Re: [Buildroot] [RFC PATCH 04/14] utils/generate-cyclonedx: support vulnerability details

[Fiona Klute via buildroot <buildroot@buildroot.org>]

Am 24.06.26 um 16:06 schrieb Thomas Perale via buildroot:
> Translate the OpenVex notation used to describe the vulnerabilities that
> aren't patched in Buildroot into the CycloneDX format.
> 
> - fixed -> resolved
> - not-affected-component-not-present -> false_positive
> - not-affected-vulnerable-code-not-present -> not_affected &
>    code_not_present
> - not-affected-vulnerable-code-not-in-execute-path -> not_affected &
>    code_not_reachable
> - not-affected-vulnerable-code-cannot-be-controlled-by-adversary -> not_affected &
>    protected_by_mitigating_control
> 
> See https://cyclonedx.org/docs/1.7/json/#vulnerabilities_items_analysis
> for more information
> 
> Signed-off-by: Thomas Perale <thomas.perale@mind.be>
> ---
>   utils/generate-cyclonedx | 83 +++++++++++++++++++++++++++++++++-------
>   1 file changed, 69 insertions(+), 14 deletions(-)
> 
> diff --git a/utils/generate-cyclonedx b/utils/generate-cyclonedx
> index df12ee84c0..c1aa1f980d 100755
> --- a/utils/generate-cyclonedx
> +++ b/utils/generate-cyclonedx
> @@ -403,6 +403,43 @@ def cyclonedx_dependency(ref, depends):
>           "dependsOn": sorted(depends),
>       }
>   
> +def openvex_to_cyclonedx_analysis(state) -> dict:
> +    """Convert an OpenVex vulnerability state into a CycloneDX analysis.
> +
> +    Supported:
> +      - fixed
> +      - not-affected-component-not-present
> +      - not-affected-vulnerable-code-not-present
> +      - not-affected-vulnerable-code-not-in-execute-path
> +      - not-affected-vulnerable-code-cannot-be-controlled-by-adversary
> +
> +    Args:
> +        state (str): OpenVex status string.
> +
> +    Returns:
> +        dict: CycloneDX analysis dict with 'state' and optional 'justification'.
> +    """
> +    MAPPING = {
> +        "fixed": {
> +            "state": "resolved",
> +        },
> +        "not-affected-component-not-present": {
> +            "state": "false_positive",
> +        },
> +        "not-affected-vulnerable-code-not-present": {
> +            "state": "not_affected",
> +            "justification": "code_not_present",
> +        },
> +        "not-affected-vulnerable-code-not-in-execute-path": {
> +            "state": "not_affected",
> +            "justification": "code_not_reachable",
> +        },
> +        "not-affected-vulnerable-code-cannot-be-controlled-by-adversary": {
> +            "state": "not_affected",
> +            "justification": "protected_by_mitigating_control",
> +        },
> +    }
> +    return MAPPING.get(state, {"state": "in_triage"})

Maybe a bit nitpicky for an RFC, but MAPPING is a constant, so it should 
probably be at module level (with a prefix added to the name) instead of 
recreating it on every call to this function.

Best regards,
Fiona

>   
>   def cyclonedx_vulnerabilities(show_info_dict):
>       """Create a JSON list of vulnerabilities ignored by buildroot and associate
> @@ -421,20 +458,38 @@ def cyclonedx_vulnerabilities(show_info_dict):
>           for cve in comp.get('ignore_cves', []):
>               cves.setdefault(cve, []).append(name)
>   
> -    return [{
> -        "id": cve,
> -        "source": {
> -            "name": "NVD",
> -            "url": "https://nvd.nist.gov/vuln/detail/" + cve
> -        },
> -        "analysis": {
> -            "state": "resolved_with_pedigree" if cve in VULN_WITH_PEDIGREE else "in_triage",
> -            "detail": f"The CVE '{cve}' has been marked as ignored by Buildroot"
> -        },
> -        "affects": [
> -            {"ref": bomref} for bomref in components
> -        ]
> -    } for cve, components in cves.items()]
> +    ret = []
> +    for cve, components in cves.items():
> +        # retrieve first occurance of the "cves_status" for this CVE.
> +        cve_status = next(
> +            (status for comp_name in components
> +             if (status := show_info_dict.get(comp_name, {}).get("cves_status", {}).get(cve, {}))),
> +            {}
> +        )
> +
> +        if cve in VULN_WITH_PEDIGREE:
> +            state = {"state": "resolved_with_pedigree"}
> +        else:
> +            state = openvex_to_cyclonedx_analysis(cve_status.get("status"))
> +
> +        detail = cve_status.get("detail", f"The CVE '{cve}' has been marked as ignored by Buildroot")
> +
> +        ret.append({
> +            "id": cve,
> +            "source": {
> +                "name": "NVD",
> +                "url": "https://nvd.nist.gov/vuln/detail/" + cve
> +            },
> +            "analysis": {
> +                **state,
> +                "detail": detail
> +            },
> +            "affects": [
> +                {"ref": bomref} for bomref in components
> +            ]
> +        })
> +
> +    return ret
>   
>   
>   def br2_virtual_is_provided_by(ref, show_info_dict) -> list:

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot