Merge branch 'main' into 798-new-ui

Reference: #798

Signed-off-by: John M. Horan johnmhoran@gmail.com

Author: johnmhoran

CHANGELOG.rst

@@ -52,6 +52,13 @@ Version v30.0.0
 - Package endpoint will give fixed packages of only those that
   matches type, name, namespace, subpath and qualifiers of the package queried.
 
+- Paginated initial listings to display a small number of records 
+  and provided page per size with a maximum limit of 100 records per page.
+
+- Add fixed packages in vulnerabilities details in packages endpoint.
+
+- Add bulk search support for CPEs.
+
 Other:
 
 - we dropped calver to use a plain semver.

requirements.txt

@@ -21,7 +21,7 @@ cryptography==36.0.2
 decorator==5.1.1
 defusedxml==0.7.1
 distro==1.7.0
-Django==4.0.6
+Django==4.0.7
 django-environ==0.8.1
 django-filter==21.1
 django-widget-tweaks==1.4.12

vulnerabilities/api.py

@@ -56,11 +56,15 @@ class VulnSerializerRefsAndSummary(serializers.HyperlinkedModelSerializer):
     Used for nesting inside package focused APIs.
     """
 
+    fixed_packages = MinimalPackageSerializer(
+        many=True, source="filtered_fixed_packages", read_only=True
+    )
+
     references = VulnerabilityReferenceSerializer(many=True, source="vulnerabilityreference_set")
 
     class Meta:
         model = Vulnerability
-        fields = ["url", "vulnerability_id", "summary", "references"]
+        fields = ["url", "vulnerability_id", "summary", "references", "fixed_packages"]
 
 
 class MinimalVulnerabilitySerializer(serializers.HyperlinkedModelSerializer):
@@ -73,21 +77,6 @@ class Meta:
         fields = ["url", "vulnerability_id"]
 
 
-class PackageSerializerFixedVulns(serializers.HyperlinkedModelSerializer):
-    """
-    Used for nesting inside vulnerability focused APIs.
-    """
-
-    purl = serializers.CharField(source="package_url")
-    fixing_vulnerabilities = MinimalVulnerabilitySerializer(
-        many=True, source="resolved_to", read_only=True
-    )
-
-    class Meta:
-        model = Package
-        fields = ["url", "purl", "fixing_vulnerabilities"]
-
-
 class AliasSerializer(serializers.HyperlinkedModelSerializer):
     """
     Used for nesting inside package focused APIs.
@@ -128,13 +117,57 @@ def to_representation(self, instance):
         return data
 
     purl = serializers.CharField(source="package_url")
-    affected_by_vulnerabilities = VulnSerializerRefsAndSummary(
-        many=True, source="vulnerable_to", read_only=True
-    )
-    fixing_vulnerabilities = VulnSerializerRefsAndSummary(
-        many=True, source="resolved_to", read_only=True
-    )
-    fixed_packages = PackageSerializerFixedVulns(many=True, read_only=True)
+
+    affected_by_vulnerabilities = serializers.SerializerMethodField("get_affected_vulnerabilities")
+
+    fixing_vulnerabilities = serializers.SerializerMethodField("get_fixed_vulnerabilities")
+
+    def get_fixed_packages(self, package):
+        """
+        Return a queryset of all packages that fixes a vulnerability with
+        same type, namespace, name, subpath and qualifiers of the `package`
+        """
+        return Package.objects.filter(
+            name=package.name,
+            namespace=package.namespace,
+            type=package.type,
+            qualifiers=package.qualifiers,
+            subpath=package.subpath,
+            packagerelatedvulnerability__fix=True,
+        ).distinct()
+
+    def get_vulnerabilities_for_a_package(self, package, fix):
+        """
+        Return a queryset of vulnerabilities related to the given `package`.
+        Return vulnerabilities that affects the `package` if given `fix` flag is False,
+        otherwise return vulnerabilities fixed by the `package`.
+        """
+        fixed_packages = self.get_fixed_packages(package=package)
+        qs = package.vulnerabilities.filter(packagerelatedvulnerability__fix=fix)
+        qs = qs.prefetch_related(
+            Prefetch(
+                "packages",
+                queryset=fixed_packages,
+                to_attr="filtered_fixed_packages",
+            )
+        )
+        return VulnSerializerRefsAndSummary(
+            instance=qs,
+            many=True,
+            context={"request": self.context["request"]},
+        ).data
+
+    def get_fixed_vulnerabilities(self, package):
+        """
+        Return a queryset of vulnerabilities fixed in the given `package`.
+        """
+        return self.get_vulnerabilities_for_a_package(package=package, fix=True)
+
+    def get_affected_vulnerabilities(self, package):
+        """
+        Return a queryset of vulnerabilities that affects the given `package`.
+        """
+        return self.get_vulnerabilities_for_a_package(package=package, fix=False)
 
     class Meta:
         model = Package
@@ -148,7 +181,6 @@ class Meta:
             "qualifiers",
             "subpath",
             "affected_by_vulnerabilities",
-            "fixed_packages",
             "fixing_vulnerabilities",
         ]
 
@@ -177,7 +209,6 @@ def filter_purl(self, queryset, name, value):
 class PackageViewSet(viewsets.ReadOnlyModelViewSet):
     queryset = Package.objects.all()
     serializer_class = PackageSerializer
-    paginate_by = 50
     filter_backends = (filters.DjangoFilterBackend,)
     filterset_class = PackageFilterSet
 
@@ -252,7 +283,6 @@ def get_queryset(self):
         )
 
     serializer_class = VulnerabilitySerializer
-    paginate_by = 50
     filter_backends = (filters.DjangoFilterBackend,)
     filterset_class = VulnerabilityFilterSet
 
@@ -270,10 +300,33 @@ class CPEViewSet(viewsets.ReadOnlyModelViewSet):
         vulnerabilityreference__reference_id__startswith="cpe"
     ).distinct()
     serializer_class = VulnerabilitySerializer
-    paginate_by = 50
     filter_backends = (filters.DjangoFilterBackend,)
     filterset_class = CPEFilterSet
 
+    @action(detail=False, methods=["post"])
+    def bulk_search(self, request):
+        """
+        This endpoint is used to search for vulnerabilities by more than one CPE.
+        """
+        response = []
+        cpes = request.data.get("cpes", []) or []
+        if not cpes or not isinstance(cpes, list):
+            return Response(
+                status=400,
+                data={"Error": "A non-empty 'cpe' list of package URLs is required."},
+            )
+        for cpe in cpes:
+            if not cpe.startswith("cpe"):
+                return Response(status=400, data={"Error": f"Invalid CPE: {cpe}"})
+        vulnerabilitiesResponse = Vulnerability.objects.filter(
+            vulnerabilityreference__reference_id__in=cpes
+        ).distinct()
+        return Response(
+            VulnerabilitySerializer(
+                vulnerabilitiesResponse, many=True, context={"request": request}
+            ).data
+        )
+
 
 class AliasFilterSet(filters.FilterSet):
     alias = filters.CharFilter(method="filter_alias")
@@ -286,6 +339,5 @@ def filter_alias(self, queryset, name, value):
 class AliasViewSet(viewsets.ReadOnlyModelViewSet):
     queryset = Vulnerability.objects.all()
     serializer_class = VulnerabilitySerializer
-    paginate_by = 50
     filter_backends = (filters.DjangoFilterBackend,)
     filterset_class = AliasFilterSet

vulnerabilities/pagination.py

@@ -0,0 +1,6 @@
+from rest_framework.pagination import PageNumberPagination
+
+
+class SmallResultSetPagination(PageNumberPagination):
+    page_size_query_param = "page_size"
+    max_page_size = 100