Skip to content

Commit ba853dc

Browse files
achrinzaachrinza
committed
feat(lbsa-20201130): add affected versions for OSV
- add affected versions - add relevant tests Signed-off-by: Rifa Achrinza <[email protected]>
1 parent 86afe48 commit ba853dc

File tree

4 files changed

+268
-18
lines changed

4 files changed

+268
-18
lines changed

‎advisories/lbsa-20201130.osv.json

Lines changed: 210 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,206 @@
11
{
2-
"schema_version": "1.2.0",
3-
"id": "LBSA-20201130",
4-
"modified": "2022-03-05T00:00:00.000Z",
5-
"severity": [
2+
"affected": [
63
{
7-
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/RL:O/E:U/RC:C",
8-
"type": "CVSS_V3"
4+
"package": {
5+
"ecosystem": "npm",
6+
"name": "@loopback/rest",
7+
"purl": "pkg:npm/%40loopback/rest"
8+
},
9+
"ranges": [
10+
{
11+
"events": [
12+
{
13+
"introduced": "02e2ce0a031367438afeaeabdfae2e29e10f25ee"
14+
},
15+
{
16+
"fixed": "f47fad3f4669c3ceae5e0927dc6098da18df864d"
17+
}
18+
],
19+
"repo": "https://github.com/loopbackio/loopback-next.git",
20+
"type": "GIT"
21+
},
22+
{
23+
"events": [
24+
{
25+
"introduced": "0"
26+
},
27+
{
28+
"fixed": "9.0.0"
29+
}
30+
],
31+
"type": "SEMVER"
32+
}
33+
],
34+
"versions": [
35+
"4.0.0-alpha.4",
36+
"4.0.0-alpha.5",
37+
"4.0.0-alpha.6",
38+
"4.0.0-alpha.7",
39+
"4.0.0-alpha.8",
40+
"4.0.0-alpha.9",
41+
"4.0.0-alpha.10",
42+
"4.0.0-alpha.11",
43+
"4.0.0-alpha.12",
44+
"4.0.0-alpha.13",
45+
"4.0.0-alpha.14",
46+
"4.0.0-alpha.15",
47+
"4.0.0-alpha.16",
48+
"4.0.0-alpha.17",
49+
"4.0.0-alpha.18",
50+
"4.0.0-alpha.19",
51+
"4.0.0-alpha.20",
52+
"4.0.0-alpha.21",
53+
"4.0.0-alpha.22",
54+
"4.0.0-alpha.23",
55+
"4.0.0-alpha.24",
56+
"4.0.0-alpha.25",
57+
"4.0.0-alpha.26",
58+
"0.1.0",
59+
"0.1.1",
60+
"0.1.2",
61+
"0.2.0",
62+
"0.3.0",
63+
"0.3.1",
64+
"0.3.2",
65+
"0.3.3",
66+
"0.3.4",
67+
"0.4.0",
68+
"0.4.1",
69+
"0.5.0",
70+
"0.5.1",
71+
"0.5.2",
72+
"0.6.0",
73+
"0.6.1",
74+
"0.6.2",
75+
"0.6.3",
76+
"0.7.0",
77+
"0.8.0",
78+
"0.8.1",
79+
"0.9.0",
80+
"0.10.0",
81+
"0.10.1",
82+
"0.10.2",
83+
"0.10.3",
84+
"0.10.4",
85+
"0.10.5",
86+
"0.11.0",
87+
"0.11.1",
88+
"0.11.2",
89+
"0.11.3",
90+
"0.12.0",
91+
"0.14.0",
92+
"0.14.1",
93+
"0.15.0",
94+
"0.15.1",
95+
"0.16.0",
96+
"0.17.0",
97+
"0.17.1",
98+
"0.18.0",
99+
"0.19.0",
100+
"0.19.1",
101+
"0.19.2",
102+
"0.19.3",
103+
"0.19.4",
104+
"0.19.5",
105+
"0.19.6",
106+
"0.20.0",
107+
"0.21.0",
108+
"0.21.1",
109+
"0.22.0",
110+
"0.22.1",
111+
"0.22.2",
112+
"0.23.0",
113+
"0.24.0",
114+
"0.25.0",
115+
"0.25.1",
116+
"0.25.2",
117+
"0.25.3",
118+
"0.25.4",
119+
"0.25.5",
120+
"0.26.0",
121+
"0.26.1",
122+
"1.0.0",
123+
"1.0.1",
124+
"1.1.0",
125+
"1.2.0",
126+
"1.3.0",
127+
"1.3.1",
128+
"1.4.0",
129+
"1.5.0",
130+
"1.5.1",
131+
"1.5.2",
132+
"1.5.3",
133+
"1.5.4",
134+
"1.5.5",
135+
"1.6.0",
136+
"1.7.0",
137+
"1.8.0",
138+
"1.9.0",
139+
"1.9.1",
140+
"1.10.0",
141+
"1.10.1",
142+
"1.10.2",
143+
"1.10.3",
144+
"1.10.4",
145+
"1.10.5",
146+
"1.11.0",
147+
"1.11.1",
148+
"1.11.2",
149+
"1.12.0",
150+
"1.13.0",
151+
"1.13.1",
152+
"1.14.0",
153+
"1.15.0",
154+
"1.16.0",
155+
"1.16.1",
156+
"1.16.2",
157+
"1.16.3",
158+
"1.16.4",
159+
"1.16.5",
160+
"1.16.6",
161+
"1.16.7",
162+
"1.16.8",
163+
"1.17.0",
164+
"1.18.0",
165+
"1.18.1",
166+
"1.19.0",
167+
"1.20.0",
168+
"1.20.1",
169+
"1.21.0",
170+
"1.22.0",
171+
"1.23.0",
172+
"1.24.0",
173+
"1.25.0",
174+
"1.25.1",
175+
"1.26.0",
176+
"1.26.1",
177+
"2.0.0",
178+
"3.0.0",
179+
"3.0.1",
180+
"3.1.0",
181+
"3.2.0",
182+
"3.2.1",
183+
"3.3.0",
184+
"3.3.1",
185+
"3.3.2",
186+
"4.0.0",
187+
"5.0.0",
188+
"5.0.1",
189+
"5.1.0",
190+
"5.1.1",
191+
"5.1.2",
192+
"5.2.0",
193+
"5.2.1",
194+
"6.0.0",
195+
"6.1.0",
196+
"6.2.0",
197+
"7.0.0",
198+
"7.0.1",
199+
"8.0.0"
200+
]
9201
}
10202
],
203+
"aliases": ["CVE-2020-4988"],
11204
"credits": [
12205
{
13206
"name": "Olivier Beg"
@@ -16,6 +209,12 @@
16209
"name": "Samuel Erb"
17210
}
18211
],
212+
"database_specific": {
213+
"CWE": "CWE-1321"
214+
},
215+
"details": "It's a similar issue as https://snyk.io/vuln/SNYK-JS-LODASH-73638, where the following description is quoted from.\n\n> Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `_proto_`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n>\n> There are two main ways in which the pollution of prototypes occurs:\n>\n> - Unsafe Object recursive merge\n> - Property definition by path",
216+
"id": "LBSA-20201130",
217+
"modified": "2022-03-06T00:13:54.000Z",
19218
"references": [
20219
{
21220
"type": "ADVISORY",
@@ -42,19 +241,12 @@
42241
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/192706"
43242
}
44243
],
45-
"aliases": ["CVE-2020-4988"],
46-
"affected": [
244+
"schema_version": "1.2.0",
245+
"severity": [
47246
{
48-
"package": {
49-
"ecosystem": "npm",
50-
"name": "@loopback/rest"
51-
},
52-
"versions": ["8.0.0"]
247+
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/RL:O/E:U/RC:C",
248+
"type": "CVSS_V3"
53249
}
54250
],
55-
"database_specific": {
56-
"CWE": "CWE-1321"
57-
},
58-
"summary": "`@loopback/rest` allows REST APIs to have `constructor` in the JSON payload, which is vulnerable to prototype pollution.",
59-
"details": "It's a similar issue as https://snyk.io/vuln/SNYK-JS-LODASH-73638, where the following description is quoted from.\n\n> Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `_proto_`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n>\n> There are two main ways in which the pollution of prototypes occurs:\n>\n> - Unsafe Object recursive merge\n> - Property definition by path"
251+
"summary": "`@loopback/rest` allows REST APIs to have `constructor` in the JSON payload, which is vulnerable to prototype pollution."
60252
}

‎package-lock.json

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,13 +43,15 @@
4343
"@loopback/build": "^8.1.0",
4444
"@loopback/eslint-config": "^12.0.2",
4545
"@types/glob": "^7.2.0",
46+
"@types/semver": "^7.3.9",
4647
"ajv": "^8.10.0",
4748
"ajv-formats": "^2.1.1",
4849
"eslint": "^8.9.0",
4950
"eslint-plugin-prettier": "^4.0.0",
5051
"glob": "^7.2.0",
5152
"husky": "^7.0.4",
5253
"secvisogram": "file:./vendors/secvisogram/app",
54+
"semver": "^7.3.5",
5355
"ts-node": "^10.5.0"
5456
}
5557
}

‎scripts/advisories/validate-osv.ts

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import glob from 'glob';
66
import Ajv2020 from 'ajv/dist/2020';
77
import addFormats from 'ajv-formats';
88
import osvSchema from '../../vendors/osv-schema/validation/schema.json';
9+
import semver from 'semver';
910

1011
const osvDocumentGlob = '../../advisories/*.osv.json';
1112

@@ -32,6 +33,7 @@ glob(path.resolve(__dirname, osvDocumentGlob), async (err, matches) => {
3233
const validationResults: Record<string, ValidationResult> = {
3334
jsonSchema: validateJsonSchema(fileContents),
3435
schemaVersion: validateSchemaVersion(fileContents),
36+
affectedVersions: validateAffectedVersions(fileContents),
3537
csaf20Sync: validateCSAF20Sync(filePath, fileContents),
3638
};
3739

@@ -88,6 +90,58 @@ function validateSchemaVersion(fileContents: any): ValidationResult {
8890
};
8991
}
9092

93+
function validateAffectedVersions(fileContents: any): ValidationResult {
94+
const errors: ValidationResult['errors'] = [];
95+
96+
if (!fileContents.affected) {
97+
errors.push({
98+
instancePath: '/affected',
99+
message: 'affected must exist.',
100+
});
101+
}
102+
103+
for (const affected of fileContents.affected) {
104+
const versions = affected.versions;
105+
106+
if (versions !== undefined) {
107+
const semverEvents = (affected.ranges as any[]).find(
108+
x => x.type === 'SEMVER',
109+
).events;
110+
const semverRange =
111+
'>=' +
112+
semverEvents.find(x => x.introduced).introduced +
113+
' <' +
114+
semverEvents.find(x => x.fixed).fixed;
115+
116+
console.log(semverRange);
117+
118+
for (let i = 0; i < versions.length; i++) {
119+
const version = versions[i];
120+
121+
if (
122+
!semver.satisfies(version, semverRange, {includePrerelease: true})
123+
) {
124+
errors.push({
125+
instancePath: `/affected/versions/${i}`,
126+
message:
127+
'versions must be within introduced and fixed semver range.',
128+
});
129+
}
130+
}
131+
} else {
132+
errors.push({
133+
instancePath: '/affected/ranges/versions',
134+
message: 'versions must exist.',
135+
});
136+
}
137+
}
138+
139+
return {
140+
isValid: errors.length < 1,
141+
errors,
142+
};
143+
}
144+
91145
function validateCSAF20Sync(
92146
filePath: string,
93147
osvDocument: any,

0 commit comments

Comments
 (0)