Update hsec-tools to support textual CWE

Author: TristanCacqueray

code/hsec-tools/cabal.project

@@ -1,5 +1,5 @@
 tested-with: GHC==9.2.5
 
-packages: *.cabal
+packages: *.cabal ../cwe/cwe.cabal
 
 package hsec-tools

code/hsec-tools/hsec-tools.cabal

@@ -50,8 +50,9 @@ library
                       aeson >= 2.0.1.0 && < 3,
                       pandoc-types >= 1.22 && < 2,
                       parsec >= 3 && < 4,
-                      commonmark-pandoc >= 0.2 && < 0.3
-                      , safe >= 0.3
+                      commonmark-pandoc >= 0.2 && < 0.3,
+                      safe >= 0.3,
+                      cwe >= 0.1 && < 2,
     hs-source-dirs:   src
     default-language: Haskell2010
     ghc-options:      -Wall

code/hsec-tools/src/Security/Advisories/Definition.hs

@@ -12,6 +12,7 @@ module Security.Advisories.Definition
   )
   where
 
+import CWE (CWEID)
 import Data.Text (Text)
 import Data.Time (ZonedTime)
 import Distribution.Types.VersionRange (VersionRange)
@@ -25,7 +26,7 @@ data Advisory = Advisory
   { advisoryId :: HsecId
   , advisoryModified :: ZonedTime
   , advisoryPublished :: ZonedTime
-  , advisoryCWEs :: [CWE]
+  , advisoryCWEs :: [CWEID]
   , advisoryKeywords :: [Keyword]
   , advisoryAliases :: [Text]
   , advisoryRelated :: [Text]

code/hsec-tools/src/Security/Advisories/Parse.hs

@@ -17,6 +17,7 @@ module Security.Advisories.Parse
   )
   where
 
+import qualified CWE
 import Control.Monad ((>=>))
 import Data.Bifunctor (first)
 import Data.Foldable (toList)
@@ -172,7 +173,7 @@ parseAdvisoryTable oob policy table doc summary details html = runTableParser $
 
   cats <-
     fromMaybe []
-      <$> optional advisory "cwe" (isArrayOf (fmap CWE . isInt))
+      <$> optional advisory "cwe" (isArrayOf (isCWE))
   kwds <-
     fromMaybe []
       <$> optional advisory "keywords" (isArrayOf (fmap Keyword . isString))
@@ -417,9 +418,10 @@ onKey ::
 onKey tbl k absent present =
   maybe absent present $ Map.lookup k tbl
 
-isInt :: TOML.Value -> TableParser Integer
-isInt (TOML.Integer i) = pure i
-isInt other = throwError $ InvalidFormat "Integer" (describeValue other) "42"
+isCWE :: TOML.Value -> TableParser CWE.CWEID
+isCWE (TOML.Integer i) | Just cwe <- CWE.mkCWEID i, Map.member cwe CWE.cweNames = pure cwe
+isCWE (TOML.String txt) | Just cwe <- Map.lookup txt CWE.cweIds = pure cwe
+isCWE other = throwError $ InvalidFormat "Integer" (describeValue other) "42"
 
 isString :: TOML.Value -> TableParser T.Text
 isString (TOML.String txt) = pure txt