[Continuation of PR #179 ]Add SUSE parser for OVAL

.travis.yml

@@ -11,7 +11,7 @@ env:
   - SECRET_KEY="i1bn=oly)w*2yl-5yc&f!vvgt)p)fh3_2$r#spa!*sw36f5ov7"
 
 before_script:
-  - pycodestyle --exclude=migrations,settings.py,venv,lib_oval.py,test_ubuntu.py --max-line-length=100 .
+  - pycodestyle --exclude=migrations,settings.py,venv,lib_oval.py,test_ubuntu.py,test_suse.py --max-line-length=100 .
   - psql -c "CREATE DATABASE vulnerablecode;" -U postgres
   - ./manage.py migrate
 

README.md

@@ -53,7 +53,7 @@ the code Django includes for this purpose: `SECRET_KEY=$(python -c "from django.
 ## Tests
 
 ```
-pycodestyle --exclude=migrations,settings.py,venv,lib_oval.py,test_ubuntu.py --max-line-length=100 .
+pycodestyle --exclude=migrations,settings.py,venv,lib_oval.py,test_ubuntu.py,test_suse.py --max-line-length=100 .
 DJANGO_DEV=1 pytest 
 ```
 To skip tests which require internet connection:

vulnerabilities/scraper/oval_parser.py

@@ -1,8 +1,8 @@
+from typing import Optional
 from typing import List
 from typing import Dict
 from typing import Tuple
 from typing import Set
-from typing import Optional
 import xml.etree.ElementTree as ET
 
 from dephell_specifier import RangeSpecifier
@@ -20,7 +20,9 @@ def __init__(self, tree):
         self.id_to_test = {el.getId(): el for el in self.getTests()}
         self.id_to_object = {el.getId(): el for el in self.getObjects()}
         self.id_to_state = {el.getId(): el for el in self.getStates()}
-        self.id_to_variable = {el.getId(): el for el in self.getVariables()}
+        if self.getVariables():
+            self.id_to_variable = {
+                el.getId(): el for el in self.getVariables()}
 
     def getElementByID(self, oval_id: str) -> Optional[OvalElement]:
         if not oval_id:
@@ -70,7 +72,7 @@ def get_data(self) -> List[Dict]:
                 continue
             definition_data = {'test_data': []}
             definition_data['description'] = definition.getMetadata(
-            ).getDescription()
+            ).getDescription()  # this could use some data cleaning
             definition_data['vuln_id'] = self.get_vuln_id_from_definition(
                 definition)
             definition_data['reference_urls'] = self.get_urls_from_definition(
@@ -194,3 +196,56 @@ def get_urls_from_definition(definition: OvalDefinition) -> Set[str]:
                 break
 
         return all_urls
+
+
+class SUSEOvalParser(UbuntuOvalParser):
+
+    def get_tests_of_definition(self, definition: OvalDefinition) -> List[OvalTest]:
+
+        criteria_refs = []
+
+        for child in definition.element.iter():
+
+            if 'test_ref' in child.attrib:
+                criteria_refs.append(child.get('test_ref'))
+
+        matching_tests = []
+        for ref in criteria_refs:
+            test = self.oval_document.getElementByID(ref)
+            _, state = self.get_object_state_of_test(test)
+            is_signature_test = False
+            is_suse_version_test = False
+            for child in state.element:
+                # This is to avoid signature tests, such as the one below
+                # <signature_keyid operation="equals">b88b2fd43dbdc284</signature_keyid>
+                if child.tag.endswith("signature_keyid"):
+                    is_signature_test = True
+                    break
+            # This is to avoid SUSE OS version tests, such as
+            # <rpminfo_state id="oval:org.opensuse.security:ste:2009061809" version="1"
+            # xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
+            #       <version operation="equals">15</version>
+            # </rpminfo_state>
+                if child.get('operation') == "equals":
+                    is_suse_version_test = True
+                    break
+            if not is_suse_version_test and not is_signature_test:
+                matching_tests.append(test)
+
+        return matching_tests
+
+    @staticmethod
+    def get_urls_from_definition(definition: OvalDefinition) -> Set[str]:
+
+        all_urls = set()
+        definition_metadata = definition.getMetadata().element
+        for child in definition_metadata:
+            if child.tag.endswith('reference'):
+                all_urls.add(child.get('ref_url'))
+            if child.tag.endswith('advisory'):
+                for grandchild in child:
+                    if grandchild.get('href'):
+                        all_urls.add(grandchild.get('href'))
+                break
+
+        return all_urls

vulnerabilities/tests/test_data/suse_oval_data.xml

@@ -0,0 +1,163 @@
+<?xml version="1.0" encoding="UTF-8"?>
+        <oval_definitions
+            xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd"
+            xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5"
+            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+            xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5"
+            xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5">
+        <generator>
+            <oval:product_name>Marcus Updateinfo to OVAL Converter</oval:product_name>
+            <oval:schema_version>5.5</oval:schema_version>
+            <oval:timestamp>2020-05-17T04:49:08</oval:timestamp>
+        </generator>
+    <definitions>
+    <definition id="oval:org.opensuse.security:def:20094112" version="1" class="vulnerability">
+    <metadata>
+    <title>CVE-2009-4112</title>
+        <affected family="unix">
+                <platform>openSUSE Leap 15.1</platform>
+        </affected>
+        <reference ref_id="CVE-2009-4112" ref_url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4112" source="CVE"/>
+        <description>
+        Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage" setting to contain arbitrary commands.
+        </description>
+    <advisory from="security@suse.de">
+    <severity>Low</severity>
+    <cve href="https://www.suse.com/security/cve/CVE-2009-4112.html">CVE-2009-4112</cve>
+    <bugzilla href="https://bugzilla.suse.com/1122535">SUSE bug 1122535</bugzilla>
+    <bugzilla href="https://bugzilla.suse.com/558664">SUSE bug 558664</bugzilla>
+    </advisory>
+    </metadata>
+            <criteria operator="AND">
+                <criterion test_ref="oval:org.opensuse.security:tst:2009265831" comment="openSUSE Leap 15.1 is installed"/>
+            <criteria operator="OR">
+                <criteria operator="AND">
+            <criterion test_ref="oval:org.opensuse.security:tst:2009281999" comment="cacti-1.2.11-lp151.3.6 is installed"/>
+            <criterion test_ref="oval:org.opensuse.security:tst:2009152167" comment="cacti is signed with openSUSE key"/>
+            </criteria>
+                <criteria operator="AND">
+            <criterion test_ref="oval:org.opensuse.security:tst:2009282000" comment="cacti-spine-1.2.11-lp151.3.6 is installed"/>
+            <criterion test_ref="oval:org.opensuse.security:tst:2009153174" comment="cacti-spine is signed with openSUSE key"/>
+            </criteria>
+            </criteria>
+            </criteria>
+    </definition>
+    <definition id="oval:org.opensuse.security:def:20112767" version="1" class="vulnerability">
+    <metadata>
+    <title>CVE-2011-2767</title>
+        <affected family="unix">
+                <platform>openSUSE Leap 15.1</platform>
+        </affected>
+        <reference ref_id="CVE-2011-2767" ref_url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2767" source="CVE"/>
+        <description>
+        mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.
+        </description>
+    <advisory from="security@suse.de">
+    <severity>Moderate</severity>
+    <cve href="https://www.suse.com/security/cve/CVE-2011-2767.html">CVE-2011-2767</cve>
+    <bugzilla href="https://bugzilla.suse.com/1156944">SUSE bug 1156944</bugzilla>
+    </advisory>
+    </metadata>
+            <criteria operator="AND">
+                <criterion test_ref="oval:org.opensuse.security:tst:2009265831" comment="openSUSE Leap 15.1 is installed"/>
+            <criteria operator="OR">
+                <criteria operator="AND">
+            <criterion test_ref="oval:org.opensuse.security:tst:2009271113" comment="apache2-mod_perl-2.0.11-lp151.3.3 is installed"/>
+            <criterion test_ref="oval:org.opensuse.security:tst:2009151816" comment="apache2-mod_perl is signed with openSUSE key"/>
+            </criteria>
+                <criteria operator="AND">
+            <criterion test_ref="oval:org.opensuse.security:tst:2009271114" comment="apache2-mod_perl-devel-2.0.11-lp151.3.3 is installed"/>
+            <criterion test_ref="oval:org.opensuse.security:tst:2009271141" comment="apache2-mod_perl-devel is signed with openSUSE key"/>
+            </criteria>
+            </criteria>
+            </criteria>
+    </definition>
+    </definitions>
+
+    <tests>
+        <rpminfo_test id="oval:org.opensuse.security:tst:2009265831" version="1" comment="openSUSE-release is ==15.1" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
+            <object object_ref="oval:org.opensuse.security:obj:2009031246"/>
+            <state state_ref="oval:org.opensuse.security:ste:2009068342"/>
+        </rpminfo_test>
+
+        <rpminfo_test id="oval:org.opensuse.security:tst:2009281999" version="1" comment="cacti is &lt;1.2.11-lp151.3.6" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
+            <object object_ref="oval:org.opensuse.security:obj:2009031297"/>
+            <state state_ref="oval:org.opensuse.security:ste:2009072069"/>
+        </rpminfo_test>
+
+        <rpminfo_test id="oval:org.opensuse.security:tst:2009152167" version="1" comment="cacti is signed with openSUSE key" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
+            <object object_ref="oval:org.opensuse.security:obj:2009031297"/>
+            <state state_ref="oval:org.opensuse.security:ste:2009051526"/>
+        </rpminfo_test>
+
+        <rpminfo_test id="oval:org.opensuse.security:tst:2009282000" version="1" comment="cacti-spine is &lt;1.2.11-lp151.3.6" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
+            <object object_ref="oval:org.opensuse.security:obj:2009037882"/>
+            <state state_ref="oval:org.opensuse.security:ste:2009072069"/>
+        </rpminfo_test>
+
+        <rpminfo_test id="oval:org.opensuse.security:tst:2009153174" version="1" comment="cacti-spine is signed with openSUSE key" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
+            <object object_ref="oval:org.opensuse.security:obj:2009037882"/>
+            <state state_ref="oval:org.opensuse.security:ste:2009051526"/>
+        </rpminfo_test>
+
+        <rpminfo_test id="oval:org.opensuse.security:tst:2009271113" version="1" comment="apache2-mod_perl is &lt;2.0.11-lp151.3.3" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
+            <object object_ref="oval:org.opensuse.security:obj:2009040947"/>
+            <state state_ref="oval:org.opensuse.security:ste:2009070552"/>
+        </rpminfo_test>
+
+        <rpminfo_test id="oval:org.opensuse.security:tst:2009151816" version="1" comment="apache2-mod_perl is signed with openSUSE key" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
+            <object object_ref="oval:org.opensuse.security:obj:2009040947"/>
+            <state state_ref="oval:org.opensuse.security:ste:2009051526"/>
+        </rpminfo_test>
+
+        <rpminfo_test id="oval:org.opensuse.security:tst:2009271114" version="1" comment="apache2-mod_perl-devel is &lt;2.0.11-lp151.3.3" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
+            <object object_ref="oval:org.opensuse.security:obj:2009041273"/>
+            <state state_ref="oval:org.opensuse.security:ste:2009070552"/>
+        </rpminfo_test>
+
+        <rpminfo_test id="oval:org.opensuse.security:tst:2009271141" version="1" comment="apache2-mod_perl-devel is signed with openSUSE key" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
+            <object object_ref="oval:org.opensuse.security:obj:2009041273"/>
+            <state state_ref="oval:org.opensuse.security:ste:2009051526"/>
+        </rpminfo_test>
+    </tests>
+    <objects>
+        <rpminfo_object id="oval:org.opensuse.security:obj:2009031246" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
+            <name>openSUSE-release</name>
+        </rpminfo_object>
+
+        <rpminfo_object id="oval:org.opensuse.security:obj:2009031297" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
+            <name>cacti</name>
+        </rpminfo_object>
+
+        <rpminfo_object id="oval:org.opensuse.security:obj:2009037882" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
+            <name>cacti-spine</name>
+        </rpminfo_object>
+
+        <rpminfo_object id="oval:org.opensuse.security:obj:2009040947" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
+            <name>apache2-mod_perl</name>
+        </rpminfo_object>
+
+        <rpminfo_object id="oval:org.opensuse.security:obj:2009041273" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
+            <name>apache2-mod_perl-devel</name>
+        </rpminfo_object>
+    </objects>
+    <states>
+        <rpminfo_state id="oval:org.opensuse.security:ste:2009068342" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
+            <version operation="equals">15.1</version>
+        </rpminfo_state>
+
+        <rpminfo_state id="oval:org.opensuse.security:ste:2009072069" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
+            <evr datatype="evr_string" operation="less than">0:1.2.11-lp151.3.6</evr>
+        </rpminfo_state>
+
+        <rpminfo_state id="oval:org.opensuse.security:ste:2009051526" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
+            <signature_keyid operation="equals">b88b2fd43dbdc284</signature_keyid>
+        </rpminfo_state>
+
+        <rpminfo_state id="oval:org.opensuse.security:ste:2009070552" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
+            <evr datatype="evr_string" operation="less than">0:2.0.11-lp151.3.3</evr>
+        </rpminfo_state>
+    </states>
+
+
+</oval_definitions>