1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18 package org.owasp.dependencycheck.data.nvdcve;
19
20 import io.github.jeremylong.openvulnerability.client.nvd.Config;
21 import java.util.stream.Collectors;
22 import org.owasp.dependencycheck.data.nvd.ecosystem.Ecosystem;
23
24 import io.github.jeremylong.openvulnerability.client.nvd.DefCveItem;
25 import io.github.jeremylong.openvulnerability.client.nvd.LangString;
26 import io.github.jeremylong.openvulnerability.client.nvd.Node;
27 import java.util.List;
28 import org.owasp.dependencycheck.dependency.VulnerableSoftware;
29
30
31
32
33
34
35
36
37 public class CveItemOperator {
38
39
40
41
42
43 private final String cpeStartsWithFilter;
44
45
46
47
48
49
50 public CveItemOperator(String cpeStartsWithFilter) {
51 this.cpeStartsWithFilter = cpeStartsWithFilter;
52 }
53
54
55
56
57
58
59
60 public String extractDescription(DefCveItem cve) {
61 return cve.getCve().getDescriptions().stream().filter((desc)
62 -> "en".equals(desc.getLang())).map(LangString::getValue).collect(Collectors.joining(" "));
63 }
64
65
66
67
68
69
70
71
72
73
74
75
76 private String extractEcosystem(String baseEcosystem, String vendor, String product, String targetSw) {
77
78
79
80
81 if (("mysql".equals(vendor) && "mysql".equals(product))
82 || ("postgresql".equals(vendor) && "postgresql".equals(product))
83 || ("picketlink".equals(vendor) && "picketlink".equals(product))
84 || ("libxl_project".equals(vendor) && "libxl".equals(product))
85 || ("ocaml".equals(vendor) && "postgresql-ocaml".equals(product))
86 || ("curses_project".equals(vendor) && "curses".equals(product))
87 || ("dalekjs".equals(vendor) && "dalekjs".equals(product))
88 || ("microsoft".equals(vendor) && "internet_explorer".equals(product))
89 || ("jenkins".equals(vendor) && "ssh_credentials".equals(product))
90 || ("kubernetes".equals(vendor) && "kubernetes".equals(product))
91 || ("gnome".equals(vendor) && "nautilus-python".equals(product))
92 || ("apache".equals(vendor) && "qpid_proton".equals(product))
93 || ("mysql-ocaml".equals(vendor) && "mysql-ocaml".equals(product))
94 || ("google".equals(vendor) && "chrome".equals(product))
95 || ("canonical".equals(vendor) && "ltsp_display_manager".equals(product))
96 || ("gnome".equals(vendor) && "vala".equals(product))
97 || ("apple".equals(vendor) && "safari".equals(product))
98 || ("mapbox".equals(vendor) && "npm-test-sqlite3-trunk".equals(product))
99 || ("apple".equals(vendor) && "webkit".equals(product))
100 || ("mozilla".equals(vendor) && "firefox".equals(product))
101 || ("apache".equals(vendor) && "thrift".equals(product))
102 || ("apache".equals(vendor) && "qpid".equals(product))
103 || ("mozilla".equals(vendor) && "thunderbird".equals(product))
104 || ("mozilla".equals(vendor) && "firefox_esr".equals(product))
105 || ("redhat".equals(vendor) && "jboss_amq_clients_2".equals(product))
106 || ("node-opencv_project".equals(vendor) && "node-opencv".equals(product))
107 || ("mozilla".equals(vendor) && "seamonkey".equals(product))
108 || ("mozilla".equals(vendor) && "thunderbird_esr".equals(product))
109 || ("mnet_soft_factory".equals(vendor) && "nodemanager_professional".equals(product))
110 || ("mozilla".equals(vendor) && "mozilla_suite".equals(product))
111 || ("theforeman".equals(vendor) && "hammer_cli".equals(product))
112 || ("ibm".equals(vendor) && "websphere_application_server".equals(product))
113 || ("sap".equals(vendor) && "hana_extend_application_services".equals(product))
114 || ("apache".equals(vendor) && "zookeeper".equals(product))) {
115 return null;
116 }
117
118 if ("ibm".equals(vendor)
119 && "java".equals(product)) {
120 return Ecosystem.NATIVE;
121 }
122
123 if ("oracle".equals(vendor)
124 && "vm".equals(product)) {
125 return Ecosystem.NATIVE;
126 }
127 switch (targetSw) {
128 case "asp.net":
129 case "c#":
130 case ".net":
131 case "dotnetnuke":
132 return Ecosystem.DOTNET;
133 case "android":
134 case "java":
135 return Ecosystem.JAVA;
136 case "c/c++":
137 case "borland_c++":
138 case "visual_c++":
139 case "gnu_c++":
140 case "linux_kernel":
141 case "linux":
142 case "unix":
143 case "suse_linux":
144 case "redhat_enterprise_linux":
145 case "debian":
146 return Ecosystem.NATIVE;
147 case "coldfusion":
148 return Ecosystem.COLDFUSION;
149 case "ios":
150 case "iphone":
151 case "ipad":
152 case "iphone_os":
153 return Ecosystem.IOS;
154 case "jquery":
155 return Ecosystem.JAVASCRIPT;
156 case "node.js":
157 case "nodejs":
158 return Ecosystem.NODEJS;
159 case "perl":
160 return Ecosystem.PERL;
161 case "joomla!":
162 case "joomla":
163 case "mybb":
164 case "simplesamlphp":
165 case "craft_cms":
166 case "moodle":
167 case "phpcms":
168 case "buddypress":
169 case "typo3":
170 case "php":
171 case "wordpress":
172 case "drupal":
173 case "mediawiki":
174 case "symfony":
175 case "openpne":
176 case "vbulletin3":
177 case "vbulletin4":
178 return Ecosystem.PHP;
179 case "python":
180 return Ecosystem.PYTHON;
181 case "ruby":
182 return Ecosystem.RUBY;
183 }
184 return baseEcosystem;
185 }
186
187
188
189
190
191
192
193
194
195
196 public String extractEcosystem(String baseEcosystem, VulnerableSoftware parsedCpe) {
197 return extractEcosystem(baseEcosystem, parsedCpe.getVendor(), parsedCpe.getProduct(), parsedCpe.getTargetSw());
198 }
199
200
201
202
203
204
205
206
207 public boolean isRejected(String description) {
208 return description.startsWith("** REJECT **") || description.startsWith("DO NOT USE THIS CANDIDATE NUMBER");
209 }
210
211
212
213
214
215
216
217
218
219 protected boolean testCveCpeStartWithFilter(final DefCveItem cve) {
220 if (cve.getCve().getConfigurations() != null) {
221
222 return cve.getCve().getConfigurations().stream()
223 .map(Config::getNodes)
224 .flatMap(List::stream)
225 .map(Node::getCpeMatch)
226 .flatMap(List::stream)
227 .filter(cpe -> cpe.getCriteria() != null)
228 .anyMatch(cpe -> cpe.getCriteria().startsWith(cpeStartsWithFilter));
229 }
230 return false;
231 }
232 }