distro-tools/apollo/server/routes/api_osv.py

278 lines
8.2 KiB
Python
Raw Normal View History

2023-02-04 23:24:31 +00:00
from typing import TypeVar, Generic, Optional
2023-02-04 23:35:47 +00:00
from fastapi import APIRouter, Depends
from fastapi.exceptions import HTTPException
2023-02-04 23:24:31 +00:00
from fastapi_pagination import create_page
from fastapi_pagination.links import Page
from pydantic import BaseModel
from slugify import slugify
from apollo.db import Advisory
from apollo.db.advisory import fetch_advisories
2023-02-05 01:14:58 +00:00
from apollo.rpmworker.repomd import EPOCH_RE, NEVRA_RE
2023-02-04 23:35:47 +00:00
from apollo.server.settings import UI_URL, get_setting
2023-02-04 23:24:31 +00:00
from common.fastapi import Params, to_rfc3339_date
router = APIRouter(tags=["osv"])
T = TypeVar("T")
class Pagination(Page[T], Generic[T]):
class Config:
allow_population_by_field_name = True
fields = {"items": {"alias": "advisories"}}
class OSVSeverity(BaseModel):
type: str
score: str
class OSVPackage(BaseModel):
ecosystem: str
name: str
purl: Optional[str] = None
class OSVEvent(BaseModel):
introduced: Optional[str] = None
fixed: Optional[str] = None
last_affected: Optional[str] = None
limit: Optional[str] = None
class OSVRangeDatabaseSpecific(BaseModel):
2023-03-06 04:49:20 +00:00
yum_repository: str
2023-02-04 23:24:31 +00:00
class OSVRange(BaseModel):
type: str
2023-03-06 04:49:20 +00:00
repo: Optional[str]
2023-02-04 23:24:31 +00:00
events: list[OSVEvent]
2023-03-06 04:49:20 +00:00
database_specific: Optional[OSVRangeDatabaseSpecific]
2023-02-04 23:24:31 +00:00
class OSVEcosystemSpecific(BaseModel):
pass
class OSVAffectedDatabaseSpecific(BaseModel):
pass
class OSVAffected(BaseModel):
package: OSVPackage
ranges: list[OSVRange]
2023-03-06 04:49:20 +00:00
versions: Optional[list[str]]
ecosystem_specific: Optional[OSVEcosystemSpecific]
database_specific: Optional[OSVAffectedDatabaseSpecific]
2023-02-04 23:24:31 +00:00
class OSVReference(BaseModel):
type: str
url: str
class OSVCredit(BaseModel):
name: str
2023-02-04 23:35:47 +00:00
contact: list[str] = None
2023-02-04 23:24:31 +00:00
class OSVDatabaseSpecific(BaseModel):
pass
class OSVAdvisory(BaseModel):
schema_version: str = "1.3.1"
id: str
modified: str
published: str
withdrawn: Optional[str]
aliases: list[str]
2023-03-06 04:49:20 +00:00
related: Optional[list[str]]
2023-02-04 23:24:31 +00:00
summary: str
details: str
2023-03-06 04:49:20 +00:00
severity: Optional[list[OSVSeverity]]
2023-02-04 23:24:31 +00:00
affected: list[OSVAffected]
references: list[OSVReference]
credits: list[OSVCredit]
database_specific: Optional[OSVDatabaseSpecific]
2023-02-04 23:24:31 +00:00
2023-02-04 23:35:47 +00:00
def to_osv_advisory(ui_url: str, advisory: Advisory) -> OSVAdvisory:
2023-02-04 23:24:31 +00:00
affected_pkgs = []
2023-02-05 01:14:58 +00:00
vendors = []
2023-02-04 23:24:31 +00:00
pkg_name_map = {}
for pkg in advisory.packages:
2023-02-05 01:14:58 +00:00
if pkg.supported_product.vendor not in vendors:
vendors.append(pkg.supported_product.vendor)
nevra = NEVRA_RE.search(pkg.nevra)
name = nevra.group(1)
arch = nevra.group(5).lower()
2023-02-05 00:18:46 +00:00
product_name = slugify(pkg.product_name)
2023-02-04 23:24:31 +00:00
if pkg.supported_products_rh_mirror:
2023-03-06 05:09:42 +00:00
product_name = f"{pkg.supported_product.variant}:{pkg.supported_products_rh_mirror.match_major_version}"
2023-02-05 00:18:46 +00:00
if product_name not in pkg_name_map:
pkg_name_map[product_name] = {}
2023-02-05 01:14:58 +00:00
if arch not in pkg_name_map[product_name]:
pkg_name_map[product_name][arch] = {}
if name not in pkg_name_map[product_name][arch]:
pkg_name_map[product_name][arch][name] = []
2023-02-04 23:24:31 +00:00
2023-02-05 01:14:58 +00:00
pkg_name_map[product_name][arch][name].append((pkg, nevra))
2023-02-04 23:24:31 +00:00
processed_nvra = {}
2023-02-05 01:14:58 +00:00
for product_name, arches in pkg_name_map.items():
2023-03-06 04:49:20 +00:00
for _, affected_arches in arches.items():
2023-02-05 01:14:58 +00:00
if not affected_arches:
2023-02-04 23:24:31 +00:00
continue
2023-02-05 01:14:58 +00:00
for pkg_name, affected_packages in affected_arches.items():
for pkg in affected_packages:
x = pkg[0]
nevra = pkg[1]
2023-03-06 04:49:20 +00:00
# Only process "src" packages
if nevra.group(5) != "src":
continue
if x.nevra in processed_nvra:
continue
processed_nvra[x.nevra] = True
2023-02-05 01:14:58 +00:00
ver_rel = f"{nevra.group(3)}-{nevra.group(4)}"
slugified = slugify(x.supported_product.variant)
slugified_distro = slugify(x.product_name)
for arch_, _ in arches.items():
slugified_arch = f"-{slugify(arch_)}"
slugified_distro = slugified_distro.replace(
slugified_arch,
"",
)
epoch = nevra.group(2)
2023-03-06 04:49:20 +00:00
purl = f"pkg:rpm/{slugified}/{pkg_name}@{ver_rel}?distro={slugified_distro}&epoch={epoch}"
2023-02-05 01:14:58 +00:00
affected = OSVAffected(
package=OSVPackage(
ecosystem=product_name,
name=pkg_name,
purl=purl,
),
ranges=[
OSVRange(
type="ECOSYSTEM",
events=[
OSVEvent(introduced="0"),
OSVEvent(fixed=ver_rel),
],
2023-03-06 04:49:20 +00:00
database_specific=OSVRangeDatabaseSpecific(
yum_repository=x.repo_name,
),
2023-02-05 01:14:58 +00:00
)
2023-02-04 23:24:31 +00:00
],
2023-03-06 04:49:20 +00:00
versions=None,
ecosystem_specific=None,
database_specific=None,
2023-02-04 23:24:31 +00:00
)
2023-03-06 04:49:20 +00:00
affected_pkgs.append(affected)
2023-02-04 23:24:31 +00:00
2023-02-04 23:35:47 +00:00
references = [
OSVReference(type="ADVISORY", url=f"{ui_url}/{advisory.name}"),
]
for fix in advisory.fixes:
references.append(OSVReference(type="REPORT", url=fix.source))
osv_credits = [OSVCredit(name=x) for x in vendors]
if advisory.red_hat_advisory:
osv_credits.append(OSVCredit(name="Red Hat"))
2023-03-06 04:49:20 +00:00
# Calculate severity by finding the highest CVSS score
highest_cvss_base_score = 0.0
final_score_vector = None
for x in advisory.cves:
# Convert cvss3_scoring_vector to a float
base_score = x.cvss3_base_score
if base_score and base_score != "UNKNOWN":
base_score = float(base_score)
if base_score > highest_cvss_base_score:
highest_cvss_base_score = base_score
final_score_vector = x.cvss3_scoring_vector
severity = None
if final_score_vector:
severity = [OSVSeverity(type="CVSS_V3", score=final_score_vector)]
2023-02-04 23:24:31 +00:00
return OSVAdvisory(
id=advisory.name,
modified=to_rfc3339_date(advisory.updated_at),
published=to_rfc3339_date(advisory.published_at),
withdrawn=None,
aliases=[x.cve for x in advisory.cves],
2023-03-06 04:49:20 +00:00
related=None,
2023-02-04 23:24:31 +00:00
summary=advisory.synopsis,
details=advisory.description,
2023-03-06 04:49:20 +00:00
severity=severity,
2023-02-04 23:24:31 +00:00
affected=affected_pkgs,
2023-02-04 23:35:47 +00:00
references=references,
credits=osv_credits,
database_specific=None,
2023-02-04 23:24:31 +00:00
)
2023-03-06 04:49:20 +00:00
@router.get("/", response_model=Pagination[OSVAdvisory], response_model_exclude_none=True)
2023-02-04 23:24:31 +00:00
async def get_advisories_osv(
params: Params = Depends(),
product: Optional[str] = None,
before: Optional[str] = None,
after: Optional[str] = None,
cve: Optional[str] = None,
synopsis: Optional[str] = None,
keyword: Optional[str] = None,
severity: Optional[str] = None,
):
fetch_adv = await fetch_advisories(
params.get_size(),
params.get_offset(),
keyword,
product,
before,
after,
cve,
synopsis,
severity,
2023-03-06 04:49:20 +00:00
kind="Security",
2023-02-04 23:24:31 +00:00
fetch_related=True,
)
count = fetch_adv[0]
advisories = fetch_adv[1]
2023-02-04 23:35:47 +00:00
ui_url = await get_setting(UI_URL)
osv_advisories = [to_osv_advisory(ui_url, x) for x in advisories]
2023-02-04 23:24:31 +00:00
return create_page(osv_advisories, count, params)
2023-02-04 23:35:47 +00:00
2023-03-06 04:49:20 +00:00
@router.get("/{advisory_id}", response_model=OSVAdvisory, response_model_exclude_none=True)
2023-02-04 23:35:47 +00:00
async def get_advisory_osv(advisory_id: str):
2023-03-23 11:59:33 +00:00
advisory = await Advisory.filter(name=advisory_id, kind="Security").prefetch_related(
2023-02-04 23:35:47 +00:00
"packages",
"cves",
"fixes",
"affected_products",
"packages",
"packages__supported_product",
"packages__supported_products_rh_mirror",
).get_or_none()
if not advisory:
raise HTTPException(404)
ui_url = await get_setting(UI_URL)
return to_osv_advisory(ui_url, advisory)