Refactor views for new models, do some style changes

The views are now based on PackageRelatedVulnerablity model.
Apart from that out of need, the properties vulnerable_to and
resolved_to are added to Vulnerability and Package models.
Style changes include centering the search bars.

Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>

Author: sbs2001

vulnerabilities/models.py

@@ -45,6 +45,14 @@ class Vulnerability(models.Model):
         help_text='Summary of the vulnerability', blank=True)
     cvss = models.FloatField(max_length=100, help_text='CVSS Score', null=True)
 
+    @property
+    def vulnerable_to(self):
+        return self.packagerelatedvulnerability_set.filter(is_vulnerable=True)
+    
+    @property
+    def resolved_to(self):
+        return self.packagerelatedvulnerability_set.filter(is_vulnerable=False)
+
     def __str__(self):
         return self.cve_id or self.summary
 
@@ -80,6 +88,14 @@ class Package(PackageURLMixin):
     vulnerabilities = models.ManyToManyField(
         to='Vulnerability', through='PackageRelatedVulnerability')
 
+    @property
+    def vulnerable_to(self):
+        return self.packagerelatedvulnerability_set.filter(is_vulnerable=True)
+    
+    @property
+    def resolved_to(self):
+        return self.packagerelatedvulnerability_set.filter(is_vulnerable=False)
+
     class Meta:
         unique_together = ('name', 'namespace', 'type',
                            'version', 'qualifiers', 'subpath')

vulnerabilities/templates/packages.html

@@ -6,9 +6,8 @@
 {% load widget_tweaks %}
 
 <section class="columns  has-text-centered">  
-    <div class = "column is-one-quarter">
-    </div>
-    <form action="{% url 'package_search' %}" method="get">
+    <div class = "column is-three-fifths is-offset-one-fifth">
+        <form action="{% url 'package_search' %}" method="get">
       <div class="field is-horizontal">
         {% for field in  form %}
         {{ field|add_class:"input" }}
@@ -18,6 +17,8 @@
       </button>
     </form>
   </div>
+  </div>
+
 </section>
 
 {% if packages %}
@@ -40,8 +41,8 @@ <h3 class="subtitle">Total Results {{packages|length}}</h3>
       {% for package in packages %}
       <tr>
         <td><a href="{% url 'package_view' package.pk %}">{{package}}</a></td>
-        <td>{{package.resolvedpackage_set.all|length}}</td>
-        <td>{{package.impactedpackage_set.all|length}}</td>
+        <td>{{package.resolved_to.all|length}}</td>
+        <td>{{package.vulnerable_to.all|length}}</td>
       </tr>
       {% endfor %}
     </table>

vulnerabilities/templates/vulnerabilities.html

@@ -6,8 +6,8 @@
 {% block content %}
 
 <div class="columns">
-    <div class="column is-one-third mx-6">
-    </div>
+    <div class="column is-one-third is-offset-one-third">
+ 
      <form action="{% url 'vulnerability_search' %}" method="get">
       {% load widget_tweaks %}
       <div class="field is-horizontal">
@@ -17,6 +17,7 @@
         </button>
       </div>
       </form>
+       </div>
 </div>
 
 {% if vulnerabilities %}
@@ -38,8 +39,8 @@ <h3 class="subtitle" id="results">Total {{vulnerabilities|length}} results</h3>
           {% for vulnerability in  vulnerabilities %}
               <tr>
                   <td><a href="{% url 'vulnerability_view' vulnerability.pk %}">{{vulnerability.cve_id}}</a></td>
-                  <td>{{vulnerability.resolvedpackage_set.all|length}}</td>
-                  <td>{{vulnerability.impactedpackage_set.all|length}}</td>
+                  <td>{{vulnerability.resolved_to.all|length}}</td>
+                  <td>{{vulnerability.vulnerable_to.all|length}}</td>
               </tr>
           {% endfor %}
           </table>

vulnerabilities/templates/vulnerability.html

@@ -55,13 +55,13 @@ <h3>References:</h3>
             </span>
         </a>
 
-        {% if vulnerability.resolvedpackage_set.all %}
+        {% if vulnerability.resolved_to.all %}
             <h3> Patched Packages </h3>
             <table class="table is-bordered is-striped is-narrow is-hoverable is-fullwidth">
                 <tr>
                     <th> Package URL </th>
                 </tr>
-                {% for ref in vulnerability.resolvedpackage_set.all %}
+                {% for ref in vulnerability.resolved_to.all %}
                 <tr>
                     <td><a href ="{% url 'package_view' ref.package.pk %}"> {{ref.package}} </a> </td>
                 </tr>
@@ -71,13 +71,13 @@ <h3> Patched Packages </h3>
             <h3> No available patched packages </h3>
         {% endif %}
 
-        {% if vulnerability.impactedpackage_set.all %}
+        {% if vulnerability.vulnerable_to.all %}
             <h3> Vulnerable Packages </h3>
             <table class="table is-bordered is-striped is-narrow is-hoverable is-fullwidth">
                 <tr>
                     <th> Package URL </th>
                 </tr>
-                {% for ref in vulnerability.impactedpackage_set.all %}
+                {% for ref in vulnerability.vulnerable_to.all %}
                 <tr>
                     <td><a href ="{% url 'package_view' ref.package.pk %}"> {{ref.package}}</a></td>
                 </tr>

vulnerabilities/views.py

@@ -20,69 +20,68 @@
 #  VulnerableCode is a free software code scanning tool from nexB Inc. and others.
 #  Visit https://github.com/nexB/vulnerablecode/ for support and download.
 
-from itertools import chain
-
 from django.shortcuts import render
 from django.urls import reverse
-from django.http import HttpResponse
 from django.views.generic.list import ListView
 from django.views.generic.detail import DetailView
 from django.views.generic.edit import UpdateView
 from django.views.generic.edit import CreateView
 from django.views.generic.edit import DeleteView
 from django.views import View
 
-from vulnerabilities.forms import PackageForm, VulnerabilitySearchForm
-from vulnerabilities.models import Package, ImpactedPackage, ResolvedPackage, VulnerabilityReference, Vulnerability
+from vulnerabilities import forms
+from vulnerabilities import models
 
 class PackageSearchView(View):
-    template_name = "packages.html"
+    template_name = 'packages.html'
 
     def get(self, request):
-        context = {'form': PackageForm()}
+        context = {'form': forms.PackageForm()}
 
         if request.GET :
-            packages = _to_queryset(request)
+            packages = self.request_to_queryset(request)
             context['packages'] = packages
 
         return render(request, self.template_name, context)
 
-def _to_queryset(request):
-    query = {}
-    if len(request.GET['name']) :
-        query['name'] = request.GET['name']
+    @staticmethod
+    def request_to_queryset(request):
+        query = {}
+        if len(request.GET['name']) :
+            query['name'] = request.GET['name']
 
-    if request.GET['type'] and request.GET['type'] != '*' :
-        query['type'] = request.GET['type']
+        if request.GET['type'] and request.GET['type'] != '*' :
+            query['type'] = request.GET['type']
 
-    if len(request.GET['version']) :
-        query['version'] = request.GET['version']
+        if len(request.GET['version']) :
+            query['version'] = request.GET['version']
 
-    return Package.objects.all().filter(**query)
+        return models.Package.objects.all().filter(**query)
 
 class VulnerabilitySearchView(View):
 
-    template_name = "vulnerabilities.html"
+    template_name = 'vulnerabilities.html'
 
     def get(self, request):
-        context = {'form' : VulnerabilitySearchForm() }
+        context = {'form' : forms.VulnerabilitySearchForm() }
 
         if request.GET :
-            vulnerabilities = self._to_queryset(request)
+            vulnerabilities = self.request_to_queryset(request)
             context['vulnerabilities'] = vulnerabilities
 
         return render(request, self.template_name, context)
 
-    def _to_queryset(self,request):
+    @staticmethod
+    def request_to_queryset(request):
 
         if request.GET['vuln_id'] :
             vuln_id = request.GET['vuln_id']
-            return Vulnerability.objects.filter(cve_id__contains=vuln_id).select_related()
+            return models.Vulnerability.objects.filter(cve_id__contains=vuln_id).select_related()
 
 class PackageUpdate(UpdateView):
 
-    template_name = "package_update.html"
-    model = Package
+    template_name = 'package_update.html'
+    model = models.Package
     fields = ['name', 'type', 'version', 'namespace']
 
     def get_context_data(self, **kwargs):
@@ -95,8 +94,8 @@ def get_context_data(self, **kwargs):
 
     def _package_vulnerabilities(self, package_pk) :
 
-        ip = ImpactedPackage.objects.filter(package_id=package_pk).select_related()
-        rp = ResolvedPackage.objects.filter(package_id=package_pk).select_related()
+        ip = models.PackageRelatedVulnerability.objects.filter(package_id=package_pk, is_vulnerable=True).select_related()
+        rp = models.PackageRelatedVulnerability.objects.filter(package_id=package_pk, is_vulnerable=False).select_related()
 
         resolved_vuln = [i.vulnerability for i in  rp]
         unresolved_vuln = [i.vulnerability for i in  ip]
@@ -109,20 +108,20 @@ def get_success_url(self):
 
 class VulnerabilityDetails(ListView):
     template_name = 'vulnerability.html'
-    model = VulnerabilityReference
+    model = models.VulnerabilityReference
 
     def get_context_data(self, **kwargs):
         context = super(VulnerabilityDetails, self).get_context_data(**kwargs)
-        context['vulnerability'] =  Vulnerability.objects.get(id=self.kwargs['pk'])
+        context['vulnerability'] =  models.Vulnerability.objects.get(id=self.kwargs['pk'])
         return context
 
     def get_queryset(self):
-        return VulnerabilityReference.objects.filter(vulnerability_id=self.kwargs['pk'])
+        return models.VulnerabilityReference.objects.filter(vulnerability_id=self.kwargs['pk'])
 
 class VulnerabilityCreate(CreateView):
 
-    template_name = "vulnerability_create.html"
-    model = Vulnerability
+    template_name = 'vulnerability_create.html'
+    model = models.Vulnerability
     fields = ['cve_id', 'summary']
 
     def get_success_url(self):
@@ -131,55 +130,60 @@ def get_success_url(self):
 
 class PackageCreate(CreateView):
 
-    template_name = "package_create.html"
-    model = Package
+    template_name = 'package_create.html'
+    model = models.Package
     fields = ['name','namespace','type','version']
 
     def get_success_url(self):
         return reverse('package_view', kwargs={'pk' : self.object.id})
 
+# TODO : Squash ImpactedPackageDelete  ResolvedPackageDelete into one 
+# 'PackageRelatedVulnerablityDelete' view
 class ResolvedPackageDelete(DeleteView):
 
-    model = ResolvedPackage
+    model = models.PackageRelatedVulnerability
 
     def get_object(self):
         package_id = self.kwargs.get('pid')
         vulnerability_id = self.kwargs.get('vid')
-        return ResolvedPackage.objects.get(package_id=package_id, vulnerability_id=vulnerability_id)
+        return models.PackageRelatedVulnerability.objects.get(package_id=package_id, vulnerability_id=vulnerability_id, is_vulnerable=False)
 
     def get_success_url(self):
         return reverse('package_view', kwargs={'pk' : self.kwargs.get('pid')})
 
 class ImpactedPackageDelete(DeleteView):
 
-    model = ImpactedPackage
+    model = models.PackageRelatedVulnerability
 
     def get_object(self):
         package_id = self.kwargs.get('pid')
         vulnerability_id = self.kwargs.get('vid')
-        return ImpactedPackage.objects.get(package_id=package_id, vulnerability_id=vulnerability_id)
+        return models.PackageRelatedVulnerability.objects.get(package_id=package_id, vulnerability_id=vulnerability_id, is_vulnerable=True)
 
     def get_success_url(self):
         return reverse('package_view', kwargs={'pk' : self.kwargs.get('pid')})
 
 class HomePage(View):
 
-    template_name = "index.html"
+    template_name = 'index.html'
 
     def get(self, request):
         return render(request, self.template_name)
 
+# TODO : Squash ImpactedPackageCreate  ResolvedPackageCreate into one 
+# 'PackageRelatedVulnerablityCreate' view
 
 class ImpactedPackageCreate(CreateView):
 
     template_name = 'impacted_package_create.html'
-    model = ImpactedPackage 
+    model = models.PackageRelatedVulnerability 
     fields = ['vulnerability']
 
     def form_valid(self, form):
 
-        package = Package.objects.get(id=self.kwargs['pid'])
+        package = models.Package.objects.get(id=self.kwargs['pid'])
         form.instance.package = package
+        form.instance.is_vulnerable = True
         return super(ImpactedPackageCreate, self).form_valid(form)
 
     def get_success_url(self):
@@ -188,13 +192,14 @@ def get_success_url(self):
 class ResolvedPackageCreate(CreateView):
 
     template_name = 'resolved_package_create.html'
-    model = ResolvedPackage 
+    model = models.PackageRelatedVulnerability 
     fields = ['vulnerability']
 
     def form_valid(self, form):
-
-        package = Package.objects.get(id=self.kwargs['pid'])
+        print(self.request)        
+        package = models.Package.objects.get(id=self.kwargs['pid'])
         form.instance.package = package
+        form.instance.is_vulnerable = False
         return super(ResolvedPackageCreate, self).form_valid(form)
 
     def get_success_url(self):
@@ -203,13 +208,12 @@ def get_success_url(self):
 class VulnerabilityReferenceCreate(CreateView):
 
     template_name = 'vulnerability_reference_create.html'
-    model = VulnerabilityReference
+    model = models.VulnerabilityReference
     fields = ['reference_id','url']
 
     def form_valid(self, form):
-        form.instance.vulnerability =  Vulnerability.objects.get(id=self.kwargs['vid'])
+        form.instance.vulnerability =  models.Vulnerability.objects.get(id=self.kwargs['vid'])
         return super(VulnerabilityReferenceCreate, self).form_valid(form)
 
     def get_success_url(self):
-        return reverse('vulnerability_view', kwargs={'pk': self.kwargs['vid']})
-
+        return reverse('vulnerability_view', kwargs={'pk': self.kwargs['vid']})

vulnerablecode/urls.py

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2017 nexB Inc. and others. All rights reserved.
+# Copyright (c) nexB Inc. and others. All rights reserved.
 # http://nexb.com and https://github.com/nexB/vulnerablecode/
 # The VulnerableCode software is licensed under the Apache License version 2.0.
 # Data generated with VulnerableCode require an acknowledgment.
@@ -18,7 +18,7 @@
 #  OR CONDITIONS OF ANY KIND, either express or implied. No content created from
 #  VulnerableCode should be considered or used as legal advice. Consult an Attorney
 #  for any legal advice.
-#  VulnerableCode is a free software code scanning tool from nexB Inc. and others.
+#  VulnerableCode is a free software from nexB Inc. and others.
 #  Visit https://github.com/nexB/vulnerablecode/ for support and download.
 
 from django.contrib import admin