Comments (8)
That is correct. But if purl will be supported in api query then it will be easily integrated with other open source tools like owasp dependency track, nexb vulnerable code
from osv.dev.
curl -X POST -d '{"package": {"purl": "pkg:maven/org.apache.struts/[email protected]"}}' https://api.osv.dev/v1/query
now works!
from osv.dev.
First, thank you for implementing PURL support! 🚀
In addition to the missing version though, the PURL syntax isn't quite right yet either (for Maven packages).
PURL is defined as:
scheme:type/namespace/name@version?qualifiers#subpath
For the maven
type, groupId
maps to namespace
and artifactId
to name
, see here. So the correct PURL for the example above would be:
pkg:maven/org.apache.struts/struts2-core
Currently, the following does not yield any results:
$ curl -X POST -d '{"package": {"purl": "pkg:maven/org.apache.struts/struts2-core"}, "version": "2.0.14"}' https://api.osv.dev/v1/query
from osv.dev.
Thanks for pointing that out @nscuro. I have a PR out and this should be fixed shortly.
Querying by PURLs that have versions in them will also come shortly.
from osv.dev.
Hi!
Could I ask where you are suggesting to add support for purls? As part of an API query?
Our thinking with our current schema and API is to keep it compatible with PURLs where we can, i.e. keeping the "ecosystem" values consistent with the ones chosen by purl ("golang", "pypi" etc), so that in most cases you can just split the PURL into the ecosystem name and the package path and version and still have it accepted by OSV.
from osv.dev.
I could not agree more!
from osv.dev.
We support PURL API requests now:
curl -X POST -d '{"package": {"purl": "pkg:maven/org.apache.struts:struts2-core"}, "version": "2.0.14"}' https://api.osv.dev/v1/query
But @VinodAnandan pointed out that we don't support package URLs with versions in them. e.g. "pkg:maven/org.apache.struts:[email protected]". Re-opening to consider this feature.
from osv.dev.
Thank you @oliverchang !!
from osv.dev.
Related Issues (20)
- Data quality issue with GO-2024-2521 HOT 4
- Data quality issue with PYSEC-2024-60 HOT 2
- Support API queries for non-enumerated ecosystems
- Missing PURL converters HOT 1
- Git analysis: relax branch computation
- Crucial bug: osv-scanner does not detect known malicious package in lockfiles HOT 8
- Update Documentation Logos for Dark Theme Consistency
- Solution hashes for a vulnerability lies in an external fork HOT 3
- Missing `Packages` for some malicious packages HOT 1
- Export an `all.zip` containing every vulnerability.
- Invalidate `last_update_date` when source changes
- Sustainably ensure invalidly prefixed records are not imported HOT 3
- The importer does not honour ignore_patterns for REST sources HOT 1
- Automate submodule updates
- Strange behaviour in PyPI versions HOT 7
- Data quality issue with GHSA-4943-9vgg-gr5r HOT 2
- Improve CVE entry management in OSV HOT 15
- Affected methods by a vulnerability HOT 1
- DSA-5649-1 missing in OSV.dev HOT 6
- Query API for Ubuntu `linux` packages HOT 7
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from osv.dev.