adulau/git-vuln-finder
1
0
Fork 0
mirror of https://github.com/adulau/git-vuln-finder.git synced 2024-11-22 10:07:11 +00:00
Code Issues Projects Releases Packages Wiki Activity

reformat a tiny with black

Browse source
This commit is contained in:
Cédric Bonhomme 2020-01-06 07:50:21 +01:00
parent a597d1e6fc
commit 335bdff4cb
No known key found for this signature in database
GPG key ID: A1CB94DE57B7A70D
4 changed files with 113 additions and 82 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

66
bin/finder.py
View file

@ -16,34 +16,44 @@ import sys
import argparse import argparse
import typing import typing
from git_vuln_finder import ( from git_vuln_finder import get_patterns, find_vuln, summary
get_patterns,
find_vuln,
summary
)
def main(): def main():
"""Point of entry for the script. """Point of entry for the script.
""" """
# Parsing arguments # Parsing arguments
parser = argparse.ArgumentParser(description = "Finding potential software vulnerabilities from git commit messages.", epilog = "More info: https://github.com/cve-search/git-vuln-finder") parser = argparse.ArgumentParser(
description="Finding potential software vulnerabilities from git commit messages.",
epilog="More info: https://github.com/cve-search/git-vuln-finder",
)
parser.add_argument("-v", help="increase output verbosity", action="store_true") parser.add_argument("-v", help="increase output verbosity", action="store_true")
parser.add_argument("-r", type=str, help="git repository to analyse") parser.add_argument("-r", type=str, help="git repository to analyse")
parser.add_argument("-o", type=str, help="Output format: [json]", default="json") parser.add_argument("-o", type=str, help="Output format: [json]", default="json")
parser.add_argument("-s", type=str, help="State of the commit found", default="under-review") parser.add_argument(
parser.add_argument("-p", type=str, help="Matching pattern to use: [vulnpatterns, cryptopatterns, cpatterns] - the pattern 'all' is used to match all the patterns at once.", default="vulnpatterns") "-s", type=str, help="State of the commit found", default="under-review"
parser.add_argument("-c", help="output only a list of the CVE pattern found in commit messages (disable by default)", action="store_true") )
parser.add_argument("-t", help="Include tags matching a specific commit", action="store_true") parser.add_argument(
"-p",
type=str,
help="Matching pattern to use: [vulnpatterns, cryptopatterns, cpatterns] - the pattern 'all' is used to match all the patterns at once.",
default="vulnpatterns",
)
parser.add_argument(
"-c",
help="output only a list of the CVE pattern found in commit messages (disable by default)",
action="store_true",
)
parser.add_argument(
"-t", help="Include tags matching a specific commit", action="store_true"
)
args = parser.parse_args() args = parser.parse_args()
patterns = get_patterns() patterns = get_patterns()
vulnpatterns = patterns["en"]["medium"]["vuln"] vulnpatterns = patterns["en"]["medium"]["vuln"]
cryptopatterns = patterns["en"]["medium"]["crypto"] cryptopatterns = patterns["en"]["medium"]["crypto"]
cpatterns = patterns["en"]["medium"]["c"] cpatterns = patterns["en"]["medium"]["c"]
if args.p == "vulnpatterns": if args.p == "vulnpatterns":
defaultpattern = vulnpatterns defaultpattern = vulnpatterns
elif args.p == "cryptopatterns": elif args.p == "cryptopatterns":
@ -62,13 +72,11 @@ def main():
else: else:
repo = git.Repo(args.r) repo = git.Repo(args.r)
# Initialization of the variables for the results # Initialization of the variables for the results
found = 0 found = 0
all_potential_vulnerabilities = {} all_potential_vulnerabilities = {}
cve_found = set() cve_found = set()
repo_heads = repo.heads repo_heads = repo.heads
repo_heads_names = [h.name for h in repo_heads] repo_heads_names = [h.name for h in repo_heads]
print(repo_heads_names, file=sys.stderr) print(repo_heads_names, file=sys.stderr)
@ -85,32 +93,36 @@ def main():
if isinstance(defaultpattern, typing.Pattern): if isinstance(defaultpattern, typing.Pattern):
ret = find_vuln(commit, pattern=defaultpattern, verbose=args.v) ret = find_vuln(commit, pattern=defaultpattern, verbose=args.v)
if ret: if ret:
rcommit = ret['commit'] rcommit = ret["commit"]
_, potential_vulnerabilities = summary(repo, _, potential_vulnerabilities = summary(
repo,
rcommit, rcommit,
branch, branch,
tagmap, tagmap,
defaultpattern, defaultpattern,
origin=origin, origin=origin,
vuln_match=ret['match'], vuln_match=ret["match"],
tags_matching=args.t, tags_matching=args.t,
commit_state=args.s) commit_state=args.s,
)
all_potential_vulnerabilities.update(potential_vulnerabilities) all_potential_vulnerabilities.update(potential_vulnerabilities)
found += 1 found += 1
elif isinstance(defaultpattern, list): elif isinstance(defaultpattern, list):
for p in defaultpattern: for p in defaultpattern:
ret = find_vuln(commit, pattern=p, verbose=args.v) ret = find_vuln(commit, pattern=p, verbose=args.v)
if ret: if ret:
rcommit = ret['commit'] rcommit = ret["commit"]
_, potential_vulnerabilities = summary(repo, _, potential_vulnerabilities = summary(
repo,
rcommit, rcommit,
branch, branch,
tagmap, tagmap,
p, p,
origin=origin, origin=origin,
vuln_match=ret['match'], vuln_match=ret["match"],
tags_matching=args.t, tags_matching=args.t,
commit_state=args.s) commit_state=args.s,
)
all_potential_vulnerabilities.update(potential_vulnerabilities) all_potential_vulnerabilities.update(potential_vulnerabilities)
found += 1 found += 1
@ -119,5 +131,11 @@ def main():
elif args.c: elif args.c:
print(json.dumps(list(cve_found))) print(json.dumps(list(cve_found)))
print("{} CVE referenced found in commit(s)".format(len(list(cve_found))), file=sys.stderr) print(
print("Total potential vulnerability found in {} commit(s)".format(found), file=sys.stderr) "{} CVE referenced found in commit(s)".format(len(list(cve_found))),
file=sys.stderr,
)
print(
"Total potential vulnerability found in {} commit(s)".format(found),
file=sys.stderr,
)

1
git_vuln_finder/__init__.py
View file

@ -1,4 +1,3 @@
from git_vuln_finder.pattern import build_pattern from git_vuln_finder.pattern import build_pattern
from git_vuln_finder.pattern import get_patterns from git_vuln_finder.pattern import get_patterns
from git_vuln_finder.vulnerability import find_vuln from git_vuln_finder.vulnerability import find_vuln

6
git_vuln_finder/pattern.py
View file

@ -14,7 +14,7 @@ import os
import re import re
PATTERNS_PATH="./git_vuln_finder/patterns" PATTERNS_PATH = "./git_vuln_finder/patterns"
def build_pattern(pattern_file): def build_pattern(pattern_file):
@ -49,9 +49,9 @@ def get_patterns(patterns_path=PATTERNS_PATH):
for f in files: for f in files:
if f.endswith(".prefix") or f.endswith(".suffix"): if f.endswith(".prefix") or f.endswith(".suffix"):
continue continue
npath = root[len(patterns_path):].split(os.sep) npath = root[len(patterns_path) :].split(os.sep)
try: try:
npath.remove('') npath.remove("")
except ValueError: except ValueError:
pass pass

80
git_vuln_finder/vulnerability.py
View file

@ -23,14 +23,15 @@ def find_vuln(commit, pattern, verbose=False):
print(commit.message, file=sys.stderr) print(commit.message, file=sys.stderr)
print("---", file=sys.stderr) print("---", file=sys.stderr)
ret = {} ret = {}
ret['commit'] = commit ret["commit"] = commit
ret['match'] = m.groups() ret["match"] = m.groups()
return ret return ret
else: else:
return None return None
def summary(repo, def summary(
repo,
commit, commit,
branch, branch,
tagmap, tagmap,
@ -38,59 +39,72 @@ def summary(repo,
origin=None, origin=None,
vuln_match=None, vuln_match=None,
tags_matching=False, tags_matching=False,
commit_state="under-review" commit_state="under-review",
): ):
potential_vulnerabilities = {} potential_vulnerabilities = {}
rcommit = commit rcommit = commit
cve = extract_cve(rcommit.message) cve = extract_cve(rcommit.message)
if origin is not None: if origin is not None:
origin = origin origin = origin
if origin.find('github.com'): if origin.find("github.com"):
origin_github_api = origin.split(':')[1] origin_github_api = origin.split(":")[1]
(org_name, repo_name) = origin_github_api.split('/', 1) (org_name, repo_name) = origin_github_api.split("/", 1)
if repo_name.find('.git$'): if repo_name.find(".git$"):
repo_name = re.sub(r".git$","", repo_name) repo_name = re.sub(r".git$", "", repo_name)
origin_github_api = 'https://api.github.com/repos/{}/{}/commits/{}'.format(org_name, repo_name, rcommit.hexsha) origin_github_api = "https://api.github.com/repos/{}/{}/commits/{}".format(
org_name, repo_name, rcommit.hexsha
)
else: else:
origin = 'git origin unknown' origin = "git origin unknown"
# deduplication if similar commits on different branches # deduplication if similar commits on different branches
if rcommit.hexsha in potential_vulnerabilities: if rcommit.hexsha in potential_vulnerabilities:
potential_vulnerabilities[rcommit.hexsha]['branches'].append(branch) potential_vulnerabilities[rcommit.hexsha]["branches"].append(branch)
else: else:
potential_vulnerabilities[rcommit.hexsha] = {} potential_vulnerabilities[rcommit.hexsha] = {}
potential_vulnerabilities[rcommit.hexsha]['message'] = rcommit.message potential_vulnerabilities[rcommit.hexsha]["message"] = rcommit.message
potential_vulnerabilities[rcommit.hexsha]['language'] = langdetect(rcommit.message) potential_vulnerabilities[rcommit.hexsha]["language"] = langdetect(
potential_vulnerabilities[rcommit.hexsha]['commit-id'] = rcommit.hexsha rcommit.message
potential_vulnerabilities[rcommit.hexsha]['summary'] = rcommit.summary )
potential_vulnerabilities[rcommit.hexsha]['stats'] = rcommit.stats.total potential_vulnerabilities[rcommit.hexsha]["commit-id"] = rcommit.hexsha
potential_vulnerabilities[rcommit.hexsha]['author'] = rcommit.author.name potential_vulnerabilities[rcommit.hexsha]["summary"] = rcommit.summary
potential_vulnerabilities[rcommit.hexsha]['author-email'] = rcommit.author.email potential_vulnerabilities[rcommit.hexsha]["stats"] = rcommit.stats.total
potential_vulnerabilities[rcommit.hexsha]['authored_date'] = rcommit.authored_date potential_vulnerabilities[rcommit.hexsha]["author"] = rcommit.author.name
potential_vulnerabilities[rcommit.hexsha]['committed_date'] = rcommit.committed_date potential_vulnerabilities[rcommit.hexsha]["author-email"] = rcommit.author.email
potential_vulnerabilities[rcommit.hexsha]['branches'] = [] potential_vulnerabilities[rcommit.hexsha][
potential_vulnerabilities[rcommit.hexsha]['branches'].append(branch) "authored_date"
potential_vulnerabilities[rcommit.hexsha]['pattern-selected'] = pattern.pattern ] = rcommit.authored_date
potential_vulnerabilities[rcommit.hexsha]['pattern-matches'] = vuln_match potential_vulnerabilities[rcommit.hexsha][
potential_vulnerabilities[rcommit.hexsha]['origin'] = origin "committed_date"
] = rcommit.committed_date
potential_vulnerabilities[rcommit.hexsha]["branches"] = []
potential_vulnerabilities[rcommit.hexsha]["branches"].append(branch)
potential_vulnerabilities[rcommit.hexsha]["pattern-selected"] = pattern.pattern
potential_vulnerabilities[rcommit.hexsha]["pattern-matches"] = vuln_match
potential_vulnerabilities[rcommit.hexsha]["origin"] = origin
if origin_github_api: if origin_github_api:
potential_vulnerabilities[commit.hexsha]['origin-github-api'] = origin_github_api potential_vulnerabilities[commit.hexsha][
potential_vulnerabilities[rcommit.hexsha]['tags'] = [] "origin-github-api"
] = origin_github_api
potential_vulnerabilities[rcommit.hexsha]["tags"] = []
if tags_matching: if tags_matching:
if repo.commit(rcommit).hexsha in tagmap: if repo.commit(rcommit).hexsha in tagmap:
potential_vulnerabilities[rcommit.hexsha]['tags'] = tagmap[repo.commit(rcommit).hexsha] potential_vulnerabilities[rcommit.hexsha]["tags"] = tagmap[
if cve: potential_vulnerabilities[rcommit.hexsha]['cve'] = cve repo.commit(rcommit).hexsha
]
if cve: if cve:
potential_vulnerabilities[rcommit.hexsha]['state'] = "cve-assigned" potential_vulnerabilities[rcommit.hexsha]["cve"] = cve
if cve:
potential_vulnerabilities[rcommit.hexsha]["state"] = "cve-assigned"
else: else:
potential_vulnerabilities[rcommit.hexsha]['state'] = commit_state potential_vulnerabilities[rcommit.hexsha]["state"] = commit_state
return rcommit.hexsha, potential_vulnerabilities return rcommit.hexsha, potential_vulnerabilities
def extract_cve(commit): def extract_cve(commit):
cve_found = set() cve_found = set()
cve_find = re.compile(r'CVE-[1-2]\d{1,4}-\d{1,7}', re.IGNORECASE) cve_find = re.compile(r"CVE-[1-2]\d{1,4}-\d{1,7}", re.IGNORECASE)
m = cve_find.findall(commit) m = cve_find.findall(commit)
if m: if m:
for v in m: for v in m: