[poky][master][PATCH 1/3] cve_check.py: Add new method get_ignored_cves

[Akash Hadke <akash.hadke@kpit.com>]

Add new method get_ignored_cves in cve_check.py
to get ignored CVEs from recipe by excluding distro-wide
ignored CVEs from meta/conf/distro/include/cve-extra-exclusions.inc

While calling this method use below code to get argument values
paths = d.getVar('PATH').split(':')
cves = d.getVar('CVE_CHECK_IGNORE').split()

Signed-off-by: Akash Hadke <akash.hadke@kpit.com>
Signed-off-by: Akash Hadke <hadkeakash4@gmail.com>
---
 meta/lib/oe/cve_check.py | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/meta/lib/oe/cve_check.py b/meta/lib/oe/cve_check.py
index dc7d2e2826..d96d47b737 100644
--- a/meta/lib/oe/cve_check.py
+++ b/meta/lib/oe/cve_check.py
@@ -163,3 +163,41 @@ def cve_check_merge_jsons(output, data):
             return
 
     output["package"].append(data["package"][0])
+
+def get_ignored_cves(paths, cves):
+    """
+    Get ignored CVEs from the recipe and exlude the CVEs from
+    meta/conf/distro/include/cve-extra-exclusions.inc
+
+    While calling this method use below code to get argument values
+    paths = d.getVar('PATH').split(':')
+    cves = d.getVar('CVE_CHECK_IGNORE').split()
+    """
+    import os
+
+    cve_extra_exclusion_inc_file = "../meta/conf/distro/include/cve-extra-exclusions.inc"
+    for path in paths:
+        check_for_correct_file_path = os.path.join(path, cve_extra_exclusion_inc_file)
+        if os.path.isfile(check_for_correct_file_path):
+            inc_file = check_for_correct_file_path
+        else:
+            continue
+
+    cve_check_ignored = set()
+    ignored_cves = set()
+    with open(inc_file) as f:
+        lines = f.readlines()
+        for line in lines:
+            if line.strip():
+                # Ignore the comments from cve-extra-exclusions.inc
+                if not re.search("^#", line):
+                    cve_match = re.findall(r'CVE\-\d{4}\-\d+', line)
+                    for cve in cve_match:
+                        ignored_cves.add(cve)
+
+    for cve in cves:
+        if cve not in ignored_cves:
+            cve_check_ignored.add(cve)
+    ignored_cves_from_recipe = " ".join(cve_check_ignored)
+
+    return ignored_cves_from_recipe
-- 
2.17.1