5d5971cda7
This changes the search method for `undici` on the NVD database. Before, since `undici` did not have a CPE assigned, the search was by keyword. Now that a CPE was assigned, it is used to query for new vulnerabilities. PR-URL: https://github.com/nodejs/node/pull/44128 Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Michael Dawson <midawson@redhat.com> Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com>
99 lines
3.3 KiB
Python
99 lines
3.3 KiB
Python
"""A list of dependencies, including their CPE, names and keywords for querying different vulnerability databases"""
|
|
|
|
from typing import Optional
|
|
import versions_parser as vp
|
|
|
|
|
|
class CPE:
|
|
def __init__(self, vendor: str, product: str):
|
|
self.vendor = vendor
|
|
self.product = product
|
|
|
|
|
|
class Dependency:
|
|
def __init__(
|
|
self,
|
|
version: str,
|
|
cpe: Optional[CPE] = None,
|
|
npm_name: Optional[str] = None,
|
|
keyword: Optional[str] = None,
|
|
):
|
|
self.version = version
|
|
self.cpe = cpe
|
|
self.npm_name = npm_name
|
|
self.keyword = keyword
|
|
|
|
def get_cpe(self) -> Optional[str]:
|
|
if self.cpe:
|
|
return f"cpe:2.3:a:{self.cpe.vendor}:{self.cpe.product}:{self.version}:*:*:*:*:*:*:*"
|
|
else:
|
|
return None
|
|
|
|
|
|
ignore_list: list[str] = [
|
|
"CVE-2018-25032", # zlib, already fixed in the fork Node uses (Chromium's)
|
|
"CVE-2007-5536", # openssl, old and only in combination with HP-UX
|
|
"CVE-2019-0190", # openssl, can be only triggered in combination with Apache HTTP Server version 2.4.37
|
|
]
|
|
|
|
dependencies: dict[str, Dependency] = {
|
|
"zlib": Dependency(
|
|
version=vp.get_zlib_version(), cpe=CPE(vendor="zlib", product="zlib")
|
|
),
|
|
# TODO: Add V8
|
|
# "V8": Dependency("cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "v8"),
|
|
"uvwasi": Dependency(version=vp.get_uvwasi_version(), cpe=None, keyword="uvwasi"),
|
|
"libuv": Dependency(
|
|
version=vp.get_libuv_version(), cpe=CPE(vendor="libuv_project", product="libuv")
|
|
),
|
|
"undici": Dependency(
|
|
version=vp.get_undici_version(),
|
|
cpe=CPE(vendor="nodejs", product="undici"),
|
|
npm_name="undici",
|
|
),
|
|
"OpenSSL": Dependency(
|
|
version=vp.get_openssl_version(), cpe=CPE(vendor="openssl", product="openssl")
|
|
),
|
|
"npm": Dependency(
|
|
version=vp.get_npm_version(),
|
|
cpe=CPE(vendor="npmjs", product="npm"),
|
|
npm_name="npm",
|
|
),
|
|
"nghttp3": Dependency(
|
|
version=vp.get_nghttp3_version(), cpe=None, keyword="nghttp3"
|
|
),
|
|
"ngtcp2": Dependency(version=vp.get_ngtcp2_version(), cpe=None, keyword="ngtcp2"),
|
|
"nghttp2": Dependency(
|
|
version=vp.get_nghttp2_version(), cpe=CPE(vendor="nghttp2", product="nghttp2")
|
|
),
|
|
"llhttp": Dependency(
|
|
version=vp.get_llhttp_version(),
|
|
cpe=CPE(vendor="llhttp", product="llhttp"),
|
|
npm_name="llhttp",
|
|
),
|
|
"ICU": Dependency(
|
|
version=vp.get_icu_version(),
|
|
cpe=CPE(vendor="icu-project", product="international_components_for_unicode"),
|
|
),
|
|
"HdrHistogram": Dependency(version="0.11.2", cpe=None, keyword="hdrhistogram"),
|
|
"corepack": Dependency(
|
|
version=vp.get_corepack_version(),
|
|
cpe=None,
|
|
keyword="corepack",
|
|
npm_name="corepack",
|
|
),
|
|
"CJS Module Lexer": Dependency(
|
|
version=vp.get_cjs_lexer_version(),
|
|
cpe=None,
|
|
keyword="cjs-module-lexer",
|
|
npm_name="cjs-module-lexer",
|
|
),
|
|
"c-ares": Dependency(
|
|
version=vp.get_c_ares_version(),
|
|
cpe=CPE(vendor="c-ares_project", product="c-ares"),
|
|
),
|
|
"brotli": Dependency(
|
|
version=vp.get_brotli_version(), cpe=CPE(vendor="google", product="brotli")
|
|
),
|
|
"acorn": Dependency(version=vp.get_acorn_version(), cpe=None, npm_name="acorn"),
|
|
}
|