Skip to content

Commit 2aaedb0

Browse files
sbs2001sbs2001
committed
Add RetireDotnetDataSource, and its tests
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
1 parent 75a4867 commit 2aaedb0

5 files changed

Lines changed: 314 additions & 0 deletions

File tree

‎vulnerabilities/importers/__init__.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,4 @@
2727
from vulnerabilities.importers.rust import RustDataSource
2828
from vulnerabilities.importers.safety_db import SafetyDbDataSource
2929
from vulnerabilities.importers.ruby import RubyDataSource
30+
from vulnerabilities.importers.retiredotnet import RetireDotnetDataSource

‎vulnerabilities/importers/retiredotnet.py‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
# Copyright (c) 2017 nexB Inc. and others. All rights reserved.
2+
# http://nexb.com and https://github.com/nexB/vulnerablecode/
3+
# The VulnerableCode software is licensed under the Apache License version 2.0.
4+
# Data generated with VulnerableCode require an acknowledgment.
5+
#
6+
# You may not use this software except in compliance with the License.
7+
# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
8+
# Unless required by applicable law or agreed to in writing, software distributed
9+
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
10+
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
11+
# specific language governing permissions and limitations under the License.
12+
#
13+
# When you publish or redistribute any data created with VulnerableCode or any VulnerableCode
14+
# derivative work, you must accompany this data with the following acknowledgment:
15+
#
16+
# Generated with VulnerableCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
17+
# OR CONDITIONS OF ANY KIND, either express or implied. No content created from
18+
# VulnerableCode should be considered or used as legal advice. Consult an Attorney
19+
# for any legal advice.
20+
# VulnerableCode is a free software code scanning tool from nexB Inc. and others.
21+
# Visit https://github.com/nexB/vulnerablecode/ for support and download.
22+
23+
import json
24+
import re
25+
from typing import Set
26+
from typing import List
27+
28+
from packageurl import PackageURL
29+
30+
from vulnerabilities.data_source import GitDataSource
31+
from vulnerabilities.data_source import GitDataSourceConfiguration
32+
from vulnerabilities.data_source import Advisory
33+
34+
35+
class RetireDotnetDataSource(GitDataSource):
36+
37+
def __enter__(self):
38+
super(RetireDotnetDataSource, self).__enter__()
39+
40+
if not getattr(self, '_added_files', None):
41+
self._added_files, self._updated_files = self.file_changes(
42+
recursive=True, file_ext='json', subdir='./Content')
43+
44+
def updated_advisories(self) -> Set[Advisory]:
45+
files = self._updated_files
46+
advisories = []
47+
for f in files:
48+
processed_data = self.process_file(f)
49+
if processed_data:
50+
advisories.append(processed_data)
51+
return self.batch_advisories(advisories)
52+
53+
def added_advisories(self) -> Set[Advisory]:
54+
files = self._added_files
55+
advisories = []
56+
for f in files:
57+
processed_data = self.process_file(f)
58+
if processed_data:
59+
advisories.append(processed_data)
60+
return self.batch_advisories(advisories)
61+
62+
@staticmethod
63+
def vuln_id_from_desc(desc):
64+
cve_regex = re.compile(r"CVE-\d+-\d+")
65+
res = cve_regex.search(desc)
66+
if res:
67+
return desc[res.start():res.end()]
68+
else:
69+
return None
70+
71+
def process_file(self, path) -> List[Advisory]:
72+
with open(path) as f:
73+
json_doc = json.load(f)
74+
if self.vuln_id_from_desc(json_doc["description"]):
75+
vuln_id = self.vuln_id_from_desc(json_doc["description"])
76+
else:
77+
return
78+
79+
affected_purls = set()
80+
fixed_purls = set()
81+
82+
for pkg in json_doc['packages']:
83+
affected_purls.add(PackageURL(
84+
name=pkg['id'],
85+
version=pkg['affected'],
86+
type='nuget'))
87+
88+
fixed_purls.add(PackageURL(
89+
name=pkg['id'],
90+
version=pkg['fix'],
91+
type='nuget'))
92+
93+
return Advisory(
94+
summary=json_doc['description'],
95+
impacted_package_urls=affected_purls,
96+
resolved_package_urls=fixed_purls,
97+
reference_urls=[json_doc['link']],
98+
cve_id=vuln_id)

‎vulnerabilities/migrations/0009_retiredotnet_importer.py‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# Copyright (c) 2017 nexB Inc. and others. All rights reserved.
2+
# http://nexb.com and https://github.com/nexB/vulnerablecode/
3+
# The VulnerableCode software is licensed under the Apache License version 2.0.
4+
# Data generated with VulnerableCode require an acknowledgment.
5+
#
6+
# You may not use this software except in compliance with the License.
7+
# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
8+
# Unless required by applicable law or agreed to in writing, software distributed
9+
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
10+
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
11+
# specific language governing permissions and limitations under the License.
12+
#
13+
# When you publish or redistribute any data created with VulnerableCode or any VulnerableCode
14+
# derivative work, you must accompany this data with the following acknowledgment:
15+
#
16+
# Generated with VulnerableCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
17+
# OR CONDITIONS OF ANY KIND, either express or implied. No content created from
18+
# VulnerableCode should be considered or used as legal advice. Consult an Attorney
19+
# for any legal advice.
20+
# VulnerableCode is a free software code scanning tool from nexB Inc. and others.
21+
# Visit https://github.com/nexB/vulnerablecode/ for support and download.
22+
23+
from django.db import migrations
24+
25+
26+
def add_retiredotnet_importer(apps, _):
27+
Importer = apps.get_model('vulnerabilities', 'Importer')
28+
29+
Importer.objects.create(
30+
name='retiredotnet',
31+
license='MIT',
32+
last_run=None,
33+
data_source='RetireDotnetDataSource',
34+
data_source_cfg={
35+
'repository_url': 'https://github.com/RetireNet/Packages.git',
36+
},
37+
)
38+
39+
40+
def remove_retiredotnet_importer(apps, _):
41+
Importer = apps.get_model('vulnerabilities', 'Importer')
42+
qs = Importer.objects.filter(name='RetireDotnet')
43+
if qs:
44+
qs[0].delete()
45+
46+
47+
class Migration(migrations.Migration):
48+
49+
dependencies = [
50+
('vulnerabilities', '0008_ruby_importer'),
51+
]
52+
53+
operations = [
54+
migrations.RunPython(add_retiredotnet_importer, remove_retiredotnet_importer),
55+
]

‎vulnerabilities/tests/test_data/retiredotnet/test_file.json‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
{
2+
"link": "https://github.com/aspnet/Announcements/issues/359",
3+
"description": "Microsoft Security Advisory CVE-2019-0982: ASP.NET Core Denial of Service Vulnerability",
4+
"packages": [
5+
{
6+
"id": "Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
7+
"affected": "1.0.0",
8+
"fix": "1.0.11"
9+
},
10+
{
11+
"id": "Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
12+
"affected": "1.0.1",
13+
"fix": "1.0.11"
14+
},
15+
{
16+
"id": "Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
17+
"affected": "1.0.2",
18+
"fix": "1.0.11"
19+
},
20+
{
21+
"id": "Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
22+
"affected": "1.0.3",
23+
"fix": "1.0.11"
24+
},
25+
{
26+
"id": "Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
27+
"affected": "1.0.4",
28+
"fix": "1.0.11"
29+
},
30+
31+
{
32+
"id": "Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
33+
"affected": "1.1.0",
34+
"fix": "1.1.5"
35+
}
36+
]
37+
}

‎vulnerabilities/tests/test_retiredotnet.py‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
# Copyright (c) 2017 nexB Inc. and others. All rights reserved.
2+
# http://nexb.com and https://github.com/nexB/vulnerablecode/
3+
# The VulnerableCode software is licensed under the Apache License version 2.0.
4+
# Data generated with VulnerableCode require an acknowledgment.
5+
#
6+
# You may not use this software except in compliance with the License.
7+
# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
8+
# Unless required by applicable law or agreed to in writing, software distributed
9+
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
10+
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
11+
# specific language governing permissions and limitations under the License.
12+
#
13+
# When you publish or redistribute any data created with VulnerableCode or any VulnerableCode
14+
# derivative work, you must accompany this data with the following acknowledgment:
15+
#
16+
# Generated with VulnerableCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
17+
# OR CONDITIONS OF ANY KIND, either express or implied. No content created from
18+
# VulnerableCode should be considered or used as legal advice. Consult an Attorney
19+
# for any legal advice.
20+
# VulnerableCode is a free software code scanning tool from nexB Inc. and others.
21+
# Visit https://github.com/nexB/vulnerablecode/ for support and download.
22+
23+
import os
24+
from unittest import TestCase
25+
from collections import OrderedDict
26+
27+
from packageurl import PackageURL
28+
29+
from vulnerabilities.importers.retiredotnet import RetireDotnetDataSource
30+
from vulnerabilities.data_source import Advisory
31+
32+
BASE_DIR = os.path.dirname(os.path.abspath(__file__))
33+
34+
35+
class TestRetireDotnetDataSource(TestCase):
36+
37+
@classmethod
38+
def setUpClass(cls):
39+
data_source_cfg = {
40+
'repository_url': 'https://test.net', }
41+
cls.data_src = RetireDotnetDataSource(1, config=data_source_cfg)
42+
43+
def test_vuln_id_from_desc(self):
44+
45+
gibberish = "xyzabcpqr123" * 50 + "\n" * 100
46+
res = self.data_src.vuln_id_from_desc(gibberish)
47+
assert res is None
48+
49+
desc = "abcdef CVE-2002-1968 pqrstuvwxyz:_|-|"
50+
res = self.data_src.vuln_id_from_desc(desc)
51+
assert res == "CVE-2002-1968"
52+
53+
def test_process_file(self):
54+
55+
path = os.path.join(BASE_DIR, "test_data/retiredotnet/test_file.json")
56+
expected_data = Advisory(
57+
summary=('Microsoft Security Advisory CVE-2019-0982: '
58+
'ASP.NET Core Denial of Service Vulnerability'),
59+
impacted_package_urls={
60+
PackageURL(
61+
type='nuget',
62+
namespace=None,
63+
name='Microsoft.AspNetCore.SignalR.Protocols.MessagePack',
64+
version='1.0.4',
65+
qualifiers=OrderedDict(),
66+
subpath=None),
67+
PackageURL(
68+
type='nuget',
69+
namespace=None,
70+
name='Microsoft.AspNetCore.SignalR.Protocols.MessagePack',
71+
version='1.0.0',
72+
qualifiers=OrderedDict(),
73+
subpath=None),
74+
PackageURL(
75+
type='nuget',
76+
namespace=None,
77+
name='Microsoft.AspNetCore.SignalR.Protocols.MessagePack',
78+
version='1.0.2',
79+
qualifiers=OrderedDict(),
80+
subpath=None),
81+
PackageURL(
82+
type='nuget',
83+
namespace=None,
84+
name='Microsoft.AspNetCore.SignalR.Protocols.MessagePack',
85+
version='1.0.3',
86+
qualifiers=OrderedDict(),
87+
subpath=None),
88+
PackageURL(
89+
type='nuget',
90+
namespace=None,
91+
name='Microsoft.AspNetCore.SignalR.Protocols.MessagePack',
92+
version='1.1.0',
93+
qualifiers=OrderedDict(),
94+
subpath=None),
95+
PackageURL(
96+
type='nuget',
97+
namespace=None,
98+
name='Microsoft.AspNetCore.SignalR.Protocols.MessagePack',
99+
version='1.0.1',
100+
qualifiers=OrderedDict(),
101+
subpath=None)},
102+
resolved_package_urls={
103+
PackageURL(
104+
type='nuget',
105+
namespace=None,
106+
name='Microsoft.AspNetCore.SignalR.Protocols.MessagePack',
107+
version='1.0.11',
108+
qualifiers=OrderedDict(),
109+
subpath=None),
110+
PackageURL(
111+
type='nuget',
112+
namespace=None,
113+
name='Microsoft.AspNetCore.SignalR.Protocols.MessagePack',
114+
version='1.1.5',
115+
qualifiers=OrderedDict(),
116+
subpath=None)},
117+
reference_urls=['https://github.com/aspnet/Announcements/issues/359'],
118+
reference_ids=[],
119+
cve_id='CVE-2019-0982')
120+
121+
found_data = self.data_src.process_file(path)
122+
123+
assert expected_data == found_data

0 commit comments

Comments
 (0)