/[secure-testing]/bin/tracker_service.py
ViewVC logotype

Diff of /bin/tracker_service.py

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 11223 by fw, Sun Feb 15 17:17:11 2009 UTC revision 18900 by geissert, Tue Apr 10 01:22:50 2012 UTC
# Line 2  Line 2 
2    
3  import sys  import sys
4  sys.path.insert(0,'../lib/python')  sys.path.insert(0,'../lib/python')
   
 if len(sys.argv) <> 3:  
     print "usage: python tracker_serivce.py SOCKET-PATH DATABASE-PATH"  
     sys.exit(1)  
 socket_name = sys.argv[1]  
 db_name = sys.argv[2]  
   
5  import bugs  import bugs
6  import re  import re
7  import security_db  import security_db
8  from web_support import *  from web_support import *
9    
10    if len(sys.argv) not in (3, 5):
11        print "usage: python tracker_service.py SOCKET-PATH DATABASE-PATH"
12        print "       python tracker_service.py URL HOST PORT DATABASE-PATH"
13        sys.exit(1)
14    if len(sys.argv) == 3:
15        socket_name = sys.argv[1]
16        db_name = sys.argv[2]
17        webservice_base_class = WebService
18    else:
19        server_base_url = sys.argv[1]
20        server_address = sys.argv[2]
21        server_port = int(sys.argv[3])
22        socket_name = (server_base_url, server_address, server_port)
23        db_name = sys.argv[4]
24        webservice_base_class = WebServiceHTTP
25    
26  class BugFilter:  class BugFilter:
27      default_action_list = [("hide_medium_urgency", "lower urgencies"),      default_action_list = [('show_high_urgency', 'only high urgencies'),
28                             ("hide_non_remote", "local vulnerabilities")]                             ('show_medium_urgency', 'only medium and high urgencies'),
29                               ('show_undetermined_urgency', 'issues that may be vulnerable but need to be checked (shown in purple)'),
30                               ('show_unimportant_urgency', 'unimportant issues'),
31                               ('show_remote_only', 'only remote vulnerabilities')]
32      def __init__(self, params, action_list=None):      def __init__(self, params, action_list=None):
33          if action_list is None:          if action_list is None:
34              self.action_list = self.default_action_list              self.action_list = self.default_action_list
# Line 32  class BugFilter: Line 44  class BugFilter:
44          l = []          l = []
45          for (prop, desc) in self.action_list:          for (prop, desc) in self.action_list:
46              if self.params[prop]:              if self.params[prop]:
47                  a = A(url.updateParamsDict({prop : None}),                  if self.params['show_medium_urgency'] and prop == 'show_medium_urgency':
48                        'Show ' + desc)                      note = 'Restore lower than medium urgencies'
49                    elif self.params['show_high_urgency'] and prop == 'show_high_urgency':
50                        note = 'Restore lower than high urgencies'
51                    elif self.params['show_remote_only'] and prop == 'show_remote_only':
52                        note = 'Restore local vulnerabilities'
53                    else:
54                        note = 'Hide ' + desc
55                    l.append(TR(TD(A(url.updateParamsDict({prop : None}), note))))
56              else:              else:
57                  a = A(url.updateParamsDict({prop : '1'}),                  note = 'Show ' + desc
58                        'Hide ' + desc)                  l.append(TR(TD(A(url.updateParamsDict({prop : '1'}), note))))
59              l.append(a)  
60              l.append(' ')          return TABLE(l)
61    
62          return apply(P, l[:-1])      def urgencyFiltered(self, urg, vuln):
63            """Returns True for urgencies that should be filtered."""
64      def urgencyFiltered(self, urg):          filterlow = self.params['show_medium_urgency'] and \
65          """Returns True if the urgency urg is filtered."""                      urg in ('low', 'low**', 'unimportant',
66          return self.params['hide_medium_urgency'] \                      'undetermined', 'not yet assigned')
67                 and urg not in ("high", "unknown", "")          filtermed = self.params['show_high_urgency'] and \
68                        urg in ('medium', 'medium**', 'low', 'low**',
69                        'unimportant', 'undetermined', 'not yet assigned')
70            filterund = not self.params['show_undetermined_urgency'] and vuln == 2
71            filteruni = not self.params['show_unimportant_urgency'] \
72                        and urg == 'unimportant'
73            return filterlow or filtermed or filterund or filteruni
74    
75      def remoteFiltered(self, remote):      def remoteFiltered(self, remote):
76          """Returns True if the attack range is filtered."""          """Returns True for only remote flaws if filtered."""
77          return remote is not None and self.params['hide_non_remote'] \          return self.params['show_remote_only'] and not remote and not remote is None
                and not remote  
78    
79  class BugFilterNoDSA(BugFilter):  class BugFilterNoDSA(BugFilter):
80      def __init__(self, params):      def __init__(self, params):
81          BugFilter.__init__(self, params, self.default_action_list          BugFilter.__init__(self, params, self.default_action_list
82              + [('hide_nodsa', 'non-DSA vulnerabilities')])              + [('show_nodsa', 'issues that are not severe enough to warrant a DSA')])
         self.hide_nodsa = int(params.get('hide_nodsa',(0,))[0])  
83    
84      def nodsaFiltered(self, nodsa):      def nodsaFiltered(self, nodsa):
85          """Returns True if no DSA will be issued for the bug."""          """Returns True for no DSA issues if filtered."""
86          return nodsa and self.params['hide_nodsa']          return nodsa and not self.params['show_nodsa']
87    
88  class TrackerService(WebService):  class TrackerService(webservice_base_class):
89      head_contents = compose(STYLE(      head_contents = compose(STYLE(
90          """h1 { font-size : 144%; }          """h1 { font-size : 144%; }
91  h2 { font-size : 120%; }  h2 { font-size : 120%; }
# Line 74  td, th { text-align : left; Line 97  td, th { text-align : left;
97           padding-right : 0.25em; }           padding-right : 0.25em; }
98  td { vertical-align: baseline }  td { vertical-align: baseline }
99  span.red { color: red; }  span.red { color: red; }
100    span.purple { color: purple; }
101  span.dangerous { color: rgb(191,127,0); }  span.dangerous { color: rgb(191,127,0); }
102  """), SCRIPT('''var old_query_value = "";  """), SCRIPT('''var old_query_value = "";
103    
# Line 93  function onSearch(query) { Line 117  function onSearch(query) {
117  }  }
118  ''')).toHTML()  ''')).toHTML()
119    
120        nvd_text =  P('''If a "**" is included, the urgency field was automatically
121            assigned by the NVD (National Vulnerability Database). Note that this
122            rating is automatically derived from a set of known factors about the
123            issue (such as access complexity, confidentiality impact, exploitability,
124            remediation level, and others). Human intervention is involved in
125            determining the values of these factors, but the rating itself comes
126            from a fully automated formula.''')
127    
128      def __init__(self, socket_name, db_name):      def __init__(self, socket_name, db_name):
129          WebService.__init__(self, socket_name)          webservice_base_class.__init__(self, socket_name)
130          self.db = security_db.DB(db_name)          self.db = security_db.DB(db_name)
131          self.register('', self.page_home)          self.register('', self.page_home)
132          self.register('*', self.page_object)          self.register('*', self.page_object)
133          self.register('redirect/*', self.page_redirect)          self.register('redirect/*', self.page_redirect)
134          self.register('source-package/*', self.page_source_package)          self.register('source-package/*', self.page_source_package)
         self.register('binary-package/*', self.page_binary_package)  
135          self.register('status/release/oldstable',          self.register('status/release/oldstable',
136                        self.page_status_release_oldstable)                        self.page_status_release_oldstable)
137          self.register('status/release/stable', self.page_status_release_stable)          self.register('status/release/stable', self.page_status_release_stable)
# Line 115  function onSearch(query) { Line 146  function onSearch(query) {
146          self.register('status/dtsa-candidates',          self.register('status/dtsa-candidates',
147                        self.page_status_dtsa_candidates)                        self.page_status_dtsa_candidates)
148          self.register('status/todo', self.page_status_todo)          self.register('status/todo', self.page_status_todo)
149            self.register('status/undetermined', self.page_status_undetermined)
150            self.register('status/unimportant', self.page_status_unimportant)
151          self.register('status/itp', self.page_status_itp)          self.register('status/itp', self.page_status_itp)
152          self.register('data/unknown-packages', self.page_data_unknown_packages)          self.register('data/unknown-packages', self.page_data_unknown_packages)
153          self.register('data/missing-epochs', self.page_data_missing_epochs)          self.register('data/missing-epochs', self.page_data_missing_epochs)
# Line 123  function onSearch(query) { Line 156  function onSearch(query) {
156          self.register('data/releases', self.page_data_releases)          self.register('data/releases', self.page_data_releases)
157          self.register('data/funny-versions', self.page_data_funny_versions)          self.register('data/funny-versions', self.page_data_funny_versions)
158          self.register('data/fake-names', self.page_data_fake_names)          self.register('data/fake-names', self.page_data_fake_names)
159            self.register('data/pts/1', self.page_data_pts)
160          self.register('debsecan/**', self.page_debsecan)          self.register('debsecan/**', self.page_debsecan)
161          self.register('data/report', self.page_report)          self.register('data/report', self.page_report)
162    
# Line 139  function onSearch(query) { Line 173  function onSearch(query) {
173              [P(              [P(
174              """The data in this tracker comes solely from the bug database maintained              """The data in this tracker comes solely from the bug database maintained
175  by Debian's security team located in the testing-security Subversion """,  by Debian's security team located in the testing-security Subversion """,
176              A("http://svn.debian.org/wsvn/secure-testing/data", "repository"),              A("http://svn.debian.org/wsvn/secure-testing/data/", "repository"),
177              """.  The data represented here is derived from: """,              """.  The data represented here is derived from: """,
178              A("http://www.debian.org/security/#DSAS", "DSAs"),              A("http://www.debian.org/security/#DSAS", "DSAs"),
179              """ issued by the Security Team; issues tracked in the """,              """ issued by the Security Team; issues tracked in the """,
# Line 164  aware of and/or help us improve the qual Line 198  aware of and/or help us improve the qual
198               'Vulnerable packages in the testing suite'),               'Vulnerable packages in the testing suite'),
199              ('status/release/stable',              ('status/release/stable',
200               'Vulnerable packages in the stable suite'),               'Vulnerable packages in the stable suite'),
             ('status/release/oldstable',  
              'Vulnerable packages in the old stable suite'),  
201              ('status/release/stable-backports',              ('status/release/stable-backports',
202               'Vulnerable packages in backports for stable'),               'Vulnerable packages in backports for stable'),
             ('status/release/oldstable-backports',  
              'Vulnerable packages in backports for oldstable'),  
203              ('status/dtsa-candidates', "Candidates for DTSAs"),              ('status/dtsa-candidates', "Candidates for DTSAs"),
204              ('status/todo', 'TODO items'),              ('status/todo', 'TODO items'),
205                ('status/undetermined', 'Packages that may be vulnerable but need to be checked (undetermined issues)'),
206                ('status/unimportant', 'Packages that have open unimportant issues'),
207              ('status/itp', 'ITPs with potential security issues'),              ('status/itp', 'ITPs with potential security issues'),
208              ('data/unknown-packages',              ('data/unknown-packages',
209               'Packages names not found in the archive'),               'Packages names not found in the archive'),
# Line 202  data source.""")], Line 234  data source.""")],
234          return self.page_object_or_redirect(url, obj, False)          return self.page_object_or_redirect(url, obj, False)
235    
236      def page_redirect(self, path, params, url):      def page_redirect(self, path, params, url):
237          obj = path[0]          if path == ():
238                obj = ''
239            else:
240                obj = path[0]
241          return self.page_object_or_redirect(url, obj, True)          return self.page_object_or_redirect(url, obj, True)
242    
243      def page_object_or_redirect(self, url, obj, redirect):      def page_object_or_redirect(self, url, obj, redirect):
# Line 238  data source.""")], Line 273  data source.""")],
273    
274          if self.db.isSourcePackage(c, obj):          if self.db.isSourcePackage(c, obj):
275              return RedirectResult(self.url_source_package(url, obj, full=True))              return RedirectResult(self.url_source_package(url, obj, full=True))
         if  self.db.isBinaryPackage(c, obj):  
             return RedirectResult(self.url_binary_package(url ,obj, full=True))  
276    
277          return self.page_not_found(url, obj)          return self.page_not_found(url, obj)
278    
# Line 266  data source.""")], Line 299  data source.""")],
299    
300          def gen_header():          def gen_header():
301              yield B("Name"), bug.name              yield B("Name"), bug.name
302    
303                nvd = self.db.getNVD(cursor, bug.name)
304    
305                if nvd and nvd.cve_desc:
306                    yield B("Description"), nvd.cve_desc
307                elif bug.description:
308                    yield B("Description"), bug.description
309    
310              source = bug.name.split('-')[0]              source = bug.name.split('-')[0]
311              if source == 'CVE':              if source == 'CVE':
312                  source_xref = compose(self.make_cve_ref(url, bug.name, 'CVE'),                  source_xref = compose(self.make_cve_ref(url, bug.name, 'CVE'),
313                                        " (",                                        " (at ",
314                                        self.make_nvd_ref(url, bug.name,                                        self.make_nvd_ref(url, bug.name,
315                                                          'in NVD'),                                                          'NVD'),
316                                          "; ",
317                                          self.make_rhbug_ref(url, bug.name,
318                                                            'Red Hat'),
319                                          ", ",
320                                          self.make_ubuntu_bug_ref(url, bug.name, 'Ubuntu'),
321                                          ", ",
322                                          self.make_gentoo_bug_ref(url, bug.name, 'Gentoo'),
323                                          ", ",
324                                          A(url.absolute('http://oss-security.openwall.org/wiki/vendors'), 'more'),
325                                        ")")                                        ")")
326              elif source == 'DSA':              elif source == 'DSA':
327                  source_xref = self.make_dsa_ref(url, bug.name, 'Debian')                  source_xref = self.make_dsa_ref(url, bug.name, 'Debian')
# Line 286  data source.""")], Line 335  data source.""")],
335    
336              if source_xref:              if source_xref:
337                  yield B("Source"), source_xref                  yield B("Source"), source_xref
   
             nvd = self.db.getNVD(cursor, bug.name)  
   
             if nvd and nvd.cve_desc:  
                 yield B("Description"), nvd.cve_desc  
             elif bug.description:  
                 yield B("Description"), bug.description  
338    
339              xref = list(self.db.getBugXrefs(cursor, bug.name))              xref = list(self.db.getBugXrefs(cursor, bug.name))
340              if xref:              if xref:
# Line 314  data source.""")], Line 356  data source.""")],
356    
357              if not bug.not_for_us:              if not bug.not_for_us:
358                  for (release, status, reason) in bug.getStatus(cursor):                  for (release, status, reason) in bug.getStatus(cursor):
359                      if status <> 'fixed':                      if status == 'undetermined':
360                            reason = self.make_purple(reason)
361                        elif status <> 'fixed':
362                          reason = self.make_red(reason)                          reason = self.make_red(reason)
363                      yield B('Debian/%s' % release), reason                      yield B('Debian/%s' % release), reason
364    
# Line 334  data source.""")], Line 378  data source.""")],
378                          package = compose(                          package = compose(
379                              self.make_source_package_ref(url, package),                              self.make_source_package_ref(url, package),
380                              " (", self.make_pts_ref(url, package, 'PTS'), ")")                              " (", self.make_pts_ref(url, package, 'PTS'), ")")
381                      if vulnerable:                      if vulnerable == 1:
382                          vuln = self.make_red('vulnerable')                          vuln = self.make_red('vulnerable')
383                          version = self.make_red(version)                          version = self.make_red(version)
384                        elif vulnerable == 2:
385                            vuln = self.make_purple('undetermined')
386                            version = self.make_purple(version)
387                      else:                      else:
388                          vuln = 'fixed'                          vuln = 'fixed'
389    
# Line 346  data source.""")], Line 393  data source.""")],
393      caption=("Source Package", "Release", "Version", "Status"),      caption=("Source Package", "Release", "Version", "Status"),
394      introduction=P('The table below lists information on source packages.')))      introduction=P('The table below lists information on source packages.')))
395    
             def gen_binary():  
                 old_pkg = ''  
                 for (packages, releases, version, archs, vulnerable) \  
                     in self.db.getBinaryPackages(cursor, bug.name):  
                     pkg = ', '.join(packages)  
                     if pkg == old_pkg:  
                         packages = ''  
                     else:  
                         old_pkg = pkg  
                         packages = self.make_binary_packages_ref(url, packages)  
   
                     if vulnerable:  
                         vuln = self.make_red('vulnerable')  
                         version = self.make_red(version)  
                     else:  
                         vuln = 'fixed'  
                     yield (packages,  
                            ', '.join(releases),  
                            version, vuln,  
                            ', '.join(archs))  
   
             page.append(make_table(gen_binary(),  
         caption=("Binary Package", "Release", "Version", "Status",  
                  "Architecures"),  
         introduction=P("The next table lists affected binary packages.")))  
   
396              def gen_data():              def gen_data():
397                  notes_sorted = bug.notes[:]                  notes_sorted = bug.notes[:]
398                  notes_sorted.sort(lambda a, b: cmp(a.package, b.package))                  notes_sorted.sort(lambda a, b: cmp(a.package, b.package))
# Line 388  data source.""")], Line 409  data source.""")],
409                              urgency = ''                              urgency = ''
410                      else:                      else:
411                          ver = self.make_red('(unfixed)')                          ver = self.make_red('(unfixed)')
412                        if urgency == 'not yet assigned':
413                            urgency = ''
414    
415                      pkg = n.package                      pkg = n.package
416                      pkg_kind = n.package_kind                      pkg_kind = n.package_kind
417                      if pkg_kind == 'source':                      if pkg_kind == 'source':
418                          pkg = self.make_source_package_ref(url, pkg)                          pkg = self.make_source_package_ref(url, pkg)
                     elif pkg_kind == 'binary':  
                         pkg = self.make_binary_package_ref(url, pkg)  
419                      elif pkg_kind == 'itp':                      elif pkg_kind == 'itp':
420                          pkg_kind = 'ITP'                          pkg_kind = 'ITP'
421                          rel = ''                          rel = ''
# Line 494  response, do not forget to let us know h Line 515  response, do not forget to let us know h
515               P("""Helping out: We welcome people who wish to join us in tracking               P("""Helping out: We welcome people who wish to join us in tracking
516  issues. The process is designed to be easy to learn and participate,  issues. The process is designed to be easy to learn and participate,
517  please read our """,  please read our """,
518                 A("http://svn.debian.org/wsvn/secure-testing/doc/narrative_introduction?op=file&rev=0&sc=0",                 A("http://svn.debian.org/viewvc/secure-testing/doc/narrative_introduction?view=co",
519                   "Introduction"),                   "Introduction"),
520                 """ to get familiar with how things work.  Join us on                 """ to get familiar with how things work.  Join us on
521  our mailing list, and on IRC and request to be added to the Alioth """,  our mailing list, and on IRC and request to be added to the Alioth """,
# Line 510  to improve our documentation and procedu Line 531  to improve our documentation and procedu
531              for (releases, version) in self.db.getSourcePackageVersions(              for (releases, version) in self.db.getSourcePackageVersions(
532                  self.db.cursor(), pkg):                  self.db.cursor(), pkg):
533                  yield ', '.join(releases), version                  yield ', '.join(releases), version
         def gen_binary():  
             for (packages, releases, archs, version) \  
                     in self.db.getBinaryPackagesForSource(  
                 self.db.cursor(), pkg):  
                 yield (self.make_binary_packages_ref(url, packages),  
                        ', '.join(releases), version, ', '.join(archs))  
534          def gen_bug_list(lst):          def gen_bug_list(lst):
535              for (bug, description) in lst:              for (bug, description) in lst:
536                  yield self.make_xref(url, bug), description                  yield self.make_xref(url, bug), description
537    
538          return self.create_page(          return self.create_page(
539              url, "Information on source package " + pkg,              url, 'Information on source package ' + pkg,
540              [make_menu(lambda x: x,              [make_menu(lambda x: x,
541                         (self.url_pts(url, pkg),                         (self.url_pts(url, pkg),
542                          pkg + ' in the Package Tracking System'),                          pkg + ' in the Package Tracking System'),
# Line 529  to improve our documentation and procedu Line 544  to improve our documentation and procedu
544                          pkg + ' in the Bug Tracking System'),                          pkg + ' in the Bug Tracking System'),
545                         (self.url_testing_status(url, pkg),                         (self.url_testing_status(url, pkg),
546                          pkg + ' in the testing migration checker')),                          pkg + ' in the testing migration checker')),
547               H2("Available versions"),               H2('Available versions'),
548               make_table(gen_versions(), caption=("Release", "Version")),               make_table(gen_versions(), caption=('Release', 'Version')),
549    
550               H2("Available binary packages"),               H2('Open issues'),
              make_table(gen_binary(),  
             caption=('Package', 'Release', 'Version', 'Architectures'),  
             replacement="""No binary packages are recorded in this database.  
 This probably means that the package is architecture-specific, and the  
 architecture is currently not tracked."""),  
   
              H2("Open issues"),  
551               make_table(gen_bug_list(self.db.getBugsForSourcePackage               make_table(gen_bug_list(self.db.getBugsForSourcePackage
552                                       (self.db.cursor(), pkg, True)),                                       (self.db.cursor(), pkg, True, False)),
553                          caption=('Bug', 'Description'),                          caption=('Bug', 'Description'),
554                          replacement='No known open issues.'),                          replacement='No known open issues.'),
555    
556               H2("Resolved issues"),               H2('Open unimportant issues'),
557               make_table(gen_bug_list(self.db.getBugsForSourcePackage               make_table(gen_bug_list(self.db.getBugsForSourcePackage
558                                       (self.db.cursor(), pkg, False)),                                       (self.db.cursor(), pkg, True, True)),
                         caption=('Bug', 'Description'),  
                         replacement='No known resolved issues.')])  
   
     def page_binary_package(self, path, params, url):  
         pkg = path[0]  
   
         def gen_versions():  
             for (releases, source, version, archs) \  
                     in self.db.getBinaryPackageVersions(self.db.cursor(), pkg):  
                 yield (', '.join(releases),  
                        self.make_source_package_ref(url, source),  
                        version, ', '.join(archs))  
         def gen_bug_list(lst):  
             for (bug, description) in lst:  
                 yield self.make_xref(url, bug), description  
   
         return self.create_page(  
             url, "Information on binary package " + pkg,  
             [make_menu(lambda x: x,  
                        (self.url_debian_bug_pkg(url, pkg),  
                         pkg + ' in the Bug Tracking System')),  
              H2("Available versions"),  
              make_table(gen_versions(),  
                 caption=("Release", "Source", "Version", "Architectures")),  
   
              H2("Open issues"),  
              make_table(gen_bug_list(self.db.getBugsForBinaryPackage  
                                      (self.db.cursor(), pkg, True)),  
559                          caption=('Bug', 'Description'),                          caption=('Bug', 'Description'),
560                          replacement='No known open issues.'),                          replacement='No known unimportant issues.'),
561    
562               H2("Resolved issues"),               H2('Resolved issues'),
563               make_table(gen_bug_list(self.db.getBugsForBinaryPackage               make_table(gen_bug_list(self.db.getBugsForSourcePackage
564                                       (self.db.cursor(), pkg, False)),                                       (self.db.cursor(), pkg, False, True)),
565                          caption=('Bug', 'Description'),                          caption=('Bug', 'Description'),
566                          replacement='No known resolved issues.'),                          replacement='No known resolved issues.'),
567    
568               H2("Non-issues"),               H2('Security announcements'),
569                  make_table(gen_bug_list(self.db.getNonBugsForBinaryPackage               make_table(gen_bug_list(self.db.getDSAsForSourcePackage
570                                          (self.db.cursor(), pkg)),                                       (self.db.cursor(), pkg)),
571                      caption=('Bug', 'Description'),                          caption=('DSA', 'Description'),
572                      replacement="""No known issues which do not affect                          replacement='No known security announcements.')
573  this package, but still reference it.""")])               ])
574    
575      def page_status_release_stable_oldstable(self, release, params, url):      def page_status_release_stable_oldstable(self, release, params, url):
576          assert release in ('stable', 'oldstable')          assert release in ('stable', 'oldstable')
# Line 599  this package, but still reference it.""" Line 579  this package, but still reference it."""
579    
580          def gen():          def gen():
581              old_pkg_name = ''              old_pkg_name = ''
582              for (pkg_name, bug_name, archive, urgency, remote, no_dsa) in \              for (pkg_name, bug_name, archive, urgency, vulnerable, remote, no_dsa) in \
583                      self.db.cursor().execute(                      self.db.cursor().execute(
584                  """SELECT package, bug, section, urgency, remote, no_dsa                  """SELECT package, bug, section, urgency, vulnerable, remote, no_dsa
585                  FROM %s_status""" % release):                  FROM %s_status""" % release):
586                  if bf.urgencyFiltered(urgency):                  if bf.urgencyFiltered(urgency, vulnerable):
587                      continue                      continue
588                  if bf.remoteFiltered(remote):                  if bf.remoteFiltered(remote):
589                      continue                      continue
590                  if bf.nodsaFiltered(no_dsa):                  if bf.nodsaFiltered(no_dsa):
591                      continue                      continue
592    
593                  if pkg_name == old_pkg_name:                  if pkg_name == old_pkg_name:
594                      pkg_name = ''                      pkg_name = ''
595                  else:                  else:
# Line 618  this package, but still reference it.""" Line 598  this package, but still reference it."""
598                          pkg_name = "%s (%s)" % (pkg_name, archive)                          pkg_name = "%s (%s)" % (pkg_name, archive)
599    
600                  if remote is None:                  if remote is None:
601                      remote = ''                      remote = '???'
602                  elif remote:                  elif remote:
603                      remote = 'yes'                      remote = 'yes'
604                  else:                  else:
605                      remote = 'no'                      remote = 'no'
606    
607                  if urgency == 'unknown':                  if urgency.startswith('high'):
                     if no_dsa:  
                         urgency = 'no DSA'  
                     else:  
                         urgency = ''  
                 elif urgency == 'high':  
608                      urgency = self.make_red(urgency)                      urgency = self.make_red(urgency)
609                    elif vulnerable == 2:
610                        urgency = self.make_purple(urgency)
611                  else:                  else:
612                      if no_dsa:                      if no_dsa:
613                          urgency = urgency + '*'                          urgency = urgency + '*'
# Line 639  this package, but still reference it.""" Line 616  this package, but still reference it."""
616    
617          return self.create_page(          return self.create_page(
618              url, 'Vulnerable source packages in the %s suite' % release,              url, 'Vulnerable source packages in the %s suite' % release,
619              [bf.actions(url),              [bf.actions(url), BR(),
620               make_table(gen(), caption=("Package", "Bug", "Urgency",               make_table(gen(), caption=("Package", "Bug", "Urgency", "Remote")),
621                                          "Remote")),               P('''If a "*" is included in the urgency field, no DSA is planned
622               P('''(If a "*" is included in the urgency field, no DSA is planned                    for this vulnerability.'''),
623  for this vulnerability.)''')])               self.nvd_text])
624    
625      def page_status_release_stable(self, path, params, url):      def page_status_release_stable(self, path, params, url):
626          return self.page_status_release_stable_oldstable('stable', params, url)          return self.page_status_release_stable_oldstable('stable', params, url)
# Line 656  for this vulnerability.)''')]) Line 633  for this vulnerability.)''')])
633    
634          def gen():          def gen():
635              old_pkg_name = ''              old_pkg_name = ''
636              for (pkg_name, bug_name, archive, urgency,              for (pkg_name, bug_name, archive, urgency, vulnerable,
637                   sid_vulnerable, ts_fixed, remote, no_dsa) \                   sid_vulnerable, ts_fixed, remote, no_dsa) \
638                   in self.db.cursor().execute(                   in self.db.cursor().execute(
639                  """SELECT package, bug, section, urgency, unstable_vulnerable,                  """SELECT package, bug, section, urgency, vulnerable,
640                  testing_security_fixed, remote, no_dsa                  unstable_vulnerable, testing_security_fixed, remote, no_dsa
641                  FROM testing_status"""):                  FROM testing_status"""):
642                  if bf.urgencyFiltered(urgency):                  if bf.urgencyFiltered(urgency, vulnerable):
643                      continue                      continue
644                  if bf.remoteFiltered(remote):                  if bf.remoteFiltered(remote):
645                      continue                      continue
# Line 677  for this vulnerability.)''')]) Line 654  for this vulnerability.)''')])
654                          pkg_name = "%s (%s)" % (pkg_name, archive)                          pkg_name = "%s (%s)" % (pkg_name, archive)
655    
656                  if remote is None:                  if remote is None:
657                      remote = ''                      remote = '???'
658                  elif remote:                  elif remote:
659                      remote = 'yes'                      remote = 'yes'
660                  else:                  else:
# Line 691  for this vulnerability.)''')]) Line 668  for this vulnerability.)''')])
668                      else:                      else:
669                          status = self.make_dangerous('fixed in unstable')                          status = self.make_dangerous('fixed in unstable')
670    
671                  if urgency == 'unknown':                  if urgency.startswith('high'):
672                      urgency = ''                      urgency = self.make_red(urgency)
673                    elif vulnerable == 2:
674                        urgency = self.make_purple(urgency)
675    
676                  yield (pkg_name, self.make_xref(url, bug_name),                  yield (pkg_name, self.make_xref(url, bug_name),
677                         urgency, remote, status)                         urgency, remote, status)
# Line 701  for this vulnerability.)''')]) Line 680  for this vulnerability.)''')])
680              url, 'Vulnerable source packages in the testing suite',              url, 'Vulnerable source packages in the testing suite',
681              [make_menu(url.scriptRelative,              [make_menu(url.scriptRelative,
682                         ("status/dtsa-candidates", "Candidates for DTSAs")),                         ("status/dtsa-candidates", "Candidates for DTSAs")),
683               bf.actions(url),               bf.actions(url), BR(),
684               make_table(gen(), caption=("Package", "Bug", "Urgency",               make_table(gen(), caption=("Package", "Bug", "Urgency", "Remote")),
685                                          "Remote"))])               self.nvd_text])
686    
687      def page_status_release_unstable_like(self, path, params, url,      def page_status_release_unstable_like(self, path, params, url,
688                                            rel, title):                                            rel, title):
# Line 711  for this vulnerability.)''')]) Line 690  for this vulnerability.)''')])
690    
691          def gen():          def gen():
692              old_pkg_name = ''              old_pkg_name = ''
693              for (pkg_name, bug_name, section, urgency, remote) \              for (pkg_name, bug_name, section, urgency, vulnerable, remote) \
694                      in self.db.cursor().execute(                      in self.db.cursor().execute(
695                  """SELECT DISTINCT sp.name, st.bug_name,                  """SELECT DISTINCT sp.name, st.bug_name,
696                  sp.archive, st.urgency,                  sp.archive, st.urgency, st.vulnerable,
697                  (SELECT range_remote FROM nvd_data                  (SELECT range_remote FROM nvd_data
698                   WHERE cve_name = st.bug_name)                   WHERE cve_name = st.bug_name)
699                  FROM source_package_status AS st, source_packages AS sp                  FROM source_package_status AS st, source_packages AS sp
700                  WHERE st.vulnerable AND st.urgency <> 'unimportant'                  WHERE st.vulnerable AND sp.rowid = st.package
701                  AND sp.rowid = st.package AND sp.release = ?                  AND sp.release = ?  AND sp.subrelease = ''
                 AND sp.subrelease = ''  
702                  ORDER BY sp.name, st.bug_name""", (rel,)):                  ORDER BY sp.name, st.bug_name""", (rel,)):
703                  if bf.urgencyFiltered(urgency):                  if bf.urgencyFiltered(urgency, vulnerable):
704                      continue                      continue
705                  if bf.remoteFiltered(remote):                  if bf.remoteFiltered(remote):
706                      continue                      continue
# Line 737  for this vulnerability.)''')]) Line 715  for this vulnerability.)''')])
715                          pkg_name = self.make_xref(url, pkg_name)                          pkg_name = self.make_xref(url, pkg_name)
716    
717                  if remote is None:                  if remote is None:
718                      remote = ''                      remote = '???'
719                  elif remote:                  elif remote:
720                      remote = 'yes'                      remote = 'yes'
721                  else:                  else:
722                      remote = 'no'                      remote = 'no'
723    
724                  if urgency == 'unknown':                  if urgency.startswith('high'):
                     urgency = ''  
                 elif urgency == 'high':  
725                      urgency = self.make_red(urgency)                      urgency = self.make_red(urgency)
726                    elif vulnerable == 2:
727                        urgency = self.make_purple(urgency)
728    
729                  yield pkg_name, self.make_xref(url, bug_name), urgency, remote                  yield pkg_name, self.make_xref(url, bug_name), urgency, remote
730    
731          return self.create_page(          return self.create_page(
732              url, title,              url, title,
733              [P("""Note that the list below is based on source packages.              [P("""Note that the list below is based on source packages.
# Line 756  for this vulnerability.)''')]) Line 735  for this vulnerability.)''')])
735              fixed source version has been uploaded to the archive, even              fixed source version has been uploaded to the archive, even
736              if there are still some vulnerably binary packages present              if there are still some vulnerably binary packages present
737              in the archive."""),              in the archive."""),
738               bf.actions(url),               bf.actions(url), BR(),
739               make_table(gen(), caption=('Package', 'Bug', 'Urgency',               make_table(gen(), caption=('Package', 'Bug', 'Urgency', 'Remote')),
740                                          'Remote'))])               self.nvd_text])
741    
742      def page_status_release_unstable(self, path, params, url):      def page_status_release_unstable(self, path, params, url):
743          return self.page_status_release_unstable_like(          return self.page_status_release_unstable_like(
# Line 770  for this vulnerability.)''')]) Line 749  for this vulnerability.)''')])
749          return self.page_status_release_unstable_like(          return self.page_status_release_unstable_like(
750              path, params, url,              path, params, url,
751              title='Vulnerable source packages among backports for stable',              title='Vulnerable source packages among backports for stable',
752              rel='lenny-backports')              rel='squeeze-backports')
753    
754      def page_status_release_oldstable_backports(self, path, params, url):      def page_status_release_oldstable_backports(self, path, params, url):
755          return self.page_status_release_unstable_like(          return self.page_status_release_unstable_like(
756              path, params, url,              path, params, url,
757              title='Vulnerable source packages among backports for oldstable',              title='Vulnerable source packages among backports for oldstable',
758              rel='etch-backports')              rel='lenny-backports')
759    
760      def page_status_dtsa_candidates(self, path, params, url):      def page_status_dtsa_candidates(self, path, params, url):
761          bf = BugFilter(params)          bf = BugFilter(params)
762    
763          def gen():          def gen():
764              old_pkg_name = ''              old_pkg_name = ''
765              for (pkg_name, bug_name, archive, urgency, stable_later,              for (pkg_name, bug_name, archive, urgency, vulnerable,
766                   remote) \                   stable_later, remote) \
767                      in self.db.cursor().execute(                      in self.db.cursor().execute(
768                  """SELECT package, bug, section, urgency,                  """SELECT package, bug, section, urgency, vulnerable,
769                  (SELECT testing.version_id < stable.version_id                  (SELECT testing.version_id < stable.version_id
770                   FROM source_packages AS testing, source_packages AS stable                   FROM source_packages AS testing, source_packages AS stable
771                   WHERE testing.name = testing_status.package                   WHERE testing.name = testing_status.package
772                   AND testing.release = 'squeeze'                   AND testing.release = 'wheezy'
773                   AND testing.subrelease = ''                   AND testing.subrelease = ''
774                   AND testing.archive = testing_status.section                   AND testing.archive = testing_status.section
775                   AND stable.name = testing_status.package                   AND stable.name = testing_status.package
776                   AND stable.release = 'lenny'                   AND stable.release = 'squeeze'
777                   AND stable.subrelease = 'security'                   AND stable.subrelease = 'security'
778                   AND stable.archive = testing_status.section),                   AND stable.archive = testing_status.section),
779                  (SELECT range_remote FROM nvd_data                  (SELECT range_remote FROM nvd_data
# Line 802  for this vulnerability.)''')]) Line 781  for this vulnerability.)''')])
781                  FROM testing_status                  FROM testing_status
782                  WHERE (NOT unstable_vulnerable)                  WHERE (NOT unstable_vulnerable)
783                  AND (NOT testing_security_fixed)"""):                  AND (NOT testing_security_fixed)"""):
784                  if bf.urgencyFiltered(urgency):                  if bf.urgencyFiltered(urgency, vulnerable):
785                      continue                      continue
786                  if bf.remoteFiltered(remote):                  if bf.remoteFiltered(remote):
787                      continue                      continue
# Line 820  for this vulnerability.)''')]) Line 799  for this vulnerability.)''')])
799                          pkg_name = self.make_source_package_ref(url, pkg_name)                          pkg_name = self.make_source_package_ref(url, pkg_name)
800    
801                  if remote is None:                  if remote is None:
802                      remote = ''                      remote = '???'
803                  elif remote:                  elif remote:
804                      remote = 'yes'                      remote = 'yes'
805                  else:                  else:
806                      remote = 'no'                      remote = 'no'
807    
808                  if urgency == 'unknown':                  if urgency.startswith('high'):
                     urgency = ''  
                 elif urgency == 'high':  
809                      urgency = self.make_red(urgency)                      urgency = self.make_red(urgency)
810                    elif vulnerable == 2:
811                        urgency = self.make_purple(urgency)
812    
813                  if stable_later:                  if stable_later:
814                      notes = "(fixed in stable?)"                      notes = "(fixed in stable?)"
# Line 847  checker to find out why they have not en Line 826  checker to find out why they have not en
826               make_menu(url.scriptRelative,               make_menu(url.scriptRelative,
827                         ("status/release/testing",                         ("status/release/testing",
828                          "List of vulnerable packages in testing")),                          "List of vulnerable packages in testing")),
829               bf.actions(url),               bf.actions(url), BR(),
830               make_table(gen(),               make_table(gen(),
831                          caption=("Package", "Migration", "Bug", "Urgency",                          caption=("Package", "Migration", "Bug", "Urgency",
832                                   "Remote"))])                                   "Remote"))])
# Line 862  checker to find out why they have not en Line 841  checker to find out why they have not en
841                    'Hide "check" TODOs')                    'Hide "check" TODOs')
842    
843          def gen():          def gen():
844              for (bug, description) in self.db.getTODOs(hide_check=hide_check):              for (bug, description, note) in self.db.getTODOs(hide_check=hide_check):
845                  yield self.make_xref(url, bug), description                  yield self.make_xref(url, bug), description, note
846          return self.create_page(          return self.create_page(
847              url, "Bugs with TODO items",              url, 'Bugs with TODO items',
848              [P(flags),              [P(flags), make_table(gen(), caption=('Bug', 'Description', 'Note'))])
849               make_table(gen(),  
850                          caption=("Bug", "Description"))])      def page_status_undetermined(self, path, params, url):
851            def gen():
852                outrel = []
853                old_bug = ''
854                old_pkg = ''
855                old_dsc = ''
856                last_displayed = ''
857                releases = ('sid', 'wheezy', 'squeeze', 'lenny')
858                for (pkg_name, bug_name, release, desc) in self.db.cursor().execute(
859                        """SELECT DISTINCT sp.name, st.bug_name, sp.release,
860                        bugs.description
861                        FROM source_package_status AS st, source_packages AS sp, bugs
862                        WHERE st.vulnerable == 2 AND sp.rowid = st.package
863                        AND ( sp.release = ? OR sp.release = ? OR sp.release = ?
864                        OR sp.release = ? )
865                        AND sp.subrelease = '' AND st.bug_name == bugs.name
866                        ORDER BY sp.name, st.bug_name""", releases):
867    
868                    if old_bug == '':
869                        old_bug = bug_name
870                        old_pkg = pkg_name
871                        old_dsc = desc
872                    elif old_bug != bug_name:
873                        if old_pkg == last_displayed:
874                            to_display = ''
875                        else:
876                            to_display = old_pkg
877                        yield to_display, self.make_xref(url, old_bug), old_dsc, ', '.join(outrel)
878                        last_displayed = old_pkg
879                        old_bug = bug_name
880                        old_pkg = pkg_name
881                        old_dsc = desc
882                        outrel = []
883                    outrel.append( release )
884                yield old_pkg, self.make_xref(url, old_bug), old_dsc, ', '.join(outrel)
885    
886            return self.create_page(url, 'Packages that may be vulnerable but need to be checked      (undetermined issues)',
887                [P("""This page lists packages that may or may not be affected
888                by known issues.  This means that some additional work needs to
889                be done to determined whether the package is actually
890                vulnerable or not.  This list is a good area for new
891                contributors to make quick and meaningful contributions."""),
892                make_table(gen(), caption=('Package', 'Bug', 'Description', 'Releases'))])
893    
894        def page_status_unimportant(self, path, params, url):
895            def gen():
896                outrel = []
897                old_bug = ''
898                old_pkg = ''
899                old_dsc = ''
900                old_name = ''
901                last_displayed = ''
902                releases = ('sid', 'wheezy', 'squeeze', 'lenny')
903                for (pkg_name, bug_name, release, desc) in self.db.cursor().execute(
904                        """SELECT DISTINCT sp.name, st.bug_name, sp.release,
905                        bugs.description
906                        FROM source_package_status AS st, source_packages AS sp, bugs
907                        WHERE st.vulnerable > 0 AND sp.rowid = st.package
908                        AND ( sp.release = ? OR sp.release = ? OR sp.release = ?
909                        OR sp.release = ? ) AND st.urgency == 'unimportant'
910                        AND sp.subrelease = '' AND st.bug_name == bugs.name
911                        ORDER BY sp.name, st.bug_name""", releases):
912    
913                    if old_bug == '':
914                        old_bug = bug_name
915                        old_pkg = pkg_name
916                        old_dsc = desc
917                    elif old_bug != bug_name:
918                        if old_pkg == last_displayed:
919                            to_display = ''
920                        else:
921                            to_display = old_pkg
922                        yield to_display, self.make_xref(url, old_bug), old_dsc, ', '.join(outrel)
923                        last_displayed = old_pkg
924                        old_bug = bug_name
925                        old_pkg = pkg_name
926                        old_dsc = desc
927                        outrel = []
928                    outrel.append( release )
929                yield old_pkg, self.make_xref(url, old_bug), old_dsc, ', '.join(outrel)
930    
931            return self.create_page(url, 'Packages that have open unimportant issues',
932                [P("""This page lists packages that are affected by issues
933                that are considered unimportant from a security perspective.
934                These issues are thought to be unexploitable or uneffective
935                in most situations (for example, browser denial-of-services)."""),
936                make_table(gen(), caption=('Package', 'Bug', 'Description', 'Releases'))])
937    
938      def page_status_itp(self, path, params, url):      def page_status_itp(self, path, params, url):
939          def gen():          def gen():
# Line 1060  Debian bug number.'''), Line 1125  Debian bug number.'''),
1125               make_table(gen(),               make_table(gen(),
1126                          caption=("Bug", "Description"))])                          caption=("Bug", "Description"))])
1127    
1128        def page_data_pts(self, path, params, url):
1129            data = []
1130            for pkg, bugs in self.db.cursor().execute(
1131                    """SELECT package, COUNT(DISTINCT bug) FROM
1132                    (SELECT package, bug, urgency FROM stable_status
1133                     UNION ALL SELECT DISTINCT sp.name, st.bug_name, st.urgency
1134                       FROM source_package_status AS st, source_packages AS sp
1135                       WHERE st.vulnerable AND st.urgency <> 'unimportant'
1136                       AND sp.rowid = st.package AND sp.release = 'sid'
1137                       AND sp.subrelease = '') x WHERE urgency <> 'unimportant'
1138                    GROUP BY package ORDER BY package"""):
1139                data.append(pkg)
1140                data.append(':')
1141                data.append(str(bugs))
1142                data.append('\n')
1143            return BinaryResult(''.join(data))
1144    
1145      def page_debsecan(self, path, params, url):      def page_debsecan(self, path, params, url):
1146          obj = '/'.join(path)          obj = '/'.join(path)
1147          data = self.db.getDebsecan(obj)          data = self.db.getDebsecan(obj)
# Line 1081  Debian bug number.'''), Line 1163  Debian bug number.'''),
1163                               "Testing Security Team"),                               "Testing Security Team"),
1164                      " - ", A(url.absolute("http://www.debian.org/security/"),                      " - ", A(url.absolute("http://www.debian.org/security/"),
1165                               "Debian Security"),                               "Debian Security"),
1166                      " - ", A(url.absolute                      " - ", A(url.absolute("http://anonscm.debian.org/viewvc/secure-testing/bin/tracker_service.py?view=markup"),
1167                               ("http://www.enyo.de/fw/impressum.html"),                               "Source"),
1168                               "Imprint")))                      " ", A(url.absolute("svn://svn.debian.org/secure-testing"), "(SVN)"),
1169                        ))
1170          if search_in_page:          if search_in_page:
1171              on_load = "selectSearch()"              on_load = "selectSearch()"
1172          else:          else:
# Line 1111  Debian bug number.'''), Line 1194  Debian bug number.'''),
1194      def url_nvd(self, url, name):      def url_nvd(self, url, name):
1195          return url.absolute("http://web.nvd.nist.gov/view/vuln/detail",          return url.absolute("http://web.nvd.nist.gov/view/vuln/detail",
1196                              vulnId=name)                              vulnId=name)
1197        def url_rhbug(self, url, name):
1198            return url.absolute("https://bugzilla.redhat.com/show_bug.cgi",
1199                                id=name)
1200        def url_ubuntu_bug(self, url, name):
1201            return url.absolute("http://people.canonical.com/~ubuntu-security/cve/%s" % name)
1202        def url_gentoo_bug(self, url, name):
1203            return url.absolute("http://bugs.gentoo.org/show_bug.cgi", id=name)
1204    
1205      def url_dsa(self, url, dsa, re_dsa=re.compile(r'^DSA-(\d+)(?:-\d+)?$')):      def url_dsa(self, url, dsa, re_dsa=re.compile(r'^DSA-(\d+)(?:-\d+)?$')):
1206          match = re_dsa.match(dsa)          match = re_dsa.match(dsa)
# Line 1141  Debian bug number.'''), Line 1231  Debian bug number.'''),
1231              return url.scriptRelativeFull("source-package/" + package)              return url.scriptRelativeFull("source-package/" + package)
1232          else:          else:
1233              return url.scriptRelative("source-package/" + package)              return url.scriptRelative("source-package/" + package)
     def url_binary_package(self, url, package, full=False):  
         if full:  
             return url.scriptRelativeFull("binary-package/" + package)  
         else:  
             return url.scriptRelative("binary-package/" + package)  
1234    
1235      def make_xref(self, url, name):      def make_xref(self, url, name):
1236          return A(url.scriptRelative(name), name)          return A(url.scriptRelative(name), name)
# Line 1167  Debian bug number.'''), Line 1252  Debian bug number.'''),
1252          if name is None:          if name is None:
1253              name = cve              name = cve
1254          return A(self.url_nvd(url, cve), name)          return A(self.url_nvd(url, cve), name)
1255    
1256        def make_rhbug_ref(self, url, cve, name=None):
1257            if name is None:
1258                name = cve
1259            return A(self.url_rhbug(url, cve), name)
1260    
1261        def make_ubuntu_bug_ref(self, url, cve, name=None):
1262            if name is None:
1263                name = cve
1264            return A(self.url_ubuntu_bug(url, cve), name)
1265    
1266        def make_gentoo_bug_ref(self, url, cve, name=None):
1267            if name is None:
1268                name = cve
1269            return A(self.url_gentoo_bug(url, cve), name)
1270    
1271      def make_dsa_ref(self, url, dsa, name=None):      def make_dsa_ref(self, url, dsa, name=None):
1272          if name is None:          if name is None:
# Line 1186  Debian bug number.'''), Line 1286  Debian bug number.'''),
1286          if title is None:          if title is None:
1287              title = pkg              title = pkg
1288          return A(self.url_source_package(url, pkg), title)          return A(self.url_source_package(url, pkg), title)
     def make_binary_package_ref(self, url, pkg, title=None):  
         if title is None:  
             title = pkg  
         return A(self.url_binary_package(url, pkg), title)  
     def make_binary_packages_ref(self, url, lst):  
         assert type(lst) <> types.StringType  
         return make_list(map(lambda x: self.make_binary_package_ref(url, x),  
                              lst))  
1289    
1290      def make_red(self, contents):      def make_red(self, contents):
1291          return SPAN(contents, _class="red")          return SPAN(contents, _class="red")
1292    
1293        def make_purple(self, contents):
1294            return SPAN(contents, _class="purple")
1295    
1296      def make_dangerous(self, contents):      def make_dangerous(self, contents):
1297          return SPAN(contents, _class="dangerous")          return SPAN(contents, _class="dangerous")
1298    
1299      def pre_dispatch(self):      def pre_dispatch(self):
1300          self.db.refresh()          pass
1301    
1302  TrackerService(socket_name, db_name).run()  TrackerService(socket_name, db_name).run()
Legend:
Removed from v.11223  
changed lines
  Added in v.18900
  ViewVC Help
Powered by ViewVC 1.1.5