Add support for vulnerability data to entities model

src/NuGet.Services.Entities/CVE.cs

@@ -0,0 +1,43 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System.Collections.Generic;
+using System.ComponentModel.DataAnnotations;
+using System.ComponentModel.DataAnnotations.Schema;
+
+namespace NuGet.Services.Entities
+{
+    /// <summary>
+    /// Represents a Common Vulnerability and Exposure (CVE).
+    /// </summary>
+    public class CVE
+        : IEntity
+    {
+        /// <summary>
+        /// Gets or sets the primary key for the entity.
+        /// </summary>
+        public int Key { get; set; }
+
+        /// <summary>
+        /// Gets or sets the unique CVE ID.
+        /// The CVE ID number has four or more digits in the sequence number portion of the ID (e.g., "CVE-1999-0067", "CVE-2014-12345", "CVE-2016-7654321").
+        /// </summary>
+        // sources:
+        //  * https://cve.mitre.org/cve/identifiers/syntaxchange.html
+        //  * https://cve.mitre.org/about/faqs.html#what_is_cve_id
+        [Index(IsUnique = true)]
+        [Required]
+        [MaxLength(20)]
+        public string CVEId { get; set; }
+
+        /// <summary>
+        /// Gets or sets the description of the CVE.
+        /// The description is a plain language field that describes the vulnerability with sufficient detail as to demonstrate that the vulnerability is unique.
+        /// </summary>
+        [MaxLength(4000)]
+        [Required]
+        public string Description { get; set; }
+
+        public virtual ICollection<PackageDeprecation> PackageDeprecations { get; set; }
+    }
+}

src/NuGet.Services.Entities/CWE.cs

@@ -0,0 +1,45 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System.Collections.Generic;
+using System.ComponentModel.DataAnnotations;
+using System.ComponentModel.DataAnnotations.Schema;
+
+namespace NuGet.Services.Entities
+{
+    /// <summary>
+    /// Represents a Common Weakness Enumeration (CWE).
+    /// </summary>
+    public class CWE
+        : IEntity
+    {
+        /// <summary>
+        /// Gets or sets the primary key for the entity.
+        /// </summary>
+        public int Key { get; set; }
+
+        /// <summary>
+        /// Gets or sets the unique CWE-ID.
+        /// </summary>
+        [Index(IsUnique = true)]
+        [Required]
+        [MaxLength(20)]
+        public string CWEId { get; set; }
+
+        /// <summary>
+        /// Gets or sets the name of the CWE.
+        /// </summary>
+        [MaxLength(200)]
+        [Required]
+        public string Name { get; set; }
+
+        /// <summary>
+        /// Gets or sets the description of the CWE.
+        /// </summary>
+        [MaxLength(600)]
+        [Required]
+        public string Description { get; set; }
+
+        public virtual ICollection<PackageDeprecation> PackageDeprecations { get; set; }
+    }
+}

src/NuGet.Services.Entities/NuGet.Services.Entities.csproj

@@ -52,6 +52,8 @@
     <Compile Include="Credential.cs" />
     <Compile Include="CuratedFeed.cs" />
     <Compile Include="CuratedPackage.cs" />
+    <Compile Include="CVE.cs" />
+    <Compile Include="CWE.cs" />
     <Compile Include="EmailMessage.cs" />
     <Compile Include="EmbeddedLicenseFileType.cs" />
     <Compile Include="EntityException.cs" />

src/NuGet.Services.Entities/PackageDeprecation.cs

@@ -2,6 +2,7 @@
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
 using System;
+using System.Collections.Generic;
 using System.ComponentModel.DataAnnotations;
 using System.ComponentModel.DataAnnotations.Schema;
 
@@ -93,15 +94,13 @@ public class PackageDeprecation
         public decimal? CVSSRating { get; set; }
 
         /// <summary>
-        /// Gets or sets the serialized JSON object containing an array of CVE ID's related to this deprecation.
-        /// The JSON object should have a version property that defines the version of its schema.
+        /// Gets or sets the collection of CVE's related to this deprecation.
         /// </summary>
-        public string CVEIds { get; set; }
+        public virtual ICollection<CVE> CVEs { get; set; }
 
         /// <summary>
-        /// Gets or sets the serialized JSON object containing an array of CWE ID's related to this deprecation.
-        /// The JSON object should have a version property that defines the version of its schema.
+        /// Gets or sets the collection of CWE's related to this deprecation.
         /// </summary>
-        public string CWEIds { get; set; }
+        public virtual ICollection<CWE> CWEs { get; set; }
     }
 }

src/NuGetGallery.Core/Entities/EntitiesContext.cs

@@ -61,6 +61,8 @@ public EntitiesContext(DbConnection connection, bool readOnly)
         /// User or organization accounts.
         /// </summary>
         public IDbSet<User> Users { get; set; }
+        public IDbSet<CVE> CVEs { get; set; }
+        public IDbSet<CWE> CWEs { get; set; }
 
         IDbSet<T> IEntitiesContext.Set<T>()
         {
@@ -371,6 +373,35 @@ protected override void OnModelCreating(DbModelBuilder modelBuilder)
             modelBuilder.Entity<PackageDeprecation>()
                 .HasKey(d => d.Key);
 
+            modelBuilder.Entity<CVE>()
+                .HasKey(d => d.Key)
+                .Property(e => e.CVEId)
+                .HasColumnType("varchar")
+                .HasMaxLength(20)
+                .IsRequired();
+
+            modelBuilder.Entity<CVE>()
+                .Property(e => e.Description)
+                .HasMaxLength(4000)
+                .IsRequired();
+
+            modelBuilder.Entity<CWE>()
+                .HasKey(d => d.Key)
+                .Property(e => e.CWEId)
+                .HasColumnType("varchar")
+                .HasMaxLength(20)
+                .IsRequired();
+
+            modelBuilder.Entity<CWE>()
+                .Property(e => e.Name)
+                .HasMaxLength(200)
+                .IsRequired();
+
+            modelBuilder.Entity<CWE>()
+                .Property(e => e.Description)
+                .HasMaxLength(600)
+                .IsRequired();
+
             modelBuilder.Entity<Package>()
                 .HasMany(p => p.Deprecations)
                 .WithRequired(d => d.Package)
@@ -398,6 +429,14 @@ protected override void OnModelCreating(DbModelBuilder modelBuilder)
             modelBuilder.Entity<PackageDeprecation>()
                 .Property(v => v.CVSSRating)
                 .HasPrecision(3, 1);
+
+            modelBuilder.Entity<PackageDeprecation>()
+                .HasMany(p => p.CVEs)
+                .WithMany(c => c.PackageDeprecations);
+
+            modelBuilder.Entity<PackageDeprecation>()
+                .HasMany(p => p.CWEs)
+                .WithMany(c => c.PackageDeprecations);
         }
 #pragma warning restore 618
     }

src/NuGetGallery.Core/Entities/IEntitiesContext.cs

@@ -18,6 +18,8 @@ public interface IEntitiesContext
         IDbSet<ReservedNamespace> ReservedNamespaces { get; set; }
         IDbSet<UserCertificate> UserCertificates { get; set; }
         IDbSet<SymbolPackage> SymbolPackages { get; set; }
+        IDbSet<CVE> CVEs { get; set; }
+        IDbSet<CWE> CWEs { get; set; }
 
         Task<int> SaveChangesAsync();
         IDbSet<T> Set<T>() where T : class;

src/NuGetGallery/Migrations/201902051333015_AddVulnerabilityEntities.cs

@@ -0,0 +1,83 @@
+namespace NuGetGallery.Migrations
+{
+    using System;
+    using System.Data.Entity.Migrations;
+
+    public partial class AddVulnerabilityEntities : DbMigration
+    {
+        public override void Up()
+        {
+            CreateTable(
+                "dbo.CVEs",
+                c => new
+                    {
+                        Key = c.Int(nullable: false, identity: true),
+                        CVEId = c.String(nullable: false, maxLength: 20, unicode: false),
+                        Description = c.String(nullable: false, maxLength: 4000),
+                    })
+                .PrimaryKey(t => t.Key)
+                .Index(t => t.CVEId, unique: true);
+
+            CreateTable(
+                "dbo.CWEs",
+                c => new
+                    {
+                        Key = c.Int(nullable: false, identity: true),
+                        CWEId = c.String(nullable: false, maxLength: 20, unicode: false),
+                        Name = c.String(nullable: false, maxLength: 200),
+                        Description = c.String(nullable: false, maxLength: 600),
+                    })
+                .PrimaryKey(t => t.Key)
+                .Index(t => t.CWEId, unique: true);
+
+            CreateTable(
+                "dbo.PackageDeprecationCVEs",
+                c => new
+                    {
+                        PackageDeprecation_Key = c.Int(nullable: false),
+                        CVE_Key = c.Int(nullable: false),
+                    })
+                .PrimaryKey(t => new { t.PackageDeprecation_Key, t.CVE_Key })
+                .ForeignKey("dbo.PackageDeprecations", t => t.PackageDeprecation_Key, cascadeDelete: true)
+                .ForeignKey("dbo.CVEs", t => t.CVE_Key, cascadeDelete: true)
+                .Index(t => t.PackageDeprecation_Key)
+                .Index(t => t.CVE_Key);
+
+            CreateTable(
+                "dbo.PackageDeprecationCWEs",
+                c => new
+                    {
+                        PackageDeprecation_Key = c.Int(nullable: false),
+                        CWE_Key = c.Int(nullable: false),
+                    })
+                .PrimaryKey(t => new { t.PackageDeprecation_Key, t.CWE_Key })
+                .ForeignKey("dbo.PackageDeprecations", t => t.PackageDeprecation_Key, cascadeDelete: true)
+                .ForeignKey("dbo.CWEs", t => t.CWE_Key, cascadeDelete: true)
+                .Index(t => t.PackageDeprecation_Key)
+                .Index(t => t.CWE_Key);
+
+            DropColumn("dbo.PackageDeprecations", "CVEIds");
+            DropColumn("dbo.PackageDeprecations", "CWEIds");
+        }
+
+        public override void Down()
+        {
+            AddColumn("dbo.PackageDeprecations", "CWEIds", c => c.String());
+            AddColumn("dbo.PackageDeprecations", "CVEIds", c => c.String());
+            DropForeignKey("dbo.PackageDeprecationCWEs", "CWE_Key", "dbo.CWEs");
+            DropForeignKey("dbo.PackageDeprecationCWEs", "PackageDeprecation_Key", "dbo.PackageDeprecations");
+            DropForeignKey("dbo.PackageDeprecationCVEs", "CVE_Key", "dbo.CVEs");
+            DropForeignKey("dbo.PackageDeprecationCVEs", "PackageDeprecation_Key", "dbo.PackageDeprecations");
+            DropIndex("dbo.PackageDeprecationCWEs", new[] { "CWE_Key" });
+            DropIndex("dbo.PackageDeprecationCWEs", new[] { "PackageDeprecation_Key" });
+            DropIndex("dbo.PackageDeprecationCVEs", new[] { "CVE_Key" });
+            DropIndex("dbo.PackageDeprecationCVEs", new[] { "PackageDeprecation_Key" });
+            DropIndex("dbo.CWEs", new[] { "CWEId" });
+            DropIndex("dbo.CVEs", new[] { "CVEId" });
+            DropTable("dbo.PackageDeprecationCWEs");
+            DropTable("dbo.PackageDeprecationCVEs");
+            DropTable("dbo.CWEs");
+            DropTable("dbo.CVEs");
+        }
+    }
+}