Safe Haskell	None
Language	GHC2021

Ecluse.Core.Osv.Advisory

Description

Decode advisory evidence for the compiled artifact. Package keys use the same ecosystem identity as policy queries.

Synopsis

data OsvAdvisory = OsvAdvisory {
- osvId :: Text
- osvAliases :: Maybe [Text]
- osvAffected :: Maybe [OsvAffected]
- osvSeverity :: Maybe [OsvSeverityEntry]
- osvDatabaseSpecific :: Maybe OsvDatabaseSpecific
- osvWithdrawn :: Maybe UTCTime
- osvModified :: Maybe Text
}
data OsvAffected = OsvAffected {
- affectedPackage :: OsvPackage
- affectedRanges :: Maybe [OsvRange]
- affectedVersions :: Maybe [Text]
}
data OsvPackage = OsvPackage {
- packageName :: Text
- packageEcosystem :: Text
}
data OsvRange = OsvRange {
- rangeType :: Text
- rangeEvents :: [OsvEvent]
}
data OsvEvent = OsvEvent {
- eventIntroduced :: Maybe Text
- eventFixed :: Maybe Text
- eventLastAffected :: Maybe Text
}
newtype OsvDatabaseSpecific = OsvDatabaseSpecific {
- dbsSeverity :: Maybe Text
}
data OsvSeverityEntry = OsvSeverityEntry {
- sevType :: Text
- sevScore :: Text
}
data ExtractedOsv = ExtractedOsv {
- extPackage :: Text
- extEcosystem :: Text
- extCveId :: Text
- extIntroduced :: Maybe Text
- extUpperBound :: UpperBound
- extSeverity :: Maybe Double
- extEpss :: Maybe Double
}
advisorySeverity :: OsvAdvisory -> Maybe Double
extractFromAdvisory :: EpssScores -> OsvAdvisory -> [ExtractedOsv]
orderableBounds :: Ecosystem -> ExtractedOsv -> Bool
unorderableBounds :: Ecosystem -> ExtractedOsv -> [Text]
osvExportUrl :: Text -> Text -> String

Documentation

data OsvAdvisory Source #

The OSV fields used to select and score active advisory evidence.

Constructors

OsvAdvisory

Fields

osvId :: Text
osvAliases :: Maybe [Text]
The same vulnerability's identifiers in other databases. An npm advisory is GHSA-keyed, so its CVE ids live here, and they are what the EPSS feed keys on.
osvAffected :: Maybe [OsvAffected]
osvSeverity :: Maybe [OsvSeverityEntry]
osvDatabaseSpecific :: Maybe OsvDatabaseSpecific
osvWithdrawn :: Maybe UTCTime
A withdrawn record supplies no active evidence, even when it retains affected ranges.
osvModified :: Maybe Text
When the source database last changed this record, as written. It is read where the pass judges it, so a value no grammar accepts costs the date and not the record.

Instances

Instances details

FromJSON OsvAdvisory Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods parseJSON :: Value -> Parser OsvAdvisory # parseJSONList :: Value -> Parser [OsvAdvisory] # omittedField :: Maybe OsvAdvisory #
Show OsvAdvisory Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods showsPrec :: Int -> OsvAdvisory -> ShowS # show :: OsvAdvisory -> String # showList :: [OsvAdvisory] -> ShowS #
Eq OsvAdvisory Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods (==) :: OsvAdvisory -> OsvAdvisory -> Bool # (/=) :: OsvAdvisory -> OsvAdvisory -> Bool #

data OsvAffected Source #

Constructors

OsvAffected
Fields affectedPackage :: OsvPackage affectedRanges :: Maybe [OsvRange] affectedVersions :: Maybe [Text] Exact affected versions enumerated outside any range, each an affected point. Much of the npm malware feed names the single bad version here with no `ranges`.

Instances

Instances details

FromJSON OsvAffected Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods parseJSON :: Value -> Parser OsvAffected # parseJSONList :: Value -> Parser [OsvAffected] # omittedField :: Maybe OsvAffected #
Show OsvAffected Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods showsPrec :: Int -> OsvAffected -> ShowS # show :: OsvAffected -> String # showList :: [OsvAffected] -> ShowS #
Eq OsvAffected Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods (==) :: OsvAffected -> OsvAffected -> Bool # (/=) :: OsvAffected -> OsvAffected -> Bool #

data OsvPackage Source #

Constructors

OsvPackage
Fields packageName :: Text packageEcosystem :: Text

Instances

Instances details

FromJSON OsvPackage Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods parseJSON :: Value -> Parser OsvPackage # parseJSONList :: Value -> Parser [OsvPackage] # omittedField :: Maybe OsvPackage #
Show OsvPackage Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods showsPrec :: Int -> OsvPackage -> ShowS # show :: OsvPackage -> String # showList :: [OsvPackage] -> ShowS #
Eq OsvPackage Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods (==) :: OsvPackage -> OsvPackage -> Bool # (/=) :: OsvPackage -> OsvPackage -> Bool #

data OsvRange Source #

Constructors

OsvRange
Fields rangeType :: Text rangeEvents :: [OsvEvent]

Instances

Instances details

FromJSON OsvRange Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods parseJSON :: Value -> Parser OsvRange # parseJSONList :: Value -> Parser [OsvRange] # omittedField :: Maybe OsvRange #
Show OsvRange Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods showsPrec :: Int -> OsvRange -> ShowS # show :: OsvRange -> String # showList :: [OsvRange] -> ShowS #
Eq OsvRange Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods (==) :: OsvRange -> OsvRange -> Bool # (/=) :: OsvRange -> OsvRange -> Bool #

data OsvEvent Source #

One event in a range's ordered event list, carrying exactly one bound. introduced opens the affected interval inclusively, fixed closes it exclusively, and last_affected inclusively.

Constructors

OsvEvent
Fields eventIntroduced :: Maybe Text eventFixed :: Maybe Text eventLastAffected :: Maybe Text

Instances

Instances details

FromJSON OsvEvent Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods parseJSON :: Value -> Parser OsvEvent # parseJSONList :: Value -> Parser [OsvEvent] # omittedField :: Maybe OsvEvent #
Show OsvEvent Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods showsPrec :: Int -> OsvEvent -> ShowS # show :: OsvEvent -> String # showList :: [OsvEvent] -> ShowS #
Eq OsvEvent Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods (==) :: OsvEvent -> OsvEvent -> Bool # (/=) :: OsvEvent -> OsvEvent -> Bool #

newtype OsvDatabaseSpecific Source #

The subset of an advisory's database_specific block the pipeline consumes.

Constructors

OsvDatabaseSpecific
Fields dbsSeverity :: Maybe Text The source database's qualitative severity label (for GHSA-sourced npm advisories: `LOW`, `MODERATE`, `HIGH`, or `CRITICAL`).

Instances

Instances details

FromJSON OsvDatabaseSpecific Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods parseJSON :: Value -> Parser OsvDatabaseSpecific # parseJSONList :: Value -> Parser [OsvDatabaseSpecific] # omittedField :: Maybe OsvDatabaseSpecific #
Show OsvDatabaseSpecific Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods showsPrec :: Int -> OsvDatabaseSpecific -> ShowS # show :: OsvDatabaseSpecific -> String # showList :: [OsvDatabaseSpecific] -> ShowS #
Eq OsvDatabaseSpecific Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods (==) :: OsvDatabaseSpecific -> OsvDatabaseSpecific -> Bool # (/=) :: OsvDatabaseSpecific -> OsvDatabaseSpecific -> Bool #

data OsvSeverityEntry Source #

One entry of an advisory's severity array: a scoring-system tag (CVSS_V3) and its value. For a CVSS system that value is the vector string, not a number.

Constructors

OsvSeverityEntry
Fields sevType :: Text sevScore :: Text

Instances

Instances details

FromJSON OsvSeverityEntry Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods parseJSON :: Value -> Parser OsvSeverityEntry # parseJSONList :: Value -> Parser [OsvSeverityEntry] # omittedField :: Maybe OsvSeverityEntry #
Show OsvSeverityEntry Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods showsPrec :: Int -> OsvSeverityEntry -> ShowS # show :: OsvSeverityEntry -> String # showList :: [OsvSeverityEntry] -> ShowS #
Eq OsvSeverityEntry Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods (==) :: OsvSeverityEntry -> OsvSeverityEntry -> Bool # (/=) :: OsvSeverityEntry -> OsvSeverityEntry -> Bool #

data ExtractedOsv Source #

An artifact segment keyed by the ecosystem's canonical package name. A missing introduced bound means affected from the beginning.

Constructors

ExtractedOsv

Fields

extPackage :: Text
extEcosystem :: Text
extCveId :: Text
extIntroduced :: Maybe Text
extUpperBound :: UpperBound
extSeverity :: Maybe Double
The advisory's CVSS base score (0 to 10), carried onto each of its segments. Nothing when the advisory is unscored, as much of the npm malware feed is.
extEpss :: Maybe Double
The advisory's EPSS probability (0 to 1), carried onto each of its segments. Nothing when the feed scores none of its identifiers.

Instances

Instances details

Show ExtractedOsv Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods showsPrec :: Int -> ExtractedOsv -> ShowS # show :: ExtractedOsv -> String # showList :: [ExtractedOsv] -> ShowS #
Eq ExtractedOsv Source #
Instance details Defined in Ecluse.Core.Osv.Advisory Methods (==) :: ExtractedOsv -> ExtractedOsv -> Bool # (/=) :: ExtractedOsv -> ExtractedOsv -> Bool #

advisorySeverity :: OsvAdvisory -> Maybe Double Source #

Prefer the highest parsing CVSS vector, then the qualitative label's ceiling, or no score.

extractFromAdvisory :: EpssScores -> OsvAdvisory -> [ExtractedOsv] Source #

Emit only active advisory segments, with canonical package keys and raw version bounds. Withdrawn records emit nothing. Unknown ecosystems keep their package spelling.

orderableBounds :: Ecosystem -> ExtractedOsv -> Bool Source #

Does every bound this segment carries parse under the ecosystem's version grammar? A bound that does not leaves affecting matching every version, fail-closed.

unorderableBounds :: Ecosystem -> ExtractedOsv -> [Text] Source #

The bounds this segment carries that the ecosystem's version grammar cannot parse.

osvExportUrl :: Text -> Text -> String Source #

Build the ecosystem archive URL under a configured OSV export base.