Skip to content

Commit c9b99e0

Browse files
ziadhanyziadhany
committed
fix gsd aliases , add gsd test
Signed-off-by: Ziad <ziadhany2016@gmail.com>
1 parent 1000417 commit c9b99e0

4 files changed

Lines changed: 224 additions & 20 deletions

File tree

‎vulnerabilities/importers/gsd.py‎

Lines changed: 24 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -31,32 +31,36 @@ class GSDImporter(Importer):
3131
def advisory_data(self) -> Iterable[AdvisoryData]:
3232
forked_dir = fork_and_get_dir(self.gsd_url)
3333
for file in get_files(forked_dir):
34-
raw_data = json.loads(file)
34+
yield parse_advisory_data(file)
3535

36-
namespaces = raw_data.get("namespaces") or {}
37-
cve_org = namespaces.get("cve.org") or {}
38-
nvd_nist_gov = namespaces.get("nvd.nist.gov") or {}
3936

40-
GSD = raw_data.get("GSD") or {}
41-
GSD_alias = GSD.get("alias") or []
42-
details = GSD.get("description") or get_description(cve_org)
43-
GSD_id = GSD.get("id") or ""
37+
def parse_advisory_data(file):
38+
raw_data = json.loads(file)
4439

45-
aliases_cve_org = get_aliases(cve_org)
46-
aliases_nvd_nist_gov = get_aliases(nvd_nist_gov)
47-
aliases = GSD_alias + GSD_id + aliases_cve_org + aliases_nvd_nist_gov
40+
namespaces = raw_data.get("namespaces") or {}
41+
cve_org = namespaces.get("cve.org") or {}
42+
nvd_nist_gov = namespaces.get("nvd.nist.gov") or {}
4843

49-
summary = build_description(summary=get_summary(cve_org), description=details)
50-
references = get_references(cve_org)
44+
GSD = raw_data.get("GSD") or {}
45+
GSD_alias = [].append(GSD.get("alias")) or []
46+
details = GSD.get("description") or get_description(cve_org)
47+
GSD_id = [].append(GSD.get("id")) or []
5148

52-
date_published = get_published_date_nvd_nist_gov(nvd_nist_gov)
49+
aliases_cve_org = get_aliases(cve_org)
50+
aliases_nvd_nist_gov = get_aliases(nvd_nist_gov)
51+
aliases = GSD_alias + GSD_id + aliases_cve_org + aliases_nvd_nist_gov
5352

54-
yield AdvisoryData(
55-
aliases=dedupe(aliases),
56-
summary=summary,
57-
references=references,
58-
date_published=date_published,
59-
)
53+
summary = build_description(summary=get_summary(cve_org), description=details)
54+
references = get_references(cve_org)
55+
56+
date_published = get_published_date_nvd_nist_gov(nvd_nist_gov)
57+
58+
return AdvisoryData(
59+
aliases=dedupe(aliases),
60+
summary=summary,
61+
references=references,
62+
date_published=date_published,
63+
)
6064

6165

6266
def get_summary(cve) -> str:

‎vulnerabilities/tests/test_data/gsd/GSD-2016-20005-expected.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"aliases": ["CVE-2016-20005"],
3+
"summary": "The REST/JSON project 7.x-1.x for Drupal allows user registration bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy.",
4+
"affected_packages": [],
5+
"references": [
6+
{"reference_id": "",
7+
"url": "https://www.drupal.org/node/2744889",
8+
"severities": []
9+
}
10+
],
11+
"date_published": "2021-01-01T01:15:00+00:00"
12+
}

‎vulnerabilities/tests/test_data/gsd/GSD-2016-20005.json‎

Lines changed: 174 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,174 @@
1+
{
2+
"GSD": {
3+
"alias": "CVE-2016-20005",
4+
"description": "The REST/JSON project 7.x-1.x for Drupal allows user registration bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy.",
5+
"id": "GSD-2016-20005"
6+
},
7+
"namespaces": {
8+
"cve.org": {
9+
"CVE_data_meta": {
10+
"ASSIGNER": "cve@mitre.org",
11+
"ID": "CVE-2016-20005",
12+
"STATE": "PUBLIC"
13+
},
14+
"affects": {
15+
"vendor": {
16+
"vendor_data": [
17+
{
18+
"product": {
19+
"product_data": [
20+
{
21+
"product_name": "n/a",
22+
"version": {
23+
"version_data": [
24+
{
25+
"version_value": "n/a"
26+
}
27+
]
28+
}
29+
}
30+
]
31+
},
32+
"vendor_name": "n/a"
33+
}
34+
]
35+
}
36+
},
37+
"data_format": "MITRE",
38+
"data_type": "CVE",
39+
"data_version": "4.0",
40+
"description": {
41+
"description_data": [
42+
{
43+
"lang": "eng",
44+
"value": "The REST/JSON project 7.x-1.x for Drupal allows user registration bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy."
45+
}
46+
]
47+
},
48+
"problemtype": {
49+
"problemtype_data": [
50+
{
51+
"description": [
52+
{
53+
"lang": "eng",
54+
"value": "n/a"
55+
}
56+
]
57+
}
58+
]
59+
},
60+
"references": {
61+
"reference_data": [
62+
{
63+
"name": "https://www.drupal.org/node/2744889",
64+
"refsource": "MISC",
65+
"url": "https://www.drupal.org/node/2744889"
66+
}
67+
]
68+
}
69+
},
70+
"nvd.nist.gov": {
71+
"configurations": {
72+
"CVE_data_version": "4.0",
73+
"nodes": [
74+
{
75+
"children": [],
76+
"cpe_match": [
77+
{
78+
"cpe23Uri": "cpe:2.3:a:rest\\/json_project:rest\\/json:*:*:*:*:*:drupal:*:*",
79+
"cpe_name": [],
80+
"versionEndIncluding": "7.x-1.5",
81+
"vulnerable": true
82+
}
83+
],
84+
"operator": "OR"
85+
}
86+
]
87+
},
88+
"cve": {
89+
"CVE_data_meta": {
90+
"ASSIGNER": "cve@mitre.org",
91+
"ID": "CVE-2016-20005"
92+
},
93+
"data_format": "MITRE",
94+
"data_type": "CVE",
95+
"data_version": "4.0",
96+
"description": {
97+
"description_data": [
98+
{
99+
"lang": "en",
100+
"value": "The REST/JSON project 7.x-1.x for Drupal allows user registration bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy."
101+
}
102+
]
103+
},
104+
"problemtype": {
105+
"problemtype_data": [
106+
{
107+
"description": [
108+
{
109+
"lang": "en",
110+
"value": "CWE-863"
111+
}
112+
]
113+
}
114+
]
115+
},
116+
"references": {
117+
"reference_data": [
118+
{
119+
"name": "https://www.drupal.org/node/2744889",
120+
"refsource": "MISC",
121+
"tags": [
122+
"Third Party Advisory"
123+
],
124+
"url": "https://www.drupal.org/node/2744889"
125+
}
126+
]
127+
}
128+
},
129+
"impact": {
130+
"baseMetricV2": {
131+
"acInsufInfo": false,
132+
"cvssV2": {
133+
"accessComplexity": "LOW",
134+
"accessVector": "NETWORK",
135+
"authentication": "NONE",
136+
"availabilityImpact": "PARTIAL",
137+
"baseScore": 7.5,
138+
"confidentialityImpact": "PARTIAL",
139+
"integrityImpact": "PARTIAL",
140+
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
141+
"version": "2.0"
142+
},
143+
"exploitabilityScore": 10.0,
144+
"impactScore": 6.4,
145+
"obtainAllPrivilege": false,
146+
"obtainOtherPrivilege": false,
147+
"obtainUserPrivilege": false,
148+
"severity": "HIGH",
149+
"userInteractionRequired": false
150+
},
151+
"baseMetricV3": {
152+
"cvssV3": {
153+
"attackComplexity": "LOW",
154+
"attackVector": "NETWORK",
155+
"availabilityImpact": "HIGH",
156+
"baseScore": 9.8,
157+
"baseSeverity": "CRITICAL",
158+
"confidentialityImpact": "HIGH",
159+
"integrityImpact": "HIGH",
160+
"privilegesRequired": "NONE",
161+
"scope": "UNCHANGED",
162+
"userInteraction": "NONE",
163+
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
164+
"version": "3.1"
165+
},
166+
"exploitabilityScore": 3.9,
167+
"impactScore": 5.9
168+
}
169+
},
170+
"lastModifiedDate": "2021-01-07T14:59Z",
171+
"publishedDate": "2021-01-01T01:15Z"
172+
}
173+
}
174+
}

‎vulnerabilities/tests/test_gsd.py‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@
77
# See https://aboutcode.org for more information about nexB OSS projects.
88
#
99
import datetime
10+
import json
11+
import os
1012
from unittest import TestCase
1113

1214
from vulnerabilities.importer import Reference
@@ -16,9 +18,21 @@
1618
from vulnerabilities.importers.gsd import get_published_date_nvd_nist_gov
1719
from vulnerabilities.importers.gsd import get_references
1820
from vulnerabilities.importers.gsd import get_summary
21+
from vulnerabilities.importers.gsd import parse_advisory_data
22+
from vulnerabilities.tests import util_tests
23+
24+
BASE_DIR = os.path.dirname(os.path.abspath(__file__))
25+
TEST_DATA = os.path.join(BASE_DIR, "test_data/gsd")
1926

2027

2128
class TestGSDImporter(TestCase):
29+
def test_to_advisories(self):
30+
with open(os.path.join(TEST_DATA, "GSD-2016-20005.json")) as f:
31+
imported_data = parse_advisory_data(f.read())
32+
expected_file = os.path.join(TEST_DATA, f"GSD-2016-20005-expected.json")
33+
result = imported_data.to_dict()
34+
util_tests.check_results_against_json(result, expected_file)
35+
2236
def test_get_references(self):
2337
assert get_references(
2438
{

0 commit comments

Comments
 (0)