Class: Nexpose::Vulnerability

Inherits:
Object
  • Object
show all
Defined in:
lib/nexpose/vulnerability.rb

Overview

This class represents each of the /NexposeReport/VulnerabilityDefinitions/vulnerability elements in the Nexpose Full XML document.

It provides a convenient way to access the information scattered all over the XML in attributes and nested tags.

Instead of providing separate methods for each supported property we rely on Ruby’s #method_missing to do most of the work.

Constant Summary collapse

SSL_CIPHER_VULN_IDS = 
%w[ssl-anon-ciphers ssl-des-ciphers ssl-3des-ciphers ssl-export-ciphers ssl-null-ciphers ssl-only-weak-ciphers ssl-static-key-ciphers ssl-weak-message-authentication-code-algorithms rc4-cve-2013-2566 ssl-cve-2016-2183-sweet32 tls-dhe-export-ciphers-cve-2015-4000].freeze

Instance Method Summary collapse

Constructor Details

#initialize(xml_node) ⇒ Vulnerability

Accepts an XML node from Nokogiri::XML.



14
15
16
 
# File 'lib/nexpose/vulnerability.rb', line 14

def initialize(xml_node)
  @xml = xml_node
end

Dynamic Method Handling

This class handles dynamic methods through the method_missing method

#method_missing(method, *args) ⇒ Object

This method is invoked by Ruby when a method that is not defined in this instance is called.

In our case we inspect the @method@ parameter and try to find the attribute, simple descendent or collection that it maps to in the XML tree.



51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
 
# File 'lib/nexpose/vulnerability.rb', line 51

def method_missing(method, *args)

  # We could remove this check and return nil for any non-recognized tag.
  # The problem would be that it would make tricky to debug problems with
  # typos. For instance: <>.potr would return nil instead of raising an
  # exception
  unless supported_tags.include?(method)
    super
    return
  end

  # First we try the attributes. In Ruby we use snake_case, but in XML
  # CamelCase is used for some attributes
  translations_table = {
    :nexpose_id => 'id',
    :pci_severity => 'pciSeverity',
    :risk_score => 'riskScore',
    :cvss_score => 'cvssScore',
    :cvss_vector =>'cvssVector'
  }

  method_name = translations_table.fetch(method, method.to_s)
  return @xml.attributes[method_name].value if @xml.attributes.key?(method_name)

  # Then we try simple children tags: description, solution
  tag = @xml.xpath("./#{method_name}/ContainerBlockElement").first
  # Then we try the tags with nested content
  nest = @xml.xpath("./#{method_name}").first

  # We need to clean up tags that have HTML content in them
  if tags_with_html_content.include?(method)
    result = cleanup_html(tag)
    result = add_bc_to_ssl_cipher_list(result) if SSL_CIPHER_VULN_IDS.include?(@xml.attributes['id'].value)
    return result
  # And we need to clean up the tags with nested content in them
  elsif tags_with_nested_content.include?(method)
    return cleanup_nested(nest)
  else
    return tag
  end

  # Handle evidence creation
  if method_name == 'details'
    vuln_id = @xml.attributes['id'].value

    return @xml.xpath("//test[@id='#{vuln_id}']/Paragraph").
      text.split("\n").
      collect(&:strip).
      reject{|line| line.empty?}.join("\n")
  end

  nil
end

Instance Method Details

#respond_to?(method, include_private = false) ⇒ Boolean

This allows external callers (and specs) to check for implemented properties

Returns:

  • (Boolean) 


40
41
42
43
 
# File 'lib/nexpose/vulnerability.rb', line 40

def respond_to?(method, include_private=false)
  return true if supported_tags.include?(method.to_sym)
  super
end

#supported_tags ⇒ Object

List of supported tags. They can be attributes, simple descendans or collections (e.g. <references/>, <tags/>)



20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
 
# File 'lib/nexpose/vulnerability.rb', line 20

def supported_tags
  [
    # attributes
    :added, :cvss_score, :cvss_vector, :modified, :nexpose_id, :pci_severity, 
    :published, :risk_score, :severity, :title,

    # simple tags
    :description, :solution,

    # multiple tags
    :references, :tags,

    # evidence tag
    :details
  ]
end