Merge pull request #68 from PidgeyL/master (e2d842a5) · Commits · Zhang Yushan / cve-search

lib/Toolkit.py

+42 −0

Original line number	Diff line number	Diff line
		@@ -8,6 +8,10 @@
		# Copyright (c) 2014-2015 Pieter-Jan Moreels - pieterjan.moreels@gmail.com

		# Imports
		from dateutil import tz
		import dateutil.parser
		import re

		# Note of warning: CPEs like cpe:/o:microsoft:windows_8:-:-:x64 are given to us by Mitre
		# x64 will be parsed as Edition in this case, not Architecture
		def toStringFormattedCPE(cpe,autofill=False):
		@@ -79,3 +83,41 @@ def pad(seq, target_length, padding=None):
		return seq
		seq.extend([padding] * (target_length - length))
		return seq

		def currentTime(utc):
		timezone = tz.tzlocal()
		utc = dateutil.parser.parse(utc)
		output = utc.astimezone(timezone)
		output = output.strftime('%d-%m-%Y - %H:%M')
		return output

		def isURL(string):
		urlTypes= [re.escape(x) for x in ['http://','https://', 'www.']]
		return re.match("^(" + "\|".join(urlTypes) + ")", string)

		def vFeedName(string):
		string=string.replace('map_','')
		string=string.replace('cve_','')
		return string.title()

		def convertDateToDBFormat(string):
		result = None
		try:
		result = time.strptime(string, "%d-%m-%Y")
		except:
		pass
		try:
		result = time.strptime(string, "%d-%m-%y")
		except:
		pass
		try:
		result = time.strptime(string, "%d/%m/%Y")
		except:
		pass
		try:
		result = time.strptime(string, "%d/%m/%y")
		except:
		pass
		if result is not None:
		result = time.strftime('%Y-%m-%d', result)
		return result

test/test.py

+50 −23

Original line number	Diff line number	Diff line
		@@ -13,7 +13,14 @@ import sys
		runPath = os.path.dirname(os.path.realpath(__file__))
		sys.path.append(os.path.join(runPath, ".."))

		from lib.Toolkit import toStringFormattedCPE, toOldCPE
		import argparse

		from lib.Toolkit import toStringFormattedCPE, toOldCPE, pad

		# parse command line arguments
		argparser = argparse.ArgumentParser(description='Recursive test for functions')
		argparser.add_argument('-v', action='store_true', help='Verbose')
		args = argparser.parse_args()

		def resultOf(original, result, expected):
		test={'in':original,'out':result,'expect':expected}
		@@ -24,6 +31,7 @@ def printResults(test, results):
		l = [x['passed'] for x in results]
		if False in l:
		print('[x] %s failed!'%test)
		if args.v:
		for x in [x for x in results if x['passed']==False]:
		print(' in: %s'%x['in'])
		print(' out: %s'%x['out'])
		@@ -61,6 +69,16 @@ old = [{'in':'cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium',
		{'in':'cpe:2.3:a:7-zip:7-zip:4.65:-:-:-:-:-:x64', 'expect':'cpe:/a:7-zip:7-zip:4.65::~~~~x64~'},
		{'in':'cpe:2.3:a:acl:acl:9.1.0.213', 'expect':'cpe:/a:acl:acl:9.1.0.213'}]

		pad1=[{'in':['a','b','c'], 'expect':['a','b','c',None,None]},
		{'in':['a','b','c','d','e'], 'expect':['a','b','c','d','e']},
		{'in':['a','b','c','d','e','f'], 'expect':['a','b','c','d','e','f']}]
		padtext1=[{'in':['a','b','c'], 'expect':['a','b','c','-','-']},
		{'in':['a','b','c','d','e'], 'expect':['a','b','c','d','e']},
		{'in':['a','b','c','d','e','f'], 'expect':['a','b','c','d','e','f']}]
		padtext2=[{'in':['a','b','c'], 'expect':['a','b','c','text','text']},
		{'in':['a','b','c','d','e'], 'expect':['a','b','c','d','e']},
		{'in':['a','b','c','d','e','f'], 'expect':['a','b','c','d','e','f']}]

		result=[]
		for x in extend:
		result.append(resultOf(x['in'],toStringFormattedCPE(x['in'],autofill=True),x['expect']))
		@@ -76,3 +94,12 @@ for x in old:
		result.append(resultOf(x['in'],toOldCPE(x['in']),x['expect']))
		printResults('Translate to 2.2 - success/no autofill',result)

		result=[]
		for x in pad1:
		result.append(resultOf(x['in'],pad(x['in'],5),x['expect']))
		for x in padtext1:
		result.append(resultOf(x['in'],pad(x['in'],5,'-'),x['expect']))
		for x in padtext2:
		result.append(resultOf(x['in'],pad(x['in'],5,'text'),x['expect']))
		printResults('Padding lists - empty, char and text - ',result)

web/index.py

+7 −51

Original line number	Diff line number	Diff line
		@@ -27,8 +27,6 @@ from passlib.hash import pbkdf2_sha256
		from redis import exceptions as redisExceptions

		import json
		from dateutil import tz
		import dateutil.parser
		import re
		import argparse
		import time
		@@ -41,7 +39,7 @@ from logging.handlers import RotatingFileHandler

		from lib.User import User
		from lib.Config import Configuration
		from lib.Toolkit import toStringFormattedCPE, toOldCPE
		from lib.Toolkit import toStringFormattedCPE, toOldCPE, currentTime, isURL, vFeedName, convertDateToDBFormat
		import lib.CVEs as cves
		from bin.db_whitelist import *
		from bin.db_blacklist import *
		@@ -160,9 +158,6 @@ def getBlacklistRegexes():


		def addCPEToList(cpe, listType, cpeType=None):
		#cpe = urllib.parse.quote_plus(cpe).lower()
		#cpe = cpe.replace("%3a", ":")
		#cpe = cpe.replace("%2f", "/")
		if not cpeType:
		cpeType='cpe'
		if listType.lower() in ("blacklist", "black", "b", "bl"):
		@@ -182,29 +177,6 @@ def getVersionsOfProduct(product):
		return sorted(list(p))


		def convertDateToDBFormat(string):
		result = None
		try:
		result = time.strptime(string, "%d-%m-%Y")
		except:
		pass
		try:
		result = time.strptime(string, "%d-%m-%y")
		except:
		pass
		try:
		result = time.strptime(string, "%d/%m/%Y")
		except:
		pass
		try:
		result = time.strptime(string, "%d/%m/%y")
		except:
		pass
		if result is not None:
		result = time.strftime('%Y-%m-%d', result)
		return result


		def adminStats():
		cveU = db.info.find_one({'db': 'cve'})
		cpeU = db.info.find_one({'db': 'cpe'})
		@@ -804,12 +776,8 @@ def page_not_found(e):

		# filters
		@app.template_filter('currentTime')
		def currentTime(utc):
		timezone = tz.tzlocal()
		utc = dateutil.parser.parse(utc)
		output = utc.astimezone(timezone)
		output = output.strftime('%d-%m-%Y - %H:%M')
		return output
		def currentTimeFilter(utc):
		return currentTime(utc)


		@app.template_filter('htmlDecode')
		@@ -822,25 +790,13 @@ def htmlEncode(string):
		return urllib.parse.quote_plus(string).lower()


		@app.template_filter('impact')
		def impact(string):
		if string.lower() == "none":
		return "good"
		elif string.lower() == "partial":
		return "medium"
		elif string.lower() == "complete":
		return "bad"

		@app.template_filter('isURL')
		def isURL(string):
		urlTypes= [re.escape(x) for x in ['http://','https://', 'www.']]
		return re.match("^(" + "\|".join(urlTypes) + ")", string)
		def isURLFilter(string):
		return isURL(string)

		@app.template_filter('vFeedName')
		def vFeedName(string):
		string=string.replace('map_','')
		string=string.replace('cve_','')
		return string.title()
		def vFeedNameFilter(string):
		return vFeedName(string)

		# signal handlers
		def sig_handler(sig, frame):

web/minimal-web.py

+7 −50

Original line number	Diff line number	Diff line
		@@ -24,8 +24,6 @@ from flask.ext.pymongo import PyMongo
		from redis import exceptions as redisExceptions

		import json
		from dateutil import tz
		import dateutil.parser
		import re
		import argparse
		import time
		@@ -36,7 +34,7 @@ import logging
		from logging.handlers import RotatingFileHandler

		from lib.Config import Configuration
		from lib.Toolkit import toStringFormattedCPE, toOldCPE
		from lib.Toolkit import toStringFormattedCPE, toOldCPE, currentTime, isURL, vFeedName, convertDateToDBFormat
		import lib.CVEs as cves

		# parse command line arguments
		@@ -75,35 +73,11 @@ def getBrowseList(vendor):
		return result



		def getVersionsOfProduct(product):
		p = redisdb.smembers("p:" + product)
		return sorted(list(p))


		def convertDateToDBFormat(string):
		result = None
		try:
		result = time.strptime(string, "%d-%m-%Y")
		except:
		pass
		try:
		result = time.strptime(string, "%d-%m-%y")
		except:
		pass
		try:
		result = time.strptime(string, "%d/%m/%Y")
		except:
		pass
		try:
		result = time.strptime(string, "%d/%m/%y")
		except:
		pass
		if result is not None:
		result = time.strftime('%Y-%m-%d', result)
		return result


		cveU = db.info.find_one({'db': 'cve'})
		cpeU = db.info.find_one({'db': 'cpe'})
		cpeOtherU = db.info.find_one({'db': 'cpeother'})
		@@ -220,7 +194,6 @@ def filterLast(r):
		# retrieving data
		cve = filter_logic(unlisted, timeSelect, startDate, endDate,
		timeTypeSelect, cvssSelect, cvss, rejectedSelect, pageLength, r)

		return render_template('index-minimal.html', settings=settings, cve=cve, r=r, pageLength=pageLength)

		@app.route('/api/cpe2.3/<path:cpe>', methods=['GET'])
		@@ -335,12 +308,8 @@ def page_not_found(e):

		# filters
		@app.template_filter('currentTime')
		def currentTime(utc):
		timezone = tz.tzlocal()
		utc = dateutil.parser.parse(utc)
		output = utc.astimezone(timezone)
		output = output.strftime('%d-%m-%Y - %H:%M')
		return output
		def currentTimeFilter(utc):
		return currentTime(utc)


		@app.template_filter('htmlDecode')
		@@ -353,25 +322,13 @@ def htmlEncode(string):
		return urllib.parse.quote_plus(string).lower()


		@app.template_filter('impact')
		def impact(string):
		if string.lower() == "none":
		return "good"
		elif string.lower() == "partial":
		return "medium"
		elif string.lower() == "complete":
		return "bad"

		@app.template_filter('isURL')
		def isURL(string):
		urlTypes= [re.escape(x) for x in ['http://','https://', 'www.']]
		return re.match("^(" + "\|".join(urlTypes) + ")", string)
		def isURLFilter(string):
		return isURL(string)

		@app.template_filter('vFeedName')
		def vFeedName(string):
		string=string.replace('map_','')
		string=string.replace('cve_','')
		return string.title()
		def vFeedNameFilter(string):
		return vFeedName(string)

		# signal handlers
		def sig_handler(sig, frame):

web/static/css/style.css

+3 −3

Original line number	Diff line number	Diff line
		@@ -71,14 +71,14 @@ ul.nav li.dropdown:hover > ul.dropdown-menu {
		table-layout: fixed
		}

		.good {
		.impact-none {
		color:green;
		}

		.medium {
		.impact-partial {
		color:orange;
		}

		.bad {
		.impact-complete {
		color:red;
		}

Admin message