Skip to content

Commit 772c150

Browse files
tushar912tushar912
committed
Add istio importer and tests
Signed-off-by: Tushar912 <tushar.912u@gmail.com>
1 parent 1d6bade commit 772c150

5 files changed

Lines changed: 318 additions & 0 deletions

File tree

‎vulnerabilities/importer_yielder.py‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -244,6 +244,15 @@
244244
"etags": {}
245245
},
246246
},
247+
{
248+
'name': 'istio',
249+
'license': '',
250+
'last_run': None,
251+
'data_source': 'IstioDataSource',
252+
'data_source_cfg': {
253+
'repository_url': 'https://github.com/istio/istio.io'
254+
},
255+
},
247256

248257
]
249258

‎vulnerabilities/importers/__init__.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,3 +45,4 @@
4545
from vulnerabilities.importers.ubuntu import UbuntuDataSource
4646
from vulnerabilities.importers.ubuntu_usn import UbuntuUSNDataSource
4747
from vulnerabilities.importers.apache_tomcat import ApacheTomcatDataSource
48+
from vulnerabilities.importers.istio import IstioDataSource

‎vulnerabilities/importers/istio.py‎

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
# Copyright (c) nexB Inc. and others. All rights reserved.
2+
# http://nexb.com and https://github.com/nexB/vulnerablecode/
3+
# The VulnerableCode software is licensed under the Apache License version 2.0.
4+
# Data generated with VulnerableCode require an acknowledgment.
5+
#
6+
# You may not use this software except in compliance with the License.
7+
# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
8+
# Unless required by applicable law or agreed to in writing, software distributed
9+
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
10+
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
11+
# specific language governing permissions and limitations under the License.
12+
#
13+
# When you publish or redistribute any data created with VulnerableCode or any VulnerableCode
14+
# derivative work, you must accompany this data with the following acknowledgment:
15+
#
16+
# Generated with VulnerableCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
17+
# OR CONDITIONS OF ANY KIND, either express or implied. No content created from
18+
# VulnerableCode should be considered or used as legal advice. Consult an Attorney
19+
# for any legal advice.
20+
# VulnerableCode is a free software tool from nexB Inc. and others.
21+
# Visit https://github.com/nexB/vulnerablecode/ for support and download.
22+
23+
import asyncio
24+
from typing import List, Set
25+
26+
from dephell_specifier import RangeSpecifier
27+
from packageurl import PackageURL
28+
29+
from vulnerabilities.data_source import Advisory, GitDataSource, Reference
30+
from vulnerabilities.package_managers import GitHubTagsAPI
31+
32+
33+
class IstioDataSource(GitDataSource):
34+
def __enter__(self):
35+
super(IstioDataSource, self).__enter__()
36+
37+
if not getattr(self, "_added_files", None):
38+
self._added_files, self._updated_files = self.file_changes(
39+
recursive=True, file_ext="md", subdir="./content/en/news/security"
40+
)
41+
self.version_api = GitHubTagsAPI()
42+
self.set_api()
43+
44+
def set_api(self):
45+
asyncio.run(self.version_api.load_api(["istio/istio"]))
46+
47+
def updated_advisories(self) -> Set[Advisory]:
48+
files = self._updated_files
49+
advisories = []
50+
for f in files:
51+
processed_data = self.process_file(f)
52+
if processed_data:
53+
advisories.extend(processed_data)
54+
return self.batch_advisories(advisories)
55+
56+
def added_advisories(self) -> Set[Advisory]:
57+
files = self._added_files
58+
advisories = []
59+
for f in files:
60+
processed_data = self.process_file(f)
61+
if processed_data:
62+
advisories.extend(processed_data)
63+
return self.batch_advisories(advisories)
64+
65+
def get_versions_for_pkg_from_range_list(self, version_range_list):
66+
# Takes a list of version ranges(affected) of a package
67+
# as parameter and returns a tuple of safe package versions and
68+
# vulnerable package versions
69+
70+
safe_pkg_versions = []
71+
vuln_pkg_versions = []
72+
all_version_list = self.version_api.get("istio/istio")
73+
if not version_range_list:
74+
return all_version_list, []
75+
version_ranges = {RangeSpecifier(r) for r in version_range_list}
76+
for version in all_version_list:
77+
if any([version in v for v in version_ranges]):
78+
vuln_pkg_versions.append(version)
79+
80+
safe_pkg_versions = set(all_version_list) - set(vuln_pkg_versions)
81+
return safe_pkg_versions, vuln_pkg_versions
82+
83+
def get_data_from_md(self, file):
84+
data = {}
85+
for line in file:
86+
line = line.strip()
87+
line = line.split()
88+
if len(line) > 0 and line is not None:
89+
90+
start = line[0]
91+
92+
if start == "title:":
93+
data["title"] = " ".join(line[1:])
94+
elif start == "description:":
95+
data["description"] = " ".join(line[1:])
96+
elif start == "cves:":
97+
data["cves"] = " ".join(line[1:])
98+
data["cves"] = data["cves"].replace("[", "")
99+
data["cves"] = data["cves"].replace("]", "")
100+
data["cves"] = data["cves"].split(",")
101+
102+
elif start == "releases:":
103+
data["releases"] = " ".join(line[1:])
104+
data["releases"] = data["releases"].replace("[", "")
105+
data["releases"] = data["releases"].replace("]", "")
106+
data["releases"] = data["releases"].replace('"', "")
107+
data["releases"] = data["releases"].split(",")
108+
releases = []
109+
if data.get("releases"):
110+
for release in data["releases"]:
111+
release = release.strip()
112+
release = release.split(" ")
113+
if len(release) > 2:
114+
lbound = ">=" + release[0]
115+
ubound = "<=" + release[2]
116+
releases.append(lbound + "," + ubound)
117+
data["releases"] = releases
118+
119+
return data
120+
121+
def process_file(self, path):
122+
123+
advisories = []
124+
125+
with open(path) as f:
126+
data = {}
127+
128+
data = self.get_data_from_md(f)
129+
130+
if not data.get("cves"):
131+
data["cves"] = [""]
132+
133+
for cve_id in data["cves"]:
134+
135+
if not cve_id.startswith("CVE"):
136+
continue
137+
138+
safe_pkg_versions = []
139+
vuln_pkg_versions = []
140+
141+
if not data.get("releases"):
142+
data["releases"] = []
143+
144+
(
145+
safe_pkg_versions,
146+
vuln_pkg_versions,
147+
) = self.get_versions_for_pkg_from_range_list(data["releases"])
148+
149+
safe_purls = []
150+
vuln_purls = []
151+
152+
cve_id = cve_id
153+
154+
safe_purls = {
155+
PackageURL(name="istio", type="golang", version=version)
156+
for version in safe_pkg_versions
157+
}
158+
159+
vuln_purls = {
160+
PackageURL(name="istio", type="golang", version=version)
161+
for version in vuln_pkg_versions
162+
}
163+
164+
advisories.append(
165+
Advisory(
166+
summary=data["description"],
167+
impacted_package_urls=vuln_purls,
168+
resolved_package_urls=safe_purls,
169+
cve_id=cve_id,
170+
)
171+
)
172+
173+
return advisories

‎vulnerabilities/tests/test_data/istio/test_file.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
title: ISTIO-SECURITY-2019-001
3+
subtitle: Security Bulletin
4+
description: Incorrect access control.
5+
cves: [CVE-2019-12243]
6+
cvss: "8.9"
7+
vector: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:H/RL:O/RC:C"
8+
releases: ["1.1 to 1.1.15", "1.2 to 1.2.6", "1.3 to 1.3.1"]
9+
publishdate: 2019-05-28
10+
keywords: [CVE]
11+
skip_seealso: true
12+
aliases:
13+
- /blog/2019/cve-2019-12243
14+
- /news/2019/cve-2019-12243
15+
---

‎vulnerabilities/tests/test_istio.py‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
# Copyright (c) nexB Inc. and others. All rights reserved.
2+
# http://nexb.com and https://github.com/nexB/vulnerablecode/
3+
# The VulnerableCode software is licensed under the Apache License version 2.0.
4+
# Data generated with VulnerableCode require an acknowledgment.
5+
#
6+
# You may not use this software except in compliance with the License.
7+
# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
8+
# Unless required by applicable law or agreed to in writing, software distributed
9+
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
10+
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
11+
# specific language governing permissions and limitations under the License.
12+
#
13+
# When you publish or redistribute any data created with VulnerableCode or any VulnerableCode
14+
# derivative work, you must accompany this data with the following acknowledgment:
15+
#
16+
# Generated with VulnerableCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
17+
# OR CONDITIONS OF ANY KIND, either express or implied. No content created from
18+
# VulnerableCode should be considered or used as legal advice. Consult an Attorney
19+
# for any legal advice.
20+
# VulnerableCode is a free software tool from nexB Inc. and others.
21+
# Visit https://github.com/nexB/vulnerablecode/ for support and download.
22+
23+
import os
24+
from collections import OrderedDict
25+
from unittest import TestCase
26+
27+
from packageurl import PackageURL
28+
29+
from vulnerabilities.data_source import Advisory, Reference
30+
from vulnerabilities.importers.istio import IstioDataSource
31+
from vulnerabilities.package_managers import GitHubTagsAPI
32+
33+
BASE_DIR = os.path.dirname(os.path.abspath(__file__))
34+
35+
36+
class TestIstioDataSource(TestCase):
37+
@classmethod
38+
def setUpClass(cls):
39+
data_source_cfg = {
40+
"repository_url": "",
41+
}
42+
cls.data_src = IstioDataSource(1, config=data_source_cfg)
43+
cls.data_src.version_api = GitHubTagsAPI(
44+
{
45+
"istio/istio": [
46+
"1.1.0-rc.0",
47+
"1.1.0-rc.1",
48+
"1.1.0-rc.2",
49+
"1.1.0-rc.3",
50+
"1.1.0-rc.4",
51+
"1.1.0-rc.5",
52+
"1.1.0-rc.6",
53+
"1.1.0-snapshot.2",
54+
"1.1.0-snapshot.3",
55+
]
56+
}
57+
)
58+
59+
def test_process_file(self):
60+
61+
path = os.path.join(BASE_DIR, "test_data/istio/test_file.md")
62+
expected_data = [
63+
Advisory(
64+
summary=("Incorrect access control."),
65+
impacted_package_urls={
66+
PackageURL(
67+
type="golang",
68+
name="istio",
69+
version="1.1.0-snapshot.2",
70+
),
71+
PackageURL(
72+
type="golang",
73+
name="istio",
74+
version="1.1.0-snapshot.3",
75+
),
76+
},
77+
resolved_package_urls={
78+
PackageURL(
79+
type="golang",
80+
name="istio",
81+
version="1.1.0-rc.2",
82+
),
83+
PackageURL(
84+
type="golang",
85+
name="istio",
86+
version="1.1.0-rc.4",
87+
),
88+
PackageURL(
89+
type="golang",
90+
name="istio",
91+
version="1.1.0-rc.3",
92+
),
93+
PackageURL(
94+
type="golang",
95+
name="istio",
96+
version="1.1.0-rc.0",
97+
),
98+
PackageURL(
99+
type="golang",
100+
name="istio",
101+
version="1.1.0-rc.5",
102+
),
103+
PackageURL(
104+
type="golang",
105+
name="istio",
106+
version="1.1.0-rc.1",
107+
),
108+
PackageURL(
109+
type="golang",
110+
name="istio",
111+
version="1.1.0-rc.6",
112+
),
113+
},
114+
cve_id="CVE-2019-12243",
115+
)
116+
]
117+
118+
found_data = self.data_src.process_file(path)
119+
120+
assert expected_data == found_data

0 commit comments

Comments
 (0)