Repository: twu/skjold

Issue:
Inconsequent ignoring
Let's take a look at this example:

```
% echo "py==1.11.0" | skjold audit -s pyup -s gemnasium -
Warning: No advisory sources configured!

py==1.11.0 (<=1.11.0) via gemnasium as CVE-2022-42969 found in <stdin>

Regular expression Denial of Service. The py library through 1.11.0 for Python
allows remote attackers to conduct a ReDoS (Regular expression Denial of
Service) attack via a Subversion repository with crafted info data, because the
InfoSvnCommand argument is mishandled.
https://nvd.nist.gov/vuln/detail/CVE-2022-42969

https://nvd.nist.gov/vuln/detail/CVE-2022-42969
https://pypi.org/project/py
https://github.com/pytest-dev/py/blob/cb87a83960523a2367d0f19226a73aed4ce4291d/py/_path/svnurl.py#L316
https://github.com/pytest-dev/py/issues/287
--

py==1.11.0 (<=1.11.0) via pyup as pyup.io-51457 found in <stdin>

Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular
expression Denial of Service) attack via a Subversion repository with crafted
info data, because the InfoSvnCommand argument is mishandled.
https://github.com/pytest-dev/py/issues/287
https://pyup.io/vulnerabilities/CVE-2022-42969/51457/

--
Found 1 vulnerable package(s)!
```

Both `pyup` and `gemnasium` finds this package as a vulnerability. However when using `pyup` as a source, it's identified as `pyup.io-51457`, not as `CVE-2022-42969`, like it is when using `gemnasium`. Thus, if you want to ignore this finding, you will have to run `skjold ignore py CVE-2022-42969` and `skjold ignore py pyup.io-51457` to ignore both of these.

I'm guessing there's just some error (or inconsistency) in how the data from `pyup` is parsed, as the raw data contains the CVE. 

Changing this behaviour can of course break some existing ignore files, but would still be nice if it would work intuitively and following the examples on how to ignore the finding.

Discussion:

Patch:
diff --git a/src/skjold/sources/pyup.py b/src/skjold/sources/pyup.py
index d41755c..65f963a 100644
--- a/src/skjold/sources/pyup.py
+++ b/src/skjold/sources/pyup.py
@@ -24,7 +24,7 @@ class PyUpSecurityAdvisory(SecurityAdvisory):
 
     @property
     def identifier(self) -> str:
-        return self._json["id"]
+        return self._json["cve"]
 
     @property
     def source(self) -> str:


Test patch:
diff --git a/tests/test_pyup.py b/tests/test_pyup.py
index 828c019..eaa7830 100644
--- a/tests/test_pyup.py
+++ b/tests/test_pyup.py
@@ -43,7 +43,7 @@ def test_ensure_using_build_obj(
     obj = PyUpSecurityAdvisory.using(name, raw)
     assert obj.package_name == "package_name"
     assert obj.canonical_name == "package-name"
-    assert obj.identifier == "pyup.io-XXXXXX"
+    assert obj.identifier == "CVE-200X-XXXX"
     assert obj.source == "pyup"
     assert obj.summary == "Advisory summary."
     assert obj.severity == "UNKNOWN"
@@ -144,7 +144,7 @@ def pyup_advisories_with_metadata() -> Any:
       },
       "package": [{
         "advisory": "...",
-        "cve": null,
+        "cve": "CVE-200X-XXXX",
         "id": "pyup.io-XXXXX",
         "specs": [">0", "<0"],
         "v": ">0,<0"