Skip to content

cravex2-reachability: Expose reachability in API - #2213

Open
ziadhany wants to merge 50 commits into
aboutcode-org:mainfrom
ziadhany:expose-symbol-reachability
Open

cravex2-reachability: Expose reachability in API #2213
ziadhany wants to merge 50 commits into
aboutcode-org:mainfrom
ziadhany:expose-symbol-reachability

Conversation

@ziadhany

@ziadhany ziadhany commented Aug 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

API Code to expose reachability results for analyze symbol reachability pipeline

Issue:

API Response Examples

  • GET /api/projects/{project_id}/packages/
API output Example 
{
    "count": 1,
    "next": null,
    "previous": null,
    "results": [
        {
            "purl": "pkg:pypi/b2sdk@1.14.0",
            "type": "pypi",
            "namespace": "",
            "name": "b2sdk",
            "version": "1.14.0",
            "qualifiers": "",
            "subpath": "",
            "tag": "",
            "primary_language": "Python",
            "description": "Backblaze B2 SDK\n# B2 Python SDK\n&nbsp;[![Continuous Integration](https://github.com/Backblaze/b2-sdk-python/workflows/Continuous%20Integration/badge.svg)](https://github.com/Backblaze/b2-sdk-python/actions?query=workflow%3A%22Continuous+Integration%22)&nbsp;[![License](https://img.shields.io/pypi/l/b2sdk.svg?label=License)](https://pypi.python.org/pypi/b2)&nbsp;[![python versions](https://img.shields.io/pypi/pyversions/b2sdk.svg?label=python%20versions)](https://pypi.python.org/pypi/b2sdk)&nbsp;[![PyPI version](https://img.shields.io/pypi/v/b2sdk.svg?label=PyPI%20version)](https://pypi.python.org/pypi/b2sdk)&nbsp;[![Docs](https://readthedocs.org/projects/b2-sdk-python/badge/?version=master)](https://b2-sdk-python.readthedocs.io/en/master/)\n\n\n\nThis repository contains a client library and a few handy utilities for easy access to all of the capabilities of B2 Cloud Storage.\n\n[B2 command-line tool](https://github.com/Backblaze/B2_Command_Line_Tool) is an example of how it can be used to provide command-line access to the B2 service, but there are many possible applications (including FUSE filesystems, storage backend drivers for backup applications etc).\n\n# Documentation\n\nThe latest documentation is available on [Read the Docs](https://b2-sdk-python.readthedocs.io).\n\n# Installation\n\nThe sdk can be installed with:\n\n    pip install b2sdk\n\n# Version policy\n\nb2sdk follows [Semantic Versioning](https://semver.org/) policy, so in essence the version number is MAJOR.MINOR.PATCH (for example 1.2.3) and:\n- we increase MAJOR version when we make incompatible API changes\n- we increase MINOR version when we add functionality in a backwards-compatible manner, and\n- we increase PATCH version when we make backwards-compatible bug fixes (unless someone relies on the undocumented behavior of a fixed bug)\n\nTherefore when setting up b2sdk as a dependency, please make sure to match the version appropriately, for example you could put this in your `requirements.txt` to make sure your code is compatible with the `b2sdk` version your user will get from pypi:\n\n```\nb2sdk>=0.0.0,<1.0.0\n```\n\n# Release History\n\nPlease refer to the [changelog](CHANGELOG.md).\n\n# Developer Info\n\nPlease see our [contributing guidelines](CONTRIBUTING.md).",
            "notes": "",
            "release_date": null,
            "parties": [
                {
                    "url": null,
                    "name": "Backblaze, Inc.",
                    "role": "author",
                    "type": "person",
                    "email": "support@backblaze.com"
                }
            ],
            "keywords": [
                "backblaze b2 cloud storage",
                "Development Status :: 5 - Production/Stable",
                "Intended Audience :: Developers",
                "Topic :: Software Development :: Libraries",
                "Programming Language :: Python :: 3",
                "Programming Language :: Python :: 3.5",
                "Programming Language :: Python :: 3.6",
                "Programming Language :: Python :: 3.7",
                "Programming Language :: Python :: 3.8",
                "Programming Language :: Python :: 3.9",
                "Programming Language :: Python :: 3.10"
            ],
            "homepage_url": "https://github.com/Backblaze/b2-sdk-python",
            "download_url": "",
            "bug_tracking_url": "",
            "code_view_url": "",
            "vcs_url": "",
            "repository_homepage_url": "https://pypi.org/project/b2sdk",
            "repository_download_url": "https://pypi.org/packages/source/b/b2sdk/b2sdk-1.14.0.tar.gz",
            "api_data_url": "https://pypi.org/pypi/b2sdk/1.14.0/json",
            "size": null,
            "md5": "",
            "sha1": "",
            "sha256": "",
            "sha512": "",
            "copyright": "",
            "holder": "",
            "declared_license_expression": "mit",
            "declared_license_expression_spdx": "MIT",
            "license_detections": [
                {
                    "matches": [
                        {
                            "score": 100.0,
                            "matcher": "1-spdx-id",
                            "end_line": 1,
                            "rule_url": null,
                            "from_file": "codebase/b2sdk-1.14.0/b2sdk.egg-info/PKG-INFO",
                            "start_line": 1,
                            "matched_text": "MIT",
                            "match_coverage": 100.0,
                            "matched_length": 1,
                            "rule_relevance": 100,
                            "rule_identifier": "spdx-license-identifier-mit-5da48780aba670b0860c46d899ed42a0f243ff06",
                            "license_expression": "mit",
                            "license_expression_spdx": "MIT"
                        }
                    ],
                    "identifier": "mit-a822f434-d61f-f2b1-c792-8b8cb9e7b9bf",
                    "license_expression": "mit",
                    "license_expression_spdx": "MIT"
                },
                {
                    "matches": [
                        {
                            "score": 100.0,
                            "matcher": "1-hash",
                            "end_line": 1,
                            "rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/pypi_mit_license.RULE",
                            "from_file": "codebase/b2sdk-1.14.0/b2sdk.egg-info/PKG-INFO",
                            "start_line": 1,
                            "matched_text": "- 'License :: OSI Approved :: MIT License'",
                            "match_coverage": 100.0,
                            "matched_length": 5,
                            "rule_relevance": 100,
                            "rule_identifier": "pypi_mit_license.RULE",
                            "license_expression": "mit",
                            "license_expression_spdx": "MIT"
                        }
                    ],
                    "identifier": "mit-24a5293c-14d7-5403-efac-1a8b7532c0e8",
                    "license_expression": "mit",
                    "license_expression_spdx": "MIT"
                }
            ],
            "other_license_expression": "",
            "other_license_expression_spdx": "",
            "other_license_detections": [],
            "extracted_license_statement": "license: MIT\nclassifiers:\n  - 'License :: OSI Approved :: MIT License'\n",
            "compliance_alert": "",
            "notice_text": "",
            "source_packages": [],
            "extra_data": {
                "license_file": "LICENSE"
            },
            "package_uid": "pkg:pypi/b2sdk@1.14.0?uuid=f38257f7-ded4-4955-b6c2-9d6e22e3aa47",
            "is_private": false,
            "is_virtual": false,
            "datasource_ids": [
                "pypi_editable_egg_pkginfo"
            ],
            "datafile_paths": [
                "b2sdk-1.14.0/b2sdk.egg-info/PKG-INFO"
            ],
            "file_references": [],
            "missing_resources": [],
            "modified_resources": [],
            "affected_by_vulnerabilities": [
                {
                    "aliases": [
                        "CVE-2022-23651",
                        "GHSA-p867-fxfr-ph2w"
                    ],
                    "summary": "b2-sdk-python is a python library to access cloud storage provided by backblaze. Linux and Mac releases of the SDK version 1.14.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a time-of-check-time-of-use (TOCTOU) race condition. SDK users of the SqliteAccountInfo format are vulnerable while users of the InMemoryAccountInfo format are safe. The SqliteAccountInfo saves API keys (and bucket name-to-id mapping) in a local database file ($XDG_CONFIG_HOME/b2/account_info, ~/.b2_account_info or a user-defined path). When first created, the file is world readable and is (typically a few milliseconds) later altered to be private to the user. If the directory containing the file is readable by a local attacker then during the brief period between file creation and permission modification, a local attacker can race to open the file and maintain a handle to it. This allows the local attacker to read the contents after the file after the sensitive information has been saved to it. Consumers of this SDK who rely on it to save data using SqliteAccountInfo class should upgrade to the latest version of the SDK. Those who believe a local user might have opened a handle using this race condition, should remove the affected database files and regenerate all application keys. Users should upgrade to b2-sdk-python 1.14.1 or later.",
                    "risk_score": 2.6,
                    "ssvc_trees": [
                        {
                            "vector": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T14:10:06Z/",
                            "options": [
                                {
                                    "Exploitation": "none"
                                },
                                {
                                    "Automatable": "no"
                                },
                                {
                                    "Technical Impact": "partial"
                                },
                                {
                                    "Mission Prevalence": "minimal"
                                },
                                {
                                    "Public Well-being Impact": "material"
                                },
                                {
                                    "Mission & Well-being": "medium"
                                }
                            ],
                            "decision": "Track",
                            "source_url": "https://github.com/cisagov/vulnrichment/blob/develop/2022/23xxx/CVE-2022-23651.json"
                        }
                    ],
                    "advisory_id": "PYSEC-2022-33",
                    "advisory_uid": "pypa/b2sdk/PYSEC-2022-33",
                    "is_reachable": "yes",
                    "resource_url": "http://public.vulnerablecode.io/advisories/pypa/b2sdk/PYSEC-2022-33",
                    "exploitability": 0.5,
                    "fixed_in_patches": [
                        {
                            "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                            "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                        }
                    ],
                    "fixed_by_packages": [
                        "pkg:pypi/b2sdk@1.14.1"
                    ],
                    "weighted_severity": 5.1,
                    "introduced_in_patches": [],
                    "reachability_analysis": [
                        {
                            "patch": {
                                "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                                "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                            },
                            "is_reachable": "yes",
                            "tool_details": [
                                {
                                    "is_exact": true,
                                    "is_called": true,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "SqliteAccountInfo._create_database",
                                    "reachable_from": [
                                        "SqliteAccountInfo._validate_database"
                                    ]
                                },
                                {
                                    "is_exact": true,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "SqliteAccountInfo",
                                    "reachable_from": []
                                }
                            ],
                            "fixed_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database"
                            ],
                            "resource_path": "b2sdk-1.14.0/b2sdk/account_info/sqlite_account_info.py",
                            "vulnerable_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database"
                            ]
                        },
                        {
                            "patch": {
                                "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                                "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                            },
                            "is_reachable": "yes",
                            "tool_details": [
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo._create_database",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": false,
                                    "is_called": true,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo",
                                    "reachable_from": [
                                        "test_upload_url_concurrency"
                                    ]
                                }
                            ],
                            "fixed_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database",
                                "SqliteAccountInfo._create_database.fd"
                            ],
                            "resource_path": "b2sdk-1.14.0/b2sdk/account_info/test_upload_url_concurrency.py",
                            "vulnerable_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database"
                            ]
                        },
                        {
                            "patch": {
                                "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                                "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                            },
                            "is_reachable": "unknown",
                            "tool_details": [
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo._create_database",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo",
                                    "reachable_from": []
                                }
                            ],
                            "fixed_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database",
                                "SqliteAccountInfo._create_database.fd"
                            ],
                            "resource_path": "b2sdk-1.14.0/b2sdk/session.py",
                            "vulnerable_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database"
                            ]
                        },
                        {
                            "patch": {
                                "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                                "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                            },
                            "is_reachable": "unknown",
                            "tool_details": [
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "SqliteAccountInfo",
                                    "reachable_from": []
                                }
                            ],
                            "fixed_symbols": [
                                "SqliteAccountInfo"
                            ],
                            "resource_path": "b2sdk-1.14.0/b2sdk/v0/account_info.py",
                            "vulnerable_symbols": [
                                "SqliteAccountInfo"
                            ]
                        },
                        {
                            "patch": {
                                "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                                "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                            },
                            "is_reachable": "unknown",
                            "tool_details": [
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo._create_database",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo",
                                    "reachable_from": []
                                }
                            ],
                            "fixed_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database",
                                "SqliteAccountInfo._create_database.fd"
                            ],
                            "resource_path": "b2sdk-1.14.0/b2sdk/v0/__init__.py",
                            "vulnerable_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database"
                            ]
                        },
                        {
                            "patch": {
                                "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                                "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                            },
                            "is_reachable": "unknown",
                            "tool_details": [
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "SqliteAccountInfo",
                                    "reachable_from": []
                                }
                            ],
                            "fixed_symbols": [
                                "SqliteAccountInfo"
                            ],
                            "resource_path": "b2sdk-1.14.0/b2sdk/v1/account_info.py",
                            "vulnerable_symbols": [
                                "SqliteAccountInfo"
                            ]
                        },
                        {
                            "patch": {
                                "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                                "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                            },
                            "is_reachable": "unknown",
                            "tool_details": [
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo._create_database",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo",
                                    "reachable_from": []
                                }
                            ],
                            "fixed_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database",
                                "SqliteAccountInfo._create_database.fd"
                            ],
                            "resource_path": "b2sdk-1.14.0/b2sdk/v1/__init__.py",
                            "vulnerable_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database"
                            ]
                        },
                        {
                            "patch": {
                                "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                                "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                            },
                            "is_reachable": "unknown",
                            "tool_details": [
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo._create_database",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo",
                                    "reachable_from": []
                                }
                            ],
                            "fixed_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database",
                                "SqliteAccountInfo._create_database.fd"
                            ],
                            "resource_path": "b2sdk-1.14.0/b2sdk/v1/session.py",
                            "vulnerable_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database"
                            ]
                        },
                        {
                            "patch": {
                                "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                                "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                            },
                            "is_reachable": "unknown",
                            "tool_details": [
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo._create_database",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo",
                                    "reachable_from": []
                                }
                            ],
                            "fixed_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database",
                                "SqliteAccountInfo._create_database.fd"
                            ],
                            "resource_path": "b2sdk-1.14.0/b2sdk/_v3/__init__.py",
                            "vulnerable_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database"
                            ]
                        },
                        {
                            "patch": {
                                "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                                "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                            },
                            "is_reachable": "yes",
                            "tool_details": [
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo._create_database",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": false,
                                    "is_called": true,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo",
                                    "reachable_from": [
                                        "main"
                                    ]
                                }
                            ],
                            "fixed_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database",
                                "SqliteAccountInfo._create_database.fd"
                            ],
                            "resource_path": "b2sdk-1.14.0/doc/sqlite_account_info_schema.py",
                            "vulnerable_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database"
                            ]
                        },
                        {
                            "patch": {
                                "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                                "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                            },
                            "is_reachable": "yes",
                            "tool_details": [
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo._create_database",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": false,
                                    "is_called": true,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo",
                                    "reachable_from": [
                                        "sqlite_account_info_factory",
                                        "sqlite_account_info_factory.get_account_info"
                                    ]
                                }
                            ],
                            "fixed_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database",
                                "SqliteAccountInfo._create_database.fd"
                            ],
                            "resource_path": "b2sdk-1.14.0/test/unit/account_info/fixtures.py",
                            "vulnerable_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database"
                            ]
                        },
                        {
                            "patch": {
                                "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                                "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                            },
                            "is_reachable": "yes",
                            "tool_details": [
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo._create_database",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": false,
                                    "is_called": true,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo",
                                    "reachable_from": [
                                        "TestSqliteAccountInfo._make_sqlite_account_info"
                                    ]
                                },
                                {
                                    "is_exact": true,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "TestSqliteAccountInfo.setUp",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": true,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "TestSqliteAccountInfo",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": true,
                                    "is_called": true,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "TestSqliteAccountInfo._make_sqlite_account_info",
                                    "reachable_from": [
                                        "TestSqliteAccountInfo._make_info",
                                        "TestSqliteAccountInfo.test_account_info_env_var_overrides_xdg_config_home",
                                        "TestSqliteAccountInfo.test_uses_default",
                                        "TestSqliteAccountInfo.test_uses_existing_file_and_ignores_xdg",
                                        "TestSqliteAccountInfo.test_uses_xdg_config_home"
                                    ]
                                },
                                {
                                    "is_exact": true,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "TestSqliteAccountInfo.test_uses_default.account_info",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": true,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "TestSqliteAccountInfo.test_uses_default",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": true,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "TestSqliteAccountInfo.test_uses_xdg_config_home.account_info",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": true,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "TestSqliteAccountInfo.test_uses_xdg_config_home",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": true,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "TestSqliteAccountInfo.test_uses_existing_file_and_ignores_xdg",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": true,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "TestSqliteAccountInfo.test_uses_existing_file_and_ignores_xdg.account_info",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": true,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "TestSqliteAccountInfo.test_account_info_env_var_overrides_xdg_config_home.account_info",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": true,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "TestSqliteAccountInfo.test_account_info_env_var_overrides_xdg_config_home",
                                    "reachable_from": []
                                }
                            ],
                            "fixed_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database",
                                "SqliteAccountInfo._create_database.fd",
                                "TestSqliteAccountInfo",
                                "TestSqliteAccountInfo._make_sqlite_account_info",
                                "TestSqliteAccountInfo.setUp",
                                "TestSqliteAccountInfo.test_account_info_env_var_overrides_xdg_config_home",
                                "TestSqliteAccountInfo.test_account_info_env_var_overrides_xdg_config_home.account_info",
                                "TestSqliteAccountInfo.test_uses_default",
                                "TestSqliteAccountInfo.test_uses_default.account_info",
                                "TestSqliteAccountInfo.test_uses_existing_file_and_ignores_xdg",
                                "TestSqliteAccountInfo.test_uses_existing_file_and_ignores_xdg.account_info",
                                "TestSqliteAccountInfo.test_uses_xdg_config_home",
                                "TestSqliteAccountInfo.test_uses_xdg_config_home.account_info"
                            ],
                            "resource_path": "b2sdk-1.14.0/test/unit/account_info/test_account_info.py",
                            "vulnerable_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database",
                                "TestSqliteAccountInfo",
                                "TestSqliteAccountInfo._make_sqlite_account_info",
                                "TestSqliteAccountInfo.setUp",
                                "TestSqliteAccountInfo.test_account_info_env_var_overrides_xdg_config_home",
                                "TestSqliteAccountInfo.test_account_info_env_var_overrides_xdg_config_home.account_info",
                                "TestSqliteAccountInfo.test_uses_default",
                                "TestSqliteAccountInfo.test_uses_default.account_info",
                                "TestSqliteAccountInfo.test_uses_existing_file_and_ignores_xdg",
                                "TestSqliteAccountInfo.test_uses_existing_file_and_ignores_xdg.account_info",
                                "TestSqliteAccountInfo.test_uses_xdg_config_home",
                                "TestSqliteAccountInfo.test_uses_xdg_config_home.account_info"
                            ]
                        }
                    ]
                }
            ]
        }
    ]
}
  • GET /api/projects/{project_id}/dependencies/
API output Example 
{
    "aliases": [
        "CVE-2026-54279"
    ],
    "summary": "aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence\n### Summary\n\nHost-only cookies that are saved with ``CookieJar.save()`` and then restored later with ``CookieJar.load()`` lose their host-only status.\n\n### Impact\n\nHost-only cookies that have been loaded from disk may get sent to subdomains that previously should have been disallowed.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2",
    "risk_score": 0.6,
    "ssvc_trees": [
        {
            "vector": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-06-22T17:40:17Z/",
            "options": [
                {
                    "Exploitation": "none"
                },
                {
                    "Automatable": "no"
                },
                {
                    "Technical Impact": "partial"
                },
                {
                    "Mission Prevalence": "minimal"
                },
                {
                    "Public Well-being Impact": "material"
                },
                {
                    "Mission & Well-being": "medium"
                }
            ],
            "decision": "Track",
            "source_url": "https://github.com/cisagov/vulnrichment/blob/develop/2026/54xxx/CVE-2026-54279.json"
        }
    ],
    "advisory_id": "GHSA-2fqr-mr3j-6wp8",
    "advisory_uid": "github_osv/GHSA-2fqr-mr3j-6wp8",
    "resource_url": "http://public.vulnerablecode.io/advisories/github_osv/GHSA-2fqr-mr3j-6wp8",
    "exploitability": 0.5,
    "fixed_in_patches": [],
    "fixed_by_packages": [
        "pkg:pypi/aiohttp@3.14.1"
    ],
    "weighted_severity": 1.2,
    "introduced_in_patches": []
},
{
    "aliases": [
        "CVE-2022-33124"
    ],
    "summary": "Withdrawn: Denial of Service in aiohttp\n## Withdrawn\nThis advisory has been withdrawn because the maintainers of aiohttp and multiple third parties disputed the validity of the issue. There is not sufficient evidence for the claims in the original report.\n\n## Original Description\naiohttp v3.8.1 was discovered to contain an invalid IPv6 URL which can lead to a Denial of Service (DoS).",
    "risk_score": 2.5,
    "ssvc_trees": [],
    "advisory_id": "GHSA-rwqr-c348-m5wr",
    "advisory_uid": "github_osv/GHSA-rwqr-c348-m5wr",
    "resource_url": "http://public.vulnerablecode.io/advisories/github_osv/GHSA-rwqr-c348-m5wr",
    "exploitability": 0.5,
    "fixed_in_patches": [],
    "fixed_by_packages": [],
    "weighted_severity": 5.0,
    "introduced_in_patches": []
},
{
    "aliases": [
        "CVE-2026-54275",
        "GHSA-4m7w-qmgq-4wj5"
    ],
    "summary": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request server_hostname parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check. This vulnerability is fixed in 3.14.1.",
    "risk_score": 3.4,
    "ssvc_trees": [
        {
            "vector": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-06-22T17:27:21Z/",
            "options": [
                {
                    "Exploitation": "none"
                },
                {
                    "Automatable": "no"
                },
                {
                    "Technical Impact": "partial"
                },
                {
                    "Mission Prevalence": "minimal"
                },
                {
                    "Public Well-being Impact": "material"
                },
                {
                    "Mission & Well-being": "medium"
                }
            ],
            "decision": "Track",
            "source_url": "https://github.com/cisagov/vulnrichment/blob/develop/2026/54xxx/CVE-2026-54275.json"
        }
    ],
    "advisory_id": "PYSEC-2026-237",
    "advisory_uid": "pypa/aiohttp/PYSEC-2026-237",
    "resource_url": "http://public.vulnerablecode.io/advisories/pypa/aiohttp/PYSEC-2026-237",
    "exploitability": 0.5,
    "fixed_in_patches": [],
    "fixed_by_packages": [
        "pkg:pypi/aiohttp@3.14.1"
    ],
    "weighted_severity": 6.8,
    "introduced_in_patches": []
},
{
    "aliases": [
        "CVE-2024-23829",
        "GHSA-8qpw-xqxj-h4r2"
    ],
    "summary": "aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against injection of additional requests. Additionally, validation could trigger exceptions that were not handled consistently with processing of other malformed input.  Being more lenient than internet standards require could, depending on deployment environment, assist in request smuggling. The unhandled exception could cause excessive resource consumption on the application server and/or its logging facilities. This vulnerability exists due to an incomplete fix for CVE-2023-47627. Version 3.9.2 fixes this vulnerability.",
    "risk_score": 3.1,
    "ssvc_trees": [
        {
            "vector": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-02-01T16:40:08Z/",
            "options": [
                {
                    "Exploitation": "none"
                },
                {
                    "Automatable": "yes"
                },
                {
                    "Technical Impact": "partial"
                },
                {
                    "Mission Prevalence": "minimal"
                },
                {
                    "Public Well-being Impact": "material"
                },
                {
                    "Mission & Well-being": "medium"
                }
            ],
            "decision": "Track",
            "source_url": "https://github.com/cisagov/vulnrichment/blob/develop/2024/23xxx/CVE-2024-23829.json"
        }
    ],
    "advisory_id": "PYSEC-2024-26",
    "advisory_uid": "pypa/aiohttp/PYSEC-2024-26",
    "is_reachable": "yes",
    "resource_url": "http://public.vulnerablecode.io/advisories/pypa/aiohttp/PYSEC-2024-26",
    "exploitability": 0.5,
    "fixed_in_patches": [
        {
            "vcs_url": "https://github.com/aio-libs/aiohttp",
            "commit_hash": "33ccdfb0a12690af5bb49bda2319ec0907fa7827"
        }
    ],
    "fixed_by_packages": [
        "pkg:pypi/aiohttp@3.9.2"
    ],
    "weighted_severity": 6.2,
    "introduced_in_patches": [],
    "reachability_analysis": [
        {
            "patch": {
                "vcs_url": "https://github.com/aio-libs/aiohttp",
                "commit_hash": "33ccdfb0a12690af5bb49bda2319ec0907fa7827"
            },
            "is_reachable": "yes",
            "tool_details": [
                {
                    "is_exact": false,
                    "is_called": true,
                    "is_defined": false,
                    "is_imported": true,
                    "symbol_name": "HttpRequestParser.parse_message",
                    "reachable_from": []
                }
            ],
            "fixed_symbols": [
                "HttpRequestParser.parse_message"
            ],
            "resource_path": "vulnerablecode-20.10/vulnerabilities/importers/debian_oval.py",
            "vulnerable_symbols": [
                "HttpRequestParser.parse_message"
            ]
        }
    ]
}

ziadhany added 30 commits July 30, 2026 02:34
@ziadhany
feat: create pipeline for symbol reachability and add a test
83c10db 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Add more test for reachability and remove redundant code
3799817 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Fix the format bugs and refactor the code
a3d1172 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Fix a bug in the import-catching logic and add a test.
2f0dd84 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Add an unidiff dependency to pyproject.toml file
00fd333 
Fix the test

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Add unidiff to package dependencies to parse diff text
5da2504 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Simplify the pipeline logic for imports and direct calls
1e7f76e 
Add missing logic for imports

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Add support for vulnerablecode reachability option
4428760 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Fix the tests and improve patch extraction performance
e1a2d86 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Fix formatting and linting errors.
bf94dc8 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Refactor and simplify reachability pipeline
c9b9652 
Improve pipeline structure

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Add support for getting constant symbols
c4ac68a 
Fix formating tests

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Remove dead code and fix the test
d48c18e 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Add unidiff to uv.lock
6686487 
Fix formating

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Add support constant to resource analyzer
a9076d3 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Fix formating error in CI
2867643 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Add a test for constants, extract_imports,collect_imports
4b48ad7 
Fix a bug in extract_imports

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Remove dependency and copy only the required file
1bd85f6 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Update pipeline/functions name
09cfa5f 
Get the dependency file and included in the PR

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Fix CI files format
3bfa88a 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Fix a typo in patch.py.ABOUT file
ec79943 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Remove the unidiff library from the dependencies
3744e2f 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Skip the test for macOS
128bfdf 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Allow reachability by default, for vulnerabilities pipeline
7258c0a 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Update the code to difflib instead of unidiff library
27de9f1 
Fix a bug related to constant detections and add a test

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Add missing docs
0d85586 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Fix a typo in build_symbol_metadata function signature
c9414ea 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Add a test for java
566ae1e 
Add end-to-end test for Symbol Reachability pipeline

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Simplify the pipeline test
9985d21 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Generate advisory reachability report ( last step in the pipeline )
131b68e 
Split pipeline to multiple steps
Build resource_index once per resource

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
ziadhany added 12 commits August 14, 2026 06:07
@ziadhany
Fix Formating and typo in test
69fc18a 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Remove type hints
98350c3 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Remove type hints for symbols.py
9ce4cb4 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Remove type hints for symbols.py
c89c64e 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Fix a typo in docs
2f14b41 
Simplify add_reachability_report function
Remove type hints for symbols.py

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Fix a typo in error message
9a6d42d 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Update the pipeline to clone repo once and collect_patch_symbols for …
01f294c 
…all commits

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Try to fix bug in vulnerability dependency
40f5f0e 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Update the pipeline to have a test for resource_patch_matcher
a36ba7e 
Refactor the pipeline

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Add more test and make sure it returns not if there is no match
30c8c7b 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Move Business logic to be in the pipes reachability file
fa64a68 
Fix the test

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
fix is_reachable to be by default NOT_REACHABLE
8f83785 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
ziadhany force-pushed the expose-symbol-reachability branch from 54f5628 to 361cad8 Compare August 25, 2026 11:54
@ziadhany
Fix a bug related to vulnerability dependency reachability pipeline
07ed82f 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Update function docs
e65b8e2 
Add resource filter based on language we support

Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Fix a typo
40d80ca 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Fix format error
83200b3 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Add a LoopProgress to the most time-consuming functions
bdc627e 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Expose reachability in API for package and dependency
3535486 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Simplify the apply_reachability_to_packages_and_dependencies function
fc917e7 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
Resolve merge conflict
96a827a 
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
@ziadhany
ziadhany force-pushed the expose-symbol-reachability branch from 361cad8 to 96a827a Compare August 28, 2026 21:44
@ziadhany
ziadhany requested a review from keshav-space August 28, 2026 21:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@keshav-space keshav-space Awaiting requested review from keshav-space

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ziadhany