Add initial fixed-affected-matching work #1228

vulnerabilities/models.py

@@ -22,6 +22,7 @@
 from django.core.validators import MinValueValidator
 from django.db import models
 from django.db.models import Count
+from django.db.models import Prefetch
 from django.db.models import Q
 from django.db.models.functions import Length
 from django.db.models.functions import Trim
@@ -31,6 +32,8 @@
 from packageurl.contrib.django.models import PackageURLQuerySet
 from packageurl.contrib.django.models import without_empty_values
 from rest_framework.authtoken.models import Token
+from univers import versions
+from univers.version_range import RANGE_CLASS_BY_SCHEMES
 
 from vulnerabilities.importer import AdvisoryData
 from vulnerabilities.importer import AffectedPackage
@@ -628,6 +631,153 @@ def get_absolute_url(self):
         """
         return reverse("package_details", args=[self.purl])
 
+    def get_fixed_packages(self, package, fix=True):
+        """
+        With fix=True, return a queryset of all packages that fix a vulnerability and have the
+        same type, namespace, name, subpath and qualifiers as the `package`.
+        With fix=False, return a queryset of all packages that have the same type, namespace,
+        name, subpath and qualifiers as the `package`, whether or not they fix any vulnerability.
+        """
+        filter_dict = {
+            "name": package.name,
+            "namespace": package.namespace,
+            "type": package.type,
+            "qualifiers": package.qualifiers,
+            "subpath": package.subpath,
+        }
+
+        if fix:
+            filter_dict["packagerelatedvulnerability__fix"] = True
+
+        return Package.objects.filter(**filter_dict).distinct()
+
+    def sort_by_version(self, packages_to_sort):
+        """
+        Use the univers version_class to sort the incoming list of vulnerabilities.models.Package
+        objects.
+        """
+        univers_version = RANGE_CLASS_BY_SCHEMES[packages_to_sort[0].type].version_class
+        return sorted(
+            packages_to_sort,
+            key=lambda x: univers_version(x.version),
+        )
+
+    @property
+    def fixed_package_details(self):
+        """
+        For a given package, report the closest subsequent fixed by version for each of that
+        package's vulnerabilities as well as the closest non-vulnerable version and the most recent
+        non-vulnerable version.
+        """
+        fixed_packages = self.get_fixed_packages(package=self, fix=True)
+        qs = self.vulnerabilities.filter(packagerelatedvulnerability__fix=False)
+        all_sibling_packages = self.get_fixed_packages(package=self, fix=False)
+
+        non_vuln_sibs = []
+        for sib in all_sibling_packages:
+            if sib.is_vulnerable is False:
+                non_vuln_sibs.append(sib)
+
+        univers_version_class = RANGE_CLASS_BY_SCHEMES[self.type].version_class
+        later_non_vuln_sibs = []
+
+        for non_vuln_sib in non_vuln_sibs:
+            non_vuln_sib_univers_version = univers_version_class(
+                PackageURL.from_string(non_vuln_sib.purl).version
+            )
+
+            if univers_version_class(non_vuln_sib.version) > univers_version_class(self.version):
+                later_non_vuln_sibs.append(non_vuln_sib)
+
+        qs = qs.prefetch_related(
+            Prefetch(
+                "packages",
+                queryset=fixed_packages,
+                to_attr="fixed_packages",
+            )
+        )
+
+        purl_dict = {}
+        purl_dict["purl"] = PackageURL.from_string(self.purl)
+
+        closest_non_vulnerable_sib = ""
+        latest_non_vulnerable_sib = ""
+
+        if len(later_non_vuln_sibs) > 0:
+            closest_non_vulnerable_sib = self.sort_by_version(later_non_vuln_sibs)[0]
+            latest_non_vulnerable_sib = self.sort_by_version(later_non_vuln_sibs)[-1]
+
+            purl_dict["closest_non_vulnerable"] = PackageURL.from_string(
+                closest_non_vulnerable_sib.purl
+            )
+            purl_dict["latest_non_vulnerable"] = PackageURL.from_string(
+                latest_non_vulnerable_sib.purl
+            )
+
+        else:
+
+            purl_dict["closest_non_vulnerable"] = None
+            purl_dict["latest_non_vulnerable"] = None
+
+        purl_dict.update({"vulnerabilities": []})
+
+        for vuln in qs:
+            purl_dict["vulnerabilities"].append({"vulnerability": vuln})
+
+            closest_fixed_package = ""
+            closest_fixed_package_vulns = ""
+            later_fixed_packages = []
+            sort_fixed_by_packages_by_version = []
+            vuln_fixed_packages = vuln.fixed_packages
+
+            if len(vuln_fixed_packages) > 0:
+                for fixed_pkg in vuln_fixed_packages:
+
+                    fixed_pkg_univers_version = univers_version_class(
+                        PackageURL.from_string(fixed_pkg.purl).version
+                    )
+
+                    if fixed_pkg in fixed_packages and univers_version_class(
+                        fixed_pkg.version
+                    ) > univers_version_class(self.version):
+
+                        later_fixed_packages.append(fixed_pkg)
+
+                if later_fixed_packages:
+                    sort_fixed_by_packages_by_version = self.sort_by_version(later_fixed_packages)
+                    closest_fixed_package = sort_fixed_by_packages_by_version[0]
+                    closest_fixed_package_vulns = closest_fixed_package.affected_by
+
+            else:
+                closest_fixed_package = None
+                closest_fixed_package_vulns = None
+
+            for dict_vuln in purl_dict["vulnerabilities"]:
+                if dict_vuln["vulnerability"] == vuln:
+
+                    if closest_fixed_package:
+                        dict_vuln["fixed_by_purl"] = PackageURL.from_string(
+                            closest_fixed_package.purl
+                        )
+
+                        dict_vuln["fixed_by_purl_vulnerabilities"] = [
+                            fixed_pkg_vuln for fixed_pkg_vuln in closest_fixed_package_vulns
+                        ]
+                    else:
+                        dict_vuln["fixed_by_purl"] = None
+                        dict_vuln["fixed_by_purl_vulnerabilities"] = []
+
+        # Temporary print output during dev/testing.
+        # from pprint import pprint
+
+        # pprint(
+        #     purl_dict,
+        #     sort_dicts=False,
+        # )
+        # print("")
+
+        return purl_dict
+
 
 class PackageRelatedVulnerability(models.Model):
     """

vulnerabilities/templates/package_details.html

@@ -24,7 +24,7 @@
                 <table class="table vcio-table width-100-pct mt-2">
                     <tbody>
                         <tr>
-                            <td class="two-col-left" style="width: 175px;">
+                            <td class="two-col-left">
                                 <span
                                     class="has-tooltip-multiline has-tooltip-black has-tooltip-arrow has-tooltip-text-left"
                                     data-tooltip="The package url or purl is a URL string used to identify and locate a software package."
@@ -33,24 +33,59 @@
                                 </span>
                             </td>
                             <td class="two-col-right">
-                                {{ package.purl }}
+                                {{ fixed_package_details.purl.to_string }}
                             </td>
                         </tr>
                     </tbody>
                 </table>
             </div>
 
+            {% if affected_by_vulnerabilities|length != 0 %}
+
+                <div class="pl-3 pr-3 mb-5 non-vuln">
+                    <table class="table vcio-table width-100-pct mt-2">
+                        <tbody>
+                            <tr>
+                                <td class="two-col-left">
+                                    Next non-vulnerable version
+                                </td>
+                                <td class="two-col-right">
+                                    {% if fixed_package_details.closest_non_vulnerable.version %}
+                                        <a href="/packages/{{ fixed_package_details.closest_non_vulnerable }}?search={{ fixed_package_details.closest_non_vulnerable }}" target="_self">{{ fixed_package_details.closest_non_vulnerable.version }}</a>
+                                    {% else %}
+                                        <span style="background-color: #ffcccc;">None.</span>
+                                    {% endif %}
+                                </td>
+                            </tr>
+                            <tr>
+                                <td class="two-col-left">
+                                    Latest non-vulnerable version
+                                </td>
+                                <td class="two-col-right">
+                                    {% if fixed_package_details.latest_non_vulnerable.version %}
+                                        <a href="/packages/{{ fixed_package_details.latest_non_vulnerable }}?search={{ fixed_package_details.latest_non_vulnerable }}" target="_self">{{ fixed_package_details.latest_non_vulnerable.version }}</a>
+                                    {% else %}
+                                        <span style="background-color: #ffcccc;">None.</span>
+                                    {% endif %}
+                                </td>
+                            </tr>
+                        </tbody>
+                    </table>
+                </div>
+
+            {% endif %}
+
             <div class="content ml-3 mr-3">
                 <div class="has-text-weight-bold ml-1 mb-0">
-                    Affected by vulnerabilities ({{ affected_by_vulnerabilities|length }})
+                    Vulnerabilities affecting this package ({{ affected_by_vulnerabilities|length }})
                 </div>
 
                 <table class="table is-bordered is-striped is-narrow is-hoverable is-fullwidth">
                     <thead>
                         <tr>
-                            <th style="width: 175px;">Vulnerability</th>
+                            <th style="width: 200px;">Vulnerability</th>
                             <th>Summary</th>
-                            <th style="width: 225px;">Aliases</th>
+                            <th style="width: 300px;">Fixed by</th>
                         </tr>
                     </thead>
 
@@ -59,11 +94,9 @@
                             <tr>
                                 <td>
                                     <a href="{{ vulnerability.get_absolute_url }}" target="_self">{{ vulnerability.vulnerability_id }}</a>
-                                </td>
-                                <td>
-                                    {{ vulnerability.summary }}
-                                </td>
-                                <td>
+                                    <br />
+                                    Aliases:
+                                    <br />
                                     {% for alias in vulnerability.alias %}
                                         {% if alias.url %}
                                             <a href="{{ alias.url }}" target="_blank">{{ alias }}<i class="fa fa-external-link fa_link_custom"></i></a>
@@ -74,33 +107,86 @@
                                         {% endif %}
                                     {% endfor %}
                                 </td>
+                                <td style="word-wrap: break-word; word-break: break-word;">
+                                    {{ vulnerability.summary }}
+                                </td>
+                                <td style="word-wrap: break-word; word-break: break-all;">
+                                    {% if package.purl == fixed_package_details.purl.to_string %}
+                                        {% for key, value in fixed_package_details.items %}
+                                            {% if key == "vulnerabilities" %}
+                                                {% for vuln in value %}
+                                                    {% if vuln.vulnerability.vulnerability_id == vulnerability.vulnerability_id %}
+                                                        {% if vuln.fixed_by_purl is None %}
+                                                            <span style="background-color: #ffcccc;">There are no reported fixed versions.</span>
+                                                        {% else %}
+                                                            {% if vuln.fixed_by_purl_vulnerabilities|length == 0 %}
+                                                                <a href="/packages/{{ vuln.fixed_by_purl }}?search={{ vuln.fixed_by_purl }}" target="_self">{{ vuln.fixed_by_purl.version }}</a>
+                                                                <br />
+                                                                <span style="background-color: #b3ffb3;">Affected by 0 other vulnerabilities.</span>
+                                                            {% else %}
+                                                                <a href="/packages/{{ vuln.fixed_by_purl }}?search={{ vuln.fixed_by_purl }}" target="_self">{{ vuln.fixed_by_purl.version }}</a>
+                                                                {% if vuln.fixed_by_purl_vulnerabilities|length != 1 %}
+                                                                    <br />
+                                                                    <span style="background-color: #ffcccc;">Affected by {{ vuln.fixed_by_purl_vulnerabilities|length }} other vulnerabilities.</span>
+                                                                    {% else %}
+                                                                    <br />
+                                                                    <span style="background-color: #ffcccc;">Affected by {{ vuln.fixed_by_purl_vulnerabilities|length }} other vulnerability.</span>
+                                                                {% endif %}
+
+                                                                <div class="dropdown is-hoverable has-text-weight-normal is-right">
+                                                                    <div class="dropdown-trigger">
+                                                                        <i class="fa fa-question-circle ml-0 fa-sm has-background-white has-text-link"></i>
+                                                                    </div>
+                                                                    <div class="dropdown-menu dropdown-vuln-list-width" id="dropdown-menu4" role="menu">
+                                                                        <div class="dropdown-content dropdown-instructions-box-shadow">
+                                                                            <div class="dropdown-item">
+                                                                                <div style="max-height: 200px; overflow-y: auto;">
+                                                                                    This version is affected by these other vulnerabilities:
+                                                                                    <div style="padding-top: 5px;">
+                                                                                        {% for fixed_by_vuln in vuln.fixed_by_purl_vulnerabilities %}
+                                                                                            <div>
+                                                                                                <a href="/vulnerabilities/{{ fixed_by_vuln.vulnerability_id }}" target="_self">{{ fixed_by_vuln.vulnerability_id }}</a>
+                                                                                            </div>
+                                                                                        {% endfor %}
+                                                                                    </div>
+                                                                                </div>
+                                                                            </div>
+                                                                        </div>
+                                                                    </div>
+                                                                </div>
+                                                            {% endif %}
+                                                        {% endif %}
+                                                    {% endif %}
+                                                {% endfor %}
+                                            {% endif %}
+                                        {% endfor %}
+                                    {% endif %}
+                                </td>
                             </tr>
                         {% empty %}
                             <tr>
                                 <td colspan="3">
-                                    This package is not known to be affected by vulnerabilities.
+                                    <span style="background-color: #b3ffb3;">This package is not known to be affected by vulnerabilities.</span>
                                 </td>
                             </tr>
                         {% endfor %}
                     </tbody>
-
                 </table>
             </div>
 
             <div class="content ml-3 mr-3">
                 <div class="has-text-weight-bold ml-1 mb-0">
-                    Fixing vulnerabilities ({{ fixing_vulnerabilities|length }})
+                    Vulnerabilities fixed by this package ({{ fixing_vulnerabilities|length }})
                 </div>
 
                 <table class="table is-bordered is-striped is-narrow is-hoverable is-fullwidth">
                     <thead>
                         <tr>
-                            <th style="width: 175px;">Vulnerability</th>
+                            <th style="width: 200px;">Vulnerability</th>
                             <th>Summary</th>
                             <th style="width: 225px;">Aliases</th>
                         </tr>
                     </thead>
-
                     <tbody>
                         {% for vulnerability in fixing_vulnerabilities %}
                             <tr>
@@ -137,5 +223,4 @@
         </div>
     </section>
 {% endif %}
-
 {% endblock %}