Skip to content
63 changes: 60 additions & 3 deletions app/vulncode_app/models.py
Original file line number Diff line number Diff line change
@@ -1,6 +1,63 @@
# -*- coding: utf-8 -*-
from __future__ import unicode_literals
#
# Copyright (c) 2017 nexB Inc. and others. All rights reserved.
# http://nexb.com and https://github.com/nexB/vulnerablecode/
# The VulnerableCode software is licensed under the Apache License version 2.0.
# Data generated with VulnerableCode require an acknowledgment.
#
# You may not use this software except in compliance with the License.
# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
# Unless required by applicable law or agreed to in writing, software distributed
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
# specific language governing permissions and limitations under the License.
#
# When you publish or redistribute any data created with VulnerableCode or any VulnerableCode
# derivative work, you must accompany this data with the following acknowledgment:
#
# Generated with VulnerableCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
# OR CONDITIONS OF ANY KIND, either express or implied. No content created from
# VulnerableCode should be considered or used as legal advice. Consult an Attorney
# for any legal advice.
# VulnerableCode is a free software code scanning tool from nexB Inc. and others.
# Visit https://github.com/nexB/vulnerablecode/ for support and download.

from __future__ import unicode_literals
from django.db import models

# Create your models here.

class Vulnerability(models.Model):
vulnerability_id = models.AutoField(primary_key=True)

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder if we are going to need a vulnerability ID that's not an auto field I think.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@pombredanne I had the same dilemma, my thought process was to primarily diff. package id from vulnerability id.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can remove this line. See https://docs.djangoproject.com/en/1.11/ref/models/fields/#primary-key

If you don’t specify primary_key=True for any field in your model, Django will automatically add an AutoField to hold the primary key

This apply to all models.

@kartiksibal kartiksibal Jul 7, 2017

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tdruez I did read that. My primary motive was to diff. vulnerability id from package id. Henc, I didn't use the default id. But, I'll change that. 👍

summary = models.TextField(max_length=50)
cvss = models.FloatField(max_length=50)


class VulnerabilityReference(models.Model):
vulnerability_id = models.ForeignKey('Vulnerability')

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

when you use a FK here, do not use _id. What you get is an object, not an ID. Also reference the model as a class here, not as a string. This applies to all the models here.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@pombredanne I read it here: https://docs.djangoproject.com/en/1.11/ref/models/fields/#django.db.models.ForeignKey

Could you please explain a bit, as to why in the documentation it is referenced as a string?

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://docs.djangoproject.com/en/1.11/ref/models/fields/#database-representation

Behind the scenes, Django appends "_id" to the field name to create its database column name. In the above example, the database table for the Car model will have a manufacturer_id column. (You can change this explicitly by specifying db_column) However, your code should never have to deal with the database column name, unless you write custom SQL. You’ll always deal with the field names of your model object.

Simple use: vulnerability = models.ForeignKey('Vulnerability')

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tdruez, Could you maybe explain @pombredanne ' point of view?

source = models.CharField(max_length=50)

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add a help to each field that documents them.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@pombredanne is referring to https://docs.djangoproject.com/en/1.11/ref/models/fields/#help-text
This is a great way to document the purpose of each field. This will also be re-used in the admin and API documentation.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tdruez This is great. 👍

reference_id = models.CharField(max_length=50)
url = models.URLField(max_length=50)

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When did you last see a URL that's 50 char long?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@pombredanne I didn't understand your tone here. Too long or short? 😛

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

50 is way to short, 1024 should be plenty.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tdruez Right, same thought. 😛



class ImpactedPackage(models.Model):
vulnerability_id = models.ForeignKey('Vulnerability')
package_id = models.ForeignKey('Package')


class ResolvedPackage(models.Model):
vulnerability_id = models.ForeignKey('Vulnerability')
package_id = models.ForeignKey('Package')


class Package(models.Model):
package_id = models.AutoField(primary_key=True)

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not needed. We can use the implicit id instead.
We also need some unique together on (platform, name, version)

platform = models.CharField(max_length=50)
name = models.CharField(max_length=50)
version = models.FloatField(max_length=50)

@tdruez tdruez Jul 7, 2017

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You should use a CharField for all version type fields.
FloatField is not suitable for something like "1.2.3"

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tdruez Pro Tip 👍 😉



class PackageReference(models.Model):
package_id = models.ForeignKey('Package')
repository = models.CharField(max_length=50)
platform = models.CharField(max_length=50)
name = models.CharField(max_length=50)
version = models.FloatField(max_length=50)