Merge pull request #230 from sbs2001/curation_ui

Add UI for VulnerableCode

Author: pombredanne

requirements.txt

@@ -12,6 +12,7 @@ dj-database-url==0.4.2
 Django==3.0.7
 django-filter==2.2.0
 djangorestframework==3.11.0
+django-widget-tweaks==1.4.8
 gunicorn==19.7.1
 importlib-metadata==1.3.0
 ipython==7.13.0
@@ -35,6 +36,7 @@ pygit2==1.2.0
 Pygments==2.6.1
 pyparsing==2.4.5
 pytest==5.3.2
+django-widget-tweaks==1.4.8 
 pytest-dependency==0.4.0
 pytest-django==3.7.0
 pytest-mock==1.13.0

vulnerabilities/forms.py

@@ -0,0 +1,56 @@
+# Copyright (c) nexB Inc. and others. All rights reserved.
+# http://nexb.com and https://github.com/nexB/vulnerablecode/
+# The VulnerableCode software is licensed under the Apache License version 2.0.
+# Data generated with VulnerableCode require an acknowledgment.
+#
+# You may not use this software except in compliance with the License.
+# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing, software distributed
+# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+# CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+#
+# When you publish or redistribute any data created with VulnerableCode or any VulnerableCode
+# derivative work, you must accompany this data with the following acknowledgment:
+#
+#  Generated with VulnerableCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
+#  OR CONDITIONS OF ANY KIND, either express or implied. No content created from
+#  VulnerableCode should be considered or used as legal advice. Consult an Attorney
+#  for any legal advice.
+#  VulnerableCode is a free software tool from nexB Inc. and others.
+#  Visit https://github.com/nexB/vulnerablecode/ for support and download.
+
+from django import forms
+
+from vulnerabilities.models import Package, PackageRelatedVulnerability, Vulnerability
+
+
+def get_package_types():
+    pkg_types = [(i.type, i.type) for i in Package.objects.distinct("type").all()]
+    pkg_types.append((None, "package type"))
+    return pkg_types
+
+
+def get_package_namespaces():
+    pkg_namespaces = [
+        (i.namespace, i.namespace)
+        for i in Package.objects.distinct("namespace").all()
+        if i.namespace
+    ]
+    pkg_namespaces.append((None, "package namespace"))
+    return pkg_namespaces
+
+
+class PackageForm(forms.Form):
+
+    type = forms.ChoiceField(choices=get_package_types)
+    namespace = forms.ChoiceField(choices=get_package_namespaces, required=False)
+    name = forms.CharField(widget=forms.TextInput(attrs={"placeholder": "package name"}))
+    version = forms.CharField(
+        widget=forms.TextInput(attrs={"placeholder": "package version"}), required=False
+    )
+
+
+class CVEForm(forms.Form):
+
+    cve_id = forms.CharField(widget=forms.TextInput(attrs={"placeholder": "vulnerability id"}))

vulnerabilities/lib_oval.py.ABOUT

@@ -0,0 +1,14 @@
+about_resource: lib_oval.py
+version: 6aaae0
+download_url: https://raw.githubusercontent.com/CISecurity/OVALRepo/6aaae00876ec716927e0ae5b9ccfa12f310427a0/scripts/lib_oval.py
+
+name: OVALRepo - lib_oval
+homepage_url: https://github.com/CISecurity/OVALRepo
+owner: Center for Internet Security
+author: Gunnar Engelbach <Gunnar.Engelbach@ThreatGuard.com>
+notes: This a single file extracted from OVALRepo that parses OVAL files.
+
+license: bsd-new
+license_file: lib_oval.py.LICENSE
+
+copyright: Copyright (c) 2010 United States Government. All Rights Reserved.

vulnerabilities/lib_oval.py.LICENSE

@@ -0,0 +1,9 @@
+Copyright© 2010 United States Government. All Rights Reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+    Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+    Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+    Neither the name of the Center for Internet Security, Inc. (CIS) nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER, CIS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER, CIS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

vulnerabilities/models.py

@@ -45,6 +45,14 @@ class Vulnerability(models.Model):
         help_text='Summary of the vulnerability', blank=True)
     cvss = models.FloatField(max_length=100, help_text='CVSS Score', null=True)
 
+    @property
+    def vulnerable_to(self):
+        return self.packagerelatedvulnerability_set.filter(is_vulnerable=True)
+
+    @property
+    def resolved_to(self):
+        return self.packagerelatedvulnerability_set.filter(is_vulnerable=False)
+
     def __str__(self):
         return self.cve_id or self.summary
 
@@ -80,6 +88,14 @@ class Package(PackageURLMixin):
     vulnerabilities = models.ManyToManyField(
         to='Vulnerability', through='PackageRelatedVulnerability')
 
+    @property
+    def vulnerable_to(self):
+        return self.packagerelatedvulnerability_set.filter(is_vulnerable=True)
+
+    @property
+    def resolved_to(self):
+        return self.packagerelatedvulnerability_set.filter(is_vulnerable=False)
+
     class Meta:
         unique_together = ('name', 'namespace', 'type',
                            'version', 'qualifiers', 'subpath')