|
| 1 | +# |
| 2 | +# Copyright (c) nexB Inc. and others. All rights reserved. |
| 3 | +# VulnerableCode is a trademark of nexB Inc. |
| 4 | +# SPDX-License-Identifier: Apache-2.0 |
| 5 | +# See http://www.apache.org/licenses/LICENSE-2.0 for the license text. |
| 6 | +# See https://github.com/nexB/vulnerablecode for support or download. |
| 7 | +# See https://aboutcode.org for more information about nexB OSS projects. |
| 8 | +# |
| 9 | +import re |
| 10 | +from pathlib import Path |
| 11 | +from typing import Iterable |
| 12 | + |
| 13 | +from vulnerabilities.importer import AdvisoryData |
| 14 | +from vulnerabilities.importer import GitImporter |
| 15 | +from vulnerabilities.importer import Reference |
| 16 | +from vulnerabilities.utils import build_description |
| 17 | +from vulnerabilities.utils import dedupe |
| 18 | + |
| 19 | + |
| 20 | +class FireyeImporter(GitImporter): |
| 21 | + spdx_license_expression = "CC-BY-SA-4.0 AND MIT" |
| 22 | + license_url = "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/README.md" |
| 23 | + |
| 24 | + def __init__(self): |
| 25 | + super().__init__(repo_url="git+https://github.com/mandiant/Vulnerability-Disclosures") |
| 26 | + |
| 27 | + def advisory_data(self) -> Iterable[AdvisoryData]: |
| 28 | + self.clone() |
| 29 | + files = filter( |
| 30 | + lambda p: p.suffix in [".md", ".MD"], Path(self.vcs_response.dest_dir).glob("**/*") |
| 31 | + ) |
| 32 | + for file in files: |
| 33 | + if Path(file).stem == "README": |
| 34 | + continue |
| 35 | + with open(file, encoding="ISO-8859-1") as f: |
| 36 | + yield parse_advisory_data(f.read()) |
| 37 | + |
| 38 | + |
| 39 | +def parse_advisory_data(raw_data) -> AdvisoryData: |
| 40 | + """ |
| 41 | + Parse a fireeye advisory repo and return an AdvisoryData or None. |
| 42 | + These files are in Markdown format. |
| 43 | + """ |
| 44 | + raw_data = raw_data.replace("\n\n", "\n") |
| 45 | + md_list = raw_data.split("\n") |
| 46 | + md_dict = md_list_to_dict(md_list) |
| 47 | + |
| 48 | + database_id = md_list[0][1::] |
| 49 | + summary = md_dict.get(database_id[1::]) or [] |
| 50 | + description = md_dict.get("## Description") or [] |
| 51 | + impact = md_dict.get("## Impact") # not used but can be used to get severity |
| 52 | + exploit_ability = md_dict.get("## Exploitability") # not used |
| 53 | + cve_ref = md_dict.get("## CVE Reference") or [] |
| 54 | + tech_details = md_dict.get("## Technical Details") # not used |
| 55 | + resolution = md_dict.get("## Resolution") # not used |
| 56 | + disc_credits = md_dict.get("## Discovery Credits") # not used |
| 57 | + disc_timeline = md_dict.get("## Disclosure Timeline") # not used |
| 58 | + references = md_dict.get("## References") or [] |
| 59 | + |
| 60 | + return AdvisoryData( |
| 61 | + aliases=get_aliases(database_id, cve_ref), |
| 62 | + summary=build_description(" ".join(summary), " ".join(description)), |
| 63 | + references=get_references(references), |
| 64 | + ) |
| 65 | + |
| 66 | + |
| 67 | +def get_references(references): |
| 68 | + """ |
| 69 | + Return a list of Reference from a list of URL reference in md format |
| 70 | + >>> get_references(["- http://1-4a.com/cgi-bin/alienform/af.cgi"]) |
| 71 | + [Reference(reference_id='', url='http://1-4a.com/cgi-bin/alienform/af.cgi', severities=[])] |
| 72 | + >>> get_references(["- [Mitre CVE-2021-42712](https://www.cve.org/CVERecord?id=CVE-2021-42712)"]) |
| 73 | + [Reference(reference_id='', url='https://www.cve.org/CVERecord?id=CVE-2021-42712', severities=[])] |
| 74 | + """ |
| 75 | + urls = [] |
| 76 | + for ref in references: |
| 77 | + if ref.startswith("- "): |
| 78 | + urls.append(matcher_url(ref[2::])) |
| 79 | + else: |
| 80 | + urls.append(matcher_url(ref)) |
| 81 | + |
| 82 | + return [Reference(url=url) for url in urls if url] |
| 83 | + |
| 84 | + |
| 85 | +def matcher_url(ref) -> str: |
| 86 | + """ |
| 87 | + Returns URL of the reference markup from reference url in Markdown format |
| 88 | + """ |
| 89 | + markup_regex = "\[([^\[]+)]\(\s*(http[s]?://.+)\s*\)" |
| 90 | + matched_markup = re.findall(markup_regex, ref) |
| 91 | + if matched_markup: |
| 92 | + return matched_markup[0][1] |
| 93 | + else: |
| 94 | + return ref |
| 95 | + |
| 96 | + |
| 97 | +def get_aliases(database_id, cve_ref) -> []: |
| 98 | + """ |
| 99 | + Returns a List of Aliases from a database_id and a list of CVEs |
| 100 | + >>> get_aliases("MNDT-2021-0012",["CVE-2021-44207"]) |
| 101 | + ['CVE-2021-44207', 'MNDT-2021-0012'] |
| 102 | + """ |
| 103 | + cve_ref.append(database_id) |
| 104 | + return dedupe(cve_ref) |
| 105 | + |
| 106 | + |
| 107 | +def md_list_to_dict(md_list): |
| 108 | + """ |
| 109 | + Returns a dictionary of md_list from a list of a md file splited by \n |
| 110 | + >>> md_list_to_dict(["# Header","hello" , "hello again" ,"# Header2"]) |
| 111 | + {'# Header': ['hello', 'hello again'], '# Header2': []} |
| 112 | + """ |
| 113 | + md_dict = {} |
| 114 | + md_key = "" |
| 115 | + for md_line in md_list: |
| 116 | + if md_line.startswith("#"): |
| 117 | + md_dict[md_line] = [] |
| 118 | + md_key = md_line |
| 119 | + else: |
| 120 | + md_dict[md_key].append(md_line) |
| 121 | + return md_dict |
0 commit comments