API Endpoint: Get Package Count by Ecosystem

controllers/vulndb_controller.go

@@ -5,6 +5,7 @@ import (
 	"net/url"
 	"strings"
 
+	"github.com/l3montree-dev/devguard/config"
 	"github.com/l3montree-dev/devguard/database/models"
 	"github.com/l3montree-dev/devguard/dtos"
 	"github.com/l3montree-dev/devguard/normalize"
@@ -16,14 +17,16 @@ import (
 )
 
 type VulnDBController struct {
-	cveRepository           shared.CveRepository
-	maliciousPackageChecker shared.MaliciousPackageChecker
+	cveRepository               shared.CveRepository
+	maliciousPackageChecker     shared.MaliciousPackageChecker
+	affectedComponentRepository shared.AffectedComponentRepository
 }
 
-func NewVulnDBController(cveRepository shared.CveRepository, maliciousPackageChecker shared.MaliciousPackageChecker) *VulnDBController {
+func NewVulnDBController(cveRepository shared.CveRepository, maliciousPackageChecker shared.MaliciousPackageChecker, affectedComponentRepository shared.AffectedComponentRepository) *VulnDBController {
 	return &VulnDBController{
-		cveRepository:           cveRepository,
-		maliciousPackageChecker: maliciousPackageChecker,
+		cveRepository:               cveRepository,
+		maliciousPackageChecker:     maliciousPackageChecker,
+		affectedComponentRepository: affectedComponentRepository,
 	}
 }
 
@@ -150,3 +153,47 @@ func (c VulnDBController) PURLInspect(ctx shared.Context) error {
 		MaliciousPackage:   maliciousPackage,
 	})
 }
+
+type ecosystemRow struct {
+	Ecosystem string `gorm:"ecosystem" json:"ecosystem"`
+	Count     int    `gorm:"count" json:"count"`
+}
+
+// return the number of affected packages by ecosystem
+func (c VulnDBController) GetEcosystemDistribution(ctx shared.Context) error {
+	results := make([]ecosystemRow, 1024)
+
+	// static sql to get amount of packages by ecosystem
+	sql := `SELECT ecosystem, COUNT(*) FROM affected_components GROUP BY ecosystem;`
+	err := c.affectedComponentRepository.GetDB(nil).Raw(sql).Find(&results).Error
+	if err != nil {
+		return err
+	}
+
+	// since ecosystem have tags behind the : character we want to group them by their prefix
+	jsonResults := buildResultsJSON(results)
+
+	return ctx.String(200, jsonResults)
+}
+
+// group ecosystem by prefix ecosystem string and return the equivalent json encoding
+func buildResultsJSON(rows []ecosystemRow) string {
+	// map to deduplicate ecosystem with different tags
+	aggregatedResults := make(map[string]int)
+
+	// fill the map with the value of the rows
+	for _, row := range rows {
+		before, _, _ := strings.Cut(row.Ecosystem, ":")
+		aggregatedResults[before] += row.Count
+	}
+
+	// build the json encoding
+	jsonString := "{\n"
+	for ecosystem, count := range aggregatedResults {
+		jsonString += fmt.Sprintf("%s\"%s\": %d,\n", config.PrettyJSONIndent, ecosystem, count)
+	}
+
+	jsonString, _ = strings.CutSuffix(jsonString, ",\n")
+	jsonString += "\n}"
+	return jsonString
+}

router/vulndb_router.go

@@ -29,6 +29,7 @@ func NewVulnDBRouter(apiV1Router APIV1Router, vulndbController *controllers.Vuln
 	cveRouter.GET("/", vulndbController.ListPaged)
 	cveRouter.GET("/:cveID/", vulndbController.Read)
 	cveRouter.GET("/purl-inspect/:purl", vulndbController.PURLInspect)
+	cveRouter.GET("/affected-package-distribution/", vulndbController.GetEcosystemDistribution)
 	return VulnDBRouter{
 		Group: cveRouter,
 	}