-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Implements the following features: - Allow viewing both resolved and unresolved issues in cve by distribution list - Display of cve context in cve details Part of gardenlinux/glvd#127
- Loading branch information
Showing
7 changed files
with
198 additions
and
11 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,75 @@ | ||
| package io.gardenlinux.glvd.db; | ||
|
|
||
| import jakarta.persistence.Column; | ||
| import jakarta.persistence.Entity; | ||
| import jakarta.persistence.Id; | ||
| import jakarta.persistence.Table; | ||
|
|
||
| import java.util.List; | ||
|
|
||
| @Entity | ||
| @Table(name = "cve_context") | ||
| public class CveContext { | ||
| @Id | ||
| @Column(name = "cve_id", nullable = false) | ||
| private String cveId; | ||
|
|
||
| @Column(name = "dist_id", nullable = false) | ||
| private String distId; | ||
|
|
||
| @Column(name = "create_date", nullable = false) | ||
| private String createDate; | ||
|
|
||
| @Column(name = "context_descriptor", nullable = false) | ||
| private String contextDescriptor; | ||
|
|
||
| @Column(name = "score_override", nullable = true) | ||
| private Float scoreOverride; | ||
|
|
||
| @Column(name = "description", nullable = true) | ||
| private String description; | ||
|
|
||
| @Column(name = "is_resolved", nullable = true) | ||
| private Boolean isResolved; | ||
|
|
||
| public CveContext() { | ||
| } | ||
|
|
||
| public CveContext(String cveId, String distId, String createDate, String contextDescriptor, Float scoreOverride, String description, Boolean isResolved) { | ||
| this.cveId = cveId; | ||
| this.distId = distId; | ||
| this.createDate = createDate; | ||
| this.contextDescriptor = contextDescriptor; | ||
| this.scoreOverride = scoreOverride; | ||
| this.description = description; | ||
| this.isResolved = isResolved; | ||
| } | ||
|
|
||
| public String getCveId() { | ||
| return cveId; | ||
| } | ||
|
|
||
| public String getDistId() { | ||
| return distId; | ||
| } | ||
|
|
||
| public String getCreateDate() { | ||
| return createDate; | ||
| } | ||
|
|
||
| public String getContextDescriptor() { | ||
| return contextDescriptor; | ||
| } | ||
|
|
||
| public Float getScoreOverride() { | ||
| return scoreOverride; | ||
| } | ||
|
|
||
| public String getDescription() { | ||
| return description; | ||
| } | ||
|
|
||
| public Boolean getResolved() { | ||
| return isResolved; | ||
| } | ||
| } |
12 changes: 12 additions & 0 deletions
12
src/main/java/io/gardenlinux/glvd/db/CveContextRepository.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| package io.gardenlinux.glvd.db; | ||
|
|
||
| import org.springframework.data.jpa.repository.JpaRepository; | ||
| import org.springframework.data.repository.query.Param; | ||
|
|
||
| import java.util.List; | ||
|
|
||
| public interface CveContextRepository extends JpaRepository<CveContext, String> { | ||
| List<CveContext> findByCveId( | ||
| @Param("cve_id") String cve_id | ||
| ); | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
56 changes: 56 additions & 0 deletions
56
src/main/resources/templates/getCveForDistributionAll.html
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| <!DOCTYPE HTML> | ||
| <html xmlns:th="http://www.thymeleaf.org"> | ||
| <head> | ||
| <title>GLVD: List vulnerabilities in distro</title> | ||
| <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> | ||
| <link href="style.css" rel="stylesheet" media="screen" /> | ||
| </head> | ||
| <body> | ||
| <h1 th:text="|Vulnerabilities list for Garden Linux ${gardenlinuxVersion} (showing resolved issues)|" /> | ||
|
|
||
| <p th:text="|Found ${#lists.size(sourcePackageCves)} potential security issues|"></p> | ||
|
|
||
| <a th:href="@{/getCveForDistribution(gardenlinuxVersion=${gardenlinuxVersion},onlyVulnerable=true)}">Show only unresolved potential issues</a> | ||
|
|
||
| <table> | ||
| <thead> | ||
| <tr> | ||
| <th>CVE ID | ||
| <a th:href="@{/getCveForDistributionAll(gardenlinuxVersion=${gardenlinuxVersion},sortBy=cveId,sortOrder=ASC,onlyVulnerable=false)}">↑</a> | ||
| <a th:href="@{/getCveForDistributionAll(gardenlinuxVersion=${gardenlinuxVersion},sortBy=cveId,sortOrder=DESC,onlyVulnerable=false)}">↓</a> | ||
| </th> | ||
|
|
||
| <th>CVE Base Score | ||
| <a th:href="@{/getCveForDistributionAll(gardenlinuxVersion=${gardenlinuxVersion},sortBy=baseScore,sortOrder=ASC,onlyVulnerable=false)}">↑</a> | ||
| <a th:href="@{/getCveForDistributionAll(gardenlinuxVersion=${gardenlinuxVersion},sortBy=baseScore,sortOrder=DESC,onlyVulnerable=false)}">↓</a> | ||
| </th> | ||
|
|
||
| <th>Vector String</th> | ||
|
|
||
| <th>CVE Published Date | ||
| <a th:href="@{/getCveForDistributionAll(gardenlinuxVersion=${gardenlinuxVersion},sortBy=cvePublishedDate,sortOrder=ASC,onlyVulnerable=false)}">↑</a> | ||
| <a th:href="@{/getCveForDistributionAll(gardenlinuxVersion=${gardenlinuxVersion},sortBy=cvePublishedDate,sortOrder=DESC,onlyVulnerable=false)}">↓</a> | ||
| </th> | ||
|
|
||
| <th>Source Package | ||
| <a th:href="@{/getCveForDistributionAll(gardenlinuxVersion=${gardenlinuxVersion},sortBy=sourcePackageName,sortOrder=ASC,onlyVulnerable=false)}">↑</a> | ||
| <a th:href="@{/getCveForDistributionAll(gardenlinuxVersion=${gardenlinuxVersion},sortBy=sourcePackageName,sortOrder=DESC,onlyVulnerable=false)}">↓</a> | ||
| </th> | ||
|
|
||
| <th>Version</th> | ||
| <th>Is Vulnerable?</th> | ||
| </tr> | ||
| </thead> | ||
| <tr th:each="item: ${sourcePackageCves}"> | ||
| <td><a th:href="@{/getCveDetails(cveId=${item.cveId})}"> <div th:text="${item.cveId}"/> </a></td> | ||
| <td th:text="${item.baseScore}" /> | ||
| <td th:text="${item.vectorString}" /> | ||
| <td th:text="${item.cvePublishedDate}" /> | ||
| <td th:text="${item.sourcePackageName}" /> | ||
| <td th:text="${item.sourcePackageVersion}" /> | ||
| <td th:text="${item.isVulnerable}" /> | ||
| </tr> | ||
| </table> | ||
|
|
||
| </body> | ||
| </html> |