Skip to content

Commit abb254f

Browse files
ziadhanyziadhany
committed
Update UI to have a new tab Package Commit Patches Details
Sort PackageCommitPatchViewSet Signed-off-by: ziad hany <ziadhany2016@gmail.com>
1 parent d1b139f commit abb254f

7 files changed

Lines changed: 173 additions & 87 deletions

File tree

‎vulnerabilities/api_v2.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -966,7 +966,7 @@ def get_queryset(self):
966966
| Q(fixed_in_impacts__base_purl__icontains=purl)
967967
).distinct()
968968

969-
return queryset
969+
return queryset.order_by("id")
970970

971971

972972
class PatchViewSet(viewsets.ReadOnlyModelViewSet):

‎vulnerabilities/templates/advisory_detail.html‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,18 @@
181181
</a>
182182
</td>
183183
</tr>
184+
<tr>
185+
<td class="two-col-left"
186+
data-tooltip="Risk expressed as a number ranging from 0 to 10. It is calculated by multiplying
187+
the weighted severity and exploitability values, capped at a maximum of 10.
188+
"
189+
>Introduced and Fixed Package Commit Patches</td>
190+
<td class="two-col-right wrap-strings">
191+
<a href="/advisories/commits/{{ advisory.avid }}">
192+
Package Commit Patches Details
193+
</a>
194+
</td>
195+
</tr>
184196
</tbody>
185197
</table>
186198
<div class="has-text-weight-bold tab-nested-div ml-1 mb-1 mt-6">

‎vulnerabilities/templates/advisory_package_commit_details.html‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
{% extends "base.html" %}
2+
{% load humanize %}
3+
{% load widget_tweaks %}
4+
{% load static %}
5+
{% load show_cvss %}
6+
{% load url_filters %}
7+
8+
{% block title %}
9+
VulnerableCode Advisory Package Commit Patch Details - {{ advisoryv2.advisory_id }}
10+
{% endblock %}
11+
12+
{% block content %}
13+
14+
{% if advisoryv2 %}
15+
<section class="section pt-0">
16+
<div class="details-container">
17+
<article class="panel is-info panel-header-only">
18+
<div class="panel-heading py-2 is-size-6">
19+
Introduce and Fixing Package Commit Patch details for Advisory:
20+
<span class="tag is-white custom">
21+
{{ advisoryv2.advisory_id }}
22+
</span>
23+
</div>
24+
</article>
25+
26+
<div id="tab-content">
27+
<table class="table vcio-table width-100-pct mt-2">
28+
<thead>
29+
<tr>
30+
<th style="width: 50%;">Introduced in</th>
31+
<th>Fixed by</th>
32+
</tr>
33+
</thead>
34+
<tbody>
35+
{% for impact in advisoryv2.impacted_packages.all %}
36+
{% for pkg_commit_patch in impact.introduced_by_package_commit_patches.all %}
37+
<tr>
38+
<td>
39+
<a href="{{ pkg_commit_patch.patch_url }}" target="_self">
40+
{{ pkg_commit_patch.vcs_url }}@{{ pkg_commit_patch.commit_hash }}
41+
</a>
42+
<br />
43+
<a href="{{ pkg_commit_patch.patch_url }}" target="_self">{{ pkg_commit_patch.patch_url }}</a>
44+
</td>
45+
<td></td>
46+
</tr>
47+
{% endfor %}
48+
49+
{% for pkg_commit_patch in impact.fixed_by_package_commit_patches.all %}
50+
<tr>
51+
<td></td>
52+
<td>
53+
<a href="{{ pkg_commit_patch.commit_url }}" target="_self">
54+
{{ impact.base_purl }}@{{ pkg_commit_patch.commit_hash }}
55+
</a>
56+
<br />
57+
58+
{% if pkg_commit_patch.patch_url %}
59+
<a href="{{ pkg_commit_patch.patch_url }}" target="_self">{{ pkg_commit_patch.patch_url }}</a>
60+
{% endif %}
61+
</td>
62+
</tr>
63+
{% endfor %}
64+
65+
{% empty %}
66+
<tr>
67+
<td colspan="2">
68+
This vulnerability is not known to affect any package commits.
69+
</td>
70+
</tr>
71+
{% endfor %}
72+
</tbody>
73+
</table>
74+
</div>
75+
76+
</div>
77+
</section>
78+
{% endif %}
79+
80+
<script src="{% static 'js/main.js' %}" crossorigin="anonymous"></script>
81+
82+
{% endblock %}

‎vulnerabilities/templates/advisory_package_details.html‎

Lines changed: 0 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -60,67 +60,6 @@
6060
</div>
6161
</div>
6262
</section>
63-
<section class="section pt-0">
64-
<div class="details-container">
65-
<article class="panel is-info panel-header-only">
66-
<div class="panel-heading py-2 is-size-6">
67-
Vulnerable and Fixing Package Commit Patch details for Advisory:
68-
<span class="tag is-white custom">
69-
{{ advisoryv2.advisory_id }}
70-
</span>
71-
</div>
72-
</article>
73-
74-
<div id="tab-content">
75-
<table class="table vcio-table width-100-pct mt-2">
76-
<thead>
77-
<tr>
78-
<th style="width: 50%;">Introduced in</th>
79-
<th>Fixed by</th>
80-
</tr>
81-
</thead>
82-
<tbody>
83-
{% for impact in advisoryv2.impacted_packages.all %}
84-
85-
{% for pkg_commit_patch in impact.introduced_by_package_commit_patches.all %}
86-
<tr>
87-
<td>
88-
<a href="{{ pkg_commit_patch.patch_url }}" target="_self">
89-
{{ pkg_commit_patch.vcs_url }}@{{ pkg_commit_patch.commit_hash }}
90-
</a>
91-
<br />
92-
<a href="{{ pkg_commit_patch.patch_url }}" target="_self">{{ pkg_commit_patch.patch_url }}</a>
93-
</td>
94-
<td></td>
95-
</tr>
96-
{% endfor %}
97-
98-
{% for pkg_commit_patch in impact.fixed_by_package_commit_patches.all %}
99-
<tr>
100-
<td></td>
101-
<td>
102-
<a href="{{ pkg_commit_patch.commit_url }}" target="_self">
103-
{{ impact.base_purl }}@{{ pkg_commit_patch.commit_hash }}
104-
</a>
105-
<br />
106-
<a href="{{ pkg_commit_patch.patch_url }}" target="_self">{{ pkg_commit_patch.patch_url }}</a>
107-
</td>
108-
</tr>
109-
{% endfor %}
110-
111-
{% empty %}
112-
<tr>
113-
<td colspan="2">
114-
This vulnerability is not known to affect any package commits.
115-
</td>
116-
</tr>
117-
{% endfor %}
118-
</tbody>
119-
</table>
120-
</div>
121-
122-
</div>
123-
</section>
12463
{% endif %}
12564

12665
<script src="{% static 'js/main.js' %}" crossorigin="anonymous"></script>

‎vulnerabilities/utils.py‎

Lines changed: 21 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@
4343
from univers.version_range import VersionRange
4444

4545
from aboutcode.hashid import build_vcid
46+
from aboutcode.hashid import get_core_purl
4647

4748
logger = logging.getLogger(__name__)
4849

@@ -871,49 +872,44 @@ def group_advisories_by_content(advisories):
871872
return grouped
872873

873874

874-
def generate_patch_url(vcs_url, commit_hash):
875+
def generate_commit_url(vcs_url, commit_hash):
875876
"""
876-
Generate patch URL from VCS URL and commit hash.
877+
Generate commit URL from VCS URL and commit hash.
877878
"""
878879
if not vcs_url or not commit_hash:
879-
return None
880+
return
880881

881-
vcs_url = vcs_url.rstrip("/")
882+
purl = url2purl(vcs_url)
883+
if not purl:
884+
return
882885

883-
if vcs_url.startswith("https://github.com"):
884-
return f"{vcs_url}/commit/{commit_hash}.patch"
885-
elif vcs_url.startswith("https://gitlab.com"):
886-
return f"{vcs_url}/-/commit/{commit_hash}.patch"
887-
elif vcs_url.startswith("https://codeberg.org"):
888-
return f"{vcs_url}/-/commit/{commit_hash}.patch"
889-
elif vcs_url.startswith("https://android.googlesource.com"):
890-
return f"{vcs_url}/+/{commit_hash}%5E%21?format=TEXT"
891-
elif vcs_url.startswith("https://bitbucket.org"):
892-
return f"{vcs_url}/-/commit/{commit_hash}/raw"
893-
elif vcs_url.startswith("https://git.kernel.org"):
894-
return f"{vcs_url}/patch/?id={commit_hash}"
895-
return
886+
base_purl = get_core_purl(str(purl))
887+
purl_with_version = PackageURL(
888+
type=base_purl.type, namespace=base_purl.namespace, name=base_purl.name, version=commit_hash
889+
)
890+
commit_url = purl2url(str(purl_with_version))
891+
return commit_url
896892

897893

898-
def generate_commit_url(vcs_url, commit_hash):
894+
def generate_patch_url(vcs_url, commit_hash):
899895
"""
900-
Generate commit URL from VCS URL and commit hash.
896+
Generate patch URL from VCS URL and commit hash.
901897
"""
902898
if not vcs_url or not commit_hash:
903899
return None
904900

905901
vcs_url = vcs_url.rstrip("/")
906902

907903
if vcs_url.startswith("https://github.com"):
908-
return f"{vcs_url}/commit/{commit_hash}"
904+
return f"{vcs_url}/commit/{commit_hash}.patch"
909905
elif vcs_url.startswith("https://gitlab.com"):
910-
return f"{vcs_url}/-/commit/{commit_hash}"
906+
return f"{vcs_url}/-/commit/{commit_hash}.patch"
907+
elif vcs_url.startswith("https://bitbucket.org"):
908+
return f"{vcs_url}/-/commit/{commit_hash}/raw"
911909
elif vcs_url.startswith("https://codeberg.org"):
912-
return f"{vcs_url}/-/commit/{commit_hash}"
910+
return f"{vcs_url}/-/commit/{commit_hash}.patch"
913911
elif vcs_url.startswith("https://android.googlesource.com"):
914-
return f"{vcs_url}/+/{commit_hash}"
915-
elif vcs_url.startswith("https://bitbucket.org"):
916-
return f"{vcs_url}/-/commit/{commit_hash}"
912+
return f"{vcs_url}/+/{commit_hash}%5E%21?format=TEXT"
917913
elif vcs_url.startswith("https://git.kernel.org"):
918914
return f"{vcs_url}/patch/?id={commit_hash}"
919915
return

‎vulnerabilities/views.py‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -787,6 +787,57 @@ def get_queryset(self):
787787
)
788788

789789

790+
class AdvisoryPackageCommitPatchDetails(DetailView):
791+
"""
792+
View to display all packages introduce by or fixing a specific vulnerability.
793+
URL: /advisories/{id}/commits
794+
"""
795+
796+
model = models.AdvisoryV2
797+
template_name = "advisory_package_commit_details.html"
798+
slug_url_kwarg = "avid"
799+
800+
def get_object(self, queryset=None):
801+
avid = self.kwargs.get(self.slug_url_kwarg)
802+
if not avid:
803+
raise Http404("Missing advisory identifier")
804+
805+
advisory = models.AdvisoryV2.objects.latest_for_avid(avid)
806+
807+
if not advisory:
808+
raise Http404(f"No advisory found for avid: {avid}")
809+
810+
return advisory
811+
812+
def get_queryset(self):
813+
"""
814+
Prefetch and optimize related data to minimize database hits.
815+
"""
816+
return (
817+
super()
818+
.get_queryset()
819+
.prefetch_related(
820+
Prefetch(
821+
"impacted_packages",
822+
queryset=models.ImpactedPackage.objects.order_by("base_purl").prefetch_related(
823+
Prefetch(
824+
"introduced_by_package_commit_patches",
825+
queryset=models.PackageCommitPatch.objects.only(
826+
"commit_hash", "vcs_url", "patch_url", "commit_url"
827+
),
828+
),
829+
Prefetch(
830+
"fixed_by_package_commit_patches",
831+
queryset=models.PackageCommitPatch.objects.only(
832+
"commit_hash", "vcs_url", "patch_url", "commit_url"
833+
),
834+
),
835+
),
836+
)
837+
)
838+
)
839+
840+
790841
class PipelineScheduleListView(ListView, FormMixin):
791842
model = PipelineSchedule
792843
context_object_name = "schedule_list"

‎vulnerablecode/urls.py‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
from vulnerabilities.api_v2 import VulnerabilityV2ViewSet
3131
from vulnerabilities.views import AdminLoginView
3232
from vulnerabilities.views import AdvisoryDetails
33+
from vulnerabilities.views import AdvisoryPackageCommitPatchDetails
3334
from vulnerabilities.views import AdvisoryPackagesDetails
3435
from vulnerabilities.views import ApiUserCreateView
3536
from vulnerabilities.views import HomePage
@@ -116,6 +117,11 @@ def __init__(self, *args, **kwargs):
116117
AdvisoryPackagesDetails.as_view(),
117118
name="advisory_package_details",
118119
),
120+
path(
121+
"advisories/commits/<path:avid>",
122+
AdvisoryPackageCommitPatchDetails.as_view(),
123+
name="advisory_package_commit_details",
124+
),
119125
path(
120126
"advisories/<path:avid>",
121127
AdvisoryDetails.as_view(),

0 commit comments

Comments
 (0)