vulnerablecode Add Vulntotal CLI

❯ python vulntotal/vulntotal_cli.py --help

Usage: vulntotal_cli.py [OPTIONS] [PURL]

  Runs the PURL through all the available  DataSources and group vulnerability
  by CVEs. Use the special '-' file name to print JSON or YAML results on
  screen/stdout.

Options:
  -l, --list   Lists all the available DataSources.
  --json FILE  Write output as pretty-printed JSON to FILE.
  --yaml FILE  Write output as YAML to FILE.
  -h, --help   Show this message and exit.

Along with some advanced hidden options especially useful for debugging and development.


Options:
  -e, --enable                    Enable these datasource/s only.
  -d, --disable                   Disable these datasource/s.
  --ecosystem                     Lists ecosystem supported by active DataSources
  --raw                           List of all the raw response from DataSources.
  --no-threading                  Run DataSources sequentially.
  -p, --pagination                Enable default pagination.
  --no-group                      Don't group by CVE.

Jul 19 '22 21:07 keshav-space

PURL: pkg:pypi/

Jul 19 '22 23:07 keshav-space

Now CLI also supports the listing of supported ecosystems

❯ python vulntotal/vulntotal_cli.py --ecosystem
Active DataSources: DEPS, GITHUB, GITLAB, OSS, OSV, SNYK, VULNERABLECODE

Ecosystem supported by active datasources
ALPINE
ANDROID
CARGO
COCOAPODS
COMPOSER
CONAN
CONDA
CRAN
CRATES.IO
DEB
DEBIAN
ERLANG
GEM
GOLANG
HEX
LINUX
MAVEN
NGINX
NPM
NUGET
OPENSSL
OSS-FUZZ
PYPI
RPM
RUBYGEMS
RUST
SWIFT
UNMANAGED

Jul 25 '22 15:07 keshav-space

IMHO we should also find a way to report some JSON output.

Aug 02 '22 13:08 pombredanne

Some example of CLI could be https://github.com/nexB/python-inspector/blob/main/src/python_inspector/resolve_cli.py

Aug 02 '22 13:08 pombredanne

Add doctsrings for all the functions and also add doctests/ unit tests for functions which have not been tested at all

Sep 05 '22 19:09 TG1999

| CVE-2020-28493 | VULNERABLECODE | CVE-2020-28493 | 2.10.1-3       | 1.11.3-r0     |
|                |                | GHSA-g3rq-g295 | 2.10.3-6       | 1.11.3-r0     |
|                |                | -4j3m          | 2.7.0-12       | 1.11.3-r0     |
|                |                |                | 2.7.18-3       | 1.11.3-r0     |

That looks like an odd result as I don't think that version 1.11.3-r0 actually exists. Maybe a bug in the VulnerableCode data? I would have expected to see 2.11.3-r0

Sep 12 '22 10:09 armijnhemel

| CVE-2020-28493 | VULNERABLECODE | CVE-2020-28493 | 2.10.1-3       | 1.11.3-r0     |
|                |                | GHSA-g3rq-g295 | 2.10.3-6       | 1.11.3-r0     |
|                |                | -4j3m          | 2.7.0-12       | 1.11.3-r0     |
|                |                |                | 2.7.18-3       | 1.11.3-r0     |
That looks like an odd result as I don't think that version 1.11.3-r0 actually exists. Maybe a bug in the VulnerableCode data? I would have expected to see 2.11.3-r0

@armijnhemel it's not a bug in Vulnerablecode, the version 1.11.3-r0 is not from pypi ecosystem but from apline ecosystem pkg:alpine/[email protected]?arch=aarch64&distroversion=edge&reponame=main vulntotal needs some sort of filtering to filter out the purls that are related to the ecosystem of the requested purl.

cc @keshav-space

Sep 12 '22 10:09 TG1999

| CVE-2020-28493 | VULNERABLECODE | CVE-2020-28493 | 2.10.1-3       | 1.11.3-r0     |
|                |                | GHSA-g3rq-g295 | 2.10.3-6       | 1.11.3-r0     |
|                |                | -4j3m          | 2.7.0-12       | 1.11.3-r0     |
|                |                |                | 2.7.18-3       | 1.11.3-r0     |
That looks like an odd result as I don't think that version 1.11.3-r0 actually exists. Maybe a bug in the VulnerableCode data? I would have expected to see 2.11.3-r0
@armijnhemel it's not a bug in Vulnerablecode, the version 1.11.3-r0 is not from pypi ecosystem but from apline ecosystem pkg:alpine/[email protected]?arch=aarch64&distroversion=edge&reponame=main vulntotal needs some sort of filtering to filter out the purls that are related to the ecosystem of the requested purl.

cc @keshav-space

I will open a different issue, as I have found what the bug is.

Sep 12 '22 11:09 armijnhemel

@armijnhemel it's not a bug in Vulnerablecode, the version 1.11.3-r0 is not from pypi ecosystem but from apline ecosystem pkg:alpine/[email protected]?arch=aarch64&distroversion=edge&reponame=main vulntotal needs some sort of filtering to filter out the purls that are related to the ecosystem of the requested purl.

cc @keshav-space

VulnTotal is making this request.

response = requests.post(
    "http://localhost:8001/api/packages/bulk_search/",
    json={"purls": ["pkg:pypi/[email protected]"]},
)

The point here is that if I'm making an explicit request for pypi ecosystem, why should I be getting anything from the alpine?

Sep 12 '22 11:09 keshav-space

@armijnhemel it's not a bug in Vulnerablecode, the version 1.11.3-r0 is not from pypi ecosystem but from apline ecosystem pkg:alpine/[email protected]?arch=aarch64&distroversion=edge&reponame=main vulntotal needs some sort of filtering to filter out the purls that are related to the ecosystem of the requested purl. cc @keshav-space

VulnTotal is making this request.
response = requests.post(
    "http://localhost:8001/api/packages/bulk_search/",
    json={"purls": ["pkg:pypi/[email protected]"]},
)
The point here is that if I'm making an explicit request for pypi ecosystem, why should I be getting anything from the alpine?

@keshav-space which branch of vulnerablecode are you using in your local checkout? if you use the latest branch you will only get purls of pypi ecosystem

Sep 12 '22 11:09 TG1999

| CVE-2020-28493 | VULNERABLECODE | CVE-2020-28493 | 2.10.1-3       | 1.11.3-r0     |
|                |                | GHSA-g3rq-g295 | 2.10.3-6       | 1.11.3-r0     |
|                |                | -4j3m          | 2.7.0-12       | 1.11.3-r0     |
|                |                |                | 2.7.18-3       | 1.11.3-r0     |
That looks like an odd result as I don't think that version 1.11.3-r0 actually exists. Maybe a bug in the VulnerableCode data? I would have expected to see 2.11.3-r0
@armijnhemel it's not a bug in Vulnerablecode, the version 1.11.3-r0 is not from pypi ecosystem but from apline ecosystem pkg:alpine/[email protected]?arch=aarch64&distroversion=edge&reponame=main vulntotal needs some sort of filtering to filter out the purls that are related to the ecosystem of the requested purl. cc @keshav-space
I will open a different issue, as I have found what the bug is.

It seems that what I found is indeed a different issue than what is currently being discussed ;-)

I have opened a separate bug report in #915

Sep 12 '22 11:09 armijnhemel

@keshav-space which branch of vulnerablecode are you using in your local checkout? if you use the latest branch you will only get purls of pypi ecosystem

Okay, let me try the latest branch.

Sep 12 '22 11:09 keshav-space

vulnerablecode vulnerablecode copied to clipboard

Add Vulntotal CLI

vulnerablecode
vulnerablecode copied to clipboard