Skip to content

Commit 94a5f10

Browse files
ziadhanyziadhany
committed
Add API support for PackageCommitPatch
Add a test Signed-off-by: ziad hany <ziadhany2016@gmail.com>
1 parent a191687 commit 94a5f10

3 files changed

Lines changed: 171 additions & 2 deletions

File tree

‎vulnerabilities/templates/advisory_detail.html‎

Lines changed: 44 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,16 @@
8080
</a>
8181
</li>
8282
{% endif %}
83-
83+
84+
<li data-tab="patch-url">
85+
<a>
86+
<span>
87+
{% with pcp_length=package_commit_patches|length %}
88+
Patches: ({{ advisory.patches.count|add:pcp_length }})
89+
{% endwith %}
90+
</span>
91+
</a>
92+
</li>
8493
<!-- <li data-tab="history">
8594
<a>
8695
<span>
@@ -184,6 +193,18 @@
184193
</a>
185194
</td>
186195
</tr>
196+
<tr>
197+
<td class="two-col-left"
198+
data-tooltip="Risk expressed as a number ranging from 0 to 10. It is calculated by multiplying
199+
the weighted severity and exploitability values, capped at a maximum of 10.
200+
"
201+
>Introduced and Fixed Package Commit Patches</td>
202+
<td class="two-col-right wrap-strings">
203+
<a href="/advisories/commits/{{ advisory.avid }}">
204+
Package Commit Patches Details
205+
</a>
206+
</td>
207+
</tr>
187208
</tbody>
188209
</table>
189210
<div class="has-text-weight-bold tab-nested-div ml-1 mb-1 mt-6">
@@ -436,7 +457,6 @@
436457
</tr>
437458
{% endfor %}
438459
</div>
439-
440460

441461
<div class="tab-div content" data-content="epss">
442462
{% if epss_data %}
@@ -503,6 +523,28 @@
503523
{% endif %}
504524
</div>
505525

526+
<div class="tab-div content" data-content="patch-url">
527+
<table class="table is-bordered is-striped is-narrow is-hoverable is-fullwidth">
528+
<thead>
529+
<tr>
530+
<th style="width: 250px;"> Patch URL </th>
531+
</tr>
532+
</thead>
533+
{% for patch in patches %}
534+
<tr>
535+
<td class="wrap-strings"><a href="{{ patch.patch_url }}" target="_blank">{{ patch.patch_url }}<i
536+
class="fa fa-external-link fa_link_custom"></i></a></td>
537+
</tr>
538+
{% empty %}
539+
<tr>
540+
<td colspan="2">
541+
There are no known patches.
542+
</td>
543+
</tr>
544+
{% endfor %}
545+
</table>
546+
</div>
547+
506548
<div class="tab-div content" data-content="severities-vectors">
507549
{% for severity_vector in severity_vectors %}
508550
{% if severity_vector.vector.version == '2.0' %}

‎vulnerabilities/templates/advisory_package_commit_details.html‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
{% extends "base.html" %}
2+
{% load humanize %}
3+
{% load widget_tweaks %}
4+
{% load static %}
5+
{% load show_cvss %}
6+
{% load url_filters %}
7+
8+
{% block title %}
9+
VulnerableCode Advisory Package Commit Patch Details - {{ advisoryv2.advisory_id }}
10+
{% endblock %}
11+
12+
{% block content %}
13+
14+
{% if advisoryv2 %}
15+
<section class="section pt-0">
16+
<div class="details-container">
17+
<article class="panel is-info panel-header-only">
18+
<div class="panel-heading py-2 is-size-6">
19+
Introduce and Fixing Package Commit Patch details for Advisory:
20+
<span class="tag is-white custom">
21+
{{ advisoryv2.advisory_id }}
22+
</span>
23+
</div>
24+
</article>
25+
26+
<div id="tab-content">
27+
<table class="table vcio-table width-100-pct mt-2">
28+
<thead>
29+
<tr>
30+
<th style="width: 50%;">Introduced in</th>
31+
<th>Fixed by</th>
32+
</tr>
33+
</thead>
34+
<tbody>
35+
{% for impact in advisoryv2.impacted_packages.all %}
36+
{% for pkg_commit_patch in impact.introduced_by_package_commit_patches.all %}
37+
<tr>
38+
<td>
39+
<a href="{{ pkg_commit_patch.vcs_url }}" target="_self">
40+
{{ pkg_commit_patch.base_purl }}@{{ pkg_commit_patch.commit_hash }}
41+
</a>
42+
</td>
43+
<td></td>
44+
</tr>
45+
{% endfor %}
46+
47+
{% for pkg_commit_patch in impact.fixed_by_package_commit_patches.all %}
48+
<tr>
49+
<td></td>
50+
<td>
51+
<a href="{{ pkg_commit_patch.vcs_url }}" target="_self">
52+
{{ impact.base_purl }}@{{ pkg_commit_patch.commit_hash }}
53+
</a>
54+
</td>
55+
</tr>
56+
{% endfor %}
57+
58+
{% empty %}
59+
<tr>
60+
<td colspan="2">
61+
This vulnerability is not known to affect any package commits.
62+
</td>
63+
</tr>
64+
{% endfor %}
65+
</tbody>
66+
</table>
67+
</div>
68+
69+
</div>
70+
</section>
71+
{% endif %}
72+
73+
<script src="{% static 'js/main.js' %}" crossorigin="anonymous"></script>
74+
75+
{% endblock %}

‎vulnerabilities/views.py‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -743,6 +743,7 @@ def add_ssvc(ssvc):
743743
"advisory": advisory,
744744
"severities": list(advisory.severities.all()),
745745
"references": list(advisory.references.all()),
746+
"patches": list(advisory.patches.all()),
746747
"aliases": list(advisory.aliases.all()),
747748
"severity_vectors": severity_vectors,
748749
"weaknesses": weaknesses_present_in_db,
@@ -940,6 +941,57 @@ def get_queryset(self):
940941
)
941942

942943

944+
class AdvisoryPackageCommitPatchDetails(DetailView):
945+
"""
946+
View to display all packages introduce by or fixing a specific vulnerability.
947+
URL: /advisories/{id}/commits
948+
"""
949+
950+
model = models.AdvisoryV2
951+
template_name = "advisory_package_commit_details.html"
952+
slug_url_kwarg = "avid"
953+
954+
def get_object(self, queryset=None):
955+
avid = self.kwargs.get(self.slug_url_kwarg)
956+
if not avid:
957+
raise Http404("Missing advisory identifier")
958+
959+
advisory = models.AdvisoryV2.objects.latest_for_avid(avid)
960+
961+
if not advisory:
962+
raise Http404(f"No advisory found for avid: {avid}")
963+
964+
return advisory
965+
966+
def get_queryset(self):
967+
"""
968+
Prefetch and optimize related data to minimize database hits.
969+
"""
970+
return (
971+
super()
972+
.get_queryset()
973+
.prefetch_related(
974+
Prefetch(
975+
"impacted_packages",
976+
queryset=models.ImpactedPackage.objects.order_by("base_purl").prefetch_related(
977+
Prefetch(
978+
"introduced_by_package_commit_patches",
979+
queryset=models.PackageCommitPatch.objects.only(
980+
"commit_hash", "vcs_url", "patch_url", "commit_url"
981+
),
982+
),
983+
Prefetch(
984+
"fixed_by_package_commit_patches",
985+
queryset=models.PackageCommitPatch.objects.only(
986+
"commit_hash", "vcs_url", "patch_url", "commit_url"
987+
),
988+
),
989+
),
990+
)
991+
)
992+
)
993+
994+
943995
class PipelineScheduleListView(VulnerableCodeListView, FormMixin):
944996
model = PipelineSchedule
945997
context_object_name = "schedule_list"

0 commit comments

Comments
 (0)