diff --git a/CHANGELOG.rst b/CHANGELOG.rst index 665cf2ee..fbff5294 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -23,6 +23,12 @@ Release notes outputs. https://github.com/aboutcode-org/dejacode/issues/98 +- Add the ability to propagate vulnerability analysis data to other affected products. + A new "Propagate analysis to:" section in now displayed the "Vulnerability analysis" + modal. The list of products containing the same package as the one currently being + analysed are listed and can be selected for "analysis propagation". + https://github.com/aboutcode-org/dejacode/issues/105 + ### Version 5.2.1 - Fix the models documentation navigation. diff --git a/dejacode/static/css/dejacode_bootstrap.css b/dejacode/static/css/dejacode_bootstrap.css index ac1656a6..f559cc68 100644 --- a/dejacode/static/css/dejacode_bootstrap.css +++ b/dejacode/static/css/dejacode_bootstrap.css @@ -411,6 +411,14 @@ table.vulnerabilities-table .column-summary { #tab_vulnerabilities .column-vulnerability_analyses__responses { min-width: 120px; } +/* -- Vulnerability analysis modal -- */ +#vulnerability-analysis-modal #div_id_responses .form-check { + display: inline-block; + margin-right: 1rem; +} +#vulnerability-analysis-modal .form-label { + font-weight: 600; +} /* -- Dependency tab -- */ #tab_dependencies .column-for_package { diff --git a/dejacode/static/js/dejacode_main.js b/dejacode/static/js/dejacode_main.js index a2353397..b6df8b64 100644 --- a/dejacode/static/js/dejacode_main.js +++ b/dejacode/static/js/dejacode_main.js @@ -31,7 +31,10 @@ function setupPopovers() { function setupSelectionCheckboxes() { const selectAllCheckbox = document.getElementById("checkbox-select-all"); - const rowCheckboxes = document.querySelectorAll("table#object-list-table tbody input[type='checkbox']"); + if (!selectAllCheckbox) return; + + const parentTable = selectAllCheckbox.closest("table"); + const rowCheckboxes = parentTable.querySelectorAll("tbody input[type='checkbox']"); let lastChecked; // Store the last checked checkbox if (!rowCheckboxes) return; diff --git a/dje/templates/bootstrap_base_js.html b/dje/templates/bootstrap_base_js.html index 85f3afef..d037b84c 100644 --- a/dje/templates/bootstrap_base_js.html +++ b/dje/templates/bootstrap_base_js.html @@ -2,29 +2,4 @@ \ No newline at end of file diff --git a/product_portfolio/templates/product_portfolio/modals/vulnerability_analysis_modal.html b/product_portfolio/templates/product_portfolio/modals/vulnerability_analysis_modal.html index fae63967..1f716ec7 100644 --- a/product_portfolio/templates/product_portfolio/modals/vulnerability_analysis_modal.html +++ b/product_portfolio/templates/product_portfolio/modals/vulnerability_analysis_modal.html @@ -5,17 +5,19 @@
+ Vulnerability analysis:
- Package: + +
-
+
diff --git a/product_portfolio/templates/product_portfolio/product_details.html b/product_portfolio/templates/product_portfolio/product_details.html index c4b26359..5d1d9f8b 100644 --- a/product_portfolio/templates/product_portfolio/product_details.html +++ b/product_portfolio/templates/product_portfolio/product_details.html @@ -257,6 +257,9 @@ url: edit_url, success: function(data) { modal_body.html(data); + setupTooltips(); + setupPopovers(); + setupSelectionCheckboxes(); }, error: function() { modal_body.html('Error.'); @@ -280,7 +283,7 @@ return false; } modal_body.html(data); - edit_modal.animate({scrollTop: 0}); + vulnerability_modal.animate({scrollTop: 0}); }, error: function(){ modal_body.html('Error.'); diff --git a/product_portfolio/templates/product_portfolio/tabs/tab_vulnerabilities.html b/product_portfolio/templates/product_portfolio/tabs/tab_vulnerabilities.html index 2c858781..9c712658 100644 --- a/product_portfolio/templates/product_portfolio/tabs/tab_vulnerabilities.html +++ b/product_portfolio/templates/product_portfolio/tabs/tab_vulnerabilities.html @@ -65,7 +65,11 @@ {% if package.vulnerability_analysis.responses %} - {{ package.vulnerability_analysis.responses|join:"
" }} +
    + {% for response in package.vulnerability_analysis.responses %} +
  • {{ response }}
    • + {% endfor %} +
{% endif %} diff --git a/product_portfolio/tests/test_views.py b/product_portfolio/tests/test_views.py index aeeb9596..e998f25b 100644 --- a/product_portfolio/tests/test_views.py +++ b/product_portfolio/tests/test_views.py @@ -416,7 +416,12 @@ def test_product_portfolio_tab_vulnerability_view_analysis_rendering(self): Code Not Present - can_not_fix
rollback + +
    +
  • can_not_fix
    • +
  • rollback
    • +
+ """ self.assertContains(response, expected, html=True) diff --git a/product_portfolio/views.py b/product_portfolio/views.py index bce2379d..69d602bc 100644 --- a/product_portfolio/views.py +++ b/product_portfolio/views.py @@ -25,8 +25,9 @@ from django.core.paginator import Paginator from django.db import transaction from django.db.models import Count -from django.db.models import ObjectDoesNotExist +from django.db.models import OuterRef from django.db.models import Prefetch +from django.db.models import Subquery from django.db.models.functions import Lower from django.forms import modelformset_factory from django.http import Http404 @@ -2464,35 +2465,64 @@ def improve_packages_from_purldb_view(request, dataspace, name, version=""): @login_required def vulnerability_analysis_form_view(request, product_uuid, vulnerability_id, package_uuid): user = request.user + dataspace = user.dataspace form_class = VulnerabilityAnalysisForm perms = "change_product" - qs = Product.objects.get_queryset(user, perms=perms) - product = get_object_or_404(qs, uuid=product_uuid) - vulnerability_qs = Vulnerability.objects.scope(user.dataspace) + product_qs = Product.objects.get_queryset(user, perms=perms) + product = get_object_or_404(product_qs, uuid=product_uuid) + vulnerability_qs = Vulnerability.objects.scope(dataspace) vulnerability = get_object_or_404(vulnerability_qs, vulnerability_id=vulnerability_id) product_package_qs = ProductPackage.objects.product_secured(user, perms=perms) product_package = get_object_or_404( product_package_qs, product=product, package__uuid=package_uuid ) + vulnerability_analysis_qs = VulnerabilityAnalysis.objects.scope(dataspace) - try: - vulnerability_analysis = VulnerabilityAnalysis.objects.scope(user.dataspace).get( - product_package=product_package, - vulnerability=vulnerability, + # Fetch the existing Analysis values for each affected products + product_analysis = vulnerability_analysis_qs.filter( + product=OuterRef("pk"), + package=OuterRef("packages__pk"), + vulnerability=OuterRef("packages__affected_by_vulnerabilities__pk"), + ) + affected_products = ( + product_qs.exclude(pk=product.pk) + .filter( + packages__uuid=package_uuid, + packages__affected_by_vulnerabilities=vulnerability, + ) + .annotate( + analysis_state=Subquery(product_analysis.values("state")[:1]), + analysis_justification=Subquery(product_analysis.values("justification")[:1]), + analysis_responses=Subquery(product_analysis.values("responses")[:1]), + analysis_detail=Subquery(product_analysis.values("detail")[:1]), ) - except ObjectDoesNotExist: - vulnerability_analysis = None # Addition + ) + + vulnerability_analysis = vulnerability_analysis_qs.get_or_none( + product_package=product_package, + vulnerability=vulnerability, + ) if request.method == "POST": - form = form_class(user, instance=vulnerability_analysis, data=request.POST) + form = form_class( + user, + instance=vulnerability_analysis, + data=request.POST, + affected_products=affected_products, + ) if form.is_valid(): form.save() messages.success(request, "Vulnerability analysis successfully updated.") return JsonResponse({"success": "updated"}, status=200) else: initial = {"product_package": product_package, "vulnerability": vulnerability} - form = form_class(user, instance=vulnerability_analysis, initial=initial) + form = form_class( + user, + instance=vulnerability_analysis, + initial=initial, + affected_products=affected_products, + ) rendered_form = render_crispy_form(form, context=csrf(request)) diff --git a/vulnerabilities/forms.py b/vulnerabilities/forms.py index 807e3277..0fa8c602 100644 --- a/vulnerabilities/forms.py +++ b/vulnerabilities/forms.py @@ -10,8 +10,12 @@ from django.core.exceptions import ValidationError from crispy_forms.helper import FormHelper +from crispy_forms.layout import Field +from crispy_forms.layout import Fieldset +from crispy_forms.layout import Layout from dje.forms import DataspacedModelForm +from dje.forms import Group from product_portfolio.models import ProductPackage from vulnerabilities.models import VulnerabilityAnalysis @@ -22,6 +26,15 @@ class VulnerabilityAnalysisForm(DataspacedModelForm): widget=forms.CheckboxSelectMultiple, required=False, ) + propagate_to_products = forms.MultipleChoiceField( + label="Propagate analysis to:", + widget=forms.CheckboxSelectMultiple, + required=False, + help_text=( + "The listed products share the same vulnerable package. " + "The analysis values will be applied to all selected products." + ), + ) class Meta: model = VulnerabilityAnalysis @@ -32,16 +45,26 @@ class Meta: "justification", "responses", "detail", + "propagate_to_products", ] widgets = { "product_package": forms.widgets.HiddenInput, "vulnerability": forms.widgets.HiddenInput, - "detail": forms.Textarea(attrs={"rows": 3}), + "detail": forms.Textarea(attrs={"rows": 2}), } def __init__(self, user, *args, **kwargs): + affected_products = kwargs.pop("affected_products", []) super().__init__(user, *args, **kwargs) + propagate_to_field = self.fields["propagate_to_products"] + # Note: the whole `product` object is set as the label to be fully used in the + # template rendering. + propagate_to_products_choices = [(product.uuid, product) for product in affected_products] + propagate_to_field.choices = propagate_to_products_choices + if not propagate_to_products_choices: + propagate_to_field.widget = forms.widgets.HiddenInput() + responses_model_field = self._meta.model._meta.get_field("responses") self.fields["responses"].help_text = responses_model_field.help_text @@ -53,12 +76,34 @@ def __init__(self, user, *args, **kwargs): def helper(self): helper = FormHelper() helper.form_method = "post" - helper.form_id = "product-vulnerability-analysis-form" helper.form_tag = False helper.modal_title = "Vulnerability analysis" helper.modal_id = "vulnerability-analysis-modal" + helper.layout = Layout( + Fieldset( + "", + "product_package", + "vulnerability", + Group("state", "justification"), + "responses", + "detail", + Field( + "propagate_to_products", + template="vulnerabilities/forms/widgets/propagate_to_table.html", + ), + ), + ) return helper + def save(self, *args, **kwargs): + instance = super().save(*args, **kwargs) + + if products := self.cleaned_data.get("propagate_to_products"): + for product_uuid in products: + instance.propagate(product_uuid, self.user) + + return instance + def clean(self): main_fields = ["state", "justification", "responses", "detail"] if not any(self.cleaned_data.get(field_name) for field_name in main_fields): diff --git a/vulnerabilities/migrations/0004_vulnerabilityanalysis_indexes.py b/vulnerabilities/migrations/0004_vulnerabilityanalysis_indexes.py new file mode 100644 index 00000000..3cbb6864 --- /dev/null +++ b/vulnerabilities/migrations/0004_vulnerabilityanalysis_indexes.py @@ -0,0 +1,26 @@ +# Generated by Django 5.0.9 on 2024-12-04 05:20 + +from django.conf import settings +from django.db import migrations, models + + +class Migration(migrations.Migration): + + dependencies = [ + ('component_catalog', '0010_component_risk_score_package_risk_score'), + ('dje', '0004_dataspace_vulnerabilities_updated_at'), + ('product_portfolio', '0008_productdependency_is_resolved_to_is_pinned'), + ('vulnerabilities', '0003_vulnerabilityanalysis'), + migrations.swappable_dependency(settings.AUTH_USER_MODEL), + ] + + operations = [ + migrations.AddIndex( + model_name='vulnerabilityanalysis', + index=models.Index(fields=['state'], name='vulnerabili_state_12e7bb_idx'), + ), + migrations.AddIndex( + model_name='vulnerabilityanalysis', + index=models.Index(fields=['justification'], name='vulnerabili_justifi_219dc2_idx'), + ), + ] diff --git a/vulnerabilities/models.py b/vulnerabilities/models.py index c3a123da..c2439e26 100644 --- a/vulnerabilities/models.py +++ b/vulnerabilities/models.py @@ -505,6 +505,10 @@ class VulnerabilityAnalysis( class Meta: unique_together = (("product_package", "vulnerability"), ("dataspace", "uuid")) + indexes = [ + models.Index(fields=["state"]), + models.Index(fields=["justification"]), + ] def __str__(self): return f"{self.vulnerability} analysis" @@ -514,3 +518,49 @@ def save(self, *args, **kwargs): self.product_id = self.product_package.product_id self.package_id = self.product_package.package_id super().save(*args, **kwargs) + + def propagate(self, product_uuid, user): + """Propagate this Analysis to another Product.""" + from product_portfolio.models import ProductPackage + + # Get the equivalent ProductPackage in the target product. + product_package_qs = ProductPackage.objects.product_secured(user, perms="change_product") + try: + product_package = product_package_qs.get( + product__uuid=product_uuid, + package=self.package, + dataspace=self.dataspace, + ) + except models.ObjectDoesNotExist: + return + + target_analysis_base_data = { + "product_package": product_package, + "vulnerability": self.vulnerability, + "dataspace": self.dataspace, + } + + existing_analysis = VulnerabilityAnalysis.objects.filter(**target_analysis_base_data) + if existing_analysis: # Update + target_analysis = existing_analysis[0] + target_analysis.last_modified_by = user + else: # New + target_analysis = VulnerabilityAnalysis( + **target_analysis_base_data, + created_by=user, + last_modified_by=user, + ) + + fields_to_clone = [ + "state", + "justification", + "responses", + "detail", + ] + for field_name in fields_to_clone: + field_value = getattr(self, field_name, None) + if field_value is not None: + setattr(target_analysis, field_name, field_value) + + target_analysis.save() + return target_analysis diff --git a/vulnerabilities/templates/vulnerabilities/forms/widgets/propagate_to_table.html b/vulnerabilities/templates/vulnerabilities/forms/widgets/propagate_to_table.html new file mode 100644 index 00000000..34e8d99f --- /dev/null +++ b/vulnerabilities/templates/vulnerabilities/forms/widgets/propagate_to_table.html @@ -0,0 +1,72 @@ +{% load crispy_forms_filters %} +{% load l10n %} + +{% if field.is_hidden %} + {{ field }} +{% else %} +
+
+ {% if field.label %} + + {{ field.label }}{% if field.field.required %}*{% endif %} + + {% endif %} + +
+ + + + + + + + + {% for group, options, index in field|optgroups %} + {% for option in options %} + {% with product=option.label %} + + + + + + + + {% endwith %} + {% endfor %} + {% endfor %} +
+ + ProductStateJustificationResponse
+ {{ product }} + {% if field.errors and forloop.last and not inline_class and forloop.parentloop.last %} + {% include 'bootstrap5/layout/field_errors_block.html' %} + {% endif %} + + {% if product.analysis_state %} + {{ product.analysis_state }} + {% endif %} + {% if product.analysis_detail %} + + + + {% endif %} + + {{ product.analysis_justification|default_if_none:"" }} + + {% if product.analysis_responses %} +
    + {% for response in product.analysis_responses %} +
  • {{ response }}
    • + {% endfor %} +
+ {% endif %} +
+
+ {% if field.errors and inline_class %} + {% for error in field.errors %} +

{{ error }}

+ {% endfor %} + {% endif %} + {% include 'bootstrap5/layout/help_text.html' %} +
+{% endif %} \ No newline at end of file diff --git a/vulnerabilities/tests/test_forms.py b/vulnerabilities/tests/test_forms.py index 852aca86..31bd71d6 100644 --- a/vulnerabilities/tests/test_forms.py +++ b/vulnerabilities/tests/test_forms.py @@ -48,3 +48,36 @@ def test_vulnerability_forms_vulnerability_analysis_save(self): self.assertEqual(product_package1.product, analysis.product) self.assertEqual(product_package1.package, analysis.package) self.assertEqual(data["detail"], analysis.detail) + + def test_vulnerability_forms_vulnerability_analysis_propagate_to_products(self): + product_package1 = make_product_package(make_product(self.dataspace)) + vulnerability1 = make_vulnerability( + dataspace=self.dataspace, affecting=[product_package1.package] + ) + product2 = make_product(self.dataspace) + + data = { + "product_package": product_package1, + "vulnerability": vulnerability1, + "detail": "Analysis detail", + "propagate_to_products": [str(product2.uuid)], + } + + form = VulnerabilityAnalysisForm(user=self.super_user, data=data) + self.assertEqual([], form.fields["propagate_to_products"].choices) + self.assertFalse(form.is_valid()) + msg = f"Select a valid choice. {product2.uuid} is not one of the available choices." + self.assertEqual({"propagate_to_products": [msg]}, form.errors) + + new_product_package = make_product_package(product2, package=product_package1.package) + form = VulnerabilityAnalysisForm( + user=self.super_user, data=data, affected_products=[product2] + ) + self.assertEqual([(product2.uuid, product2)], form.fields["propagate_to_products"].choices) + self.assertTrue(form.is_valid()) + analysis = form.save() + new_analysis = new_product_package.vulnerability_analyses.get() + self.assertEqual(vulnerability1, new_analysis.vulnerability) + self.assertEqual(product2, new_analysis.product) + self.assertEqual(new_product_package.package, new_analysis.package) + self.assertEqual(data["detail"], analysis.detail) diff --git a/vulnerabilities/tests/test_models.py b/vulnerabilities/tests/test_models.py index aa52e1ca..ae290801 100644 --- a/vulnerabilities/tests/test_models.py +++ b/vulnerabilities/tests/test_models.py @@ -17,6 +17,7 @@ from component_catalog.tests import make_package from dejacode_toolkit.vulnerablecode import VulnerableCode from dje.models import Dataspace +from dje.tests import create_superuser from product_portfolio.tests import make_product from product_portfolio.tests import make_product_package from vulnerabilities.models import Vulnerability @@ -29,6 +30,7 @@ class VulnerabilitiesModelsTestCase(TestCase): def setUp(self): self.dataspace = Dataspace.objects.create(name="nexB") + self.super_user = create_superuser("super_user", self.dataspace) @mock.patch("dejacode_toolkit.vulnerablecode.VulnerableCode.request_get") def test_vulnerability_mixin_get_entry_for_package(self, mock_request_get): @@ -257,3 +259,43 @@ def test_vulnerability_model_vulnerability_analysis_save(self): self.assertEqual(product_package1.product, analysis.product) self.assertEqual(product_package1.package, analysis.package) self.assertEqual(VulnerabilityAnalysis.State.RESOLVED, analysis.state) + + def test_vulnerability_model_vulnerability_propagate(self): + vulnerability1 = make_vulnerability(dataspace=self.dataspace) + product_package1 = make_product_package(make_product(self.dataspace)) + analysis = VulnerabilityAnalysis.objects.create( + product_package=product_package1, + vulnerability=vulnerability1, + dataspace=self.dataspace, + state=VulnerabilityAnalysis.State.RESOLVED, + justification=VulnerabilityAnalysis.Justification.CODE_NOT_PRESENT, + responses=[ + VulnerabilityAnalysis.Response.CAN_NOT_FIX, + VulnerabilityAnalysis.Response.ROLLBACK, + ], + detail="detail", + ) + + product2 = make_product(self.dataspace) + new_analysis = analysis.propagate(product2.uuid, self.super_user) + self.assertIsNone(new_analysis) + + new_product_package = make_product_package(product2, package=product_package1.package) + new_analysis = analysis.propagate(product2.uuid, self.super_user) + self.assertIsNotNone(new_analysis) + self.assertNotEqual(analysis.pk, new_analysis.pk) + self.assertEqual(vulnerability1, new_analysis.vulnerability) + self.assertEqual(new_product_package, new_analysis.product_package) + self.assertEqual(product2, new_analysis.product) + self.assertEqual(new_product_package.package, new_analysis.package) + self.assertEqual(self.super_user, new_analysis.created_by) + self.assertEqual(self.super_user, new_analysis.last_modified_by) + self.assertEqual(analysis.state, new_analysis.state) + self.assertEqual(analysis.justification, new_analysis.justification) + self.assertEqual(analysis.detail, new_analysis.detail) + self.assertEqual(analysis.responses, new_analysis.responses) + + # Update + analysis.update(state=VulnerabilityAnalysis.State.EXPLOITABLE) + new_analysis = analysis.propagate(product2.uuid, self.super_user) + self.assertEqual(VulnerabilityAnalysis.State.EXPLOITABLE, new_analysis.state)