|
| 1 | +# |
| 2 | +# Copyright (c) nexB Inc. and others. All rights reserved. |
| 3 | +# VulnerableCode is a trademark of nexB Inc. |
| 4 | +# SPDX-License-Identifier: Apache-2.0 |
| 5 | +# See http://www.apache.org/licenses/LICENSE-2.0 for the license text. |
| 6 | +# See https://github.com/aboutcode-org/vulnerablecode for support or download. |
| 7 | +# See https://aboutcode.org for more information about nexB OSS projects. |
| 8 | +# |
| 9 | + |
| 10 | +import json |
| 11 | +from pathlib import Path |
| 12 | + |
| 13 | +from aboutcode.pipeline import LoopProgress |
| 14 | +from fetchcode.vcs import fetch_via_vcs |
| 15 | + |
| 16 | +from vulnerabilities.models import AdvisoryAlias |
| 17 | +from vulnerabilities.models import AdvisoryPOC |
| 18 | +from vulnerabilities.models import AdvisoryV2 |
| 19 | +from vulnerabilities.pipelines import VulnerableCodePipeline |
| 20 | + |
| 21 | + |
| 22 | +class GithubPocsImproverPipeline(VulnerableCodePipeline): |
| 23 | + """ |
| 24 | + Pipeline to Collect an exploit-PoCs repository, parse exploit JSON files, |
| 25 | + match them to advisories via aliases, and update/create POC records. |
| 26 | + """ |
| 27 | + |
| 28 | + pipeline_id = "enhance_with_github_poc" |
| 29 | + repo_url = "git+https://github.com/nomi-sec/PoC-in-GitHub" |
| 30 | + |
| 31 | + @classmethod |
| 32 | + def steps(cls): |
| 33 | + return ( |
| 34 | + cls.clone_repo, |
| 35 | + cls.collect_and_store_exploits, |
| 36 | + cls.clean_downloads, |
| 37 | + ) |
| 38 | + |
| 39 | + def clone_repo(self): |
| 40 | + self.log(f"Cloning `{self.repo_url}`") |
| 41 | + self.vcs_response = fetch_via_vcs(self.repo_url) |
| 42 | + |
| 43 | + def collect_and_store_exploits(self): |
| 44 | + """ |
| 45 | + Parse PoC JSON files, match them to advisories via aliases, |
| 46 | + and create or update related exploit records. |
| 47 | + """ |
| 48 | + |
| 49 | + base_directory = Path(self.vcs_response.dest_dir) |
| 50 | + json_files = list(base_directory.rglob("**/*.json")) |
| 51 | + exploits_count = len(json_files) |
| 52 | + self.log(f"Enhancing the vulnerability with {exploits_count:,d} exploit records") |
| 53 | + progress = LoopProgress(total_iterations=exploits_count, logger=self.log) |
| 54 | + for file_path in progress.iter(json_files): |
| 55 | + with open(file_path, "r") as f: |
| 56 | + try: |
| 57 | + exploits_data = json.load(f) |
| 58 | + except json.JSONDecodeError: |
| 59 | + self.log(f"Invalid JSON in {file_path}, skipping.") |
| 60 | + continue |
| 61 | + |
| 62 | + filename = file_path.stem.strip() |
| 63 | + |
| 64 | + advisories = set() |
| 65 | + try: |
| 66 | + if alias := AdvisoryAlias.objects.get(alias=filename): |
| 67 | + for adv in alias.advisories.all(): |
| 68 | + advisories.add(adv) |
| 69 | + else: |
| 70 | + advs = AdvisoryV2.objects.filter(advisory_id=filename).latest_per_avid() |
| 71 | + for adv in advs: |
| 72 | + advisories.add(adv) |
| 73 | + except AdvisoryAlias.DoesNotExist: |
| 74 | + self.log(f"Advisory {filename} not found.") |
| 75 | + continue |
| 76 | + |
| 77 | + for advisory in advisories: |
| 78 | + for exploit_data in exploits_data: |
| 79 | + exploit_repo_url = exploit_data.get("html_url") |
| 80 | + if not exploit_repo_url: |
| 81 | + continue |
| 82 | + |
| 83 | + AdvisoryPOC.objects.update_or_create( |
| 84 | + advisory=advisory, |
| 85 | + url=exploit_repo_url, |
| 86 | + defaults={ |
| 87 | + "created_at": exploit_data.get("created_at"), |
| 88 | + "updated_at": exploit_data.get("updated_at"), |
| 89 | + }, |
| 90 | + ) |
| 91 | + |
| 92 | + self.log(f"Successfully added {exploits_count:,d} poc exploit advisory") |
| 93 | + |
| 94 | + def clean_downloads(self): |
| 95 | + if self.vcs_response: |
| 96 | + self.log(f"Removing cloned repository") |
| 97 | + self.vcs_response.delete() |
| 98 | + |
| 99 | + def on_failure(self): |
| 100 | + self.clean_downloads() |
0 commit comments