github.com/CycloneDX/sbom-utility@v0.16.0/cmd/vulnerability.go

// SPDX-License-Identifier: Apache-2.0
/*
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package cmd

import (
	"encoding/csv"
	"fmt"
	"io"
	"sort"
	"strings"
	"text/tabwriter"

	"github.com/CycloneDX/sbom-utility/common"
	"github.com/CycloneDX/sbom-utility/schema"
	"github.com/CycloneDX/sbom-utility/utils"
	"github.com/jwangsadinata/go-multimap"
	"github.com/spf13/cobra"
)

const (
	SUBCOMMAND_VULNERABILITY_LIST = "list"
)

const (
	FLAG_VULN_SUMMARY = "summary"
)

var VALID_SUBCOMMANDS_VULNERABILITY = []string{SUBCOMMAND_VULNERABILITY_LIST}

// data (filter) keys
const (
	VULN_DATA_KEY_ID                     = "id"                     // summary
	VULN_DATA_KEY_BOM_REF                = "bom-ref"                // full (optional, internal reference)
	VULN_DATA_KEY_CWES                   = "cwe-ids"                // full (Common Weakness Enumeration (CWE))
	VULN_DATA_KEY_CVSS_SEVERITY          = "cvss-severity"          // summary (CVSS Severity, V3.1 ot v2.0)
	VULN_DATA_KEY_SOURCE_NAME            = "source-name"            // summary
	VULN_DATA_KEY_SOURCE_URL             = "source-url"             // full
	VULN_DATA_KEY_PUBLISHED              = "published"              // summary
	VULN_DATA_KEY_UPDATED                = "updated"                // full
	VULN_DATA_KEY_CREATED                = "created"                // full
	VULN_DATA_KEY_REJECTED               = "rejected"               // full
	VULN_DATA_KEY_ANALYSIS_STATE         = "analysis-state"         // full
	VULN_DATA_KEY_ANALYSIS_JUSTIFICATION = "analysis-justification" // full
	VULN_DATA_KEY_DESC                   = "description"            // summary
)

// NOTE: columns will be output in order they are listed here:
// NOTE: data marked as "summary" data is informed by the output from the NVD database service itself
// this includes fields that have ISO 8601 date-time fields are truncated to show date only
var VULNERABILITY_LIST_ROW_DATA = []ColumnFormatData{
	*NewColumnFormatData(VULN_DATA_KEY_ID, REPORT_DO_NOT_TRUNCATE, REPORT_SUMMARY_DATA, false),
	*NewColumnFormatData(VULN_DATA_KEY_BOM_REF, REPORT_DO_NOT_TRUNCATE, false, false),
	*NewColumnFormatData(VULN_DATA_KEY_CWES, REPORT_DO_NOT_TRUNCATE, false, false),
	*NewColumnFormatData(VULN_DATA_KEY_CVSS_SEVERITY, REPORT_DO_NOT_TRUNCATE, REPORT_SUMMARY_DATA, false),
	*NewColumnFormatData(VULN_DATA_KEY_SOURCE_NAME, REPORT_DO_NOT_TRUNCATE, REPORT_SUMMARY_DATA, false),
	*NewColumnFormatData(VULN_DATA_KEY_SOURCE_URL, REPORT_DO_NOT_TRUNCATE, false, false),
	*NewColumnFormatData(VULN_DATA_KEY_PUBLISHED, REPORT_DO_NOT_TRUNCATE, REPORT_SUMMARY_DATA, false),
	*NewColumnFormatData(VULN_DATA_KEY_UPDATED, REPORT_DO_NOT_TRUNCATE, false, false),
	*NewColumnFormatData(VULN_DATA_KEY_CREATED, REPORT_DO_NOT_TRUNCATE, false, false),
	*NewColumnFormatData(VULN_DATA_KEY_REJECTED, REPORT_DO_NOT_TRUNCATE, false, false),
	*NewColumnFormatData(VULN_DATA_KEY_ANALYSIS_STATE, REPORT_DO_NOT_TRUNCATE, false, false),
	*NewColumnFormatData(VULN_DATA_KEY_ANALYSIS_JUSTIFICATION, REPORT_DO_NOT_TRUNCATE, false, false),
	*NewColumnFormatData(VULN_DATA_KEY_DESC, VULN_TRUNCATE_DESC_LEN, REPORT_SUMMARY_DATA, REPORT_REPLACE_LINE_FEEDS_TRUE),
}

// TODO make configurable via flag
const VULN_TRUNCATE_DESC_LEN = 32

// Command help formatting
const (
	FLAG_VULNERABILITY_OUTPUT_FORMAT_HELP = "format vulnerability output"
	FLAG_VULN_SUMMARY_HELP                = "summarize vulnerability information when listing in supported formats"
)

var VULNERABILITY_LIST_SUPPORTED_FORMATS = MSG_SUPPORTED_OUTPUT_FORMATS_HELP +
	strings.Join([]string{FORMAT_TEXT, FORMAT_CSV, FORMAT_MARKDOWN, FORMAT_JSON}, ", ")

// Vuln. command informational messages
const (
	MSG_OUTPUT_NO_VULNERABILITIES_FOUND = "[WARN] no matching vulnerabilities found for query"
)

func NewCommandVulnerability() *cobra.Command {
	var command = new(cobra.Command)
	command.Use = CMD_USAGE_VULNERABILITY_LIST
	command.Short = "Report on vulnerabilities found in the BOM input file"
	command.Long = "Report on vulnerabilities found in the BOM input file"
	command.Flags().StringVarP(&utils.GlobalFlags.PersistentFlags.OutputFormat, FLAG_FILE_OUTPUT_FORMAT, "", FORMAT_TEXT,
		FLAG_VULNERABILITY_OUTPUT_FORMAT_HELP+VULNERABILITY_LIST_SUPPORTED_FORMATS)
	command.Flags().StringP(FLAG_REPORT_WHERE, "", "", FLAG_REPORT_WHERE_HELP)
	command.Flags().BoolVarP(
		&utils.GlobalFlags.VulnerabilityFlags.Summary,
		FLAG_VULN_SUMMARY, "", false,
		FLAG_VULN_SUMMARY_HELP)
	command.RunE = vulnerabilityCmdImpl
	command.ValidArgs = VALID_SUBCOMMANDS_VULNERABILITY
	command.PreRunE = func(cmd *cobra.Command, args []string) (err error) {

		// TODO: pre-validate if --where keys are valid for this command

		// the vuln. command requires at least 1 valid subcommand (argument)
		getLogger().Tracef("args: %v\n", args)
		if len(args) == 0 {
			return getLogger().Errorf("Missing required argument(s).")
		} else if len(args) > 1 {
			return getLogger().Errorf("Too many arguments provided: %v", args)
		}

		// Make sure subcommand is known
		if !preRunTestForSubcommand(VALID_SUBCOMMANDS_VULNERABILITY, args[0]) {
			return getLogger().Errorf("Subcommand provided is not valid: `%v`", args[0])
		}

		// Test for required flags (parameters)
		err = preRunTestForInputFile(args)

		return
	}
	return command
}

// Cobra command callback
func vulnerabilityCmdImpl(cmd *cobra.Command, args []string) (err error) {
	getLogger().Enter(args)
	defer getLogger().Exit()

	// Create output writer
	outputFilename := utils.GlobalFlags.PersistentFlags.OutputFile
	outputFile, writer, err := createOutputFile(outputFilename)
	getLogger().Tracef("outputFile: `%v`; writer: `%v`", outputFile, writer)

	// use function closure to assure consistent error output based upon error type
	defer func() {
		// always close the output file
		if outputFile != nil {
			err = outputFile.Close()
			getLogger().Infof("Closed output file: `%s`", outputFilename)
		}
	}()

	// process filters supplied on the --where command flag
	whereFilters, err := processWhereFlag(cmd)

	if err != nil {
		return
	}

	err = ListVulnerabilities(writer, utils.GlobalFlags.PersistentFlags, utils.GlobalFlags.VulnerabilityFlags, whereFilters)
	return
}

// Assure all errors are logged
func processVulnerabilityListResults(err error) {
	if err != nil {
		// No special processing at this time
		getLogger().Error(err)
	}
}

func sortVulnerabilities(entries []multimap.Entry) {
	// Sort by Id, Created date (descending)
	sort.Slice(entries, func(i, j int) bool {
		vuln1 := (entries[i].Value).(schema.VulnerabilityInfo)
		vuln2 := (entries[j].Value).(schema.VulnerabilityInfo)
		if vuln1.Id != vuln2.Id {
			return vuln1.Id > vuln2.Id
		}
		return vuln1.Created > vuln2.Created
	})
}

// NOTE: vulnerability type data has already been validated
func ListVulnerabilities(writer io.Writer, persistentFlags utils.PersistentCommandFlags, flags utils.VulnerabilityCommandFlags, whereFilters []common.WhereFilter) (err error) {
	getLogger().Enter()
	defer getLogger().Exit()

	// use function closure to assure consistent error output based upon error type
	defer func() {
		if err != nil {
			processVulnerabilityListResults(err)
		}
	}()

	// Note: returns error if either file load or unmarshal to JSON map fails
	var document *schema.BOM
	document, err = LoadInputBOMFileAndDetectSchema()

	if err != nil {
		return
	}

	// Hash all vulnerabilities within input file
	getLogger().Infof("Scanning document for vulnerabilities...")
	err = loadDocumentVulnerabilities(document, whereFilters)

	if err != nil {
		return
	}

	format := persistentFlags.OutputFormat
	getLogger().Infof("Outputting listing (`%s` format)...", format)
	switch format {
	case FORMAT_TEXT:
		err = DisplayVulnListText(document, writer, flags)
	case FORMAT_CSV:
		err = DisplayVulnListCSV(document, writer, flags)
	case FORMAT_MARKDOWN:
		err = DisplayVulnListMarkdown(document, writer, flags)
	case FORMAT_JSON:
		err = DisplayVulnListJson(document, writer, flags)
	default:
		// Default to Text output for anything else (set as flag default)
		getLogger().Warningf("Listing not supported for `%s` format; defaulting to `%s` format...",
			format, FORMAT_JSON)
		err = DisplayVulnListText(document, writer, flags)
	}
	return
}

func loadDocumentVulnerabilities(document *schema.BOM, whereFilters []common.WhereFilter) (err error) {
	getLogger().Enter()
	defer getLogger().Exit(err)

	// At this time, fail SPDX format SBOMs as "unsupported" (for "any" format)
	if !document.FormatInfo.IsCycloneDx() {
		err = schema.NewUnsupportedFormatForCommandError(
			document.FormatInfo.CanonicalName,
			document.GetFilename(),
			CMD_LICENSE, FORMAT_ANY)
		return
	}

	// Before looking for license data, fully unmarshal the SBOM
	// into named structures
	if err = document.UnmarshalCycloneDXBOM(); err != nil {
		return
	}

	// Hash all components found in the (root).components[] (+ "nested" components)
	pVulnerabilities := document.GetCdxVulnerabilities()
	if pVulnerabilities != nil && len(*pVulnerabilities) > 0 {
		if err = document.HashmapVulnerabilities(*pVulnerabilities, whereFilters); err != nil {
			return
		}
	}

	return
}

// NOTE: This list is NOT de-duplicated
// TODO: Add a --no-title flag to skip title output
func DisplayVulnListText(bom *schema.BOM, writer io.Writer, flags utils.VulnerabilityCommandFlags) (err error) {
	getLogger().Enter()
	defer getLogger().Exit()

	// initialize tabwriter
	w := new(tabwriter.Writer)
	defer w.Flush()

	// min-width, tab-width, padding, pad-char, flags
	w.Init(writer, 8, 2, 2, ' ', 0)

	// create title row and underline row from slices of optional and compulsory titles
	titles, underlines := prepareReportTitleData(VULNERABILITY_LIST_ROW_DATA, flags.Summary)

	// Add tabs between column titles for the tabWRiter
	fmt.Fprintf(w, "%s\n", strings.Join(titles, "\t"))
	fmt.Fprintf(w, "%s\n", strings.Join(underlines, "\t"))

	// Display a warning "missing" in the actual output and return (short-circuit)
	entries := bom.VulnerabilityMap.Entries()

	// Emit no license warning into output
	if len(entries) == 0 {
		fmt.Fprintf(w, "%s\n", MSG_OUTPUT_NO_VULNERABILITIES_FOUND)
		return
	}

	// Sort vulnerabilities prior to outputting
	sortVulnerabilities(entries)

	// Emit row data
	var line []string
	for _, entry := range entries {
		// TODO surface error data to top-level command
		line, err = prepareReportLineData(
			entry.Value.(schema.VulnerabilityInfo),
			VULNERABILITY_LIST_ROW_DATA,
			flags.Summary,
		)
		// Only emit line if no error
		if err != nil {
			return
		}
		fmt.Fprintf(w, "%s\n", strings.Join(line, "\t"))
	}
	return
}

// TODO: Add a --no-title flag to skip title output
func DisplayVulnListCSV(bom *schema.BOM, writer io.Writer, flags utils.VulnerabilityCommandFlags) (err error) {
	getLogger().Enter()
	defer getLogger().Exit()

	// initialize writer and prepare the list of entries (i.e., the "rows")
	w := csv.NewWriter(writer)
	defer w.Flush()

	// Create title row data as []string
	titles, _ := prepareReportTitleData(VULNERABILITY_LIST_ROW_DATA, flags.Summary)

	if err = w.Write(titles); err != nil {
		return getLogger().Errorf("error writing to output (%v): %s", titles, err)
	}

	// Display a warning "missing" in the actual output and return (short-circuit)
	entries := bom.VulnerabilityMap.Entries()

	// Emit no vuln. found warning into output
	if len(entries) == 0 {
		currentRow := []string{MSG_OUTPUT_NO_VULNERABILITIES_FOUND}
		if err = w.Write(currentRow); err != nil {
			// unable to emit an error message into output stream
			return getLogger().Errorf("error writing to output (%v): %s", currentRow, err)
		}
		return fmt.Errorf(currentRow[0])
	}

	// Sort vulnerabilities prior to outputting
	sortVulnerabilities(entries)

	// Emit row data
	var line []string
	for _, entry := range entries {
		line, err = prepareReportLineData(
			entry.Value.(schema.VulnerabilityInfo),
			VULNERABILITY_LIST_ROW_DATA,
			flags.Summary,
		)
		// Only emit line if no error
		if err != nil {
			return
		}
		if err = w.Write(line); err != nil {
			err = getLogger().Errorf("csv.Write: %w", err)
		}
	}
	return
}

// TODO: Add a --no-title flag to skip title output
func DisplayVulnListMarkdown(bom *schema.BOM, writer io.Writer, flags utils.VulnerabilityCommandFlags) (err error) {
	getLogger().Enter()
	defer getLogger().Exit()

	// Create title row data as []string, include columns depending on value of Summary flag.
	titles, _ := prepareReportTitleData(VULNERABILITY_LIST_ROW_DATA, flags.Summary)
	titleRow := createMarkdownRow(titles)
	fmt.Fprintf(writer, "%s\n", titleRow)

	// create alignment row, include columns depending on value of Summary flag.
	alignments := createMarkdownColumnAlignmentRow(VULNERABILITY_LIST_ROW_DATA, flags.Summary)
	alignmentRow := createMarkdownRow(alignments)
	fmt.Fprintf(writer, "%s\n", alignmentRow)

	// Display a warning "missing" in the actual output and return (short-circuit)
	entries := bom.VulnerabilityMap.Entries()

	// Emit no vuln. found warning into output
	if len(entries) == 0 {
		fmt.Fprintf(writer, "%s\n", MSG_OUTPUT_NO_VULNERABILITIES_FOUND)
		return fmt.Errorf(MSG_OUTPUT_NO_VULNERABILITIES_FOUND)
	}

	// Sort vulnerabilities prior to outputting
	sortVulnerabilities(entries)

	// Emit row data
	var line []string
	var lineRow string
	for _, entry := range entries {
		line, err = prepareReportLineData(
			entry.Value.(schema.VulnerabilityInfo),
			VULNERABILITY_LIST_ROW_DATA,
			flags.Summary,
		)
		// Only emit line if no error
		if err != nil {
			return
		}
		lineRow = createMarkdownRow(line)
		fmt.Fprintf(writer, "%s\n", lineRow)
	}
	return
}

// Output filtered list of vulnerabilities as JSON
func DisplayVulnListJson(bom *schema.BOM, writer io.Writer, flags utils.VulnerabilityCommandFlags) (err error) {
	getLogger().Enter()
	defer getLogger().Exit()

	var vulnInfo schema.VulnerabilityInfo
	var vulnList []schema.CDXVulnerability

	for _, key := range bom.VulnerabilityMap.KeySet() {
		arrVulnInfo, _ := bom.VulnerabilityMap.Get(key)

		for _, iInfo := range arrVulnInfo {
			vulnInfo = iInfo.(schema.VulnerabilityInfo)
			vulnList = append(vulnList, vulnInfo.Vulnerability)
		}
	}

	// Note: JSON data files MUST ends in a newline as this is a POSIX standard
	// which is already accounted for by the JSON encoder.
	_, err = utils.WriteAnyAsEncodedJSONInt(writer, vulnList, utils.GlobalFlags.PersistentFlags.GetOutputIndentInt())
	return
}