owasp-depscan 5.1.3__py3-none-any.whl → 5.1.5__py3-none-any.whl

depscan/lib/analysis.py

@@ -1,9 +1,16 @@
+# -*- coding: utf-8 -*-
+
+import contextlib
 import json
 import os.path
+import re
 from collections import OrderedDict, defaultdict
 from dataclasses import dataclass
 from typing import Dict, List, Optional
 
+import cvss
+from cvss import CVSSError
+from packageurl import PackageURL
 from rich import box
 from rich.markdown import Markdown
 from rich.panel import Panel
@@ -18,11 +25,11 @@ from depscan.lib import config
 from depscan.lib.logger import LOG, console
 from depscan.lib.utils import max_version
 
-# -*- coding: utf-8 -*-
-
 
 NEWLINE = "\\n"
 
+CWE_SPLITTER = re.compile(r"(?<=CWE-)[0-9]\d{0,5}", re.IGNORECASE)
+
 
 def best_fixed_location(sug_version, orig_fixed_location):
     """
@@ -43,9 +50,9 @@ def best_fixed_location(sug_version, orig_fixed_location):
     if sug_version and orig_fixed_location:
         if sug_version == placeholder_fix_version:
             return ""
-        tmpA = sug_version.split(".")[0]
-        tmpB = orig_fixed_location.split(".")[0]
-        if tmpA == tmpB:
+        tmp_a = sug_version.split(".")[0]
+        tmp_b = orig_fixed_location.split(".")[0]
+        if tmp_a == tmp_b:
             return sug_version
     # Handle the placeholder version used by OS distros
     if orig_fixed_location == placeholder_fix_version:
@@ -90,12 +97,21 @@ def retrieve_bom_dependency_tree(bom_file):
             bom_data = json.load(bfp)
             if bom_data:
                 return bom_data.get("dependencies", []), bom_data
-    except Exception:
+    except json.JSONDecodeError:
         pass
     return [], None
 
 
 def retrieve_oci_properties(bom_data):
+    """
+    Retrieves OCI properties from the given BOM data.
+
+    :param bom_data: The BOM data to retrieve OCI properties from.
+    :type bom_data: dict
+
+    :return: A dictionary containing the retrieved OCI properties.
+    :rtype: dict
+    """
     props = {}
     if not bom_data:
         return props
@@ -119,17 +135,14 @@ def get_pkg_display(tree_pkg, current_pkg, extra_text=None):
         tree_pkg == current_pkg or tree_pkg in current_pkg
     )
     if tree_pkg:
-        try:
-            if current_pkg.startswith("pkg:"):
-                purl_obj = parse_purl(current_pkg)
-                if purl_obj:
-                    version_used = purl_obj.get("version")
-                    if version_used:
-                        full_pkg_display = (
-                            f"""{purl_obj.get("name")}@{version_used}"""
-                        )
-        except Exception:
-            pass
+        if current_pkg.startswith("pkg:"):
+            purl_obj = parse_purl(current_pkg)
+            if purl_obj:
+                version_used = purl_obj.get("version")
+                if version_used:
+                    full_pkg_display = (
+                        f"""{purl_obj.get("name")}@{version_used}"""
+                    )
     if extra_text and highlightable:
         full_pkg_display = f"{full_pkg_display} {extra_text}"
     return full_pkg_display
@@ -234,7 +247,8 @@ def prepare_vdr(options: PrepareVdrOptions):
     vulnerability details.
 
     :param options: An instance of PrepareVdrOptions containing the function parameters.
-    :return: Tuple containing (A list of vulnerability details, prioritized list as a dict)
+    :return: Vulnerability details, dictionary of prioritized items
+    :rtype: Tuple[List, Dict]
     """
     if not options.results:
         return [], {}
@@ -246,14 +260,11 @@ def prepare_vdr(options: PrepareVdrOptions):
         min_width=150,
     )
     ids_seen = {}
-    direct_purls = options.direct_purls
-    if not direct_purls:
-        direct_purls = {}
-    reached_purls = options.reached_purls
-    if not reached_purls:
-        reached_purls = {}
+    direct_purls = options.direct_purls or {}
+    reached_purls = options.reached_purls or {}
     required_pkgs = options.scoped_pkgs.get("required", [])
     optional_pkgs = options.scoped_pkgs.get("optional", [])
+    fp_count = 0
     pkg_attention_count = 0
     critical_count = 0
     has_poc_count = 0
@@ -288,6 +299,10 @@ def prepare_vdr(options: PrepareVdrOptions):
     for vuln_occ_dict in options.results:
         vid = vuln_occ_dict.get("id")
         problem_type = vuln_occ_dict.get("problem_type")
+        cwes = []
+        if problem_type:
+            cwes = split_cwe(problem_type)
+        has_flagged_cwe = False
         package_issue = vuln_occ_dict.get("package_issue")
         matched_by = vuln_occ_dict.get("matched_by")
         full_pkg = package_issue["affected_location"].get("package")
@@ -309,7 +324,6 @@ def prepare_vdr(options: PrepareVdrOptions):
                     f"{vendor}:"
                     f"{package_issue['affected_location'].get('package')}"
                 )
-        version = None
         if matched_by:
             version = matched_by.split("|")[-1]
             full_pkg = full_pkg + ":" + version
@@ -323,55 +337,86 @@ def prepare_vdr(options: PrepareVdrOptions):
         package_type = None
         insights = []
         plain_insights = []
+        purl_obj = None
+        vendor = None
         if purl and purl.startswith("pkg:"):
-            try:
-                purl_obj = parse_purl(purl)
-                if purl_obj:
-                    version_used = purl_obj.get("version")
-                    package_type = purl_obj.get("type")
-                    qualifiers = purl_obj.get("qualifiers", {})
-                    if package_type in config.OS_PKG_TYPES:
+            purl_obj = parse_purl(purl)
+            if purl_obj:
+                version_used = purl_obj.get("version")
+                package_type = purl_obj.get("type")
+                qualifiers = purl_obj.get("qualifiers", {})
+                if package_type in config.OS_PKG_TYPES:
+                    vendor = package_issue["affected_location"].get("vendor")
+                    if (
+                        vendor
+                        and oci_product_types
+                        and vendor not in oci_product_types
+                    ):
+                        # Bug #170 - do not report CVEs belonging to other distros
+                        if vendor in config.OS_PKG_TYPES:
+                            fp_count += 1
+                            continue
+                        # Some nvd data might match application CVEs for
+                        # OS vendors which can be filtered
+                        if package_issue["affected_location"].get("cpe_uri"):
+                            all_parts = CPE_FULL_REGEX.match(
+                                package_issue["affected_location"].get(
+                                    "cpe_uri"
+                                )
+                            )
+                            if (
+                                all_parts
+                                and all_parts.group("target_sw") != "*"
+                                and all_parts.group("target_sw")
+                                not in config.OS_PKG_TYPES
+                            ):
+                                fp_count += 1
+                                continue
+                        insights.append(
+                            f"[#7C8082]:telescope: Vendor {vendor}[/#7C8082]"
+                        )
+                        plain_insights.append(f"Vendor {vendor}")
+                    has_os_packages = True
+                    for acwe in cwes:
+                        if acwe in config.OS_VULN_KEY_CWES:
+                            has_flagged_cwe = True
+                            break
+                    # Don't flag the cwe for ignorable os packages
+                    if has_flagged_cwe and (
+                        purl_obj.get("name") in config.OS_PKG_UNINSTALLABLE
+                        or purl_obj.get("name") in config.OS_PKG_IGNORABLE
+                        or vendor in config.OS_PKG_IGNORABLE
+                    ):
+                        has_flagged_cwe = False
+                    else:
                         if (
-                            package_issue["affected_location"].get("vendor")
-                            and oci_product_types
-                            and package_issue["affected_location"].get("vendor")
-                            not in oci_product_types
+                            purl_obj.get("name") in config.OS_PKG_IGNORABLE
+                            or vendor in config.OS_PKG_IGNORABLE
                         ):
-                            # Some nvd data might match application CVEs for OS vendors which can be filtered
-                            if package_issue["affected_location"].get(
-                                "cpe_uri"
-                            ):
-                                all_parts = CPE_FULL_REGEX.match(
-                                    package_issue["affected_location"].get(
-                                        "cpe_uri"
-                                    )
-                                )
-                                if (
-                                    all_parts
-                                    and all_parts.group("target_sw") != "*"
-                                    and all_parts.group("target_sw")
-                                    not in config.OS_PKG_TYPES
-                                ):
-                                    continue
-                            # Some vendors like suse leads to FP and can be turned off if our image do not have those types
-                            # Some os packages might match application packages in NVD
-                            if package_issue["affected_location"].get(
-                                "vendor"
-                            ) not in ("suse",):
-                                insights.append(
-                                    f"[#7C8082]:telescope: Vendor {package_issue['affected_location'].get('vendor')}"
-                                )
-                                plain_insights.append(
-                                    f"Vendor {package_issue['affected_location'].get('vendor')}"
-                                )
-                        has_os_packages = True
+                            insights.append(
+                                "[#7C8082]:mute: Suppress for containers[/#7C8082]"
+                            )
+                            plain_insights.append("Suppress for containers")
+                        elif (
+                            purl_obj.get("name") in config.OS_PKG_UNINSTALLABLE
+                        ):
+                            insights.append(
+                                "[#7C8082]:scissors: Uninstall candidate[/#7C8082]"
+                            )
+                            plain_insights.append("Uninstall candidate")
+                    # If the flag remains after all the suppressions then add it as an insight
+                    if has_flagged_cwe:
+                        insights.append(
+                            "[#7C8082]:triangular_flag: Flagged weakness[/#7C8082]"
+                        )
+                        plain_insights.append("Flagged weakness")
+                if qualifiers:
                     if "ubuntu" in qualifiers.get("distro", ""):
                         has_ubuntu_packages = True
                     if "rhel" in qualifiers.get("distro", ""):
                         has_redhat_packages = True
-            except Exception:
-                pass
         if ids_seen.get(vid + purl):
+            fp_count += 1
             continue
         # Mark this CVE + pkg as seen to avoid duplicates
         ids_seen[vid + purl] = True
@@ -421,7 +466,11 @@ def prepare_vdr(options: PrepareVdrOptions):
         )
         if is_required and package_type not in config.OS_PKG_TYPES:
             if direct_purls.get(purl):
-                package_usage = f":direct_hit: Used in [info]{str(direct_purls.get(purl))}[/info] locations"
+                package_usage = (
+                    f":direct_hit: Used in [info]"
+                    f"{str(direct_purls.get(purl))}"
+                    f"[/info] locations"
+                )
                 plain_package_usage = (
                     f"Used in {str(direct_purls.get(purl))} locations"
                 )
@@ -442,7 +491,10 @@ def prepare_vdr(options: PrepareVdrOptions):
                 plain_package_usage = "Local install"
                 has_os_packages = True
             else:
-                package_usage = "[spring_green4]:notebook: Indirect dependency[/spring_green4]"
+                package_usage = (
+                    "[spring_green4]:notebook: Indirect "
+                    "dependency[/spring_green4]"
+                )
                 plain_package_usage = "Indirect dependency"
         if package_usage != "N/A":
             insights.append(package_usage)
@@ -483,10 +535,26 @@ def prepare_vdr(options: PrepareVdrOptions):
                 )
                 plain_insights.append("Reachable and Exploitable")
                 has_reachable_exploit_count += 1
-                # Fail safe. Packages with exploits and direct usage without a reachable flow
-                # are still considered reachable to reduce false negatives
+                # Fail safe. Packages with exploits and direct usage without
+                # a reachable flow are still considered reachable to reduce
+                # false negatives
                 if not reached_purls.get(purl):
                     reached_purls[purl] = 1
+            elif has_flagged_cwe:
+                if (vendor and vendor in ("gnu",)) or (
+                    purl_obj and purl_obj.get("name") in ("glibc", "openssl")
+                ):
+                    insights.append(
+                        "[bright_red]:exclamation_mark: Reachable and Exploitable[/bright_red]"
+                    )
+                    plain_insights.append("Reachable and Exploitable")
+                    has_reachable_exploit_count += 1
+                else:
+                    insights.append(
+                        "[bright_red]:exclamation_mark: Exploitable[/bright_red]"
+                    )
+                    plain_insights.append("Exploitable")
+                    has_exploit_count += 1
             else:
                 insights.append(
                     "[bright_red]:exclamation_mark: Known Exploits[/bright_red]"
@@ -553,74 +621,54 @@ def prepare_vdr(options: PrepareVdrOptions):
                     "state": "in_triage",
                     "detail": f"Dependency Tree: {json.dumps(pkg_tree_list)}",
                 }
-            score = 2.0
-            try:
-                score = float(vuln_occ_dict.get("cvss_score"))
-            except Exception:
-                pass
-            sev_to_use = pkg_severity.lower()
-            if sev_to_use not in (
-                "critical",
-                "high",
-                "medium",
-                "low",
-                "info",
-                "none",
-            ):
-                sev_to_use = "unknown"
-            ratings = [
+            ratings = cvss_to_vdr_rating(vuln_occ_dict)
+            properties = [
                 {
-                    "score": score,
-                    "severity": sev_to_use,
-                    "method": "CVSSv31",
-                }
+                    "name": "depscan:insights",
+                    "value": "\\n".join(plain_insights),
+                },
+                {
+                    "name": "depscan:prioritized",
+                    "value": "true" if pkg_group_rows.get(purl) else "false",
+                },
             ]
+            affected_version_range = get_version_range(package_issue, purl)
+            if affected_version_range:
+                properties.append(affected_version_range)
             advisories = []
             for k, v in clinks.items():
                 advisories.append({"title": k, "url": v})
-            cwes = []
-            if problem_type:
-                try:
-                    acwe = int(problem_type.lower().replace("cwe-", ""))
-                    cwes = [acwe]
-                except Exception:
-                    pass
-            pkg_vulnerabilities.append(
-                {
-                    "bom-ref": f"{vid}/{purl}",
-                    "id": vid,
-                    "source": source,
-                    "ratings": ratings,
-                    "cwes": cwes,
-                    "description": vuln_occ_dict.get("short_description"),
-                    "recommendation": recommendation,
-                    "advisories": advisories,
-                    "analysis": analysis,
-                    "affects": affects,
-                    "properties": [
-                        {
-                            "name": "depscan:insights",
-                            "value": "\\n".join(plain_insights),
-                        },
-                        {
-                            "name": "depscan:prioritized",
-                            "value": "true"
-                            if pkg_group_rows.get(purl)
-                            else "false",
-                        },
-                    ],
-                }
-            )
+            vuln = {
+                "bom-ref": f"{vid}/{purl}",
+                "id": vid,
+                "source": source,
+                "ratings": ratings,
+                "cwes": cwes,
+                "description": vuln_occ_dict.get("short_description"),
+                "recommendation": recommendation,
+                "advisories": advisories,
+                "analysis": analysis,
+                "affects": affects,
+                "properties": properties,
+            }
+            if source_orig_time := vuln_occ_dict.get("source_orig_time"):
+                vuln["published"] = source_orig_time
+            if source_update_time := vuln_occ_dict.get("source_update_time"):
+                vuln["updated"] = source_update_time
+            pkg_vulnerabilities.append(vuln)
+
     if not options.no_vuln_table:
         console.print()
         console.print(table)
-        console.print()
     if pkg_group_rows:
         psection = Markdown(
-            """## Next Steps
+            """
+Next Steps
+----------
 
 Below are the vulnerabilities prioritized by depscan. Follow your team's remediation workflow to mitigate these findings.
-        """
+        """,
+            justify="left",
         )
         console.print(psection)
         utable = Table(
@@ -653,14 +701,14 @@ Below are the vulnerabilities prioritized by depscan. Follow your team's remedia
             if has_reachable_exploit_count:
                 rmessage = (
                     f":point_right: [magenta]{has_reachable_exploit_count}"
-                    f"[/magenta] out of {len(options.results)} vulnerabilities "
+                    f"[/magenta] out of {len(pkg_vulnerabilities)} vulnerabilities "
                     f"have [dark magenta]reachable[/dark magenta] exploits and requires your ["
                     f"magenta]immediate[/magenta] attention."
                 )
             else:
                 rmessage = (
                     f":point_right: [magenta]{has_exploit_count}"
-                    f"[/magenta] out of {len(options.results)} vulnerabilities "
+                    f"[/magenta] out of {len(pkg_vulnerabilities)} vulnerabilities "
                     f"have known exploits and requires your ["
                     f"magenta]immediate[/magenta] attention."
                 )
@@ -677,19 +725,25 @@ Below are the vulnerabilities prioritized by depscan. Follow your team's remedia
                     )
             else:
                 rmessage += (
-                    "\nConsider trimming this image by removing any "
+                    "\n:scissors: Consider trimming this image by removing any "
                     "unwanted packages. Alternatively, use a slim "
                     "base image."
                 )
                 if distro_packages_count and distro_packages_count < len(
-                    options.results
+                    pkg_vulnerabilities
                 ):
-                    rmessage += (
-                        f"\nNOTE: [magenta]{distro_packages_count}"
-                        f"[/magenta] distro-specific vulnerabilities "
-                        f"out of {len(options.results)} could be prioritized "
-                        f"for updates."
-                    )
+                    if (
+                        len(pkg_vulnerabilities)
+                        > config.max_distro_vulnerabilities
+                    ):
+                        rmessage += f"\nNOTE: Check if the base image or the kernel version used is End-of-Life (EOL)."
+                    else:
+                        rmessage += (
+                            f"\nNOTE: [magenta]{distro_packages_count}"
+                            f"[/magenta] distro-specific vulnerabilities "
+                            f"out of {len(pkg_vulnerabilities)} could be prioritized "
+                            f"for updates."
+                        )
                 if has_redhat_packages:
                     rmessage += """\nNOTE: Vulnerabilities in RedHat packages with status "out of support" or "won't fix" are excluded from this result."""
                 if has_ubuntu_packages:
@@ -715,7 +769,7 @@ Below are the vulnerabilities prioritized by depscan. Follow your team's remedia
             else:
                 rmessage = (
                     f":point_right: [info]{pkg_attention_count}"
-                    f"[/info] out of {len(options.results)} vulnerabilities "
+                    f"[/info] out of {len(pkg_vulnerabilities)} vulnerabilities "
                     f"requires your attention."
                 )
             if fix_version_count:
@@ -727,10 +781,15 @@ Below are the vulnerabilities prioritized by depscan. Follow your team's remedia
                         "remediate."
                     )
                 else:
+                    v_text = (
+                        "vulnerability"
+                        if fix_version_count == 1
+                        else "vulnerabilities"
+                    )
                     rmessage += (
                         f"\nYou can remediate [bright_green]"
                         f"{fix_version_count}[/bright_green] "
-                        f"{'vulnerability' if fix_version_count == 1 else 'vulnerabilities'} "
+                        f"{v_text} "
                         f"by updating the packages using the fix "
                         f"version :thumbsup:"
                     )
@@ -756,11 +815,7 @@ Below are the vulnerabilities prioritized by depscan. Follow your team's remedia
                 rmessage = (
                     ":white_medium_small_square: Prioritize any vulnerabilities in libraries such "
                     "as glibc, openssl, or libcurl.\nAdditionally, "
-                    "prioritize the vulnerabilities in packages that "
-                    "provide executable binaries when there is a "
-                    "Remote Code Execution or File Write "
-                    "vulnerability in the containerized application "
-                    "or service."
+                    "prioritize the vulnerabilities with 'Flagged weakness' under insights."
                 )
                 rmessage += (
                     "\nVulnerabilities in Linux Kernel packages can "
@@ -817,10 +872,13 @@ Below are the vulnerabilities prioritized by depscan. Follow your team's remedia
             (k, v) for v, k in sorted_reached_purls
         )
         rsection = Markdown(
-            """## Proactive Measures
+            """
+Proactive Measures
+------------------
 
 Below are the top reachable packages identified by depscan. Setup alerts and notifications to actively monitor these packages for new vulnerabilities and exploits.
-        """
+        """,
+            justify="left",
         )
         console.print(rsection)
         rtable = Table(
@@ -840,6 +898,99 @@ Below are the top reachable packages identified by depscan. Setup alerts and not
     return pkg_vulnerabilities, pkg_group_rows
 
 
+def get_version_range(package_issue, purl):
+    """
+    Generates a version range object for inclusion in the vdr file.
+
+    :param package_issue: Vulnerability data dict
+    :param purl: Package URL string
+
+    :return: A list containing a dictionary with version range information.
+    """
+    new_prop = {}
+    if (affected_location := package_issue.get("affected_location")) and (
+        affected_version := affected_location.get("version")
+    ):
+        try:
+            ppurl = PackageURL.from_string(purl)
+            new_prop = {
+                "name": "affectedVersionRange",
+                "value": f"{ppurl.name}@" f"{affected_version}",
+            }
+            if ppurl.namespace:
+                new_prop["value"] = f'{ppurl.namespace}/{new_prop["value"]}'
+        except ValueError:
+            ppurl = purl.split("@")
+            if len(ppurl) == 2:
+                new_prop = {
+                    "name": "affectedVersionRange",
+                    "value": f"{ppurl[0]}@{affected_version}",
+                }
+
+    return new_prop
+
+
+def cvss_to_vdr_rating(vuln_occ_dict):
+    """
+    Generates a rating object for inclusion in the vdr file.
+
+    :param vuln_occ_dict: Vulnerability data
+
+    :return: A list containing a dictionary with CVSS score information.
+    """
+    cvss_score = vuln_occ_dict.get("cvss_score", 2.0)
+    with contextlib.suppress(ValueError, TypeError):
+        cvss_score = float(cvss_score)
+    if (pkg_severity := vuln_occ_dict.get("severity", "").lower()) not in (
+        "critical",
+        "high",
+        "medium",
+        "low",
+        "info",
+        "none",
+    ):
+        pkg_severity = "unknown"
+    ratings = [
+        {
+            "score": cvss_score,
+            "severity": pkg_severity,
+        }
+    ]
+    method = "31"
+    if vuln_occ_dict.get("cvss_v3") and (
+        vector_string := vuln_occ_dict["cvss_v3"].get("vector_string")
+    ):
+        ratings[0]["vector"] = vector_string
+        with contextlib.suppress(CVSSError):
+            method = cvss.CVSS3(vector_string).as_json().get("version")
+            method = method.replace(".", "").replace("0", "")
+    ratings[0]["method"] = f"CVSSv{method}"
+
+    return ratings
+
+
+def split_cwe(cwe):
+    """
+    Split the given CWE string into a list of CWE IDs.
+
+    :param cwe: The problem issue taken from a vulnerability object
+
+    :return: A list of CWE IDs
+    :rtype: list
+    """
+    cwe_ids = []
+
+    if isinstance(cwe, str):
+        cwe_ids = re.findall(CWE_SPLITTER, cwe)
+    elif isinstance(cwe, list):
+        cwes = "|".join(cwe)
+        cwe_ids = re.findall(CWE_SPLITTER, cwes)
+
+    with contextlib.suppress(ValueError, TypeError):
+        cwe_ids = [int(cwe_id) for cwe_id in cwe_ids]
+    return cwe_ids
+
+
 def summary_stats(results):
     """
     Generate summary stats
@@ -875,7 +1026,8 @@ def jsonl_report(
     reached_purls,
 ):
     """
-    Produce vulnerability occurrence report in jsonlines format
+    DEPRECATED: Produce vulnerability occurrence report in jsonlines format
+    This method should use the pkg_vulnerabilities from prepare_vdr
 
     :param scoped_pkgs: A dict of lists of required/optional/excluded packages.
     :param sug_version_dict: A dict mapping package names to suggested versions.
@@ -884,6 +1036,8 @@ def jsonl_report(
     :param results: List of vulnerabilities found
     :param pkg_aliases: Package alias
     :param out_file_name: Output filename
+    :param direct_purls: A list of direct purls
+    :param reached_purls: A list of reached purls
     """
     ids_seen = {}
     required_pkgs = scoped_pkgs.get("required", [])
@@ -916,18 +1070,15 @@ def jsonl_report(
             version_used = package_issue["affected_location"].get("version")
             purl = purl_aliases.get(full_pkg, full_pkg)
             if purl:
-                try:
-                    purl_obj = parse_purl(purl)
-                    if purl_obj:
-                        version_used = purl_obj.get("version")
-                        if purl_obj.get("namespace"):
-                            full_pkg = f"""{purl_obj.get("namespace")}/
-                            {purl_obj.get("name")}@{purl_obj.get("version")}"""
-                        else:
-                            full_pkg = f"""{purl_obj.get("name")}@{purl_obj
-                                .get("version")}"""
-                except Exception:
-                    pass
+                purl_obj = parse_purl(purl)
+                if purl_obj:
+                    version_used = purl_obj.get("version")
+                    if purl_obj.get("namespace"):
+                        full_pkg = f"""{purl_obj.get("namespace")}/
+                        {purl_obj.get("name")}@{purl_obj.get("version")}"""
+                    else:
+                        full_pkg = f"""{purl_obj.get("name")}@{purl_obj
+                            .get("version")}"""
             if ids_seen.get(vid + purl):
                 continue
             # On occasions, this could still result in duplicates if the
@@ -1143,6 +1294,7 @@ def suggest_version(results, pkg_aliases=None, purl_aliases=None):
 
     :param results: List of package issue objects or dicts
     :param pkg_aliases: Dict of package names and aliases
+    :param purl_aliases: Dict of purl names and aliases
     :return: Dict mapping each package to its suggested version
     """
     pkg_fix_map = {}
@@ -1166,7 +1318,6 @@ def suggest_version(results, pkg_aliases=None, purl_aliases=None):
                     f"{package_issue.affected_location.vendor}:"
                     f"{package_issue.affected_location.package}"
                 )
-        version = None
         if matched_by:
             version = matched_by.split("|")[-1]
             full_pkg = full_pkg + ":" + version
@@ -1176,9 +1327,9 @@ def suggest_version(results, pkg_aliases=None, purl_aliases=None):
         else:
             full_pkg = pkg_aliases.get(full_pkg, full_pkg)
         version_upgrades = pkg_fix_map.get(full_pkg, set())
-        if (
-            fixed_location != placeholder_fix_version
-            and fixed_location != placeholder_exclude_version
+        if fixed_location not in (
+            placeholder_fix_version,
+            placeholder_exclude_version,
         ):
             version_upgrades.add(fixed_location)
         pkg_fix_map[full_pkg] = version_upgrades
@@ -1261,6 +1412,8 @@ def classify_links(related_urls):
             clinks["Bug Bounty"] = rurl
         elif "cwe.mitre.org" in rurl:
             clinks["cwe"] = rurl
+        else:
+            clinks["other"] = rurl
     return clinks
 
 
@@ -1268,12 +1421,16 @@ def find_purl_usages(bom_file, src_dir, reachables_slices_file):
     """
     Generates a list of reachable elements based on the given BOM file.
 
-    :param bom_file (str): The path to the BOM file.
-    :param src_dir (str): Source directory
+    :param bom_file: The path to the BOM file.
+    :type bom_file: str
+    :param src_dir: Source directory
+    :type src_dir: str
     :param reachables_slices_file: Path to the reachables slices file
+    :type reachables_slices_file: str
 
-    :return: Tuple of direct_purls and reached_purls based on the occurrence and callstack evidences from the BOM.
-             If reachables slices json were found, the file would be read first.
+    :return: Tuple of direct_purls and reached_purls based on the occurrence and
+                callstack evidences from the BOM. If reachables slices json were
+                found, the file is read first.
     """
     direct_purls = defaultdict(int)
     reached_purls = defaultdict(int)
@@ -1297,7 +1454,6 @@ def find_purl_usages(bom_file, src_dir, reachables_slices_file):
 
         for c in data["components"]:
             purl = c["purl"]
-            if c.get("evidence"):
-                if c["evidence"].get("occurrences"):
-                    direct_purls[purl] += len(c["evidence"].get("occurrences"))
+            if c.get("evidence") and c["evidence"].get("occurrences"):
+                direct_purls[purl] += len(c["evidence"].get("occurrences"))
     return dict(direct_purls), dict(reached_purls)