-
Notifications
You must be signed in to change notification settings - Fork 79
/
rhcc.go
115 lines (102 loc) · 2.76 KB
/
rhcc.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
// Package rhcc implements an ecosystem for the Red Hat Container Catalog.
//
// This ecosystem treats an entire container as a package and matches advisories
// against it.
package rhcc
import (
"encoding/xml"
"strings"
"time"
"github.com/quay/claircore"
"github.com/quay/claircore/pkg/cpe"
"github.com/quay/claircore/pkg/rhctag"
)
var goldRepo = claircore.Repository{
Name: "Red Hat Container Catalog",
URI: `https://catalog.redhat.com/software/containers/explore`,
}
type cveMap struct {
XMLName xml.Name `xml:"cvemap"`
RedHatVulnerabilities []redHatVulnerability `xml:"Vulnerability"`
}
type redHatVulnerability struct {
XMLName xml.Name `xml:"Vulnerability"`
Name string `xml:"name,attr"`
ThreatSeverity string `xml:"ThreatSeverity"`
AffectedReleases []affectedRelease `xml:"AffectedRelease"`
Details []details `xml:"Details"`
}
type affectedRelease struct {
XMLName xml.Name `xml:"AffectedRelease"`
Cpe string `xml:"cpe,attr"`
ReleaseDate customTime `xml:"ReleaseDate"`
Package string `xml:"Package"`
Impact string `xml:"impact,attr"`
Advisory advisory `xml:"Advisory"`
}
type advisory struct {
XMLName xml.Name `xml:"Advisory"`
Text string `xml:",cdata"`
URL string `xml:"url,attr"`
}
type details struct {
XMLName xml.Name `xml:"Details"`
Text string `xml:",cdata"`
Source string `xml:"source,attr"`
}
type customTime struct {
time time.Time
}
type consolidatedRelease struct {
Issued time.Time
FixedInVersions *rhctag.Versions
Severity string
AdvisoryLink string
AdvisoryName string
Cpe cpe.WFN
}
func (c *customTime) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error {
const shortForm = "2006-01-02"
var v string
d.DecodeElement(&v, &start)
date := strings.Split(v, "T")
parse, err := time.Parse(shortForm, date[0])
if err != nil {
return err
}
*c = customTime{parse}
return nil
}
func parseContainerPackage(p string) (bool, string, string) {
parts := strings.Split(p, ":")
if len(parts) != 2 {
return false, "", ""
}
if !strings.ContainsAny(parts[0], "/") {
return false, "", ""
}
return true, parts[0], parts[1]
}
// Prefer Red Hat descriptions over Mitre ones
func getDescription(ds []details) string {
rhDetailsIdx := -1
mitreDetailsIdx := -1
result := ""
for idx, d := range ds {
if d.Source == "Red Hat" {
rhDetailsIdx = idx
break
} else if d.Source == "Mitre" {
mitreDetailsIdx = idx
}
}
if rhDetailsIdx != -1 {
result = ds[rhDetailsIdx].Text
return strings.TrimSpace(result)
}
if mitreDetailsIdx != -1 {
result = ds[mitreDetailsIdx].Text
return strings.TrimSpace(result)
}
return strings.TrimSpace(result)
}