Merge ~alexmurray/ubuntu-cve-tracker:fix-pyright-warnings-in-check-cves into ubuntu-cve-tracker:master

[Alex Murray]

    scripts/check-cves: fix a bunch of pyright warnings

    Before:

    ± pyright scripts/check-cves
    /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves
      /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:211:32 - error: Object of type "str" is not callable (reportCallIssue)
      /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:252:37 - error: Operator "+" not supported for types "str | Unknown | list[str | Unknown] | list[Unknown]" and "Literal['/data/DSA/list']"
        Operator "+" not supported for types "list[str | Unknown]" and "Literal['/data/DSA/list']"
        Operator "+" not supported for types "list[Unknown]" and "Literal['/data/DSA/list']" (reportOperatorIssue)
      /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:326:32 - error: Argument of type "(cve: Unknown) -> Unknown" cannot be assigned to parameter "desc" of type "str" in function "convert_to_nvd"
        "function" is incompatible with "str" (reportArgumentType)
      /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:414:32 - error: Argument of type "(cve: Unknown) -> Unknown" cannot be assigned to parameter "desc" of type "str" in function "convert_to_nvd"
        "function" is incompatible with "str" (reportArgumentType)
      /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:497:32 - error: Argument of type "(c: Unknown) -> str" cannot be assigned to parameter "desc" of type "str" in function "convert_to_nvd"
        "function" is incompatible with "str" (reportArgumentType)
      /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:597:52 - error: Operator "+" not supported for types "str | Unknown | list[str | Unknown] | list[Unknown]" and "Literal['/data/CVE/list']"
        Operator "+" not supported for types "list[str | Unknown]" and "Literal['/data/CVE/list']"
        Operator "+" not supported for types "list[Unknown]" and "Literal['/data/CVE/list']" (reportOperatorIssue)
      /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:780:49 - error: Operator "not in" not supported for types "Literal['Previously triaged as ignored in Ubuntu\n\n']" and "str | None"
        Operator "not in" not supported for types "Literal['Previously triaged as ignored in Ubuntu\n\n']" and "None" (reportOperatorIssue)
      /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:786:30 - error: "split" is not a known member of "None" (reportOptionalMemberAccess)
      /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:791:27 - error: "find" is not a known member of "None" (reportOptionalMemberAccess)
      /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:791:59 - error: "find" is not a known member of "None" (reportOptionalMemberAccess)
      /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:1474:20 - error: "_exceptions" is not a known member of module "xml.sax" (reportAttributeAccessIssue)
      /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:1622:39 - error: Argument of type "_TemporaryFileWrapper[str] | TextIO" cannot be assigned to parameter "file" of type "TextIO" in function "display_cve"
        Type "_TemporaryFileWrapper[str] | TextIO" cannot be assigned to type "TextIO"
          "_TemporaryFileWrapper[str]" is incompatible with "TextIO" (reportArgumentType)
      /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:1631:39 - error: Argument of type "_TemporaryFileWrapper[str] | TextIO" cannot be assigned to parameter "file" of type "TextIO" in function "display_cve"
        Type "_TemporaryFileWrapper[str] | TextIO" cannot be assigned to type "TextIO"
          "_TemporaryFileWrapper[str]" is incompatible with "TextIO" (reportArgumentType)
    13 errors, 0 warnings, 0 informations

    After:

    ± pyright scripts/check-cves
    /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves
      /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:253:37 - error: Operator "+" not supported for types "str | Unknown | list[str | Unknown] | list[Unknown]" and "Literal['/data/DSA/list']"
        Operator "+" not supported for types "list[str | Unknown]" and "Literal['/data/DSA/list']"
        Operator "+" not supported for types "list[Unknown]" and "Literal['/data/DSA/list']" (reportOperatorIssue)
      /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:598:52 - error: Operator "+" not supported for types "str | Unknown | list[str | Unknown] | list[Unknown]" and "Literal['/data/CVE/list']"
        Operator "+" not supported for types "list[str | Unknown]" and "Literal['/data/CVE/list']"
        Operator "+" not supported for types "list[Unknown]" and "Literal['/data/CVE/list']" (reportOperatorIssue)
    2 errors, 0 warnings, 0 informations

    Signed-off-by: Alex Murray <email address hidden>

[Steve Beattie (sbeattie)]

 review approve

On Mon, Mar 18, 2024 at 01:26:18AM -0000, Alex Murray wrote:
> scripts/check-cves: fix a bunch of pyright warnings
>
> Before:
>
> ± pyright scripts/check-cves
> /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves
> /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:211:32 - error: Object of type "str" is not callable (reportCallIssue)
> /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:252:37 - error: Operator "+" not supported for types "str | Unknown | list[str | Unknown] | list[Unknown]" and "Literal['/data/DSA/list']"
> Operator "+" not supported for types "list[str | Unknown]" and "Literal['/data/DSA/list']"
> Operator "+" not supported for types "list[Unknown]" and "Literal['/data/DSA/list']" (reportOperatorIssue)
> /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:326:32 - error: Argument of type "(cve: Unknown) -> Unknown" cannot be assigned to parameter "desc" of type "str" in function "convert_to_nvd"
> "function" is incompatible with "str" (reportArgumentType)
> /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:414:32 - error: Argument of type "(cve: Unknown) -> Unknown" cannot be assigned to parameter "desc" of type "str" in function "convert_to_nvd"
> "function" is incompatible with "str" (reportArgumentType)
> /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:497:32 - error: Argument of type "(c: Unknown) -> str" cannot be assigned to parameter "desc" of type "str" in function "convert_to_nvd"
> "function" is incompatible with "str" (reportArgumentType)
> /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:597:52 - error: Operator "+" not supported for types "str | Unknown | list[str | Unknown] | list[Unknown]" and "Literal['/data/CVE/list']"
> Operator "+" not supported for types "list[str | Unknown]" and "Literal['/data/CVE/list']"
> Operator "+" not supported for types "list[Unknown]" and "Literal['/data/CVE/list']" (reportOperatorIssue)
> /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:780:49 - error: Operator "not in" not supported for types "Literal['Previously triaged as ignored in Ubuntu\n\n']" and "str | None"
> Operator "not in" not supported for types "Literal['Previously triaged as ignored in Ubuntu\n\n']" and "None" (reportOperatorIssue)
> /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:786:30 - error: "split" is not a known member of "None" (reportOptionalMemberAccess)
> /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:791:27 - error: "find" is not a known member of "None" (reportOptionalMemberAccess)
> /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:791:59 - error: "find" is not a known member of "None" (reportOptionalMemberAccess)
> /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:1474:20 - error: "_exceptions" is not a known member of module "xml.sax" (reportAttributeAccessIssue)
> /home/amurray/ubuntu/git/ubuntu-cve-tracker/scripts/check-cves:1622:39 - error: Argument of type "_Temporar...

review: Approve

diff --git a/scripts/check-cves b/scripts/check-cves
index e5cf20f..940d2d1 100755
--- a/scripts/check-cves
+++ b/scripts/check-cves
@@ -16,6 +16,7 @@
 
 
 from datetime import datetime, timezone, date as datetime_date
+import typing
 import json
 import math
 import argparse
@@ -183,7 +184,7 @@ class PercentageFile(object):
         return self.f.close()
 
 
-def convert_to_nvd(cves=[], desc=""):
+def convert_to_nvd(cves=[], desc=lambda _: ""):
     # convert to nvd format dict (like nvd json)
     nvd = {"CVE_data_type": "CVE",
            "CVE_data_format": "MITRE",
@@ -335,7 +336,7 @@ def import_debian(handler):
 class RHEL8OVALHandler(xml.sax.handler.ContentHandler):
     """SAX handler for processing rhel8 OVAL XML."""
 
-    def __init__(self, ignore=[]):
+    def __init__(self):
         # For per-hit processing
         self._curr_vuln = None
         self._curr_cve = None
@@ -513,7 +514,7 @@ def read_mbox_file(f):
         sys.exit(1)
 
     child = subprocess.Popen(['./scripts/locate_cves.py', f], stdout=subprocess.PIPE, universal_newlines=True)
-    out, err = child.communicate()
+    out, _ = child.communicate()
 
     tmp = tempfile.NamedTemporaryFile(mode='w', prefix='mbox-import_', suffix='.out', delete=False)
     tmpname = tmp.name
@@ -675,7 +676,7 @@ class CVEHandler(xml.sax.handler.ContentHandler):
             try:
                 for ref in cve["references"]["reference_data"]:
                     self.curr_refs += [(ref["refsource"], ref["name"], ref["url"])]
-            except:
+            except Exception:
                 pass
 
             # find an english description
@@ -776,6 +777,8 @@ class CVEHandler(xml.sax.handler.ContentHandler):
             self.curr_refs += [(self.curr_source, self.curr_chars, self.curr_url)]
 
     def handle_cve(self):
+        if not self.curr_cve or not self.curr_desc:
+            return
         # Skip CVEs we know about already unless this is a mistriaged CVE
         if self.curr_cve in self.cve_ignore and mistriaged_hint not in self.curr_desc:
             return
@@ -842,7 +845,7 @@ class CVEHandler(xml.sax.handler.ContentHandler):
 
         return external_subprojects
 
-    def display_cve(self, cve, file=sys.stdout, line_prefix=None, wrap_desc=False):
+    def display_cve(self, cve, file: typing.IO=sys.stdout, line_prefix=None, wrap_desc=False):
         class CVEOutput:
             def __init__(self, file, line_prefix=None):
                 self.file = file
@@ -904,7 +907,7 @@ class CVEHandler(xml.sax.handler.ContentHandler):
                         print(f'    Ubuntu: {pkg} | {answer[name][pkg]} | {name}')
             # no debian info, display possible commented ignore command when
             # using command file (i.e. wrap_desc is true)
-            if (self.debian[cve]['state'] == 'RESERVED' or self.debian[cve]['state'] == None)  and wrap_desc:
+            if (self.debian[cve]['state'] == 'RESERVED' or self.debian[cve]['state'] is None)  and wrap_desc:
                 proposed_ignore = self.ignore_suggestion.get_ignore_suggestion(self.cve_data[cve]['desc'])
                 print(f'{cve} ignore "{proposed_ignore}"')
             # debian rejected, so offer to reject by ignoring when using command file (i.e. wrap_desc is true)
@@ -1009,7 +1012,7 @@ class CVEHandler(xml.sax.handler.ContentHandler):
 
     def human_process_cve(self, cve, action='skip', reason='', package=''):
         info = ''
-        while info == "" or not info[0] in ['i', 'a', 's', 'q', 'r']:
+        while info == "" or info[0] not in ['i', 'a', 's', 'q', 'r']:
             prompt_user(f'\nA]dd (or R]epeat), I]gnore forever, S]kip for now, or Q]uit? [{action}] ')
             info = sys.stdin.readline().strip().lower()
             if info == "":
@@ -1140,7 +1143,7 @@ class CVEHandler(xml.sax.handler.ContentHandler):
                 except IndexError:
                     raise ValueError(f'Invalid add command on line {line_num}:\n{orig_line}')
 
-                if not priority in cve_lib.priorities and not priority == 'untriaged':
+                if priority not in cve_lib.priorities and not priority == 'untriaged':
                     raise ValueError(f'Invalid priority on line {line_num}:\n{orig_line}')
 
                 if os.path.exists(f'{destdir}/active/{cve}'):
@@ -1471,7 +1474,7 @@ for uri in args.uris:
             handler.parse_json(readable)
         else:
             parser.parse(readable)
-    except xml.sax._exceptions.SAXParseException as e:
+    except xml.sax.SAXParseException as e:
         print(f"\n\nWARNING: {uri} is malformed:\n{e}")
         print("Aborting", file=sys.stderr)
         sys.exit(1)
@@ -1496,7 +1499,7 @@ def refresh_cves(cve_refresh_list, full_refresh=True):
                 desc = _wrap_desc(handler.cve_data[cve]['desc'].strip())
                 public = handler.cve_data[cve]['public']
             cvsss = handler.cve_data[cve]['cvss']
-        except:
+        except Exception:
             if args.verbose:
                 print(f'{cve} not listed in XML', file=sys.stderr)