Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

pip-audit json structure has changed #9770

Closed
remote-tty1 opened this issue Mar 18, 2024 · 5 comments
Closed

pip-audit json structure has changed #9770

remote-tty1 opened this issue Mar 18, 2024 · 5 comments
Labels

Comments

@remote-tty1
Copy link

Bug description
Defectdojo v2.32.1 is unable to import pip-audit v2.7.2 json output ( --format json)
old json structure (the one you use with unit tests https://github.com/DefectDojo/django-DefectDojo/blob/master/unittests/scans/pip_audit/many_vulns.json):

[
    {
        "name": "component_name",
        "version": "component_version",
        "vulns": [
            {
                "id": "vuln_id",
                "fix_versions": [
                    "vuln_fix_versions"
                ],
                "description": "vuln_description"
            }
        ]
    }
]

new json structure:

{
  "dependencies": [
    {
      "name": "component_name",
      "version": "component_version",
      "vulns": [
        {
          "id": "vuln_id",
          "fix_versions": [
            "vuln_fix_versions"
          ],
          "aliases": [
            "vuln_aliases"
          ],
          "description": "vuln_description"
        }
      ]
    }
  ],
  "fixes": []
}

I've attached a patch file with a fix that worked for me
pip-audit_parser.patch.txt

Hope it helps

@manuel-sommer
Copy link
Contributor

Do you have a complete scan result?

@remote-tty1
Copy link
Author

Sure, I've attached a sample

sample.json

@grendel513
Copy link
Contributor

@remote-tty1 This pull request which has already been merged to dev takes care of this issue: #9696

@manuel-sommer
Copy link
Contributor

Ah nice @grendel513, was about to help here.

@manuel-sommer
Copy link
Contributor

Can we close this?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants