Repository: twu/skjold (language: python)

Issue:
Links to pyup.io point to 404 page
Here's an example of an issue reported by skjold:
```
cryptography==38.0.1 (<39.0.0) via pyup as pyup.io-51159 found in poetry.lock

Cryptography 39.0.0 drops support for C library "LibreSSL" < 3.4, as these
versions are not receiving security support anymore.
https://pyup.io/pyup.io-51159
```
The link at the last line points to https://pyup.io/pyup.io-51159, however it should point to https://pyup.io/vulnerabilities/CVE-2021-41581/51159/

It's likely appending the `id` instead of the `more_info_path` to the domain when constructing the link.


Discussion / hints:

Fix patch:
diff --git a/src/skjold/sources/pyup.py b/src/skjold/sources/pyup.py
index 5df83b3..d41755c 100644
--- a/src/skjold/sources/pyup.py
+++ b/src/skjold/sources/pyup.py
@@ -36,7 +36,10 @@ def severity(self) -> str:
 
     @property
     def url(self) -> str:
-        return f"https://pyup.io/{self.identifier}"
+        path = self._json.get("more_info_path")
+        if not path:
+            return ""
+        return f"https://pyup.io{path}"
 
     @property
     def references(self) -> List[str]:


Test patch:
diff --git a/tests/test_pyup.py b/tests/test_pyup.py
index 8508def..828c019 100644
--- a/tests/test_pyup.py
+++ b/tests/test_pyup.py
@@ -10,7 +10,7 @@
 
 
 @pytest.mark.parametrize(
-    "name, raw",
+    "name, raw, expected_url",
     [
         (
             "package_name",
@@ -21,10 +21,25 @@
                 "specs": ["<1.0.0", ">=1.1,<1.1.1"],
                 "v": "<1.0.4,>=1.1,<1.1.1",
             },
-        )
+            "",
+        ),
+        (
+            "package_name",
+            {
+                "advisory": "Advisory summary.",
+                "cve": "CVE-200X-XXXX",
+                "id": "pyup.io-XXXXXX",
+                "specs": ["<1.0.0", ">=1.1,<1.1.1"],
+                "v": "<1.0.4,>=1.1,<1.1.1",
+                "more_info_path": "/vulnerabilities/CVE-1970-0001/12345/",
+            },
+            "https://pyup.io/vulnerabilities/CVE-1970-0001/12345/",
+        ),
     ],
 )
-def test_ensure_using_build_obj(name: str, raw: Dict[Any, Any]) -> None:
+def test_ensure_using_build_obj(
+    name: str, raw: Dict[Any, Any], expected_url: str
+) -> None:
     obj = PyUpSecurityAdvisory.using(name, raw)
     assert obj.package_name == "package_name"
     assert obj.canonical_name == "package-name"
@@ -32,7 +47,7 @@ def test_ensure_using_build_obj(name: str, raw: Dict[Any, Any]) -> None:
     assert obj.source == "pyup"
     assert obj.summary == "Advisory summary."
     assert obj.severity == "UNKNOWN"
-    assert obj.url == "https://pyup.io/pyup.io-XXXXXX"
+    assert obj.url == expected_url
     assert obj.references == []
     assert obj.vulnerable_versions == "<1.0.0,<1.1.1,>=1.1"