Merge ~litios/ubuntu-cve-tracker:aliases-in-triage into ubuntu-cve-tracker:master

[David Fernandez Gonzalez]

When doing triage, if aliases are found for a subproject, add the right entries when creating the CVE.

Also in triage, include the aliases when trying to find the package in a subproject (in the "possibly affected" section)

[David Fernandez Gonzalez (litios)]

Planning to do this the other way around, removing.

Unmerged commits

1f47bb0... by David Fernandez Gonzalez on 2023-02-10

Enable the use of aliases when triagging + include aliases in active_edit

diff --git a/scripts/active_edit b/scripts/active_edit
index 9d0df27..244f741 100755
--- a/scripts/active_edit
+++ b/scripts/active_edit
@@ -128,9 +128,14 @@ def _add_pkg(p, fp, fixed, parent, embargoed):
             print('%s_%s: %s' % (rel, p, state), file=fp)
         # TODO: figure out how to store subproject details for embargoed CVEs
         elif not embargoed:
-            # add this to subprojects for rel
-            with open(os.path.join(cve_lib.get_external_subproject_cve_dir(rel), cve), "a") as f:
-                print('%s_%s: %s' % (rel, p, state), file=f)
+            if 'aliases' in source[rel][p]:
+                for alias in source[rel][p]['aliases']:
+                    with open(os.path.join(cve_lib.get_external_subproject_cve_dir(rel), cve), "a") as f:
+                        print('%s_%s: %s' % (rel, alias, state), file=f)
+            else:
+                # add this to subprojects for rel
+                with open(os.path.join(cve_lib.get_external_subproject_cve_dir(rel), cve), "a") as f:
+                    print('%s_%s: %s' % (rel, p, state), file=f)
 
 def add_pkg(p, fp, fixed, parent, embargoed):
     # skip packages which don't actually exist in any release
diff --git a/scripts/check-cves b/scripts/check-cves
index 6eb9f58..093f58f 100755
--- a/scripts/check-cves
+++ b/scripts/check-cves
@@ -76,6 +76,17 @@ common_words = ['an', 'and', 'context', 'file', 'modules', 'the', 'when']
 allsrcs.difference_update(set(common_words))
 allsrcs.update(set(cve_lib.package_db.keys()))
 
+aliases = {}
+for rel in source:
+    aliases[rel] = {}
+    for pkg in source[rel]:
+        if 'aliases' in source[rel][pkg]:
+            for alias in source[rel][pkg]['aliases']:
+                if alias not in aliases[rel]:
+                    aliases[rel][alias] = [pkg]
+                else:
+                    aliases[rel][alias].append(pkg)
+
 built_using_map = None
 
 destdir = "."
@@ -887,6 +898,10 @@ class CVEHandler(xml.sax.handler.ContentHandler):
                 for hint in software_hints_from_cve_description:
                     if hint in source[subproject] and hint not in common_words:
                         external_subprojects.setdefault(subproject, set()).add(hint)
+                    elif hint in aliases[subproject] and hint not in common_words:
+                        for pkg in aliases[subproject][hint]:
+                            if pkg in source[subproject]:
+                                external_subprojects.setdefault(subproject, set()).add(hint + ' (alias)')
         return external_subprojects
 
     def display_cve(self, cve, file=sys.stdout, line_prefix=None, wrap_desc=False):