Repository: google/osv.dev

Issue:
Incorrect response on API call for gopkg.in/yaml.v2
I am trying to get the OSV for `gopkg.in/yaml.v2` and here is curl command
`curl -X POST -d   '{"version":"2.4.0", "package": {"name": "gopkg.in/yaml.v2", "ecosystem": "Go"}}'      "https://api.osv.dev/v1/query" `

Here is the result of the call.

But as per result, it has been fixed in `2.2.8` and in `2.2.3` , so `2.4.0` should return clean. It isn't. This is correct results I am seeing in https://deps.dev/go/gopkg.in%2Fyaml.v2/v2.4.0 

What am I doing wrong? 

Thanks

``` json
{
  "vulns": [
    {
      "id": "GO-2020-0036",
      "package": {
        "name": "gopkg.in/yaml.v2",
        "ecosystem": "Go"
      },
      "details": "Due to unbounded aliasing, a crafted YAML file can cause consumption\nof significant system resources. If parsing user supplied input, this\nmay be used as a denial of service vector.\n",
      "affects": {
        "ranges": [
          {
            "type": "SEMVER",
            "fixed": "2.2.8"
          }
        ]
      },
      "aliases": [
        "CVE-2019-11254"
      ],
      "modified": "2021-04-14T12:00:00Z",
      "published": "2021-04-14T12:00:00Z",
      "ecosystem_specific": {
        "symbols": [
          "yaml_parser_fetch_more_tokens"
        ]
      },
      "database_specific": {
        "source": "https://storage.googleapis.com/go-vulndb/gopkg.in/yaml.v2.json",
        "url": "https://go.googlesource.com/vulndb/+/refs/heads/master/reports/GO-2020-0036.yaml"
      },
      "references": [
        {
          "type": "FIX",
          "url": "https://github.com/go-yaml/yaml/pull/555"
        },
        {
          "type": "FIX",
          "url": "https://github.com/go-yaml/yaml/commit/53403b58ad1b561927d19068c655246f2db79d48"
        },
        {
          "type": "WEB",
          "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18496"
        }
      ],
      "affected": [
        {
          "package": {
            "name": "gopkg.in/yaml.v2",
            "ecosystem": "Go"
          },
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "2.2.8"
                }
              ]
            }
          ],
          "ecosystem_specific": {
            "symbols": [
              "yaml_parser_fetch_more_tokens"
            ]
          },
          "database_specific": {
            "url": "https://go.googlesource.com/vulndb/+/refs/heads/master/reports/GO-2020-0036.yaml",
            "source": "https://storage.googleapis.com/go-vulndb/gopkg.in/yaml.v2.json"
          }
        },
        {
          "package": {
            "name": "github.com/go-yaml/yaml",
            "ecosystem": "Go"
          },
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "ecosystem_specific": {
            "symbols": [
              "yaml_parser_fetch_more_tokens"
            ]
          },
          "database_specific": {
            "url": "https://go.googlesource.com/vulndb/+/refs/heads/master/reports/GO-2020-0036.yaml",
            "source": "https://storage.googleapis.com/go-vulndb/gopkg.in/yaml.v2.json"
          }
        }
      ]
    },
    {
      "id": "GO-2021-0061",
      "package": {
        "name": "gopkg.in/yaml.v2",
        "ecosystem": "Go"
      },
      "details": "Due to unbounded alias chasing, a maliciously crafted YAML file\ncan cause the system to consume significant system resources. If\nparsing user input, this may be used as a denial of service vector.\n",
      "affects": {
        "ranges": [
          {
            "type": "SEMVER",
            "fixed": "2.2.3"
          }
        ]
      },
      "modified": "2021-04-14T12:00:00Z",
      "published": "2021-04-14T12:00:00Z",
      "ecosystem_specific": {
        "symbols": [
          "decoder.unmarshal"
        ]
      },
      "database_specific": {
        "url": "https://go.googlesource.com/vulndb/+/refs/heads/master/reports/GO-2021-0061.yaml",
        "source": "https://storage.googleapis.com/go-vulndb/gopkg.in/yaml.v2.json"
      },
      "references": [
        {
          "type": "FIX",
          "url": "https://github.com/go-yaml/yaml/pull/375"
        },
        {
          "type": "FIX",
          "url": "https://github.com/go-yaml/yaml/commit/bb4e33bf68bf89cad44d386192cbed201f35b241"
        }
      ],
      "affected": [
        {
          "package": {
            "name": "gopkg.in/yaml.v2",
            "ecosystem": "Go"
          },
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "2.2.3"
                }
              ]
            }
          ],
          "ecosystem_specific": {
            "symbols": [
              "decoder.unmarshal"
            ]
          },
          "database_specific": {
            "url": "https://go.googlesource.com/vulndb/+/refs/heads/master/reports/GO-2021-0061.yaml",
            "source": "https://storage.googleapis.com/go-vulndb/gopkg.in/yaml.v2.json"
          }
        },
        {
          "package": {
            "name": "github.com/go-yaml/yaml",
            "ecosystem": "Go"
          },
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "ecosystem_specific": {
            "symbols": [
              "decoder.unmarshal"
            ]
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/go-vulndb/gopkg.in/yaml.v2.json",
            "url": "https://go.googlesource.com/vulndb/+/refs/heads/master/reports/GO-2021-0061.yaml"
          }
        }
      ]
    }
  ]
}
```


Discussion:
@oliverchang Any help would be appreciated. Thanks

Resolving patch:
diff --git a/gcp/api/server.py b/gcp/api/server.py
--- a/gcp/api/server.py
+++ b/gcp/api/server.py
@@ -131,13 +131,19 @@ def query_by_commit(commit, to_response=bug_to_response):
   return _get_bugs(bug_ids, to_response=to_response)
 
 
-def _is_semver_affected(affected_packages, version):
+def _is_semver_affected(affected_packages, package_name, ecosystem, version):
   """Returns whether or not the given version is within an affected SEMVER
   range."""
   version = semver_index.parse(version)
 
   affected = False
   for affected_package in affected_packages:
+    if package_name and package_name != affected_package.package.name:
+      continue
+
+    if ecosystem and ecosystem != affected_package.package.ecosystem:
+      continue
+
     for affected_range in affected_package.ranges:
       if affected_range.type != 'SEMVER':
         continue
@@ -154,7 +160,7 @@ def _is_semver_affected(affected_packages, version):
   return affected
 
 
-def _query_by_semver(query, version):
+def _query_by_semver(query, package_name, ecosystem, version):
   """Query by semver."""
   if not semver_index.is_valid(version):
     return []
@@ -163,8 +169,8 @@ def _query_by_semver(query, version):
       osv.Bug.semver_fixed_indexes > semver_index.normalize(version))
 
   return [
-      bug for bug in query
-      if _is_semver_affected(bug.affected_packages, version)
+      bug for bug in query if _is_semver_affected(
+          bug.affected_packages, package_name, ecosystem, version)
   ]
 
 
@@ -187,12 +193,12 @@ def query_by_version(project, ecosystem, version, to_response=bug_to_response):
   if ecosystem:
     if is_semver:
       # Ecosystem supports semver only.
-      bugs.extend(_query_by_semver(query, version))
+      bugs.extend(_query_by_semver(query, project, ecosystem, version))
     else:
       bugs.extend(_query_by_generic_version(query, version))
   else:
     # Unspecified ecosystem. Try both.
-    bugs.extend(_query_by_semver(query, version))
+    bugs.extend(_query_by_semver(query, project, ecosystem, version))
     bugs.extend(_query_by_generic_version(query, version))
 
   return [to_response(bug) for bug in bugs]


Test patch:
diff --git a/gcp/api/integration_tests.py b/gcp/api/integration_tests.py
--- a/gcp/api/integration_tests.py
+++ b/gcp/api/integration_tests.py
@@ -411,6 +411,35 @@ def test_query_semver(self):
         }))
     self.assert_results_equal({}, response.json())
 
+  def test_query_semver_multiple_package(self):
+    """Test query by SemVer (with multiple packages)."""
+    response = requests.post(
+        _api() + '/v1/query',
+        data=json.dumps({
+            'version': '2.4.0',
+            'package': {
+                'name': 'gopkg.in/yaml.v2',
+                'ecosystem': 'Go',
+            }
+        }))
+
+    self.assert_results_equal({}, response.json())
+
+    response = requests.post(
+        _api() + '/v1/query',
+        data=json.dumps({
+            'version': '2.4.0',
+            'package': {
+                'name': 'github.com/go-yaml/yaml',
+                'ecosystem': 'Go',
+            }
+        }))
+
+    response_json = response.json()
+    self.assertEqual(2, len(response_json['vulns']))
+    self.assertCountEqual(['GO-2021-0061', 'GO-2020-0036'],
+                          [vuln['id'] for vuln in response_json['vulns']])
+
 
 def print_logs(filename):
   """Print logs."""