diff --git a/cve-vulner-manager/common/common.go b/cve-vulner-manager/common/common.go index 6ea9f3a0a1a9b809928a9fef80da33cc54706f14..0a91be37104d2a0ecf941331a881514eaad240c4 100644 --- a/cve-vulner-manager/common/common.go +++ b/cve-vulner-manager/common/common.go @@ -301,6 +301,7 @@ type CveReferenceData struct { Name string `json:"name"` Refsource string `json:"refsource"` Tags []string `json:"tags"` + SourceUrl string `json:"source_url"` } type CveVulType struct { @@ -339,9 +340,9 @@ type CveOriginData struct { Impact CveImpact `json:"impact"` VulStatus string `json:"vulStatus"` Poc CvePoc `json:"poc"` - Event CveEvent `json:"event"` + Event []CveEvent `json:"event"` ReferenceData []CveReferenceData `json:"referenceData"` - VulType CveVulType `json:"vulType"` + VulType []CveVulType `json:"vulType"` FixSuggest CveFixSuggest `json:"fixSuggest"` Version string `json:"version"` Credibility int `json:"credibility"` @@ -367,10 +368,11 @@ type CveOriginDetailData struct { Impact CveImpact `json:"impact"` VulStatus string `json:"vulStatus"` Poc CvePoc `json:"poc"` - Event CveEvent `json:"event"` + Event []CveEvent `json:"event"` ReferenceData []CveReferenceData `json:"referenceData"` - VulType CveVulType `json:"vulType"` + VulType []CveVulType `json:"vulType"` FixSuggest CveFixSuggest `json:"fixSuggest"` + Patch []CveOriginPatch `json:"patch"` } type CveOriginPatch struct { @@ -379,6 +381,7 @@ type CveOriginPatch struct { FixPatch string `json:"fix_patch"` BreakPatch string `json:"break_patch"` Source string `json:"source"` + Branch string `json:"branch"` } func GetRepoOrg() (string, error) { diff --git a/cve-vulner-manager/controllers/cvedetail.go b/cve-vulner-manager/controllers/cvedetail.go index c7012f9346012b208ac74961d3a06314a2b92ab9..68c5a0650751f7095253c98c3882f6f655528ffe 100644 --- a/cve-vulner-manager/controllers/cvedetail.go +++ b/cve-vulner-manager/controllers/cvedetail.go @@ -4,6 +4,7 @@ import ( "cvevulner/common" "cvevulner/errcode" "cvevulner/models" + "github.com/astaxie/beego" "github.com/astaxie/beego/logs" ) @@ -181,13 +182,17 @@ func (u *CveDetailController) Get() { cod.Poc.Desc = oup.Desc cod.Poc.Dbindex = oup.Dbindex } - var oue models.OriginUpstreamEvent + var oue []models.OriginUpstreamEvent oueErr := models.GetOriginEvent(ou.CveId, &oue) - if oueErr == nil && oue.EventId > 0 { - cod.Event.Date = oue.Date - cod.Event.Url = oue.Url - cod.Event.Description = oue.Description - cod.Event.Title = oue.Title + if oueErr == nil && len(oue) > 0 { + for _, v := range oue { + cod.Event = append(cod.Event, common.CveEvent{ + Title: v.Title, + Date: v.Date, + Description: v.Description, + Url: v.Url, + }) + } } var our []models.OriginUpstreamReference ourNum, ourErr := models.GetOriginReference(ou.CveId, &our) @@ -198,15 +203,21 @@ func (u *CveDetailController) Get() { crd.Name = reference.Name crd.Tags = append(crd.Tags, reference.Tags) crd.Refsource = reference.Refsource + crd.SourceUrl = reference.SourceUrl cod.ReferenceData = append(cod.ReferenceData, crd) } } - var ouv models.OriginUpstreamVulType + var ouv []models.OriginUpstreamVulType ouvErr := models.GetOriginVulType(ou.CveId, &ouv) - if ouvErr == nil && ouv.VulId > 0 { - cod.VulType.Cwe = ouv.Cwe - cod.VulType.En = ouv.EnDesc - cod.VulType.Zh = ouv.ZhDesc + if ouvErr == nil && len(ouv) > 0 { + for _, v := range ouv { + cod.VulType = append(cod.VulType, common.CveVulType{ + Cwe: v.Cwe, + En: v.EnDesc, + Zh: v.ZhDesc, + }) + } + } var ouf models.OriginUpstreamFixSuggest oufErr := models.GetOriginFixSuggest(ou.CveId, &ouf) @@ -231,6 +242,14 @@ func (u *CveDetailController) Get() { } cod.FixSuggest.Detail = ouf.Detail } + patch, err := models.QueryCveOriginPatchInfo(cveNum) + if err == nil && len(patch) > 0 { + for _, v := range patch { + cod.Patch = append(cod.Patch, common.CveOriginPatch{ + Package: v.Package, FixVersion: v.FixVersion, FixPatch: v.FixPatch, BreakPatch: v.BreakPatch, Source: v.Source, Branch: v.Branch, + }) + } + } resp["errno"] = errcode.RecodeOk resp["errmsg"] = errcode.RecodeText(errcode.RecodeOk) resp["body"] = cod diff --git a/cve-vulner-manager/controllers/login.go b/cve-vulner-manager/controllers/login.go index 3b91a92c2727b12c574c8541367224df7f255ab3..69bae4f19bbdbf72b70acef603cb9e8a8ff53f60 100644 --- a/cve-vulner-manager/controllers/login.go +++ b/cve-vulner-manager/controllers/login.go @@ -1,14 +1,16 @@ package controllers import ( + "encoding/json" + "fmt" + "time" + "cvevulner/common" "cvevulner/errcode" "cvevulner/models" - "encoding/json" - "fmt" + "github.com/astaxie/beego" "github.com/astaxie/beego/logs" - "time" ) type UserLoginController struct { @@ -66,21 +68,32 @@ func (u *UserLoginController) Post() { } var strc Result username := fmt.Sprintf("%s", req["userName"]) - resp_model, err := models.GetCveUserByUser(username, password) - logs.Info(resp_model) - if resp_model != nil && err == nil { + respModel, err := models.GetCveUserByUser(username, password) + logs.Info(respModel) + if respModel != nil && err == nil { + if exp, ok := respModel[0]["expiration_time"].(string); ok && exp > models.Time2Str() { + if k, kok := respModel[0]["aes_key"].(string); kok { + strc.Key = k + strc.UserId = respModel[0]["user_id"] + resp["body"] = strc + resp["errno"] = errcode.RecodeOk + resp["errmsg"] = errcode.RecodeText(errcode.RecodeOk) + u.RetData(resp) + return + } + } token, terr := common.GenToken(username, password) if terr == nil { strc.Key = token - logs.Info(resp_model[0]["user_id"]) - user_id := resp_model[0]["user_id"] - strc.UserId = user_id + logs.Info(respModel[0]["user_id"]) + userId := respModel[0]["user_id"] + strc.UserId = userId resp["body"] = strc resp["errno"] = errcode.RecodeOk resp["errmsg"] = errcode.RecodeText(errcode.RecodeOk) expirTime := common.GetTokenExpirTime() newTime := time.Now().AddDate(0, 0, expirTime) - models.UpdateToken(resp_model[0]["user_id"], token, newTime) + models.UpdateToken(respModel[0]["user_id"], token, newTime) u.RetData(resp) return } diff --git a/cve-vulner-manager/controllers/upload.go b/cve-vulner-manager/controllers/upload.go index 3774fe9942af47ded7202535b334ff69c30e14e7..6ebc83f21b61f9a3dff242cdd67fa39b76cdf6fc 100644 --- a/cve-vulner-manager/controllers/upload.go +++ b/cve-vulner-manager/controllers/upload.go @@ -327,15 +327,27 @@ func AddOrgUpstream(source int, CveDataDict common.CveOriginData) (ResDataList [ osp.Desc = CveDataDict.Poc.Desc osp.Path = CveDataDict.Poc.Path osp.Source = CveDataDict.Poc.Source - var ose models.OriginUpstreamEvent - ose.Date = CveDataDict.Event.Date - ose.Url = CveDataDict.Event.Url - ose.Description = CveDataDict.Event.Description - ose.Title = CveDataDict.Event.Title - var osv models.OriginUpstreamVulType - osv.ZhDesc = CveDataDict.VulType.Zh - osv.EnDesc = CveDataDict.VulType.En - osv.Cwe = CveDataDict.VulType.Cwe + var ose []*models.OriginUpstreamEvent + if len(CveDataDict.Event) > 0 { + for _, v := range CveDataDict.Event { + var event models.OriginUpstreamEvent + event.Title = v.Title + event.Url = v.Url + event.Date = v.Date + event.Description = v.Description + ose = append(ose, &event) + } + } + var osv []*models.OriginUpstreamVulType + if len(CveDataDict.VulType) > 0 { + for _, v := range CveDataDict.VulType { + var typ models.OriginUpstreamVulType + typ.Cwe = v.Cwe + typ.ZhDesc = v.Zh + typ.EnDesc = v.En + osv = append(osv, &typ) + } + } var osf models.OriginUpstreamFixSuggest osf.Detail = CveDataDict.FixSuggest.Detail dbCve, ok := models.QueryCveOriginByIds(ids) @@ -349,7 +361,7 @@ func AddOrgUpstream(source int, CveDataDict common.CveOriginData) (ResDataList [ } logs.Info("The currently inserted data already exists: ", dbCve) } - _, err := models.CreateOriginCve(CveDataDict, &orCve, &od, &ous, &osi, &osp, &ose, &osv, &osf) + _, err := models.CreateOriginCve(CveDataDict, &orCve, &od, &ous, &osi, &osp, ose, osv, &osf) if err == nil { logs.Info("Cve original data is successfully created CveNum: ", CveDataDict.Ids) ResData.CveNum = CveDataDict.Ids diff --git a/cve-vulner-manager/models/cvedetail.go b/cve-vulner-manager/models/cvedetail.go index 741dc5d3904abfb37186c24153508502f1f96fa2..f975a01aac181907d56625d6e4886d09bd6283a9 100644 --- a/cve-vulner-manager/models/cvedetail.go +++ b/cve-vulner-manager/models/cvedetail.go @@ -95,10 +95,10 @@ func GetOriginPoc(cveId int64, oup *OriginUpstreamPoc) (err error) { return err } -func GetOriginEvent(cveId int64, oue *OriginUpstreamEvent) (err error) { +func GetOriginEvent(cveId int64, oue *[]OriginUpstreamEvent) (err error) { o := orm.NewOrm() - err = o.Raw("select * FROM cve_origin_upstream_event "+ - "WHERE cve_id=?", cveId).QueryRow(oue) + _, err = o.Raw("select * FROM cve_origin_upstream_event "+ + "WHERE cve_id=?", cveId).QueryRows(oue) if err == nil { logs.Info("GetOriginEvent, cve_origin_upstream_event, cve_id: ", cveId, ", search successful") return nil @@ -123,10 +123,10 @@ func GetOriginReference(cveId int64, our *[]OriginUpstreamReference) (num int64, return 0, err } -func GetOriginVulType(cveId int64, ouv *OriginUpstreamVulType) (err error) { +func GetOriginVulType(cveId int64, ouv *[]OriginUpstreamVulType) (err error) { o := orm.NewOrm() - err = o.Raw("select * FROM cve_origin_upstream_vul_type "+ - "WHERE cve_id=?", cveId).QueryRow(ouv) + _, err = o.Raw("select * FROM cve_origin_upstream_vul_type "+ + "WHERE cve_id=?", cveId).QueryRows(ouv) if err == nil { logs.Info("GetOriginVulType, cve_origin_upstream_vul_type, "+ "cve_id: ", cveId, ", search successful") diff --git a/cve-vulner-manager/models/login.go b/cve-vulner-manager/models/login.go index 62dcd79360008093912dba596c0bf9372527a85d..b8523465e4dc0664874e200d51ab6b1c964fbab6 100644 --- a/cve-vulner-manager/models/login.go +++ b/cve-vulner-manager/models/login.go @@ -1,14 +1,15 @@ package models import ( - "github.com/astaxie/beego/orm" "time" + + "github.com/astaxie/beego/orm" ) func GetCveUserByUser(username, pwd string) (maps []orm.Params, err error) { o := orm.NewOrm() var num int64 - num, err = o.Raw("select user_id FROM cve_other_user WHERE user_name=? and pass_word=?", + num, err = o.Raw("select user_id,expiration_time,aes_key FROM cve_other_user WHERE user_name=? and pass_word=?", username, pwd).Values(&maps) if err == nil && num > 0 { return maps, nil diff --git a/cve-vulner-manager/models/modeldb.go b/cve-vulner-manager/models/modeldb.go index 2586d212e72499d8cb63170c2f0d5e54ffb24f94..30493d29032d573815ec533101d6b5342156b674 100644 --- a/cve-vulner-manager/models/modeldb.go +++ b/cve-vulner-manager/models/modeldb.go @@ -402,6 +402,7 @@ type OriginUpstreamPatch struct { FixPatch string `orm:"size(256);column(fix_patch)" description:"修复补丁"` BreakPatch string `orm:"size(256);column(break_patch)" description:"问题引入补丁"` Source string `orm:"size(64);column(source)" description:"来源"` + Branch string `orm:"size(64);column(branch)" description:"分支"` } type OriginUpstreamImpactScore struct { @@ -483,6 +484,7 @@ type OriginUpstreamReference struct { Name string `orm:"size(512);column(name);null" description:"名称"` Refsource string `orm:"size(512);column(refsource);null" description:"参考来源"` Url string `orm:"size(512);column(url);null" description:"链接"` + SourceUrl string `orm:"size(256);column(source_url);null" description:"链接"` Tags string `orm:"type(text);column(tags);null" description:"tags"` } diff --git a/cve-vulner-manager/models/uploadcve.go b/cve-vulner-manager/models/uploadcve.go index 95da6f5e4137d91b1e2c9586f95aff47f4046dd5..9530fa374cd9db6813fa61e72890f8168f79539e 100644 --- a/cve-vulner-manager/models/uploadcve.go +++ b/cve-vulner-manager/models/uploadcve.go @@ -213,8 +213,8 @@ func QueryCveOriginByIds(ids string) (OriginUpstream, bool) { } func CreateOriginCve(CveData common.CveOriginData, ou *OriginUpstream, od *OriginUpstreamDesc, - ous *OriginUpstreamConfig, osi *OriginUpstreamImpact, osp *OriginUpstreamPoc, ose *OriginUpstreamEvent, - osv *OriginUpstreamVulType, osf *OriginUpstreamFixSuggest) (Id int64, err error) { + ous *OriginUpstreamConfig, osi *OriginUpstreamImpact, osp *OriginUpstreamPoc, ose []*OriginUpstreamEvent, + osv []*OriginUpstreamVulType, osf *OriginUpstreamFixSuggest) (Id int64, err error) { o := orm.NewOrm() errs := o.Begin() if errs == nil { @@ -459,24 +459,22 @@ func CreateOriginCve(CveData common.CveOriginData, ou *OriginUpstream, od *Origi o.Rollback() return 0, err } - - ose.CveId = num - lose := OriginUpstreamEvent{CveId: num} - errx := o.Read(&lose, "CveId") - if errx == orm.ErrNoRows || errx == orm.ErrMissPK { - logs.Info("CreateOriginCve, cve_origin_upstream_event, Data does not exist, cveId: ", num) - } else { + if len(ose) > 0 { losed := OriginUpstreamEvent{CveId: num} o.Delete(&losed, "CveId") - } - if osenum, err := o.Insert(ose); err == nil { - logs.Info("CreateOriginCve, insert cve_origin_upstream_event success, "+ - "osenum:", osenum, ", cveNum: ", ou.Ids) - } else { - logs.Error("CreateOriginCve, insert cve_origin_upstream_event failed, "+ - "ose:", ose, ", err: ", err) - o.Rollback() - return 0, err + for k := range ose { + data := ose[k] + data.CveId = num + } + if osenum, err := o.InsertMulti(len(ose), ose); err == nil { + logs.Info("CreateOriginCve, insert cve_origin_upstream_event success, "+ + "osenum:", osenum, ", cveNum: ", ou.Ids) + } else { + logs.Error("CreateOriginCve, insert cve_origin_upstream_event failed, "+ + "ose:", ose, ", err: ", err) + o.Rollback() + return 0, err + } } lousr := OriginUpstreamReference{CveId: num} @@ -486,6 +484,7 @@ func CreateOriginCve(CveData common.CveOriginData, ou *OriginUpstream, od *Origi var lousrd OriginUpstreamReference lousrd.CveId = num lousrd.Url = ref.Url + lousrd.SourceUrl = ref.SourceUrl lousrd.Refsource = ref.Refsource lousrd.Name = ref.Name tags := "" @@ -507,19 +506,23 @@ func CreateOriginCve(CveData common.CveOriginData, ou *OriginUpstream, od *Origi } } } - lousv := OriginUpstreamVulType{CveId: num} - o.Delete(&lousv, "CveId") - osv.CveId = num - if osvnum, err := o.Insert(osv); err == nil { - logs.Info("CreateOriginCve, insert cve_origin_upstream_vul_type success,"+ - " osvnum:", osvnum, ", cveNum: ", ou.Ids) - } else { - logs.Error("CreateOriginCve, insert cve_origin_upstream_vul_type failed, "+ - "osv:", osv, ", err: ", err) - o.Rollback() - return 0, err + if len(osv) > 0 { + lousv := OriginUpstreamVulType{CveId: num} + o.Delete(&lousv, "CveId") + for k := range osv { + typ := osv[k] + typ.CveId = num + } + if osvnum, err := o.InsertMulti(len(osv), osv); err == nil { + logs.Info("CreateOriginCve, insert cve_origin_upstream_vul_type success,"+ + " osvnum:", osvnum, ", cveNum: ", ou.Ids) + } else { + logs.Error("CreateOriginCve, insert cve_origin_upstream_vul_type failed, "+ + "osv:", osv, ", err: ", err) + o.Rollback() + return 0, err + } } - ose.CveId = num lousfs := OriginUpstreamFixSuggest{CveId: num} errxxsx := o.Read(&lousfs, "CveId") if errxxsx == orm.ErrNoRows || errxxsx == orm.ErrMissPK { @@ -827,23 +830,22 @@ func CreateOriginCve(CveData common.CveOriginData, ou *OriginUpstream, od *Origi o.Rollback() return 0, err } - ose.CveId = num - lose := OriginUpstreamEvent{CveId: num} - errx := o.Read(&lose, "CveId") - if errx == orm.ErrNoRows || errx == orm.ErrMissPK { - logs.Info("CreateOriginCve, cve_origin_upstream_event, Data does not exist, cveId: ", num) - } else { + if len(ose) > 0 { losed := OriginUpstreamEvent{CveId: num} o.Delete(&losed, "CveId") - } - if osenum, err := o.Insert(ose); err == nil { - logs.Info("CreateOriginCve, insert cve_origin_upstream_event success, "+ - "osenum:", osenum, ", cveNum: ", ou.Ids) - } else { - logs.Error("CreateOriginCve, insert cve_origin_upstream_event failed, "+ - "ose:", ose, ", err: ", err) - o.Rollback() - return 0, err + for k := range ose { + data := ose[k] + data.CveId = num + } + if osenum, err := o.InsertMulti(len(ose), ose); err == nil { + logs.Info("CreateOriginCve, insert cve_origin_upstream_event success, "+ + "osenum:", osenum, ", cveNum: ", ou.Ids) + } else { + logs.Error("CreateOriginCve, insert cve_origin_upstream_event failed, "+ + "ose:", ose, ", err: ", err) + o.Rollback() + return 0, err + } } lousr := OriginUpstreamReference{CveId: num} o.Delete(&lousr, "CveId") @@ -852,6 +854,7 @@ func CreateOriginCve(CveData common.CveOriginData, ou *OriginUpstream, od *Origi var lousrd OriginUpstreamReference lousrd.CveId = num lousrd.Url = ref.Url + lousrd.SourceUrl = ref.SourceUrl lousrd.Refsource = ref.Refsource lousrd.Name = ref.Name tags := "" @@ -873,19 +876,23 @@ func CreateOriginCve(CveData common.CveOriginData, ou *OriginUpstream, od *Origi } } } - lousv := OriginUpstreamVulType{CveId: num} - o.Delete(&lousv, "CveId") - osv.CveId = num - if osvnum, err := o.Insert(osv); err == nil { - logs.Info("CreateOriginCve, insert cve_origin_upstream_vul_type success, "+ - "osvnum:", osvnum, ", cveNum: ", ou.Ids) - } else { - logs.Error("CreateOriginCve, insert cve_origin_upstream_vul_type failed, "+ - "osv:", osv, ", err: ", err) - o.Rollback() - return 0, err + if len(osv) > 0 { + lousv := OriginUpstreamVulType{CveId: num} + o.Delete(&lousv, "CveId") + for k := range osv { + typ := osv[k] + typ.CveId = num + } + if osvnum, err := o.Insert(osv); err == nil { + logs.Info("CreateOriginCve, insert cve_origin_upstream_vul_type success, "+ + "osvnum:", osvnum, ", cveNum: ", ou.Ids) + } else { + logs.Error("CreateOriginCve, insert cve_origin_upstream_vul_type failed, "+ + "osv:", osv, ", err: ", err) + o.Rollback() + return 0, err + } } - ose.CveId = num lousfs := OriginUpstreamFixSuggest{CveId: num} osErr := o.Read(&lousfs, "CveId") if osErr == orm.ErrNoRows || osErr == orm.ErrMissPK { @@ -983,6 +990,7 @@ func resetOriginPatch(cveData *common.CveOriginData, o orm.Ormer, oid string) er FixPatch: v.FixPatch, BreakPatch: v.BreakPatch, Source: v.Source, + Branch: v.Branch, }) } @@ -1001,7 +1009,7 @@ func QueryCveOriginPatchInfo(cveNum string) ([]OriginUpstreamPatch, error) { return nil, nil } - sql := "select package,fix_version,fix_patch,break_patch,source from cve_origin_upstream_patch where o_id = ?" + sql := "select * from cve_origin_upstream_patch where o_id = ?" o := orm.NewOrm() var res []OriginUpstreamPatch diff --git a/cve-vulner-manager/taskhandler/common.go b/cve-vulner-manager/taskhandler/common.go index 952e03b869097233c3d48b6c305bf9f526585e60..7a55a1d745428642c0fdc4a3edc25db30dbdb70a 100644 --- a/cve-vulner-manager/taskhandler/common.go +++ b/cve-vulner-manager/taskhandler/common.go @@ -1171,15 +1171,15 @@ func getCveDetailContent(info []models.OriginUpstreamReference) string { return "无" } - th := `| 参考来源 | 参考链接 | -| ------- | -------- | + th := `| 参考来源 | 参考链接 | 来源链接 | +| ------- | -------- | -------- | ` - tc := `| %s | %s | + tc := `| %s | %s | %s | ` table := th for _, v := range info { - table = table + fmt.Sprintf(tc, v.Refsource, v.Url) + table = table + fmt.Sprintf(tc, v.Refsource, v.Url, v.SourceUrl) } return table