Skip to content

Commit 13be1e6

Browse files
haikoscholhaikoschol
authored
Merge pull request #183 from sbs2001/general_oval_parser
Generalise the UbuntuOvalParser to work with SUSE oval files
2 parents e812ce6 + 063ed35 commit 13be1e6

6 files changed

Lines changed: 381 additions & 51 deletions

File tree

‎.travis.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ env:
1111
- SECRET_KEY="i1bn=oly)w*2yl-5yc&f!vvgt)p)fh3_2$r#spa!*sw36f5ov7"
1212

1313
before_script:
14-
- pycodestyle --exclude=migrations,settings.py,venv,lib_oval.py,test_ubuntu.py --max-line-length=100 .
14+
- pycodestyle --exclude=migrations,settings.py,venv,lib_oval.py,test_ubuntu.py,test_suse.py --max-line-length=100 .
1515
- psql -c "CREATE DATABASE vulnerablecode;" -U postgres
1616
- ./manage.py migrate
1717

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ the code Django includes for this purpose: `SECRET_KEY=$(python -c "from django.
5353
## Tests
5454

5555
```
56-
pycodestyle --exclude=migrations,settings.py,venv,lib_oval.py,test_ubuntu.py --max-line-length=100 .
56+
pycodestyle --exclude=migrations,settings.py,venv,lib_oval.py,test_ubuntu.py,test_suse.py --max-line-length=100 .
5757
DJANGO_DEV=1 pytest
5858
```
5959
To skip tests which require internet connection:

‎vulnerabilities/scraper/oval_parser.py‎

Lines changed: 35 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1+
from typing import Optional
12
from typing import List
23
from typing import Dict
34
from typing import Tuple
45
from typing import Set
5-
from typing import Optional
66
import xml.etree.ElementTree as ET
77

88
from dephell_specifier import RangeSpecifier
@@ -11,7 +11,7 @@
1111
OvalDefinition, OvalDocument, OvalTest, OvalObject, OvalState, OvalElement)
1212

1313

14-
class OvalExtractor:
14+
class OvalParser:
1515

1616
def __init__(self, translations: Dict, oval_document: ET.ElementTree):
1717

@@ -33,7 +33,7 @@ def get_data(self) -> List[Dict]:
3333
continue
3434
definition_data = {'test_data': []}
3535
definition_data['description'] = definition.getMetadata(
36-
).getDescription()
36+
).getDescription() # this could use some data cleaning
3737
definition_data['vuln_id'] = self.get_vuln_id_from_definition(
3838
definition)
3939
definition_data['reference_urls'] = self.get_urls_from_definition(
@@ -57,43 +57,6 @@ def get_tests_of_definition(self, definition: OvalDefinition) -> List[OvalTest]:
5757
"""
5858
returns a list of all valid tests of the passed OvalDefinition
5959
"""
60-
pass
61-
62-
def get_object_state_of_test(self, test: OvalTest) -> Tuple[OvalObject, OvalState]:
63-
"""
64-
returns a tuple of (OvalObject,OvalState) of an OvalTest
65-
"""
66-
pass
67-
68-
def get_pkgs_from_obj(self, obj: OvalObject) -> List[str]:
69-
"""
70-
returns a list of all related packages nested within
71-
an OvalObject
72-
"""
73-
pass
74-
75-
def get_versionsrngs_from_state(self, state: OvalState) -> RangeSpecifier:
76-
"""
77-
returns a list of all related version ranges within a
78-
state
79-
"""
80-
pass
81-
82-
@staticmethod
83-
def get_urls_from_definition(definition: OvalDefinition) -> Set[str]:
84-
pass
85-
86-
@staticmethod
87-
def get_vuln_id_from_definition(definition):
88-
89-
for child in definition.element.iter():
90-
if child.get('ref_id'):
91-
return child.get('ref_id')
92-
93-
94-
class UbuntuOvalParser(OvalExtractor):
95-
96-
def get_tests_of_definition(self, definition: OvalDefinition) -> List[OvalTest]:
9760

9861
criteria_refs = []
9962

@@ -104,21 +67,35 @@ def get_tests_of_definition(self, definition: OvalDefinition) -> List[OvalTest]:
10467

10568
matching_tests = []
10669
for ref in criteria_refs:
107-
if len(self.oval_document.getElementByID(ref).element) == 2:
108-
matching_tests.append(self.oval_document.getElementByID(ref))
70+
oval_test = self.oval_document.getElementByID(ref)
71+
if len(oval_test.element) == 2:
72+
_, state = self.get_object_state_of_test(oval_test)
73+
valid_test = True
74+
for child in state.element:
75+
if child.get('operation') not in self.translations:
76+
valid_test = False
77+
break
78+
if valid_test:
79+
matching_tests.append(
80+
self.oval_document.getElementByID(ref))
10981

11082
return matching_tests
11183

11284
def get_object_state_of_test(self, test: OvalTest) -> Tuple[OvalObject, OvalState]:
113-
85+
"""
86+
returns a tuple of (OvalObject,OvalState) of an OvalTest
87+
"""
11488
obj, state = list(test.element)[0].get(
11589
'object_ref'), list(test.element)[1].get('state_ref')
11690
obj = self.oval_document.getElementByID(obj)
11791
state = self.oval_document.getElementByID(state)
118-
11992
return (obj, state)
12093

12194
def get_pkgs_from_obj(self, obj: OvalObject) -> List[str]:
95+
"""
96+
returns a list of all related packages nested within
97+
an OvalObject
98+
"""
12299

123100
pkg_list = []
124101

@@ -133,11 +110,14 @@ def get_pkgs_from_obj(self, obj: OvalObject) -> List[str]:
133110

134111
return pkg_list
135112

136-
def get_versionsrngs_from_state(self, state: OvalState) -> RangeSpecifier:
137-
113+
def get_versionsrngs_from_state(self, state: OvalState) -> Optional[RangeSpecifier]:
114+
"""
115+
returns all related version ranges within a state
116+
"""
138117
for var in state.element:
139118
if var.get('operation'):
140-
119+
if var.get('operation') not in self.translations:
120+
continue
141121
operand = self.translations[var.get('operation')]
142122
version = var.text
143123
version_range = operand + version
@@ -154,6 +134,14 @@ def get_urls_from_definition(definition: OvalDefinition) -> Set[str]:
154134
for grandchild in child:
155135
if grandchild.tag.endswith('ref'):
156136
all_urls.add(grandchild.text)
137+
if grandchild.get('href'):
138+
all_urls.add(grandchild.get('href'))
157139
break
158140

159141
return all_urls
142+
143+
@staticmethod
144+
def get_vuln_id_from_definition(definition):
145+
for child in definition.element.iter():
146+
if child.get('ref_id'):
147+
return child.get('ref_id')

‎vulnerabilities/tests/test_data/suse_oval_data.xml‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<oval_definitions
3+
xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd"
4+
xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5"
5+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
6+
xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5"
7+
xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5">
8+
<generator>
9+
<oval:product_name>Marcus Updateinfo to OVAL Converter</oval:product_name>
10+
<oval:schema_version>5.5</oval:schema_version>
11+
<oval:timestamp>2020-05-17T04:49:08</oval:timestamp>
12+
</generator>
13+
<definitions>
14+
<definition id="oval:org.opensuse.security:def:20094112" version="1" class="vulnerability">
15+
<metadata>
16+
<title>CVE-2009-4112</title>
17+
<affected family="unix">
18+
<platform>openSUSE Leap 15.1</platform>
19+
</affected>
20+
<reference ref_id="CVE-2009-4112" ref_url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4112" source="CVE"/>
21+
<description>
22+
Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage" setting to contain arbitrary commands.
23+
</description>
24+
<advisory from="security@suse.de">
25+
<severity>Low</severity>
26+
<cve href="https://www.suse.com/security/cve/CVE-2009-4112.html">CVE-2009-4112</cve>
27+
<bugzilla href="https://bugzilla.suse.com/1122535">SUSE bug 1122535</bugzilla>
28+
<bugzilla href="https://bugzilla.suse.com/558664">SUSE bug 558664</bugzilla>
29+
</advisory>
30+
</metadata>
31+
<criteria operator="AND">
32+
<criterion test_ref="oval:org.opensuse.security:tst:2009265831" comment="openSUSE Leap 15.1 is installed"/>
33+
<criteria operator="OR">
34+
<criteria operator="AND">
35+
<criterion test_ref="oval:org.opensuse.security:tst:2009281999" comment="cacti-1.2.11-lp151.3.6 is installed"/>
36+
<criterion test_ref="oval:org.opensuse.security:tst:2009152167" comment="cacti is signed with openSUSE key"/>
37+
</criteria>
38+
<criteria operator="AND">
39+
<criterion test_ref="oval:org.opensuse.security:tst:2009282000" comment="cacti-spine-1.2.11-lp151.3.6 is installed"/>
40+
<criterion test_ref="oval:org.opensuse.security:tst:2009153174" comment="cacti-spine is signed with openSUSE key"/>
41+
</criteria>
42+
</criteria>
43+
</criteria>
44+
</definition>
45+
<definition id="oval:org.opensuse.security:def:20112767" version="1" class="vulnerability">
46+
<metadata>
47+
<title>CVE-2011-2767</title>
48+
<affected family="unix">
49+
<platform>openSUSE Leap 15.1</platform>
50+
</affected>
51+
<reference ref_id="CVE-2011-2767" ref_url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2767" source="CVE"/>
52+
<description>
53+
mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.
54+
</description>
55+
<advisory from="security@suse.de">
56+
<severity>Moderate</severity>
57+
<cve href="https://www.suse.com/security/cve/CVE-2011-2767.html">CVE-2011-2767</cve>
58+
<bugzilla href="https://bugzilla.suse.com/1156944">SUSE bug 1156944</bugzilla>
59+
</advisory>
60+
</metadata>
61+
<criteria operator="AND">
62+
<criterion test_ref="oval:org.opensuse.security:tst:2009265831" comment="openSUSE Leap 15.1 is installed"/>
63+
<criteria operator="OR">
64+
<criteria operator="AND">
65+
<criterion test_ref="oval:org.opensuse.security:tst:2009271113" comment="apache2-mod_perl-2.0.11-lp151.3.3 is installed"/>
66+
<criterion test_ref="oval:org.opensuse.security:tst:2009151816" comment="apache2-mod_perl is signed with openSUSE key"/>
67+
</criteria>
68+
<criteria operator="AND">
69+
<criterion test_ref="oval:org.opensuse.security:tst:2009271114" comment="apache2-mod_perl-devel-2.0.11-lp151.3.3 is installed"/>
70+
<criterion test_ref="oval:org.opensuse.security:tst:2009271141" comment="apache2-mod_perl-devel is signed with openSUSE key"/>
71+
</criteria>
72+
</criteria>
73+
</criteria>
74+
</definition>
75+
</definitions>
76+
77+
<tests>
78+
<rpminfo_test id="oval:org.opensuse.security:tst:2009265831" version="1" comment="openSUSE-release is ==15.1" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
79+
<object object_ref="oval:org.opensuse.security:obj:2009031246"/>
80+
<state state_ref="oval:org.opensuse.security:ste:2009068342"/>
81+
</rpminfo_test>
82+
83+
<rpminfo_test id="oval:org.opensuse.security:tst:2009281999" version="1" comment="cacti is &lt;1.2.11-lp151.3.6" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
84+
<object object_ref="oval:org.opensuse.security:obj:2009031297"/>
85+
<state state_ref="oval:org.opensuse.security:ste:2009072069"/>
86+
</rpminfo_test>
87+
88+
<rpminfo_test id="oval:org.opensuse.security:tst:2009152167" version="1" comment="cacti is signed with openSUSE key" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
89+
<object object_ref="oval:org.opensuse.security:obj:2009031297"/>
90+
<state state_ref="oval:org.opensuse.security:ste:2009051526"/>
91+
</rpminfo_test>
92+
93+
<rpminfo_test id="oval:org.opensuse.security:tst:2009282000" version="1" comment="cacti-spine is &lt;1.2.11-lp151.3.6" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
94+
<object object_ref="oval:org.opensuse.security:obj:2009037882"/>
95+
<state state_ref="oval:org.opensuse.security:ste:2009072069"/>
96+
</rpminfo_test>
97+
98+
<rpminfo_test id="oval:org.opensuse.security:tst:2009153174" version="1" comment="cacti-spine is signed with openSUSE key" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
99+
<object object_ref="oval:org.opensuse.security:obj:2009037882"/>
100+
<state state_ref="oval:org.opensuse.security:ste:2009051526"/>
101+
</rpminfo_test>
102+
103+
<rpminfo_test id="oval:org.opensuse.security:tst:2009271113" version="1" comment="apache2-mod_perl is &lt;2.0.11-lp151.3.3" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
104+
<object object_ref="oval:org.opensuse.security:obj:2009040947"/>
105+
<state state_ref="oval:org.opensuse.security:ste:2009070552"/>
106+
</rpminfo_test>
107+
108+
<rpminfo_test id="oval:org.opensuse.security:tst:2009151816" version="1" comment="apache2-mod_perl is signed with openSUSE key" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
109+
<object object_ref="oval:org.opensuse.security:obj:2009040947"/>
110+
<state state_ref="oval:org.opensuse.security:ste:2009051526"/>
111+
</rpminfo_test>
112+
113+
<rpminfo_test id="oval:org.opensuse.security:tst:2009271114" version="1" comment="apache2-mod_perl-devel is &lt;2.0.11-lp151.3.3" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
114+
<object object_ref="oval:org.opensuse.security:obj:2009041273"/>
115+
<state state_ref="oval:org.opensuse.security:ste:2009070552"/>
116+
</rpminfo_test>
117+
118+
<rpminfo_test id="oval:org.opensuse.security:tst:2009271141" version="1" comment="apache2-mod_perl-devel is signed with openSUSE key" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
119+
<object object_ref="oval:org.opensuse.security:obj:2009041273"/>
120+
<state state_ref="oval:org.opensuse.security:ste:2009051526"/>
121+
</rpminfo_test>
122+
</tests>
123+
<objects>
124+
<rpminfo_object id="oval:org.opensuse.security:obj:2009031246" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
125+
<name>openSUSE-release</name>
126+
</rpminfo_object>
127+
128+
<rpminfo_object id="oval:org.opensuse.security:obj:2009031297" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
129+
<name>cacti</name>
130+
</rpminfo_object>
131+
132+
<rpminfo_object id="oval:org.opensuse.security:obj:2009037882" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
133+
<name>cacti-spine</name>
134+
</rpminfo_object>
135+
136+
<rpminfo_object id="oval:org.opensuse.security:obj:2009040947" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
137+
<name>apache2-mod_perl</name>
138+
</rpminfo_object>
139+
140+
<rpminfo_object id="oval:org.opensuse.security:obj:2009041273" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
141+
<name>apache2-mod_perl-devel</name>
142+
</rpminfo_object>
143+
</objects>
144+
<states>
145+
<rpminfo_state id="oval:org.opensuse.security:ste:2009068342" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
146+
<version operation="equals">15.1</version>
147+
</rpminfo_state>
148+
149+
<rpminfo_state id="oval:org.opensuse.security:ste:2009072069" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
150+
<evr datatype="evr_string" operation="less than">0:1.2.11-lp151.3.6</evr>
151+
</rpminfo_state>
152+
153+
<rpminfo_state id="oval:org.opensuse.security:ste:2009051526" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
154+
<signature_keyid operation="equals">b88b2fd43dbdc284</signature_keyid>
155+
</rpminfo_state>
156+
157+
<rpminfo_state id="oval:org.opensuse.security:ste:2009070552" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
158+
<evr datatype="evr_string" operation="less than">0:2.0.11-lp151.3.3</evr>
159+
</rpminfo_state>
160+
</states>
161+
162+
163+
</oval_definitions>

0 commit comments

Comments
 (0)