Add support for CWE #782

ziadhany · 2022-06-24T23:34:58Z

Reference: #651
Signed-off-by: Ziad ziadhany2016@gmail.com

ziadhany · 2022-06-27T18:21:07Z

pombredanne

This would need to be rebased... also you may want to remove the UI part to treat it separately as the UI has changed extensively!
Also could we also get the CWE from the NVD importer? or is this something for later?
Finally two other considerations:

the CWE library maintainer has not much replied to data, so if we need this we would have to fok it
is there something else beyond CWE that would be about a more general concept of categories?

vulnerabilities/models.py

ziadhany · 2022-09-10T16:27:33Z

This would need to be rebased... also you may want to remove the UI part to treat it separately as the UI has changed extensively! Also could we also get the CWE from the NVD importer? or is this something for later?

ok, no problem I will change this, but what about editing all importers not just NVD, I think I could handle this in a separate pull request.

1. the CWE library maintainer has not much replied to data, so if we need this we would have to fok it

oops, yes we can fork it. it isn't a complicated library, all data come from this database, we need to make sure the database is updated so I think we should use this link
https://cwe.mitre.org/data/downloads.html as our database.

2. is there something else beyond CWE that would be about a more general concept of categories?

I don't know but the main three categories are

Software Development
Hardware Design
Research Concepts

some External Mappings :

CWE Top 25 (2022)
OWASP Top Ten (2021)
Software Fault Pattern Clusters

ziadhany · 2022-09-10T23:38:29Z

ziadhany · 2022-11-01T11:43:14Z

pombredanne · 2022-11-21T22:53:40Z

@ziadhany the cwe2 library is ready now: https://pypi.org/project/cwe2/

pombredanne · 2022-12-06T17:01:45Z

vulnerabilities/templates/vulnerability_details.html

+                     <div class="tab-nested-div">
+                        <table class="table is-bordered is-striped is-narrow is-hoverable is-fullwidth gray-header-border">
+                            <tr>
+                                <th> CWE id  </th>


Use plain CWE

pombredanne

Here are a few nitpickings for your review

pombredanne · 2022-12-13T16:27:02Z

vulnerabilities/importers/nvd.py

+        """
+        weaknesses = []
+        for weaknesses in get_item(self.cve_item, "cve", "problemtype", "problemtype_data") or []:
+            weaknesses_description = weaknesses.get("description")


Suggested change

weaknesses_description = weaknesses.get("description")

weaknesses_description = weaknesses.get("description") or []

pombredanne · 2022-12-13T16:27:22Z

vulnerabilities/importers/nvd.py

+        for weaknesses in get_item(self.cve_item, "cve", "problemtype", "problemtype_data") or []:
+            weaknesses_description = weaknesses.get("description")
+            for weaknesses_value in weaknesses_description:
+                cwe_id = get_cwe_id(weaknesses_value.get("value"))


I would skip weaknesses_description if the lang is not "en"

pombredanne · 2022-12-13T16:28:11Z

vulnerabilities/improve_runner.py

@@ -133,6 +134,10 @@ def process_inferences(inferences: List[Inference], advisory: Advisory, improver
                fix=True,
            ).update_or_create()

+        if inference.weaknesses:
+            for cwe_id in inference.weaknesses:
+                Weakness.objects.update_or_create(cwe_id=cwe_id, vulnerabilities=vulnerability)


Why is vulnerabilities plural and receiving a single vulnerability?

I think because we improve vulnerability one by one . Can you suggest any way to do this?

pombredanne · 2022-12-13T16:29:08Z

vulnerabilities/models.py

+    @property
+    def name(self):
+        """Return the weakness's name."""
+        db = Database()


This should be a class member instead

pombredanne · 2022-12-13T16:29:51Z

vulnerabilities/models.py

@@ -249,6 +250,25 @@ def get_related_purls(self):
        return [p.package_url for p in self.packages.distinct().all()]


+class Weakness(models.Model):
+    cwe_id = models.IntegerField()


We need a help text

vulnerabilities/models.py

pombredanne · 2022-12-24T23:00:48Z

@ziadhany Could you rebase or merge on the latest main branch?

Remove the weaknesses table header Fix expected_files tests Fix all test cases Add CWE support for NVD importer Fix migration conflict Add Weakness model Fix requirements.txt , Fix migration conflict Add cwe name instead of Hyperlinks Add nexB/cwe package Fix test , remove empty lines Add CWE in the new UI Signed-off-by: ziadhany <ziadhany2016@gmail.com>

Signed-off-by: ziadhany <ziadhany2016@gmail.com>

pombredanne

LGTM!

ziadhany marked this pull request as ready for review June 27, 2022 18:15

TG1999 added this to In progress in GSoC 2022 @ziadhany Jun 30, 2022

ziadhany self-assigned this Jul 5, 2022

pombredanne mentioned this pull request Jul 12, 2022

Maintenance status? Julian-Nash/cwe#4

Closed

TG1999 requested a review from pombredanne July 19, 2022 15:25

pombredanne requested changes Sep 9, 2022

View reviewed changes

vulnerabilities/models.py Outdated Show resolved Hide resolved

ziadhany force-pushed the add-cwe branch 2 times, most recently from 89ff4d0 to 24a919b Compare September 10, 2022 23:35

ziadhany mentioned this pull request Sep 22, 2022

Plan for merging pull requestes #925

Open

9 tasks

TG1999 added this to the v31.0 milestone Oct 11, 2022

TG1999 marked this pull request as draft October 18, 2022 16:26

ziadhany force-pushed the add-cwe branch from 24a919b to 3cdec06 Compare November 1, 2022 11:42

ziadhany force-pushed the add-cwe branch from 3cdec06 to 8db5d5b Compare November 1, 2022 11:55

ziadhany force-pushed the add-cwe branch from 8db5d5b to 329afc5 Compare November 22, 2022 15:02

ziadhany marked this pull request as ready for review November 22, 2022 15:07

ziadhany requested a review from pombredanne November 22, 2022 15:07

ziadhany force-pushed the add-cwe branch 2 times, most recently from 3b2c98c to 550788f Compare December 1, 2022 17:13

pombredanne reviewed Dec 6, 2022

View reviewed changes

pombredanne modified the milestones: v31.0, v32.0.0 Dec 8, 2022

pombredanne requested changes Dec 13, 2022

View reviewed changes

ziadhany force-pushed the add-cwe branch 3 times, most recently from 52b1aeb to 3ddaccf Compare December 20, 2022 15:10

ziadhany force-pushed the add-cwe branch 3 times, most recently from 818945c to 5080ea3 Compare January 5, 2023 13:45

ziadhany force-pushed the add-cwe branch from 5080ea3 to b0d53d8 Compare January 17, 2023 15:49

ziadhany added 2 commits January 24, 2023 15:01

Fix merge Conflict

0969c9c

Signed-off-by: ziadhany <ziadhany2016@gmail.com>

ziadhany force-pushed the add-cwe branch from b0d53d8 to 0969c9c Compare January 24, 2023 13:39

pombredanne approved these changes Jan 24, 2023

View reviewed changes

pombredanne merged commit 59fd972 into aboutcode-org:main Jan 24, 2023

GSoC 2022 @ziadhany automation moved this from In progress to Done Jan 24, 2023

This was referenced Jan 24, 2023

Add CWE support in all importers #1093

Open

Add CWE support in the API #1094

Open

Add support for CWE #651

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for CWE #782

Add support for CWE #782

ziadhany commented Jun 24, 2022

ziadhany commented Jun 27, 2022

pombredanne left a comment

ziadhany commented Sep 10, 2022

ziadhany commented Sep 10, 2022

ziadhany commented Nov 1, 2022 •

edited

Loading

pombredanne commented Nov 21, 2022

pombredanne Dec 6, 2022

pombredanne left a comment •

edited

Loading

pombredanne Dec 13, 2022

pombredanne Dec 13, 2022

pombredanne Dec 13, 2022

ziadhany Dec 20, 2022

pombredanne Dec 13, 2022

pombredanne Dec 13, 2022

pombredanne commented Dec 24, 2022

pombredanne left a comment

	weaknesses_description = weaknesses.get("description")
	weaknesses_description = weaknesses.get("description") or []

Add support for CWE #782

Add support for CWE #782

Conversation

ziadhany commented Jun 24, 2022

ziadhany commented Jun 27, 2022

pombredanne left a comment

Choose a reason for hiding this comment

ziadhany commented Sep 10, 2022

ziadhany commented Sep 10, 2022

ziadhany commented Nov 1, 2022 • edited Loading

pombredanne commented Nov 21, 2022

pombredanne Dec 6, 2022

Choose a reason for hiding this comment

pombredanne left a comment • edited Loading

Choose a reason for hiding this comment

pombredanne Dec 13, 2022

Choose a reason for hiding this comment

pombredanne Dec 13, 2022

Choose a reason for hiding this comment

pombredanne Dec 13, 2022

Choose a reason for hiding this comment

ziadhany Dec 20, 2022

Choose a reason for hiding this comment

pombredanne Dec 13, 2022

Choose a reason for hiding this comment

pombredanne Dec 13, 2022

Choose a reason for hiding this comment

pombredanne commented Dec 24, 2022

pombredanne left a comment

Choose a reason for hiding this comment

ziadhany commented Nov 1, 2022 •

edited

Loading

pombredanne left a comment •

edited

Loading