Module: Utils::Analytics::Vulnerabilities Private

Defined in:
utils/analytics/vulnerabilities.rb

Overview

This module is part of a private API. This module may only be used in the Homebrew/brew repository. Third parties should avoid using this module if possible, as it may be removed or changed without warning.

Summaries of the advisory corpus and the existing formula API findings.

Class Method Summary collapse

Class Method Details

.catalogue(formulae, available:, revision:) ⇒ Hash{String => T.anything}

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
 
# File 'utils/analytics/vulnerabilities.rb', line 57

def self.catalogue(formulae, available:, revision:)
  counts = Hash.new(0)
  severity = Hash.new(0)
  upstream = Set.new
  rows = formulae.filter_map do |name, formula|
    findings = formula["vulnerabilities"]
    case findings
    when Hash then nil
    else next
    end

    open = findings.fetch("open")
    patched = findings.fetch("patched")
    fixed = findings.fetch("fixed_count")
    counts["covered_formulae"] += 1
    counts["formulae_with_open_findings"] += 1 if open.any?
    counts["open"] += open.length
    counts["patched"] += patched.length
    counts["fixed"] += fixed
    open.each do |entry|
      severity[entry["severity"] || "unknown"] += 1
      Array(entry["upstream"]).each { |identifier| upstream << identifier }
    end
    versions = case (value = formula["versions"])
    when Hash then value
    else {}
    end
    {
      "formula"  => name,
      "version"  => versions["stable"],
      "revision" => formula["revision"],
      "open"     => open.length,
      "patched"  => patched.length,
      "fixed"    => fixed,
      "critical" => open.count { |entry| entry["severity"] == "critical" },
      "high"     => open.count { |entry| entry["severity"] == "high" },
    }
  end
  {
    "generated_at" => Time.now.utc.iso8601,
    "source"       => "https://formulae.brew.sh/api/advisories.json",
    "revision"     => revision,
    "available"    => available,
    "counts"       => counts.merge("catalogue_formulae"        => formulae.size,
                                   "uncovered_formulae"        => formulae.size - counts["covered_formulae"],
                                   "open_upstream_identifiers" => upstream.size),
    "severity"     => severity,
    "formulae"     => rows.sort_by { |row| [-row.fetch("open"), row.fetch("formula")] },
  }
end

.corpus(repository) ⇒ Hash{String => T.anything}

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
 
# File 'utils/analytics/vulnerabilities.rb', line 12

def self.corpus(repository)
  counts = Hash.new(0)
  severity = Hash.new(0)
  formulae = Set.new
  upstream = Set.new
  (repository/"advisories").glob("*.json").each do |path|
    record = JSON.parse(path.read)
    counts["records"] += 1
    if record["withdrawn"].present?
      counts["withdrawn"] += 1
      next
    end
    vulnerability = Homebrew::Vulns::Vulnerability.new(record)
    vulnerability.upstream.each { |identifier| upstream << identifier }
    severity[vulnerability.severity&.to_s || "unknown"] += 1
    vulnerability.affected.each do |affected|
      formulae << affected.dig("package", "name")
    end
    ecosystem = vulnerability.affected.first&.fetch("ecosystem_specific", {}) || {}
    category = if record.dig("database_specific", "source") == "matched" && ecosystem["range_state"].nil?
      "uncomparable"
    elsif ecosystem["fix"] == "patch"
      "patch"
    elsif ecosystem["fix"] == "bump"
      "bump"
    else
      "unresolved"
    end
    counts[category] += 1
  end
  {
    "generated_at" => Time.now.utc.iso8601,
    "source"       => "https://github.com/Homebrew/advisory-database",
    "revision"     => if (repository/".git").exist?
                        Utils.safe_popen_read("git", "-C", repository.to_s, "rev-parse", "HEAD").strip
    end,
    "counts"       => counts.merge("formulae" => formulae.size, "upstream_identifiers" => upstream.size),
    "severity"     => severity,
  }
end