Add CloudVulnDB importer for issue #1511 by Tednoob17 · Pull Request #2217 · aboutcode-org/vulnerablecode

Tednoob17 · 2026-03-15T00:34:57Z

Add a new v2 importer for CloudVulnDB from the public RSS feed.
Changes

add CloudVulnDB importe pipline
register the importer
add dedicated tests and fixture
ignore setup.py during pytest collection in Docker

Testing

dedicated CloudVulnDB tests passs in Docker
importer registration verified
Docker test collection no longer fails on setup.py

Copilot

Pull request overview

Adds a new v2 importer pipeline to ingest CloudVulnDB advisories from the project’s public RSS feed, along with fixtures/tests and a pytest configuration tweak to avoid collecting setup.py in Docker.

Changes:

Introduce CloudVulnDBImporterPipeline and RSS parsing helpers to produce AdvisoryDataV2.
Register the new importer in the central importer registry.
Add unit tests + RSS/XML and expected JSON fixtures; update pytest addopts to ignore setup.py during collection.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
vulnerabilities/pipelines/v2_importers/cloudvulndb_importer.py	New CloudVulnDB RSS-based v2 importer implementation.
vulnerabilities/importers/init.py	Registers the new v2 importer in the importers registry.
vulnerabilities/tests/test_cloudvulndb_importer.py	Adds unit tests for RSS parsing and advisory ID derivation.
vulnerabilities/tests/test_data/cloudvulndb/cloudvulndb_rss_mock.xml	Adds mocked RSS fixture for deterministic tests.
vulnerabilities/tests/test_data/cloudvulndb/expected_cloudvulndb_advisory_output1.json	Adds expected `AdvisoryDataV2` JSON output fixture.
pyproject.toml	Updates pytest collection options to ignore `setup.py`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

- add CloudVulnDB v2 importer pipeline - register importer - add tests and fixtures - ignore setup.py in pytest collection Signed-off-by: Tedsig42 <teddams047@gmail.com>

Signed-off-by: Tedsig42 <teddams047@gmail.com>

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com> Signed-off-by: Tedsig42 <teddams047@gmail.com>

…lines Signed-off-by: ziad hany <ziadhany2016@gmail.com> Signed-off-by: Tedsig42 <teddams047@gmail.com>

Signed-off-by: ziad hany <ziadhany2016@gmail.com> Signed-off-by: Tedsig42 <teddams047@gmail.com>

Resolves: aboutcode-org#2186 Signed-off-by: Keshav Priyadarshi <git@keshav.space> Signed-off-by: Tedsig42 <teddams047@gmail.com>

Signed-off-by: Keshav Priyadarshi <git@keshav.space> Signed-off-by: Tedsig42 <teddams047@gmail.com>

Resolves: aboutcode-org#2187 Signed-off-by: Keshav Priyadarshi <git@keshav.space> Signed-off-by: Tedsig42 <teddams047@gmail.com>

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com> Signed-off-by: Tedsig42 <teddams047@gmail.com>

ziadhany

@Tednoob17 please fix the DOC, and see the comments below.

ziadhany · 2026-05-13T11:49:49Z

+        cloudvulndb_importer_v2.CloudVulnDBImporterPipeline,
+        enisa_nisa_importer_v2.EnisaNisaImporterPipeline,


To keep things simple, let’s split each importer into its own PR, but we should first double-check the quality of the data source.

ziadhany · 2026-05-13T11:53:34Z

+filterwarnings = [
+  "ignore:Unknown config option.*:pytest.PytestConfigWarning",
+  'ignore:datetime.datetime.utcfromtimestamp\(\) is deprecated and scheduled for removal.*:DeprecationWarning',
+  "ignore:CheckConstraint.check is deprecated in favor of `.condition`.:django.utils.deprecation.RemovedInDjango60Warning",
+]
+
 addopts = [
    "-rfExXw",
    "--strict-markers",
    "--doctest-modules",
+    # setup.py imports setuptools which is not available in the Docker runtime
+    # image. Without this, pytest (which uses python_files = "*.py") tries to
+    # collect setup.py as a test module and crashes with exit code 2.
+    "--ignore=setup.py",
+  "--ignore-glob=*/setup.py",


Please avoid unrelated changes to the PR.

ziadhany · 2026-05-13T12:00:20Z

+class EnisaNisaImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
+    """
+    Import ENISA NISA advisories with tolerant parsing.
+
+    This parser is intentionally fault-tolerant: when version mapping is malformed,
+    it still extracts CVE aliases and URL references.
+    """
+
+    pipeline_id = "enisa_nisa_importer_v2"
+    spdx_license_expression = "CC-BY-4.0"
+    license_url = "https://www.enisa.europa.eu/"
+    repo_url = "git+https://github.com/enisaeu/CNW"
+
+    precedence = 200


We already have a PR for importing enisa:

Add V2_importer to collect advisories from EUVD #2046

ziadhany · 2026-05-13T12:06:29Z

+import io
+import os
+import shutil
+import subprocess
+import tarfile
+import zipfile
+from pathlib import Path


Why do we need to change this file? Is this vide-code? Please don't submit AI-generated code.

Copilot AI review requested due to automatic review settings March 15, 2026 00:34

Copilot started reviewing on behalf of Tednoob17 March 15, 2026 00:35 View session

Copilot AI reviewed Mar 15, 2026

View reviewed changes

Comment thread vulnerabilities/pipelines/v2_importers/cloudvulndb_importer.py Outdated

Comment thread vulnerabilities/pipelines/v2_importers/cloudvulndb_importer.py

Comment thread vulnerabilities/pipelines/v2_importers/cloudvulndb_importer.py

Comment thread pyproject.toml

Tednoob17 mentioned this pull request Mar 15, 2026

Add https://github.com/wiz-sec/open-cvdb data #1511

Open

Tednoob17 force-pushed the feat/cloudvulndb-importer branch 2 times, most recently from 159276b to d964334 Compare March 18, 2026 09:07

Tednoob17 and others added 19 commits March 18, 2026 09:10

Add CloudVulnDB importer

95cf5e6

- add CloudVulnDB v2 importer pipeline - register importer - add tests and fixtures - ignore setup.py in pytest collection Signed-off-by: Tedsig42 <teddams047@gmail.com>

Potential fix for pull request finding

7faf3cf

Signed-off-by: Tedsig42 <teddams047@gmail.com>

Review all V2 pipelines

b4ab457

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com> Signed-off-by: Tedsig42 <teddams047@gmail.com>

Add V2 in navbar

90fe206

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com> Signed-off-by: Tedsig42 <teddams047@gmail.com>

Add V3 info on landing page

66d2525

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com> Signed-off-by: Tedsig42 <teddams047@gmail.com>

Prep for release

cae95fe

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com> Signed-off-by: Tedsig42 <teddams047@gmail.com>

Fix null constraint violations in multiple v1 exploit collection pipe…

736c1fb

…lines Signed-off-by: ziad hany <ziadhany2016@gmail.com> Signed-off-by: Tedsig42 <teddams047@gmail.com>

Add a test, and update Kev pipeline

f7a0e99

Signed-off-by: ziad hany <ziadhany2016@gmail.com> Signed-off-by: Tedsig42 <teddams047@gmail.com>

Update (exploitdb, kev, metasploit ) pipelines to do single db query

d8436bb

Signed-off-by: ziad hany <ziadhany2016@gmail.com> Signed-off-by: Tedsig42 <teddams047@gmail.com>

Fix a vulnrichment importer test to correctly mock a CVSSv4 score

ffef300

Signed-off-by: ziad hany <ziadhany2016@gmail.com> Signed-off-by: Tedsig42 <teddams047@gmail.com>

Compute content_id from all fields of AdvisoryV2

e57efe0

Resolves: aboutcode-org#2186 Signed-off-by: Keshav Priyadarshi <git@keshav.space> Signed-off-by: Tedsig42 <teddams047@gmail.com>

Add tests for compute_content_id_v2

b77c68d

Signed-off-by: Keshav Priyadarshi <git@keshav.space> Signed-off-by: Tedsig42 <teddams047@gmail.com>

Do not update related field of an immutable AdvisoryV2

c5de735

Resolves: aboutcode-org#2187 Signed-off-by: Keshav Priyadarshi <git@keshav.space> Signed-off-by: Tedsig42 <teddams047@gmail.com>

Store advisory content hash

daa490e

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com> Signed-off-by: Tedsig42 <teddams047@gmail.com>

Allow all ecosystems in gitlab

472f17b

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com> Signed-off-by: Tedsig42 <teddams047@gmail.com>

Fix formatting issues

93e1b74

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com> Signed-off-by: Tedsig42 <teddams047@gmail.com>

Fix formatting issues

857c692

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com> Signed-off-by: Tedsig42 <teddams047@gmail.com>

Add tests

1991ce8

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com> Signed-off-by: Tedsig42 <teddams047@gmail.com>

Fix typos

ce44242

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com> Signed-off-by: Tedsig42 <teddams047@gmail.com>

Tednoob17 force-pushed the feat/cloudvulndb-importer branch from 2be778e to ce44242 Compare March 18, 2026 09:10

Merge branch 'main' into feat/cloudvulndb-importer

9911790

AyanSinhaMahapatra requested review from keshav-space and ziadhany April 6, 2026 13:29

Add new importer

b7e51a9

Merge branch 'main' into feat/cloudvulndb-importer

43f74b5

ziadhany requested changes May 13, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add CloudVulnDB importer for issue #1511#2217

Add CloudVulnDB importer for issue #1511#2217
Tednoob17 wants to merge 22 commits into
aboutcode-org:mainfrom
Tednoob17:feat/cloudvulndb-importer

Tednoob17 commented Mar 15, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ziadhany left a comment

Uh oh!

ziadhany May 13, 2026

Uh oh!

ziadhany May 13, 2026

Uh oh!

ziadhany May 13, 2026

Uh oh!

ziadhany May 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

		cloudvulndb_importer_v2.CloudVulnDBImporterPipeline,
		enisa_nisa_importer_v2.EnisaNisaImporterPipeline,

Uh oh!

Conversation

Tednoob17 commented Mar 15, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ziadhany left a comment

Choose a reason for hiding this comment

Uh oh!

ziadhany May 13, 2026

Choose a reason for hiding this comment

Uh oh!

ziadhany May 13, 2026

Choose a reason for hiding this comment

Uh oh!

ziadhany May 13, 2026

Choose a reason for hiding this comment

Uh oh!

ziadhany May 13, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants