OSIDB-4929: Ignore withdrawn osv cves#1250
Conversation
📝 WalkthroughWalkthroughAdds a dedicated exception class to handle withdrawn OSV vulnerabilities with metadata. Updates the extraction and collection flow to detect withdrawn entries, raise the exception, catch it, log a warning, and skip processing without affecting other exception handling. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@collectors/osv/collectors.py`:
- Around line 167-169: The except block that catches
OSVCollectorWithdrawnException (currently logging via logger.warning and
continuing) should instead trigger reconciliation to remove or retire related
OSV snippets and any OSIDB Flaw records that are only linked to that OSV source;
update the handler in collectors.py where OSVCollectorWithdrawnException is
caught to call your existing snippet management functions (e.g., retire_snippet
or delete_snippet) and a new helper (e.g., reconcile_flaw_links) that checks
Flaw.linked_sources and deletes or marks Flaw as retired only if no other
sources remain; ensure the operation is idempotent and logged (replace the
logger.warning call with calls that perform the retire/delete and log the
actions).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 4d571d4a-cfe5-4a6a-b9f9-1cded8b08ab1
📒 Files selected for processing (2)
collectors/osv/collectors.pydocs/CHANGELOG.md
| except OSVCollectorWithdrawnException as exc: | ||
| logger.warning(str(exc)) | ||
| continue |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cd /repo && find . -name "collectors.py" -path "*/osv/*" | head -5Repository: RedHatProductSecurity/osidb
Length of output: 126
🏁 Script executed:
cd /repo && wc -l collectors/osv/collectors.pyRepository: RedHatProductSecurity/osidb
Length of output: 126
🏁 Script executed:
cd /repo && sed -n '150,180p' collectors/osv/collectors.pyRepository: RedHatProductSecurity/osidb
Length of output: 126
🏁 Script executed:
cd /repo && sed -n '280,310p' collectors/osv/collectors.pyRepository: RedHatProductSecurity/osidb
Length of output: 126
🏁 Script executed:
cd /repo && sed -n '1,50p' collectors/osv/collectors.pyRepository: RedHatProductSecurity/osidb
Length of output: 126
🏁 Script executed:
find . -name "collectors.py" -path "*/osv/*"Repository: RedHatProductSecurity/osidb
Length of output: 101
🏁 Script executed:
wc -l collectors/osv/collectors.pyRepository: RedHatProductSecurity/osidb
Length of output: 103
🏁 Script executed:
sed -n '150,180p' collectors/osv/collectors.pyRepository: RedHatProductSecurity/osidb
Length of output: 1578
🏁 Script executed:
sed -n '280,310p' collectors/osv/collectors.pyRepository: RedHatProductSecurity/osidb
Length of output: 1043
🏁 Script executed:
sed -n '33,50p' collectors/osv/collectors.pyRepository: RedHatProductSecurity/osidb
Length of output: 593
🏁 Script executed:
grep -n "class OSVCollectorWithdrawnException" collectors/osv/collectors.pyRepository: RedHatProductSecurity/osidb
Length of output: 122
🏁 Script executed:
grep -n "save_snippet_and_flaw" collectors/osv/collectors.pyRepository: RedHatProductSecurity/osidb
Length of output: 271
🏁 Script executed:
sed -n '1,100p' collectors/osv/collectors.pyRepository: RedHatProductSecurity/osidb
Length of output: 3828
🏁 Script executed:
sed -n '210,270p' collectors/osv/collectors.pyRepository: RedHatProductSecurity/osidb
Length of output: 2925
🏁 Script executed:
grep -n "external_id" collectors/osv/collectors.pyRepository: RedHatProductSecurity/osidb
Length of output: 275
🏁 Script executed:
grep -rn "external_id" collectors/ --include="*.py" | grep -i "osv" | head -20Repository: RedHatProductSecurity/osidb
Length of output: 1036
🏁 Script executed:
grep -rn "withdrawn" . --include="*.py" | head -20Repository: RedHatProductSecurity/osidb
Length of output: 795
🏁 Script executed:
grep -rn "withdrawn" collectors/osv/ --include="*.py"Repository: RedHatProductSecurity/osidb
Length of output: 779
🏁 Script executed:
grep -rn "delete\|cleanup\|retire" collectors/osv/ --include="*.py" | head -20Repository: RedHatProductSecurity/osidb
Length of output: 53
🏁 Script executed:
find . -name "*.md" -o -name "*.txt" -o -name "*.rst" | xargs grep -l "withdrawn\|cleanup" 2>/dev/null | head -10Repository: RedHatProductSecurity/osidb
Length of output: 90
🏁 Script executed:
sed -n '140,200p' collectors/osv/collectors.pyRepository: RedHatProductSecurity/osidb
Length of output: 3055
🏁 Script executed:
cat ./docs/CHANGELOG.md | grep -A 5 -B 5 "withdrawn"Repository: RedHatProductSecurity/osidb
Length of output: 497
🏁 Script executed:
sed -n '150,160p' collectors/osv/collectors.pyRepository: RedHatProductSecurity/osidb
Length of output: 650
🏁 Script executed:
rg "def.*collect" collectors/osv/collectors.py -A 3Repository: RedHatProductSecurity/osidb
Length of output: 334
🏁 Script executed:
grep -rn "Snippet.objects" collectors/osv/collectors.pyRepository: RedHatProductSecurity/osidb
Length of output: 228
🏁 Script executed:
grep -rn "delete\|remove" osidb/models.py | grep -i "snippet\|flaw" | head -10Repository: RedHatProductSecurity/osidb
Length of output: 119
🏁 Script executed:
grep -rn "update_or_create" collectors/osv/collectors.py -A 2 -B 2Repository: RedHatProductSecurity/osidb
Length of output: 706
🏁 Script executed:
cat collectors/osv/tests/test_collectors.py | head -100Repository: RedHatProductSecurity/osidb
Length of output: 3440
🏁 Script executed:
grep -rn "class Snippet" osidb/ --include="*.py" | head -5Repository: RedHatProductSecurity/osidb
Length of output: 235
🏁 Script executed:
find . -path "*/osidb/models*" -name "*.py"Repository: RedHatProductSecurity/osidb
Length of output: 937
🏁 Script executed:
fd "models" osidb/ --type f -name "*.py" | head -10Repository: RedHatProductSecurity/osidb
Length of output: 301
🏁 Script executed:
sed -n '1,100p' osidb/models/snippet.pyRepository: RedHatProductSecurity/osidb
Length of output: 3572
🏁 Script executed:
grep -A 20 "class Snippet" osidb/models/snippet.pyRepository: RedHatProductSecurity/osidb
Length of output: 718
🏁 Script executed:
grep -rn "source.*OSV" collectors/osv/ --include="*.py" | head -10Repository: RedHatProductSecurity/osidb
Length of output: 301
🏁 Script executed:
grep -rn "external_id" osidb/models/snippet.pyRepository: RedHatProductSecurity/osidb
Length of output: 796
🏁 Script executed:
grep -B 5 -A 10 "withdrawn" collectors/osv/collectors.py | tail -30Repository: RedHatProductSecurity/osidb
Length of output: 1139
🏁 Script executed:
grep -rn "delete\|cascade" osidb/models/snippet.pyRepository: RedHatProductSecurity/osidb
Length of output: 160
Remove or retire OSV snippets when records become withdrawn upstream.
When an OSV record transitions from active to withdrawn, the current code skips processing the withdrawn record but does not reconcile previously ingested snippets and their linked flaws. This leaves stale vulnerability data in OSIDB that contradicts the upstream withdrawal status. Either delete/retire matching OSV snippets (and their flaws if not linked to other sources) on detection of withdrawal, or document the intentional decision to retain historical data.
Also applies to: 291-293
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@collectors/osv/collectors.py` around lines 167 - 169, The except block that
catches OSVCollectorWithdrawnException (currently logging via logger.warning and
continuing) should instead trigger reconciliation to remove or retire related
OSV snippets and any OSIDB Flaw records that are only linked to that OSV source;
update the handler in collectors.py where OSVCollectorWithdrawnException is
caught to call your existing snippet management functions (e.g., retire_snippet
or delete_snippet) and a new helper (e.g., reconcile_flaw_links) that checks
Flaw.linked_sources and deletes or marks Flaw as retired only if no other
sources remain; ensure the operation is idempotent and logged (replace the
logger.warning call with calls that perform the retire/delete and log the
actions).
1 participant
OSV_collector is failing because some CVE's don't have a details field.
Here are some Cases
https://rhcorporate.sumologic.com/log-search/create?id=KrKOonAPFb0MuA06kmYGTB4xC4fhOPqVmGBK3aPN
After some investigation all of this cases besides having no
Details" field had awithdrawnfield.In an informal refinement it was agreed that maybe we should ignore this cases.
Alternative fix:
Instead of ignoring ALL cases it could just ignore the ones without Details.
Closes OSIDB-4929