Skip to content

Commit e92740c

Browse files
xavierdecosterxavierdecoster
authored
Autocomplete APIs for vulnerability information (#6887)
1 parent 13b3d34 commit e92740c

41 files changed

Lines changed: 1089 additions & 60 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎src/NuGet.Services.Entities/Cve.cs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@ namespace NuGet.Services.Entities
1414
public class Cve
1515
: IEntity
1616
{
17+
public const string IdPrefix = "CVE-";
18+
1719
public Cve()
1820
{
1921
PackageDeprecations = new HashSet<PackageDeprecation>();

‎src/NuGet.Services.Entities/Cwe.cs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ namespace NuGet.Services.Entities
1313
public class Cwe
1414
: IEntity
1515
{
16+
public const string IdPrefix = "CWE-";
17+
1618
public Cwe()
1719
{
1820
PackageDeprecations = new HashSet<PackageDeprecation>();

‎src/NuGetGallery/App_Start/DefaultDependenciesModule.cs‎

Lines changed: 21 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -680,28 +680,41 @@ private static void ConfigureAutocomplete(ContainerBuilder builder, IGalleryConf
680680
if (configuration.Current.ServiceDiscoveryUri != null &&
681681
!string.IsNullOrEmpty(configuration.Current.AutocompleteServiceResourceType))
682682
{
683-
builder.RegisterType<AutoCompleteServicePackageIdsQuery>()
683+
builder.RegisterType<AutocompleteServicePackageIdsQuery>()
684684
.AsSelf()
685-
.As<IAutoCompletePackageIdsQuery>()
685+
.As<IAutocompletePackageIdsQuery>()
686686
.SingleInstance();
687687

688-
builder.RegisterType<AutoCompleteServicePackageVersionsQuery>()
688+
builder.RegisterType<AutocompleteServicePackageVersionsQuery>()
689689
.AsSelf()
690-
.As<IAutoCompletePackageVersionsQuery>()
690+
.As<IAutocompletePackageVersionsQuery>()
691691
.InstancePerLifetimeScope();
692692
}
693693
else
694694
{
695-
builder.RegisterType<AutoCompleteDatabasePackageIdsQuery>()
695+
builder.RegisterType<AutocompleteDatabasePackageIdsQuery>()
696696
.AsSelf()
697-
.As<IAutoCompletePackageIdsQuery>()
697+
.As<IAutocompletePackageIdsQuery>()
698698
.InstancePerLifetimeScope();
699699

700-
builder.RegisterType<AutoCompleteDatabasePackageVersionsQuery>()
700+
builder.RegisterType<AutocompleteDatabasePackageVersionsQuery>()
701701
.AsSelf()
702-
.As<IAutoCompletePackageVersionsQuery>()
702+
.As<IAutocompletePackageVersionsQuery>()
703703
.InstancePerLifetimeScope();
704704
}
705+
706+
// Vulnerability Autocomplete
707+
builder.RegisterType<AutocompleteCveIdsQuery>()
708+
.As<IAutocompleteCveIdsQuery>()
709+
.InstancePerLifetimeScope();
710+
711+
builder.RegisterType<AutocompleteCweIdsQuery>()
712+
.As<IAutocompleteCweIdsQuery>()
713+
.InstancePerLifetimeScope();
714+
715+
builder.RegisterType<VulnerabilityAutocompleteService>()
716+
.As<IVulnerabilityAutocompleteService>()
717+
.InstancePerLifetimeScope();
705718
}
706719

707720
private static void ConfigureForLocalFileSystem(ContainerBuilder builder, IGalleryConfigurationService configuration)

‎src/NuGetGallery/App_Start/Routes.cs‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,11 @@ public static void RegisterUIRoutes(RouteCollection routes)
9999
"json/{action}",
100100
new { controller = "JsonApi" });
101101

102+
routes.MapRoute(
103+
RouteName.ManageDeprecationJsonApi,
104+
"json/deprecation/{action}",
105+
new { controller = "ManageDeprecationJsonApi" });
106+
102107
routes.MapRoute(
103108
RouteName.Contributors,
104109
"pages/contributors",
@@ -154,7 +159,7 @@ public static void RegisterUIRoutes(RouteCollection routes)
154159
"packages/{id}/required-signer/{username}",
155160
new { controller = "Packages", action = RouteName.SetRequiredSigner, username = UrlParameter.Optional },
156161
constraints: new { httpMethod = new HttpMethodConstraint("POST") },
157-
obfuscationMetadata: new RouteExtensions.ObfuscatedPathMetadata(3, Obfuscator.DefaultTelemetryUserName) );
162+
obfuscationMetadata: new RouteExtensions.ObfuscatedPathMetadata(3, Obfuscator.DefaultTelemetryUserName));
158163

159164
routes.MapRoute(
160165
RouteName.PackageOwnerConfirmation,
@@ -245,7 +250,7 @@ public static void RegisterUIRoutes(RouteCollection routes)
245250
RouteName.License,
246251
"packages/{id}/{version}/license",
247252
new { controller = "Packages", action = "License" });
248-
253+
249254
//Redirecting v1 Confirmation Route
250255
routes.Redirect(
251256
r => r.MapRoute(
@@ -492,7 +497,7 @@ public static void RegisterUIRoutes(RouteCollection routes)
492497
new RouteExtensions.ObfuscatedPathMetadata(4, Obfuscator.DefaultTelemetryToken)
493498
});
494499

495-
routes.MapRoute(
500+
routes.MapRoute(
496501
RouteName.OrganizationMemberCancelAjax,
497502
"organization/{accountName}/members/cancel",
498503
new { controller = "Organizations", action = RouteName.OrganizationMemberCancelAjax },

‎src/NuGetGallery/Controllers/ApiController.cs‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,8 @@ public partial class ApiController
3636
: AppController
3737
{
3838
private const string NuGetExeUrl = "https://dist.nuget.org/win-x86-commandline/v2.8.6/nuget.exe";
39+
private readonly IAutocompletePackageIdsQuery _autocompletePackageIdsQuery;
40+
private readonly IAutocompletePackageVersionsQuery _autocompletePackageVersionsQuery;
3941

4042
public IApiScopeEvaluator ApiScopeEvaluator { get; set; }
4143
public IEntitiesContext EntitiesContext { get; set; }
@@ -86,7 +88,9 @@ public ApiController(
8688
IPackageUploadService packageUploadService,
8789
IPackageDeleteService packageDeleteService,
8890
ISymbolPackageFileService symbolPackageFileService,
89-
ISymbolPackageUploadService symbolPackageUploadService)
91+
ISymbolPackageUploadService symbolPackageUploadService,
92+
IAutocompletePackageIdsQuery autocompletePackageIdsQuery,
93+
IAutocompletePackageVersionsQuery autocompletePackageVersionsQuery)
9094
{
9195
ApiScopeEvaluator = apiScopeEvaluator;
9296
EntitiesContext = entitiesContext;
@@ -109,6 +113,8 @@ public ApiController(
109113
StatisticsService = null;
110114
SymbolPackageFileService = symbolPackageFileService;
111115
SymbolPackageUploadService = symbolPackageUploadService;
116+
_autocompletePackageIdsQuery = autocompletePackageIdsQuery;
117+
_autocompletePackageVersionsQuery = autocompletePackageVersionsQuery;
112118
}
113119

114120
public ApiController(
@@ -133,12 +139,14 @@ public ApiController(
133139
IPackageUploadService packageUploadService,
134140
IPackageDeleteService packageDeleteService,
135141
ISymbolPackageFileService symbolPackageFileService,
136-
ISymbolPackageUploadService symbolPackageUploadServivce)
142+
ISymbolPackageUploadService symbolPackageUploadServivce,
143+
IAutocompletePackageIdsQuery autocompletePackageIdsQuery,
144+
IAutocompletePackageVersionsQuery autocompletePackageVersionsQuery)
137145
: this(apiScopeEvaluator, entitiesContext, packageService, packageFileService, userService, contentService,
138146
indexingService, searchService, statusService, messageService, auditingService,
139147
configurationService, telemetryService, authenticationService, credentialBuilder, securityPolicies,
140148
reservedNamespaceService, packageUploadService, packageDeleteService, symbolPackageFileService,
141-
symbolPackageUploadServivce)
149+
symbolPackageUploadServivce, autocompletePackageIdsQuery, autocompletePackageVersionsQuery)
142150
{
143151
StatisticsService = statisticsService;
144152
}
@@ -896,10 +904,9 @@ public virtual async Task<ActionResult> GetPackageIds(
896904
bool? includePrerelease,
897905
string semVerLevel = null)
898906
{
899-
var query = GetService<IAutoCompletePackageIdsQuery>();
900907
return new JsonResult
901908
{
902-
Data = (await query.Execute(partialId, includePrerelease, semVerLevel)).ToArray(),
909+
Data = (await _autocompletePackageIdsQuery.Execute(partialId, includePrerelease, semVerLevel)).ToArray(),
903910
JsonRequestBehavior = JsonRequestBehavior.AllowGet
904911
};
905912
}
@@ -911,10 +918,9 @@ public virtual async Task<ActionResult> GetPackageVersions(
911918
bool? includePrerelease,
912919
string semVerLevel = null)
913920
{
914-
var query = GetService<IAutoCompletePackageVersionsQuery>();
915921
return new JsonResult
916922
{
917-
Data = (await query.Execute(id, includePrerelease, semVerLevel)).ToArray(),
923+
Data = (await _autocompletePackageVersionsQuery.Execute(id, includePrerelease, semVerLevel)).ToArray(),
918924
JsonRequestBehavior = JsonRequestBehavior.AllowGet
919925
};
920926
}

‎src/NuGetGallery/Controllers/JsonApiController.cs‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@
1313
using NuGetGallery.Configuration;
1414
using NuGetGallery.Filters;
1515
using NuGetGallery.Infrastructure.Mail.Messages;
16-
using NuGetGallery.Security;
1716

1817
namespace NuGetGallery
1918
{
@@ -25,23 +24,20 @@ public partial class JsonApiController
2524
private readonly IPackageService _packageService;
2625
private readonly IUserService _userService;
2726
private readonly IAppConfiguration _appConfiguration;
28-
private readonly ISecurityPolicyService _policyService;
2927
private readonly IPackageOwnershipManagementService _packageOwnershipManagementService;
3028

3129
public JsonApiController(
3230
IPackageService packageService,
3331
IUserService userService,
3432
IMessageService messageService,
3533
IAppConfiguration appConfiguration,
36-
ISecurityPolicyService policyService,
3734
IPackageOwnershipManagementService packageOwnershipManagementService)
3835
{
39-
_packageService = packageService;
40-
_userService = userService;
41-
_messageService = messageService;
42-
_appConfiguration = appConfiguration;
43-
_policyService = policyService;
44-
_packageOwnershipManagementService = packageOwnershipManagementService;
36+
_packageService = packageService ?? throw new ArgumentNullException(nameof(packageService));
37+
_userService = userService ?? throw new ArgumentNullException(nameof(userService));
38+
_messageService = messageService ?? throw new ArgumentNullException(nameof(messageService));
39+
_appConfiguration = appConfiguration ?? throw new ArgumentNullException(nameof(appConfiguration));
40+
_packageOwnershipManagementService = packageOwnershipManagementService ?? throw new ArgumentNullException(nameof(packageOwnershipManagementService));
4541
}
4642

4743
[HttpGet]

‎src/NuGetGallery/Controllers/ManageDeprecationJsonApiController.cs‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
// Copyright (c) .NET Foundation. All rights reserved.
2+
// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
3+
4+
using System;
5+
using System.Net;
6+
using System.Web.Mvc;
7+
8+
namespace NuGetGallery
9+
{
10+
public partial class ManageDeprecationJsonApiController
11+
: AppController
12+
{
13+
private readonly IVulnerabilityAutocompleteService _vulnerabilityAutocompleteService;
14+
15+
public ManageDeprecationJsonApiController(
16+
IVulnerabilityAutocompleteService vulnerabilityAutocompleteService)
17+
{
18+
_vulnerabilityAutocompleteService = vulnerabilityAutocompleteService ?? throw new ArgumentNullException(nameof(vulnerabilityAutocompleteService));
19+
}
20+
21+
[HttpGet]
22+
[ActionName("CveIds")]
23+
public JsonResult GetCveIds(string query)
24+
{
25+
// Get CVE data.
26+
// Suggestions will be CVE Id's that start with characters entered by the user.
27+
var queryResult = _vulnerabilityAutocompleteService.AutocompleteCveIds(query);
28+
var httpStatusCode = queryResult.Success ? HttpStatusCode.OK : HttpStatusCode.BadRequest;
29+
30+
return Json(
31+
httpStatusCode,
32+
queryResult,
33+
JsonRequestBehavior.AllowGet);
34+
}
35+
36+
[HttpGet]
37+
[ActionName("CweIds")]
38+
public JsonResult GetCweIds(string query)
39+
{
40+
// Get CWE data.
41+
// Suggestions will be CWE Id's that start with characters entered by the user,
42+
// or CWE Id's that have a Name containing the textual search term provided by the user.
43+
var queryResult = _vulnerabilityAutocompleteService.AutocompleteCweIds(query);
44+
var httpStatusCode = queryResult.Success ? HttpStatusCode.OK : HttpStatusCode.BadRequest;
45+
46+
return Json(
47+
httpStatusCode,
48+
queryResult,
49+
JsonRequestBehavior.AllowGet);
50+
}
51+
}
52+
}

‎src/NuGetGallery/NuGetGallery.csproj‎

Lines changed: 22 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -222,6 +222,27 @@
222222
<Compile Include="Authentication\Providers\AzureActiveDirectoryV2\AzureActiveDirectoryV2AuthenticatorConfiguration.cs" />
223223
<Compile Include="Authentication\Providers\AzureActiveDirectory\AzureActiveDirectoryAuthenticator.cs" />
224224
<Compile Include="Authentication\Providers\AzureActiveDirectory\AzureActiveDirectoryAuthenticatorConfiguration.cs" />
225+
<Compile Include="Controllers\ManageDeprecationJsonApiController.cs" />
226+
<Compile Include="Queries\AutocompleteCveIdQueryResults.cs" />
227+
<Compile Include="Queries\AutocompleteCweIdQueryResults.cs" />
228+
<Compile Include="Queries\AutocompleteCveIdQueryResult.cs" />
229+
<Compile Include="Queries\AutocompleteCweIdQueryResult.cs" />
230+
<Compile Include="Services\IVulnerabilityAutocompleteService.cs" />
231+
<Compile Include="Queries\AutocompleteDatabasePackageIdsQuery.cs" />
232+
<Compile Include="Queries\AutocompleteDatabasePackageVersionsQuery.cs" />
233+
<Compile Include="Queries\AutocompleteDatabaseQuery.cs" />
234+
<Compile Include="Queries\AutocompleteServicePackageIdsQuery.cs" />
235+
<Compile Include="Queries\AutocompleteServicePackageVersionsQuery.cs" />
236+
<Compile Include="Queries\AutocompleteServiceQuery.cs" />
237+
<Compile Include="Queries\IAutocompletePackageVersionsQuery.cs" />
238+
<Compile Include="Queries\IAutocompletePackageIdsQuery.cs" />
239+
<Compile Include="Queries\IAutocompleteCweIdsQuery.cs" />
240+
<Compile Include="Queries\CweIdHelper.cs" />
241+
<Compile Include="Queries\CweQueryStringValidator.cs" />
242+
<Compile Include="Queries\CweQueryMethod.cs" />
243+
<Compile Include="Queries\AutocompleteCveIdsQuery.cs" />
244+
<Compile Include="Queries\AutocompleteCweIdsQuery.cs" />
245+
<Compile Include="Queries\IAutocompleteCveIdsQuery.cs" />
225246
<Compile Include="Diagnostics\TraceDiagnosticsSourceScope.cs" />
226247
<Compile Include="Extensions\ClaimsExtensions.cs" />
227248
<Compile Include="Configuration\IGalleryConfigurationService.cs" />
@@ -717,6 +738,7 @@
717738
<Compile Include="ViewModels\ListPackageItemRequiredSignerViewModel.cs" />
718739
<Compile Include="ViewModels\ManagePackageViewModel.cs" />
719740
<Compile Include="ViewModels\SignerViewModel.cs" />
741+
<Compile Include="Services\VulnerabilityAutocompleteService.cs" />
720742
<Compile Include="WebRole.cs" />
721743
<Compile Include="Areas\Admin\AdminAreaRegistration.cs" />
722744
<Compile Include="Areas\Admin\Controllers\AdminControllerBase.cs" />
@@ -1249,14 +1271,6 @@
12491271
<Compile Include="OData\Serializers\NuGetEntityTypeSerializer.cs" />
12501272
<Compile Include="OData\Serializers\CustomSerializerProvider.cs" />
12511273
<Compile Include="Infrastructure\Lucene\NuGetQueryParser.cs" />
1252-
<Compile Include="Queries\AutoCompleteDatabaseQuery.cs" />
1253-
<Compile Include="Queries\AutoCompleteServiceQuery.cs" />
1254-
<Compile Include="Queries\AutoCompleteServicePackageIdsQuery.cs" />
1255-
<Compile Include="Queries\AutoCompleteServicePackageVersionsQuery.cs" />
1256-
<Compile Include="Queries\IAutoCompletePackageIdsQuery.cs" />
1257-
<Compile Include="Queries\IAutoCompletePackageVersionsQuery.cs" />
1258-
<Compile Include="Queries\AutoCompleteDatabasePackageVersionsQuery.cs" />
1259-
<Compile Include="Queries\AutoCompleteDatabasePackageIdsQuery.cs" />
12601274
<Compile Include="RequestModels\DeletePackagesRequest.cs" />
12611275
<Compile Include="RequestModels\EditPackageVersionRequest.cs" />
12621276
<Compile Include="RequestModels\VerifyPackageRequest.cs" />

‎src/NuGetGallery/Queries/AutocompleteCveIdQueryResult.cs‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
// Copyright (c) .NET Foundation. All rights reserved.
2+
// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
3+
4+
using System;
5+
6+
namespace NuGetGallery
7+
{
8+
public class AutocompleteCveIdQueryResult
9+
{
10+
public AutocompleteCveIdQueryResult(string cveId, string description, decimal? cvssRating)
11+
{
12+
CveId = cveId ?? throw new ArgumentNullException(nameof(cveId));
13+
Description = description ?? throw new ArgumentNullException(nameof(description));
14+
CvssRating = cvssRating;
15+
}
16+
17+
public string CveId { get; }
18+
19+
public string Description { get; }
20+
21+
public decimal? CvssRating { get; set; }
22+
}
23+
}

‎src/NuGetGallery/Queries/AutocompleteCveIdQueryResults.cs‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
// Copyright (c) .NET Foundation. All rights reserved.
2+
// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
3+
4+
using System;
5+
using System.Collections.Generic;
6+
7+
namespace NuGetGallery
8+
{
9+
public class AutocompleteCveIdQueryResults
10+
{
11+
public AutocompleteCveIdQueryResults(string errorMessage)
12+
{
13+
ErrorMessage = errorMessage ?? throw new ArgumentNullException(errorMessage);
14+
Success = false;
15+
}
16+
17+
public AutocompleteCveIdQueryResults(IReadOnlyCollection<AutocompleteCveIdQueryResult> results)
18+
{
19+
Results = results ?? throw new ArgumentNullException(nameof(results));
20+
Success = true;
21+
}
22+
23+
public bool Success { get; }
24+
25+
public string ErrorMessage { get; set; }
26+
27+
public IReadOnlyCollection<AutocompleteCveIdQueryResult> Results { get; }
28+
}
29+
}

0 commit comments

Comments
 (0)