Skip to content

Commit c28a139

Browse files
stevespringettstevespringett
committed
Added UI for configuring the NVD and GitHub actions.
#1153 #1225
1 parent 95772bf commit c28a139

File tree

5 files changed

+172
-0
lines changed

5 files changed

+172
-0
lines changed

‎src/i18n/locales/en.json‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -287,6 +287,10 @@
287287
"npm_audit": "NPM Audit",
288288
"oss_index": "Sonatype OSS Index",
289289
"vulndb": "VulnDB",
290+
"vuln_sources": "Vulnerability Sources",
291+
"nvd": "NVD",
292+
"national_vulnerability_database": "National Vulnerability Database",
293+
"github_advisories": "GitHub Advisories",
290294
"repositories": "Repositories",
291295
"cargo": "Cargo",
292296
"composer": "Composer",
@@ -345,6 +349,11 @@
345349
"analyzer_ossindex_desc": "OSS Index is a service provided by Sonatype which identifies vulnerabilities in third-party components. Dependency-Track integrates natively with the OSS Index service to provide highly accurate results. Use of this analyzer requires a valid PackageURL for the components being analyzed.",
346350
"analyzer_vulndb_enable": "Enable VulnDB analyzer",
347351
"analyzer_vulndb_desc": "VulnDB is a commercial service from Risk Based Security which identifies vulnerabilities in third-party components. Dependency-Track integrates natively with the VulnDB service to provide highly accurate results. Use of this analyzer requires a valid CPE for the components being analyzed.",
352+
"vulnsource_nvd_enable": "Enable National Vulnerability Database mirroring",
353+
"vulnsource_nvd_desc": "The National Vulnerability Database (NVD) is the largest publicly available source of vulnerability intelligence. It is maintained by a group within the National Institute of Standards and Technology (NIST) and builds upon the work of MITRE and others. Vulnerabilities in the NVD are called Common Vulnerabilities and Exposures (CVE). There are over 100,000 CVEs documented in the NVD spanning from the 1990’s to the present.",
354+
"vulnsource_nvd_feeds_url": "NVD Feeds URL",
355+
"vulnsource_github_advisories_enable": "Enable GitHub Advisory mirroring",
356+
"vulnsource_github_advisories_desc": "GitHub Advisories is a centralized source of vulnerability intelligence specific to GitHub projects. GitHub advisories may \nor may not be documented in the National Vulnerability Database.",
348357
"registered_email_address": "Registered email address",
349358
"api_token": "API token",
350359
"consumer_key": "Consumer key",

‎src/views/administration/AdminMenu.vue‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,23 @@
8888
}
8989
]
9090
},
91+
{
92+
name: this.$t('admin.vuln_sources'),
93+
id: "vulnSourceMenu",
94+
permission: SYSTEM_CONFIGURATION,
95+
children: [
96+
{
97+
component: "VulnSourceNvd",
98+
name: this.$t('admin.national_vulnerability_database'),
99+
href: "#vulnsourceNvdTab"
100+
},
101+
{
102+
component: "VulnSourceGitHubAdvisories",
103+
name: this.$t('admin.github_advisories'),
104+
href: "#vulnsourceGitHubAdvisoriesTab"
105+
}
106+
]
107+
},
91108
{
92109
name: this.$t('admin.repositories'),
93110
id: "repositoriesMenu",

‎src/views/administration/Administration.vue‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,9 @@
2828
import NpmAuditAnalyzer from "./analyzers/NpmAuditAnalyzer";
2929
import OssIndexAnalyzer from "./analyzers/OssIndexAnalyzer";
3030
import VulnDbAnalyzer from "./analyzers/VulnDbAnalyzer";
31+
// Vulnerability sources
32+
import VulnSourceNvd from "./vuln-sources/VulnSourceNvd";
33+
import VulnSourceGitHubAdvisories from "./vuln-sources/VulnSourceGitHubAdvisories";
3134
// Repositories
3235
import Cargo from "./repositories/Cargo";
3336
import Composer from "./repositories/Composer";
@@ -60,6 +63,7 @@
6063
AdminMenu,
6164
General, BomFormats, Email, InternalComponents,
6265
InternalAnalyzer, NpmAuditAnalyzer, OssIndexAnalyzer, VulnDbAnalyzer,
66+
VulnSourceNvd, VulnSourceGitHubAdvisories,
6367
Cargo, Composer, Gem, GoModules, Hex, Maven, Npm, Nuget, Python,
6468
Alerts, Templates,
6569
FortifySsc, DefectDojo, KennaSecurity,

‎src/views/administration/vuln-sources/VulnSourceGitHubAdvisories.vue‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
<template>
2+
<b-card no-body :header="header">
3+
<b-card-body>
4+
<c-switch id="vulnsourceEnabled" color="primary" v-model="vulnsourceEnabled" label v-bind="labelIcon" />{{$t('admin.vulnsource_github_advisories_enable')}}
5+
<b-validated-input-group-form-input
6+
id="github-advisories-apitoken"
7+
:label="$t('admin.api_token')"
8+
input-group-size="mb-3"
9+
rules="required"
10+
type="password"
11+
v-model="apitoken"
12+
lazy="true"
13+
/>
14+
<hr/>
15+
{{ $t('admin.vulnsource_github_advisories_desc') }}
16+
</b-card-body>
17+
<b-card-footer>
18+
<b-button variant="outline-primary" class="px-4" @click="saveChanges">{{ $t('message.update') }}</b-button>
19+
</b-card-footer>
20+
</b-card>
21+
</template>
22+
23+
<script>
24+
import { Switch as cSwitch } from '@coreui/vue';
25+
import BValidatedInputGroupFormInput from '../../../forms/BValidatedInputGroupFormInput';
26+
import common from "../../../shared/common";
27+
import configPropertyMixin from "../mixins/configPropertyMixin";
28+
29+
export default {
30+
mixins: [configPropertyMixin],
31+
props: {
32+
header: String
33+
},
34+
components: {
35+
cSwitch,
36+
BValidatedInputGroupFormInput
37+
},
38+
data() {
39+
return {
40+
vulnsourceEnabled: false,
41+
apitoken: '',
42+
labelIcon: {
43+
dataOn: '\u2713',
44+
dataOff: '\u2715'
45+
},
46+
}
47+
},
48+
methods: {
49+
saveChanges: function() {
50+
this.updateConfigProperties([
51+
{groupName: 'vuln-source', propertyName: 'github.advisories.enabled', propertyValue: this.vulnsourceEnabled},
52+
{groupName: 'vuln-source', propertyName: 'github.advisories.access.token', propertyValue: this.apitoken}
53+
]);
54+
}
55+
},
56+
created () {
57+
this.axios.get(this.configUrl).then((response) => {
58+
let configItems = response.data.filter(function (item) { return item.groupName === "vuln-source" });
59+
for (let i=0; i<configItems.length; i++) {
60+
let item = configItems[i];
61+
switch (item.propertyName) {
62+
case "github.advisories.enabled":
63+
this.vulnsourceEnabled = common.toBoolean(item.propertyValue); break;
64+
case "github.advisories.access.token":
65+
this.apitoken = item.propertyValue; break;
66+
}
67+
}
68+
});
69+
}
70+
}
71+
</script>

‎src/views/administration/vuln-sources/VulnSourceNvd.vue‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
<template>
2+
<b-card no-body :header="header">
3+
<b-card-body>
4+
<c-switch id="vulnsourceEnabled" color="primary" v-model="vulnsourceEnabled" label v-bind="labelIcon" />{{$t('admin.vulnsource_nvd_enable')}}
5+
<b-validated-input-group-form-input
6+
id="nvd-feeds-url"
7+
:label="$t('admin.vulnsource_nvd_feeds_url')"
8+
input-group-size="mb-3"
9+
rules="required"
10+
type="text"
11+
v-model="nvdFeedsUrl"
12+
lazy="true"
13+
/>
14+
<hr/>
15+
{{ $t('admin.vulnsource_nvd_desc') }}
16+
</b-card-body>
17+
<b-card-footer>
18+
<b-button variant="outline-primary" class="px-4" @click="saveChanges">{{ $t('message.update') }}</b-button>
19+
</b-card-footer>
20+
</b-card>
21+
</template>
22+
23+
<script>
24+
import { Switch as cSwitch } from '@coreui/vue';
25+
import BValidatedInputGroupFormInput from '../../../forms/BValidatedInputGroupFormInput';
26+
import common from "../../../shared/common";
27+
import configPropertyMixin from "../mixins/configPropertyMixin";
28+
29+
export default {
30+
mixins: [configPropertyMixin],
31+
props: {
32+
header: String
33+
},
34+
components: {
35+
cSwitch,
36+
BValidatedInputGroupFormInput
37+
},
38+
data() {
39+
return {
40+
vulnsourceEnabled: false,
41+
nvdFeedsUrl: '',
42+
labelIcon: {
43+
dataOn: '\u2713',
44+
dataOff: '\u2715'
45+
},
46+
}
47+
},
48+
methods: {
49+
saveChanges: function() {
50+
this.updateConfigProperties([
51+
{groupName: 'vuln-source', propertyName: 'nvd.enabled', propertyValue: this.scannerEnabled},
52+
{groupName: 'vuln-source', propertyName: 'nvd.feeds.url', propertyValue: this.username}
53+
]);
54+
}
55+
},
56+
created () {
57+
this.axios.get(this.configUrl).then((response) => {
58+
let configItems = response.data.filter(function (item) { return item.groupName === "vuln-source" });
59+
for (let i=0; i<configItems.length; i++) {
60+
let item = configItems[i];
61+
switch (item.propertyName) {
62+
case "nvd.enabled":
63+
this.vulnsourceEnabled = common.toBoolean(item.propertyValue); break;
64+
case "nvd.feeds.url":
65+
this.nvdFeedsUrl = item.propertyValue; break;
66+
}
67+
}
68+
});
69+
}
70+
}
71+
</script>

0 commit comments

Comments
 (0)