From 2b5cc4676860cde099a0b2563a6d29a029de3506 Mon Sep 17 00:00:00 2001 From: Holly Gong <39108850+hogo6002@users.noreply.github.com> Date: Tue, 23 Jul 2024 20:43:28 -0700 Subject: [PATCH 01/87] Add security tracker links to references (#2388) Includes Alpine and Debian security tracker links to vulnerability references on OSV.dev Fixes https://github.com/google/osv.dev/issues/2284 --- vulnfeeds/cmd/combine-to-osv/main.go | 38 +++++++++++++++++++++++ vulnfeeds/cmd/combine-to-osv/main_test.go | 26 ++++++++++++++++ vulnfeeds/cves/versions.go | 12 ++++++- 3 files changed, 75 insertions(+), 1 deletion(-) diff --git a/vulnfeeds/cmd/combine-to-osv/main.go b/vulnfeeds/cmd/combine-to-osv/main.go index 38f2a79dec4..617cd24e89a 100644 --- a/vulnfeeds/cmd/combine-to-osv/main.go +++ b/vulnfeeds/cmd/combine-to-osv/main.go @@ -3,6 +3,7 @@ package main import ( "encoding/json" "flag" + "net/url" "os" "path" "strings" @@ -18,6 +19,11 @@ const ( defaultPartsInputPath = "parts" defaultOSVOutputPath = "osv_output" defaultCVEListPath = "." + + alpineEcosystem = "Alpine" + alpineSecurityTrackerURL = "https://security.alpinelinux.org/vuln" + debianEcosystem = "Debian" + debianSecurityTrackerURL = "https://security-tracker.debian.org/tracker" ) var Logger utility.LoggerWrapper @@ -159,9 +165,20 @@ func combineIntoOSV(loadedCves map[cves.CVEID]cves.Vulnerability, allParts map[c convertedCve.Withdrawn = modified } } + + addedDebianURL := false + addedAlpineURL := false for _, pkgInfo := range allParts[cveId] { convertedCve.AddPkgInfo(pkgInfo) + if strings.HasPrefix(pkgInfo.Ecosystem, debianEcosystem) && !addedDebianURL { + addReference(string(cveId), debianEcosystem, convertedCve) + addedDebianURL = true + } else if strings.HasPrefix(pkgInfo.Ecosystem, alpineEcosystem) && !addedAlpineURL { + addReference(string(cveId), alpineEcosystem, convertedCve) + addedAlpineURL = true + } } + cveModified, _ := time.Parse(time.RFC3339, convertedCve.Modified) if cvePartsModifiedTime[cveId].After(cveModified) { convertedCve.Modified = cvePartsModifiedTime[cveId].Format(time.RFC3339) @@ -221,3 +238,24 @@ func loadAllCVEs(cvePath string) map[cves.CVEID]cves.Vulnerability { } return result } + +// addReference adds the related security tracker URL to a given vulnerability's references +func addReference(cveId string, ecosystem string, convertedCve *vulns.Vulnerability) { + securityReference := vulns.Reference{Type: "ADVISORY"} + if ecosystem == alpineEcosystem { + securityReference.URL, _ = url.JoinPath(alpineSecurityTrackerURL, cveId) + } else if ecosystem == debianEcosystem { + securityReference.URL, _ = url.JoinPath(debianSecurityTrackerURL, cveId) + } + + if securityReference.URL == "" { + return + } + + _, err := cves.ValidateAndCanonicalizeLink(securityReference.URL) + if err != nil { + Logger.Warnf("Failed to add reference for %s in %s: %v", cveId, ecosystem, err) + return + } + convertedCve.References = append(convertedCve.References, securityReference) +} diff --git a/vulnfeeds/cmd/combine-to-osv/main_test.go b/vulnfeeds/cmd/combine-to-osv/main_test.go index 1d2d832bb68..cc7004a1f61 100644 --- a/vulnfeeds/cmd/combine-to-osv/main_test.go +++ b/vulnfeeds/cmd/combine-to-osv/main_test.go @@ -102,6 +102,32 @@ func TestCombineIntoOSV(t *testing.T) { if len(combinedOSV[cve].Affected) != len(allParts[cve]) { t.Errorf("Affected lengths for %s do not match", cve) } + found := false + if cve == "CVE-2018-1000500" { + for _, reference := range combinedOSV[cve].References { + if reference.Type == "ADVISORY" && + reference.URL == "https://security-tracker.debian.org/tracker/CVE-2018-1000500" { + found = true + } + } + } else if cve == "CVE-2022-33745" { + for _, reference := range combinedOSV[cve].References { + if reference.Type == "ADVISORY" && + reference.URL == "https://security.alpinelinux.org/vuln/CVE-2022-33745" { + found = true + } + } + } else if cve == "CVE-2022-32746" { + for _, reference := range combinedOSV[cve].References { + if reference.Type == "ADVISORY" && + reference.URL == "https://security.alpinelinux.org/vuln/CVE-2022-32746" { + found = true + } + } + } + if !found { + t.Errorf("%s doesn't have all expected references", cve) + } } } diff --git a/vulnfeeds/cves/versions.go b/vulnfeeds/cves/versions.go index 41ac7afc0de..40bc6412acf 100644 --- a/vulnfeeds/cves/versions.go +++ b/vulnfeeds/cves/versions.go @@ -611,7 +611,17 @@ func ValidateAndCanonicalizeLink(link string) (canonicalLink string, err error) } backoff := retry.NewExponential(1 * time.Second) if err := retry.Do(context.Background(), retry.WithMaxRetries(3, backoff), func(ctx context.Context) error { - resp, err := http.Head(link) + req, err := http.NewRequest("HEAD", link, nil) + if err != nil { + return err + } + + // security.alpinelinux.org responds with text/html content. + // default HEAD request in Go does not provide any Accept headers, causing a 406 response. + req.Header.Set("Accept", "text/html") + + // Send the request + resp, err := http.DefaultClient.Do(req) if err != nil { return err } From c10b00561ff869143b335306e94fa66437d99b5c Mon Sep 17 00:00:00 2001 From: Esteban Campos Date: Fri, 26 Jul 2024 03:27:51 +1000 Subject: [PATCH 02/87] style: adjusting styles of titles (#2410) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Description Updating style of titles on main osv.dev website to be more consistent. Recommendations are visible on Figma: https://www.figma.com/design/Yi1nd5v6iR406zngmscSD3/Open-Source-Vulnerability-(OSV)-Scanner?node-id=0-1&t=eH3EaOJ8WHYCUudr-0 ## Screenshots ![Screenshot 2024-07-23 at 3 03 24 PM](https://github.com/user-attachments/assets/ecc69e7a-1d56-4eec-b7ad-3f19f982aa4c) ![Screenshot 2024-07-23 at 3 03 20 PM](https://github.com/user-attachments/assets/62c6d58e-0e14-4a7e-8c1a-70b1cae48f2f) ![Screenshot 2024-07-23 at 3 08 26 PM](https://github.com/user-attachments/assets/391ce49f-d192-40e6-a4c7-b041f74b8b71) --- gcp/appengine/blog/layouts/index.html | 2 +- gcp/appengine/frontend3/src/styles.scss | 23 +++++++++++++++++-- .../frontend3/src/templates/blog.html | 1 + .../frontend3/src/templates/list.html | 2 +- 4 files changed, 24 insertions(+), 4 deletions(-) diff --git a/gcp/appengine/blog/layouts/index.html b/gcp/appengine/blog/layouts/index.html index 41ac3e6939e..749915a6a74 100644 --- a/gcp/appengine/blog/layouts/index.html +++ b/gcp/appengine/blog/layouts/index.html @@ -1,7 +1,7 @@ {{ $pages := where site.RegularPages "Type" "posts"}} {{ range $pages.ByPublishDate.Reverse }}
- {{ .Title }} + {{ .Title }}
Posted by {{ .Params.author }} on {{ .PublishDate.Format "Jan 2, 2006" }}
{{ .Summary }} diff --git a/gcp/appengine/frontend3/src/styles.scss b/gcp/appengine/frontend3/src/styles.scss index d82794daf4f..9250917da2f 100644 --- a/gcp/appengine/frontend3/src/styles.scss +++ b/gcp/appengine/frontend3/src/styles.scss @@ -369,8 +369,9 @@ pre { .list-page { .title { - font-size: 20px; - height: 25px; + font-size: 42px; + margin-top: 24px; + margin-bottom: 26px; // To compensate the margin-top of search input of 22px } .ecosystem-buttons { @@ -1372,6 +1373,13 @@ dl.vulnerability-details, .blog-entry { padding-bottom: 24px; + .entry-title { + font-size: 1.5rem; + font-family: $osv-heading-font-family; + display: block; + padding-bottom: 16px; + } + .author { font-size: 18px; font-family: $osv-body-font-family; @@ -1461,6 +1469,13 @@ div.highlight { } } +.blog-page{ + .title { + padding-top: 24px; + padding-bottom: 42px; + } +} + .blog-post-page { .post { max-width: 800px; @@ -1468,6 +1483,10 @@ div.highlight { margin: 0 auto; font-size: 16px; } + + .author{ + padding-bottom: 48px; + } } /** 404 page */ diff --git a/gcp/appengine/frontend3/src/templates/blog.html b/gcp/appengine/frontend3/src/templates/blog.html index 4620e5cb691..9c86dd302e7 100644 --- a/gcp/appengine/frontend3/src/templates/blog.html +++ b/gcp/appengine/frontend3/src/templates/blog.html @@ -6,6 +6,7 @@
+

Blog

{{ index|safe }}
diff --git a/gcp/appengine/frontend3/src/templates/list.html b/gcp/appengine/frontend3/src/templates/list.html index 326a0ec5e24..37037f3e94b 100644 --- a/gcp/appengine/frontend3/src/templates/list.html +++ b/gcp/appengine/frontend3/src/templates/list.html @@ -30,7 +30,7 @@
-

Vulnerability Library

+

Vulnerabilities