Add a page to manually enter a cve

Signed-off-by: Max Magorsch <arzano@gentoo.org>

7 files changed, 214 insertions, 1 deletions

diff --git a/pkg/app/handler/cvetool/new.go b/pkg/app/handler/cvetool/new.go
new file mode 100644
index 0000000..782efd7
--- /dev/null
+++ b/pkg/app/handler/cvetool/new.go
@@ -0,0 +1,83 @@
+package cvetool
+
+import (
+	"glsamaker/pkg/app/handler/authentication"
+	"glsamaker/pkg/app/handler/authentication/utils"
+	"glsamaker/pkg/database/connection"
+	"glsamaker/pkg/logger"
+	"glsamaker/pkg/models/cve"
+	"net/http"
+	"strconv"
+	"time"
+)
+
+// Show renders a template to show the landing page of the application
+func New(w http.ResponseWriter, r *http.Request) {
+
+	user := utils.GetAuthenticatedUser(r)
+
+	if !user.Permissions.Glsa.View {
+		authentication.AccessDenied(w, r)
+		return
+	}
+
+	id, baseScore, summary, err := getNewCVEParams(r)
+	parsedBaseScore, baseScorErr := strconv.ParseFloat(baseScore, 64)
+
+
+	if r.Method == "GET" || err != nil || baseScorErr != nil || id == "" {
+		renderNewCVETemplate(w, user)
+		return
+	}
+	
+	newCVE := &cve.DefCveItem{
+		Id:               id,
+		State:            "New",
+		Configurations:   nil,
+		Cve:              cve.CVE{
+			Affects:     nil,
+			CVEDataMeta: nil,
+			DataFormat:  "",
+			DataType:    "",
+			DataVersion: "",
+			Description: nil,
+			Problemtype: nil,
+			References:  &cve.References{ReferenceData: []*cve.Reference{}},
+		},
+		Description:      summary,
+		Impact:           &cve.DefImpact{
+			BaseMetricV3: cve.BaseMetricV3{
+				CvssV3:              cve.CvssV3{
+					BaseScore:       parsedBaseScore,
+				},
+			},
+		},
+		LastModifiedDate: time.Now().String(),
+		PublishedDate:    time.Now().String(),
+		ManuallyCreated:  true,
+		Comments:         nil,
+		Packages:         nil,
+		Bugs:             nil,
+	}
+
+	_, err = connection.DB.Model(newCVE).OnConflict("(id) DO UPDATE").Insert()
+	if err != nil {
+		logger.Error.Println("Err during CVE insert")
+		logger.Error.Println(err)
+	}
+
+	http.Redirect(w, r, "/cve/tool", 301)
+}
+
+
+
+func getNewCVEParams(r *http.Request) (string, string, string, error) {
+	err := r.ParseForm()
+	if err != nil {
+		return "", "", "", err
+	}
+	id := r.Form.Get("id")
+	basescore := r.Form.Get("basescore")
+	summary := r.Form.Get("summary")
+	return id, basescore, summary, err
+}
diff --git a/pkg/app/handler/cvetool/utils.go b/pkg/app/handler/cvetool/utils.go
index 7e78660..cac4c7e 100644
--- a/pkg/app/handler/cvetool/utils.go
+++ b/pkg/app/handler/cvetool/utils.go
@@ -31,6 +31,17 @@ func renderIndexFullscreenTemplate(w http.ResponseWriter, user *users.User) {
 	templates.ExecuteTemplate(w, "showFullscreen.tmpl", createPageData("cvetool", user))
 }
 
+// renderIndexTemplate renders all templates used for the landing page
+func renderNewCVETemplate(w http.ResponseWriter, user *users.User) {
+	templates := template.Must(
+		template.Must(
+			template.New("Show").
+				ParseGlob("web/templates/layout/*.tmpl")).
+			ParseGlob("web/templates/index/new.tmpl"))
+
+	templates.ExecuteTemplate(w, "new.tmpl", createPageData("cvetool", user))
+}
+
 // createPageData creates the data used in the template of the landing page
 func createPageData(page string, user *users.User) interface{} {
 	return struct {
diff --git a/pkg/app/serve.go b/pkg/app/serve.go
index 1f16d9a..4b194a2 100644
--- a/pkg/app/serve.go
+++ b/pkg/app/serve.go
@@ -77,6 +77,7 @@ func Serve() {
 	requireLogin("/new", newRequest.Show)
 
 	requireLogin("/cve/update", cvetool.Update)
+	requireLogin("/cve/new", cvetool.New)
 	requireLogin("/cve/tool", cvetool.Show)
 	requireLogin("/cve/tool/fullscreen", cvetool.ShowFullscreen)
 	requireLogin("/cve/data", cvetool.CveData)
diff --git a/pkg/cveimport/update.go b/pkg/cveimport/update.go
index a15e447..8dcf454 100644
--- a/pkg/cveimport/update.go
+++ b/pkg/cveimport/update.go
@@ -82,6 +82,7 @@ func importCVEs(year string) {
 			}
 		}
 		cveitem.Description = description
+		cveitem.ManuallyCreated = false
 
 		_, err := connection.DB.Model(cveitem).OnConflict("(id) DO UPDATE").Insert()
 		if err != nil {
diff --git a/pkg/models/cve/feed.go b/pkg/models/cve/feed.go
index 598c3ab..cad8c3a 100644
--- a/pkg/models/cve/feed.go
+++ b/pkg/models/cve/feed.go
@@ -59,6 +59,7 @@ type DefCveItem struct {
 	LastModifiedDate string     `json:"lastModifiedDate,omitempty"`
 	PublishedDate    string     `json:"publishedDate,omitempty"`
 
+	ManuallyCreated bool `json:"-"`
 	Comments []Comment `pg:",fk:cve_id"`
 	Packages []gpackage.Package
 	Bugs     []bugzilla.Bug `pg:"many2many:def_cve_item_to_bugs,joinFK:bug_id"`
diff --git a/web/packs/src/javascript/cvetool.js b/web/packs/src/javascript/cvetool.js
index 2a04c5b..d672a07 100644
--- a/web/packs/src/javascript/cvetool.js
+++ b/web/packs/src/javascript/cvetool.js
@@ -89,6 +89,13 @@ function initDatatable(){
                         }
                     },
                     {
+                        text: 'New',
+                        className: 'btn-sm btn-outline-secondary float-left colvis-btn new-btn',
+                        action: function ( e, dt, node, config ) {
+                            Turbolinks.visit("/cve/new");
+                        }
+                    },
+                    {
                         text: 'State',
                         className: 'btn-sm btn-outline-secondary float-left colvis-btn mr-2 dropdown-toggle view-filter-state'
                     }
@@ -105,10 +112,13 @@ function initDatatable(){
 
 
                     $('#table_id_filter').prepend( '<div id="filterByStateDropdown" class="dropdown"> <div class="dropdown-menu" aria-labelledby="dropdownMenuButton"> <button id="filterByStateNew" class="dropdown-item"><span class="badge badge-danger state">New</span></button> <button id="filterByStateAssigned" class="dropdown-item"><span class="badge badge-success state">Assigned</span></button> <button id="filterByStateNFU" class="dropdown-item"><span class="badge badge-info state">NFU</span></button> <button id="filterByStateLater" class="dropdown-item"><span class="badge badge-warning state">Later</span></button> <button id="filterByStateInvalid" class="dropdown-item"><span class="badge badge-dark state">Invalid</span></button> <div class="dropdown-divider"></div> <button id="filterByStateAll" class="dropdown-item">All</button> </div> </div>' );
-                    $('#table_id_filter').prepend( "<span class='m-1 float-left'> Filter by </span>" );
+                    $('#table_id_filter').prepend( "<span class='m-1 ml-5 float-left'> Filter by </span>" );
                     $('.view-filter-state').prependTo( $('#filterByStateDropdown') );
                     document.querySelector(".view-filter-state").setAttribute('data-toggle', 'dropdown');
 
+                    $('#table_id_filter').prepend( $('.new-btn') );
+                    $('#table_id_filter').prepend( "<span class='m-1 float-left'> Create </span>" );
+
                     $("#filterByStateNew").on('click', function () {
                         $('.view-filter-state').text("New");
                         table.columns( 10 ).search(  "New" ).draw();
diff --git a/web/templates/index/new.tmpl b/web/templates/index/new.tmpl
new file mode 100644
index 0000000..ccbb33b
--- /dev/null
+++ b/web/templates/index/new.tmpl
@@ -0,0 +1,106 @@
+<!DOCTYPE html>
+<html lang="en">
+{{template "head"}}
+<body>
+{{template "header" .}}
+
+<div class="container mb-5">
+    <div class="row">
+        <div class="col-12">
+
+            <h2 class="ml-1 mb-4">New CVE </h2>
+
+            <div class="card px-2 mx-1">
+                <div class="card-body">
+
+                    <form action="/cve/new" method="POST">
+
+
+                        <div class="col-sm-12 pr-0">
+                            <span class="badge badge-danger badge-request">New</span>
+                            <span class="badge badge-warning badge-draft" style="display: none;">Draft</span>
+                            &nbsp;<a id="cve_id_label" style="color:#000000;" href="">CVE </a>
+
+                            <span id="summary_container">
+                                    <small style="margin-left:5px;color:#505152;">Created: 2020-04-08 16:05 UTC</small>
+                                </span>
+
+
+                        </div>
+
+                        <div class="col-sm-12">
+                            <h1 style="font-size: 20px;margin-top:10px;margin-bottom:4px;"><span id="short_desc_nonedit_display">
+                                        New Common Vulnerabilities and Exposures Report
+                                    </span></h1>
+                        </div>
+
+
+                        <style>
+                            .advanced-fields {
+                                color: grey;
+                            }
+                        </style>
+
+
+
+                        <div class="row mt-5">
+                            <div class="col-2 text-right">
+                                <b>ID</b><br/>
+                                <small>Please enter the ID of the new CVE here.</small>
+                            </div>
+                            <div class="col-10">
+                                <input placeholder="CVE-YYYY-NNNN" id="id" name="id" type="text" class="form-control" style="display:inline-block;max-width: 200px;background: none;"/>
+                                <i id="bug-spinner" class="fa fa-lg fa-refresh fa-spin ml-3" style="display: none;" aria-hidden="true"></i>
+                                <i id="bug-refresh-ok" class="fa fa-lg fa-check ml-3" style="display: none;color: green;" aria-hidden="true"></i>
+                                <i id="bug-refresh-failed" class="fa fa-lg fa-times ml-3" style="display: none;color: darkred;" aria-hidden="true"></i>
+                            </div>
+                        </div>
+
+                        <div class="row mt-4">
+                            <div class="col-2 text-right">
+                                <b>Base Score</b><br/>
+                                <small>You can set a BaseScore for the CVE here</small>
+                            </div>
+                            <div class="col-10">
+                                <input placeholder="optional" id="basescore" name="basescore" type="text" class="form-control" style="display:inline-block;max-width: 200px;background: none;"/>
+                            </div>
+                        </div>
+
+                        <div class="row mt-4">
+                            <div class="col-2 text-right">
+                                <b>Summary</b><br/>
+                                <small>Please summarize the new CVE here</small>
+                            </div>
+                            <div class="col-10">
+                                <textarea id="summary" name="summary" rows="5" class="form-control" style="max-width: 600px;background: none;"></textarea>
+                            </div>
+                        </div>
+
+
+                        <hr class="mt-4"/>
+
+                        <div class="row mt-4">
+                            <div class="col-2 text-right"></div>
+                            <div class="col-10">
+                                <button type="submit" class="btn btn-primary float-right"> Create CVE <i class="fa fa-angle-double-right ml-1" aria-hidden="true"></i></button>
+
+                            </div>
+                        </div>
+
+                    </form>
+
+                </div>
+            </div>
+
+
+
+        </div>
+    </div>
+</div>
+
+
+{{template "footer" .}}
+
+
+</body>
+</html>