Drop OSVDB-derived OSV aliases from the rubygem data sources

The rubysec advisory data carries references to the defunct OSVDB
database in its osvdb field, and both the ruby importer and the v2
ruby importer pipeline turned these into OSV-<number> aliases. These
are not public aliases and the prefix collides with the modern
OSV.dev namespace.

Remove the code that imports them and add a data migration deleting
the previously imported ones from both the Alias and AdvisoryAlias
tables. Genuine OSV.dev identifiers (OSV-<year>-<number>, with two
hyphens) are preserved by the migration regex.

Closes #2421

Signed-off-by: Manoj Gowda <manojgowdabs18@gmail.com>

Author: MGpromax

vulnerabilities/importers/ruby.py

@@ -145,8 +145,6 @@ def get_aliases(record) -> [str]:
     aliases = []
     if record.get("cve"):
         aliases.append("CVE-{}".format(record.get("cve")))
-    if record.get("osvdb"):
-        aliases.append("OSV-{}".format(record.get("osvdb")))
     if record.get("ghsa"):
         aliases.append("GHSA-{}".format(record.get("ghsa")))
     return aliases

vulnerabilities/migrations/0143_remove_rubygem_osvdb_aliases.py

@@ -0,0 +1,42 @@
+#
+# Copyright (c) nexB Inc. and others. All rights reserved.
+# VulnerableCode is a trademark of nexB Inc.
+# SPDX-License-Identifier: Apache-2.0
+# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
+# See https://github.com/aboutcode-org/vulnerablecode for support or download.
+# See https://aboutcode.org for more information about nexB OSS projects.
+#
+
+from django.db import migrations
+
+"""
+Remove the OSVDB-derived aliases imported from the rubygem data sources.
+
+The rubysec advisory data contains legacy references to the defunct OSVDB
+database, and these were imported as "OSV-<number>" aliases. These are not
+public aliases and collide with the modern OSV.dev namespace. Genuine
+OSV.dev identifiers have the form "OSV-<year>-<number>" with two hyphens
+and are preserved.
+
+See https://github.com/aboutcode-org/vulnerablecode/issues/2421
+"""
+
+OSVDB_DERIVED_ALIAS_REGEX = r"^OSV-\d+$"
+
+
+def remove_osvdb_aliases(apps, schema_editor):
+    Alias = apps.get_model("vulnerabilities", "Alias")
+    Alias.objects.filter(alias__regex=OSVDB_DERIVED_ALIAS_REGEX).delete()
+
+    AdvisoryAlias = apps.get_model("vulnerabilities", "AdvisoryAlias")
+    AdvisoryAlias.objects.filter(alias__regex=OSVDB_DERIVED_ALIAS_REGEX).delete()
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("vulnerabilities", "0142_advisoryv2_is_curation_advisoryv2_resolves_todos"),
+    ]
+
+    operations = [
+        migrations.RunPython(remove_osvdb_aliases, reverse_code=migrations.RunPython.noop),
+    ]

vulnerabilities/pipelines/v2_importers/ruby_importer.py

@@ -202,8 +202,6 @@ def get_aliases(record) -> [str]:
     aliases = []
     if record.get("cve"):
         aliases.append("CVE-{}".format(record.get("cve")))
-    if record.get("osvdb"):
-        aliases.append("OSV-{}".format(record.get("osvdb")))
     if record.get("ghsa"):
         aliases.append("GHSA-{}".format(record.get("ghsa")))
     return aliases

vulnerabilities/tests/test_data/ruby/CVE-2010-1330-expected.json

@@ -1,7 +1,6 @@
 {
   "aliases": [
-    "CVE-2010-1330",
-    "OSV-77297"
+    "CVE-2010-1330"
   ],
   "summary": "CVE-2010-1330 jruby: XSS in the regular expression engine when processing invalid UTF-8 byte sequences\nThe regular expression engine in JRuby before 1.4.1, when $KCODE is set to 'u', does not properly handle characters immediately after a UTF-8 character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted string.",
   "affected_packages": [
@@ -29,4 +28,4 @@
   "date_published": "2010-04-26T00:00:00+00:00",
   "weaknesses": [],
   "url": "https://github.com/rubysec/ruby-advisory-db"
-}
+}