Skip to content

Commit ecc2622

Browse files
TG1999TG1999
authored
Merge branch 'main' into debian_importer_v2
2 parents d408b62 + a535807 commit ecc2622

9 files changed

Lines changed: 134 additions & 12 deletions

File tree

‎docs/source/installation.rst‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,10 @@ to run on a different port than 8000.
8484
are several steps that may be needed to secure such a deployment.
8585
Currently, this is not recommendend.
8686

87+
.. tip::
88+
89+
Set ``STAGING`` to ``False`` in production to disable the staging environment warning.
90+
8791
Execute a Command
8892
^^^^^^^^^^^^^^^^^
8993

‎vulnerabilities/pipes/osv_v2.py‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@
1717
from cvss.exceptions import CVSS3MalformedError
1818
from cvss.exceptions import CVSS4MalformedError
1919
from packageurl import PackageURL
20-
from univers.version_constraint import InvalidConstraintsError
2120
from univers.version_constraint import VersionConstraint
2221
from univers.version_constraint import validate_comparators
2322
from univers.version_range import RANGE_CLASS_BY_SCHEMES
@@ -49,7 +48,7 @@
4948
"rubygems": "gem",
5049
"go": "golang",
5150
"hex": "hex",
52-
"cargo": "cargo",
51+
"crates.io": "cargo",
5352
}
5453

5554

‎vulnerabilities/templates/footer.html‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
<footer class="footer">
22
<div class="content has-text-centered">
33
<p>
4-
<strong>VulnerableCode</strong> is free software by <a href="https://github.com/nexB/vulnerablecode"> nexB Inc. and others</a> |
5-
Source code license: <a href="https://github.com/nexB/vulnerablecode/blob/main/apache-2.0.LICENSE">Apache-2.0</a> |
6-
Data license: <a href="https://github.com/nexB/vulnerablecode/blob/main/cc-by-sa-4.0.LICENSE">CC-BY-SA-4.0</a> | <a href="/tos">Terms of Service</a>
4+
<strong>VulnerableCode</strong> is free software by <a href="https://github.com/aboutcode-org/vulnerablecode"> nexB Inc. and others</a> |
5+
Source code license: <a href="https://github.com/aboutcode-org/vulnerablecode/blob/main/apache-2.0.LICENSE">Apache-2.0</a> |
6+
Data license: <a href="https://github.com/aboutcode-org/vulnerablecode/blob/main/cc-by-sa-4.0.LICENSE">CC-BY-SA-4.0</a> | <a href="/tos">Terms of Service</a>
77
</p>
88
</div>
99
</footer>

‎vulnerabilities/templates/navbar.html‎

Lines changed: 20 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,18 @@
11
{% load utils %}
22

3-
<nav class="navbar is-dark mb-5 border-bottom-radius" role="navigation" aria-label="main navigation">
3+
4+
{% if STAGING %}
5+
<div class="notification is-danger has-text-centered is-fixed-top my-0" style="border-radius: 0;">
6+
<span class="icon">
7+
<i class="fa fa-exclamation-triangle"></i>
8+
</span>
9+
<strong> Staging Environment:</strong>
10+
Content and features may be unstable or change without notice.
11+
</div>
12+
{% endif %}
13+
14+
<nav class="navbar is-dark mb-5 border-bottom-radius" role="navigation" aria-label="main navigation"
15+
style="border-radius: 0;">
416
<div class="navbar-brand ml-3">
517
<a class="navbar-item is-size-4 has-text-weight-bold {% active_item 'home' %}" href="{% url 'home' %}">
618
VulnerableCode<span class="nexb-orange">.</span>io
@@ -29,26 +41,27 @@
2941
<div class="navbar-item navbar-item is-cursor-help">
3042
<div class="dropdown is-right is-hoverable ">
3143
<div class="dropdown-trigger has-text-grey-light">About</div>
32-
<div class="dropdown-menu navbar-hover-div" role="menu">
44+
<div class="dropdown-menu navbar-hover-div" role="menu">
3345
<div class="dropdown-content">
3446
<div class="dropdown-item about-hover-div">
3547

3648
VulnerableCode is a free and open database of software package vulnerabilities.
3749
<ul>
3850
<li>
3951
Live chat at <a href="https://gitter.im/aboutcode-org/vulnerablecode">
40-
https://gitter.im/aboutcode-org/vulnerablecode</a>
52+
https://gitter.im/aboutcode-org/vulnerablecode</a>
4153
</li>
4254
<li>
43-
Source code and support at <a href="https://github.com/nexB/vulnerablecode">https://github.com/nexB/vulnerablecode</a>
55+
Source code and support at <a
56+
href="https://github.com/nexB/vulnerablecode">https://github.com/nexB/vulnerablecode</a>
4457
</li>
4558
<li>
46-
Docs at <a href=https://vulnerablecode.readthedocs.org/>
59+
Docs at <a href=https://vulnerablecode.readthedocs.org />
4760
https://vulnerablecode.readthedocs.org/</a>
4861
</li>
4962
<li>
5063
Sponsored by NLnet <a href="https://nlnet.nl/project/vulnerabilitydatabase/">
51-
https://nlnet.nl/project/vulnerabilitydatabase/</a> for
64+
https://nlnet.nl/project/vulnerabilitydatabase/</a> for
5265
<a href="https://www.aboutcode.org/">https://www.aboutcode.org/</a>
5366
</li>
5467
</ul>
@@ -59,7 +72,7 @@
5972
</div>
6073
<div class="navbar-item navbar-item is-cursor-help">
6174
<div class="dropdown-trigger has-text-grey-light">
62-
v{{ VULNERABLECODE_VERSION }}
75+
v{{ VULNERABLECODE_VERSION }}
6376
</div>
6477
</div>
6578
</div>

‎vulnerabilities/tests/pipes/test_osv_v2.py‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -184,6 +184,16 @@ def test_to_advisories_github3(self):
184184
result = imported_data.to_dict()
185185
util_tests.check_results_against_json(result, expected_file)
186186

187+
def test_to_advisories_github4(self):
188+
with open(os.path.join(TEST_DATA, "github/github-4.json")) as f:
189+
mock_response = json.load(f)
190+
expected_file = os.path.join(TEST_DATA, "github/github-expected-4.json")
191+
imported_data = parse_advisory_data_v3(
192+
mock_response, "cargo", advisory_url="https://test.com", advisory_text=""
193+
)
194+
result = imported_data.to_dict()
195+
util_tests.check_results_against_json(result, expected_file)
196+
187197
def test_to_advisories_oss_fuzz1(self):
188198
with open(os.path.join(TEST_DATA, "oss-fuzz/oss-fuzz-1.yaml")) as f:
189199
mock_response = saneyaml.load(f)

‎vulnerabilities/tests/test_data/osv_test/github/github-4.json‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wjxc-pjx9-4wvm",
4+
"modified": "2024-02-03T00:18:06Z",
5+
"published": "2024-02-03T00:18:06Z",
6+
"aliases": [],
7+
"summary": "Nervos CKB Panic on malformed input",
8+
"details": "### Impact\nCKB process will panic when received malformed p2p message because of snappy, which is used to compress network messages\n\n### References\nhttps://github.com/BurntSushi/rust-snappy/issues/29",
9+
"severity": [],
10+
"affected": [
11+
{
12+
"package": {
13+
"ecosystem": "crates.io",
14+
"name": "ckb"
15+
},
16+
"ranges": [
17+
{
18+
"type": "ECOSYSTEM",
19+
"events": [
20+
{
21+
"introduced": "0"
22+
},
23+
{
24+
"fixed": "0.34.2"
25+
}
26+
]
27+
}
28+
],
29+
"database_specific": {
30+
"last_known_affected_version_range": "<= 0.34.1"
31+
}
32+
}
33+
],
34+
"references": [
35+
{
36+
"type": "WEB",
37+
"url": "https://github.com/nervosnetwork/ckb/security/advisories/GHSA-wjxc-pjx9-4wvm"
38+
}
39+
],
40+
"database_specific": {
41+
"cwe_ids": [],
42+
"severity": "HIGH",
43+
"github_reviewed": true,
44+
"github_reviewed_at": "2024-02-03T00:18:06Z",
45+
"nvd_published_at": null
46+
}
47+
}

‎vulnerabilities/tests/test_data/osv_test/github/github-expected-4.json‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
{
2+
"advisory_id": "GHSA-wjxc-pjx9-4wvm",
3+
"aliases": [],
4+
"summary": "Nervos CKB Panic on malformed input\n### Impact\nCKB process will panic when received malformed p2p message because of snappy, which is used to compress network messages\n\n### References\nhttps://github.com/BurntSushi/rust-snappy/issues/29",
5+
"affected_packages": [
6+
{
7+
"package": {
8+
"type": "cargo",
9+
"namespace": "",
10+
"name": "ckb",
11+
"version": "",
12+
"qualifiers": "",
13+
"subpath": ""
14+
},
15+
"affected_version_range": "vers:cargo/<=0.34.1",
16+
"fixed_version_range": "vers:cargo/0.34.2",
17+
"introduced_by_commit_patches": [],
18+
"fixed_by_commit_patches": []
19+
}
20+
],
21+
"references_v2": [
22+
{
23+
"reference_id": "",
24+
"reference_type": "",
25+
"url": "https://github.com/nervosnetwork/ckb/security/advisories/GHSA-wjxc-pjx9-4wvm"
26+
}
27+
],
28+
"patches": [],
29+
"severities": [
30+
{
31+
"system": "generic_textual",
32+
"value": "HIGH",
33+
"scoring_elements": ""
34+
}
35+
],
36+
"date_published": "2024-02-03T00:18:06+00:00",
37+
"weaknesses": [],
38+
"url": "https://test.com"
39+
}

‎vulnerablecode/context_processors.py‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,16 @@
77
# See https://aboutcode.org for more information about nexB OSS projects.
88
#
99

10+
from django.conf import settings
11+
1012
from vulnerablecode import __version__ as vulnerablecode_version
1113

1214

1315
def versions(request):
1416
return {
1517
"VULNERABLECODE_VERSION": vulnerablecode_version,
1618
}
19+
20+
21+
def staging(request):
22+
return {"STAGING": getattr(settings, "STAGING")}

‎vulnerablecode/settings.py‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,9 @@
5151
# SECURITY WARNING: do not run with debug turned on in production
5252
DEBUG_UI = env.bool("VULNERABLECODE_DEBUG_UI", default=False)
5353

54+
# WARNING: Set this to False in production
55+
STAGING = env.bool("STAGING", default=True)
56+
5457
EMAIL_BACKEND = "django.core.mail.backends.smtp.EmailBackend"
5558
EMAIL_HOST = env.str("EMAIL_HOST", default="")
5659
EMAIL_USE_TLS = True
@@ -139,6 +142,7 @@
139142
"django.template.context_processors.request",
140143
"django.template.context_processors.static",
141144
"vulnerablecode.context_processors.versions",
145+
"vulnerablecode.context_processors.staging",
142146
],
143147
},
144148
},

0 commit comments

Comments
 (0)