Class: Brew::Vulns::Vulnerability

Inherits:
Object
  • Object
show all
Defined in:
lib/brew/vulns/vulnerability.rb

Constant Summary collapse

CVSS_TYPE_PRIORITY = 
{
  "CVSS_V4" => 4,
  "CVSS_V3" => 3,
  "CVSS_V2" => 2
}.freeze

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(data) ⇒ Vulnerability

Returns a new instance of Vulnerability.



18
19
20
21
22
23
24
25
26
 
# File 'lib/brew/vulns/vulnerability.rb', line 18

def initialize(data)
  @id = data["id"]
  @summary = data["summary"]
  @details = data["details"]
  @aliases = data["aliases"] || []
  @references = data["references"] || []
  @affected = data["affected"] || []
  @severity = extract_severity(data)
end

Instance Attribute Details

#affected ⇒ Object (readonly)

Returns the value of attribute affected.



16
17
18
 
# File 'lib/brew/vulns/vulnerability.rb', line 16

def affected
  @affected
end

#aliases ⇒ Object (readonly)

Returns the value of attribute aliases.



16
17
18
 
# File 'lib/brew/vulns/vulnerability.rb', line 16

def aliases
  @aliases
end

#details ⇒ Object (readonly)

Returns the value of attribute details.



16
17
18
 
# File 'lib/brew/vulns/vulnerability.rb', line 16

def details
  @details
end

#id ⇒ Object (readonly)

Returns the value of attribute id.



16
17
18
 
# File 'lib/brew/vulns/vulnerability.rb', line 16

def id
  @id
end

#references ⇒ Object (readonly)

Returns the value of attribute references.



16
17
18
 
# File 'lib/brew/vulns/vulnerability.rb', line 16

def references
  @references
end

#severity ⇒ Object (readonly)

Returns the value of attribute severity.



16
17
18
 
# File 'lib/brew/vulns/vulnerability.rb', line 16

def severity
  @severity
end

#summary ⇒ Object (readonly)

Returns the value of attribute summary.



16
17
18
 
# File 'lib/brew/vulns/vulnerability.rb', line 16

def summary
  @summary
end

Class Method Details

.from_osv_list(vulns_data) ⇒ Object 



80
81
82
 
# File 'lib/brew/vulns/vulnerability.rb', line 80

def self.from_osv_list(vulns_data)
  vulns_data.map { |data| new(data) }
end

Instance Method Details

#advisory_url ⇒ Object 



46
47
48
49
 
# File 'lib/brew/vulns/vulnerability.rb', line 46

def advisory_url
  ref = references.find { |r| r["type"] == "ADVISORY" }
  ref&.dig("url")
end

#affects_version?(version, default_ecosystem = "gem") ⇒ Boolean

Returns:

  • (Boolean) 


67
68
69
70
71
72
73
74
75
76
77
78
 
# File 'lib/brew/vulns/vulnerability.rb', line 67

def affects_version?(version, default_ecosystem = "gem")
  return true if affected.empty?

  normalized_version = normalize_version(version)

  affected.any? do |aff|
    ecosystem = extract_ecosystem(aff, default_ecosystem)

    in_explicit_versions?(aff, normalized_version) ||
      in_semver_ranges?(aff, normalized_version, ecosystem)
  end
end

#build_constraint_sets(events) ⇒ Object 



176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
 
# File 'lib/brew/vulns/vulnerability.rb', line 176

def build_constraint_sets(events)
  constraint_sets = []
  constraints = nil

  events.each do |event|
    if event["introduced"]
      constraints = []
      intro = normalize_version(event["introduced"])
      constraints << ">=#{intro}" unless intro == "0"
    elsif event["fixed"]
      constraints ||= []
      constraints << "<#{normalize_version(event["fixed"])}"
      constraint_sets << constraints
      constraints = nil
    elsif event["last_affected"]
      constraints ||= []
      constraints << "<=#{normalize_version(event["last_affected"])}"
      constraint_sets << constraints
      constraints = nil
    elsif event["limit"]
      constraints ||= []
      limit_constraint = build_limit_constraint(event["limit"])
      constraints << limit_constraint if limit_constraint
      constraint_sets << constraints
      constraints = nil
    end
  end

  constraint_sets << constraints if constraints
  constraint_sets
end

#build_limit_constraint(limit) ⇒ Object 



208
209
210
211
212
213
 
# File 'lib/brew/vulns/vulnerability.rb', line 208

def build_limit_constraint(limit)
  limit = limit.to_s
  return if limit == "*"

  "<#{normalize_version(limit)}"
end

#cve_ids ⇒ Object 



42
43
44
 
# File 'lib/brew/vulns/vulnerability.rb', line 42

def cve_ids
  ([id] + aliases).select { |a| a.start_with?("CVE-") }
end

#cvss_severities(severities) ⇒ Object 



107
108
109
110
111
 
# File 'lib/brew/vulns/vulnerability.rb', line 107

def cvss_severities(severities)
  severities
    .select { |sev| CVSS_TYPE_PRIORITY.key?(sev["type"]) }
    .sort_by { |sev| -CVSS_TYPE_PRIORITY.fetch(sev["type"], 0) }
end

#extract_ecosystem(aff, default_ecosystem) ⇒ Object 



140
141
142
143
144
145
146
147
148
149
 
# File 'lib/brew/vulns/vulnerability.rb', line 140

def extract_ecosystem(aff, default_ecosystem)
  purl_str = aff.dig("package", "purl")
  return default_ecosystem unless purl_str

  purl = Purl.parse(purl_str)
  purl.type
rescue StandardError => e
  warn "Warning: Failed to parse purl '#{purl_str}': #{e.message}"
  default_ecosystem
end

#extract_severity(data) ⇒ Object 



84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
 
# File 'lib/brew/vulns/vulnerability.rb', line 84

def extract_severity(data)
  if data["severity"]&.any?
    cvss_severities(data["severity"]).each do |sev|
      cvss_severity = severity_from_cvss(sev["score"])
      return cvss_severity if cvss_severity
    end
  end

  if data.dig("database_specific", "severity")
    return normalize_severity(data.dig("database_specific", "severity"))
  end

  data["affected"]&.each do |aff|
    eco_sev = aff.dig("ecosystem_specific", "severity")
    return normalize_severity(eco_sev) if eco_sev

    db_sev = aff.dig("database_specific", "severity")
    return normalize_severity(db_sev) if db_sev
  end

  nil
end

#fix_urls ⇒ Object 



51
52
53
 
# File 'lib/brew/vulns/vulnerability.rb', line 51

def fix_urls
  references.select { |r| r["type"] == "FIX" }.map { |r| r["url"] }
end

#fixed_versions ⇒ Object 



55
56
57
58
59
60
61
62
63
64
65
 
# File 'lib/brew/vulns/vulnerability.rb', line 55

def fixed_versions
  versions = []
  affected.each do |aff|
    (aff["ranges"] || []).each do |range|
      (range["events"] || []).each do |event|
        versions << event["fixed"] if event["fixed"]
      end
    end
  end
  versions.uniq
end

#in_explicit_versions?(aff, version) ⇒ Boolean

Returns:

  • (Boolean) 


151
152
153
154
 
# File 'lib/brew/vulns/vulnerability.rb', line 151

def in_explicit_versions?(aff, version)
  versions = aff["versions"] || []
  versions.any? { |v| normalize_version(v) == version }
end

#in_semver_ranges?(aff, version, ecosystem) ⇒ Boolean

Returns:

  • (Boolean) 


156
157
158
159
160
161
162
163
 
# File 'lib/brew/vulns/vulnerability.rb', line 156

def in_semver_ranges?(aff, version, ecosystem)
  ranges = aff["ranges"] || []
  semver_ranges = ranges.select { |r| r["type"] == "SEMVER" }

  semver_ranges.any? do |range|
    version_in_range?(version, range["events"], ecosystem)
  end
end

#normalize_severity(severity) ⇒ Object 



113
114
115
116
117
118
119
120
121
122
 
# File 'lib/brew/vulns/vulnerability.rb', line 113

def normalize_severity(severity)
  return nil unless severity

  case severity.downcase
  when "critical" then "critical"
  when "high" then "high"
  when "moderate", "medium" then "medium"
  when "low" then "low"
  end
end

#normalize_version(version) ⇒ Object 



136
137
138
 
# File 'lib/brew/vulns/vulnerability.rb', line 136

def normalize_version(version)
  version.sub(/^v/, "")
end

#severity_display ⇒ Object 



28
29
30
 
# File 'lib/brew/vulns/vulnerability.rb', line 28

def severity_display
  severity&.upcase || "UNKNOWN"
end

#severity_from_cvss(vector) ⇒ Object 



124
125
126
127
128
129
130
131
132
133
134
 
# File 'lib/brew/vulns/vulnerability.rb', line 124

def severity_from_cvss(vector)
  return nil if vector.to_s.empty?

  cvss = CvssSuite.new(vector)

  normalize_severity(cvss.severity)
rescue StandardError
  warn "Warning: Failed to determine severity from CVSS vector " \
       "'#{vector}' for '#{id}'"
  nil
end

#severity_level ⇒ Object 



32
33
34
35
36
37
38
39
40
 
# File 'lib/brew/vulns/vulnerability.rb', line 32

def severity_level
  case severity&.downcase
  when "critical" then 4
  when "high" then 3
  when "medium" then 2
  when "low" then 1
  else 0
  end
end

#version_in_range?(version, events, ecosystem) ⇒ Boolean

Returns:

  • (Boolean) 


165
166
167
168
169
170
171
172
173
174
 
# File 'lib/brew/vulns/vulnerability.rb', line 165

def version_in_range?(version, events, ecosystem)
  return false if events.nil? || events.empty?

  build_constraint_sets(events).any? do |constraints|
    constraints.empty? || Vers.satisfies?(version, constraints.join(","), ecosystem)
  end
rescue StandardError => e
  warn "Warning: Failed to check version '#{version}' against constraints: #{e.message}"
  true
end