cve-checker 5.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196
  1. #!/usr/bin/env python
  2. # Copyright (C) 2009 by Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
  3. # Copyright (C) 2020 by Gregory CLEMENT <gregory.clement@bootlin.com>
  4. #
  5. # This program is free software; you can redistribute it and/or modify
  6. # it under the terms of the GNU General Public License as published by
  7. # the Free Software Foundation; either version 2 of the License, or
  8. # (at your option) any later version.
  9. #
  10. # This program is distributed in the hope that it will be useful,
  11. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  12. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  13. # General Public License for more details.
  14. #
  15. # You should have received a copy of the GNU General Public License
  16. # along with this program; if not, write to the Free Software
  17. # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  18. import argparse
  19. import datetime
  20. import os
  21. import json
  22. import sys
  23. import cve as cvecheck
  24. class Package:
  25. def __init__(self, name, version, ignored_cves):
  26. self.name = name
  27. self.version = version
  28. self.cves = list()
  29. self.ignored_cves = ignored_cves
  30. def check_package_cves(nvd_path, packages):
  31. if not os.path.isdir(nvd_path):
  32. os.makedirs(nvd_path)
  33. for cve in cvecheck.CVE.read_nvd_dir(nvd_path):
  34. for pkg_name in cve.pkg_names:
  35. pkg = packages.get(pkg_name, '')
  36. if pkg and cve.affects(pkg.name, pkg.version, pkg.ignored_cves) == cve.CVE_AFFECTS:
  37. pkg.cves.append(cve.identifier)
  38. html_header = """
  39. <head>
  40. <script src=\"https://www.kryogenix.org/code/browser/sorttable/sorttable.js\"></script>
  41. <style type=\"text/css\">
  42. table {
  43. width: 100%;
  44. }
  45. td {
  46. border: 1px solid black;
  47. }
  48. td.centered {
  49. text-align: center;
  50. }
  51. td.wrong {
  52. background: #ff9a69;
  53. }
  54. td.correct {
  55. background: #d2ffc4;
  56. }
  57. </style>
  58. <title>CVE status for Buildroot configuration</title>
  59. </head>
  60. <p id=\"sortable_hint\"></p>
  61. """
  62. html_footer = """
  63. </body>
  64. <script>
  65. if (typeof sorttable === \"object\") {
  66. document.getElementById(\"sortable_hint\").innerHTML =
  67. \"hint: the table can be sorted by clicking the column headers\"
  68. }
  69. </script>
  70. </html>
  71. """
  72. def dump_html_pkg(f, pkg):
  73. f.write(" <tr>\n")
  74. f.write(" <td>%s</td>\n" % pkg.name)
  75. # Current version
  76. if len(pkg.version) > 20:
  77. version = pkg.version[:20] + "..."
  78. else:
  79. version = pkg.version
  80. f.write(" <td class=\"centered\">%s</td>\n" % version)
  81. # CVEs
  82. td_class = ["centered"]
  83. if len(pkg.cves) == 0:
  84. td_class.append("correct")
  85. else:
  86. td_class.append("wrong")
  87. f.write(" <td class=\"%s\">\n" % " ".join(td_class))
  88. for cve in pkg.cves:
  89. f.write(" <a href=\"https://security-tracker.debian.org/tracker/%s\">%s<br/>\n" % (cve, cve))
  90. f.write(" </td>\n")
  91. f.write(" </tr>\n")
  92. def dump_html_all_pkgs(f, packages):
  93. f.write("""
  94. <table class=\"sortable\">
  95. <tr>
  96. <td>Package</td>
  97. <td class=\"centered\">Version</td>
  98. <td class=\"centered\">CVEs</td>
  99. </tr>
  100. """)
  101. for pkg in packages:
  102. dump_html_pkg(f, pkg)
  103. f.write("</table>")
  104. def dump_html_gen_info(f, date):
  105. f.write("<p><i>Generated on %s</i></p>\n" % (str(date)))
  106. def dump_html(packages, date, output):
  107. with open(output, 'w') as f:
  108. f.write(html_header)
  109. dump_html_all_pkgs(f, packages)
  110. dump_html_gen_info(f, date)
  111. f.write(html_footer)
  112. def dump_json(packages, date, output):
  113. # Format packages as a dictionnary instead of a list
  114. pkgs = {
  115. pkg.name: {
  116. "version": pkg.version,
  117. "cves": pkg.cves,
  118. } for pkg in packages
  119. }
  120. # The actual structure to dump, add date to it
  121. final = {'packages': pkgs,
  122. 'date': str(date)}
  123. with open(output, 'w') as f:
  124. json.dump(final, f, indent=2, separators=(',', ': '))
  125. f.write('\n')
  126. def resolvepath(path):
  127. return os.path.abspath(os.path.expanduser(path))
  128. def parse_args():
  129. parser = argparse.ArgumentParser()
  130. output = parser.add_argument_group('output', 'Output file(s)')
  131. output.add_argument('--html', dest='html', type=resolvepath,
  132. help='HTML output file')
  133. output.add_argument('--json', dest='json', type=resolvepath,
  134. help='JSON output file')
  135. parser.add_argument('--nvd-path', dest='nvd_path',
  136. help='Path to the local NVD database', type=resolvepath,
  137. required=True)
  138. args = parser.parse_args()
  139. if not args.html and not args.json:
  140. parser.error('at least one of --html or --json (or both) is required')
  141. return args
  142. def __main__():
  143. packages = list()
  144. content = json.load(sys.stdin)
  145. for item in content:
  146. pkg = content[item]
  147. p = Package(item, pkg.get('version', ''), pkg.get('ignore_cves', ''))
  148. packages.append(p)
  149. args = parse_args()
  150. date = datetime.datetime.utcnow()
  151. print("Checking packages CVEs")
  152. check_package_cves(args.nvd_path, {p.name: p for p in packages})
  153. if args.html:
  154. print("Write HTML")
  155. dump_html(packages, date, args.html)
  156. if args.json:
  157. print("Write JSON")
  158. dump_json(packages, date, args.json)
  159. __main__()