Merge pull request #43 from WSE-research/42-mysql-controller

42 mysql controller

code/AmIVulnerable/AmIVulnerable.sln

@@ -7,8 +7,6 @@ Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "AmIVulnerable", "AmIVulnera
 EndProject
 Project("{E53339B2-1760-4266-BCC7-CA923CBCF16C}") = "docker-compose", "docker-compose.dcproj", "{62D82FEA-37BC-41E2-A628-27C3B32E34AC}"
 EndProject
-Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "LiteDbLib", "LiteDbLib\LiteDbLib.csproj", "{A58AA5A3-E651-422C-AE34-A857DBD283AF}"
-EndProject
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Modells", "Modells\Modells.csproj", "{03B60F6F-8975-4531-8B21-F2EAEE0B5B17}"
 EndProject
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "AmIVulnerable.Test", "AmIVulnerable.Test\AmIVulnerable.Test.csproj", "{D298A9EB-0556-4734-A5B8-52D58D4A994A}"
@@ -32,10 +30,6 @@ Global
 		{62D82FEA-37BC-41E2-A628-27C3B32E34AC}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{62D82FEA-37BC-41E2-A628-27C3B32E34AC}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{62D82FEA-37BC-41E2-A628-27C3B32E34AC}.Release|Any CPU.Build.0 = Release|Any CPU
-		{A58AA5A3-E651-422C-AE34-A857DBD283AF}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
-		{A58AA5A3-E651-422C-AE34-A857DBD283AF}.Debug|Any CPU.Build.0 = Debug|Any CPU
-		{A58AA5A3-E651-422C-AE34-A857DBD283AF}.Release|Any CPU.ActiveCfg = Release|Any CPU
-		{A58AA5A3-E651-422C-AE34-A857DBD283AF}.Release|Any CPU.Build.0 = Release|Any CPU
 		{03B60F6F-8975-4531-8B21-F2EAEE0B5B17}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{03B60F6F-8975-4531-8B21-F2EAEE0B5B17}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{03B60F6F-8975-4531-8B21-F2EAEE0B5B17}.Release|Any CPU.ActiveCfg = Release|Any CPU

code/AmIVulnerable/AmIVulnerable/AmIVulnerable.csproj

@@ -29,7 +29,7 @@
   </ItemGroup>
 
   <ItemGroup>
-    <ProjectReference Include="..\LiteDbLib\LiteDbLib.csproj" />
+    <ProjectReference Include="..\Modells\Modells.csproj" />
   </ItemGroup>
 
 </Project>

code/AmIVulnerable/AmIVulnerable/Controllers/DependeciesController.cs

@@ -1,8 +1,10 @@
-using LiteDbLib.Controller;
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 using Modells;
 using Modells.Packages;
+using MySql.Data.MySqlClient;
 using Newtonsoft.Json;
+using SerilogTimings;
+using System.Data;
 using System.Diagnostics;
 using System.Text.Json;
 using F = System.IO.File;
@@ -13,6 +15,14 @@ namespace AmIVulnerable.Controllers {
     [ApiController]
     public class DependeciesController : ControllerBase {
 
+        #region Config
+        private readonly IConfiguration Configuration;
+
+        public DependeciesController(IConfiguration configuration) {
+            Configuration = configuration;
+        }
+        #endregion
+
         /// <summary>
         /// Extract dependecies of different project types as json
         /// </summary>
@@ -43,23 +53,25 @@ public IActionResult ExtractDependencies([FromHeader] ProjectType projectType) {
         [HttpGet]
         [Route("ExtractAndAnalyzeTree")]
         public async Task<IActionResult> ExtractAndAnalyzeTreeAsync([FromHeader] ProjectType projectType) {
-            switch (projectType) {
-                case ProjectType.NodeJs: {
-                        ExecuteCommand("npm", "install");
-                        ExecuteCommand("del", "tree.json");
-                        ExecuteCommand("npm", "list --all --json >> tree.json");
-                        List<NodePackage> depTree = ExtractTree(AppDomain.CurrentDomain.BaseDirectory + "rawAnalyze/tree.json");
-                        List<NodePackageResult> resTree = await analyzeTreeAsync(depTree) ?? [];
-                        if (resTree.Count != 0) {
-                            return Ok(JsonConvert.SerializeObject(resTree));
+            using (Operation.Time($"ExtractAndAnalyzeTreeAsync called with procjectType {projectType.ToString()}")) {
+                switch (projectType) {
+                    case ProjectType.NodeJs: {
+                            ExecuteCommand("npm", "install");
+                            ExecuteCommand("del", "tree.json");
+                            ExecuteCommand("npm", "list --all --json >> tree.json");
+                            List<NodePackage> depTree = ExtractTree("rawAnalyze/tree.json");
+                            List<NodePackageResult> resTree = await analyzeTreeAsync(depTree) ?? [];
+                            if (resTree.Count != 0) {
+                                return Ok(JsonConvert.SerializeObject(resTree));
+                            }
+                            else {
+                                return StatusCode(299, "Keine Schwachstelle gefunden.");
+                            }
                         }
-                        else {
-                            return StatusCode(299, "Keine Schwachstelle gefunden.");
+                    default: {
+                            return BadRequest();
                         }
-                    }
-                default: {
-                        return BadRequest();
-                    }
+                }
             }
         }
 
@@ -70,9 +82,9 @@ public async Task<IActionResult> ExtractAndAnalyzeTreeAsync([FromHeader] Project
         /// <param name="command">Command used for programm</param>
         private void ExecuteCommand(string prog, string command) {
             ProcessStartInfo process = new ProcessStartInfo {
-                FileName = "cmd",
+                FileName = "bash",
                 RedirectStandardInput = true,
-                WorkingDirectory = AppDomain.CurrentDomain.BaseDirectory + "rawAnalyze",
+                WorkingDirectory = "rawAnalyze",
             };
             Process runProcess = Process.Start(process)!;
             runProcess.StandardInput.WriteLine($"{prog} {command}");
@@ -141,28 +153,68 @@ private NodePackage ExtractDependencyInfo(JsonProperty dependency) {
                     }
                 }
             }
+
             // analyze list
-            SearchDbController searchDbController = new SearchDbController();
-            List<string> designation = [];
+            List<CveResult> cveResults = [];
             foreach (Tuple<string, string> x in nodePackages) {
-                designation.Add(x.Item1);
+                DataTable dtResult = SearchInMySql(x.Item1);
+                // convert the result
+                foreach (DataRow y in dtResult.Rows) {
+                    CveResult z = new CveResult() {
+                        CveNumber = y["cve_number"].ToString() ?? "",
+                        Designation = y["designation"].ToString() ?? "",
+                        Version = y["version_affected"].ToString() ?? ""
+                    };
+                    CVEcomp temp = JsonConvert.DeserializeObject<CVEcomp>(y["full_text"].ToString() ?? string.Empty) ?? new CVEcomp();
+                    try {
+                        if (temp.containers.cna.metrics.Count != 0) {
+                            z.CvssV31 = temp.containers.cna.metrics[0].cvssV3_1;
+                        }
+                        if (temp.containers.cna.descriptions.Count != 0) {
+                            z.Description = temp.containers.cna.descriptions[0];
+                        }
+                    }
+                    finally {
+                        cveResults.Add(z);
+                    }
+                }
             }
 
-            List<CveResult> results = await searchDbController.SearchPackagesAsList(designation);
-            //List<CveResult> results = searchDbController.SearchPackagesAsListMono(designation);
-
             // find the critical points
-            if (results.Count == 0) {
+            if (cveResults.Count == 0) {
                 return null;
             }
             List<NodePackageResult?> resulstList = [];
             foreach (NodePackage x in depTree) {
-                NodePackageResult? temp = checkVulnerabilities(x, results);
+                NodePackageResult? temp = checkVulnerabilities(x, cveResults);
                 if (temp is not null) {
                     resulstList.Add(temp);
                 }
             }
             return resulstList;
+            #region oldcode
+            //SearchDbController searchDbController = new SearchDbController();
+            //List<string> designation = [];
+            //foreach (Tuple<string, string> x in nodePackages) {
+            //    designation.Add(x.Item1);
+            //}
+
+            //List<CveResult> results = await searchDbController.SearchPackagesAsList(designation);
+            ////List<CveResult> results = searchDbController.SearchPackagesAsListMono(designation);
+
+            //// find the critical points
+            //if (results.Count == 0) {
+            //    return null;
+            //}
+            //List<NodePackageResult?> resulstListOld = [];
+            //foreach (NodePackage x in depTree) {
+            //    NodePackageResult? temp = checkVulnerabilities(x, results);
+            //    if (temp is not null) {
+            //        resulstList.Add(temp);
+            //    }
+            //}
+            //return resulstList;
+            #endregion
         }
 
         /// <summary>
@@ -230,5 +282,25 @@ private bool depCheck(NodePackageResult package) {
             isTrue:
             return true;
         }
+
+        private DataTable SearchInMySql(string packageName) {
+            // MySql Connection
+            MySqlConnection connection = new MySqlConnection(Configuration["ConnectionStrings:cvedb"]);
+
+            MySqlCommand cmd = new MySqlCommand($"" +
+                $"SELECT cve_number, designation, version_affected, full_text " +
+                $"FROM cve.cve " +
+                $"WHERE designation='{packageName}';", connection);
+
+            DataTable dataTable = new DataTable();
+            using (Operation.Time($"Query-Time for Package \"{packageName}\"")) {
+                // read the result
+                connection.Open();
+                MySqlDataReader reader = cmd.ExecuteReader();
+                dataTable.Load(reader);
+                connection.Close();
+            }
+            return dataTable;
+        }
     }
 }

code/AmIVulnerable/AmIVulnerable/Controllers/GitController.cs

@@ -1,5 +1,7 @@
-using Microsoft.AspNetCore.Mvc;
+using LibGit2Sharp;
+using Microsoft.AspNetCore.Mvc;
 using System.Diagnostics;
+using System.Security.Policy;
 using CM = System.Configuration.ConfigurationManager;
 
 namespace AmIVulnerable.Controllers {
@@ -8,6 +10,17 @@ namespace AmIVulnerable.Controllers {
     [ApiController]
     public class GitController : ControllerBase {
 
+        /// <summary></summary>
+        private readonly IConfiguration Configuration;
+
+        /// <summary></summary>
+        /// <param name="configuration"></param>
+        public GitController(IConfiguration configuration) {
+            Configuration = configuration;
+        }
+
+        private static bool isFinished = false;
+
         /// <summary>
         /// API-Post route to clone a git repository
         /// </summary>
@@ -19,7 +32,6 @@ public class GitController : ControllerBase {
         public IActionResult CloneRepo([FromHeader] bool cveRaw, [FromBody] Tuple<string, string> data) {
         //public IActionResult CloneRepo([FromHeader] string? url) {
             try {
-                CM.AppSettings["CloneFinished"] = "false";
                 if (cveRaw) {
                     if (data.Item1.Equals("")) { // nothing, so use standard
                         if (data.Item2.Equals("")) { //nothing, so use standard
@@ -44,6 +56,32 @@ public IActionResult CloneRepo([FromHeader] bool cveRaw, [FromBody] Tuple<string
             }
         }
 
+        [HttpGet]
+        [Route("pullCveAndConvert")]
+        public async Task<IActionResult> PullAndConvertCveFiles() {
+             try {
+                ProcessStartInfo process = new ProcessStartInfo {
+                    FileName = "cmd",
+                    RedirectStandardInput = true,
+                    WorkingDirectory = $"",
+                };
+
+                Process runProcess = Process.Start(process)!;
+                runProcess.StandardInput.WriteLine($"git " +
+                    $"clone {CM.AppSettings["StandardCveUrlPlusTag"]!} " +  // git url
+                    $"--branch cve_2023-12-31_at_end_of_day " +             // tag
+                    $"raw");                                                // target dir
+                runProcess.StandardInput.WriteLine($"exit");
+                runProcess.WaitForExit();
+
+                DbController dbC = new DbController(Configuration);
+                return dbC.ConvertRawFilesToMySql();
+            }
+            catch (Exception ex) {
+                return BadRequest(ex.Message);
+            }
+        }
+
         /// <summary>
         /// Clone a git repository.
         /// </summary>
@@ -52,37 +90,40 @@ public IActionResult CloneRepo([FromHeader] bool cveRaw, [FromBody] Tuple<string
         /// <param name="dir">Directory where to clone project into.</param>
         /// <returns></returns>
         private static async Task Clone(string url, string tag, string dir){
-            await Task.Run(() => {
-                if (Directory.Exists(AppDomain.CurrentDomain.BaseDirectory + dir)) {
-                    string targetDir = AppDomain.CurrentDomain.BaseDirectory + dir;
-                    RemoveReadOnlyAttribute(targetDir);
-                    Directory.Delete(targetDir, true);
-                }
-                if (tag.Equals("")) {
-                    Process.Start("git.exe", $"clone {url} {AppDomain.CurrentDomain.BaseDirectory}{dir}");
-                }
-                else {
-                    try {
-                        Process.Start("git.exe", $"clone {url} --branch {tag} {AppDomain.CurrentDomain.BaseDirectory}{dir}");
+            try {
+                await Task.Run(() => {
+                    if (Directory.Exists(dir)) {
+                        RemoveReadOnlyAttribute(dir);
+                        Directory.Delete(dir, true);
                     }
-                    catch (Exception ex) {
-                        Console.WriteLine("Error with clone, tag?\n" + ex.Message);
-                        return; // leave CloneFinished false
+                    if (tag.Equals("")) {
+                        Process.Start("git", $"clone {url} {dir}");
                     }
-                }
-                #region For Reminder
-                //if (s) {
-                //    Repository.Clone(url, AppDomain.CurrentDomain.BaseDirectory + "raw", new CloneOptions {
-                //        BranchName = "cve_2023-12-31_at_end_of_day",
-                //        IsBare = true,
-                //    });
-                //}
-                //else {
-                //    Repository.Clone(url, AppDomain.CurrentDomain.BaseDirectory + "raw");
-                //}
-                #endregion
-                CM.AppSettings["CloneFinished"] = "true";
-            });
+                    else {
+                        try {
+                            Process.Start("git", $"clone {url} --branch {tag} {AppDomain.CurrentDomain.BaseDirectory}{dir}");
+                        }
+                        catch (Exception ex) {
+                            Console.WriteLine("Error with clone, tag?\n" + ex.Message);
+                            return; // leave CloneFinished false
+                        }
+                    }
+                    #region For Reminder
+                    //if (s) {
+                    //    Repository.Clone(url, AppDomain.CurrentDomain.BaseDirectory + "raw", new CloneOptions {
+                    //        BranchName = "cve_2023-12-31_at_end_of_day",
+                    //        IsBare = true,
+                    //    });
+                    //}
+                    //else {
+                    //    Repository.Clone(url, AppDomain.CurrentDomain.BaseDirectory + "raw");
+                    //}
+                    #endregion
+                });
+            }
+            catch (Exception ex) {
+                await Console.Out.WriteLineAsync(ex.StackTrace);
+            }
         }
 
         /// <summary>
@@ -100,20 +141,5 @@ private static void RemoveReadOnlyAttribute(string path) {
                 RemoveReadOnlyAttribute(subDirectory.FullName);
             }
         }
-
-        /// <summary>
-        /// Status of git clone command
-        /// </summary>
-        /// <returns>OK if clone finished. NoContent if not finished.</returns>
-        [HttpGet]
-        [Route("cloneStatus")]
-        public IActionResult CloneStatus() {
-            if (CM.AppSettings["CloneFinished"]!.Equals("true")) {
-                return Ok();
-            }
-            else {
-                return NoContent();
-            }
-        }
     }
 }

code/AmIVulnerable/AmIVulnerable/Controllers/MySqlConnectionController.cs

@@ -21,7 +21,7 @@ public IActionResult PingWithDb() {
                 try {
                     MySqlConnection c = new MySqlConnection(Configuration["ConnectionStrings:cvedb"]);
 
-                    MySqlCommand cmd = new MySqlCommand("SELECT * FROM cve", c);
+                    MySqlCommand cmd = new MySqlCommand("SELECT cve_number, designation FROM cve.cve", c);
 
                     c.Open();
                     MySqlDataReader reader = cmd.ExecuteReader();