Skip to content

Begin work on combining affected and fixed by packages #1287 #1320

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
johnmhoran wants to merge 1 commit into from
Closed

Begin work on combining affected and fixed by packages #1287 #1320

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 42 additions & 0 deletions vulnerabilities/models.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,8 @@
from packageurl.contrib.django.models import PackageURLQuerySet
from packageurl.contrib.django.models import without_empty_values
from rest_framework.authtoken.models import Token
from univers import versions
from univers.version_range import RANGE_CLASS_BY_SCHEMES

from vulnerabilities.importer import AdvisoryData
from vulnerabilities.importer import AffectedPackage
Expand Down Expand Up @@ -628,6 +630,46 @@ def get_absolute_url(self):
"""
return reverse("package_details", args=[self.purl])

# 2023-10-03 Tuesday 16:44:20. Add this from 1228-fixed-affected-version-matching branch.
def get_fixed_by_package_versions(self, fix=True):
"""
Return a queryset of all the package versions of this `package` that fix any vulnerability.
If `fix` is False, return all package versions whether or not they fix a vulnerability.
"""
filter_dict = {
"name": self.name,
"namespace": self.namespace,
"type": self.type,
"qualifiers": self.qualifiers,
"subpath": self.subpath,
}

if fix:
filter_dict["packagerelatedvulnerability__fix"] = True

# return Package.objects.filter(**filter_dict).distinct()
# ZAP: 2023-10-04 Wednesday 08:42:40. Will this sort? Yes.
fixed_by_package_versions = Package.objects.filter(**filter_dict).distinct()
return self.sort_by_version(fixed_by_package_versions)

def sort_by_version(self, packages):
"""
Return a list of `packages` sorted by version.
"""
if not packages:
return []

version_class = RANGE_CLASS_BY_SCHEMES[packages[0].type].version_class
return sorted(
packages,
key=lambda x: version_class(x.version),
)

# Test
def getFruits(self):
fruits = ["apple", "banana", "cantelope", "strawberry"]
return fruits


class PackageRelatedVulnerability(models.Model):
"""
Expand Down
65 changes: 64 additions & 1 deletion vulnerabilities/templates/vulnerability_details.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,13 @@
<span>Essentials</span>
</a>
</li>
<li data-tab="affected-fixed-by">
<a>
<span>
Affected/Fixed by packages ({{ affected_packages|length }}/{{ fixed_by_packages|length }})
</span>
</a>
</li>
<li data-tab="fixed-by">
<a>
<span>
Expand Down Expand Up @@ -138,7 +145,7 @@
{% empty %}
<tr>
<td>
There are no known fixed packages.
There are no known fixed by packages.
</td>
</tr>
{% endfor %}
Expand Down Expand Up @@ -208,6 +215,62 @@
</div>
</div>

<div class="tab-div content" data-content="affected-fixed-by">
<table class="table is-bordered is-striped is-narrow is-hoverable is-fullwidth">
<thead>
<tr>
<th style="width: 50%;">
<!-- <span class="has-tooltip-multiline has-tooltip-black has-tooltip-arrow has-tooltip-text-left" data-tooltip="The package url or purl is a URL string used to identify and locate a software package."> -->
Affected
<!-- </span> -->
</th>
<th>Fixed By</th>
</tr>
</thead>
<tbody>
{% for package in affected_packages %}
<tr>
<td>
<a href="{{ package.get_absolute_url }}?search={{ package.purl }}" target="_self">{{ package.purl }} (id={{ package.id }})</a>
</td>
<td>
<!-- <br />
<span style="font-size: 12px; color: #ff0000;">package.get_fixed_by_package_versions count = {{ package.get_fixed_by_package_versions|length }}</span>
<br />
<span style="font-size: 12px; color: #ff0000;">
{% for pkg in package.get_fixed_by_package_versions %}
{{ pkg.purl }} (id={{ pkg.id }})
<br />
{% endfor %}
</span>
<br /> -->
{% for pkg in package.get_fixed_by_package_versions %}
{% if pkg in vulnerability.fixed_by_packages %}
<!-- <a href="{{ pkg.get_absolute_url }}?search={{ pkg.purl }}" target="_self">{{ pkg.purl }} (id={{ pkg.id }})</a>
<br /> -->
<a href="{{ pkg.get_absolute_url }}?search={{ pkg.purl }}" target="_self">{{ pkg.version }} (id={{ pkg.id }})</a>
<br />
<!-- <br /> -->
{% endif %}
{% empty %}
There are no known fixed by packages.
{% endfor %}
<br />


</td>
</tr>
{% empty %}
<tr>
<td colspan="2">
This vulnerability is not known to affect any packages.
</td>
</tr>
{% endfor %}
</tbody>
</table>
</div>

<div class="tab-div content" data-content="references">
<table class="table is-bordered is-striped is-narrow is-hoverable is-fullwidth">
<thead>
Expand Down