You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
119 lines
3.5 KiB
119 lines
3.5 KiB
// Copyright 2019 clair authors
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package vulnerability
|
|
|
|
import (
|
|
"database/sql"
|
|
|
|
"github.com/coreos/clair/database"
|
|
"github.com/coreos/clair/database/pgsql/feature"
|
|
"github.com/coreos/clair/database/pgsql/util"
|
|
"github.com/coreos/clair/ext/versionfmt"
|
|
"github.com/lib/pq"
|
|
)
|
|
|
|
const (
|
|
searchPotentialAffectingVulneraibilities = `
|
|
SELECT nf.id, v.id, vaf.affected_version, vaf.id
|
|
FROM vulnerability_affected_feature AS vaf, vulnerability AS v,
|
|
namespaced_feature AS nf, feature AS f
|
|
WHERE nf.id = ANY($1)
|
|
AND nf.feature_id = f.id
|
|
AND nf.namespace_id = v.namespace_id
|
|
AND vaf.feature_name = f.name
|
|
AND vaf.feature_type = f.type
|
|
AND vaf.vulnerability_id = v.id
|
|
AND v.deleted_at IS NULL`
|
|
insertVulnerabilityAffected = `
|
|
INSERT INTO vulnerability_affected_feature(vulnerability_id, feature_name, affected_version, feature_type, fixedin)
|
|
VALUES ($1, $2, $3, $4, $5)
|
|
RETURNING ID
|
|
`
|
|
searchVulnerabilityAffected = `
|
|
SELECT vulnerability_id, feature_name, affected_version, t.name, fixedin
|
|
FROM vulnerability_affected_feature AS vaf, feature_type AS t
|
|
WHERE t.id = vaf.feature_type AND vulnerability_id = ANY($1)
|
|
`
|
|
|
|
searchVulnerabilityPotentialAffected = `
|
|
WITH req AS (
|
|
SELECT vaf.id AS vaf_id, n.id AS n_id, vaf.feature_name AS name, vaf.feature_type AS type, v.id AS vulnerability_id
|
|
FROM vulnerability_affected_feature AS vaf,
|
|
vulnerability AS v,
|
|
namespace AS n
|
|
WHERE vaf.vulnerability_id = ANY($1)
|
|
AND v.id = vaf.vulnerability_id
|
|
AND n.id = v.namespace_id
|
|
)
|
|
SELECT req.vulnerability_id, nf.id, f.version, req.vaf_id AS added_by
|
|
FROM feature AS f, namespaced_feature AS nf, req
|
|
WHERE f.name = req.name
|
|
AND f.type = req.type
|
|
AND nf.namespace_id = req.n_id
|
|
AND nf.feature_id = f.id`
|
|
)
|
|
|
|
type vulnerabilityCache struct {
|
|
nsFeatureID int64
|
|
vulnID int64
|
|
vulnAffectingID int64
|
|
}
|
|
|
|
func SearchAffectingVulnerabilities(tx *sql.Tx, features []database.NamespacedFeature) ([]vulnerabilityCache, error) {
|
|
if len(features) == 0 {
|
|
return nil, nil
|
|
}
|
|
|
|
ids, err := feature.FindNamespacedFeatureIDs(tx, features)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
fMap := map[int64]database.NamespacedFeature{}
|
|
for i, f := range features {
|
|
if !ids[i].Valid {
|
|
return nil, database.ErrMissingEntities
|
|
}
|
|
fMap[ids[i].Int64] = f
|
|
}
|
|
|
|
cacheTable := []vulnerabilityCache{}
|
|
rows, err := tx.Query(searchPotentialAffectingVulneraibilities, pq.Array(ids))
|
|
if err != nil {
|
|
return nil, util.HandleError("searchPotentialAffectingVulneraibilities", err)
|
|
}
|
|
|
|
defer rows.Close()
|
|
for rows.Next() {
|
|
var (
|
|
cache vulnerabilityCache
|
|
affected string
|
|
)
|
|
|
|
err := rows.Scan(&cache.nsFeatureID, &cache.vulnID, &affected, &cache.vulnAffectingID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if ok, err := versionfmt.InRange(fMap[cache.nsFeatureID].VersionFormat, fMap[cache.nsFeatureID].Version, affected); err != nil {
|
|
return nil, err
|
|
} else if ok {
|
|
cacheTable = append(cacheTable, cache)
|
|
}
|
|
}
|
|
|
|
return cacheTable, nil
|
|
}
|