Refuse to update old databases

Very old databases can cause 1000+ http requests due getting every CVE.

For very old database it is better to download the latest new archive.

Author: Mab879

cmd/cvetool/update.go

@@ -16,6 +16,8 @@ import (
 	"github.com/urfave/cli/v2"
 )
 
+const oldDatabaseThresholdDuration = 24 * time.Hour * 30
+
 var updateCmd = &cli.Command{
 	Name:    "update",
 	Aliases: []string{"u"},
@@ -28,12 +30,17 @@ var updateCmd = &cli.Command{
 			Usage:   "where to look for the matcher DB",
 			EnvVars: []string{"DB_PATH"},
 		},
+		&cli.BoolFlag{
+			Name:  "allow-updating-old-database",
+			Usage: "Allow updating a database older than 30 days. Updating an old database is very slow, it is suggested to delete and create anew.",
+		},
 	},
 }
 
 func update(c *cli.Context) error {
 	ctx := c.Context
 	dbPath := c.String("db-path")
+	allowUpdatingOldDatabase := c.Bool("allow-updating-old-database")
 	if dbPath == "" {
 		var err error
 		dbPath, err = getDefaultDBPath()
@@ -82,6 +89,32 @@ func update(c *cli.Context) error {
 		},
 	}
 
+	// Check last update time
+	updateOps, err := matcherStore.GetUpdateOperations(ctx, driver.VulnerabilityKind)
+	if err != nil {
+		return fmt.Errorf("error getting update operations: %v", err)
+	}
+
+	// Find the most recent update time across all updaters
+	var lastUpdate time.Time
+	for _, ops := range updateOps {
+		if len(ops) > 0 {
+			// ops are sorted by date descending, so first element is most recent
+			if ops[0].Date.After(lastUpdate) {
+				lastUpdate = ops[0].Date
+			}
+		}
+	}
+
+	if !lastUpdate.IsZero() {
+		fmt.Printf("Last update: %s (%s ago)\n", lastUpdate.Format(time.RFC1123), time.Since(lastUpdate).Round(time.Second))
+		if time.Since(lastUpdate) > oldDatabaseThresholdDuration && !allowUpdatingOldDatabase {
+			return fmt.Errorf("Database more than 30 days old, refusing to update. Delete the database at %s and run this command again.", dbPath)
+		}
+	} else {
+		fmt.Println("No previous updates found in database")
+	}
+
 	lv, err := libvuln.New(ctx, matcherOpts)
 	if err != nil {
 		return fmt.Errorf("error creating Libvuln: %v", err)