From 8405e0fad6a405fe9f73952ebac9ad682ab67ecc Mon Sep 17 00:00:00 2001 From: Kota Kanbe Date: Wed, 30 Dec 2020 08:33:30 +0900 Subject: [PATCH] refactor(gost): Duplicate code into function (#1110) * refactor(gost): Duplicate code into function * fix --- gost/base.go | 2 +- gost/redhat.go | 192 +++++++++++++++++++++---------------------------- 2 files changed, 84 insertions(+), 110 deletions(-) diff --git a/gost/base.go b/gost/base.go index d9306088..40524b2c 100644 --- a/gost/base.go +++ b/gost/base.go @@ -19,7 +19,7 @@ type Base struct { // FillCVEsWithRedHat fills cve information that has in Gost func (b Base) FillCVEsWithRedHat(driver db.DB, r *models.ScanResult) error { - return RedHat{}.fillFixed(driver, r) + return RedHat{}.fillCvesWithRedHatAPI(driver, r) } // CheckHTTPHealth do health check diff --git a/gost/redhat.go b/gost/redhat.go index 92e78fdf..aede2fb9 100644 --- a/gost/redhat.go +++ b/gost/redhat.go @@ -21,10 +21,47 @@ type RedHat struct { // DetectUnfixed fills cve information that has in Gost func (red RedHat) DetectUnfixed(driver db.DB, r *models.ScanResult, ignoreWillNotFix bool) (nCVEs int, err error) { - return red.fillUnfixed(driver, r, ignoreWillNotFix) + return red.detectUnfixed(driver, r, ignoreWillNotFix) } -func (red RedHat) fillFixed(driver db.DB, r *models.ScanResult) error { +func (red RedHat) detectUnfixed(driver db.DB, r *models.ScanResult, ignoreWillNotFix bool) (nCVEs int, err error) { + if config.Conf.Gost.IsFetchViaHTTP() { + prefix, _ := util.URLPathJoin(config.Conf.Gost.URL, + "redhat", major(r.Release), "pkgs") + responses, err := getAllUnfixedCvesViaHTTP(r, prefix) + if err != nil { + return 0, err + } + for _, res := range responses { + // CVE-ID: RedhatCVE + cves := map[string]gostmodels.RedhatCVE{} + if err := json.Unmarshal([]byte(res.json), &cves); err != nil { + return 0, err + } + for _, cve := range cves { + if newly := red.setUnfixedCveToScanResult(&cve, r); newly { + nCVEs++ + } + } + } + } else { + if driver == nil { + return 0, nil + } + for _, pack := range r.Packages { + // CVE-ID: RedhatCVE + cves := driver.GetUnfixedCvesRedhat(major(r.Release), pack.Name, ignoreWillNotFix) + for _, cve := range cves { + if newly := red.setUnfixedCveToScanResult(&cve, r); newly { + nCVEs++ + } + } + } + } + return nCVEs, nil +} + +func (red RedHat) fillCvesWithRedHatAPI(driver db.DB, r *models.ScanResult) error { cveIDs := []string{} for cveID, vuln := range r.ScannedCves { if _, ok := vuln.CveContents[models.RedHatAPI]; ok { @@ -48,131 +85,68 @@ func (red RedHat) fillFixed(driver db.DB, r *models.ScanResult) error { if redCve.ID == 0 { continue } - cveCont, mitigations := red.ConvertToModel(&redCve) - v, ok := r.ScannedCves[res.request.cveID] - if ok { - if v.CveContents == nil { - v.CveContents = models.NewCveContents(*cveCont) - } else { - v.CveContents[models.RedHatAPI] = *cveCont - } - } else { - v = models.VulnInfo{ - CveID: cveCont.CveID, - CveContents: models.NewCveContents(*cveCont), - Confidences: models.Confidences{models.RedHatAPIMatch}, - } - } - v.Mitigations = append(v.Mitigations, mitigations...) - r.ScannedCves[res.request.cveID] = v + red.setFixedCveToScanResult(&redCve, r) } } else { if driver == nil { return nil } - for cveID, redCve := range driver.GetRedhatMulti(cveIDs) { + for _, redCve := range driver.GetRedhatMulti(cveIDs) { if len(redCve.Name) == 0 { continue } - cveCont, mitigations := red.ConvertToModel(&redCve) - v, ok := r.ScannedCves[cveID] - if ok { - if v.CveContents == nil { - v.CveContents = models.NewCveContents(*cveCont) - } else { - v.CveContents[models.RedHatAPI] = *cveCont - } - } else { - v = models.VulnInfo{ - CveID: cveCont.CveID, - CveContents: models.NewCveContents(*cveCont), - Confidences: models.Confidences{models.RedHatAPIMatch}, - } - } - v.Mitigations = append(v.Mitigations, mitigations...) - r.ScannedCves[cveID] = v + red.setFixedCveToScanResult(&redCve, r) } } return nil } -func (red RedHat) fillUnfixed(driver db.DB, r *models.ScanResult, ignoreWillNotFix bool) (nCVEs int, err error) { - if config.Conf.Gost.IsFetchViaHTTP() { - prefix, _ := util.URLPathJoin(config.Conf.Gost.URL, - "redhat", major(r.Release), "pkgs") - responses, err := getAllUnfixedCvesViaHTTP(r, prefix) - if err != nil { - return 0, err - } - for _, res := range responses { - // CVE-ID: RedhatCVE - cves := map[string]gostmodels.RedhatCVE{} - if err := json.Unmarshal([]byte(res.json), &cves); err != nil { - return 0, err - } - - for _, cve := range cves { - cveCont, mitigations := red.ConvertToModel(&cve) - v, ok := r.ScannedCves[cve.Name] - if ok { - if v.CveContents == nil { - v.CveContents = models.NewCveContents(*cveCont) - } else { - v.CveContents[models.RedHatAPI] = *cveCont - } - } else { - v = models.VulnInfo{ - CveID: cveCont.CveID, - CveContents: models.NewCveContents(*cveCont), - Confidences: models.Confidences{models.RedHatAPIMatch}, - } - nCVEs++ - } - v.Mitigations = append(v.Mitigations, mitigations...) - pkgStats := red.mergePackageStates(v, - cve.PackageState, r.Packages, r.Release) - if 0 < len(pkgStats) { - v.AffectedPackages = pkgStats - r.ScannedCves[cve.Name] = v - } - } +func (red RedHat) setFixedCveToScanResult(cve *gostmodels.RedhatCVE, r *models.ScanResult) { + cveCont, mitigations := red.ConvertToModel(cve) + v, ok := r.ScannedCves[cveCont.CveID] + if ok { + if v.CveContents == nil { + v.CveContents = models.NewCveContents(*cveCont) + } else { + v.CveContents[models.RedHatAPI] = *cveCont } } else { - if driver == nil { - return 0, nil - } - for _, pack := range r.Packages { - // CVE-ID: RedhatCVE - cves := driver.GetUnfixedCvesRedhat(major(r.Release), pack.Name, ignoreWillNotFix) - for _, cve := range cves { - cveCont, mitigations := red.ConvertToModel(&cve) - v, ok := r.ScannedCves[cve.Name] - if ok { - if v.CveContents == nil { - v.CveContents = models.NewCveContents(*cveCont) - } else { - v.CveContents[models.RedHatAPI] = *cveCont - } - } else { - v = models.VulnInfo{ - CveID: cveCont.CveID, - CveContents: models.NewCveContents(*cveCont), - Confidences: models.Confidences{models.RedHatAPIMatch}, - } - nCVEs++ - } - v.Mitigations = append(v.Mitigations, mitigations...) - pkgStats := red.mergePackageStates(v, - cve.PackageState, r.Packages, r.Release) - if 0 < len(pkgStats) { - v.AffectedPackages = pkgStats - r.ScannedCves[cve.Name] = v - } - } + v = models.VulnInfo{ + CveID: cveCont.CveID, + CveContents: models.NewCveContents(*cveCont), + Confidences: models.Confidences{models.RedHatAPIMatch}, } } - return nCVEs, nil + v.Mitigations = append(v.Mitigations, mitigations...) + r.ScannedCves[cveCont.CveID] = v +} + +func (red RedHat) setUnfixedCveToScanResult(cve *gostmodels.RedhatCVE, r *models.ScanResult) (newly bool) { + cveCont, mitigations := red.ConvertToModel(cve) + v, ok := r.ScannedCves[cve.Name] + if ok { + if v.CveContents == nil { + v.CveContents = models.NewCveContents(*cveCont) + } else { + v.CveContents[models.RedHatAPI] = *cveCont + } + } else { + v = models.VulnInfo{ + CveID: cveCont.CveID, + CveContents: models.NewCveContents(*cveCont), + Confidences: models.Confidences{models.RedHatAPIMatch}, + } + newly = true + } + v.Mitigations = append(v.Mitigations, mitigations...) + pkgStats := red.mergePackageStates(v, + cve.PackageState, r.Packages, r.Release) + if 0 < len(pkgStats) { + v.AffectedPackages = pkgStats + r.ScannedCves[cve.Name] = v + } + return } func (red RedHat) mergePackageStates(v models.VulnInfo, ps []gostmodels.RedhatPackageState, installed models.Packages, release string) (pkgStats models.PackageFixStatuses) {