net.ossindex.common.resource

Class VulnerabilityResource

java.lang.Object

net.ossindex.common.resource.AbstractRemoteResource

net.ossindex.common.resource.VulnerabilityResource

public class VulnerabilityResource
extends AbstractRemoteResource

Representation of a Vulnerability, backed by the OSS Index REST API. Vulnerabilities come in 3 flavours 1. As a search result -- external link (/v1.0/scm/299024085/vulnerabilities). An 'external link' vulnerability is a vulnerability that has been added, likely manually, which is comprised simply of a link to an external site describing a vulnerability, and the versions affected. The versions are related to the unique SCM/artifact that references this vulnerability instance. Note that a vulnerability *may* affect multiple products, but the version field is related to the SCM/Aftifact being queries for. [ { "uri": "https://nodesecurity.io/advisories/uglifyjs_incorrectly_handles_non-boolean_comparisons", "versions": [ "<= 2.4.23" ] } ] 2. As a search result -- CVE (/v1.0/scm/296375846/vulnerabilities). These are vulnerabilities found in the National Vulnerability Database(NVD). The versions are related to the unique SCM/artifact that references this vulnerability instance. Note that a vulnerability *may* affect multiple products, but the version field is related to the SCM/Aftifact being queries for. [ { "uri": "cve:/CVE-2011-4969", "id": "348528", "cve-id": "CVE-2011-4969", "summary": "Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.", "details": "http://localhost:8080/v1.0/cve/348528", "versions": [ "1.6", "1.6.1", "1.6.2" ] }, ... ] 3. Full CVE details (/v1.0/cve/323345) Note that in this case there is no version field in the same sense as the ones as a result of search, since when searching there is a single product for which we are returning versions, whereas when CVE details are retrieved they may be affecting multiple versions.

Author:

Ken Duck

Constructor Summary

Constructors

Constructor and Description
VulnerabilityResource()

Method Summary

Modifier and Type	Method and Description
boolean	affects(String name, String range) Return true if this vulnerability affects anything within the provided range
boolean	appliesTo(String version) Return true if this vulnerability applies to the specified version.
String	getDescription() Get a reasonable description of the vulnerability
protected String	getResourceType() Get the OSS Index resource type.
String	getTitle() Get a reasonable title of the vulnerability
URI	getUri() Get the unique URI for a vulnerability
String[]	getVersions() Get the product version ranges affected by this vulnerability.
boolean	isCve() Return true if this vulnerability represents a known CVE.

Methods inherited from class net.ossindex.common.resource.AbstractRemoteResource

exists, getId

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

VulnerabilityResource

public VulnerabilityResource()

Method Detail

getResourceType

protected String getResourceType()

Description copied from class: AbstractRemoteResource

Get the OSS Index resource type.

Specified by:

getResourceType in class AbstractRemoteResource

Returns:

The resource type name

isCve

public boolean isCve()

Return true if this vulnerability represents a known CVE. Otherwise this is likely an 'external link'.

Returns:

true if this is a CVE

getUri

public URI getUri()

Get the unique URI for a vulnerability

Returns:

The vulnerability URI

getVersions

public String[] getVersions()

Get the product version ranges affected by this vulnerability. This will only be filled in if this vulnerability is the result of a search which allows us to identify the explicit project we are interested in.

Returns:

The list of version ranges that the vulnerability affects

getDescription

public String getDescription()

Get a reasonable description of the vulnerability

Returns:

A description

getTitle

public String getTitle()

Get a reasonable title of the vulnerability

Returns:

A title

affects

public boolean affects(String name,
                       String range)

Return true if this vulnerability affects anything within the provided range

Parameters:

name - product/package name

range - range of versions that the passed in product/package represents

Returns:

True if the vulnerability affects the specified product/package

appliesTo

public boolean appliesTo(String version)

Return true if this vulnerability applies to the specified version.

Parameters:

version - Version we are checking

Returns:

true if the vulnerability affects the resource