Skip to content

Commit fe574fc

Browse files
pombredannepombredanne
authored
Merge pull request #1041 from TG1999/migrate/retiredotnet
Migrate retiredotnet importer
2 parents 6b0a4c2 + cb491e2 commit fe574fc

File tree

6 files changed

+158
-168
lines changed

6 files changed

+158
-168
lines changed

‎CHANGELOG.rst

+1
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ Version v31.1.0
66
----------------
77

88
- We re-enabled support for the NPM vulnerabilities advisories importer.
9+
- We re-enabled support for the Retiredotnet vulnerabilities advisories importer.
910

1011

1112
Version v31.0.0

‎vulnerabilities/importers/__init__.py

+2
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
from vulnerabilities.importers import pypa
2222
from vulnerabilities.importers import pysec
2323
from vulnerabilities.importers import redhat
24+
from vulnerabilities.importers import retiredotnet
2425
from vulnerabilities.importers import ubuntu
2526

2627
IMPORTERS_REGISTRY = [
@@ -39,6 +40,7 @@
3940
ubuntu.UbuntuImporter,
4041
debian_oval.DebianOvalImporter,
4142
npm.NpmImporter,
43+
retiredotnet.RetireDotnetImporter,
4244
]
4345

4446
IMPORTERS_REGISTRY = {x.qualified_name: x for x in IMPORTERS_REGISTRY}

‎vulnerabilities/importers/retiredotnet.py

+52-41
Original file line numberDiff line numberDiff line change
@@ -9,34 +9,38 @@
99

1010
import json
1111
import re
12+
from pathlib import Path
13+
from typing import Iterable
1214
from typing import List
13-
from typing import Set
1415

1516
from packageurl import PackageURL
17+
from univers.version_range import NugetVersionRange
18+
from univers.versions import NugetVersion
1619

1720
from vulnerabilities.importer import AdvisoryData
18-
from vulnerabilities.importer import GitImporter
21+
from vulnerabilities.importer import AffectedPackage
22+
from vulnerabilities.importer import Importer
1923
from vulnerabilities.importer import Reference
20-
from vulnerabilities.utils import AffectedPackage
2124

2225

23-
class RetireDotnetImporter(GitImporter):
24-
def __enter__(self):
25-
super(RetireDotnetImporter, self).__enter__()
26+
class RetireDotnetImporter(Importer):
27+
license_url = "https://github.com/RetireNet/Packages/blob/master/LICENSE"
28+
spdx_license_expression = "MIT"
29+
repo_url = "git+https://github.com/RetireNet/Packages/"
2630

27-
if not getattr(self, "_added_files", None):
28-
self._added_files, self._updated_files = self.file_changes(
29-
recursive=True, file_ext="json", subdir="./Content"
30-
)
31+
def advisory_data(self) -> Iterable[AdvisoryData]:
32+
try:
33+
self.clone(self.repo_url)
34+
path = Path(self.vcs_response.dest_dir)
3135

32-
def updated_advisories(self) -> Set[AdvisoryData]:
33-
files = self._updated_files.union(self._added_files)
34-
advisories = []
35-
for f in files:
36-
processed_data = self.process_file(f)
37-
if processed_data:
38-
advisories.append(processed_data)
39-
return self.batch_advisories(advisories)
36+
vuln = path / "Content"
37+
for file in vuln.glob("*.json"):
38+
advisory = self.process_file(file)
39+
if advisory:
40+
yield advisory
41+
finally:
42+
if self.vcs_response:
43+
self.vcs_response.delete()
4044

4145
@staticmethod
4246
def vuln_id_from_desc(desc):
@@ -50,33 +54,40 @@ def vuln_id_from_desc(desc):
5054
def process_file(self, path) -> List[AdvisoryData]:
5155
with open(path) as f:
5256
json_doc = json.load(f)
53-
if self.vuln_id_from_desc(json_doc["description"]):
54-
vuln_id = self.vuln_id_from_desc(json_doc["description"])
55-
else:
56-
return
57-
57+
description = json_doc.get("description") or ""
58+
alias = self.vuln_id_from_desc(description)
5859
affected_packages = []
59-
for pkg in json_doc["packages"]:
60+
for pkg in json_doc.get("packages") or []:
61+
name = pkg.get("id")
62+
if not name:
63+
continue
64+
affected_version_range = None
65+
fixed_version = None
66+
if pkg.get("affected"):
67+
affected_version_range = NugetVersionRange.from_versions([pkg["affected"]])
68+
if pkg.get("fix"):
69+
fixed_version = NugetVersion(pkg["fix"])
70+
if not affected_version_range and not fixed_version:
71+
continue
6072
affected_packages.append(
6173
AffectedPackage(
62-
vulnerable_package=PackageURL(
63-
name=pkg["id"], version=pkg["affected"], type="nuget"
64-
),
65-
patched_package=PackageURL(
66-
name=pkg["id"], version=pkg["fix"], type="nuget"
67-
),
74+
package=PackageURL(name=name, type="nuget"),
75+
affected_version_range=affected_version_range,
76+
fixed_version=fixed_version,
6877
)
6978
)
7079

71-
vuln_reference = [
72-
Reference(
73-
url=json_doc["link"],
80+
link = json_doc.get("link")
81+
if link:
82+
vuln_reference = [
83+
Reference(
84+
url=link,
85+
)
86+
]
87+
if alias:
88+
return AdvisoryData(
89+
aliases=[alias],
90+
summary=description,
91+
affected_packages=affected_packages,
92+
references=vuln_reference,
7493
)
75-
]
76-
77-
return AdvisoryData(
78-
vulnerability_id=vuln_id,
79-
summary=json_doc["description"],
80-
affected_packages=affected_packages,
81-
references=vuln_reference,
82-
)

‎vulnerabilities/tests/conftest.py

-1
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,6 @@ def no_rmtree(monkeypatch):
3636
"test_mozilla.py",
3737
"test_msr2019.py",
3838
"test_package_managers.py",
39-
"test_retiredotnet.py",
4039
"test_ruby.py",
4140
"test_rust.py",
4241
"test_safety_db.py",

‎vulnerabilities/tests/test_data/retiredotnet/expected_file.json

+88
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
{
2+
"aliases": [
3+
"CVE-2019-0982"
4+
],
5+
"summary": "Microsoft Security Advisory CVE-2019-0982: ASP.NET Core Denial of Service Vulnerability",
6+
"affected_packages": [
7+
{
8+
"package": {
9+
"type": "nuget",
10+
"namespace": null,
11+
"name": "Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
12+
"version": null,
13+
"qualifiers": null,
14+
"subpath": null
15+
},
16+
"affected_version_range": "vers:nuget/1.0.0",
17+
"fixed_version": "1.0.11"
18+
},
19+
{
20+
"package": {
21+
"type": "nuget",
22+
"namespace": null,
23+
"name": "Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
24+
"version": null,
25+
"qualifiers": null,
26+
"subpath": null
27+
},
28+
"affected_version_range": "vers:nuget/1.0.1",
29+
"fixed_version": "1.0.11"
30+
},
31+
{
32+
"package": {
33+
"type": "nuget",
34+
"namespace": null,
35+
"name": "Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
36+
"version": null,
37+
"qualifiers": null,
38+
"subpath": null
39+
},
40+
"affected_version_range": "vers:nuget/1.0.2",
41+
"fixed_version": "1.0.11"
42+
},
43+
{
44+
"package": {
45+
"type": "nuget",
46+
"namespace": null,
47+
"name": "Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
48+
"version": null,
49+
"qualifiers": null,
50+
"subpath": null
51+
},
52+
"affected_version_range": "vers:nuget/1.0.3",
53+
"fixed_version": "1.0.11"
54+
},
55+
{
56+
"package": {
57+
"type": "nuget",
58+
"namespace": null,
59+
"name": "Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
60+
"version": null,
61+
"qualifiers": null,
62+
"subpath": null
63+
},
64+
"affected_version_range": "vers:nuget/1.0.4",
65+
"fixed_version": "1.0.11"
66+
},
67+
{
68+
"package": {
69+
"type": "nuget",
70+
"namespace": null,
71+
"name": "Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
72+
"version": null,
73+
"qualifiers": null,
74+
"subpath": null
75+
},
76+
"affected_version_range": "vers:nuget/1.1.0",
77+
"fixed_version": "1.1.5"
78+
}
79+
],
80+
"references": [
81+
{
82+
"reference_id": "",
83+
"url": "https://github.com/aspnet/Announcements/issues/359",
84+
"severities": []
85+
}
86+
],
87+
"date_published": null
88+
}

‎vulnerabilities/tests/test_retiredotnet.py

+15-126
Original file line numberDiff line numberDiff line change
@@ -9,138 +9,27 @@
99

1010

1111
import os
12-
from collections import OrderedDict
13-
from unittest import TestCase
1412

15-
from packageurl import PackageURL
16-
17-
from vulnerabilities.importer import AdvisoryData
18-
from vulnerabilities.importer import Reference
1913
from vulnerabilities.importers.retiredotnet import RetireDotnetImporter
20-
from vulnerabilities.utils import AffectedPackage
14+
from vulnerabilities.tests import util_tests
2115

2216
BASE_DIR = os.path.dirname(os.path.abspath(__file__))
2317

2418

25-
class TestRetireDotnetImporter(TestCase):
26-
@classmethod
27-
def setUpClass(cls):
28-
data_source_cfg = {
29-
"repository_url": "https://test.net",
30-
}
31-
cls.data_src = RetireDotnetImporter(1, config=data_source_cfg)
32-
33-
def test_vuln_id_from_desc(self):
34-
35-
gibberish = "xyzabcpqr123" * 50 + "\n" * 100
36-
res = self.data_src.vuln_id_from_desc(gibberish)
37-
assert res is None
38-
39-
desc = "abcdef CVE-2002-1968 pqrstuvwxyz:_|-|"
40-
res = self.data_src.vuln_id_from_desc(desc)
41-
assert res == "CVE-2002-1968"
42-
43-
def test_process_file(self):
19+
def test_vuln_id_from_desc():
20+
importer = RetireDotnetImporter()
21+
gibberish = "xyzabcpqr123" * 50 + "\n" * 100
22+
res = importer.vuln_id_from_desc(gibberish)
23+
assert res is None
4424

45-
path = os.path.join(BASE_DIR, "test_data/retiredotnet/test_file.json")
46-
expected_data = Advisory(
47-
summary="Microsoft Security Advisory CVE-2019-0982: ASP.NET Core Denial of Service Vulnerability",
48-
vulnerability_id="CVE-2019-0982",
49-
affected_packages=[
50-
AffectedPackage(
51-
vulnerable_package=PackageURL(
52-
type="nuget",
53-
namespace=None,
54-
name="Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
55-
version="1.0.0",
56-
),
57-
patched_package=PackageURL(
58-
type="nuget",
59-
namespace=None,
60-
name="Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
61-
version="1.0.11",
62-
),
63-
),
64-
AffectedPackage(
65-
vulnerable_package=PackageURL(
66-
type="nuget",
67-
namespace=None,
68-
name="Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
69-
version="1.0.1",
70-
),
71-
patched_package=PackageURL(
72-
type="nuget",
73-
namespace=None,
74-
name="Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
75-
version="1.0.11",
76-
),
77-
),
78-
AffectedPackage(
79-
vulnerable_package=PackageURL(
80-
type="nuget",
81-
namespace=None,
82-
name="Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
83-
version="1.0.2",
84-
),
85-
patched_package=PackageURL(
86-
type="nuget",
87-
namespace=None,
88-
name="Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
89-
version="1.0.11",
90-
),
91-
),
92-
AffectedPackage(
93-
vulnerable_package=PackageURL(
94-
type="nuget",
95-
namespace=None,
96-
name="Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
97-
version="1.0.3",
98-
),
99-
patched_package=PackageURL(
100-
type="nuget",
101-
namespace=None,
102-
name="Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
103-
version="1.0.11",
104-
),
105-
),
106-
AffectedPackage(
107-
vulnerable_package=PackageURL(
108-
type="nuget",
109-
namespace=None,
110-
name="Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
111-
version="1.0.4",
112-
),
113-
patched_package=PackageURL(
114-
type="nuget",
115-
namespace=None,
116-
name="Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
117-
version="1.0.11",
118-
),
119-
),
120-
AffectedPackage(
121-
vulnerable_package=PackageURL(
122-
type="nuget",
123-
namespace=None,
124-
name="Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
125-
version="1.1.0",
126-
),
127-
patched_package=PackageURL(
128-
type="nuget",
129-
namespace=None,
130-
name="Microsoft.AspNetCore.SignalR.Protocols.MessagePack",
131-
version="1.1.5",
132-
),
133-
),
134-
],
135-
references=[
136-
Reference(
137-
reference_id="",
138-
url="https://github.com/aspnet/Announcements/issues/359",
139-
severities=[],
140-
)
141-
],
142-
)
25+
desc = "abcdef CVE-2002-1968 pqrstuvwxyz:_|-|"
26+
res = importer.vuln_id_from_desc(desc)
27+
assert res == "CVE-2002-1968"
14328

144-
found_data = self.data_src.process_file(path)
14529

146-
assert expected_data == found_data
30+
def test_process_file():
31+
path = os.path.join(BASE_DIR, "test_data/retiredotnet/test_file.json")
32+
importer = RetireDotnetImporter()
33+
expected_file = os.path.join(BASE_DIR, "test_data/retiredotnet/expected_file.json")
34+
advisory = importer.process_file(path)
35+
util_tests.check_results_against_json(advisory.to_dict(), expected_file)

0 commit comments

Comments
 (0)