fix(report): fix cvedb-url, add -cvedb-type=http (#734)

* fix(report): fix cvedb-url, add -cvedb-type=http

* feat(report): support go-exploitdb server mode

* update deps

* implement tui

* fix server mode

* fix(tui): default value of cvedb-type to ""

* update deps

exploit/exploit.go

@@ -18,11 +18,13 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 package exploit
 
 import (
+	"encoding/json"
 	"fmt"
 	"net/http"
 
 	cnf "github.com/future-architect/vuls/config"
 	"github.com/future-architect/vuls/models"
+	"github.com/future-architect/vuls/util"
 	"github.com/mozqnet/go-exploitdb/db"
 	exploitmodels "github.com/mozqnet/go-exploitdb/models"
 	"github.com/parnurzeal/gorequest"
@@ -30,29 +32,49 @@ import (
 
 // FillWithExploit fills exploit information that has in Exploit
 func FillWithExploit(driver db.DB, r *models.ScanResult) (nExploitCve int, err error) {
-	if isFetchViaHTTP() {
-		// TODO
-		return 0, fmt.Errorf("We are not yet supporting data acquisition in exploitdb server mode")
-	}
-
-	if driver == nil {
-		return 0, nil
-	}
-	for cveID, vuln := range r.ScannedCves {
-		es := driver.GetExploitByCveID(cveID)
-		if len(es) == 0 {
-			continue
+	if cnf.Conf.Exploit.IsFetchViaHTTP() {
+		var cveIDs []string
+		for cveID := range r.ScannedCves {
+			cveIDs = append(cveIDs, cveID)
+		}
+		prefix, _ := util.URLPathJoin(cnf.Conf.Exploit.URL, "cves")
+		responses, err := getCvesViaHTTP(cveIDs, prefix)
+		if err != nil {
+			return 0, err
+		}
+		for _, res := range responses {
+			exps := []*exploitmodels.Exploit{}
+			if err := json.Unmarshal([]byte(res.json), &exps); err != nil {
+				return 0, err
+			}
+			exploits := convertToModels(exps)
+			v, ok := r.ScannedCves[res.request.cveID]
+			if ok {
+				v.Exploits = exploits
+			}
+			r.ScannedCves[res.request.cveID] = v
+			nExploitCve++
+		}
+	} else {
+		if driver == nil {
+			return 0, nil
+		}
+		for cveID, vuln := range r.ScannedCves {
+			es := driver.GetExploitByCveID(cveID)
+			if len(es) == 0 {
+				continue
+			}
+			exploits := convertToModels(es)
+			vuln.Exploits = exploits
+			r.ScannedCves[cveID] = vuln
+			nExploitCve++
 		}
-		exploits := ConvertToModel(es)
-		vuln.Exploits = exploits
-		r.ScannedCves[cveID] = vuln
-		nExploitCve++
 	}
 	return nExploitCve, nil
 }
 
-// ConvertToModel converts gost model to vuls model
-func ConvertToModel(es []*exploitmodels.Exploit) (exploits []models.Exploit) {
+// convertToModels converts gost model to vuls model
+func convertToModels(es []*exploitmodels.Exploit) (exploits []models.Exploit) {
 	for _, e := range es {
 		var documentURL, paperURL, shellURL *string
 		if e.OffensiveSecurity != nil {
@@ -68,11 +90,10 @@ func ConvertToModel(es []*exploitmodels.Exploit) (exploits []models.Exploit) {
 			}
 		}
 		exploit := models.Exploit{
-			ExploitType: e.ExploitType,
-			ID:          e.ExploitUniqueID,
-			URL:         e.URL,
-			Description: e.Description,
-
+			ExploitType:  e.ExploitType,
+			ID:           e.ExploitUniqueID,
+			URL:          e.URL,
+			Description:  e.Description,
 			DocumentURL:  documentURL,
 			ShellCodeURL: shellURL,
 			PaperURL:     paperURL,
@@ -84,7 +105,7 @@ func ConvertToModel(es []*exploitmodels.Exploit) (exploits []models.Exploit) {
 
 // CheckHTTPHealth do health check
 func CheckHTTPHealth() error {
-	if !isFetchViaHTTP() {
+	if !cnf.Conf.Exploit.IsFetchViaHTTP() {
 		return nil
 	}
 
@@ -112,8 +133,3 @@ func CheckIfExploitFresh(driver db.DB, osFamily string) (ok bool, err error) {
 	//TODO
 	return true, nil
 }
-
-func isFetchViaHTTP() bool {
-	// Default value of OvalDBType is sqlite3
-	return cnf.Conf.Exploit.URL != "" && cnf.Conf.Exploit.Type == "sqlite3"
-}