Add support for storing exploitability and weighted severity by ziadhany · Pull Request #1646 · aboutcode-org/vulnerablecode

ziadhany · 2024-11-09T00:33:59Z

http://127.0.0.1:8001/api/vulnerabilities :

http://127.0.0.1:8001/vulnerabilities/VCID-dzgg-pppr-zqew :

Vulnerability model. Create a pipeline for vulnerability risk assessment. Signed-off-by: ziad hany <ziadhany2016@gmail.com>

tdruez

See the various comments.
Also, do we have unit tests for all the new code?

vulnerabilities/migrations/0077_vulnerability_exploitability_and_more.py

vulnerabilities/models.py

vulnerabilities/risk.py

tdruez · 2024-11-11T11:52:34Z

vulnerabilities/templates/vulnerability_details.html

+                                    data-tooltip="Exploitability refers to the potential or probability of a software package vulnerability being 
+                                    exploited by malicious actors to compromise systems, applications, or networks. 
+                                    It is determined automatically by the discovery of exploits.">


This should be taken from the model help instead of duplicated.

Yeah, you are right, but I think we should handle this separately because we do this for a lot of fields. Based on my understanding, there is no direct way to display the help_text of the model without using a view, form, or a template tag.

vulnerabilities/templates/vulnerability_details.html

…_score function. Rename the help text for the model. Signed-off-by: ziad hany <ziadhany2016@gmail.com>

Signed-off-by: ziad hany <ziadhany2016@gmail.com>

TG1999 · 2024-11-13T14:39:51Z

@ziadhany please attach the issues that will be fixed by this PR. Additionally please do not merge this until these 2 #1649 #1636 are merged.

tdruez

Hi @ziadhany we are nearly there. See the few minor comments.

Also, could you provide some input on aboutcode-org/dejacode#194 (comment)

In the design documents, the decimal values are always presented with 1 decimal place: 9.0 - 10.0 but the implementation was made with 2 on the VCIO side. I don't know if that was decided on purpose, but I'm not sure that the second decimal place is adding any values. It makes the UI more dense and does not fit the filter choices. Let's clarify this.

What's your take on this? Was it a particular reason to go with 2 decimal places? I just want to make sure that we are consistent across the apps.

vulnerabilities/models.py

vulnerabilities/tests/test_risk.py

TG1999 · 2024-11-14T10:58:15Z

@ziadhany #1649 #1636 are merged now, please mention the issue in ticket description.

vulnerabilities/models.py

# Conflicts: # vulnerabilities/models.py # vulnerabilities/pipelines/compute_package_risk.py # vulnerabilities/risk.py

… api_v2 Signed-off-by: ziad hany <ziadhany2016@gmail.com>

vulnerabilities/models.py

Signed-off-by: ziad hany <ziadhany2016@gmail.com>

ziadhany

@tdruez I've updated the help text and resolved the merge conflict. Please let me know if I missed anything so I can address it as soon as possible.

vulnerabilities/risk.py

ziadhany · 2024-11-12T15:33:53Z

vulnerabilities/templates/vulnerability_details.html

+                                    data-tooltip="Exploitability refers to the potential or probability of a software package vulnerability being 
+                                    exploited by malicious actors to compromise systems, applications, or networks. 
+                                    It is determined automatically by the discovery of exploits.">


Yeah, you are right, but I think we should handle this separately because we do this for a lot of fields. Based on my understanding, there is no direct way to display the help_text of the model without using a view, form, or a template tag.

ziadhany · 2024-11-12T15:45:55Z

vulnerabilities/pipelines/compute_package_risk.py

+
+        for vulnerability in progress.iter(affected_vulnerabilities.paginated()):
+
+            vulnerability = compute_vulnerability_risk(vulnerability)


vulnerabilities/models.py

vulnerabilities/pipelines/compute_package_risk.py

TG1999

See my comment!

keshav-space

Thanks @ziadhany, see some suggestions to improve performance.

vulnerabilities/pipelines/compute_package_risk.py

vulnerabilities/risk.py

…or compute_and_store_package_risk_score Signed-off-by: ziad hany <ziadhany2016@gmail.com>

Update the tests for exploits and the simple_risk_pipeline. Signed-off-by: ziad hany <ziadhany2016@gmail.com>

ziadhany · 2024-11-18T17:12:35Z

@keshav-space Thank you for the review, Please let me know if I overlooked anything, and I hope we can move forward with the merge.

vulnerabilities/risk.py

Signed-off-by: ziad hany <ziadhany2016@gmail.com>

keshav-space

Thanks @ziadhany, Looking Good!

TG1999

LGTM!

Add exploitability and weighted_severity fields to the

530cb52

Vulnerability model. Create a pipeline for vulnerability risk assessment. Signed-off-by: ziad hany <ziadhany2016@gmail.com>

ziadhany requested review from keshav-space and tdruez November 9, 2024 00:34

tdruez requested changes Nov 11, 2024

View reviewed changes

tdruez mentioned this pull request Nov 12, 2024

Store and display new Package.risk_score field in the UI aboutcode-org/dejacode#194

Merged

ziadhany added 3 commits November 12, 2024 17:50

Optimize performance, refactor, and rename the add_vulnerability_risk…

86f6927

…_score function. Rename the help text for the model. Signed-off-by: ziad hany <ziadhany2016@gmail.com>

Merge remote-tracking branch 'origin/main' into save-risk

b97fdf4

Resolve migration conflict

405bf86

Signed-off-by: ziad hany <ziadhany2016@gmail.com>

TG1999 added the 2-next label Nov 13, 2024

tdruez requested changes Nov 14, 2024

View reviewed changes

vulnerabilities/models.py Outdated Show resolved Hide resolved

vulnerabilities/tests/test_risk.py Outdated Show resolved Hide resolved

tdruez reviewed Nov 14, 2024

View reviewed changes

vulnerabilities/models.py Outdated Show resolved Hide resolved

ziadhany added 2 commits November 15, 2024 23:47

Merge remote-tracking branch 'origin/main' into save-risk

fbc8fed

# Conflicts: # vulnerabilities/models.py # vulnerabilities/pipelines/compute_package_risk.py # vulnerabilities/risk.py

Resolve migration conflict & add weighted_severity, exploitability to…

ec5b972

… api_v2 Signed-off-by: ziad hany <ziadhany2016@gmail.com>

tdruez approved these changes Nov 17, 2024

View reviewed changes

vulnerabilities/models.py Outdated Show resolved Hide resolved

Correct help text and remove inconsistent typing.

893183f

Signed-off-by: ziad hany <ziadhany2016@gmail.com>

ziadhany commented Nov 17, 2024

View reviewed changes

TG1999 reviewed Nov 18, 2024

View reviewed changes

vulnerabilities/pipelines/compute_package_risk.py Show resolved Hide resolved

TG1999 requested changes Nov 18, 2024

View reviewed changes

keshav-space requested changes Nov 18, 2024

View reviewed changes

ziadhany added 2 commits November 18, 2024 16:21

Add severities in the prefetch and optimize the prefetching process f…

f29ef16

…or compute_and_store_package_risk_score Signed-off-by: ziad hany <ziadhany2016@gmail.com>

Refactor the risk score calculation for vulnerabilities and packages.

4920e1f

Update the tests for exploits and the simple_risk_pipeline. Signed-off-by: ziad hany <ziadhany2016@gmail.com>

keshav-space reviewed Nov 18, 2024

View reviewed changes

vulnerabilities/risk.py Outdated Show resolved Hide resolved

Rename vulnerability to relation for clarity in compute_package_risk

1a9df9b

Signed-off-by: ziad hany <ziadhany2016@gmail.com>

keshav-space approved these changes Nov 18, 2024

View reviewed changes

TG1999 approved these changes Nov 19, 2024

View reviewed changes

TG1999 merged commit 9c23eb8 into aboutcode-org:main Nov 19, 2024

pombredanne added this to the v35.0.0 - 2-next milestone Nov 26, 2024

pombredanne mentioned this pull request Dec 18, 2024

CRAVEX: Vulnerabilities policy aboutcode-org/dejacode#97

Closed

pombredanne added this to 00-AboutCodePlanner Jul 22, 2025

pombredanne moved this to Validated in 00-AboutCodePlanner Jul 22, 2025


		for vulnerability in progress.iter(affected_vulnerabilities.paginated()):

		vulnerability = compute_vulnerability_risk(vulnerability)

Uh oh!

Comments

Conversation

ziadhany commented Nov 9, 2024

Uh oh!

tdruez left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tdruez Nov 11, 2024

Choose a reason for hiding this comment

Uh oh!

ziadhany Nov 12, 2024

Choose a reason for hiding this comment

Uh oh!

Uh oh!

TG1999 commented Nov 13, 2024

Uh oh!

tdruez left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

TG1999 commented Nov 14, 2024

Uh oh!

Uh oh!

Uh oh!

ziadhany left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ziadhany Nov 12, 2024

Choose a reason for hiding this comment

Uh oh!

ziadhany Nov 12, 2024

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

TG1999 left a comment

Choose a reason for hiding this comment

Uh oh!

keshav-space left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ziadhany commented Nov 18, 2024

Uh oh!

Uh oh!

keshav-space left a comment

Choose a reason for hiding this comment

Uh oh!

TG1999 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants