diff --git a/README.md b/README.md index ad3335b..8222483 100644 --- a/README.md +++ b/README.md @@ -11,6 +11,7 @@ Check the HTTP API section below for specific endpoints that can be queried via ## Supported data models: - `Cve` data from [cve_list](https://github.com/CVEProject/cvelist) github repo. - `Cpe` data from [nvd](https://nvd.nist.gov/products/cpe) 2.2 format. +- `Cna` data from [mitre](https://raw.githubusercontent.com/CVEProject/cve-website/dev/src/assets/data/CNAsList.json). - `GithubPoc` data from [nomi-sec](https://github.com/nomi-sec/PoC-in-GitHub) github repo. - `InthewildCveExploit` data from [inthewild.io](https://inthewild.io/api/exploited) exploited feed. - `TrickestPocCve` data from [trickest](https://github.com/trickest/cve) github repo. @@ -46,6 +47,13 @@ For now unauthenticated api over localhost:3000 until I put in some basic token get "/cpes/:id", to: "cpes#show" ``` +#### Cnas +``` + get "/cnas", to: "cnas#index" + get "/cnas/:id", to: "cnas#show" + get "/cnas/cna/:cna_id", to: "cnas#show_for_cna" +``` + #### GithubPocs ``` get "/github_pocs", to: "github_pocs#index" diff --git a/app/controllers/cnas_controller.rb b/app/controllers/cnas_controller.rb new file mode 100644 index 0000000..3b9b3e5 --- /dev/null +++ b/app/controllers/cnas_controller.rb @@ -0,0 +1,15 @@ +class CnasController < ApplicationController + def index + @cnas = Cna.all + end + + def show + @cna = Cna.find(params[:id]) + render json: @cna.to_json + end + + def show_for_cna + @cna = Cna.find_by_cna_id(params[:cna_id]) + render json: @cna.to_json + end +end diff --git a/app/models/cna.rb b/app/models/cna.rb new file mode 100644 index 0000000..1836e61 --- /dev/null +++ b/app/models/cna.rb @@ -0,0 +1,5 @@ +class Cna < ActiveRecord::Base + def self.find_by_cna_id(cna_id) + find_by(:cna_id => cna_id) + end +end diff --git a/app/views/cnas/index.html.erb b/app/views/cnas/index.html.erb new file mode 100644 index 0000000..76a8dd5 --- /dev/null +++ b/app/views/cnas/index.html.erb @@ -0,0 +1 @@ +

Cnas#index

diff --git a/app/views/cnas/show.html.erb b/app/views/cnas/show.html.erb new file mode 100644 index 0000000..e69de29 diff --git a/config/routes.rb b/config/routes.rb index e4e3e49..3b73f51 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -25,4 +25,8 @@ Rails.application.routes.draw do get "/cvemon_cves/cve/:cve_id", to: "cvemon_cves#show_for_cve" get "/cvemon_cves/years/:year", to: "cvemon_cves#show_year" + get "/cnas", to: "cnas#index" + get "/cnas/:id", to: "cnas#show" + get "/cnas/cna/:cna_id", to: "cnas#show_for_cna" + end diff --git a/db/migrate/20220407223152_create_cnas.rb b/db/migrate/20220407223152_create_cnas.rb new file mode 100644 index 0000000..4cf6a5a --- /dev/null +++ b/db/migrate/20220407223152_create_cnas.rb @@ -0,0 +1,17 @@ +class CreateCnas < ActiveRecord::Migration[7.0] + def change + create_table :cnas do |t| + t.string :short_name + t.string :cna_id + t.index :cna_id, unique: true + t.string :organization_name + t.string :scope + t.jsonb :contact + t.jsonb :disclosure_policy + t.jsonb :security_advisories + t.string :resources, array: true + t.jsonb :cna + t.string :country + end + end +end diff --git a/db/schema.rb b/db/schema.rb index 84da295..90439dd 100644 --- a/db/schema.rb +++ b/db/schema.rb @@ -10,10 +10,24 @@ # # It's strongly recommended that you check this file into your version control system. -ActiveRecord::Schema[7.0].define(version: 2022_04_07_083218) do +ActiveRecord::Schema[7.0].define(version: 2022_04_07_223152) do # These are extensions that must be enabled in order to support this database enable_extension "plpgsql" + create_table "cnas", force: :cascade do |t| + t.string "short_name" + t.string "cna_id" + t.string "organization_name" + t.string "scope" + t.jsonb "contact" + t.jsonb "disclosure_policy" + t.jsonb "security_advisories" + t.string "resources", array: true + t.jsonb "cna" + t.string "country" + t.index ["cna_id"], name: "index_cnas_on_cna_id", unique: true + end + create_table "cpes", force: :cascade do |t| t.string "status" t.date "modification_date" diff --git a/db/seeds.rb b/db/seeds.rb index 8f0ab18..1da28d0 100644 --- a/db/seeds.rb +++ b/db/seeds.rb @@ -12,6 +12,7 @@ require '/data_importer/lib/poc_in_github_importer.rb' require '/data_importer/lib/inthewild_cve_exploit_importer.rb' require '/data_importer/lib/trickest_poc_cve_importer.rb' require '/data_importer/lib/cvemon_cve_importer.rb' +require '/data_importer/lib/cna_importer.rb' def line_sep puts '----------' * 12 @@ -24,6 +25,7 @@ def perform import_inthewild_cve_exploits import_cvemon_cves import_cpes + import_cnas end def import_cves @@ -56,4 +58,9 @@ def import_cvemon_cves CvemonCveImporter.new.import end +def import_cnas + line_sep + CnaImporter.new.import +end + perform \ No newline at end of file diff --git a/lib/cna_importer.rb b/lib/cna_importer.rb new file mode 100644 index 0000000..3c63584 --- /dev/null +++ b/lib/cna_importer.rb @@ -0,0 +1,61 @@ +require 'json' +require 'rest-client' +require 'bulk_insert' + +class CnaImporter + attr_accessor :url + def initialize + @url = 'https://raw.githubusercontent.com/CVEProject/cve-website/dev/src/assets/data/CNAsList.json' + end + + def send_request_rest + RestClient::Request.execute( + method: :get, + url: url + ) + end + + def parse_res(response) + JSON.parse(response.body) + end + + def get_json + res = send_request_rest + if res.code == 200 + parse_res(res) + else + "HTTP Status: #{res.code}" + end + end + + def json_to_hash(json) + data_hash = {} + data_hash[:short_name] = json['shortName'] + data_hash[:cna_id] = json['cnaID'] + data_hash[:organization_name] = json['organizationName'] + data_hash[:scope] = json['scope'] + data_hash[:contact] = json['contact'] + data_hash[:disclosure_policy] = json['disclosurePolicy'] + data_hash[:security_advisories] = json['securityAdvisories'] + data_hash[:resources] = json['resources'] + data_hash[:cna] = json['CNA'] + data_hash[:country] = json['country'] + data_hash + end + + def bulk_insert(cves) + Cna.bulk_insert do |worker| + cves.each do |attrs| + worker.add(attrs) + end + end + end + + def import + json = get_json + attrs = json.map {|j| json_to_hash(j) } + puts "Now importing CNAs." + bulk_insert(attrs) + end + +end diff --git a/lib/cna_security_advisories.rb b/lib/cna_security_advisories.rb deleted file mode 100644 index 38300e8..0000000 --- a/lib/cna_security_advisories.rb +++ /dev/null @@ -1,42 +0,0 @@ -# outputs the list of CNA organizationNames and the securityAdvisory urls from the json file here: -# https://raw.githubusercontent.com/CVEProject/cve-website/dev/src/assets/data/CNAsList.json - -require 'json' -require 'rest-client' - -class CnaSecurityAdvisories - attr_accessor :url - def initialize - @url = 'https://raw.githubusercontent.com/CVEProject/cve-website/dev/src/assets/data/CNAsList.json' - end - - def send_request_rest - RestClient::Request.execute( - method: :get, - url: url - ) - end - - def parse_res(response) - JSON.parse(response.body) - end - - def get_json - res = send_request_rest - if res.code == 200 - parse_res(res) - else - "HTTP Status: #{res.code}" - end - end - - def perform - json = get_json - json.map do |d| - org_name = d.dig('organizationName') - security_advisories = d.dig('securityAdvisories') - security_advisory_urls = security_advisories.dig('advisories').map { |adv| adv.dig('url') } - { orgName: org_name, security_advisories_urls: security_advisory_urls } - end - end -end