anon-iclr-submission/benchname-bug-localization huggingface dataset:
Repository: nexb/vulnerablecode
Issue: NPM import skips unfixed vulnerabilities

The [function that resolves version ranges](https://github.com/nexB/vulnerablecode/blob/58e3ff375f8cc40cd457aa8130a5ac5264e29cd7/vulnerabilities/scraper/npm.py#L68) for affected and fixed packages returns empty lists if either of the ranges is empty. For unfixed vulnerabilities, the fixed version range is usually empty, hence no data for those will be added.

Changed files:
vulnerabilities/scraper/npm.py

diff --git a/vulnerabilities/scraper/npm.py b/vulnerabilities/scraper/npm.py
index f6196e5..bb52018 100644
--- a/vulnerabilities/scraper/npm.py
+++ b/vulnerabilities/scraper/npm.py
@@ -58,25 +58,22 @@ def get_all_versions(package_name):
 
 def extract_versions(package_name, aff_version_range, fixed_version_range):
     """
-    Seperate list of affected versions and fixed versions from all versions
-    using the ranges specified
+    Seperate list of affected versions and unaffected versions from all versions
+    using the ranges specified.
     """
-    # FIXME This skips unfixed vulnerabilities
-    if aff_version_range == '' or fixed_version_range == '':
-        return ([], [])
-
     aff_spec = semantic_version.NpmSpec(remove_spaces(aff_version_range))
     fix_spec = semantic_version.NpmSpec(remove_spaces(fixed_version_range))
     all_ver = get_all_versions(package_name)
     aff_ver = []
     fix_ver = []
+    # Unaffected version is that version which  is in the fixed_version_range
+    # or which is absent in the aff_version_range
     for ver in all_ver:
         cur_version = semantic_version.Version(ver)
-        if cur_version in aff_spec:
-            aff_ver.append(ver)
+        if cur_version in fix_spec or cur_version not in aff_spec:
+            fix_ver.append(ver)
         else:
-            if cur_version in fix_spec:
-                fix_ver.append(ver)
+            aff_ver.append(ver)
 
     return (aff_ver, fix_ver)
Repository: nexb/vulnerablecode
Issue: Import github fails due to an "-class.-jw.util.version.Version-" Invalid Version

This in in the relation the issue I have for import github and the version "-class.-jw.util.version.Version-" not validated

I found that it is related to the changes made on April 7th, particularly here: nexB/vulnerablecode@6f643c9. Commits before April 6th have not this issue.

I did install the requirements, did the git pull rebuild the image, tried in a new directory with fresh code, tried to twist the code but my hacks just make a mess :) .. Even tried to improve the regex but was creating a mess again.

By skipping(hacking) that original version I got many other Invalid versions like: 2.0.1rc2-git Which seems to be valid
https://www.versioneye.com/Python/nltk/2.0.1rc2-git

Will keep posting here my findings :)

Changed files:
vulnerabilities/importers/github.py

diff --git a/vulnerabilities/importers/github.py b/vulnerabilities/importers/github.py
index 9e45c93..6da7a57 100644
--- a/vulnerabilities/importers/github.py
+++ b/vulnerabilities/importers/github.py
@@ -82,6 +82,69 @@ query = """
         }
         """
 
+# See https://github.com/nexB/vulnerablecode/issues/486
+IGNORE_VERSIONS = {
+    "0.1-bulbasaur",
+    "0.1-charmander",
+    "0.3m1",
+    "0.3m2",
+    "0.3m3",
+    "0.3m4",
+    "0.3m5",
+    "0.4m1",
+    "0.4m2",
+    "0.4m3",
+    "0.4m4",
+    "0.4m5",
+    "0.5m1",
+    "0.5m2",
+    "0.5m3",
+    "0.5m4",
+    "0.5m5",
+    "0.6m1",
+    "0.6m2",
+    "0.6m3",
+    "0.6m4",
+    "0.6m5",
+    "0.6m6",
+    "0.7.10p1",
+    "0.7.11p1",
+    "0.7.11p2",
+    "0.7.11p3",
+    "0.8.1p1",
+    "0.8.3p1",
+    "0.8.4p1",
+    "0.8.4p2",
+    "0.8.6p1",
+    "0.8.7p1",
+    "0.9-doduo",
+    "0.9-eevee",
+    "0.9-fearow",
+    "0.9-gyarados",
+    "0.9-horsea",
+    "0.9-ivysaur",
+    "2013-01-21T20:33:09+0100",
+    "2013-01-23T17:11:52+0100",
+    "2013-02-01T20:50:46+0100",
+    "2013-02-02T19:59:03+0100",
+    "2013-02-02T20:23:17+0100",
+    "2013-02-08T17:40:57+0000",
+    "2013-03-27T16:32:26+0100",
+    "2013-05-09T12:47:53+0200",
+    "2013-05-10T17:55:56+0200",
+    "2013-05-14T20:16:05+0200",
+    "2013-06-01T10:32:51+0200",
+    "2013-07-19T09:11:08+0000",
+    "2013-08-12T21:48:56+0200",
+    "2013-09-11T19-27-10",
+    "2013-12-23T17-51-15",
+    "2014-01-12T15-52-10",
+    "2.0.1rc2-git",
+    "3.0.0b3-",
+    "3.0b6dev-r41684",
+    "-class.-jw.util.version.Version-",
+}
+
 
 class GitHubTokenError(Exception):
     pass
@@ -265,9 +328,11 @@ class GitHubAPIDataSource(DataSource):
         affected_versions = []
         unaffected_versions = []
         for version in all_versions:
+            if version in IGNORE_VERSIONS:
+                continue
+
             if version_class(version) in version_range:
                 affected_versions.append(version)
             else:
                 unaffected_versions.append(version)
-
         return (affected_versions, unaffected_versions)
Repository: opentrons/opentrons
Issue: Ephemeral Pipette instances in control endpoints triggering asserts

## overview

When Pipette objects are created for use in control endpoints, any objects created after the first on each mount will trigger an assertion that a Pipette already exists on that mount. This state should be cleared when the Pipette object is destroyed.

## steps to reproduce

Call the `/robot/home` endpoint twice with the same mount

Changed files:
api/tests/opentrons/server/test_control_endpoints.py, api/opentrons/robot/robot.py, api/opentrons/server/endpoints/control.py

diff --git a/api/opentrons/robot/robot.py b/api/opentrons/robot/robot.py
index 71d4091995..b761856469 100755
--- a/api/opentrons/robot/robot.py
+++ b/api/opentrons/robot/robot.py
@@ -423,6 +423,11 @@ class Robot(object):
             point=(_x, _y, _z)
         )
 
+    def remove_instrument(self, mount):
+        instrument = self._instruments.pop(mount, None)
+        if instrument:
+            self.poses = pose_tracker.remove(self.poses, instrument)
+
     def add_warning(self, warning_msg):
         """
         Internal. Add a runtime warning to the queue.
diff --git a/api/opentrons/server/endpoints/control.py b/api/opentrons/server/endpoints/control.py
index ff6bd97550..e0a00e6a32 100644
--- a/api/opentrons/server/endpoints/control.py
+++ b/api/opentrons/server/endpoints/control.py
@@ -254,6 +254,7 @@ async def home(request):
             if mount in ['left', 'right']:
                 pipette = instruments.Pipette(mount=mount)
                 pipette.home()
+                robot.remove_instrument(mount)
 
                 status = 200
                 message = "Pipette on {} homed successfully.".format(mount)
diff --git a/api/tests/opentrons/server/test_control_endpoints.py b/api/tests/opentrons/server/test_control_endpoints.py
index 50650f6b76..c4a5fb35cd 100644
--- a/api/tests/opentrons/server/test_control_endpoints.py
+++ b/api/tests/opentrons/server/test_control_endpoints.py
@@ -131,9 +131,11 @@ async def test_home_pipette(virtual_smoothie_env, loop, test_client):
         'mount': 'left'}
 
     res = await cli.post('/robot/home', json=test_data)
-
     assert res.status == 200
 
+    res2 = await cli.post('/robot/home', json=test_data)
+    assert res2.status == 200
+
 
 async def test_home_robot(virtual_smoothie_env, loop, test_client):
Repository: keylime/keylime
Issue: keylime_ima_emulator incorrectly parses token from ascii_runtime_measurements

# Environment
 * OS / version: Fedora 29
 * Processor architecture:  N/A
 * TPM Manufacturer: emulator
 * Keylime version:  master

# Description 

When running the keylime_ima_emulator service, some lines of `ascii_runtime_measurements` are incorrectly split.

`Feb 27 16:59:43 localhost.localdomain tpm_with_ima.sh[11418]: ERROR: invalid measurement list file line: -7ec02e /usr/bin/ping-`

`cat /sys/kernel/security/ima/ascii_runtime_measurements |grep ping
10 4b0fdc36d52e6a084ecd9600511eb1b8899e0f66 ima-ng sha1:d1703bf9c9d7094c0e9aacb634002ffa447ec02e /usr/bin/ping
`

This is from the following code:

https://github.com/keylime/python-keylime/blob/aa2b55aba7eab9924b3b0f23cd07bbf726ef30ac/keylime/ima_emulator_adapter.py#L41-L49

## Expected behavior vs. actual behavior 

## Steps to reproduce problem
1.  Run  keylime_ima_emulator against the following list:

https://paste.fedoraproject.org/paste/RggKZQRNMbL2qCWTrmqisA




Changed files:
keylime/ima_emulator_adapter.py

diff --git a/keylime/ima_emulator_adapter.py b/keylime/ima_emulator_adapter.py
index 913b325..16c12ec 100644
--- a/keylime/ima_emulator_adapter.py
+++ b/keylime/ima_emulator_adapter.py
@@ -24,6 +24,7 @@ import common
 import select
 import time
 import hashlib
+import itertools
 from tpm_abstract import *
 import tpm_obj
 
@@ -33,9 +34,7 @@ tpm = tpm_obj.getTPM(need_hw_tpm=True)
 def ml_extend(ml,position,searchHash=None):
     f = open(ml,'r')
     
-    f.seek(position)
-    rest = f.read()
-    lines = rest.split('\\n')
+    lines = itertools.islice(f, position, None)
     runninghash = ima.START_HASH
     
     for line in lines:
@@ -47,6 +46,7 @@ def ml_extend(ml,position,searchHash=None):
         if len(tokens)<5:
             print "ERROR: invalid measurement list file line: -%s-"%(line)
             return position
+        position += 1
         
         # get the filename roughly
         path = str(line[line.rfind(tokens[3])+len(tokens[3])+1:])        
@@ -63,14 +63,13 @@ def ml_extend(ml,position,searchHash=None):
         else:
             runninghash = hashlib.sha1(runninghash+template_hash.decode('hex')).digest()
             if runninghash.encode('hex') == searchHash:
-                position = rest.index(line)+len(line)
                 print "Located last IMA file updated: %s"%(path)
                 return position
     
     if searchHash is not None:
         raise Exception("Unable to find current measurement list position, Resetting the TPM emulator may be neccesary")
     
-    return position+len(rest)
+    return position
 
 
 def main(argv=sys.argv):
Repository: keylime/keylime
Issue: script_vtpm_register.py wrong ext

`script_vtpm_register.py` should have a `.sh`  extension (its a bash script).

Changed files:
scripts/script_vtpm_register.py

diff --git a/scripts/script_vtpm_register.py b/scripts/script_vtpm_register.sh
similarity index 93%
rename from scripts/script_vtpm_register.py
rename to scripts/script_vtpm_register.sh
index c2d9394..afb21da 100755
--- a/scripts/script_vtpm_register.py
+++ b/scripts/script_vtpm_register.sh
@@ -4,20 +4,20 @@
 #
 # DISTRIBUTION STATEMENT A. Approved for public release: distribution unlimited.
 #
-# This material is based upon work supported by the Assistant Secretary of Defense for 
-# Research and Engineering under Air Force Contract No. FA8721-05-C-0002 and/or 
-# FA8702-15-D-0001. Any opinions, findings, conclusions or recommendations expressed in 
-# this material are those of the author(s) and do not necessarily reflect the views of the 
+# This material is based upon work supported by the Assistant Secretary of Defense for
+# Research and Engineering under Air Force Contract No. FA8721-05-C-0002 and/or
+# FA8702-15-D-0001. Any opinions, findings, conclusions or recommendations expressed in
+# this material are those of the author(s) and do not necessarily reflect the views of the
 # Assistant Secretary of Defense for Research and Engineering.
 #
 # Copyright 2015 Massachusetts Institute of Technology.
 #
 # The software/firmware is provided to you on an As-Is basis
 #
-# Delivered to the US Government with Unlimited Rights, as defined in DFARS Part 
-# 252.227-7013 or 7014 (Feb 2014). Notwithstanding any copyright notice, U.S. Government 
-# rights in this work are defined by DFARS 252.227-7013 or DFARS 252.227-7014 as detailed 
-# above. Use of this work other than as specifically authorized by the U.S. Government may 
+# Delivered to the US Government with Unlimited Rights, as defined in DFARS Part
+# 252.227-7013 or 7014 (Feb 2014). Notwithstanding any copyright notice, U.S. Government
+# rights in this work are defined by DFARS 252.227-7013 or DFARS 252.227-7014 as detailed
+# above. Use of this work other than as specifically authorized by the U.S. Government may
 # violate any copyrights that exist in this work.
 #
 ##########################################################################################
@@ -26,8 +26,8 @@
 # Make sure our children don't get loose
 function finish() {
     echo "*** Killing all jobs"
-    pkill -9 -P $$ 
-    sleep 2 
+    pkill -9 -P $$
+    sleep 2
 #    kill -9 $(jobs -p)
 #    kill -9 $(jobs -rp)
 #    wait $(jobs -rp) 2>/dev/null
Repository: keylime/keylime
Issue: If cfssl is configured and not installed, the registrar fails with a misleading message

Should you run with the default `ca_implementation = cfssl` and not have golang and cfssl installed, the registrar will fail with the following message:

```
2019-09-25 12:33:18.918 - keylime.cloudverifier_common - INFO - Setting up TLS...

Traceback (most recent call last):

  File "/usr/local/bin/keylime_registrar", line 11, in <module>

    load_entry_point('keylime==1.2', 'console_scripts', 'keylime_registrar')()

  File "/usr/local/lib/python3.7/site-packages/keylime-1.2-py3.7.egg/keylime/registrar.py", line 36, in main

    registrar_common.start(config.getint('general', 'registrar_tls_port'),config.getint('general', 'registrar_port'),config.get('registrar', 'db_filename'))

  File "/usr/local/lib/python3.7/site-packages/keylime-1.2-py3.7.egg/keylime/registrar_common.py", line 434, in start

    generatedir='reg_ca')

  File "/usr/local/lib/python3.7/site-packages/keylime-1.2-py3.7.egg/keylime/cloud_verifier_common.py", line 136, in init_mtls

    raise Exception("It appears that the verifier has not yet created a CA and certificates, please run the verifier first")

Exception: It appears that the verifier has not yet created a CA and certificates, please run the verifier first
```

This is after the verifier has run with the following:

```
2019-09-25 12:32:48.812 - keylime.cloudverifier - INFO - Starting Cloud Verifier (tornado) on port 8881, use <Ctrl-C> to stop
2019-09-25 12:32:48.813 - keylime.cloudverifier_common - INFO - Setting up TLS...
2019-09-25 12:32:48.813 - keylime.cloudverifier_common - INFO - Generating a new CA in /var/lib/keylime/cv_ca and a client certificate for connecting
2019-09-25 12:32:48.814 - keylime.cloudverifier_common - INFO - use keylime_ca -d /var/lib/keylime/cv_ca to manage this CA
2019-09-25 12:32:48.814 - keylime.cloudverifier_common - WARNING - CAUTION: using default password for CA, please set private_key_pw to a strong password
```

We basically need to check somehow, that if cfssl is configured as the ca implementation, is it even present to be used?

Changed files:
keylime/ca_impl_cfssl.py

diff --git a/keylime/ca_impl_cfssl.py b/keylime/ca_impl_cfssl.py
index b512665..117c171 100644
--- a/keylime/ca_impl_cfssl.py
+++ b/keylime/ca_impl_cfssl.py
@@ -25,6 +25,8 @@ import subprocess
 import socket
 import time
 import requests
+import shutil
+import sys
 
 try:
     import simplejson as json
@@ -68,6 +70,9 @@ def post_cfssl(params,data):
     return response.json()
 
 def start_cfssl(cmdline=""):
+    if shutil.which("cfssl") is None:
+        logger.error("cfssl binary not found in the path.  Please install cfssl or change the setting \\"ca_implementation\\" in keylime.conf")
+        sys.exit(1)
     global cfsslproc
     cmd = "cfssl serve -loglevel=1 %s "%cmdline
     env = os.environ.copy()