Skip to content

Commit 83f5a21

Browse files
keshav-spacekeshav-space
committed
add initial config for vulntotal
- add osv validator Signed-off-by: Keshav Priyadarshi <git@keshav.space>
1 parent 8ccb202 commit 83f5a21

5 files changed

Lines changed: 193 additions & 0 deletions

File tree

‎vulntotal/validator.py‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
#
2+
# Copyright (c) nexB Inc. and others. All rights reserved.
3+
# http://nexb.com and https://github.com/nexB/vulnerablecode/
4+
# The VulnTotal software is licensed under the Apache License version 2.0.
5+
# Data generated with VulnTotal require an acknowledgment.
6+
#
7+
# You may not use this software except in compliance with the License.
8+
# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
9+
# Unless required by applicable law or agreed to in writing, software distributed
10+
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
11+
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
12+
# specific language governing permissions and limitations under the License.
13+
#
14+
# When you publish or redistribute any data created with VulnTotal or any VulnTotal
15+
# derivative work, you must accompany this data with the following acknowledgment:
16+
#
17+
# Generated with VulnTotal and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
18+
# OR CONDITIONS OF ANY KIND, either express or implied. No content created from
19+
# VulnTotal should be considered or used as legal advice. Consult an Attorney
20+
# for any legal advice.
21+
# VulnTotal is a free software tool from nexB Inc. and others.
22+
# Visit https://github.com/nexB/vulnerablecode/ for support and download.
23+
24+
import dataclasses
25+
import json
26+
from typing import Iterable
27+
from typing import List
28+
29+
30+
@dataclasses.dataclass(order=True)
31+
class VendorData:
32+
raw_dump: str = ""
33+
aliases: List[str] = dataclasses.field(default_factory=list)
34+
affected_versions: List[str] = dataclasses.field(default_factory=list)
35+
fixed_versions: List[str] = dataclasses.field(default_factory=list)
36+
37+
def to_dict(self):
38+
return {
39+
"affected_versions": self.affected_versions,
40+
"fixed_versions": self.fixed_versions,
41+
"aliases": self.aliases,
42+
"raw_dump": self.raw_dump,
43+
}
44+
45+
46+
class Validator:
47+
def validator_advisory(self, purl) -> Iterable[VendorData]:
48+
"""
49+
Yield VendorData object corresponding to vendor
50+
"""
51+
return NotImplementedError

‎vulntotal/validator_runner.py‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
#
2+
# Copyright (c) nexB Inc. and others. All rights reserved.
3+
# http://nexb.com and https://github.com/nexB/vulnerablecode/
4+
# The VulnTotal software is licensed under the Apache License version 2.0.
5+
# Data generated with VulnTotal require an acknowledgment.
6+
#
7+
# You may not use this software except in compliance with the License.
8+
# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
9+
# Unless required by applicable law or agreed to in writing, software distributed
10+
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
11+
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
12+
# specific language governing permissions and limitations under the License.
13+
#
14+
# When you publish or redistribute any data created with VulnTotal or any VulnTotal
15+
# derivative work, you must accompany this data with the following acknowledgment:
16+
#
17+
# Generated with VulnTotal and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
18+
# OR CONDITIONS OF ANY KIND, either express or implied. No content created from
19+
# VulnTotal should be considered or used as legal advice. Consult an Attorney
20+
# for any legal advice.
21+
# VulnTotal is a free software tool from nexB Inc. and others.
22+
# Visit https://github.com/nexB/vulnerablecode/ for support and download.

‎vulntotal/validators/__init__.py‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
#
2+
# Copyright (c) nexB Inc. and others. All rights reserved.
3+
# http://nexb.com and https://github.com/nexB/vulnerablecode/
4+
# The VulnTotal software is licensed under the Apache License version 2.0.
5+
# Data generated with VulnTotal require an acknowledgment.
6+
#
7+
# You may not use this software except in compliance with the License.
8+
# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
9+
# Unless required by applicable law or agreed to in writing, software distributed
10+
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
11+
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
12+
# specific language governing permissions and limitations under the License.
13+
#
14+
# When you publish or redistribute any data created with VulnTotal or any VulnTotal
15+
# derivative work, you must accompany this data with the following acknowledgment:
16+
#
17+
# Generated with VulnTotal and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
18+
# OR CONDITIONS OF ANY KIND, either express or implied. No content created from
19+
# VulnTotal should be considered or used as legal advice. Consult an Attorney
20+
# for any legal advice.
21+
# VulnTotal is a free software tool from nexB Inc. and others.
22+
# Visit https://github.com/nexB/vulnerablecode/ for support and download.

‎vulntotal/validators/osv.py‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
#
2+
# Copyright (c) nexB Inc. and others. All rights reserved.
3+
# http://nexb.com and https://github.com/nexB/vulnerablecode/
4+
# The VulnTotal software is licensed under the Apache License version 2.0.
5+
# Data generated with VulnTotal require an acknowledgment.
6+
#
7+
# You may not use this software except in compliance with the License.
8+
# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
9+
# Unless required by applicable law or agreed to in writing, software distributed
10+
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
11+
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
12+
# specific language governing permissions and limitations under the License.
13+
#
14+
# When you publish or redistribute any data created with VulnTotal or any VulnTotal
15+
# derivative work, you must accompany this data with the following acknowledgment:
16+
#
17+
# Generated with VulnTotal and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
18+
# OR CONDITIONS OF ANY KIND, either express or implied. No content created from
19+
# VulnTotal should be considered or used as legal advice. Consult an Attorney
20+
# for any legal advice.
21+
# VulnTotal is a free software tool from nexB Inc. and others.
22+
# Visit https://github.com/nexB/vulnerablecode/ for support and download.
23+
24+
import json
25+
from typing import Iterable
26+
27+
import requests
28+
from packageurl import PackageURL
29+
30+
from vulntotal.validator import Validator
31+
from vulntotal.validator import VendorData
32+
33+
34+
class OSVValidator(Validator):
35+
spdx_license_expression = "Apache-2.0"
36+
license_url = "https://github.com/google/osv/blob/master/LICENSE"
37+
38+
def validator_advisory(self, purl) -> Iterable[VendorData]:
39+
40+
# source https://ossf.github.io/osv-schema/
41+
supported_ecosystem = {
42+
"npm": "npm",
43+
"maven": "Maven",
44+
"go": "Go",
45+
"nuget": "NuGet",
46+
"pypi": "PyPI",
47+
"rubygems": "RubyGems",
48+
"crates.io": "crates.io",
49+
"packagist": "Packagist",
50+
"linux": "Linux",
51+
"oss-fuzz": "OSS-Fuzz",
52+
"debian": "Debian",
53+
"hex": "Hex",
54+
"android": "Android",
55+
}
56+
url = "https://api.osv.dev/v1/query"
57+
58+
requestpayload = {}
59+
requestpayload["version"] = purl.version
60+
requestpayload["package"] = {}
61+
requestpayload["package"]["name"] = purl.name
62+
if purl.type in supported_ecosystem:
63+
requestpayload["package"]["ecosystem"] = supported_ecosystem[purl.type]
64+
65+
raw_response = requests.post(url, data=str(requestpayload))
66+
response = json.loads(raw_response.text)
67+
68+
for vuln in response["vulns"]:
69+
fixed = [fix["events"][1]["fixed"] for fix in vuln["affected"][0]["ranges"]]
70+
71+
yield VendorData(
72+
aliases=vuln["aliases"],
73+
affected_versions=vuln["affected"][0]["versions"],
74+
fixed_versions=fixed,
75+
raw_dump=raw_response.text,
76+
)

‎vulntotal/validators/vulnerablecode.py‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
#
2+
# Copyright (c) nexB Inc. and others. All rights reserved.
3+
# http://nexb.com and https://github.com/nexB/vulnerablecode/
4+
# The VulnTotal software is licensed under the Apache License version 2.0.
5+
# Data generated with VulnTotal require an acknowledgment.
6+
#
7+
# You may not use this software except in compliance with the License.
8+
# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
9+
# Unless required by applicable law or agreed to in writing, software distributed
10+
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
11+
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
12+
# specific language governing permissions and limitations under the License.
13+
#
14+
# When you publish or redistribute any data created with VulnTotal or any VulnTotal
15+
# derivative work, you must accompany this data with the following acknowledgment:
16+
#
17+
# Generated with VulnTotal and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
18+
# OR CONDITIONS OF ANY KIND, either express or implied. No content created from
19+
# VulnTotal should be considered or used as legal advice. Consult an Attorney
20+
# for any legal advice.
21+
# VulnTotal is a free software tool from nexB Inc. and others.
22+
# Visit https://github.com/nexB/vulnerablecode/ for support and download.

0 commit comments

Comments
 (0)