From ec314d342f097a3a2c7fade38a13cfa33c722f0a Mon Sep 17 00:00:00 2001 From: Ashutosh Panda Date: Sun, 18 Oct 2026 21:53:27 +0530 Subject: [PATCH] Map the OSV crates.io ecosystem to cargo OSV calls the Rust ecosystem crates.io, but the ecosystem mapping only had a cargo key, so every crates.io affected entry was skipped. Signed-off-by: Ashutosh Panda --- vulnerabilities/importers/osv.py | 1 + vulnerabilities/tests/test_osv.py | 30 ++++++++++++++++++++++++++++++ 2 files changed, 31 insertions(+) diff --git a/vulnerabilities/importers/osv.py b/vulnerabilities/importers/osv.py index 3658c57b3..c1d5968a8 100644 --- a/vulnerabilities/importers/osv.py +++ b/vulnerabilities/importers/osv.py @@ -45,6 +45,7 @@ "go": "golang", "hex": "hex", "cargo": "cargo", + "crates.io": "cargo", } diff --git a/vulnerabilities/tests/test_osv.py b/vulnerabilities/tests/test_osv.py index e7505510c..43395a324 100644 --- a/vulnerabilities/tests/test_osv.py +++ b/vulnerabilities/tests/test_osv.py @@ -24,6 +24,7 @@ from vulnerabilities.importers.osv import get_published_date from vulnerabilities.importers.osv import get_references from vulnerabilities.importers.osv import get_severities +from vulnerabilities.importers.osv import parse_advisory_data from vulnerabilities.severity_systems import SCORING_SYSTEMS @@ -397,3 +398,32 @@ def test_get_fixed_versions4(self): ) assert results == [SemverVersion("6.5.4")] + + def test_parse_advisory_data_with_crates_io_ecosystem(self): + raw_data = { + "id": "GHSA-xxxx-yyyy-zzzz", + "summary": "test advisory", + "affected": [ + { + "package": {"name": "serde", "ecosystem": "crates.io"}, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [{"introduced": "0"}, {"fixed": "1.0.0"}], + } + ], + } + ], + } + + advisory = parse_advisory_data( + raw_data=raw_data, + supported_ecosystems=["cargo"], + advisory_url="https://example.org/advisory", + ) + results = advisory.affected_packages + + assert len(results) == 1 + assert results[0].package == PackageURL(type="cargo", name="serde") + assert str(results[0].package) == "pkg:cargo/serde" + assert results[0].fixed_version == SemverVersion("1.0.0")