Compare commits

...
Author SHA1 Message Date
Weston Steimel 60bfda45cd chore: re-generate cpe-index
Signed-off-by: Weston Steimel <commits@weston.slmail.me>
2024-06-13 09:09:40 +01:00
Weston Steimel 78167f1492 index cpes for github repos
Signed-off-by: Weston Steimel <commits@weston.slmail.me>
2024-06-13 09:07:31 +01:00
Weston Steimel 4267bea068 feat: index known CPEs for wordpress plugins and themes
Signed-off-by: Weston Steimel <commits@weston.slmail.me>
2024-06-13 09:07:25 +01:00
3 changed files with 41791 additions and 23 deletions
File diff suppressed because it is too large Load Diff
@@ -102,20 +102,30 @@ func normalizeCPE(cpe *wfn.Attributes) *wfn.Attributes {
}
const (
prefixForNPMPackages = "https://www.npmjs.com/package/"
prefixForRubyGems = "https://rubygems.org/gems/"
prefixForRubyGemsHTTP = "http://rubygems.org/gems/"
prefixForNativeRubyGems = "https://github.com/ruby/"
prefixForPyPIPackages = "https://pypi.org/project/"
prefixForJenkinsPlugins = "https://plugins.jenkins.io/"
prefixForJenkinsPluginsGitHub = "https://github.com/jenkinsci/"
prefixForRustCrates = "https://crates.io/crates/"
prefixForPHPPear = "https://pear.php.net/"
prefixForPHPPearHTTP = "http://pear.php.net/"
prefixForPHPPecl = "https://pecl.php.net/"
prefixForPHPPeclHTTP = "http://pecl.php.net/"
prefixForPHPComposer = "https://packagist.org/packages/"
prefixForGoModules = "https://pkg.go.dev/"
prefixForNPMPackages = "https://www.npmjs.com/package/"
prefixForRubyGems = "https://rubygems.org/gems/"
prefixForRubyGemsHTTP = "http://rubygems.org/gems/"
prefixForNativeRubyGems = "https://github.com/ruby/"
prefixForPyPIPackages = "https://pypi.org/project/"
prefixForJenkinsPlugins = "https://plugins.jenkins.io/"
prefixForJenkinsPluginsGitHub = "https://github.com/jenkinsci/"
prefixForRustCrates = "https://crates.io/crates/"
prefixForPHPPear = "https://pear.php.net/"
prefixForPHPPearHTTP = "http://pear.php.net/"
prefixForPHPPecl = "https://pecl.php.net/"
prefixForPHPPeclHTTP = "http://pecl.php.net/"
prefixForPHPComposer = "https://packagist.org/packages/"
prefixForGoModules = "https://pkg.go.dev/"
prefixForWordpressPlugins = "https://wordpress.org/plugins/"
prefixForWordpressPluginsTracBrowser = "https://plugins.trac.wordpress.org/browser/"
prefixForWordpressPluginsTracLog = "https://plugins.trac.wordpress.org/log/"
prefixForWordpressPluginsGitHubArchive = "https://github.com/wp-plugins/"
prefixForWordpressPluginsWordfence = "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/"
prefixForWordpressThemes = "https://wordpress.org/themes/"
prefixForWordpressThemesTracBrowser = "https://themes.trac.wordpress.org/browser/"
prefixForWordpressThemesTracLog = "https://themes.trac.wordpress.org/log/"
prefixForWordpressThemesWordfence = "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/"
prefixForGitHubRepo = "https://github.com/"
)
// indexCPEList creates an index of CPEs by ecosystem.
@@ -164,6 +174,17 @@ func indexCPEList(list CpeList) *dictionary.Indexed {
case strings.HasPrefix(ref, prefixForGoModules):
addEntryForGoModulePackage(indexed, ref, cpeItemName)
case strings.HasPrefix(ref, prefixForWordpressPlugins), strings.HasPrefix(ref, prefixForWordpressPluginsTracBrowser), strings.HasPrefix(ref, prefixForWordpressPluginsTracLog), strings.HasPrefix(ref, prefixForWordpressPluginsGitHubArchive), strings.HasPrefix(ref, prefixForWordpressPluginsWordfence):
addEntryForWordpressPlugin(indexed, ref, cpeItemName)
case strings.HasPrefix(ref, prefixForWordpressThemes), strings.HasPrefix(ref, prefixForWordpressThemesTracBrowser), strings.HasPrefix(ref, prefixForWordpressThemesTracLog), strings.HasPrefix(ref, prefixForWordpressThemesWordfence):
addEntryForWordpressTheme(indexed, ref, cpeItemName)
}
if strings.HasPrefix(ref, prefixForGitHubRepo) {
addEntryForGitHubRepo(indexed, ref, cpeItemName)
}
}
}
@@ -183,6 +204,61 @@ func updateIndex(indexed *dictionary.Indexed, ecosystem string, pkgName string,
indexed.EcosystemPackages[ecosystem][pkgName].Add(cpe)
}
func addEntryForGitHubRepo(indexed *dictionary.Indexed, ref string, cpeItemName string) {
// Prune off the non-package-name parts of the URL
ref = strings.TrimPrefix(ref, prefixForGitHubRepo)
ref = strings.Split(ref, "?")[0]
components := strings.Split(ref, "/")
if len(components) < 2 {
return
}
owner := strings.ToLower(components[0])
project := strings.ToLower(components[1])
if owner == "advisories" {
return
}
if owner == "cveproject" && project == "cvelist" {
return
}
updateIndex(indexed, "github", owner+"/"+project, cpeItemName)
}
func addEntryForWordpressPlugin(indexed *dictionary.Indexed, ref string, cpeItemName string) {
// Prune off the non-package-name parts of the URL
ref = strings.TrimPrefix(ref, prefixForWordpressPlugins)
ref = strings.TrimPrefix(ref, prefixForWordpressPluginsTracBrowser)
ref = strings.TrimPrefix(ref, prefixForWordpressPluginsTracLog)
ref = strings.TrimPrefix(ref, prefixForWordpressPluginsGitHubArchive)
ref = strings.TrimPrefix(ref, prefixForWordpressPluginsWordfence)
ref = strings.Split(ref, "?")[0]
ref = strings.Split(ref, "/")[0]
if ref == "" {
return
}
updateIndex(indexed, dictionary.EcosystemWordpressPlugins, ref, cpeItemName)
}
func addEntryForWordpressTheme(indexed *dictionary.Indexed, ref string, cpeItemName string) {
// Prune off the non-package-name parts of the URL
ref = strings.TrimPrefix(ref, prefixForWordpressThemes)
ref = strings.TrimPrefix(ref, prefixForWordpressThemesTracBrowser)
ref = strings.TrimPrefix(ref, prefixForWordpressThemesTracLog)
ref = strings.TrimPrefix(ref, prefixForWordpressThemesWordfence)
ref = strings.Split(ref, "?")[0]
ref = strings.Split(ref, "/")[0]
if ref == "" {
return
}
updateIndex(indexed, dictionary.EcosystemWordpressThemes, ref, cpeItemName)
}
func addEntryForRustCrate(indexed *dictionary.Indexed, ref string, cpeItemName string) {
// Prune off the non-package-name parts of the URL
ref = strings.TrimPrefix(ref, prefixForRustCrates)
@@ -8,15 +8,17 @@ import (
)
const (
EcosystemNPM = "npm"
EcosystemRubyGems = "rubygems"
EcosystemPyPI = "pypi"
EcosystemPHPPear = "php_pear"
EcosystemPHPPecl = "php_pecl"
EcosystemPHPComposer = "php_composer"
EcosystemJenkinsPlugins = "jenkins_plugins"
EcosystemRustCrates = "rust_crates"
EcosystemGoModules = "go_modules"
EcosystemNPM = "npm"
EcosystemRubyGems = "rubygems"
EcosystemPyPI = "pypi"
EcosystemPHPPear = "php_pear"
EcosystemPHPPecl = "php_pecl"
EcosystemPHPComposer = "php_composer"
EcosystemJenkinsPlugins = "jenkins_plugins"
EcosystemRustCrates = "rust_crates"
EcosystemGoModules = "go_modules"
EcosystemWordpressPlugins = "wordpress_plugins"
EcosystemWordpressThemes = "wordpress_themes"
)
type Indexed struct {