Add tests

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>

Author: TG1999

vulnerabilities/migrations/0086_codefix.py

@@ -1,4 +1,4 @@
-# Generated by Django 4.2.16 on 2024-12-23 19:32
+# Generated by Django 4.2.16 on 2025-01-08 13:28
 
 from django.db import migrations, models
 import django.db.models.deletion
@@ -25,7 +25,7 @@ class Migration(migrations.Migration):
                     models.JSONField(
                         blank=True,
                         default=list,
-                        help_text="List of commit identifiers associated with the code change.",
+                        help_text="List of commit identifiers using VCS URLs associated with the code change.",
                     ),
                 ),
                 (
@@ -48,15 +48,15 @@ class Migration(migrations.Migration):
                     "patch",
                     models.TextField(
                         blank=True,
-                        help_text="The code change in patch format (e.g., git diff).",
+                        help_text="The code change as a patch in unified diff format.",
                         null=True,
                     ),
                 ),
                 (
                     "notes",
                     models.TextField(
                         blank=True,
-                        help_text="Additional notes or instructions about the code change.",
+                        help_text="Notes or instructions about this code change.",
                         null=True,
                     ),
                 ),
@@ -65,55 +65,58 @@ class Migration(migrations.Migration):
                     models.JSONField(
                         blank=True,
                         default=list,
-                        help_text="External references related to this code change.",
+                        help_text="URL references related to this code change.",
                     ),
                 ),
                 (
-                    "status_reviewed",
+                    "is_reviewed",
                     models.BooleanField(
-                        default=False, help_text="Indicates if the code change has been reviewed."
-                    ),
-                ),
-                (
-                    "base_commit",
-                    models.CharField(
-                        blank=True,
-                        help_text="The commit ID representing the state of the code before applying the fix or change.",
-                        max_length=255,
-                        null=True,
+                        default=False, help_text="Indicates if this code change has been reviewed."
                     ),
                 ),
                 (
                     "created_at",
                     models.DateTimeField(
                         auto_now_add=True,
-                        help_text="Timestamp indicating when the code change was created.",
+                        help_text="Timestamp indicating when this code change was created.",
                     ),
                 ),
                 (
                     "updated_at",
                     models.DateTimeField(
                         auto_now=True,
-                        help_text="Timestamp indicating when the code change was last updated.",
+                        help_text="Timestamp indicating when this code change was last updated.",
                     ),
                 ),
                 (
-                    "base_version",
+                    "affected_package_vulnerability",
+                    models.ForeignKey(
+                        help_text="The affected package version to which this code fix applies.",
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="code_fix",
+                        to="vulnerabilities.affectedbypackagerelatedvulnerability",
+                    ),
+                ),
+                (
+                    "base_package_version",
                     models.ForeignKey(
                         blank=True,
-                        help_text="The base version of the package to which this code change applies.",
+                        help_text="The base package version to which this code change applies.",
                         null=True,
                         on_delete=django.db.models.deletion.SET_NULL,
-                        related_name="base_version_codechanges",
+                        related_name="codechanges",
                         to="vulnerabilities.package",
                     ),
                 ),
                 (
-                    "package_vulnerabilities",
-                    models.ManyToManyField(
-                        help_text="The vulnerabilities fixed by this code change.",
-                        related_name="code_fixes",
-                        to="vulnerabilities.affectedbypackagerelatedvulnerability",
+                    "fixed_package_vulnerability",
+                    models.ForeignKey(
+                        blank=True,
+                        help_text="The fixing package version with this code fix",
+                        null=True,
+                        on_delete=django.db.models.deletion.SET_NULL,
+                        related_name="code_fix",
+                        to="vulnerabilities.fixingpackagerelatedvulnerability",
                     ),
                 ),
             ],

vulnerabilities/pipelines/collect_commits.py

@@ -10,13 +10,9 @@
 import re
 
 from aboutcode.pipeline import LoopProgress
-from packageurl.contrib.url2purl import url2purl
 
 from vulnerabilities.models import AffectedByPackageRelatedVulnerability
 from vulnerabilities.models import CodeFix
-from vulnerabilities.models import FixingPackageRelatedVulnerability
-from vulnerabilities.models import Package
-from vulnerabilities.models import VulnerabilityReference
 from vulnerabilities.pipelines import VulnerableCodePipeline
 
 
@@ -59,8 +55,7 @@ def collect_and_store_fix_commits(self):
             affected_by_package_related_vulnerabilities.paginated(per_page=500)
         ):
             vulnerability = apv.vulnerability
-            for reference in vulnerability.references:
-
+            for reference in vulnerability.references.all():
                 if not is_vcs_url(reference.url):
                     continue
 
@@ -171,6 +166,7 @@ def normalize_vcs_url(repo_url, vcs_tool=None):
 
     # FIXME: where these URL schemes come from??
     if repo_url.startswith(("bitbucket:", "gitlab:", "github:", "gist:")):
+        repo = repo_url.split(":")[1]
         hoster_urls = {
             "bitbucket": f"https://bitbucket.org/{repo}",
             "github": f"https://github.com/{repo}",
@@ -236,12 +232,15 @@ def is_vcs_url(repo_url):
     if not repo_url:
         return False
 
-    # 1. Match URLs with standard protocols
-    if re.match(r"^(git|ssh|http|https)://", repo_url):
+    # Define valid VCS domains
+    vcs_domains = r"(github\.com|gitlab\.com|bitbucket\.org|gist\.github\.com)"
+
+    # 1. Match URLs with standard protocols pointing to VCS domains
+    if re.match(rf"^(git|ssh|http|https)://{vcs_domains}/[\w\-.]+/[\w\-.]+", repo_url):
         return True
 
     # 2. Match SSH URLs (e.g., git@github.com:user/repo.git)
-    if re.match(r"^git@\w+\.\w+:[\w\-./]+$", repo_url):
+    if re.match(rf"^git@{vcs_domains}:[\w\-.]+/[\w\-.]+(\.git)?$", repo_url):
         return True
 
     # 3. Match shortcut syntax (e.g., github:user/repo)