Code enhancement based on the PR review comments #1763

Signed-off-by: Chin Yeung Li <tli@nexb.com>

Author: chinyeungli

scanpipe/pipelines/scan_maven_package.py

@@ -31,7 +31,8 @@
 
 class ScanMavenPackage(ScanSinglePackage, DeployToDevelop):
     """
-    Scan a single Maven package and run a D2D scan.
+    Scan a single Maven package and perform a deployment to development
+    relation scan.
 
     This pipeline takes a Maven PURL as input, fetches the binary and
     source archives (if they exist), and then performs scans for package
@@ -92,8 +93,8 @@ def extract_input(self):
             self.extract_inputs_to_codebase_directory()
 
     def maven_d2d_steps(self):
+        """Run D2D steps for Maven projects."""
         if self.d2d_enabled:
-            """Run D2D steps for Maven projects."""
             self.collect_and_create_codebase_resources()
             self.fingerprint_codebase_directories()
             self.flag_empty_files()
@@ -163,16 +164,13 @@ def fetch_and_scan_remote_pom(self):
         scanning_errors = fetch_and_scan_remote_pom(
             self.purl, self.scan_output_location
         )
-        if scanning_errors:
-            for scanning_error in scanning_errors:
-                for resource_path, errors in scanning_error.items():
-                    self.project.add_error(
-                        description="\n".join(errors),
-                        model=self.pipeline_name,
-                        details={
-                            "resource_path": resource_path.removeprefix("codebase/")
-                        },
-                    )
+        for scanning_error in scanning_errors:
+            for resource_path, errors in scanning_error.items():
+                self.project.add_error(
+                    description="\n".join(errors),
+                    model=self.pipeline_name,
+                    details={"resource_path": resource_path.removeprefix("codebase/")},
+                )
 
     def update_package_license_from_resource_if_missing(self):
         """Update PACKAGE license from the license detected in RESOURCES if missing."""

scanpipe/pipes/maven.py

@@ -63,31 +63,26 @@ def check_input_and_return_purl(project):
 
 
 def fetch_inputs(purl):
-    # Fetch the bianry and source for the given input purl and return the
-    # location of the fetched tarballs
+    """Fetch the binary and source for the given input purl"""
     purl_str = PackageURL.to_string(purl)
-    purl_bin = purl_str
-    purl_src = f"{purl_str}?classifier=sources"
 
-    try:
-        package = fetch.fetch_url(url=purl_bin)
-        purl_bin_path = [package.path]
-    except Exception as e:
-        logger.info("Failed to fetch binary package: %s", e)
-        purl_bin_path = []
-
-    try:
-        package_src = fetch.fetch_url(url=purl_src)
-        purl_src_path = [package_src.path]
-    except Exception as e:
-        logger.info("Failed to fetch source package: %s", e)
-        purl_src_path = []
+    purl_bin_path = fetch_path(purl_str, "binary")
+    purl_src_path = fetch_path(f"{purl_str}?classifier=sources", "source")
 
     if not purl_bin_path and not purl_src_path:
         err_msg = f"No source or binary could be resolved for {purl}."
         raise ValueError(err_msg)
 
-    return purl_src_path, purl_bin_path
+    return [purl_src_path], [purl_bin_path]
+
+
+def fetch_path(url, package_type):
+    """Fetch the url and return the location of the fetched tarball"""
+    try:
+        return fetch.fetch_url(url=url).path
+    except Exception as e:
+        logger.info("Failed to fetch %s package: %s", package_type, e)
+        return None
 
 
 def fetch_and_scan_remote_pom(input_purl, scan_output_location):
@@ -97,7 +92,7 @@ def fetch_and_scan_remote_pom(input_purl, scan_output_location):
         # Return and do nothing if data has pom.xml
         for file in data["files"]:
             if "pom.xml" in file["path"]:
-                return
+                return []
     packages = data.get("packages", [])
 
     pom_url = get_pom_url(input_purl)
@@ -141,33 +136,31 @@ def get_pom_url(input_purl):
 
 def download_pom_file(pom_url):
     """Fetch the pom file from the input pom_url"""
-    pom_file_dict = {}
-
+    # PO: Could we use fetchcode to fetch instead? Yes, we could, but
+    # the issue is do we want to. Following is the code if we switch to
+    # fetchcode which seems making things complicated, OR we can move
+    # the "fetch_http" to fetchcode and use it.
+    """
+    import os
+    import fetchcode
+    downloaded_pom = fetchcode.fetch(pom_url)
+    location = str(downloaded_pom.location)
+    path = location + ".pom"
+    # The fetch function from fetchcode save the file as /tmp/name
+    # without an extension. We need to add the ".pom" extension so that
+    # the package scan can work properly for this file.
+    os.rename(location, path)
+    """
     try:
-        # PO: Could we use fetchcode to fetch instead? Yes, we could, but
-        # the issue is do we want to. Following is the code if we switch to
-        # fetchcode which seems making things complicated, OR we can move
-        # the "fetch_http" to fetchcode and use it.
-        """
-        import os
-        import fetchcode
-        downloaded_pom = fetchcode.fetch(pom_url)
-        location = str(downloaded_pom.location)
-        path = location + ".pom"
-        # The fetch function from fetchcode save the file as /tmp/name
-        # without an extension. We need to add the ".pom" extension so that
-        # the package scan can work properly for this file.
-        os.rename(location, path)
-        """
         downloaded_pom = fetch.fetch_http(pom_url)
-        path = str(downloaded_pom.path)
-
-        pom_file_dict["pom_file_path"] = path
-        pom_file_dict["output_path"] = path + "-output.json"
-        pom_file_dict["pom_url"] = pom_url
     except requests.RequestException:
         # Return an empty dictionary
-        pass
+        return {}
+    path = str(downloaded_pom.path)
+    pom_file_dict = {}
+    pom_file_dict["pom_file_path"] = path
+    pom_file_dict["output_path"] = path + "-output.json"
+    pom_file_dict["pom_url"] = pom_url
     return pom_file_dict
 
 

scanpipe/views.py

@@ -28,7 +28,6 @@
 from contextlib import suppress
 
 from django.apps import apps
-from django.conf import settings
 from django.contrib import messages
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.core.exceptions import ObjectDoesNotExist
@@ -2352,7 +2351,6 @@ class DiscoveredPackageDetailsView(
             ],
             "icon_class": "fa-solid fa-bug",
             "template": "scanpipe/tabset/tab_vulnerabilities.html",
-            "tab_context": {"VULNERABLECODE_URL": settings.VULNERABLECODE_URL},
         },
         "extra_data": {
             "fields": ["extra_data"],