aboutsummaryrefslogtreecommitdiffstats
path: root/lib/srtgui/views.py
AgeCommit message (Collapse)Author
2020-01-26srtool: inherit comments to new vulnerabilitys and investigationsSRTOOL_DJANGO_1_11David Reyna
When creating a new Vulnerability or Investigation, inherit the parent object's (CVE/Vulnerability) "comments" field. Signed-off-by: David Reyna <David.Reyna@windriver.com>
2020-01-21srtool: add publishing, update backup scanning, MITRE init fixDavid Reyna
Add CVE publishing features, specifically add a method to generate CVE status across the releases, filterable by CVE status. Add dynamic schema calculations for the backup database snapshots, to enable difference scanning even when the schema has been reordered after a migration. Add first part of database difference scanning code migration. Fix MITRE scanning for new source files. [YOCTO #13734] Signed-off-by: David Reyna <David.Reyna@windriver.com>
2020-01-12Bug 13734 - cumulative deployment features and fixesDavid Reyna
srtool: cumulative deployment features and fixes High level new features: * Publishing support to external/public databases * Ability to label products as "active", "inactive", "under development" Inactive (EOL) products appear but * Do not affect status propagation * Do not auto-create defects Development product status is not exported to pubic database * Extend NIST download range to 2002..2019 * Added MITRE downloads to provide RESERVED tracking * Extended audit history tracking and meta-data * Delete CVE records * Ability to do "OR" searches (default is "AND") Example: "CVE-2019-20095 OR CVE-2019-20096 OR CVE-2019-19977" * Automated defect creation (Jira) If selected, creates customer defect for selected and active products Reuse existing defect if present for given product * Many small sorting, readability, edge case fixes Backups: * Add meta-data stamp file for each backup * Save daily backups with day name instead of day number * Preserve file dates when making copies to backup * Add list command Automated Updates: * Fix report format * Add trial run test Utilities: * Add 13 new database fix up procedures Some are one-shot historical fixes, some are learned validation checks Database Schema: * Add "SRTool" class to wrap shared enumerations (e.g. Priority) * Add "Update" class to tag and track audit trail objects * Change Priority naming to match CVE model instead of JIRA * Add srt_created/srt_updated to CVE/Vul/Inv/Notify for improved updating and auditing * Add to Defect the SRT versions of Status, Priority, Outcome To distinguish these from the customer's defect system's values Common Tools: * Fix new CVE auto-scoring to skip CVE's already scored (though still NEW) * Add automated propagation of Defects/Investigations status to parent Vulnerabilities See "srtool_common.py" for rule details CVEs: * Add MITRE as an automatic upstream source This is to specifically capture all of the "RESERVED" CVE enumerations which will not appear in the MIST databases, and have the CVE records in place for internal investigations and transitions to "public" status. * Spell out the command arguments in the NIST data source files for greater legibility * Change Priority naming to match CVE instead of JIRA * Add parallel status states for "inactive" products This specifically blocks state propagation from inactive objects to active objects NIST management script: * Refactor file for greater clarity * Reorder methods to reflect workflow order * Fully spell out names of objects * Remove temporary holding class "CVE" in favor of dictionary objects * Debugging enhancements * Incremental update commands for stepped debugging For example, ability to fetch/update specific CVE(s) * Additional debugging flags [YOCTO #13734] Signed-off-by: David Reyna <David.Reyna@windriver.com>
2019-02-09srtool_investigation: list investigation defects and statusDavid Reyna
In the Investigation page, explicilty list the attached defects and their status (and controls) for clarity and simplicity. Signed-off-by: David Reyna <David.Reyna@windriver.com>
2019-01-31srtool_cve: add multiple cve attach to a vulnerabilityDavid Reyna
Add these features: * Allow attaching multiple Vulnerabilities to a CVE * Allow attaching existing Vulnerability to a CVE * Allow attaching multiple triaged CVEs to a Vulnerability Revert change to to execute_process. Some routines that use this method already apply a "decode()", and you cannot do two decodes on an object. Signed-off-by: David Reyna <David.Reyna@windriver.com>
2019-01-29srtool_email: update email values, error handlingDavid Reyna
Various updates and fixes: * Use the new SRT_EMAIL_* variable names * Fix hardcoded value for 'from' address * Add additional error handling * Allow the email settings to be defined in SrtSetting values, and provide example in the ACME datasource file Signed-off-by: David Reyna <David.Reyna@windriver.com>
2019-01-15views: use subprocess directlyRoss Burton
2019-01-14srtool: updates cleanup #2David Reyna
Clean up after pull from RBurton pylint updates * Protect against missing CVE lookup call * Protect against disabled defect tool when creating defects * Repair CVE 'score_date' data field default * Update tool typos for formatting Signed-off-by: David Reyna <David.Reyna@windriver.com>
2019-01-14srtgui: pylint-inspired cleanupsRoss Burton
- Fix whitespace - Remove redundant imports - Remove redundant semicolons - Remove redundant try/except - Remove redundant super()
2019-01-07srtool: set priority/components new defect from investigationDavid Reyna
Add pulldown to set a new defect's priority and components in in the Investigation screen. Clean up the data passing from the srtool_defect* call. Signed-off-by: David Reyna <David.Reyna@windriver.com>
2019-01-04srttool: include missing CVE reference informationDavid Reyna
The CVE 'resource' and 'source' values for the CVE references are now scanned and displayed. * The JSON scanning has been moved away from CveResources to a dynamic value in the CveDetail record, similar to the CPE table processing. * Additional debugging support has been added * The now unused CveResources table will be deleted in a later revision [YOCTO #13121] Signed-off-by: David Reyna <David.Reyna@windriver.com>
2019-01-01srtool: parameterize the defect new callDavid Reyna
Change the new defect call to use named parameters. This will enhance the readability and better allow for future changes. Also, pass the CVE list and defect 'reason' so that the defect integation tool can use that for the defect record and/or use in creating its own version of the defect 'summary'. Signed-off-by: David Reyna <David.Reyna@windriver.com>
2018-12-30srtool: add defect create from investigationsDavid Reyna
Enable the feature of creating defects from investigations. Consolidate into one defect creation method for both investigations and CVE triage. Enhance the "srtool_defect.py" sample tools to simulate creating new defects. Fix the sample "srtool_jira.py" tool new defect creation to support the new "defect_tag" variable. Signed-off-by: David Reyna <David.Reyna@windriver.com>
2018-12-30srtool: replace 'toaster_render' with 'managedcontextprocessor'David Reyna
The 'toaster_render' was intended to define global context values. That feature is better provided by the existing 'managedcontextprocessor'. Signed-off-by: David Reyna <David.Reyna@windriver.com>
2018-12-30srtool: fix url patterns for master appDavid Reyna
Update the 'urlpatterns' processing to use the master app. Also, update the YP master app to include a url and view class, plus provide a default YP landing page, and abtract the default logo display. Signed-off-by: David Reyna <David.Reyna@windriver.com>
2018-12-29srtool: generalize the master app (yp, acme, ...) managementDavid Reyna
The SRTool allows users to substitute an alternate master application instead of the default "yp" in order to customize their instance to their organization. This is done by: (a) Creating a datasource directory under bin (b) Defining a "datasource.json" file (c) Defining 'export SRT_MAIN_APP="<app>"' in "srtool_env.sh" This environment files are scanned by 'bin/srt', and if such an alternate master app is found it pre-empts the default 'yp'. This value is set via the environment because "lib/srtmain/settings.py" is the file that sets the app (and this the URL) ordering, and it is processed before any database is attached. To disable the alternate main app, simply rename its "datasource.json" file and it will be ignored for the next start. The sample alternate app "acme" is provided to demonstrate this facility. Additionally, a development tool 'bin/dev_tools/master_app.sh' has been added to help switch between master apps, to aid testing. $ ./stop.sh $ ./master_app.sh acme $ ./start.sh ... test ... $ ./stop.sh $ ./master_app.sh yp $ ./start.sh Other included fixes: * Fix the ACME JSON files formating * Remove ACME "_sample" from all but "datasource.json_sample" * Fix tabs to spaces in "srt" * Add global contect values to views::managedcontextprocessor so that other app templates can share them Signed-off-by: David Reyna <David.Reyna@windriver.com>
2018-12-21srtool: fix pylint reported issuesDavid Reyna
[YOCTO #13093] Signed-off-by: David Reyna <David.Reyna@windriver.com>
2018-12-19views: use Django 2's django.urls.resolveRoss Burton
2018-12-18lib: fix typo in get_name_sortRoss Burton
Ideally, these are all centralised.
2018-12-17srtool: port to Django-2.xDavid Reyna
Support Django-2.2: Move 'django.core.urlresolvers' to 'django.urls' Disable 'register.assignment_tag' tags Move settings 'MIDDLEWARE_CLASSES' to 'MIDDLEWARE' Move urlpatterns 'include' to 'path' Move 'regex.pattern' to 'pattern.regex.pattern' Maintain Django-1.11 support General Fixes: Fix commit for notify_categories Add more error halt checks during lsupdates Add explicit 'on_delete=models.CASCADE' for all ForeignKey's Fix 'get_defect_tag' processing [YOCTO #13091] Signed-off-by: David Reyna <David.Reyna@windriver.com>
2018-12-13srtool: cummulative update 12/13/2018David Reyna
Changes: Repartition the data sources Reconfigure the data sources into self-contained directories under the "bin" directory. Implement dynamic data source discovery and import Remove all hard coded data source data (e.g. fixtures, data, CVE lookups) Add license files to all data sources Django User model Add "users" Django application dir Login page Self create user account page Password change page User access and delete management CVE Name sorting by hidden 'name_sort' field (CVE-nnnn-0nnnnnn) CVE Triage Auto import reserved CVEs Add MITRE CVE records where NIST missing Add data source count to triage page Easy checkbox toggle by clicking any field Triage any CVE status category (not just new) Assign to any CVE status category Object create/delete Create/Delete Vulnerablities Create/Delete Investigations from Vulnerablity page Add "Historical" CVE status When bootstraping system, all CVEs older than 60 days preset to "Historical" Add CVEs withint 60 days preset to "New" Can be overridden by defect and systaining status imports Preadd Debian data for "New" CVEs Abstraction Add generic Product mappings to defect system ("defect_tag": defect prefix) Add generic Product mappings to product system ("product_tag": product reference, related) Manage functions via "srt" script For example add superuser Normalize Vulnerability to Investigation mapping Replace orm_vulnerabilityproduct with orm_vulnerabilitytoinvestigation General Enable the 'srtool-requirements.txt' Django test Speed the CVE scoring by pre-fetching the datasources Progress display cleanup Move and update srtool_defect prototype to 'bin/yp' Signed-off-by: David Reyna <David.Reyna@windriver.com>
2018-10-09srtool: change list for non-vulnerable CVE's, errant messageDavid Reyna
Add the change list alert for non-vulnerable CVE triage. Fix the mistaken error message from srtool_common.py. Signed-off-by: David Reyna <David.Reyna@windriver.com>
2018-09-27srtool: cummulative update 9/27/2018David Reyna
Changes: * Local CVE rename support * Fix CVE edit submit * Move tools links to topbar * Fix year extraction * Add is_local flag for CVEs * Revise local CVE naming * Common page header class for inline buttons * Fix url links for named inv/vul URLs Signed-off-by: David Reyna <David.Reyna@windriver.com>
2018-09-24srtool: edit local CVE namesDavid Reyna
Add the ability to edit the names for local CVE's. This can specifically be used to create placeholders for reserved CVEs (which are not included in the NIST data) and then download the data from the alternate CVE sources. Signed-off-by: David Reyna <David.Reyna@windriver.com>
2018-09-22srtool: cumulative update 9/20/2018David Reyna
Summary: * CVE management enhancements * Lookup Mitre, Red Hat, Debian * Local CVE's * Edit CVE's * CVE triage: create defects and notifications * Packages * Table, packages to C/V/I/D * Filter model update * Triage filtering script * Notifications * Upstream CVE changes * Upstream defect changes * Notices and reminders * Creation * Emails * Productization * Move DataSource to Init/Update/Lookup model * Add defect details to Management home page * Add author to notification records * Move fixture data and SrtSettings to JSON files * database column mappings for scripts generated directly from database * srtool_utils.py: add [backup|restore]_cve_packages Signed-off-by: David Reyna <David.Reyna@windriver.com>
2018-08-11Various fixes.David Reyna
* Improve the CVE detail caching * Fix the "_FALLBACK" settings management * Fix the YP "samples" fixture file * Rename "srtool_cve.py" as "srtool_nist.cy" Signed-off-by: David Reyna <David.Reyna@windriver.com>
2018-08-10Cummulative development update August 2018David Reyna
* Add incremental NIST scans and import to CVE database * Add modified NIST scans and import to CVE database * Moved CVE details out of SRTool database to reduce size * Add CVE details lookup in cached CVE upstream files * Added edit support for Vulnerabilies and Investigations * Comments * Attachments and downloads * Product list * History audit trail * Add Vulnerability and Investigation creation from CVE triage * Add user id to session variables * Add defect import placeholder script * Modularize the fixture files for common versus site-specific setup Signed-off-by: Moayer, Puya <Puya.Moayer@windriver.com> Signed-off-by: David Reyna <David.Reyna@windriver.com>
2018-06-05update default user, rename WR tab to 'Local'David Reyna
Signed-off-by: David Reyna <David.Reyna@windriver.com>
2018-06-05fix empty CVE list, Non-vulnerable split, no selected productsDavid Reyna
Signed-off-by: David Reyna <David.Reyna@windriver.com>
2018-06-04Implement CVE triage, change History tablesDavid Reyna
Signed-off-by: David Reyna <David.Reyna@windriver.com>
2018-05-21Fix WR'isms: 'Jira,RCPL,wr_comments' to 'Defect,release_version,comments'David Reyna
Signed-off-by: David Reyna <David.Reyna@windriver.com>
2018-05-15remove WR-isms from template files, update 'toaster' executable to 'srt' ↵David Reyna
executable Signed-off-by: David Reyna <David.Reyna@windriver.com>
2018-05-14Add SRTool updated files version 0.03David Reyna
Signed-off-by: David Reyna <David.Reyna@windriver.com>
2018-05-14rename base SRTool directories, update README filesDavid Reyna
Signed-off-by: David Reyna <David.Reyna@windriver.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-25 11:45:28 +0000