diff --git a/app/controller/RulesAdmin.py b/app/controller/RulesAdmin.py index 131385d3..996ffbd6 100644 --- a/app/controller/RulesAdmin.py +++ b/app/controller/RulesAdmin.py @@ -71,10 +71,12 @@ def rules(): @web.route(ADMIN_URL + '/add_new_rule', methods=['GET', 'POST']) def add_new_rule(): if request.method == 'POST': - vul_type = request.form['vul_type'] - lang = request.form['language'] - regex = request.form['regex'] - description = request.form['description'] + vul_type = request.form.get('vul_type') + lang = request.form.get('language') + regex = request.form.get('regex') + regex_confirm = request.form.get('regex_confirm') + description = request.form.get('description') + repair = request.form.get('repair') if not vul_type or vul_type == "": return jsonify(tag='danger', msg='vul type error.') @@ -84,9 +86,14 @@ def add_new_rule(): return jsonify(tag='danger', msg='regex can not be blank') if not description or description == "": return jsonify(tag='danger', msg='description can not be blank') + if not regex_confirm or regex_confirm == "": + return jsonify(tag='danger', msg='confirm regex can not be blank') + if not repair or repair == "": + return jsonify(tag='danger', msg='repair can not be empty') current_time = time.strftime('%Y-%m-%d %X', time.localtime()) - rule = CobraRules(vul_type, lang, regex, description, current_time, current_time) + rule = CobraRules(vul_type, lang, regex, regex_confirm, description, repair, + 1, current_time, current_time) try: db.session.add(rule) db.session.commit() @@ -123,11 +130,14 @@ def del_rule(): @web.route(ADMIN_URL + '/edit_rule/', methods=['GET', 'POST']) def edit_rule(rule_id): if request.method == 'POST': - vul_type = request.form['vul_type'] - lang = request.form['language'] - regex = request.form['regex'] - description = request.form['description'] - rule_id = request.form['rule_id'] + vul_type = request.form.get('vul_type') + lang = request.form.get('language') + regex = request.form.get('regex') + regex_confirm = request.form.get('regex_confirm') + description = request.form.get('description') + rule_id = request.form.get('rule_id') + repair = request.form.get('repair') + status = request.form.get('status') if not vul_type or vul_type == "": return jsonify(tag='danger', msg='vul type error.') @@ -135,14 +145,24 @@ def edit_rule(rule_id): return jsonify(tag='danger', msg='language error.') if not regex or regex == "": return jsonify(tag='danger', msg='regex can not be blank') + if not regex_confirm or regex_confirm == "": + return jsonify(tag='danger', msg='confirm regex can not be blank') if not description or description == "": return jsonify(tag='danger', msg='description can not be blank') + if not repair or repair == "": + return jsonify(tag='danger', msg='repair can not be blank') + if not status or status == "" or (status != '1' and status != '2'): + return jsonify(tag="danger", msg='status error.') r = CobraRules.query.filter_by(id=rule_id).first() r.vul_id = vul_type r.language = lang r.regex = regex + r.regex_confirm = regex_confirm r.description = description + r.repair = repair + r.status = status + r.updated_at = time.strftime('%Y-%m-%d %X', time.localtime()) try: db.session.add(r) db.session.commit() @@ -154,10 +174,7 @@ def edit_rule(rule_id): vul_type = CobraVuls.query.all() languages = CobraLanguages.query.all() return render_template('rulesadmin/edit_rule.html', data={ - 'vul_type': r.vul_id, - 'language': r.language, - 'regex': r.regex, - 'description': r.description, + 'rule': r, 'all_vuls': vul_type, 'all_lang': languages, }) @@ -167,22 +184,24 @@ def edit_rule(rule_id): @web.route(ADMIN_URL + '/add_new_vul', methods=['GET', 'POST']) def add_new_vul(): if request.method == 'POST': - name = request.form['name'] - description = request.form['description'] + name = request.form.get('name') + description = request.form.get('description') + repair = request.form.get('repair') if not name or name == "": - return jsonify(tag='danger', msg='name is empty') + return jsonify(tag='danger', msg='name can not be blank.') if not description or description == "": - return jsonify(tag='danger', msg='description is empty') + return jsonify(tag='danger', msg='description can not be blank.') + if not repair or repair == "": + return jsonify(tag='danger', msg='repair can not be blank.') current_time = time.strftime('%Y-%m-%d %X', time.localtime()) - vul = CobraVuls(name, description, current_time, current_time) + vul = CobraVuls(name, description, repair, current_time, current_time) try: db.session.add(vul) db.session.commit() return jsonify(tag='success', msg='Add Success.') except: return jsonify(tag='danger', msg='Add failed. Please try again later.') - else: return render_template('rulesadmin/add_new_vul.html') @@ -217,15 +236,22 @@ def del_vul(): @web.route(ADMIN_URL + '/edit_vul/', methods=['GET', 'POST']) def edit_vul(vul_id): if request.method == 'POST': - name = request.form['name'] - description = request.form['description'] + name = request.form.get('name') + description = request.form.get('description') + repair = request.form.get('repair') + if not name or name == "": return jsonify(tag='danger', msg='name can not be empty') if not description or description == "": return jsonify(tag='danger', msg='description can not be empty') + if not repair or repair == "": + return jsonify(tag='danger', msg='repair can not be empty') + v = CobraVuls.query.filter_by(id=vul_id).first() v.name = name v.description = description + v.repair = repair + try: db.session.add(v) db.session.commit() @@ -235,8 +261,7 @@ def edit_vul(vul_id): else: v = CobraVuls.query.filter_by(id=vul_id).first() return render_template('rulesadmin/edit_vul.html', data={ - 'name': v.name, - 'description': v.description, + 'vul': v, }) diff --git a/app/controller/api.py b/app/controller/api.py index 66df8be8..ee19ab6d 100644 --- a/app/controller/api.py +++ b/app/controller/api.py @@ -24,14 +24,12 @@ def add_new_task(): { "url": "https://gitlab.com/username/project", // must, gitlab address "branch": "master", // must, the project branch - "username": "your username", // optional, the username access to the repo. If the repo is public, leave this blank. - "password": "your password", // optional, the password access to the repo. If the repo is public, leave this blank. + "username": "username here", // if the repo is private, please provide the account username + "password": "password here", // if the repo is private, please provide the account password "old_version": "old version here", // optional, if you choice diff scan mode, you should provide old version hash. "new_version": "new version here", // optional, if you choice diff scan mode, you should provide new version hash. "scan_way": 1, // must, scan way, 1-full scan, 2-diff scan, if you want to use full scan mode, // leave old_version and new_version blank. - "scan_type": 2, // must, scan type, 1-all vulnerabilities, 2-general vulnerabilities, 3-code syntax - "level": "1", // must, scan level, 1-5 } :return: The return value also in json format, usually is: @@ -48,13 +46,11 @@ def add_new_task(): # get data url = data.get('url') branch = data.get('branch') - username = data.get('username') - password = data.get('password') new_version = data.get('new_version') old_version = data.get('old_version') + username = data.get('username') + password = data.get('password') scan_way = data.get('scan_way') - scan_type = data.get('scan_type') - level = data.get('level') # check data if not url or url == "": @@ -63,34 +59,33 @@ def add_new_task(): return jsonify(code=1002, msg=u'branch can not be empty.') if not scan_way or scan_way == "": return jsonify(code=1002, msg=u'scan way can not be empty') - if not scan_type or scan_type == "": - return jsonify(code=1002, msg=u'scan type can not be empty') - if not level or level == "": - return jsonify(code=1002, msg=u'level can not be empty') - current_timestamp = int(time.time()) current_time = time.strftime('%Y-%m-%d %X', time.localtime()) gg = GitTools.Git(url, branch=branch, username=username, password=password) - repo_name = gg.repo_directory.split('/')[-1] - repo_name = repo_name.split('_')[-1] + repo_author = gg.repo_author + repo_name = gg.repo_name new_version = None if new_version == "" else new_version old_version = None if old_version == "" else old_version username = None if username == "" else username password = None if password == "" else password + # TODO: file count + # insert into task info table. - task_info = CobraTaskInfo(task_type=1, create_time=current_timestamp, filename=None, url=url, branch=branch, - username=username, password=password, scan_type=scan_type, level=level, scan_way=scan_way, - old_version=old_version, new_version=new_version) + task = CobraTaskInfo(url, branch, scan_way, new_version, old_version, None, None, None, 1, + current_time, current_time) - # insert into project table. - project = CobraProjects(name=repo_name, repo_type=1, repository=url, branch=branch, username=username, - password=password, scan_at=None, created_at=current_time, updated_at=current_time) + p = CobraProjects.query.filter_by(repository=url).first() + project = None + if not p: + # insert into project table. + project = CobraProjects(url, repo_name, repo_author, None, None, current_time, current_time) try: - db.session.add(task_info) - db.session.add(project) + db.session.add(task) + if not p: + db.session.add(project) db.session.commit() return jsonify(code=1001, msg=u'task add success.') except: diff --git a/app/models.py b/app/models.py index 46d82ef7..28b4753e 100644 --- a/app/models.py +++ b/app/models.py @@ -12,56 +12,45 @@ # See the file 'doc/COPYING' for copying permission # -from sqlalchemy.dialects.mysql import TINYINT, INTEGER +from sqlalchemy.dialects.mysql import TINYINT, INTEGER, SMALLINT from app import db # task_info table. store task information. class CobraTaskInfo(db.Model): - ''' - id: task id - task_type: task type, 1-login to gitlab with username and password, 2-upload file - create_time: task created time - filename: filename, if user upload source code, this is the archive filename - url: url, if user provide gitlab account, this is the project url on gitlab - username: username, gitlab username - password: password, gitlab password - scan_type: scan type, 1-all vulnerabislities, 2-general vulnerabilities, 3-code syntax, - level: level, scan level - scan_way: scan way, 1-full scan, 2-diff scan - old_version: old version, if user select diff scan, this is the old version of the project - new_version: new version, if user select diff scan, this is the new version of the project - ''' __tablename__ = 'tasks' id = db.Column(INTEGER(unsigned=True), primary_key=True, autoincrement=True, nullable=False) - task_type = db.Column(db.SmallInteger, nullable=False) - filename = db.Column(db.String(255), nullable=True) - url = db.Column(db.String(255), nullable=True) - branch = db.Column(db.String(64), nullable=True) - scan_way = db.Column(db.SmallInteger, nullable=False) - old_version = db.Column(db.String(40), nullable=True) - new_version = db.Column(db.String(40), nullable=True) - created_at = db.Column(db.DATETIME, nullable=False) - updated_at = db.Column(db.DATETIME, nullable=False) - - def __init__(self, task_type, filename, url, branch, scan_way, - old_version, new_version, created_at, updated_at): - self.task_type = task_type - self.filename = filename - self.url = url + target = db.Column(db.String(255), nullable=True, default=None) + branch = db.Column(db.String(64), nullable=True, default=None) + scan_way = db.Column(SMALLINT(6), nullable=True, default=None) + new_version = db.Column(db.String(40), nullable=True, default=None) + old_version = db.Column(db.String(40), nullable=True, default=None) + time_consume = db.Column(db.DateTime, nullable=True, default=None) + time_start = db.Column(db.DateTime, nullable=True, default=None) + time_end = db.Column(db.DateTime, nullable=True, default=None) + file_count = db.Column(db.Integer, nullable=True, default=None) + created_at = db.Column(db.DateTime, nullable=True, default=None) + updated_at = db.Column(db.DateTime, nullable=True, default=None) + + def __init__(self, target, branch, scan_way, new_version, old_version, time_consume, time_start, time_end, + file_count, created_at, updated_at): + self.target = target self.branch = branch self.scan_way = scan_way - self.old_version = old_version self.new_version = new_version + self.old_version = old_version + self.time_consume = time_consume + self.time_start = time_start + self.time_end = time_end + self.file_count = file_count self.created_at = created_at self.updated_at = updated_at def __repr__(self): - return '' % (self.id, - "username/password on gitlab" if self.scan_way == 1 else "file upload") + return '' % (self.id, self.target) class CobraRules(db.Model): @@ -71,15 +60,21 @@ class CobraRules(db.Model): vul_id = db.Column(TINYINT(unsigned=False), nullable=True, default=None) language = db.Column(TINYINT(unsigned=False), nullable=True, default=None) regex = db.Column(db.String(512), nullable=True, default=None) + regex_confirm = db.Column(db.String(512), nullable=True, default=None) description = db.Column(db.String(256), nullable=True, default=None) + repair = db.Column(db.String(512), nullable=True, default=None) + status = db.Column(TINYINT(2), nullable=True, default=None) created_at = db.Column(db.DateTime, nullable=True, default=None) updated_at = db.Column(db.DateTime, nullable=True, default=None) - def __init__(self, vul_id, language, regex, description, created_at, updated_at): + def __init__(self, vul_id, language, regex, regex_confirm, description, repair, status, created_at, updated_at): self.vul_id = vul_id self.language = language self.regex = regex + self.regex_confirm = regex_confirm self.description = description + self.repair = repair + self.status = status self.created_at = created_at self.updated_at = updated_at @@ -92,12 +87,14 @@ class CobraVuls(db.Model): id = db.Column(INTEGER(unsigned=True), primary_key=True, autoincrement=True, nullable=False) name = db.Column(db.String(56), nullable=True, default=None) description = db.Column(db.String(512), nullable=True, default=None) + repair = db.Column(db.String(512), nullable=True, default=None) created_at = db.Column(db.DateTime, nullable=True, default=None) updated_at = db.Column(db.DateTime, nullable=True, default=None) - def __init__(self, name, description, created_at, updated_at): + def __init__(self, name, description, repair, created_at, updated_at): self.name = name self.description = description + self.repair = repair self.created_at = created_at self.updated_at = updated_at diff --git a/app/templates/asset/js/admin.js b/app/templates/asset/js/admin.js index 56ab3a62..e72ff5ec 100644 --- a/app/templates/asset/js/admin.js +++ b/app/templates/asset/js/admin.js @@ -42,38 +42,37 @@ $("#show_all_rules").click(function () { var lang = $("#language").val(); var regex = $("#regex").val(); var description = $("#description").val(); + var regex_confirm = $("#confirm-regex").val(); + var repair = $("#repair").val(); + var status = $("#status:checked").val(); // check data if (!vul_type || vul_type == "") { - var result = ''; - $("#add-new-rule-result").html(result).fadeIn(1000); + showAlert('danger', 'vul type error.', '#edit-rule-result'); return false; } if (!lang || lang == "") { - var result = ''; - $("#add-new-rule-result").html(result).fadeIn(1000); + showAlert('danger', 'language error.', '#edit-rule-result'); return false; } if (!description || description == "") { - var result = ''; - $("#add-new-rule-result").html(result).fadeIn(1000); + showAlert('danger', 'description can not be blank.', '#edit-rule-result'); return false; } if (!regex || regex == "") { - var result = ''; - $("#add-new-rule-result").html(result).fadeIn(1000); + showAlert('danger', 'regex can not be blank.', '#edit-rule-result'); + return false; + } + if (!regex_confirm || regex_confirm == "") { + showAlert('danger', 'confirm regex can not be blank', '#edit-rule-result'); + return false; + } + if (!repair || repair == "") { + showAlert('danger', 'repair can not be blank.', '#edit-rule-result'); + return false; + } + if (!status || status == "") { + showAlert('danger', 'status error.', '#edit-rule-result'); return false; } @@ -82,15 +81,14 @@ $("#show_all_rules").click(function () { 'vul_type': vul_type, 'language': lang, 'regex': regex, + 'regex_confirm': regex_confirm, 'description': description, - 'rule_id': cur_id + 'rule_id': cur_id, + 'repair': repair, + 'status': status }; $.post('edit_rule/' + cur_id, data, function (res) { - var tres = ''; - $("#edit-rule-result").html(tres).fadeIn(1000); + showAlert(res.tag, res.msg, "#edit-rule-result"); }); }); }); @@ -100,8 +98,13 @@ $("#show_all_rules").click(function () { $("[id^=view-rule]").click(function () { var cur_id = $(this).attr('id').split('-')[2]; var regex = $("
").text($("#rule-regex-" + cur_id).text()).html(); + var confirm_regex = $("
").text($("#rule-confirm-regex-" + cur_id).text()).html(); + var repair = $("
").text($("#rule-repair-" + cur_id).text()).html(); $("#view-title").html("Rule Details."); - $("#view-body").html("Regex in Perl: " + regex); + var content = "Regex: " + regex + "
"; + content += "Confirm Regex: " + confirm_regex + "
"; + content += "Repair: " + repair + "
"; + $("#view-body").html(content); }); }); @@ -116,39 +119,33 @@ $("#add_new_rules").click(function () { var vul_type = $("#vul_type").val(); var lang = $("#language").val(); var regex = $("#regex").val(); + var regex_confirm = $("#confirm-regex").val(); var description = $("#description").val(); + var repair = $("#repair").val(); // check data if (!vul_type || vul_type == "") { - var result = ''; - $("#add-new-rule-result").html(result).fadeIn(1000); + showAlert('danger', 'vul type error.', '#add-new-rule-result'); return false; } if (!lang || lang == "") { - var result = ''; - $("#add-new-rule-result").html(result).fadeIn(1000); + showAlert('danger', 'language error.', '#add-new-rule-result'); return false; } if (!description || description == "") { - var result = ''; - $("#add-new-rule-result").html(result).fadeIn(1000); + showAlert('danger', 'description can not be blank.', '#add-new-rule-result'); return false; } if (!regex || regex == "") { - var result = ''; - $("#add-new-rule-result").html(result).fadeIn(1000); + showAlert('danger', 'regex can not be blank.', '#add-new-rule-result'); + return false; + } + if (!regex_confirm || regex_confirm == "") { + showAlert('danger', 'regex confirm can not be blank.', '#add-new-rule-result'); + return false; + } + if (!repair || repair == "") { + showAlert('danger', 'repair can not be blank.', '#add-new-rule-result'); return false; } @@ -157,14 +154,12 @@ $("#add_new_rules").click(function () { 'vul_type': vul_type, 'language': lang, 'regex': regex, - 'description': description + 'regex_confirm': regex_confirm, + 'description': description, + 'repair': repair }; $.post('add_new_rule', data, function (res) { - var tres = ''; - $("#add-new-rule-result").html(tres).fadeIn(1000); + showAlert(res.tag, res.msg, '#add-new-rule-result'); }); }); }); @@ -201,29 +196,42 @@ $("#show_all_vuls").click(function () { $("#edit-vul-button").click(function () { var name = $("#name").val(); var description = $("#description").val(); - if (!name || !description || name == "" || description == "") { - var result = ''; - $("#edit-vul-result").html(result).fadeIn(1000); + var repair = $("#repair").val(); + + if (!name || name == "") { + showAlert('danger', 'name can not be blank.', '#edit-vul-result'); return false; } + if (!description || description == "") { + showAlert('danger', 'description can not be blank.', '#edit-vul-result'); + return false; + } + if (!repair || repair == "") { + showAlert('danger', 'repair can not be blank.', '#edit-vul-result'); + return false; + } + data = { 'vul_id': vul_id, 'name': name, - 'description': description + 'description': description, + 'repair': repair }; $.post('edit_vul/' + vul_id, data, function (res) { - var tres = ''; - $("#edit-vul-result").html(tres).fadeIn(1000); + showAlert(res.tag, res.msg, '#edit-vul-result'); }); }); }); }); + + // view the special vul + $("[id^=view-vul]").click(function () { + var cur_id = $(this).attr('id').split('-')[2]; + var repair = $("
").text($("#vul-repair-" + cur_id).text()).html(); + $("#view-title").html("Vul Details."); + var content = "Repair: " + repair + "
"; + $("#view-body").html(content); + }); }); }); @@ -242,33 +250,27 @@ $("#add_new_vuls").click(function () { $("#add-new-vul-button").click(function () { var name = $("#name").val(); var description = $("#description").val(); - var result = ''; + var repair = $("#repair").val(); + if (name == "" || !name) { - result += ''; - $("#add-new-vul-result").html(result).fadeIn(1000); + showAlert('danger', 'name can not be blank.', '#add-new-vul-result'); return false; } if (description == "" || !description) { - result += ''; - $("#add-new-vul-result").html(result).fadeIn(1000); + showAlert('danger', 'description can not be blank.', '#add-new-vul-result'); + return false; + } + if (repair == "" || !description) { + showAlert('danger', 'description can not be blank.', '#add-new-vul-result'); return false; } var data = { 'name': name, - 'description': description + 'description': description, + 'repair': repair }; $.post('add_new_vul', data, function (res) { - var tres = ''; - $("#add-new-vul-result").html(tres).fadeIn(1000); + showAlert(res.tag, res.msg, "#add-new-vul-result"); }); }); }); diff --git a/app/templates/rulesadmin/add_new_rule.html b/app/templates/rulesadmin/add_new_rule.html index b3bbfd4c..ced64581 100644 --- a/app/templates/rulesadmin/add_new_rule.html +++ b/app/templates/rulesadmin/add_new_rule.html @@ -20,13 +20,21 @@
- +
+
+ + +
+
+ + +
diff --git a/app/templates/rulesadmin/add_new_vul.html b/app/templates/rulesadmin/add_new_vul.html index 3654d8cf..e6c2e91c 100644 --- a/app/templates/rulesadmin/add_new_vul.html +++ b/app/templates/rulesadmin/add_new_vul.html @@ -17,6 +17,10 @@

+
+ + +
diff --git a/app/templates/rulesadmin/edit_rule.html b/app/templates/rulesadmin/edit_rule.html index bf4e3576..f7c9d183 100644 --- a/app/templates/rulesadmin/edit_rule.html +++ b/app/templates/rulesadmin/edit_rule.html @@ -14,18 +14,37 @@
- - + + +
+
+ +
- + +
+
+ + +
+
+      + +
diff --git a/app/templates/rulesadmin/edit_vul.html b/app/templates/rulesadmin/edit_vul.html index a99cd176..8f98bc95 100644 --- a/app/templates/rulesadmin/edit_vul.html +++ b/app/templates/rulesadmin/edit_vul.html @@ -11,11 +11,15 @@

- +
- + +
+
+ +
diff --git a/app/templates/rulesadmin/rules.html b/app/templates/rulesadmin/rules.html index 5012cc1a..f8baad05 100644 --- a/app/templates/rulesadmin/rules.html +++ b/app/templates/rulesadmin/rules.html @@ -18,6 +18,8 @@ {{ rule.description }} {{ rule.updated_at }} {{ rule.regex }} + {{ rule.regex_confirm }} + {{ rule.repair }}