Vulnerability.java

/*
 * This file is part of Dependency-Track.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 *
 * SPDX-License-Identifier: Apache-2.0
 * Copyright (c) OWASP Foundation. All Rights Reserved.
 */
package org.dependencytrack.persistence.model;

import io.quarkus.hibernate.orm.panache.PanacheEntityBase;
import io.quarkus.runtime.annotations.RegisterForReflection;
import jakarta.persistence.Column;
import jakarta.persistence.Convert;
import jakarta.persistence.Entity;
import jakarta.persistence.EnumType;
import jakarta.persistence.Enumerated;
import jakarta.persistence.Id;
import jakarta.persistence.JoinColumn;
import jakarta.persistence.JoinTable;
import jakarta.persistence.ManyToMany;
import jakarta.persistence.OneToMany;
import jakarta.persistence.OrderBy;
import jakarta.persistence.Table;
import org.dependencytrack.common.cwe.Cwe;
import org.dependencytrack.common.model.Severity;
import org.dependencytrack.commonutil.VulnerabilityUtil;
import org.dependencytrack.persistence.converter.CollectionIntegerConverter;
import org.hibernate.annotations.JdbcType;
import org.hibernate.type.descriptor.jdbc.UUIDJdbcType;

import java.math.BigDecimal;
import java.util.ArrayList;
import java.util.Date;
import java.util.List;
import java.util.UUID;

/**
 * Model for tracking vulnerabilities.
 *
 * @author Steve Springett
 * @since 3.0.0
 */

@Entity
@RegisterForReflection
@Table(name = "VULNERABILITY")
public class Vulnerability extends PanacheEntityBase {

    /**
     * Defines the sources of vulnerability data supported by Dependency-Track.
     */
    public enum Source {
        NVD,      // National Vulnerability Database
        NPM,      // NPM Public Advisories - NEED TO KEEP FOR LEGACY PURPOSES
        GITHUB,   // GitHub Security Advisories
        VULNDB,   // VulnDB from Risk Based Security
        OSSINDEX, // Sonatype OSS Index
        RETIREJS, // Retire.js
        INTERNAL,  // Internally-managed (and manually entered) vulnerability
        SNYK,    // Snyk Purl Vulnerability
        OSV // Google OSV Advisories
    }

    @Id
    @Column(name = "ID")
    private long id;

    @Column(name = "VULNID", nullable = false)
    private String vulnId;

    @Column(name = "SOURCE", nullable = false)
    private String source;

    @Column(name = "FRIENDLYVULNID")
    private String friendlyVulnId;

    @Column(name = "TITLE")
    private String title;

    @Column(name = "SUBTITLE")
    private String subTitle;

    @Column(name = "DESCRIPTION")
    private String description;

    @Column(name = "DETAIL")
    private String detail;

    @Column(name = "RECOMMENDATION")
    private String recommendation;

    @Column(name = "\"REFERENCES\"")
    private String references;

    @Column(name = "CREDITS")
    private String credits;

    @Column(name = "CREATED")
    private Date created;

    @Column(name = "PUBLISHED")
    private Date published;

    @Column(name = "UPDATED")
    private Date updated;

    @Column(name = "CWES")
    @Convert(converter = CollectionIntegerConverter.class)
    private List<Integer> cwes;

    @Column(name = "CVSSV2BASESCORE", scale = 1)
    private BigDecimal cvssV2BaseScore;

    @Column(name = "CVSSV2IMPACTSCORE", scale = 1)
    private BigDecimal cvssV2ImpactSubScore;

    @Column(name = "CVSSV2EXPLOITSCORE", scale = 1)
    private BigDecimal cvssV2ExploitabilitySubScore;

    @Column(name = "CVSSV2VECTOR")
    private String cvssV2Vector;

    @Column(name = "CVSSV3BASESCORE", scale = 1)
    private BigDecimal cvssV3BaseScore;

    @Column(name = "CVSSV3IMPACTSCORE", scale = 1)
    private BigDecimal cvssV3ImpactSubScore;

    @Column(name = "CVSSV3EXPLOITSCORE", scale = 1)
    private BigDecimal cvssV3ExploitabilitySubScore;

    @Column(name = "CVSSV3VECTOR")
    private String cvssV3Vector;

    @Enumerated(EnumType.STRING)
    @Column(name = "SEVERITY")
    private Severity severity;

    @Column(name = "VULNERABLEVERSIONS")
    private String vulnerableVersions;

    @Column(name = "PATCHEDVERSIONS")
    private String patchedVersions;

    @ManyToMany(mappedBy = "vulnerabilities")
    private List<VulnerableSoftware> vulnerableSoftware;

    @OrderBy("name ASC")
    @ManyToMany
    @JoinTable(
            name = "COMPONENTS_VULNERABILITIES",
            joinColumns = @JoinColumn(name = "VULNERABILITY_ID", referencedColumnName = "ID"),
            inverseJoinColumns = @JoinColumn(name = "COMPONENT_ID", referencedColumnName = "ID")
    )
    private List<Component> components;

    @Column(name = "UUID", nullable = false)
    @JdbcType(UUIDJdbcType.class)
    private UUID uuid;

    @OneToMany
    @JoinTable(
            name = "VULNERABILITIES_TAGS",
            joinColumns = @JoinColumn(name = "VULNERABILITY_ID", referencedColumnName = "ID"),
            inverseJoinColumns = @JoinColumn(name = "TAG_ID", referencedColumnName = "ID")
    )
    @OrderBy("name ASC")
    private List<Tag> tags;

    private transient int affectedProjectCount;

    private transient List<VulnerabilityAlias> aliases;

    public long getId() {
        return id;
    }

    public void setId(Long id) {
        this.id = id;
    }

    /**
     * Returns the value of the severity field (if specified), otherwise, will
     * return the severity based on the numerical CVSS score. CVSSv2 and CVSSv3 have
     * slightly different ranges with CVSSv3 introducing critical severity whereas
     * CVSSv2 only has high, medium, and low.
     * <p>
     * This method properly accounts for vulnerabilities that may have only a CVSSv2
     * score. If both scores are available, it will return the CVSSv3 severity.
     *
     * @return the severity of the vulnerability
     * @see VulnerabilityUtil#getSeverity(BigDecimal, BigDecimal)
     */
    public Severity getSeverity() {
        return (this.severity != null) ? severity : VulnerabilityUtil.getSeverity(cvssV2BaseScore, cvssV3BaseScore);
    }

    /**
     * Sets the severity. This should only be set if CVSSv2 or CVSSv3 scores
     * are not used.
     *
     * @param severity the severity of the vulnerability
     */
    public void setSeverity(Severity severity) {
        cvssV2BaseScore = null;
        cvssV2ImpactSubScore = null;
        cvssV2ExploitabilitySubScore = null;
        cvssV2Vector = null;
        cvssV3BaseScore = null;
        cvssV3ImpactSubScore = null;
        cvssV3ExploitabilitySubScore = null;
        cvssV3Vector = null;
        this.severity = severity;
    }

    public String getVulnId() {
        return vulnId;
    }

    public void setVulnId(String vulnId) {
        this.vulnId = vulnId;
    }

    public String getFriendlyVulnId() {
        return friendlyVulnId;
    }

    public void setFriendlyVulnId(String friendlyVulnId) {
        this.friendlyVulnId = friendlyVulnId;
    }

    public String getDescription() {
        return description;
    }

    public void setDescription(String description) {
        this.description = description;
    }

    public String getRecommendation() {
        return recommendation;
    }

    public String getDetail() {
        return detail;
    }

    public void setDetail(String detail) {
        this.detail = detail;
    }

    public void setRecommendation(String recommendation) {
        this.recommendation = recommendation;
    }

    public String getReferences() {
        return references;
    }

    public void setReferences(String references) {
        this.references = references;
    }

    public String getCredits() {
        return credits;
    }

    public void setCredits(String credits) {
        this.credits = credits;
    }

    public Date getCreated() {
        return created;
    }

    public void setCreated(Date created) {
        this.created = created;
    }

    public Date getPublished() {
        return published;
    }

    public void setPublished(Date published) {
        this.published = published;
    }

    public Date getUpdated() {
        return updated;
    }

    public void setUpdated(Date updated) {
        this.updated = updated;
    }

    public String getVulnerableVersions() {
        return vulnerableVersions;
    }

    public void setVulnerableVersions(String vulnerableVersions) {
        this.vulnerableVersions = vulnerableVersions;
    }

    public String getPatchedVersions() {
        return patchedVersions;
    }

    public void setPatchedVersions(String patchedVersions) {
        this.patchedVersions = patchedVersions;
    }

    public String getSource() {
        return source;
    }

    public void setSource(String source) {
        this.source = source;
    }

    public void setSource(Source source) {
        this.source = source.name();
    }

    public String getTitle() {
        return title;
    }

    public void setTitle(String title) {
        this.title = title;
    }

    public String getSubTitle() {
        return subTitle;
    }

    public void setSubTitle(String subTitle) {
        this.subTitle = subTitle;
    }

    public List<Integer> getCwes() {
        return cwes;
    }

    public void setCwes(List<Integer> cwes) {
        if (cwes == null) {
            this.cwes = null;
        } else {
            this.cwes = new ArrayList<>();
            for (final Integer integer : cwes) {
                if (integer != null) {
                    this.cwes.add(integer);
                }
            }


        }
    }

    public void addCwe(Integer cweId) {
        if (cweId == null) {
            return;
        }
        if (this.cwes == null) {
            this.cwes = new ArrayList<>();
        }
        this.cwes.add(cweId);
    }

    public void addCwe(Cwe cwe) {
        if (cwe == null) {
            return;
        }
        if (this.cwes == null) {
            this.cwes = new ArrayList<>();
            this.cwes.add(cwe.getCweId());
        } else {
            if (!this.cwes.contains(cwe.getCweId())) {
                this.cwes.add(cwe.getCweId());
            }
        }
    }

    public BigDecimal getCvssV2BaseScore() {
        return cvssV2BaseScore;
    }

    public void setCvssV2BaseScore(BigDecimal cvssV2BaseScore) {
        this.cvssV2BaseScore = cvssV2BaseScore;
    }

    public BigDecimal getCvssV2ImpactSubScore() {
        return cvssV2ImpactSubScore;
    }

    public void setCvssV2ImpactSubScore(BigDecimal cvssV2ImpactSubScore) {
        this.cvssV2ImpactSubScore = cvssV2ImpactSubScore;
    }

    public BigDecimal getCvssV2ExploitabilitySubScore() {
        return cvssV2ExploitabilitySubScore;
    }

    public void setCvssV2ExploitabilitySubScore(BigDecimal cvssV2ExploitabilitySubScore) {
        this.cvssV2ExploitabilitySubScore = cvssV2ExploitabilitySubScore;
    }

    public String getCvssV2Vector() {
        return cvssV2Vector;
    }

    public void setCvssV2Vector(String cvssV2Vector) {
        this.cvssV2Vector = cvssV2Vector;
    }

    public BigDecimal getCvssV3BaseScore() {
        return cvssV3BaseScore;
    }

    public void setCvssV3BaseScore(BigDecimal cvssV3BaseScore) {
        this.cvssV3BaseScore = cvssV3BaseScore;
    }

    public BigDecimal getCvssV3ImpactSubScore() {
        return cvssV3ImpactSubScore;
    }

    public void setCvssV3ImpactSubScore(BigDecimal cvssV3ImpactSubScore) {
        this.cvssV3ImpactSubScore = cvssV3ImpactSubScore;
    }

    public BigDecimal getCvssV3ExploitabilitySubScore() {
        return cvssV3ExploitabilitySubScore;
    }

    public void setCvssV3ExploitabilitySubScore(BigDecimal cvssV3ExploitabilitySubScore) {
        this.cvssV3ExploitabilitySubScore = cvssV3ExploitabilitySubScore;
    }

    public String getCvssV3Vector() {
        return cvssV3Vector;
    }

    public void setCvssV3Vector(String cvssV3Vector) {
        this.cvssV3Vector = cvssV3Vector;
    }

    public List<VulnerableSoftware> getVulnerableSoftware() {
        return vulnerableSoftware;
    }

    public void setVulnerableSoftware(List<VulnerableSoftware> vulnerableSoftware) {
        this.vulnerableSoftware = vulnerableSoftware;
    }

    public List<Component> getComponents() {
        return components;
    }

    public void setComponents(List<Component> components) {
        this.components = components;
    }


    public UUID getUuid() {
        return uuid;
    }

    public void setUuid(UUID uuid) {
        this.uuid = uuid;
    }

    public int getAffectedProjectCount() {
        return affectedProjectCount;
    }

    public void setAffectedProjectCount(int affectedProjectCount) {
        this.affectedProjectCount = affectedProjectCount;
    }

    public List<VulnerabilityAlias> getAliases() {
        return aliases;
    }

    public void setAliases(List<VulnerabilityAlias> aliases) {
        this.aliases = aliases;
    }

    public List<Tag> getTags() {
        return tags;
    }

    public void setTags(List<Tag> tags) {
        this.tags = tags;
    }
}