Merge pull request #81 from PidgeyL/master (7ebeb20e) · Commits · Zhang Yushan / cve-search

sbin/db_mgmt_admin.py

+4 −1

Original line number	Diff line number	Diff line
		@@ -45,7 +45,8 @@ exits = {'userInDb': 'User already exists in database',
		'userpasscombo': 'Master user/password combination does not exist',
		'passwordMatch': "The passwords don't match!",
		'noMaster': 'Not a master account!',
		'lastMaster': 'This user is the last admin in the database and thus can not be removed'}
		'lastMaster': 'This user is the last admin in the database and thus can not be removed',
		'dummy': '_dummy_ is a placeholder, and thus cannot be used'}

		# functions

		@@ -89,6 +90,8 @@ def isLastAdmin(user):
		try:
		if args.a:
		username = args.a
		if username.strip() == "_dummy_":
		sys.exit(exits['dummy'])
		if existsInDB(username):
		sys.exit(exits['userInDb'])
		# set master if db is empty

web/index.py

+84 −37

Original line number	Diff line number	Diff line
		@@ -134,6 +134,11 @@ def blacklist_mark(cve):
		return cve


		def seen_mark(cve):
		seen=getSeenCVEs()
		for c in cve:
		if c["id"] in seen: cve[cve.index(c)]['seen'] = 'yes'

		def getBlacklist():
		collection = db.mgmt_blacklist
		blacklist = collection.find()
		@@ -158,6 +163,17 @@ def getBlacklistRegexes():
		return regexes


		def getSeenCVEs():
		cu=current_user.get_id()
		collection = db.mgmt_seen
		userdata = collection.find({"user":cu})
		if userdata.count()==0:
		collection.insert({"user":cu, "seen_cves":[]})
		return []
		else:
		return userdata[0]["seen_cves"]


		def addCPEToList(cpe, listType, cpeType=None):
		if not cpeType:
		cpeType='cpe'
		@@ -200,7 +216,7 @@ def adminStats():


		def filter_logic(blacklist, whitelist, unlisted, timeSelect, startDate, endDate,
		timeTypeSelect, cvssSelect, cvss, rejectedSelect, limit, skip):
		timeTypeSelect, cvssSelect, cvss, rejectedSelect, hideSeen, limit, skip):
		collection = db.cves
		query = []
		# retrieving lists
		@@ -228,6 +244,11 @@ def filter_logic(blacklist, whitelist, unlisted, timeSelect, startDate, endDate,
		if rejectedSelect == "hide":
		exp = "^(?!\\ REJECT \\\s+DO NOT USE THIS CANDIDATE NUMBER.*)"
		query.append({'summary': re.compile(exp)})

		if current_user.is_authenticated():
		if hideSeen == "hide":
		query.append({'id': {"$nin":getSeenCVEs()}})

		# cvss logic
		if cvssSelect != "all":
		if cvssSelect == "above":
		@@ -259,6 +280,7 @@ def filter_logic(blacklist, whitelist, unlisted, timeSelect, startDate, endDate,
		cve = whitelist_mark(cve)
		if blacklist == "mark":
		cve = blacklist_mark(cve)
		seen_mark(cve)
		cve = list(cve)
		return cve

		@@ -281,6 +303,28 @@ def markCPEs(cve):
		return cve


		def getFilterSettingsFromPost():
		blacklist = request.form.get('blacklistSelect')
		whitelist = request.form.get('whitelistSelect')
		unlisted = request.form.get('unlistedSelect')
		timeSelect = request.form.get('timeSelect')
		startDate = request.form.get('startDate')
		endDate = request.form.get('endDate')
		timeTypeSelect = request.form.get('timeTypeSelect')
		cvssSelect = request.form.get('cvssSelect')
		cvss = request.form.get('cvss')
		rejectedSelect = request.form.get('rejectedSelect')
		hideSeen = request.form.get('hideSeen')
		settings = {'blacklistSelect': blacklist, 'whitelistSelect': whitelist,
		'unlistedSelect': unlisted, 'timeSelect': timeSelect,
		'startDate': startDate, 'endDate': endDate,
		'timeTypeSelect': timeTypeSelect, 'cvssSelect': cvssSelect,
		'cvss': cvss, 'rejectedSelect': rejectedSelect, "hideSeen": hideSeen}
		# retrieving data
		cve = filter_logic(blacklist, whitelist, unlisted, timeSelect, startDate, endDate,
		timeTypeSelect, cvssSelect, cvss, rejectedSelect, hideSeen, pageLength, 0)
		return(settings,cve)

		@login_manager.user_loader
		def load_user(id):
		return User.get(id)
		@@ -299,30 +343,14 @@ def index():
		cvssSelect = "all"
		cvss = None
		rejectedSelect = "hide"
		hideSeen = "show"
		cve = filter_logic(blacklist, whitelist, unlisted, timeSelect, startDate, endDate,
		timeTypeSelect, cvssSelect, cvss, rejectedSelect, pageLength, 0)
		timeTypeSelect, cvssSelect, cvss, rejectedSelect, hideSeen, pageLength, 0)
		return render_template('index.html', cve=cve, r=0, pageLength=pageLength)

		@app.route('/', methods=['POST'])
		def filterPost():
		blacklist = request.form.get('blacklistSelect')
		whitelist = request.form.get('whitelistSelect')
		unlisted = request.form.get('unlistedSelect')
		timeSelect = request.form.get('timeSelect')
		startDate = request.form.get('startDate')
		endDate = request.form.get('endDate')
		timeTypeSelect = request.form.get('timeTypeSelect')
		cvssSelect = request.form.get('cvssSelect')
		cvss = request.form.get('cvss')
		rejectedSelect = request.form.get('rejectedSelect')
		settings = {'blacklistSelect': blacklist, 'whitelistSelect': whitelist,
		'unlistedSelect': unlisted, 'timeSelect': timeSelect,
		'startDate': startDate, 'endDate': endDate,
		'timeTypeSelect': timeTypeSelect, 'cvssSelect': cvssSelect,
		'cvss': cvss, 'rejectedSelect': rejectedSelect}
		# retrieving data
		cve = filter_logic(blacklist, whitelist, unlisted, timeSelect, startDate, endDate,
		timeTypeSelect, cvssSelect, cvss, rejectedSelect, pageLength, 0)
		settings,cve = getFilterSettingsFromPost()
		return render_template('index.html', settings=settings, cve=cve, r=0, pageLength=pageLength)


		@@ -330,27 +358,35 @@ def filterPost():
		def filterLast(r):
		if not r:
		r = 0
		blacklist = request.form.get('blacklistSelect')
		whitelist = request.form.get('whitelistSelect')
		unlisted = request.form.get('unlistedSelect')
		timeSelect = request.form.get('timeSelect')
		startDate = request.form.get('startDate')
		endDate = request.form.get('endDate')
		timeTypeSelect = request.form.get('timeTypeSelect')
		cvssSelect = request.form.get('cvssSelect')
		cvss = request.form.get('cvss')
		rejectedSelect = request.form.get('rejectedSelect')
		settings = {'blacklistSelect': blacklist, 'whitelistSelect': whitelist,
		'unlistedSelect': unlisted, 'timeSelect': timeSelect,
		'startDate': startDate, 'endDate': endDate,
		'timeTypeSelect': timeTypeSelect, 'cvssSelect': cvssSelect,
		'cvss': cvss, 'rejectedSelect': rejectedSelect}
		settings,cve = getFilterSettingsFromPost()
		return render_template('index.html', settings=settings, cve=cve, r=r, pageLength=pageLength)

		@app.route('/r/<int:r>/seen', methods=['POST'])
		def seen(r):
		if not r:
		r = 0
		seenlist=request.form.get('list').split(",")
		# retrieving data
		cve = filter_logic(blacklist, whitelist, unlisted, timeSelect, startDate, endDate,
		timeTypeSelect, cvssSelect, cvss, rejectedSelect, pageLength, r)
		if current_user.is_authenticated():
		col = db.mgmt_seen
		col.update({"user":current_user.get_id()},{"$addToSet":{"seen_cves":{"$each":seenlist}}})
		settings,cve = getFilterSettingsFromPost()
		return render_template('index.html', settings=settings, cve=cve, r=r, pageLength=pageLength)


		@app.route('/r/<int:r>/unseen', methods=['POST'])
		def unseen(r):
		if not r:
		r = 0
		seenlist=request.form.get('list').split(",")
		# retrieving data
		if current_user.is_authenticated():
		col = db.mgmt_seen
		col.update({"user":current_user.get_id()},{"$pullAll":{"seen_cves":seenlist}})
		settings,cve = getFilterSettingsFromPost()
		return render_template('index.html', settings=settings, cve=cve, r=r, pageLength=pageLength)


		@app.route('/api/cpe2.3/<path:cpe>', methods=['GET'])
		def cpe23(cpe):
		cpe = toStringFormattedCPE(cpe)
		@@ -410,6 +446,11 @@ def apisearch(vendor=None, product=None):
		r.append(cve)
		return (json.dumps(r))

		@app.route('/seenCVEs', methods=['POST'])
		def see():
		cves=request.form.get('blacklistSelect')
		return render_template('index.html', cve=cve)

		@app.route('/cve/<cveid>')
		def cve(cveid):
		cveid = cveid.upper()
		@@ -418,9 +459,15 @@ def cve(cveid):
		if cve is None:
		return render_template('error.html',status={'except':'cve-not-found','info':{'cve':cveid}})
		cve = markCPEs(cve)
		if current_user.is_authenticated():
		l = getSeenCVEs()
		if not cveid in l:
		col=db.mgmt_seen
		col.update({"user":current_user.get_id()},{"$addToSet":{"seen_cves":cveid}})
		return render_template('cve.html', cve=cve)



		@app.route('/browse/<vendor>')
		@app.route('/browse/')
		def browse(vendor=None):

web/static/css/style.css

+18 −0

Original line number	Diff line number	Diff line
		@@ -4,6 +4,13 @@
		.blacklisted{
		color: #555588;
		}
		table.table-striped tr.seen{
		color: #778899;
		}
		.table.table-striped tr.selected{
		background-color: #556677;
		color: #FFFFFF;
		}
		.listInput{
		width:calc(50% - 25px);
		min-width:200px;
		@@ -42,6 +49,17 @@ ul.nav li.dropdown:hover > ul.dropdown-menu {
		padding: 1em;
		display: none;
		}
		.select-submit {
		position: fixed;
		bottom: 6em;
		right: 0px;
		text-decoration: none;
		color: #000000;
		background-color: rgba(180, 180, 235, 0.70);
		font-size: 12px;
		padding: 1em;
		display: none;
		}

		.back-to-top:hover {
		background-color: rgba(135, 135, 135, 0.50);

web/static/js/custom/table.js

0 → 100644

+45 −0

Original line number	Diff line number	Diff line
		function postList(url, cves) {
		var form = document.getElementById("filter");
		form.action = url;
		document.body.appendChild(form);
		var list = document.createElement("INPUT");
		list.type = "hidden";
		list.name = "list"
		list.value = cves
		form.appendChild(list);
		form.submit();
		}
		//Selectable table
		$(document).ready(function() {
		var table = $('#CVEs');
		var duration = 500;
		$('#CVEs tbody').on( 'click', 'tr', function () {
		if($('#markseen').is(':checked') \|\| $('#markunseen').is(':checked')){
		$(this).toggleClass('selected');
		var rows= $('#CVEs tbody tr.selected');
		if (rows.length > 0) {
		$('.select-submit').fadeIn(duration);
		} else {
		$('.select-submit').fadeOut(duration);
		}
		}
		});
		$('.select-submit').click( function () {
		var rows= $('#CVEs tbody tr.selected');
		var cvelist=[];
		for (i=0;i<rows.length;i++){
		cvelist.push(rows[i].cells[1].innerHTML.replace(/<\/?[^>]+(>\|$)/g, "").trim());
		}
		var r=getr();
		var url = ""
		if($('#markseen').is(':checked')){url="seen";}
		else if($('#markunseen').is(':checked')){url="unseen";}
		else{return false;}

		postList("/r/"+r+"/"+url,cvelist);
		for (x in cvelist){
		$('#'+cvelist[x]).removeClass('selected');
		}
		return false;
		});
		});

web/templates/index.html

+17 −0

Original line number	Diff line number	Diff line
		@@ -10,6 +10,7 @@

		<!-- javascript -->
		<script type="text/javascript" src="/static/js/custom/filter.js"></script>
		<script type="text/javascript" src="/static/js/custom/table.js"></script>
		<script type="text/javascript">
		function setSettings(){
		{% if settings is defined%}
		@@ -23,6 +24,7 @@
		document.getElementById('cvssSelect').value = "{{settings['cvssSelect']}}";
		document.getElementById('cvss').value = "{{settings['cvss']}}";
		document.getElementById('rejectedSelect').value = "{{settings['rejectedSelect']}}";
		document.getElementById('hideSeen').value = "{{settings['hideSeen']}}";
		cvssSelectDisable()
		timeSelectDisable()
		{%endif%}
		@@ -32,6 +34,9 @@
		form.action = url;
		form.submit();
		}
		function getr(){
		return {{r}};
		}
		function next(n){
		setSettings();
		var multiplier = {{ r }} + ( n * {{ pageLength }});
		@@ -128,6 +133,13 @@
		<option value="show">Show</option>
		</select>
		</td>
		<td>{% if current_user.is_authenticated() %}Seen CVEs{% endif %}</td>
		<td>
		<select {% if not current_user.is_authenticated() %} style="visibility:hidden;" {% endif %} name="hideSeen" id="hideSeen">
		<option value="show">Show</option>
		<option value="hide">Hide</option>
		</select>
		</td>
		</tr>
		<tr>
		<td colspan="4"><input type="submit" value="Search"/></td>
		@@ -138,6 +150,11 @@
		<!-- Pager -->
		{% include 'pager.html' %}
		<!-- Search results -->
		{% if current_user.is_authenticated() %}
		<input type="radio" id="dontmark" name="selectTable" value="none" checked>Don't mark
		<input type="radio" id="markseen" name="selectTable" value="see">Mark seen
		<input type="radio" id="markunseen" name="selectTable" value="unsee">Mark unseen
		{% endif %}
		{% include 'table.html' %}
		<!-- Pager -->
		{% include 'pager.html' %}

Admin message