Skip to content
Sign up

flagon-io/g1t

public
0

Commit

The advisories a repository publishes live in security_advisories: the security database already had an advisories table, its cache of OSV advisories, so the migration for repository advisories stopped at its first statement on deploy.

syntaqxcommitted Parent7ee1b9dBrowse files
2 files+8−80/2 viewed
+2−2
77 -- state: draft | published | withdrawn
88 -- severity: critical | high | medium | low
99 -- credits: JSON array of strings
10−CREATE TABLE advisories (
10+CREATE TABLE security_advisories (
1111 id TEXT PRIMARY KEY,
1212 g1tsa_id TEXT NOT NULL UNIQUE,
1313 repo_id TEXT NOT NULL,
3030 published_at TEXT,
3131 withdrawn_at TEXT
3232 );
33−CREATE INDEX advisories_repo ON advisories (repo_id, state, created_at);
33+CREATE INDEX security_advisories_repo ON security_advisories (repo_id, state, created_at);
3434
3535 -- A report: what someone told the maintainers privately, when the
3636 -- repository takes private vulnerability reports. The reporter is a
+6−6
233233 values.push(LISTED.into());
234234 let rows = self
235235 .db
236− .prepare(format!("SELECT {ADVISORY_COLUMNS} FROM advisories WHERE repo_id = ? AND state IN ({marks}) ORDER BY created_at DESC LIMIT ?"))
236+ .prepare(format!("SELECT {ADVISORY_COLUMNS} FROM security_advisories WHERE repo_id = ? AND state IN ({marks}) ORDER BY created_at DESC LIMIT ?"))
237237 .bind(&values)?
238238 .all()
239239 .await?
246246 let column = if is_g1tsa_id(id) { "g1tsa_id" } else { "id" };
247247 Ok(self
248248 .db
249− .prepare(format!("SELECT {ADVISORY_COLUMNS} FROM advisories WHERE repo_id = ? AND {column} = ?"))
249+ .prepare(format!("SELECT {ADVISORY_COLUMNS} FROM security_advisories WHERE repo_id = ? AND {column} = ?"))
250250 .bind(&[repo.repo_id.as_str().into(), id.into()])?
251251 .first::<AdvisoryRow>(None)
252252 .await?
263263 let at = rfc3339(now_ms);
264264 self.db
265265 .prepare(
266− "INSERT INTO advisories (id, g1tsa_id, repo_id, title, description, severity, cvss_vector, cvss_score, cve_id, ecosystem,
266+ "INSERT INTO security_advisories (id, g1tsa_id, repo_id, title, description, severity, cvss_vector, cvss_score, cve_id, ecosystem,
267267 package, affected_versions, patched_versions, state, credits, report_id, created_by, created_at, updated_at)
268268 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'draft', ?, ?, ?, ?, ?)",
269269 )
295295 pub async fn update_advisory(&self, repo: &RepoRow, id: &str, input: &AdvisoryInput) -> Result<()> {
296296 self.db
297297 .prepare(
298− "UPDATE advisories SET title = ?, description = ?, severity = ?, cvss_vector = ?, cvss_score = ?, cve_id = ?, ecosystem = ?,
298+ "UPDATE security_advisories SET title = ?, description = ?, severity = ?, cvss_vector = ?, cvss_score = ?, cve_id = ?, ecosystem = ?,
299299 package = ?, affected_versions = ?, patched_versions = ?, credits = ?, updated_at = ?
300300 WHERE repo_id = ? AND id = ?",
301301 )
328328 _ => "published_at = published_at",
329329 };
330330 self.db
331− .prepare(format!("UPDATE advisories SET state = ?2, updated_at = ?1, {stamp} WHERE repo_id = ?3 AND id = ?4"))
331+ .prepare(format!("UPDATE security_advisories SET state = ?2, updated_at = ?1, {stamp} WHERE repo_id = ?3 AND id = ?4"))
332332 .bind(&[at.as_str().into(), state.into(), repo.repo_id.as_str().into(), id.into()])?
333333 .run()
334334 .await?;
443443 pub async fn purge_advisories(&self, repo_id: &str) -> Result<()> {
444444 self.db
445445 .batch(vec![
446− self.db.prepare("DELETE FROM advisories WHERE repo_id = ?").bind(&[repo_id.into()])?,
446+ self.db.prepare("DELETE FROM security_advisories WHERE repo_id = ?").bind(&[repo_id.into()])?,
447447 self.db.prepare("DELETE FROM vulnerability_reports WHERE repo_id = ?").bind(&[repo_id.into()])?,
448448 ])
449449 .await?;