Add severity column to vulnerability list #2262

ZhangChen199102 · 2024-06-03T02:17:53Z

andrewpollock

LGTMish (without seeing a preview), with some thoughts on handling multiple CVSS versions.

There's also the UX question of records that do not have any CVSS scores and how they would sort...

andrewpollock · 2024-06-03T03:07:25Z

gcp/appengine/frontend3/src/templates/list.html

+                {% for score in (vulnerability.severity_scores) %}
+                <li>{{ score }}</li>
+                {% endfor %}


I think it would be preferable to only output the highest available CVSS score, I.e. where CVSSv3 and CVSSv4 scores are provided, favour the v4 score.

andrewpollock

LGTM

oliverchang · 2024-06-07T01:12:56Z

LGTM

This adds more width to our page :/ Should we evaluate removing some other columns first?

oliverchang · 2024-06-07T01:13:43Z

e.g. fix available, and versions probably isn't that useful.

hogo6002 · 2024-06-11T07:19:22Z

Hey @ZhangChen199102 , thanks for implementing this feature! After discussing with the team, we have some thoughts on this change:

Instead of adding a new column for the severity score, we can just move it into the "Fix Available" column and making it more of an "Attributes" column. This can reduce the number of columns and allow us to easily add other tags in the future.
the current severity tag colour makes the text a bit hard to see. Maybe we can just use a white tag with black text, displaying the information like "Severity - 5.4 (MEDIUM)"?
the "Affected versions" listed here aren't adding much information and make the page looks a bit crowded. We can remove this column entirely from https://osv.dev/list (this can be done in a separate PR, and it would also automatically resolve Display the correct affected versions when filtering by ecosystem #2286)

zahraaalizadeh

Resolves: #2255, #2286

another-rex · 2024-06-20T01:53:29Z

Looks really good! Can you also try keeping the color, but for the darker colors have the text color switch from black to white to make it easier to read? I'm not sure if we'll go with that, but I think it would be nice to compare. (Or choose different tag colors to maintain the contrast. )

zahraaalizadeh · 2024-06-20T07:37:13Z

With the current colors, switching the text color to white instead of black actually fails the contrast ratio for accessibility (checked using this tool).

I’ve attached a sample output for reference, showing how the text looks with white colors on these backgrounds. Additionally, I’ve attached a photo demonstrating the appearance with black text on these colors.

As another alternative, I’ve used red-themed colors for high and critical severities to maintain the contrast.

Sample output with white text on colors( fails accessibility checks )

Black and white text on colors ( passes accessibility checks )

Red-themed colors for medium high and critical severities

another-rex · 2024-06-21T04:19:07Z

I personally prefer the middle option, though can you try switching the orange (High) text color to white instead of black?

hogo6002 · 2024-06-24T00:30:23Z

I personally prefer the middle option, though can you try switching the orange (High) text color to white instead of black?

+1, I also think the middle one looks better. The third one has a pink colour, which is the same as our "no fix available" tag.

zahraaalizadeh · 2024-06-25T00:14:30Z

I personally prefer the middle option, though can you try switching the orange (High) text color to white instead of black?

@another-rex @hogo6002, unfortunately, using white on orange fails the accessibility contrast checks. the result is in demonstrated on pic1 in my previous comment.

zahraaalizadeh · 2024-06-25T07:13:34Z

Here is the updated colours:

another-rex

Styling LGTM! Just some minor comments.

another-rex · 2024-06-25T23:55:01Z

gcp/appengine/Pipfile

@@ -22,6 +22,7 @@ requests = "==2.32.2"
 grpcio-status = "==1.62.2"
 gunicorn = "==22.0.0"
 whitenoise = "6.5.0"
+cvss = "*"


Can you pin this version

another-rex · 2024-06-25T23:56:33Z

gcp/appengine/frontend3/src/styles.scss

@@ -537,6 +544,26 @@ md-icon-button.mdc-data-table__sort-icon-button {
    &.fix-unavailable {
      background: $osv-red-300;
    }
+
+    &.severity-low {
+      background: #53aa33;


Set these values as (scss) variables, I think we might want to use them for each vulnerability page as well.

another-rex · 2024-06-25T23:59:47Z

gcp/appengine/frontend_handlers.py

  if detailed:
    add_links(response)
    add_source_info(bug, response)
  return response


+def add_cvss_score(bug):
+  """Add severity score where possible."""
+  severity_score = {}


nit: can this just be 3 variables?

This change refactors the existing functionality of calculating the severity base score and rating, to enable reusing it in vulnerability page.

zahraaalizadeh · 2024-06-26T01:15:45Z

gcp/appengine/Pipfile.lock

-            "markers": "platform_python_implementation != 'PyPy'",
-            "version": "==0.22.0"
+            "markers": "python_version >= '3.7'",
+            "version": "==6.5.0"


The version of whitenoise specified in the Pipfile is 6.5.0, so it makes sense that pipenv lock downgrades the version from 6.7.0 to 6.5.0, as introduced by this commit.
However I'm unsure why it removed zstandard. I suspect it might be because I'm running it from a mac machine?

Hmm I'm guessing whitenoise added zstd support somewhere between 6.7.0 and 6.5.0. Since it looks like we are already using whitenoise 6.7.0, can you update our pipfile for whitenoise to ==6.7.0 (The only reason renovatebot didn't do it is because there's currently a dependency conflict in the Google cloud dependencies. )

Re zstandard, looking at pipenv graph it's a dependancy for flask-compress version 1.15 as the version in Pipfile is specified as 1.13 it's been removed.

@another-rex Should I upgradeflask-compress from 1.13 to 1.15 too?

Yes, I think that'll be good

zahraaalizadeh · 2024-06-26T01:25:51Z

gcp/appengine/frontend_handlers.py

+def calculate_severity_details(
+    severity: dict) -> tuple[float | None, str | None]:
+  """Calculate score and rating of severity"""


I cherry-picked this commit from my other branch which adds link to cvss calculator.
FYI - Once this PR was merged, I'll resolve the potential conflicts and open a seperate PR for the mentioned issue.

hogo6002

Looks really nice! Thanks Zahra!

andrewpollock reviewed Jun 3, 2024

View reviewed changes

ZhangChen199102 force-pushed the add-severity-column-to-vulnerability-list branch 3 times, most recently from 5c89f1c to 1f28fe8 Compare June 5, 2024 00:49

ZhangChen199102 marked this pull request as ready for review June 5, 2024 01:15

ZhangChen199102 requested a review from andrewpollock June 5, 2024 01:15

andrewpollock approved these changes Jun 6, 2024

View reviewed changes

zahraaalizadeh force-pushed the add-severity-column-to-vulnerability-list branch from 1f28fe8 to 9661b2c Compare June 19, 2024 05:46

zahraaalizadeh reviewed Jun 19, 2024

View reviewed changes

zahraaalizadeh requested review from hogo6002 and another-rex June 19, 2024 05:54

ZhangChen199102 and others added 5 commits June 25, 2024 16:45

Added severity score column to vulnerability list

480126c

Remove affected versions column

8b1fcc8

Rename Fix column to Attributes

df5ef56

Display severity as part of the attribute column

e3cc5a0

Make the severity tags categorised by color

89a0e85

another-rex reviewed Jun 26, 2024

View reviewed changes

zahraaalizadeh added 3 commits June 26, 2024 10:20

Specify the cvss version

fc7fa39

Use scss variables to reuse colors later

07b48d2

Refactor severity score calculator

307c07d

This change refactors the existing functionality of calculating the severity base score and rating, to enable reusing it in vulnerability page.

zahraaalizadeh force-pushed the add-severity-column-to-vulnerability-list branch from 41de3b9 to 307c07d Compare June 26, 2024 01:09

zahraaalizadeh reviewed Jun 26, 2024

View reviewed changes

zahraaalizadeh requested a review from another-rex June 26, 2024 01:28

another-rex approved these changes Jun 26, 2024

View reviewed changes

Upgrade whitenoise and flask-compress versions

c16df2a

hogo6002 approved these changes Jun 26, 2024

View reviewed changes

another-rex merged commit 617416b into google:master Jun 27, 2024
11 checks passed

zahraaalizadeh mentioned this pull request Jun 27, 2024

Display the correct affected versions when filtering by ecosystem #2286

Closed

another-rex mentioned this pull request Jun 27, 2024

Make it possible to visually evaluate a list of vulnerabilities by severity #2255

Closed

G-Rath deleted the add-severity-column-to-vulnerability-list branch August 20, 2024 19:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add severity column to vulnerability list #2262

Add severity column to vulnerability list #2262

ZhangChen199102 commented Jun 3, 2024 •

edited

Loading

andrewpollock left a comment

andrewpollock Jun 3, 2024

andrewpollock left a comment

oliverchang commented Jun 7, 2024

oliverchang commented Jun 7, 2024

hogo6002 commented Jun 11, 2024

zahraaalizadeh left a comment •

edited

Loading

another-rex commented Jun 20, 2024 •

edited

Loading

zahraaalizadeh commented Jun 20, 2024

another-rex commented Jun 21, 2024

hogo6002 commented Jun 24, 2024

zahraaalizadeh commented Jun 25, 2024 •

edited

Loading

zahraaalizadeh commented Jun 25, 2024

another-rex left a comment

another-rex Jun 25, 2024

another-rex Jun 25, 2024

another-rex Jun 25, 2024

zahraaalizadeh Jun 26, 2024

another-rex Jun 26, 2024

zahraaalizadeh Jun 26, 2024

zahraaalizadeh Jun 26, 2024

another-rex Jun 26, 2024

zahraaalizadeh Jun 26, 2024

hogo6002 left a comment

Add severity column to vulnerability list #2262

Add severity column to vulnerability list #2262

Conversation

ZhangChen199102 commented Jun 3, 2024 • edited Loading

andrewpollock left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

andrewpollock left a comment

Choose a reason for hiding this comment

oliverchang commented Jun 7, 2024

oliverchang commented Jun 7, 2024

hogo6002 commented Jun 11, 2024

zahraaalizadeh left a comment • edited Loading

Choose a reason for hiding this comment

another-rex commented Jun 20, 2024 • edited Loading

zahraaalizadeh commented Jun 20, 2024

another-rex commented Jun 21, 2024

hogo6002 commented Jun 24, 2024

zahraaalizadeh commented Jun 25, 2024 • edited Loading

zahraaalizadeh commented Jun 25, 2024

another-rex left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hogo6002 left a comment

Choose a reason for hiding this comment

ZhangChen199102 commented Jun 3, 2024 •

edited

Loading

zahraaalizadeh left a comment •

edited

Loading

another-rex commented Jun 20, 2024 •

edited

Loading

zahraaalizadeh commented Jun 25, 2024 •

edited

Loading