Hello guys,
What did I do this week?
After we added support for file paths in output. I have found out a bug which was breaking cve_scanner whenever we use --input-file
flag for scanning CVEs from CSV or JSON file. I have also found out several other issues in the previous structures which is specified below:
- Old CVEData was NamedTuple and since newly added path attribute was mutable it can create hard to find bugs.
- To update path we need to scan all_cve_data to find product for which we want to append paths.
Time Complexity: O(n**2)
which can be reduced toO(n)
using better structure. - Throwing vendor, product, version in different function was decreasing readability. So, ProductInfo would be nice to pack this data together since we never need that alone.
- TriageData structure wasn't syncing with old CVEData. So, csv2cve or input_engine was breaking.
So, I have decided to change current structure to handle all these issues. Previously all_cve_data
was Set[CVEData]
which was sufficient then because all attributes are immutable in CVEData
and we are just using set to remove duplicates from output. But, when we introduce paths
attribute we need to change paths
everytime we detect same product in different time and set doesn't have any easy way(Set isn't made for storing mutable type) to get value stored in it apart from looping over whole set to find what we are looking for. So, I have refactor structure into two parts: 1) immutable ProductInfo(vendor, product, version)
and 2) mutable CVEData(list_of_cves, paths_of_cves)
. And I am storing mapping of ProductInfo
and CVEData
into all_cve_data
so now we can access CVEData of a product without having to traverse whole all_cve_data
. Also, I have moved all data structures into utils to avoid circular imports. I have also added test for paths.
What am I doing this week?
I am continue to improve documentation of the code I generated like adding docstrings and comments. And I am also going to add requested how-to guides to improve User Experience.
Have I got stuck anywhere?
No, I didn't get stuck this week.