From a01aae06ef9117c38d4bac4751a9542160950cb8 Mon Sep 17 00:00:00 2001 From: zhangjianjun Date: Thu, 13 Jan 2022 11:50:10 +0800 Subject: [PATCH 1/2] Bug fix: There are duplicate lines in the CVE list, that is, the two lines are the same CVE id, the same issue number, and other information are the same, and de-duplicate --- cve-vulner-manager/taskhandler/xml.go | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/cve-vulner-manager/taskhandler/xml.go b/cve-vulner-manager/taskhandler/xml.go index 15f5222..b24268b 100644 --- a/cve-vulner-manager/taskhandler/xml.go +++ b/cve-vulner-manager/taskhandler/xml.go @@ -397,8 +397,17 @@ func BuildXml(cveXml *[]CveXml, v *models.ExcelExport, cvex.OwnedComponent = v.OwnedComponent *cveXml = append(*cveXml, cvex) } else { - vx = append(vx, sn) - securityNotice[v.OwnedComponent] = vx + sameFlag := false + for _, vu := range vx { + if sn.CveNum == vu.CveNum { + sameFlag = true + break + } + } + if !sameFlag { + vx = append(vx, sn) + securityNotice[v.OwnedComponent] = vx + } } //cvex.PackRpmx = make(map[string][]PackRpm) if px, ok := packRpmx[v.OwnedComponent]; !ok { -- Gitee From 5a22c219d7336dc1e0ac8c9940389fb4d63afe63 Mon Sep 17 00:00:00 2001 From: zhangjianjun Date: Fri, 14 Jan 2022 17:36:20 +0800 Subject: [PATCH 2/2] Fixed bug: this CVE-2021-43566 . Using the /get-cve command, the synchronization information is displayed successfully, but the echo is still empty --- cve-vulner-manager/conf/app.conf | 2 +- cve-vulner-manager/conf/product_app.conf | 2 +- cve-vulner-manager/controllers/hook.go | 13 ++++-- cve-vulner-manager/task/issuetask.go | 54 ++++++++++++------------ cve-vulner-manager/taskhandler/cve.go | 3 ++ 5 files changed, 42 insertions(+), 32 deletions(-) diff --git a/cve-vulner-manager/conf/app.conf b/cve-vulner-manager/conf/app.conf index 2f3496c..d5002ad 100644 --- a/cve-vulner-manager/conf/app.conf +++ b/cve-vulner-manager/conf/app.conf @@ -20,7 +20,7 @@ approveCmd = "/approve" closeCmd = "/close" errorCmd = "/error" autoPrCmd = "/find-patch" -feedBackCmd = "/feedback" +feedBackCmd = "/report-patch" getCveCmd = "/get-cve" labelFixed = "CVE/FIXED" labelUnFix = "CVE/UNFIXED" diff --git a/cve-vulner-manager/conf/product_app.conf b/cve-vulner-manager/conf/product_app.conf index 1e832d2..adf8882 100644 --- a/cve-vulner-manager/conf/product_app.conf +++ b/cve-vulner-manager/conf/product_app.conf @@ -20,7 +20,7 @@ approveCmd = "/approve" closeCmd = "/close" errorCmd = "/error" autoPrCmd = "/find-patch" -feedBackCmd = "/feedback" +feedBackCmd = "/report-patch" getCveCmd = "/get-cve" labelFixed = "CVE/FIXED" labelUnFix = "CVE/UNFIXED" diff --git a/cve-vulner-manager/controllers/hook.go b/cve-vulner-manager/controllers/hook.go index 48d1460..53c6f13 100644 --- a/cve-vulner-manager/controllers/hook.go +++ b/cve-vulner-manager/controllers/hook.go @@ -79,8 +79,8 @@ const ( // rejected or upend CommentRejectedState = `@%v 当前issue状态为: %v,请先修改issue状态, 否则评论无法被识别.` // Get cve information comment - CommentGetNvdCveSuccess = `@%v CVE信息同步成功, 稍后请重新加载页面.` - CommentGetNvdCveFailed = `@%v CVE信息同步失败, 请稍后重试, 或者数据源不存在.` + CommentGetNvdCveSuccess = `@%v CVE信息从NVD同步成功, 稍后请重新加载页面.` + CommentGetNvdCveFailed = `@%v CVE信息从NVD同步失败, 请稍后重试, 或者数据源不存在.` CommentRepeatIssue = `%v 请检查当前: %v,是否重复创建, issue编号： %v, 重复创建的issue,将不会被再次识别.` ) @@ -223,13 +223,13 @@ func (c *HookEventControllers) handleIssue() { } } if issueHook.Action == "open" { + owner, token := common.GetOwnerAndToken(organizationID) issueTmp := models.IssueTemplate{IssueNum: issueHook.Iid, IssueId: issueHook.Issue.Id} err := models.GetIssueTemplateByColName(&issueTmp, "issue_num", "issue_id") if err == nil { vc := models.VulnCenter{CveId: issueTmp.CveId} vcErr := models.GetVulnCenterByCid(&vc, "CveId") if vcErr == nil && vc.OrganizationID == organizationID { - owner, token := common.GetOwnerAndToken(organizationID) cc := fmt.Sprintf(CommentRepeatIssue, "@"+cuAccount, issueTmp.CveNum, issueTmp.IssueNum) taskhandler.AddCommentToIssue(cc, issueTmp.IssueNum, owner, issueTmp.Repo, token) return @@ -238,8 +238,13 @@ func (c *HookEventControllers) handleIssue() { err = gitAddIssueProc(&issueHook, organizationID) if err != nil { logs.Error(err) - return } + issueTmp = models.IssueTemplate{IssueNum: issueHook.Iid, IssueId: issueHook.Issue.Id} + err = models.GetIssueTemplateByColName(&issueTmp, "issue_num", "issue_id") + if err == nil { + PostTriggerGetCve(issueTmp, owner, token, cuAccount) + } + return } if issueHook.Action == "delete" { err = gitDelIssueProc(&issueHook, organizationID) diff --git a/cve-vulner-manager/task/issuetask.go b/cve-vulner-manager/task/issuetask.go index f13cae3..cb5fd51 100644 --- a/cve-vulner-manager/task/issuetask.go +++ b/cve-vulner-manager/task/issuetask.go @@ -201,7 +201,7 @@ func addUnlimitedIssue(beforeTime string, prcnum, years, toolYears, manYears, fl ErrorCveStatistics("CVE已经在官网展示, 已修复", issueValue, 1) continue } - if issueValue.Status == 0 && flag != 2 { + if issueValue.Status == 0 && flag != 2 && len(issueValue.CveVersion) > 0 { branchBool := CheckCveIssueBranch(issueValue.PackName, issueValue.CveVersion) if !branchBool { models.UpdateIssueStatus(issueValue, 8) @@ -511,11 +511,14 @@ func ProcUpdateIssue(issueValue models.VulnCenter, accessToken, owner string) er // Query issue template var it models.IssueTemplate it.CveNum = issueValue.CveNum - it.OwnedVersion = issueValue.CveVersion - it.Repo = issueValue.PackName it.CveId = issueValue.CveId - templateErr := models.GetIssueTemplateByColName(&it, "CveNum", "OwnedVersion", "Repo", "CveId") + templateErr := models.GetIssueTemplateByColName(&it, "CveNum", "CveId") if templateErr == nil && it.TemplateId > 0 { + it.OwnedVersion = issueValue.CveVersion + it.Repo = issueValue.PackName + if len(issueValue.RepoName) > 0 { + it.OwnedComponent = issueValue.RepoName + } if it.NVDScore == 0 && sr.NVDScore > 0 { it.NVDScore = sr.NVDScore it.NVDVector = sr.NvectorVule @@ -538,6 +541,27 @@ func ProcUpdateIssue(issueValue models.VulnCenter, accessToken, owner string) er it.Assignee = repoMainTainer } } + _, err := taskhandler.UpdateIssueToGit(accessToken, owner, path, issueValue, it) + if err != nil && err.Error() != "Recreate issue" { + logs.Error("ProcUpdateIssue, Failed to update issue template, "+ + "CveNum: ", issueValue.CveNum, "err: ", err) + // Update issue status + models.UpdateIssueStatus(issueValue, 3) + return err + } + // Update issue status + models.UpdateIssueStatus(issueValue, 2) + // Update score status + models.UpdateIssueScore(issueValue, 2) + templetID, err := models.CreateIssueTemplate(&it) + if err != nil { + logs.Error("ProcUpdateIssue, Failed to modify issue template, "+ + "CveNum: ", issueValue.CveNum, ",err: ", err) + //return err + } + models.UpdateIssueScoreRe(issueValue, 1) + logs.Info("ProcUpdateIssue, Successfully updated the issue template, "+ + "CveNum: ", issueValue.CveNum, ", templetID: ", templetID) // Judgment of necessary fields if it.NVDScore <= 0 || len(issueValue.Description) < 2 || len(issueValue.CveNum) < 2 || len(issueValue.PackName) < 2 || len(issueValue.CveVersion) < 1 { @@ -559,28 +583,6 @@ func ProcUpdateIssue(issueValue models.VulnCenter, accessToken, owner string) er } return errors.New("CVE的描述和NVD信息缺失") } - _, err := taskhandler.UpdateIssueToGit(accessToken, owner, path, - issueValue, it) - if err != nil && err.Error() != "Recreate issue" { - logs.Error("ProcUpdateIssue, Failed to update issue template, "+ - "CveNum: ", issueValue.CveNum, "err: ", err) - // Update issue status - models.UpdateIssueStatus(issueValue, 3) - return err - } - // Update issue status - models.UpdateIssueStatus(issueValue, 2) - // Update score status - models.UpdateIssueScore(issueValue, 2) - templetID, err := models.CreateIssueTemplate(&it) - if err != nil { - logs.Error("ProcUpdateIssue, Failed to modify issue template, "+ - "CveNum: ", issueValue.CveNum, ",err: ", err) - //return err - } - models.UpdateIssueScoreRe(issueValue, 1) - logs.Info("ProcUpdateIssue, Successfully updated the issue template, "+ - "CveNum: ", issueValue.CveNum, ", templetID: ", templetID) } return nil } diff --git a/cve-vulner-manager/taskhandler/cve.go b/cve-vulner-manager/taskhandler/cve.go index 83bca0e..0a5694b 100644 --- a/cve-vulner-manager/taskhandler/cve.go +++ b/cve-vulner-manager/taskhandler/cve.go @@ -2179,6 +2179,9 @@ func GenCveVulerByIssue(cveData models.GiteOriginIssue, cveRef string, openeuler models.UpdateCveIssueStatusById(3, cveData.Id) return false, err } + if len(hole.Components) < 1 { + hole.Components = cveData.RepoPath + } goe := models.GitPackageInfo{} if organizationID == 1 { goe, _ = models.QueryCveOpeneulerDetaildataByName(cveData.RepoPath, hole.Version) -- Gitee