OSV, PyPI: Do not use "details" field for vuln summaries

CHANGELOG.md

@@ -8,6 +8,12 @@ All versions prior to 0.0.9 are untracked.
 
 ## [Unreleased]
 
+### Fixed
+
+* CLI: the `--format=markdown` and `--format=columns` output formats are no
+  longer broken by long vulnerability descriptions from the OSV and PyPI
+  vulnerability sources ([#323](https://github.com/trailofbits/pip-audit/pull/323))
+
 ## [2.4.1]
 
 ### Fixed

pip_audit/_service/osv.py

@@ -90,11 +90,7 @@ def query(self, spec: Dependency) -> Tuple[Dependency, List[VulnerabilityResult]
 
             id = vuln["id"]
 
-            # The summary is intended to be shorter, so we prefer it over
-            # details, if present. However, neither is required.
             description = vuln.get("summary")
-            if description is None:
-                description = vuln.get("details")
             if description is None:
                 description = "N/A"
 

pip_audit/_service/pypi.py

@@ -117,8 +117,12 @@ def query(self, spec: Dependency) -> Tuple[Dependency, List[VulnerabilityResult]
             # The ranges aren't guaranteed to come in chronological order
             fix_versions.sort()
 
+            description = v.get("summary")
+            if description is None:
+                description = "N/A"
+
             results.append(
-                VulnerabilityResult(v["id"], v["details"], fix_versions, set(v["aliases"]))
+                VulnerabilityResult(v["id"], description, fix_versions, set(v["aliases"]))
             )
 
         return spec, results

test/service/test_osv.py

@@ -168,20 +168,18 @@ def test_osv_unsupported_schema_version(monkeypatch, version):
 
 
 @pytest.mark.parametrize(
-    ["summary", "details", "description"],
+    ["summary", "description"],
     [
-        ("fakesummary", "fakedetails", "fakesummary"),
-        (None, "fakedetails", "fakedetails"),
-        (None, None, "N/A"),
+        ("fakesummary", "fakesummary"),
+        (None, "N/A"),
     ],
 )
-def test_osv_vuln_description_fallbacks(monkeypatch, summary, details, description):
+def test_osv_vuln_description_fallbacks(monkeypatch, summary, description):
     payload = {
         "vulns": [
             {
                 "id": "fakeid",
                 "summary": summary,
-                "details": details,
                 "affected": [
                     {
                         "package": {"name": "foo", "ecosystem": "PyPI"},

test/service/test_pypi.py

@@ -144,7 +144,7 @@ def json(self):
                         {
                             "aliases": ["foo", "bar"],
                             "id": "VULN-0",
-                            "details": "The first vulnerability",
+                            "summary": "The first vulnerability",
                             "fixed_in": ["1.1", "1.4"],
                         }
                     ]