From mboxrd@z Thu Jan 1 00:00:00 1970 From: Thomas Petazzoni Date: Fri, 28 Aug 2020 11:45:55 +0200 Subject: [Buildroot] [PATCH v3 5/8] support/scripts: Add a per configuration CVE checker In-Reply-To: <20200724154356.2607639-6-gregory.clement@bootlin.com> References: <20200724154356.2607639-1-gregory.clement@bootlin.com> <20200724154356.2607639-6-gregory.clement@bootlin.com> Message-ID: <20200828114555.18c19e9c@windsurf.home> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: buildroot@busybox.net Hello, On Fri, 24 Jul 2020 17:43:53 +0200 Gregory CLEMENT wrote: > This scripts takes as entry on stdin a JSON description of the package > used for a given configuration. This description is the one generated > by "make show-info". > > The script generates the list of all the package used and if they are > affected by a CVE. The output is either a JSON or an HTML file similar > to the one generated by pkg-stats. > > Signed-off-by: Gregory CLEMENT Thanks, I have applied to next, but after doing a number of changes, see below. > +import argparse > +import datetime > +import os > +import json > +import sys > + > +sys.path.append('utils/') This was not needed. > + > +import cve as cvecheck > + > +class Package: > + def __init__(self, name, version, ignored_cves): > + self.name = name > + self.version = version > + self.cves = list() > + self.ignored_cves = ignored_cves > + > +def check_package_cves(nvd_path, packages): > + if not os.path.isdir(nvd_path): > + os.makedirs(nvd_path) > + > + for cve in cvecheck.CVE.read_nvd_dir(nvd_path): > + for pkg_name in cve.pkg_names: > + pkg = packages.get(pkg_name, '') > + if pkg and cve.affects(pkg.name, pkg.version, pkg.ignored_cves): This was not correct as cve.affects() no longer returns a boolean. Due to this, all existing CVEs were reported in the generated HTML/JSON as affecting the package. > + pkg.cves.append(cve.identifier) > + > +html_header = """ > + > + > + > +CVE status for Buildroot packages Changed "Buildroot packages" for "Buildroot configuration". Indeed, compared to pkg-stats which operates on all packages (it's a tool for Buildroot maintenance), cve-checker is really about a given Buildroot configuration. > +def infra_str(infra_list): This function was not used anywhere, so I dropped it. > +def boolean_str(b): This function was not used anywhere, so I dropped it. > +def dump_json(packages, date, output): > + # Format packages as a dictionnary instead of a list > + # Exclude local field that does not contains real date > + excluded_fields = ['url_worker', 'name'] > + pkgs = { > + pkg.name: { > + k: v > + for k, v in pkg.__dict__.items() > + if k not in excluded_fields > + } for pkg in packages I simplified that a bit, as we don't want all fields in the JSON I believe, just the version and list of CVEs. For example, the list of ignored CVEs is not really relevant. > + > +def parse_args(): > + parser = argparse.ArgumentParser() > + output = parser.add_argument_group('output', 'Output file(s)') > + output.add_argument('--html', dest='html', type=resolvepath, > + help='HTML output file') > + output.add_argument('--json', dest='json', type=resolvepath, > + help='JSON output file') > + packages = parser.add_mutually_exclusive_group() This line was not used. > + parser.add_argument('--nvd-path', dest='nvd_path', > + help='Path to the local NVD database',type=resolvepath, > + default='./nvd_dl') The default value doesn't exist for pkg-stats, I'm not sure it makes sense to have a default value. I've however added a required=True because this script doesn't do anything useful if we don't have access to the NVD data. > +def __main__(): > + packages = list() > + exclude_pacakges = ["linux", "gcc"] I'm not sure why those two packages were excluded, so I've dropped that, at least for now. We can of course improve things later on. > + content = json.load(sys.stdin) > + for item in content: > + if item in exclude_pacakges: > + continue > + pkg = content[item] > + p = Package(item, pkg.get('version', ''), pkg.get('ignore_cves', '')) > + packages.append(p) > + > + args = parse_args() > + date = datetime.datetime.utcnow() > + > + if args.nvd_path: I've dropped this "if", since args.nvd_path is a required option. As said above: applied to next with all those changes. Thanks! Thomas -- Thomas Petazzoni, CTO, Bootlin Embedded Linux and Kernel engineering https://bootlin.com