Skip to content

Commit f0bd35d

Browse files
authored
Merge pull request #4 from intel/main
Changes-2
2 parents a1e428d + 44b5e99 commit f0bd35d

File tree

9 files changed

+82
-20
lines changed

9 files changed

+82
-20
lines changed

.github/workflows/codeql-analysis.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ jobs:
5151

5252
# Initializes the CodeQL tools for scanning.
5353
- name: Initialize CodeQL
54-
uses: github/codeql-action/init@49abf0ba24d0b7953cb586944e918a0b92074c80 # v2.22.4
54+
uses: github/codeql-action/init@74483a38d39275f33fcff5f35b679b5ca4a26a99 # v2.22.5
5555
with:
5656
languages: ${{ matrix.language }}
5757
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -76,4 +76,4 @@ jobs:
7676
# make release
7777

7878
- name: Perform CodeQL Analysis
79-
uses: github/codeql-action/analyze@49abf0ba24d0b7953cb586944e918a0b92074c80 # v2.22.4
79+
uses: github/codeql-action/analyze@74483a38d39275f33fcff5f35b679b5ca4a26a99 # v2.22.5

.github/workflows/fuzzing.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,10 @@ jobs:
1616
if: github.event.repository.fork == false
1717
steps:
1818
- name: Check out code
19-
uses: actions/checkout@v2
19+
uses: actions/checkout@v4
2020

2121
- name: Set up Python
22-
uses: actions/setup-python@v2
22+
uses: actions/setup-python@v4
2323
with:
2424
python-version: 3.9
2525

.github/workflows/spelling.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,6 @@ jobs:
1919
egress-policy: audit
2020

2121
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
22-
- uses: check-spelling/check-spelling@d7cd2973c513e84354f9d6cf50a6417a628a78ce # v0.0.21
22+
- uses: check-spelling/[email protected].22
2323
with:
2424
post_comment: '0'

.pre-commit-config.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,13 @@ repos:
66
exclude: ^fuzz/generated/
77

88
- repo: https://github.com/psf/black-pre-commit-mirror
9-
rev: 23.9.1
9+
rev: 23.10.1
1010
hooks:
1111
- id: black
1212
exclude: ^fuzz/generated/
1313

1414
- repo: https://github.com/asottile/pyupgrade
15-
rev: v3.10.1
15+
rev: v3.15.0
1616
hooks:
1717
- id: pyupgrade
1818
exclude: ^fuzz/generated/
@@ -37,7 +37,7 @@ repos:
3737
- id: gitlint
3838

3939
- repo: https://github.com/pre-commit/mirrors-mypy
40-
rev: v1.5.1
40+
rev: v1.6.1
4141
hooks:
4242
- id: mypy
4343
additional_dependencies:

cve_bin_tool/data_sources/curl_source.py

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,16 @@
2323

2424

2525
class Curl_Source(Data_Source):
26+
"""Represents a data source for retrieving information about vulnerabilities in cURL."""
27+
2628
SOURCE = "Curl"
2729
CACHEDIR = DISK_LOCATION_DEFAULT
2830
BACKUPCACHEDIR = DISK_LOCATION_BACKUP
2931
LOGGER = LOGGER.getChild("CVEDB")
3032
DATA_SOURCE_LINK = "https://curl.se/docs/vuln.json"
3133

3234
def __init__(self, error_mode=ErrorMode.TruncTrace):
35+
"""Initialize a Curl_Source instance. Args: error_mode (ErrorMode): The error mode to be used."""
3336
self.cve_list = None
3437
self.cachedir = self.CACHEDIR
3538
self.backup_cachedir = self.BACKUPCACHEDIR
@@ -40,12 +43,14 @@ def __init__(self, error_mode=ErrorMode.TruncTrace):
4043
self.vulnerability_data = []
4144

4245
async def get_cve_data(self):
46+
"""Get cURL vulnerability data. Fetches the cURL vulnerability data and retrieves a list of affected data."""
4347
await self.fetch_cves()
4448
self.get_cve_list()
4549

4650
return (None, self.affected_data), self.source_name
4751

4852
async def fetch_cves(self):
53+
"""Fetch cURL vulnerabilities data."""
4954
if not self.session:
5055
connector = aiohttp.TCPConnector(limit_per_host=19)
5156
self.session = RateLimiter(
@@ -57,6 +62,7 @@ async def fetch_cves(self):
5762
await self.session.close()
5863

5964
async def download_curl_vulnerabilities(self, session: RateLimiter) -> None:
65+
"""Download cURL vulnerability data and save it to a file. Args: session (RateLimiter): The session to use for the HTTP request."""
6066
async with await session.get(self.DATA_SOURCE_LINK) as response:
6167
response.raise_for_status()
6268
self.vulnerability_data = await response.json()
@@ -66,6 +72,7 @@ async def download_curl_vulnerabilities(self, session: RateLimiter) -> None:
6672
await f.write(json.dumps(self.vulnerability_data, indent=4))
6773

6874
def get_cve_list(self):
75+
"""Get a list of affected cURL vulnerabilities."""
6976
self.affected_data = []
7077

7178
for cve in self.vulnerability_data:

cve_bin_tool/data_sources/gad_source.py

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@
2323

2424

2525
class GAD_Source(Data_Source):
26+
"""Represents a data source for retrieving Common Vulnerabilities and Exposures (CVEs) from GitLab Advisory Database (GAD)."""
27+
2628
SOURCE = "GAD"
2729
CACHEDIR = DISK_LOCATION_DEFAULT
2830
LOGGER = LOGGER.getChild("CVEDB")
@@ -174,6 +176,9 @@ async def update_cve_entries(self):
174176
self.all_cve_entries.append(data)
175177

176178
def parse_multiple_version(self, range_string):
179+
"""Parses multiple version strings from a range string.
180+
Args:range_string (str): The range string to parse.
181+
Returns:list: A list of parsed version strings."""
177182
version_strings = range_string.split(",")
178183
start = False
179184
versions = []

cve_bin_tool/data_sources/osv_source.py

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -292,15 +292,18 @@ def format_data(self, all_cve_entries):
292292

293293
severity_data.append(cve)
294294

295-
for package in cve_item["affected"]:
296-
product = package["package"]["name"]
295+
for package_data in cve_item.get("affected", []):
296+
package = package_data.get("package", {})
297+
if not package:
298+
continue
299+
300+
product = package.get("name")
297301
vendor = (
298302
"unknown" # OSV Schema does not provide vendor names for packages
299303
)
300-
if (
301-
"github.com/" in product
302-
): # if package name is of format github.com/xxxx/yyyy xxxx can be vendor name and yyyy is package name
303-
vendor = product.split("/")[-2] # trying to guess vendor name
304+
305+
if product.startswith("github.com/"):
306+
vendor = product.split("/")[-2]
304307
product = product.split("/")[-1]
305308

306309
affected = {
@@ -315,12 +318,12 @@ def format_data(self, all_cve_entries):
315318
}
316319

317320
events = None
318-
for ranges in package.get("ranges", []):
321+
for ranges in package_data.get("ranges", []):
319322
if ranges["type"] == "SEMVER":
320323
events = ranges["events"]
321324

322-
if events is None and "versions" in package:
323-
versions = package["versions"]
325+
if events is None and "versions" in package_data:
326+
versions = package_data["versions"]
324327

325328
if versions == []:
326329
continue

cve_bin_tool/output_engine/__init__.py

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -594,10 +594,51 @@ def output_pdf(
594594
exploits: bool = False,
595595
all_product_data=None,
596596
):
597+
"""Output a PDF of CVEs
598+
Required module: Reportlab not found"""
597599
LOGGER.warning("PDF output requires install of reportlab")
598600

599601

600602
class OutputEngine:
603+
"""
604+
Class represention of OutputEngine
605+
Attributes:
606+
all_cve_data (dict[ProductInfo, CVEData])
607+
scanned_dir (str)
608+
filename (str)
609+
themes_dir (str)
610+
time_of_last_update
611+
tag (str)
612+
logger
613+
products_with_cve (int)
614+
products_without_cve (int)
615+
total_files (int)
616+
is_report (bool)
617+
no_zero_cve_report (bool)
618+
append
619+
merge_report
620+
affected_versions (int)
621+
all_cve_version_info
622+
detailed (bool)
623+
vex_filename (str)
624+
exploits (bool)
625+
all_product_data
626+
sbom_filename (str)
627+
sbom_type (str)
628+
sbom_format (str)
629+
sbom_root (str)
630+
offline (bool)
631+
632+
Methods:
633+
output_cves: Output a list of CVEs to other formats like CSV or JSON.
634+
generate_vex: Generate a vex file and create vulnerability entry.
635+
generate_sbom: Create SBOM package and generate SBOM file.
636+
output_file_wrapper:
637+
output_file: Generate a file for list of CVE
638+
check_file_path: Generate a new filename if file already exists.
639+
check_dir_path: Generate a new filename if filepath is a directory.
640+
"""
641+
601642
def __init__(
602643
self,
603644
all_cve_data: dict[ProductInfo, CVEData],
@@ -626,6 +667,7 @@ def __init__(
626667
sbom_root: str = "CVE_SBOM",
627668
offline: bool = False,
628669
):
670+
"""Constructor for OutputEngine class."""
629671
self.logger = logger or LOGGER.getChild(self.__class__.__name__)
630672
self.all_cve_version_info = all_cve_version_info
631673
self.scanned_dir = scanned_dir
@@ -735,6 +777,7 @@ def output_cves(self, outfile, output_type="console"):
735777
)
736778

737779
def generate_vex(self, all_cve_data: dict[ProductInfo, CVEData], filename: str):
780+
"""Generate a vex file and create vulnerability entry."""
738781
analysis_state = {
739782
Remarks.NewFound: "in_triage",
740783
Remarks.Unexplored: "in_triage",
@@ -840,6 +883,7 @@ def generate_sbom(
840883
sbom_format="tag",
841884
sbom_root="CVE-SCAN",
842885
):
886+
"""Create SBOM package and generate SBOM file."""
843887
# Create SBOM
844888
sbom_packages = {}
845889
sbom_relationships = []
@@ -895,6 +939,7 @@ def generate_sbom(
895939
my_generator.generate(parent, my_sbom.get_sbom(), filename=filename)
896940

897941
def output_file_wrapper(self, output_types=["console"]):
942+
"""Call output_file method for all output types."""
898943
for output_type in output_types:
899944
self.output_file(output_type)
900945

@@ -959,6 +1004,7 @@ def output_file(self, output_type="console"):
9591004
self.output_cves(f, output_type)
9601005

9611006
def check_file_path(self, filepath: str, output_type: str, prefix: str = "output"):
1007+
"""Generate a new filename if file already exists."""
9621008
# check if the file already exists
9631009
if Path(filepath).is_file():
9641010
self.logger.warning(f"Failed to write at '{filepath}'. File already exists")
@@ -970,6 +1016,7 @@ def check_file_path(self, filepath: str, output_type: str, prefix: str = "output
9701016
def check_dir_path(
9711017
self, filepath: str, output_type: str, prefix: str = "intermediate"
9721018
):
1019+
"""Generate a new filename if filepath is a directory."""
9731020
if Path(filepath).is_dir():
9741021
self.logger.info(
9751022
f"Generating a new filename with Default Naming Convention in directory path {filepath}"

dev-requirements.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
1-
black==23.9.1
1+
black==23.10.1
22
isort; python_version < "3.8"
33
isort==5.12.0; python_version >= "3.8"
44
pre-commit; python_version < "3.8"
5-
pre-commit==3.4.0; python_version >= "3.8"
5+
pre-commit==3.5.0; python_version >= "3.8"
66
flake8; python_version < "3.8"
77
flake8==6.1.0; python_version >= "3.8"
88
bandit==1.7.5
99
gitlint==v0.19.1
1010
interrogate
11-
mypy==v1.5.1
11+
mypy==v1.6.1
1212
pytest>=7.2.0
1313
pytest-xdist
1414
pytest-cov

0 commit comments

Comments
 (0)