Skip to content

Commit bf80cc1

Browse files
ziadhanyziadhany
committed
Split severities into EPSS and non-EPSS sections
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
1 parent dcd2f00 commit bf80cc1

2 files changed

Lines changed: 99 additions & 73 deletions

File tree

‎vulnerabilities/templates/vulnerability_details.html‎

Lines changed: 85 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@
6868
<li data-tab="epss">
6969
<a>
7070
<span>
71-
EPSS
71+
EPSS ({{ epss_severities|length }})
7272
</span>
7373
</a>
7474
</li>
@@ -501,13 +501,15 @@
501501
</tr>
502502
{% endfor %}
503503
</div>
504-
505-
504+
506505
<div class="tab-div content" data-content="epss">
507-
{% if epss_data %}
506+
507+
{% if epss_severities %}
508508
<div class="has-text-weight-bold tab-nested-div ml-1 mb-1 mt-1">
509509
Exploit Prediction Scoring System (EPSS)
510510
</div>
511+
512+
{% with first=epss_severities.0 %}
511513
<table class="table vcio-table width-100-pct mt-2">
512514
<tbody>
513515
<tr>
@@ -517,7 +519,7 @@
517519
Percentile
518520
</span>
519521
</td>
520-
<td class="two-col-right">{{ epss_data.percentile }}</td>
522+
<td class="two-col-right">{{ first.scoring_elements }}</td>
521523
</tr>
522524
<tr>
523525
<td class="two-col-left">
@@ -526,71 +528,99 @@
526528
EPSS Score
527529
</span>
528530
</td>
529-
<td class="two-col-right">{{ epss_data.score }}</td>
531+
<td class="two-col-right">{{ first.value }}</td>
530532
</tr>
531-
{% if epss_data.published_at %}
532533
<tr>
533534
<td class="two-col-left">
534535
<span class="has-tooltip-multiline has-tooltip-black has-tooltip-arrow has-tooltip-text-left"
535536
data-tooltip="Date when the EPSS score was published.">
536537
Published At
537538
</span>
538539
</td>
539-
<td class="two-col-right">{{ epss_data.published_at }}</td>
540+
<td class="two-col-right">{{ first.published_at }}</td>
540541
</tr>
541-
{% endif %}
542542
</tbody>
543543
</table>
544-
{% else %}
545-
<p>No EPSS data available for this vulnerability.</p>
546-
{% endif %}
547-
</div>
544+
{% endwith %}
548545

549-
<div class="tab-div content" data-content="history">
550-
<table class="table is-bordered is-striped is-narrow is-hoverable is-fullwidth">
551-
<thead>
546+
<div class="has-text-weight-bold tab-nested-div ml-1 mb-1 mt-1">
547+
EPSS History
548+
</div>
549+
550+
<table class="table is-bordered is-striped is-narrow is-hoverable is-fullwidth gray-header-border">
551+
<tr>
552+
<th style="width: 100px;"> Score </th>
553+
<th style="width: 100px;"> Percentile </th>
554+
<th> Published At </th>
555+
<th> Found at </th>
556+
</tr>
557+
{% for epss_severity in epss_severities %}
558+
<tr>
559+
<td class="wrap-strings">{{ epss_severity.value }}</td>
560+
<td class="wrap-strings">{{ epss_severity.scoring_elements }}</td>
561+
<td class="wrap-strings">{{ epss_severity.published_at }}</td>
562+
<td class="wrap-strings">
563+
<a href="{{ epss_severity.url }}" target="_blank">
564+
{{ epss_severity.url }}
565+
<i class="fa fa-external-link fa_link_custom"></i>
566+
</a>
567+
</td>
568+
</tr>
569+
{% endfor %}
570+
</table>
571+
{% else %}
552572
<tr>
553-
<th>
554-
<span
555-
class="has-tooltip-multiline has-tooltip-black has-tooltip-arrow has-tooltip-text-left"
556-
data-tooltip="The date that the vulnerability was imported (collected) or improved.">
557-
Date </span>
558-
</th>
559-
<th>
560-
<span
561-
class="has-tooltip-multiline has-tooltip-black has-tooltip-arrow has-tooltip-text-left"
562-
data-tooltip="The process that created or updated the vulnerability."> Actor </span>
563-
</th>
564-
<th> <span
565-
class="has-tooltip-multiline has-tooltip-black has-tooltip-arrow has-tooltip-text-left"
566-
data-tooltip="Imported or Improved"> Action </span> </th>
567-
<th> <span
568-
class="has-tooltip-multiline has-tooltip-black has-tooltip-arrow has-tooltip-text-left"
569-
data-tooltip="The public service that published the advisory or related information."> Source </span> </th>
570-
<th> <span
571-
class="has-tooltip-multiline has-tooltip-black has-tooltip-arrow has-tooltip-text-left"
572-
data-tooltip="The version of VulnerableCode that performed the action. ">
573-
VulnerableCode Version
574-
</span> </th>
573+
<td colspan="2">
574+
No EPSS data available for this vulnerability.
575+
</td>
575576
</tr>
576-
</thead>
577-
{% for log in history %}
578-
<tr>
579-
<td class="is-break-word wrap-strings">{{ log.get_iso_time }}</td>
580-
<td class="is-break-word wrap-strings">{{ log.actor_name }}</td>
581-
<td class="is-break-word wrap-strings">{{ log.get_action_type_label }}</td>
582-
<td class="is-break-word wrap-strings"> <a href="{{ log.source_url }}" target="_blank">{{log.source_url }}</a></td>
583-
<td class="is-break-word wrap-strings"> {{ log.software_version }} </td>
584-
</tr>
585-
{% empty %}
586-
<tr>
587-
<td colspan="5">
588-
There are no relevant records.
589-
</td>
590-
</tr>
591-
{% endfor %}
592-
</table>
577+
{% endif %}
593578
</div>
579+
<div class="tab-div content" data-content="history">
580+
<table class="table is-bordered is-striped is-narrow is-hoverable is-fullwidth">
581+
<thead>
582+
<tr>
583+
<th>
584+
<span
585+
class="has-tooltip-multiline has-tooltip-black has-tooltip-arrow has-tooltip-text-left"
586+
data-tooltip="The date that the vulnerability was imported (collected) or improved.">
587+
Date </span>
588+
</th>
589+
<th>
590+
<span
591+
class="has-tooltip-multiline has-tooltip-black has-tooltip-arrow has-tooltip-text-left"
592+
data-tooltip="The process that created or updated the vulnerability."> Actor </span>
593+
</th>
594+
<th> <span
595+
class="has-tooltip-multiline has-tooltip-black has-tooltip-arrow has-tooltip-text-left"
596+
data-tooltip="Imported or Improved"> Action </span> </th>
597+
<th> <span
598+
class="has-tooltip-multiline has-tooltip-black has-tooltip-arrow has-tooltip-text-left"
599+
data-tooltip="The public service that published the advisory or related information."> Source </span> </th>
600+
<th> <span
601+
class="has-tooltip-multiline has-tooltip-black has-tooltip-arrow has-tooltip-text-left"
602+
data-tooltip="The version of VulnerableCode that performed the action. ">
603+
VulnerableCode Version
604+
</span> </th>
605+
</tr>
606+
</thead>
607+
{% for log in history %}
608+
<tr>
609+
<td class="is-break-word wrap-strings">{{ log.get_iso_time }}</td>
610+
<td class="is-break-word wrap-strings">{{ log.actor_name }}</td>
611+
<td class="is-break-word wrap-strings">{{ log.get_action_type_label }}</td>
612+
<td class="is-break-word wrap-strings"> <a href="{{ log.source_url }}" target="_blank">{{log.source_url }}</a></td>
613+
<td class="is-break-word wrap-strings"> {{ log.software_version }} </td>
614+
</tr>
615+
{% empty %}
616+
<tr>
617+
<td colspan="5">
618+
There are no relevant records.
619+
</td>
620+
</tr>
621+
{% endfor %}
622+
</table>
623+
</div>
594624
</div>
595625
</div>
596626
</section>

‎vulnerabilities/views.py‎

Lines changed: 14 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
# See https://aboutcode.org for more information about nexB OSS projects.
88
#
99
import logging
10+
from datetime import datetime
1011

1112
from cvss.exceptions import CVSS2MalformedError
1213
from cvss.exceptions import CVSS3MalformedError
@@ -305,12 +306,19 @@ def get_context_data(self, **kwargs):
305306
if weakness_object.weakness
306307
]
307308

308-
valid_severities = self.object.severities.exclude(scoring_system=EPSS.identifier).filter(
309-
scoring_elements__isnull=False, scoring_system__in=SCORING_SYSTEMS.keys()
310-
)
309+
all_severities = list(self.object.severities.all().order_by("-published_at"))
311310

312-
severity_vectors = []
311+
valid_severities = [
312+
s
313+
for s in all_severities
314+
if s.scoring_system != EPSS.identifier
315+
and s.scoring_elements is not None
316+
and s.scoring_system in SCORING_SYSTEMS
317+
]
313318

319+
epss_severities = [s for s in all_severities if s.scoring_system == EPSS.identifier]
320+
321+
severity_vectors = []
314322
for severity in valid_severities:
315323
try:
316324
vector_values_system = SCORING_SYSTEMS[severity.scoring_system]
@@ -328,30 +336,18 @@ def get_context_data(self, **kwargs):
328336
):
329337
logging.error(f"CVSSMalformedError for {severity.scoring_elements}")
330338

331-
epss_severity = vulnerability.severities.filter(scoring_system="epss").latest(
332-
"published_at"
333-
)
334-
335-
epss_data = None
336-
if epss_severity:
337-
epss_data = {
338-
"percentile": epss_severity.scoring_elements,
339-
"score": epss_severity.value,
340-
"published_at": epss_severity.published_at,
341-
}
342-
343339
context.update(
344340
{
345341
"vulnerability": vulnerability,
346342
"vulnerability_search_form": VulnerabilitySearchForm(self.request.GET),
347-
"severities": list(vulnerability.severities.all()),
343+
"severities": list(self.object.severities.exclude(scoring_system=EPSS.identifier)),
348344
"severity_vectors": severity_vectors,
345+
"epss_severities": epss_severities,
349346
"references": list(vulnerability.references.all()),
350347
"aliases": list(vulnerability.aliases.all()),
351348
"weaknesses": weaknesses_present_in_db,
352349
"status": vulnerability.get_status_label,
353350
"history": vulnerability.history,
354-
"epss_data": epss_data,
355351
}
356352
)
357353
return context

0 commit comments

Comments
 (0)