Skip to content

Commit 1a0744d

Browse files
pombredannepombredanne
committed
Merge branch 'deps-only' into vulntotal-clean
2 parents 536dd91 + 3235316 commit 1a0744d

File tree

10 files changed

+1084
-0
lines changed

10 files changed

+1084
-0
lines changed

‎vulntotal/datasources/deps.py‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
#
2+
# Copyright (c) nexB Inc. and others. All rights reserved.
3+
# http://nexb.com and https://github.com/nexB/vulnerablecode/
4+
# The VulnTotal software is licensed under the Apache License version 2.0.
5+
# Data generated with VulnTotal require an acknowledgment.
6+
#
7+
# You may not use this software except in compliance with the License.
8+
# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
9+
# Unless required by applicable law or agreed to in writing, software distributed
10+
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
11+
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
12+
# specific language governing permissions and limitations under the License.
13+
#
14+
# When you publish or redistribute any data created with VulnTotal or any VulnTotal
15+
# derivative work, you must accompany this data with the following acknowledgment:
16+
#
17+
# Generated with VulnTotal and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
18+
# OR CONDITIONS OF ANY KIND, either express or implied. No content created from
19+
# VulnTotal should be considered or used as legal advice. Consult an Attorney
20+
# for any legal advice.
21+
# VulnTotal is a free software tool from nexB Inc. and others.
22+
# Visit https://github.com/nexB/vulnerablecode/ for support and download.
23+
24+
import json
25+
import logging
26+
from typing import Iterable
27+
from urllib.parse import quote
28+
29+
import requests
30+
from packageurl import PackageURL
31+
32+
from vulntotal.validator import DataSource
33+
from vulntotal.validator import VendorData
34+
35+
logger = logging.getLogger(__name__)
36+
37+
38+
class DepsDataSource(DataSource):
39+
spdx_license_expression = "TODO"
40+
license_url = "TODO"
41+
42+
def fetch_json_response(self, url):
43+
response = requests.get(url)
44+
if not response.status_code == 200 or response.text == "Not Found":
45+
logger.error(f"Error while fetching {url}")
46+
return
47+
return response.json()
48+
49+
def datasource_advisory(self, purl) -> Iterable[VendorData]:
50+
payload = generate_meta_payload(purl)
51+
response = self.fetch_json_response(payload)
52+
if response:
53+
advisories = parse_advisories_from_meta(response)
54+
if advisories:
55+
for advisory in advisories:
56+
advisory_payload = generate_advisory_payload(advisory)
57+
fetched_advisory = self.fetch_json_response(advisory_payload)
58+
self._raw_dump.append(fetched_advisory)
59+
if fetched_advisory:
60+
return parse_advisory(fetched_advisory)
61+
62+
@classmethod
63+
def supported_ecosystem(cls):
64+
return {
65+
"npm": "npm",
66+
"maven": "maven",
67+
"golang": "go",
68+
"pypi": "pypi",
69+
"cargo": "cargo",
70+
# Coming soon
71+
# "nuget": "nuget",
72+
}
73+
74+
75+
def parse_advisory(advisory) -> Iterable[VendorData]:
76+
affected_versions = [event["version"] for event in advisory["packages"][0]["versionsAffected"]]
77+
fixed_versions = [event["version"] for event in advisory["packages"][0]["versionsUnaffected"]]
78+
yield VendorData(
79+
aliases=sorted(list(set(advisory["aliases"]))),
80+
affected_versions=sorted(list(set(affected_versions))),
81+
fixed_versions=sorted(list(set(fixed_versions))),
82+
)
83+
84+
85+
def parse_advisories_from_meta(advisories_metadata):
86+
advisories = []
87+
if "dependencies" in advisories_metadata and advisories_metadata["dependencies"]:
88+
for dependency in advisories_metadata["dependencies"]:
89+
if dependency["advisories"]:
90+
advisories.extend(dependency["advisories"])
91+
return advisories
92+
93+
94+
def generate_advisory_payload(advisory_meta):
95+
url_advisory = "https://deps.dev/_/advisory/{source}/{sourceID}"
96+
return url_advisory.format(source=advisory_meta["source"], sourceID=advisory_meta["sourceID"])
97+
98+
99+
def generate_meta_payload(purl):
100+
url_advisories_meta = "https://deps.dev/_/s/{ecosystem}/p/{package}/v/{version}/dependencies"
101+
supported_ecosystem = DepsDataSource.supported_ecosystem()
102+
if purl.type in supported_ecosystem:
103+
purl_version = purl.version
104+
purl_name = purl.name
105+
106+
if purl.type == "maven":
107+
if not purl.namespace:
108+
logger.error(f"Invalid Maven PURL {str(purl)}")
109+
return
110+
purl_name = quote(f"{purl.namespace}:{purl.name}", safe="")
111+
112+
elif purl.type == "golang":
113+
if purl.namespace:
114+
purl_name = quote(f"{purl.namespace}/{purl.name}", safe="")
115+
if not purl_version.startswith("v"):
116+
purl_version = f"v{purl_version}"
117+
118+
return url_advisories_meta.format(
119+
ecosystem=supported_ecosystem[purl.type],
120+
package=purl_name,
121+
version=purl_version,
122+
)

‎vulntotal/tests/test_data/deps/advisories_metadata.json‎

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+
[
2+
{
3+
"source": "GHSA",
4+
"sourceID": "GHSA-g3rq-g295-4j3m",
5+
"sourceURL": "https://github.com/advisories/GHSA-g3rq-g295-4j3m",
6+
"title": "Regular Expression Denial of Service (ReDoS) in Jinja2",
7+
"description": "This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDOS vulnerability of the regex is mainly due to the sub-pattern [a-zA-Z0-9._-]+.[a-zA-Z0-9._-]+ This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.",
8+
"referenceURLs": [
9+
"https://nvd.nist.gov/vuln/detail/CVE-2020-28493",
10+
"https://github.com/pallets/jinja/pull/1343",
11+
"https://github.com/pallets/jinja/blob/ab81fd9c277900c85da0c322a2ff9d68a235b2e6/src/jinja2/utils.py%23L20",
12+
"https://snyk.io/vuln/SNYK-PYTHON-JINJA2-1012994",
13+
"https://lists.fedoraproject.org/archives/list/[email protected]/message/PVAKCOO7VBVUBM3Q6CBBTPBFNP5NDXF4/",
14+
"https://security.gentoo.org/glsa/202107-19",
15+
"https://github.com/advisories/GHSA-g3rq-g295-4j3m"
16+
],
17+
"severity": "MEDIUM",
18+
"gitHubSeverity": "MODERATE",
19+
"scoreV3": 5.3,
20+
"aliases": [
21+
"CVE-2020-28493"
22+
],
23+
"disclosedAt": 1616189285,
24+
"observedAt": 1650328213
25+
},
26+
{
27+
"source": "OSV",
28+
"sourceID": "PYSEC-2014-8",
29+
"sourceURL": "https://osv.dev/vulnerability/PYSEC-2014-8",
30+
"title": "PYSEC-2014-8",
31+
"description": "The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.",
32+
"referenceURLs": [
33+
"http://advisories.mageia.org/MGASA-2014-0028.html",
34+
"http://jinja.pocoo.org/docs/changelog/",
35+
"http://openwall.com/lists/oss-security/2014/01/10/2",
36+
"http://openwall.com/lists/oss-security/2014/01/10/3",
37+
"http://rhn.redhat.com/errata/RHSA-2014-0747.html",
38+
"http://rhn.redhat.com/errata/RHSA-2014-0748.html",
39+
"http://secunia.com/advisories/56287",
40+
"http://secunia.com/advisories/58783",
41+
"http://secunia.com/advisories/58918",
42+
"http://secunia.com/advisories/59017",
43+
"http://secunia.com/advisories/60738",
44+
"http://secunia.com/advisories/60770",
45+
"http://www.gentoo.org/security/en/glsa/glsa-201408-13.xml",
46+
"http://www.mandriva.com/security/advisories?name=MDVSA-2014:096",
47+
"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734747",
48+
"https://bugzilla.redhat.com/show_bug.cgi?id=1051421",
49+
"https://github.com/pypa/advisory-database/blob/main/vulns/jinja2/PYSEC-2014-8.yaml",
50+
"https://oss.oracle.com/pipermail/el-errata/2014-June/004192.html"
51+
],
52+
"severity": "UNKNOWN",
53+
"gitHubSeverity": "UNKNOWN",
54+
"aliases": [
55+
"CVE-2014-1402"
56+
],
57+
"disclosedAt": 1400511300,
58+
"observedAt": 1645597812
59+
},
60+
{
61+
"source": "OSV",
62+
"sourceID": "PYSEC-2014-82",
63+
"sourceURL": "https://osv.dev/vulnerability/PYSEC-2014-82",
64+
"title": "PYSEC-2014-82",
65+
"description": "FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.",
66+
"referenceURLs": [
67+
"http://seclists.org/oss-sec/2014/q1/73",
68+
"http://secunia.com/advisories/56328",
69+
"http://secunia.com/advisories/60738",
70+
"http://www.gentoo.org/security/en/glsa/glsa-201408-13.xml",
71+
"https://bugzilla.redhat.com/show_bug.cgi?id=1051421",
72+
"https://github.com/mitsuhiko/jinja2",
73+
"https://github.com/mitsuhiko/jinja2/commit/acb672b6a179567632e032f547582f30fa2f4aa7",
74+
"https://github.com/mitsuhiko/jinja2/pull/292",
75+
"https://github.com/mitsuhiko/jinja2/pull/296",
76+
"https://github.com/pypa/advisory-database/blob/main/vulns/jinja2/PYSEC-2014-82.yaml"
77+
],
78+
"severity": "UNKNOWN",
79+
"gitHubSeverity": "UNKNOWN",
80+
"aliases": [
81+
"CVE-2014-0012"
82+
],
83+
"disclosedAt": 1400511300,
84+
"observedAt": 1645597812
85+
},
86+
{
87+
"source": "OSV",
88+
"sourceID": "PYSEC-2019-217",
89+
"sourceURL": "https://osv.dev/vulnerability/PYSEC-2019-217",
90+
"title": "PYSEC-2019-217",
91+
"description": "In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.",
92+
"referenceURLs": [
93+
"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html",
94+
"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html",
95+
"https://access.redhat.com/errata/RHSA-2019:1152",
96+
"https://access.redhat.com/errata/RHSA-2019:1237",
97+
"https://access.redhat.com/errata/RHSA-2019:1329",
98+
"https://github.com/advisories/GHSA-462w-v97r-4m45",
99+
"https://github.com/pypa/advisory-database/blob/main/vulns/jinja2/PYSEC-2019-217.yaml",
100+
"https://lists.apache.org/thread.html/09fc842ff444cd43d9d4c510756fec625ef8eb1175f14fd21de2605f@%3Cdevnull.infra.apache.org%3E",
101+
"https://lists.apache.org/thread.html/2b52b9c8b9d6366a4f1b407a8bde6af28d9fc73fdb3b37695fd0d9ac@%3Cdevnull.infra.apache.org%3E",
102+
"https://lists.apache.org/thread.html/320441dccbd9a545320f5f07306d711d4bbd31ba43dc9eebcfc602df@%3Cdevnull.infra.apache.org%3E",
103+
"https://lists.apache.org/thread.html/46c055e173b52d599c648a98199972dbd6a89d2b4c4647b0500f2284@%3Cdevnull.infra.apache.org%3E",
104+
"https://lists.apache.org/thread.html/57673a78c4d5c870d3f21465c7e2946b9f8285c7c57e54c2ae552f02@%3Ccommits.airflow.apache.org%3E",
105+
"https://lists.apache.org/thread.html/7f39f01392d320dfb48e4901db68daeece62fd60ef20955966739993@%3Ccommits.airflow.apache.org%3E",
106+
"https://lists.apache.org/thread.html/b2380d147b508bbcb90d2cad443c159e63e12555966ab4f320ee22da@%3Ccommits.airflow.apache.org%3E",
107+
"https://lists.apache.org/thread.html/f0c4a03418bcfe70c539c5dbaf99c04c98da13bfa1d3266f08564316@%3Ccommits.airflow.apache.org%3E",
108+
"https://lists.fedoraproject.org/archives/list/[email protected]/message/DSW3QZMFVVR7YE3UT4YRQA272TYAL5AF/",
109+
"https://lists.fedoraproject.org/archives/list/[email protected]/message/QCDYIS254EJMBNWOG4S5QY6AOTOR4TZU/",
110+
"https://lists.fedoraproject.org/archives/list/[email protected]/message/TS7IVZAJBWOHNRDMFJDIZVFCMRP6YIUQ/",
111+
"https://palletsprojects.com/blog/jinja-2-10-1-released",
112+
"https://usn.ubuntu.com/4011-1/",
113+
"https://usn.ubuntu.com/4011-2/"
114+
],
115+
"severity": "UNKNOWN",
116+
"gitHubSeverity": "UNKNOWN",
117+
"aliases": [
118+
"CVE-2019-10906",
119+
"GHSA-462w-v97r-4m45"
120+
],
121+
"disclosedAt": 1554596940,
122+
"observedAt": 1645597812
123+
},
124+
{
125+
"source": "OSV",
126+
"sourceID": "PYSEC-2019-220",
127+
"sourceURL": "https://osv.dev/vulnerability/PYSEC-2019-220",
128+
"title": "PYSEC-2019-220",
129+
"description": "In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.",
130+
"referenceURLs": [
131+
"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html",
132+
"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html",
133+
"https://access.redhat.com/errata/RHSA-2019:1022",
134+
"https://access.redhat.com/errata/RHSA-2019:1237",
135+
"https://access.redhat.com/errata/RHSA-2019:1260",
136+
"https://access.redhat.com/errata/RHSA-2019:3964",
137+
"https://access.redhat.com/errata/RHSA-2019:4062",
138+
"https://github.com/advisories/GHSA-hj2j-77xm-mc5v",
139+
"https://github.com/pallets/jinja",
140+
"https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16",
141+
"https://github.com/pypa/advisory-database/blob/main/vulns/jinja2/PYSEC-2019-220.yaml",
142+
"https://palletsprojects.com/blog/jinja-281-released/",
143+
"https://usn.ubuntu.com/4011-1/",
144+
"https://usn.ubuntu.com/4011-2/"
145+
],
146+
"severity": "UNKNOWN",
147+
"gitHubSeverity": "UNKNOWN",
148+
"aliases": [
149+
"CVE-2016-10745",
150+
"GHSA-hj2j-77xm-mc5v"
151+
],
152+
"disclosedAt": 1554730140,
153+
"observedAt": 1645597812
154+
},
155+
{
156+
"source": "OSV",
157+
"sourceID": "PYSEC-2021-66",
158+
"sourceURL": "https://osv.dev/vulnerability/PYSEC-2021-66",
159+
"title": "PYSEC-2021-66",
160+
"description": "This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.",
161+
"referenceURLs": [
162+
"https://github.com/advisories/GHSA-g3rq-g295-4j3m",
163+
"https://github.com/pallets/jinja/blob/ab81fd9c277900c85da0c322a2ff9d68a235b2e6/src/jinja2/utils.py%23L20",
164+
"https://github.com/pallets/jinja/pull/1343",
165+
"https://github.com/pypa/advisory-database/blob/main/vulns/jinja2/PYSEC-2021-66.yaml",
166+
"https://lists.fedoraproject.org/archives/list/[email protected]/message/PVAKCOO7VBVUBM3Q6CBBTPBFNP5NDXF4/",
167+
"https://snyk.io/vuln/SNYK-PYTHON-JINJA2-1012994"
168+
],
169+
"severity": "UNKNOWN",
170+
"gitHubSeverity": "UNKNOWN",
171+
"aliases": [
172+
"CVE-2020-28493",
173+
"SNYK-PYTHON-JINJA2-1012994",
174+
"GHSA-g3rq-g295-4j3m"
175+
],
176+
"disclosedAt": 1612210500,
177+
"observedAt": 1645597812
178+
}
179+
]

0 commit comments

Comments
 (0)