JSON API #8

app/vulncode_app/data_dump.py

@@ -23,6 +23,7 @@
 
 from vulncode_app.models import Vulnerability
 from vulncode_app.models import VulnerabilityReference
+from vulncode_app.models import ImpactedPackage
 from vulncode_app.models import Package
 
 
@@ -38,11 +39,16 @@ def debian_dump(extract_data):
             vulnerability=vulnerability,
             reference_id=data.get('vulnerability_id', ''),
         )
-        Package.objects.create(
+        package = Package.objects.create(
             name=data.get('package_name', ''),
             version=data.get('fixed_version', ''),
         )
 
+        impacted_package = ImpactedPackage.objects.create(
+            vulnerability=vulnerability,
+            package=package
+        )
+
 
 def ubuntu_dump(html):
     """
@@ -56,6 +62,10 @@ def ubuntu_dump(html):
             vulnerability=vulnerability,
             reference_id=data.get('cve_id'),
         )
-        Package.objects.create(
+        package = Package.objects.create(
             name=data.get('package_name'),
         )
+        ImpactedPackage.objects.create(
+            vulnerability=vulnerability,
+            package=package
+        )

app/vulncode_app/serializers.py

@@ -0,0 +1,65 @@
+#
+# Copyright (c) 2017 nexB Inc. and others. All rights reserved.
+# http://nexb.com and https://github.com/nexB/vulnerablecode/
+# The VulnerableCode software is licensed under the Apache License version 2.0.
+# Data generated with VulnerableCode require an acknowledgment.
+#
+# You may not use this software except in compliance with the License.
+# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing, software distributed
+# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+# CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+#
+# When you publish or redistribute any data created with VulnerableCode or any VulnerableCode
+# derivative work, you must accompany this data with the following acknowledgment:
+#
+#  Generated with VulnerableCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
+#  OR CONDITIONS OF ANY KIND, either express or implied. No content created from
+#  VulnerableCode should be considered or used as legal advice. Consult an Attorney
+#  for any legal advice.
+#  VulnerableCode is a free software code scanning tool from nexB Inc. and others.
+#  Visit https://github.com/nexB/vulnerablecode/ for support and download.
+
+from rest_framework import serializers
+
+from vulncode_app.models import Vulnerability
+from vulncode_app.models import VulnerabilityReference
+from vulncode_app.models import Package
+from vulncode_app.models import PackageReference
+from vulncode_app.models import ImpactedPackage
+
+
+class PackageReferenceSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = PackageReference
+        fields = ('name', 'version')
+
+
+class VulnerabilityReferenceSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = VulnerabilityReference
+        fields = ('reference_id',)
+
+
+class VulnerabilitySerializer(serializers.ModelSerializer):
+    reference = VulnerabilityReferenceSerializer(source='vulnerabilityreference_set', many=True)
+
+    class Meta:
+        model = Vulnerability
+        fields = ('summary', 'reference')
+
+
+class PackageSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = Package
+        fields = ('name', 'version')
+
+
+class ImpactedPackageSerializer(serializers.ModelSerializer):
+    package = PackageSerializer()
+    vulnerability = VulnerabilitySerializer()
+
+    class Meta:
+        model = ImpactedPackage
+        fields = ('package', 'vulnerability')

app/vulncode_app/test_api.py

@@ -0,0 +1,83 @@
+#
+# Copyright (c) 2017 nexB Inc. and others. All rights reserved.
+# http://nexb.com and https://github.com/nexB/vulnerablecode/
+# The VulnerableCode software is licensed under the Apache License version 2.0.
+# Data generated with VulnerableCode require an acknowledgment.
+#
+# You may not use this software except in compliance with the License.
+# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing, software distributed
+# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+# CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+#
+# When you publish or redistribute any data created with VulnerableCode or any VulnerableCode
+# derivative work, you must accompany this data with the following acknowledgment:
+#
+#  Generated with VulnerableCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
+#  OR CONDITIONS OF ANY KIND, either express or implied. No content created from
+#  VulnerableCode should be considered or used as legal advice. Consult an Attorney
+#  for any legal advice.
+#  VulnerableCode is a free software code scanning tool from nexB Inc. and others.
+#  Visit https://github.com/nexB/vulnerablecode/ for support and download.
+
+import json
+
+from drf_multiple_model.views import MultipleModelAPIView
+from django.test import TestCase
+from rest_framework.response import Response
+
+from vulncode_app.data_dump import debian_dump
+from vulncode_app.data_dump import ubuntu_dump
+
+from scraper import debian
+from scraper import ubuntu
+
+
+class TestSerializers(TestCase):
+    def test_debian_response(self):
+        with open('tests/test_data/debian.json') as f:
+            test_data = json.loads(f.read())
+
+        extract_data = debian.extract_vulnerabilities(test_data)
+        debian_dump(extract_data)
+        response = self.client.get('/vulncode_app/data/mimetex', format='json')
+
+        expected = {
+                "name": "mimetex",
+                "vulnerabilities": [
+                    {
+                       "summary": "Multiple stack-based buffer overflows in mimetex.cgi in mimeTeX",
+                       "reference_id": "CVE-2009-2458",
+                       "version": "1.50-1.1"
+                    },
+                    {
+                       "summary": "Multiple unspecified vulnerabilities in mimeTeX.",
+                       "reference_id": "CVE-2009-2459",
+                       "version": "1.50-1.1"
+                    }
+                ]
+            }
+
+        self.assertEqual(expected, response.data)
+
+    def test_ubuntu_response(self):
+        with open('tests/test_data/ubuntu_main.html') as f:
+            test_data = f.read()
+
+        extract_data = ubuntu.extract_cves(test_data)
+        ubuntu_dump(extract_data)
+        response = self.client.get('/vulncode_app/data/automake', format='json')
+
+        expected = {
+               "name": "automake",
+               "vulnerabilities": [
+                    {
+                       "summary": "",
+                       "reference_id": "CVE-2012-3386",
+                       "version": ""
+                    }
+                ]
+            }
+
+        self.assertEqual(expected, response.data)

app/vulncode_app/urls.py

@@ -22,11 +22,21 @@
 #  Visit https://github.com/nexB/vulnerablecode/ for support and download.
 
 from django.conf.urls import url
-
-from . import views
+from rest_framework.urlpatterns import format_suffix_patterns
+from vulncode_app import views
 
 
 urlpatterns = [
-    url(r'(?P<name>[a-z]+)/(?P<version>[0-9]+)', views.package_version, name='package_version'),
-    url(r'^(?P<name>[a-z]+)', views.package, name='package'),
+    url(r'^cve-search/(?P<name>[a-z]+)/(?P<version>[0-9]+)',
+        views.package_version,
+        name='package_version'),
+
+    url(r'^cve-search/(?P<name>[a-z]+)',
+        views.package,
+        name='package'),
+
+    url(r'^data/(?P<package_name>[a-z]+)',
+        views.VulnerabilityData.as_view()),
 ]
+
+urlpatterns = format_suffix_patterns(urlpatterns)

app/vulncode_app/views.py

@@ -24,10 +24,42 @@
 import json
 
 from django.http import HttpResponse
+from rest_framework.views import APIView
+from rest_framework.response import Response
+from rest_framework import status
 
+from vulncode_app.serializers import ImpactedPackageSerializer
+from vulncode_app.models import ImpactedPackage
+from vulncode_app.models import Package
 from vulncode_app import api_data
 
 
+class VulnerabilityData(APIView):
+    def get(self, request, package_name):
+        vulnerability = []
+        extract = []
+        data = []
+
+        pk = Package.objects.filter(name=package_name)
+
+        for i, v in enumerate(pk):
+            vulnerability.append(ImpactedPackage.objects.filter(pk=v.id))
+            extract += ImpactedPackageSerializer(vulnerability[i], many=True).data
+
+            data.append({
+                'summary': extract[i]['vulnerability']['summary'],
+                'reference_id': extract[i]['vulnerability']['reference'][0]['reference_id'],
+                'version': extract[i]['package']['version']
+            })
+
+        response = {
+            'name': package_name,
+            'vulnerabilities': data
+        }
+
+        return Response(response)
+
+
 def package(request, name):
     """
     Queries the cve-search api with just

requirements.txt

@@ -1,6 +1,7 @@
 beautifulsoup4==4.6.0
 lxml==3.8.0
 django==1.11.4
+djangorestframework==3.6
 
 # Tests
 pytest==3.1.3