diff --git a/cve-vulner-manager/models/uploadcve.go b/cve-vulner-manager/models/uploadcve.go index 585a0857d664373bf9b604bda9bac04a2f03e2f6..95da6f5e4137d91b1e2c9586f95aff47f4046dd5 100644 --- a/cve-vulner-manager/models/uploadcve.go +++ b/cve-vulner-manager/models/uploadcve.go @@ -1013,6 +1013,30 @@ func QueryCveOriginPatchInfo(cveNum string) ([]OriginUpstreamPatch, error) { return res, nil } +func QueryCveOriginReference(cveNum string) ([]OriginUpstreamReference, error) { + if cveNum == "" { + return nil, nil + } + o := orm.NewOrm() + var id struct { + CveId int64 `orm:"column(cve_id)"` + } + _ = o.Raw("select cve_id from cve_origin_upstream where cve_num = ? order by cve_id desc", cveNum).QueryRow(&id) + if id.CveId == 0 { + return nil, nil + } + + sql := "select * from cve_origin_upstream_reference where cve_id = ?" + var res []OriginUpstreamReference + + _, err := o.Raw(sql, id.CveId).QueryRows(&res) + if err != nil { + return nil, err + } + + return res, nil +} + func QueryCveOrigin(cveNum, typ string) bool { sql := "select * from cve_origin_upstream where (cve_num = ? or cve_un_ids = ?) and update_type = ?" o := orm.NewOrm() @@ -1029,7 +1053,7 @@ func FilterOldData(cve string) bool { o := orm.NewOrm() var res OriginUpstream err := o.Raw(sql, cve).QueryRow(&res) - if err != nil{ + if err != nil { return false } if res.Credibility > 3 && res.CveId <= 20557 { diff --git a/cve-vulner-manager/taskhandler/common.go b/cve-vulner-manager/taskhandler/common.go index 95b4e8a58dddc8499cc159ed056119c7afe560d6..125066f98c86f1295e896d142e515799e623d718 100644 --- a/cve-vulner-manager/taskhandler/common.go +++ b/cve-vulner-manager/taskhandler/common.go @@ -973,16 +973,16 @@ func CreateIssueBody(accessToken, owner, path, assignee string, body := "" if its.Status == 3 && len(its.SecLink) > 3 && cve.OrganizationID == 1 { body = fmt.Sprintf(bodySecLinkTpl, cveNumber, cvePkg, cve.CveVersion, scoreType, nveScore, nveVector, - cve.Description, cve.RepairTime, updateTime, cve.CveDetailUrl, commentCmd, holeSource(cve.DataSource), + cve.Description, cve.RepairTime, updateTime, cve.CveDetailUrl+"\n"+getCveDetail(cve.CveNum)+"\n", commentCmd, holeSource(cve.DataSource), genPatchInfo(cve.CveNum), cveAnalysis, openEulerScore, oVector, affectedVersion, abiVersion, its.SecLink) } else { if cve.OrganizationID == 1 { body = fmt.Sprintf(bodyUpTplx, cveNumber, cvePkg, cve.CveVersion, scoreType, nveScore, nveVector, - cve.Description, cve.RepairTime, updateTime, cve.CveDetailUrl, commentCmd, holeSource(cve.DataSource), + cve.Description, cve.RepairTime, updateTime, cve.CveDetailUrl+"\n"+getCveDetail(cve.CveNum)+"\n", commentCmd, holeSource(cve.DataSource), genPatchInfo(cve.CveNum), cveAnalysis, openEulerScore, oVector, affectedVersion, abiVersion) } else { body = fmt.Sprintf(bodyUpTplx, cveNumber, cveRepo, cve.CveVersion, scoreType, nveScore, nveVector, - cve.Description, cve.RepairTime, updateTime, cve.CveDetailUrl, commentCmd, holeSource(cve.DataSource), + cve.Description, cve.RepairTime, updateTime, cve.CveDetailUrl+"\n"+getCveDetail(cve.CveNum)+"\n", commentCmd, holeSource(cve.DataSource), genPatchInfo(cve.CveNum), cveAnalysis, openEulerScore, oVector, affectedVersion) } } @@ -998,11 +998,11 @@ func CreateIssueBody(accessToken, owner, path, assignee string, body := "" if cve.OrganizationID == 1 { body = fmt.Sprintf(bodyTplx, cveNumber, cvePkg, cve.CveVersion, scoreType, nveScore, nveVector, - cve.Description, cve.RepairTime, updateTime, cve.CveDetailUrl, commentCmd, holeSource(cve.DataSource), + cve.Description, cve.RepairTime, updateTime, cve.CveDetailUrl+"\n"+getCveDetail(cve.CveNum)+"\n", commentCmd, holeSource(cve.DataSource), genPatchInfo(cve.CveNum), cveAnalysis, openEulerScore, affectedVersion, abiVersion) } else { body = fmt.Sprintf(bodyTplx, cveNumber, cveRepo, cve.CveVersion, scoreType, nveScore, nveVector, - cve.Description, cve.RepairTime, updateTime, cve.CveDetailUrl, commentCmd, holeSource(cve.DataSource), + cve.Description, cve.RepairTime, updateTime, cve.CveDetailUrl+"\n"+getCveDetail(cve.CveNum)+"\n", commentCmd, holeSource(cve.DataSource), genPatchInfo(cve.CveNum), cveAnalysis, openEulerScore, affectedVersion) } if cve.OrganizationID == 3 && assignee != "fangzhou0329" { @@ -1018,11 +1018,11 @@ func CreateIssueBody(accessToken, owner, path, assignee string, body := "" if cve.OrganizationID == 1 { body = fmt.Sprintf(bodyTplx, cveNumber, cvePkg, cve.CveVersion, scoreType, nveScore, nveVector, - cve.Description, cve.RepairTime, updateTime, cve.CveDetailUrl, commentCmd, holeSource(cve.DataSource), + cve.Description, cve.RepairTime, updateTime, cve.CveDetailUrl+"\n"+getCveDetail(cve.CveNum)+"\n", commentCmd, holeSource(cve.DataSource), genPatchInfo(cve.CveNum), cveAnalysis, openEulerScore, affectedVersion, abiVersion) } else { body = fmt.Sprintf(bodyTplx, cveNumber, cveRepo, cve.CveVersion, scoreType, nveScore, nveVector, - cve.Description, cve.RepairTime, updateTime, cve.CveDetailUrl, commentCmd, holeSource(cve.DataSource), + cve.Description, cve.RepairTime, updateTime, cve.CveDetailUrl+"\n"+getCveDetail(cve.CveNum)+"\n", commentCmd, holeSource(cve.DataSource), genPatchInfo(cve.CveNum), cveAnalysis, openEulerScore, affectedVersion) } if cve.OrganizationID == 3 && assignee != "fangzhou0329" { @@ -1038,16 +1038,16 @@ func CreateIssueBody(accessToken, owner, path, assignee string, body := "" if its.Status == 3 && len(its.SecLink) > 3 && cve.OrganizationID == 1 { body = fmt.Sprintf(bodySecLinkTpl, cveNumber, cvePkg, cve.CveVersion, scoreType, nveScore, nveVector, - cve.Description, cve.RepairTime, updateTime, cve.CveDetailUrl, commentCmd, holeSource(cve.DataSource), + cve.Description, cve.RepairTime, updateTime, cve.CveDetailUrl+"\n"+getCveDetail(cve.CveNum)+"\n", commentCmd, holeSource(cve.DataSource), genPatchInfo(cve.CveNum), cveAnalysis, openEulerScore, oVector, affectedVersion, abiVersion, its.SecLink) } else { if cve.OrganizationID == 1 { body = fmt.Sprintf(bodyUpTplx, cveNumber, cvePkg, cve.CveVersion, scoreType, nveScore, nveVector, - cve.Description, cve.RepairTime, updateTime, cve.CveDetailUrl, commentCmd, holeSource(cve.DataSource), + cve.Description, cve.RepairTime, updateTime, cve.CveDetailUrl+"\n"+getCveDetail(cve.CveNum)+"\n", commentCmd, holeSource(cve.DataSource), genPatchInfo(cve.CveNum), cveAnalysis, openEulerScore, oVector, affectedVersion, abiVersion) } else { body = fmt.Sprintf(bodyUpTplx, cveNumber, cveRepo, cve.CveVersion, scoreType, nveScore, nveVector, - cve.Description, cve.RepairTime, updateTime, cve.CveDetailUrl, commentCmd, holeSource(cve.DataSource), + cve.Description, cve.RepairTime, updateTime, cve.CveDetailUrl+"\n"+getCveDetail(cve.CveNum)+"\n", commentCmd, holeSource(cve.DataSource), genPatchInfo(cve.CveNum), cveAnalysis, openEulerScore, oVector, affectedVersion) } } @@ -1063,11 +1063,11 @@ func CreateIssueBody(accessToken, owner, path, assignee string, body := "" if cve.OrganizationID == 1 { body = fmt.Sprintf(bodyTplx, cveNumber, cvePkg, cve.CveVersion, scoreType, nveScore, nveVector, - cve.Description, cve.RepairTime, updateTime, cve.CveDetailUrl, commentCmd, holeSource(cve.DataSource), + cve.Description, cve.RepairTime, updateTime, cve.CveDetailUrl+"\n"+getCveDetail(cve.CveNum)+"\n", commentCmd, holeSource(cve.DataSource), genPatchInfo(cve.CveNum), cveAnalysis, openEulerScore, affectedVersion, abiVersion) } else { body = fmt.Sprintf(bodyTplx, cveNumber, cveRepo, cve.CveVersion, scoreType, nveScore, nveVector, - cve.Description, cve.RepairTime, updateTime, cve.CveDetailUrl, commentCmd, holeSource(cve.DataSource), + cve.Description, cve.RepairTime, updateTime, cve.CveDetailUrl+"\n"+getCveDetail(cve.CveNum)+"\n", commentCmd, holeSource(cve.DataSource), genPatchInfo(cve.CveNum), cveAnalysis, openEulerScore, affectedVersion) } if cve.OrganizationID == 3 && its.Assignee != "fangzhou0329" { @@ -1090,7 +1090,7 @@ func holeSource(sourceCode int8) string { func genPatchInfo(cveNum string) string { tpl := `
-详情 +详情(点击展开) %s
` @@ -1124,6 +1124,42 @@ func genPathInfoContent(info []models.OriginUpstreamPatch) string { return table } +func getCveDetail(cveNum string) string { + tpl := `
+更多参考(点击展开) + +%s +
` + + info, err := models.QueryCveOriginReference(cveNum) + if err != nil { + logs.Error("QueryCveOriginPatchInfo error: ", err) + } + + content := getCveDetailContent(info) + + return fmt.Sprintf(tpl, content) +} + +func getCveDetailContent(info []models.OriginUpstreamReference) string { + if len(info) == 0 { + return "无" + } + + th := `| 参考来源 | 参考链接 | +| ------- | -------- | +` + tc := `| %s | %s | +` + + table := th + for _, v := range info { + table = table + fmt.Sprintf(tc, v.Refsource, v.Url) + } + + return table +} + func AffectVersion(affectedVersion string) int { affectBranchsxList := make([]string, 0) affectValue := make([]string, 0) diff --git a/cve-vulner-manager/taskhandler/excel.go b/cve-vulner-manager/taskhandler/excel.go index 1e86c46c62428b4e2fe2c5ecd366b5f0d20b7ef4..2813817cbe7266c7fd29f1dd17d3be7994e1c4e7 100644 --- a/cve-vulner-manager/taskhandler/excel.go +++ b/cve-vulner-manager/taskhandler/excel.go @@ -1130,7 +1130,8 @@ func getDateByGite(pkgList []models.ExcelPackage, startTime string, c chan<- []I continue } for _, isTemp := range issueTemp { - if len(cves) != 0 && !filterCveInSlice(isTemp.CveNum, cves) { + if len(cves) != 0 && !filterDataInSlice(isTemp.CveNum, cves) { + st = 0 continue } //logs.Info("isTemp===>", isTemp) @@ -1191,7 +1192,7 @@ func UnaffectIssueProc(affectBranch string, cvrfFileList map[string][]string, continue } } - if len(cves) != 0 && !filterCveInSlice(v.CveNum, cves) { + if len(cves) != 0 && !filterDataInSlice(v.CveNum, cves) { continue } //save data to excel @@ -1230,10 +1231,10 @@ func UnaffectIssueProc(affectBranch string, cvrfFileList map[string][]string, } } -//filter existing cves -func filterCveInSlice(cve string, filterCveList []string) bool { - for _, v := range filterCveList { - if strings.EqualFold(cve, v) { +//filter existing data +func filterDataInSlice(data string, filterList []string) bool { + for _, v := range filterList { + if strings.EqualFold(data, v) { return true } } diff --git a/cve-vulner-manager/taskhandler/yaml.go b/cve-vulner-manager/taskhandler/yaml.go index c77324cc2f0ab9c06586f2af21ef54c30bdf16aa..41147be800abe167eeb5dd8fa8d4c8dfff07f8ef 100644 --- a/cve-vulner-manager/taskhandler/yaml.go +++ b/cve-vulner-manager/taskhandler/yaml.go @@ -91,7 +91,7 @@ func GetYaml(url, compURL1 string, page, size int, tc.Page = page tc.Size = size compURL2 := compURL1 + "?table_name=" + tableValue.TableName - for ; ; { + for { compURL := compURL2 + "&page_num=" + strconv.Itoa(tc.Page) + "&page_size=" + strconv.Itoa(size) body, err := util.HTTPGetCom(compURL) @@ -443,6 +443,7 @@ func ProcYamlInfo(valuesX map[string]interface{}, outSyncBranch []string) { if valuesX != nil && len(valuesX) > 0 { for repKey, repValue := range valuesX { if repKey != "" && len(repKey) > 1 { + var branchs = make(map[string]string) //Delete all data first, then insert new data //models.DelOpenEulerRepoOriginByName(repKey) value := repValue.(map[string]interface{}) @@ -454,6 +455,15 @@ func ProcYamlInfo(valuesX map[string]interface{}, outSyncBranch []string) { var er models.OpenEulerRepoOrigin er.PackageName = repKey v := branchValue.(map[string]interface{}) + var ver string + for k, vv := range v { + if strings.EqualFold(k, "version") { + ver = vv.(string) + if _, ok := branchs[ver]; !ok { + branchs[ver] = "" + } + } + } for vKey, vu := range v { switch vKey { case "summary": @@ -462,8 +472,32 @@ func ProcYamlInfo(valuesX map[string]interface{}, outSyncBranch []string) { er.Version = vu.(string) case "brname": er.Branchs = vu.(string) + if !filterDataInSlice(er.Branchs, outSyncBranch) { + branch, ok := branchs[ver] + if !ok { + branchs[ver] = vu.(string) + } else { + if len(branch) == 0 { + branchs[ver] = vu.(string) + } else { + branchs[ver] = branch + "," + vu.(string) + } + } + } case "description": - er.Decription = vu.(string) + switch vu.(type) { + case []interface{}: + des := vu.([]interface{}) + for _, d := range des { + if er.Decription == "" { + er.Decription = d.(string) + } else { + er.Decription = er.Decription + "," + d.(string) + } + } + case string: + er.Decription = vu.(string) + } } } if len(er.Branchs) > 0 { @@ -478,7 +512,7 @@ func ProcYamlInfo(valuesX map[string]interface{}, outSyncBranch []string) { continue } } - UpdateYamlToDb(er) + UpdateYamlToDb(er, branchs) } } } @@ -489,39 +523,22 @@ func ProcYamlInfo(valuesX map[string]interface{}, outSyncBranch []string) { } // Update data to the database -func UpdateYamlToDb(er models.OpenEulerRepoOrigin) { +func UpdateYamlToDb(er models.OpenEulerRepoOrigin, branchs map[string]string) { if len(er.PackageName) > 0 && len(er.Version) > 0 && !strings.Contains(er.Version, "%") { var oro models.OpenEulerRepoOrigin oro.PackageName = er.PackageName oro.Version = er.Version + branch := branchs[er.Version] repErr := models.QueryEulerRepoOrigin(&oro, "PackageName", "Version") if oro.Id > 0 { if len(oro.Decription) < 2 && len(er.Decription) > 2 { oro.Decription = er.Decription } - if len(er.Branchs) > 1 && len(oro.Branchs) > 1 { - BranchSlice := strings.Split(oro.Branchs, ",") - if len(BranchSlice) > 0 { - branchFlag := false - for _, br := range BranchSlice { - if br == er.Branchs { - branchFlag = true - break - } - } - if !branchFlag { - oro.Branchs = oro.Branchs + "," + er.Branchs - } - } - } else { - if len(er.Branchs) > 1 && len(oro.Branchs) < 2 { - oro.Branchs = er.Branchs - } - } + oro.Branchs = branch if len(oro.Summary) < 2 && len(er.Summary) > 2 { oro.Summary = er.Summary } - oro.UpdateTime = er.UpdateTime + oro.UpdateTime = common.GetCurTime() oro.Status = 1 oro.Repo = er.PackageName upErr := models.UpdateEulerRepoOrigin(&oro, "Decription", "Branchs", "Summary", "UpdateTime", "Repo") @@ -529,9 +546,9 @@ func UpdateYamlToDb(er models.OpenEulerRepoOrigin) { } else { logs.Info(repErr) oro.Decription = er.Decription - oro.Branchs = er.Branchs + oro.Branchs = branch oro.Summary = er.Summary - oro.UpdateTime = er.UpdateTime + oro.UpdateTime = common.GetCurTime() oro.PackageName = er.PackageName oro.Version = er.Version oro.Status = 1