aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDavid Reyna <David.Reyna@windriver.com>2019-02-19 17:52:11 -0800
committerDavid Reyna <David.Reyna@windriver.com>2019-02-19 17:52:11 -0800
commitf31c18ff2e87589793f3d6a097dc3e960ae1b0b4 (patch)
tree5fa51b909aa39230b57f39fa67071a01e3ff46f1
parentafd9ac752d88a192a043725ae8bc932e2d703888 (diff)
downloadsrtool-f31c18ff2e87589793f3d6a097dc3e960ae1b0b4.tar.gz
srtool-f31c18ff2e87589793f3d6a097dc3e960ae1b0b4.tar.bz2
srtool-f31c18ff2e87589793f3d6a097dc3e960ae1b0b4.zip
srtool_report: add CVE to defects report
Add a report lists the Vulnerabilities, Investigations, and Defects (plus status) for the givne list of CVEs. Example: 1) Open the CVEs table 2) Search for this string: "CVE-2017-5715 OR CVE-2017-5753 OR CVE-2017-5754" 3) Click Export * Select the new report "CVE to Defects Table". You can leave the rest of the settings alone. * Click "Generate and Download Report" * Open the report CSV file in your text editor or in Excel. Signed-off-by: David Reyna <David.Reyna@windriver.com>
-rw-r--r--lib/orm/models.py3
-rw-r--r--lib/srtgui/api.py5
-rw-r--r--lib/srtgui/reports.py119
-rw-r--r--lib/srtgui/tables.py1
-rw-r--r--lib/srtgui/templates/cves-toastertable.html2
5 files changed, 124 insertions, 6 deletions
diff --git a/lib/orm/models.py b/lib/orm/models.py
index 29ef88dc..0f6cfb17 100644
--- a/lib/orm/models.py
+++ b/lib/orm/models.py
@@ -584,7 +584,8 @@ class Product(models.Model):
unique_together = ('name', 'version', 'profile', )
@property
def long_name(self):
- return '%s %s %s' % (self.name,self.version,self.profile)
+ long_name = '%s %s %s' % (self.name,self.version,self.profile)
+ return long_name.strip()
def get_defect_tag(self,tag):
dict = json.loads(self.defect_tags)
try:
diff --git a/lib/srtgui/api.py b/lib/srtgui/api.py
index b3e15acc..16ff88b0 100644
--- a/lib/srtgui/api.py
+++ b/lib/srtgui/api.py
@@ -296,6 +296,11 @@ def summaryCveDetails(cve,cve_sources):
cve_detail.name = cve.name
cve_html = {}
+ # No data sources
+ if not cve_main:
+ return cve_detail,cve_html
+
+ # Merge the data into summary record
summaryMerge(cve_detail,cve_main,cve_local,cve_html,'description')
summaryMerge(cve_detail,cve_main,cve_local,cve_html,'cve_data_format')
summaryMerge(cve_detail,cve_main,cve_local,cve_html,'lastModifiedDate')
diff --git a/lib/srtgui/reports.py b/lib/srtgui/reports.py
index a7de4ca4..297b885a 100644
--- a/lib/srtgui/reports.py
+++ b/lib/srtgui/reports.py
@@ -659,6 +659,7 @@ class CvesReport(Report):
context['report_type_list'] = '\
<option value="summary">CVEs Table</option> \
+ <option value="cve_defects">CVE to Defects Table</option> \
'
context['report_get_title'] = ''
context['report_recordrange_list'] = '\
@@ -678,7 +679,7 @@ class CvesReport(Report):
'
return context
- def print_row(self,writer,is_header,is_full,cve):
+ def print_row_summary(self,writer,is_header,is_full,cve):
if is_header:
if not is_full:
writer.writerow([
@@ -762,6 +763,99 @@ class CvesReport(Report):
cve.description,
])
+ def print_row_cve_defects(self,writer,mode,is_full,cve,vulnerability,investigation,defect):
+ if 'header' == mode:
+ if not is_full:
+ writer.writerow([
+ 'Name',
+ 'Status',
+ 'Severity (V3)',
+ 'Published',
+ 'Vulnerability',
+ 'Investigation',
+ 'Investigation Product',
+ 'Investigation Priority',
+ 'Investigation Status',
+ 'Investigation Outcome',
+ 'Defect',
+ 'Defect Priority',
+ 'Defect Status',
+ 'Defect resolution',
+ ])
+ else:
+ writer.writerow([
+ 'Name',
+ 'Status',
+ 'Severity (V3)',
+ 'Published',
+ 'Vulnerability',
+ 'Investigation',
+ 'Investigation Product',
+ 'Investigation Priority',
+ 'Investigation Status',
+ 'Investigation Outcome',
+ 'Defect',
+ 'Defect Priority',
+ 'Defect Status',
+ 'Defect resolution',
+ ])
+ elif 'cve' == mode:
+ c2v_list = cve.cve_to_vulnerability.all()
+ if c2v_list:
+ for cv in c2v_list:
+ v2i_list = cv.vulnerability.vulnerability_investigation.all()
+ if v2i_list:
+ for investigation in v2i_list:
+ i2d_list = investigation.investigation_to_defect.all()
+ if i2d_list:
+ for i2d in investigation.investigation_to_defect.all():
+ self.print_row_cve_defects(writer,'line',is_full,cve,cv.vulnerability,investigation,i2d.defect)
+ else:
+ self.print_row_cve_defects(writer,'line',is_full,cve,cv.vulnerability,investigation,None)
+ else:
+ self.print_row_cve_defects(writer,'line',is_full,cve,cv.vulnerability,None,None)
+ else:
+ self.print_row_cve_defects(writer,'line',is_full,cve,None,None,None)
+ else:
+ if not is_full:
+ writer.writerow([
+ cve.name,
+ cve.get_status_text,
+ '%s %s' % (cve.cvssV3_baseScore,cve.cvssV3_baseSeverity),
+ cve.get_publish_text,
+ vulnerability.name if vulnerability else '<no_vulnerability>',
+ investigation.name if investigation else '',
+ investigation.product.long_name if investigation and investigation.product else '<no_product>',
+ investigation.get_priority_text if investigation else '',
+ investigation.get_status_text if investigation else '',
+ investigation.get_outcome_text if investigation else '',
+ defect.name if defect else '<no_defect>',
+ defect.get_priority_text if defect else '',
+ defect.get_status_text if defect else '',
+ defect.get_resolution_text if defect else '',
+ ])
+ else:
+ writer.writerow([
+ cve.name,
+ cve.get_status_text,
+ '%s %s' % (cve.recommend,cve.recommend_list),
+ cve.cve_data_type,
+ cve.cve_data_format,
+ cve.cve_data_version,
+ '%s %s' % (cve.cvssV3_baseScore,cve.cvssV3_baseSeverity),
+ '%s %s' % (cve.cvssV2_baseScore,cve.cvssV2_severity),
+ cve.get_publish_text,
+ vulnerability.name if vulnerability else '',
+ investigation.name if investigation else '',
+ investigation.get_priority_text if investigation else '',
+ investigation.get_status_text if investigation else '',
+ investigation.get_outcome_text if investigation else '',
+ defect.name if defect else '',
+ defect.get_priority_text if defect else '',
+ defect.get_status_text if defect else '',
+ defect.get_outcome_text if defect else '',
+ ])
+
def exec_report(self, *args, **kwargs):
_log_args("REPORT_CVES_EXEC", *args, **kwargs)
super(CvesReport, self).exec_report(*args, **kwargs)
@@ -786,21 +880,38 @@ class CvesReport(Report):
writer = csv.writer(csvfile, delimiter=delimiter,
quotechar='"', quoting=csv.QUOTE_MINIMAL)
if ('summary' == report_type):
- self.print_row(writer,True,"all" == columns,None)
+ self.print_row_summary(writer,True,"all" == columns,None)
+ if 'displayed' == range:
+ for id in record_list.split(','):
+ if not id:
+ continue
+ cve = Cve.objects.get(id=id)
+ if not name_filter or (name_filter in cve.name):
+ self.print_row_summary(writer,False,"all" == columns,cve)
+ elif 'all' == range:
+ if name_filter:
+ query = Cve.objects.filter(name__contains=name_filter).order_by('name')
+ else:
+ query = Cve.objects.all().order_by('name')
+ for cve in query:
+ self.print_row_summary(writer,False,"all" == columns,cve)
+
+ if ('cve_defects' == report_type):
+ self.print_row_cve_defects(writer,'header',"all" == columns,None,None,None,None)
if 'displayed' == range:
for id in record_list.split(','):
if not id:
continue
cve = Cve.objects.get(id=id)
if not name_filter or (name_filter in cve.name):
- self.print_row(writer,False,"all" == columns,cve)
+ self.print_row_cve_defects(writer,'cve',"all" == columns,cve,None,None,None)
elif 'all' == range:
if name_filter:
query = Cve.objects.filter(name__contains=name_filter).order_by('name')
else:
query = Cve.objects.all().order_by('name')
for cve in query:
- self.print_row(writer,False,"all" == columns,cve)
+ self.print_row_cve_defects(writer,'line',"all" == columns,cve,None,None,None)
return report_name,os.path.basename(report_name)
diff --git a/lib/srtgui/tables.py b/lib/srtgui/tables.py
index 3268e68f..0bfef4e5 100644
--- a/lib/srtgui/tables.py
+++ b/lib/srtgui/tables.py
@@ -1126,6 +1126,7 @@ class ProductsTable(ToasterTable):
self.add_column(title="Order",
field_name="order",
hideable=False,
+ orderable=True,
)
key_link_template = '''
diff --git a/lib/srtgui/templates/cves-toastertable.html b/lib/srtgui/templates/cves-toastertable.html
index d5329713..45dce261 100644
--- a/lib/srtgui/templates/cves-toastertable.html
+++ b/lib/srtgui/templates/cves-toastertable.html
@@ -62,7 +62,7 @@
/* Set the report link */
var record_list=""
- $(".name > a").each(function(){
+ $(".name_sort > a").each(function(){
var this_id=$(this).prop('id');
if (this_id.startsWith("dataid_")) {
record_list +=this_id.replace(/dataid_/,"") + ",";