Add missing OSV schema fields to vulnerability page #2132

zahraaalizadeh · 2024-04-23T08:11:56Z

This change adds the following info to the vulnerability page:

purl: https://ossf.github.io/osv-schema/#affectedpackage-field
Severity: https://ossf.github.io/osv-schema/#severity-field
Credits: https://ossf.github.io/osv-schema/#credits-fields

resolves #2081

Regarding the second items on the issue: per-range ecosystem/database_specific fields I left a question on the issue.

gcp/appengine/frontend3/src/templates/vulnerability.html

oliverchang · 2024-05-10T02:33:12Z

gcp/appengine/frontend3/src/templates/vulnerability.html

@@ -163,57 +200,57 @@ <h3 class="mdc-layout-grid__cell--span-3">
              </dd>
            </dl>
          {% endfor -%}
+          </div>


We also have per-range ecosystem/database_specific: https://ossf.github.io/osv-schema/#affectedecosystem_specific-field

To clarify, in total there's 3 variations here:

affected[].ranges[].database_specific

affected[].database_specific field

affected[].ecosystem_specific field

Added a commit to expose it: 47f2185

Also looking at the data models, I reckon currently this data is not recorded on the Bug model:

osv.dev/osv/models.py

Lines 185 to 194 in 47f2185

class AffectedRange2(ndb.Model):

"""Affected range."""

# Type of range.

type = ndb.StringProperty(validator=_check_valid_range_type)

# Repo URL.

repo_url = ndb.StringProperty()

# Events.

events = ndb.LocalStructuredProperty(AffectedEvent, repeated=True)

(Please correct me if I'm missing something.)

It might be worth mentioning, I couldn't find any bug that include database_specific on their ranges though.

sample output:

@oliverchang - FYI added ecae833 to render the on the fly database_specific data too.

oliverchang · 2024-05-10T02:34:02Z

gcp/appengine/frontend3/src/templates/vulnerability.html

+              {%- if 'purl' in affected.package -%}
+              <dt>Purl</dt>
+              <dd>{{ affected.package.purl }}</dd>
+              {%- endif -%}
              {%- endif -%}


We also a per-affected severity field: https://ossf.github.io/osv-schema/#affectedseverity-field

Added a commit for it c645c99

You might verify it via: BIT-mediawiki-2020-27621

sample output:

The rendering of this is different from the rendering for the top level severity (e.g. on GHSA-76v2-48w6-crxr). Can we make this the same as the top level rendering?

update in 212c8f1

sample output:

gcp/appengine/frontend3/src/templates/vulnerability.html

oliverchang · 2024-05-17T05:08:37Z

gcp/appengine/frontend3/src/templates/vulnerability.html

+              {% for credit in vulnerability.credits -%}
+              <li class="credit">
+                <ul>
+                  <li>{{ credit.name }}{%- if 'type' in credit -%} - {{ credit.type }}{%- endif -%}</li>


Can we add a space after the name and before the first "-" ?

updated: 3c62c56

oliverchang · 2024-05-17T05:08:54Z

gcp/appengine/frontend3/src/styles.scss

  pre {
    white-space: pre-wrap;
    overflow: auto;
  }
-
+
+  .purl{


can you add a space here after "purl" ?

updated 511d314

oliverchang · 2024-05-17T05:10:05Z

gcp/appengine/frontend3/src/templates/vulnerability.html

+              {%- if 'purl' in affected.package -%}
+              <dt>Purl</dt>
+              <dd>{{ affected.package.purl }}</dd>
+              {%- endif -%}
              {%- endif -%}


The rendering of this is different from the rendering for the top level severity (e.g. on GHSA-76v2-48w6-crxr). Can we make this the same as the top level rendering?

oliverchang · 2024-05-20T05:55:48Z

/gcbrun

oliverchang

thanks! just one last comment.

oliverchang · 2024-05-20T05:56:39Z

gcp/appengine/frontend_handlers.py

@@ -240,7 +240,7 @@ def vulnerability_redirector(potential_vuln_id):
 def bug_to_response(bug, detailed=True):
  """Convert a Bug entity to a response object."""
  response = osv.vulnerability_to_dict(
-      bug.to_vulnerability(include_alias=detailed))
+      bug.to_vulnerability(include_source=detailed, include_alias=detailed))


No need to show this actually, as it replicates the existing "Source" field on the vulnerabilities field. Can you please revert?

Ah, Thanks for the heads up! I didn't noticed the duplication. I dropped the commit.

Earlier in the html, there is a duplicated `if` statement to display the pacjange if it existed in the affected payload. This change removes the duplicated `if` statement in favour of the parent `if` statement.

Priorly, affected database specific was linked to affected range database specific. This change updates the link to point to the correct address.

oliverchang

LGTM, but holding off on merging this until we've had this week's release, so we can evaluate this in our test instance before it goes to prod.

zahraaalizadeh requested review from oliverchang and another-rex May 7, 2024 05:36

zahraaalizadeh self-assigned this May 7, 2024

oliverchang reviewed May 8, 2024

View reviewed changes

gcp/appengine/frontend3/src/templates/vulnerability.html Show resolved Hide resolved

zahraaalizadeh force-pushed the add-missing-osv-schema-fields-to-vulnerability-page branch 2 times, most recently from 7eeb0bd to 22f43d3 Compare May 9, 2024 10:25

oliverchang reviewed May 10, 2024

View reviewed changes

gcp/appengine/frontend3/src/templates/vulnerability.html Outdated Show resolved Hide resolved

zahraaalizadeh force-pushed the add-missing-osv-schema-fields-to-vulnerability-page branch from 22f43d3 to 47f2185 Compare May 15, 2024 03:33

zahraaalizadeh requested a review from oliverchang May 15, 2024 04:06

oliverchang reviewed May 17, 2024

View reviewed changes

zahraaalizadeh requested a review from oliverchang May 17, 2024 06:40

oliverchang reviewed May 20, 2024

View reviewed changes

zahraaalizadeh added 11 commits May 21, 2024 09:24

Fix the indentation

a909518

Display purl info on the vulnerability page

b88f6d7

Add severity details to the vulnerability page

040c81c

Add the credits info to the vulnerability page

c56092e

Remove duplicated if statement

d27dfd7

Earlier in the html, there is a duplicated `if` statement to display the pacjange if it existed in the affected payload. This change removes the duplicated `if` statement in favour of the parent `if` statement.

Expose severity per affected if any

855e39b

Fix the link to affected database specific

4f2c775

Priorly, affected database specific was linked to affected range database specific. This change updates the link to point to the correct address.

Expose affected range database specific info

40c7572

Add a space before dash for credit

2fcd956

Add missing space

a7afa62

Make the rendering of severity consistent

db8349b

zahraaalizadeh force-pushed the add-missing-osv-schema-fields-to-vulnerability-page branch from 212c8f1 to db8349b Compare May 20, 2024 23:54

zahraaalizadeh requested a review from oliverchang May 21, 2024 03:03

oliverchang approved these changes May 21, 2024

View reviewed changes

oliverchang merged commit 8aa87e6 into google:master May 23, 2024
11 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add missing OSV schema fields to vulnerability page #2132

Add missing OSV schema fields to vulnerability page #2132

zahraaalizadeh commented Apr 23, 2024 •

edited

oliverchang May 10, 2024

oliverchang May 10, 2024

zahraaalizadeh May 15, 2024

zahraaalizadeh May 17, 2024

oliverchang May 10, 2024

zahraaalizadeh May 15, 2024

oliverchang May 17, 2024

zahraaalizadeh May 17, 2024

oliverchang May 17, 2024

zahraaalizadeh May 17, 2024

oliverchang May 17, 2024

zahraaalizadeh May 17, 2024

oliverchang May 17, 2024

oliverchang commented May 20, 2024

oliverchang left a comment

oliverchang May 20, 2024

zahraaalizadeh May 20, 2024

oliverchang left a comment

	class AffectedRange2(ndb.Model):
	"""Affected range."""
	# Type of range.
	type = ndb.StringProperty(validator=_check_valid_range_type)
	# Repo URL.
	repo_url = ndb.StringProperty()
	# Events.
	events = ndb.LocalStructuredProperty(AffectedEvent, repeated=True)

Add missing OSV schema fields to vulnerability page #2132

Add missing OSV schema fields to vulnerability page #2132

Conversation

zahraaalizadeh commented Apr 23, 2024 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

oliverchang commented May 20, 2024

oliverchang left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

oliverchang left a comment

Choose a reason for hiding this comment

zahraaalizadeh commented Apr 23, 2024 •

edited