src/NuGetGallery.Services/PackageManagement/PackageVulnerabilitiesManagementService.cs
/// <summary>
/// Iterates through the <see cref="Package"/>s that could be vulnerable to <paramref name="range"/>.
/// If any of these packages have not been marked vulnerable and should be, mark them vulnerable and add them to <paramref name="packagesToUpdate"/>.
/// </summary>
/// <remarks>
/// It is not possible to query the database to only return packages satisfying the version range, so we must iterate through all <see cref="Package"/>s in the <see cref="PackageRegistration"/>.
/// </remarks>
Iterates through the s that could be vulnerable to .
If any of these packages have not been marked vulnerable and should be, mark them vulnerable and add them to .
Iterates through the s that could be vulnerable to . If any of these packages have not been marked vulnerable and should be mark them vulnerable and add them to .
private void ProcessNewVulnerabilityRange(VulnerablePackageVersionRange range, HashSet<Package> packagesToUpdate)
        {
            _logger.LogInformation(
                "Marking packages that match ID {VulnerablePackageId} and version range {VulnerablePackageVersionRange} vulnerable",
                range.PackageId,
                range.PackageVersionRange);
            var versionRange = VersionRange.Parse(range.PackageVersionRange);
            var packages = _entitiesContext.PackageRegistrations
                .Where(pr => pr.Id == range.PackageId)
                .SelectMany(pr => pr.Packages)
                .ToList();
            foreach (var package in packages)
            {
                var version = NuGetVersion.Parse(package.NormalizedVersion);
                var satisfiesVersionRange = versionRange.Satisfies(version);
                if (satisfiesVersionRange)
                {
                    _logger.LogInformation(
                        "Package with ID {VulnerablePackageId} and version {VulnerablePackageVersion} satisfies {VulnerablePackageVersionRange} and is vulnerable",
                        range.PackageId,
                        package.NormalizedVersion,
                        range.PackageVersionRange);
                    package.VulnerablePackageRanges.Add(range);
                    range.Packages.Add(package);
                    packagesToUpdate.Add(package);
                }
            }
        }
private void ProcessNewVulnerabilityRange ( VulnerablePackageVersionRange range , HashSet < Package > packagesToUpdate ) { _logger . LogInformation ( " " , range . PackageId , range . PackageVersionRange ) ; var versionRange = VersionRange . Parse ( range . PackageVersionRange ) ; var packages = _entitiesContext . PackageRegistrations . Where ( pr => pr . Id == range . PackageId ) . SelectMany ( pr => pr . Packages ) . ToList ( ) ; foreach ( var package in packages ) { var version = NuGetVersion . Parse ( package . NormalizedVersion ) ; var satisfiesVersionRange = versionRange . Satisfies ( version ) ; if ( satisfiesVersionRange ) { _logger . LogInformation ( " " , range . PackageId , package . NormalizedVersion , range . PackageVersionRange ) ; package . VulnerablePackageRanges . Add ( range ) ; range . Packages . Add ( package ) ; packagesToUpdate . Add ( package ) ; } } }
Iterates through the s that could be vulnerable to .
Iterates through the s that could be vulnerable to .
range
VulnerablePackageVersionRange
packagesToUpdate
HashSet<Package>
remarks
It is not possible to query the database to only return packages satisfying the version range, so we must iterate through all s in the .
It is not possible to query the database to only return packages satisfying the version range so we must iterate through all s in the .