Implement VEX document verification system with issuer management and signature verification
- Added IIssuerDirectory interface for managing VEX document issuers, including methods for registration, revocation, and trust validation. - Created InMemoryIssuerDirectory class as an in-memory implementation of IIssuerDirectory for testing and single-instance deployments. - Introduced ISignatureVerifier interface for verifying signatures on VEX documents, with support for multiple signature formats. - Developed SignatureVerifier class as the default implementation of ISignatureVerifier, allowing extensibility for different signature formats. - Implemented handlers for DSSE and JWS signature formats, including methods for verification and signature extraction. - Defined various records and enums for issuer and signature metadata, enhancing the structure and clarity of the verification process.
This commit is contained in:
StellaOps Bot
685
src/VexLens/StellaOps.VexLens/Normalization/CsafVexNormalizer.cs
Normal file
685
src/VexLens/StellaOps.VexLens/Normalization/CsafVexNormalizer.cs
Normal file
@@ -0,0 +1,685 @@
|
||||
using System.Diagnostics;
|
||||
using System.Security.Cryptography;
|
||||
using System.Text;
|
||||
using System.Text.Json;
|
||||
using StellaOps.VexLens.Models;
|
||||
|
||||
namespace StellaOps.VexLens.Normalization;
|
||||
|
||||
/// <summary>
|
||||
/// Normalizer for CSAF VEX format documents.
|
||||
/// CSAF VEX documents follow the OASIS CSAF 2.0 specification with profile "VEX".
|
||||
/// </summary>
|
||||
public sealed class CsafVexNormalizer : IVexNormalizer
|
||||
{
|
||||
public VexSourceFormat SourceFormat => VexSourceFormat.CsafVex;
|
||||
|
||||
public bool CanNormalize(string content)
|
||||
{
|
||||
if (string.IsNullOrWhiteSpace(content))
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
try
|
||||
{
|
||||
using var doc = JsonDocument.Parse(content);
|
||||
var root = doc.RootElement;
|
||||
|
||||
// CSAF documents have document.category = "csaf_vex"
|
||||
if (root.TryGetProperty("document", out var document))
|
||||
{
|
||||
if (document.TryGetProperty("category", out var category))
|
||||
{
|
||||
var categoryStr = category.GetString();
|
||||
return categoryStr?.Equals("csaf_vex", StringComparison.OrdinalIgnoreCase) == true;
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
catch
|
||||
{
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
public Task<NormalizationResult> NormalizeAsync(
|
||||
string content,
|
||||
NormalizationContext context,
|
||||
CancellationToken cancellationToken = default)
|
||||
{
|
||||
var stopwatch = Stopwatch.StartNew();
|
||||
var warnings = new List<NormalizationWarning>();
|
||||
var statementsSkipped = 0;
|
||||
|
||||
try
|
||||
{
|
||||
using var doc = JsonDocument.Parse(content);
|
||||
var root = doc.RootElement;
|
||||
|
||||
// Extract document metadata
|
||||
if (!root.TryGetProperty("document", out var documentElement))
|
||||
{
|
||||
stopwatch.Stop();
|
||||
return Task.FromResult(NormalizationResult.Failed(
|
||||
[new NormalizationError("ERR_CSAF_001", "Missing 'document' element", "document", null)],
|
||||
new NormalizationMetrics(
|
||||
Duration: stopwatch.Elapsed,
|
||||
SourceBytes: Encoding.UTF8.GetByteCount(content),
|
||||
StatementsExtracted: 0,
|
||||
StatementsSkipped: 0,
|
||||
ProductsMapped: 0),
|
||||
warnings));
|
||||
}
|
||||
|
||||
// Extract document ID
|
||||
var documentId = ExtractDocumentId(documentElement);
|
||||
if (string.IsNullOrWhiteSpace(documentId))
|
||||
{
|
||||
documentId = $"csaf:{Guid.NewGuid():N}";
|
||||
warnings.Add(new NormalizationWarning(
|
||||
"WARN_CSAF_001",
|
||||
"Document tracking ID not found; generated a random ID",
|
||||
"document.tracking.id"));
|
||||
}
|
||||
|
||||
// Extract issuer from publisher
|
||||
var issuer = ExtractIssuer(documentElement, warnings);
|
||||
|
||||
// Extract timestamps
|
||||
var (issuedAt, lastUpdatedAt) = ExtractTimestamps(documentElement);
|
||||
|
||||
// Extract product tree for product resolution
|
||||
var productTree = root.TryGetProperty("product_tree", out var pt) ? pt : default;
|
||||
|
||||
// Extract vulnerabilities and convert to statements
|
||||
var statements = ExtractStatements(root, productTree, warnings, ref statementsSkipped);
|
||||
|
||||
// Calculate source digest
|
||||
var sourceDigest = ComputeDigest(content);
|
||||
|
||||
// Build provenance
|
||||
var provenance = new NormalizationProvenance(
|
||||
NormalizedAt: context.NormalizedAt,
|
||||
Normalizer: context.Normalizer,
|
||||
SourceRevision: null,
|
||||
TransformationRules: ["csaf-vex-to-normalized-v1"]);
|
||||
|
||||
var normalizedDoc = new NormalizedVexDocument(
|
||||
SchemaVersion: NormalizedVexDocument.CurrentSchemaVersion,
|
||||
DocumentId: documentId,
|
||||
SourceFormat: VexSourceFormat.CsafVex,
|
||||
SourceDigest: sourceDigest,
|
||||
SourceUri: context.SourceUri,
|
||||
Issuer: issuer,
|
||||
IssuedAt: issuedAt,
|
||||
LastUpdatedAt: lastUpdatedAt,
|
||||
Statements: statements,
|
||||
Provenance: provenance);
|
||||
|
||||
stopwatch.Stop();
|
||||
|
||||
return Task.FromResult(NormalizationResult.Successful(
|
||||
normalizedDoc,
|
||||
new NormalizationMetrics(
|
||||
Duration: stopwatch.Elapsed,
|
||||
SourceBytes: Encoding.UTF8.GetByteCount(content),
|
||||
StatementsExtracted: statements.Count,
|
||||
StatementsSkipped: statementsSkipped,
|
||||
ProductsMapped: statements.Count),
|
||||
warnings));
|
||||
}
|
||||
catch (JsonException ex)
|
||||
{
|
||||
stopwatch.Stop();
|
||||
return Task.FromResult(NormalizationResult.Failed(
|
||||
[new NormalizationError("ERR_CSAF_002", "Invalid JSON", ex.Path, ex)],
|
||||
new NormalizationMetrics(
|
||||
Duration: stopwatch.Elapsed,
|
||||
SourceBytes: Encoding.UTF8.GetByteCount(content),
|
||||
StatementsExtracted: 0,
|
||||
StatementsSkipped: 0,
|
||||
ProductsMapped: 0),
|
||||
warnings));
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
stopwatch.Stop();
|
||||
return Task.FromResult(NormalizationResult.Failed(
|
||||
[new NormalizationError("ERR_CSAF_999", "Unexpected error during normalization", null, ex)],
|
||||
new NormalizationMetrics(
|
||||
Duration: stopwatch.Elapsed,
|
||||
SourceBytes: Encoding.UTF8.GetByteCount(content),
|
||||
StatementsExtracted: 0,
|
||||
StatementsSkipped: 0,
|
||||
ProductsMapped: 0),
|
||||
warnings));
|
||||
}
|
||||
}
|
||||
|
||||
private static string? ExtractDocumentId(JsonElement document)
|
||||
{
|
||||
if (document.TryGetProperty("tracking", out var tracking) &&
|
||||
tracking.TryGetProperty("id", out var id))
|
||||
{
|
||||
return id.GetString();
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
private static VexIssuer? ExtractIssuer(JsonElement document, List<NormalizationWarning> warnings)
|
||||
{
|
||||
if (!document.TryGetProperty("publisher", out var publisher))
|
||||
{
|
||||
warnings.Add(new NormalizationWarning(
|
||||
"WARN_CSAF_002",
|
||||
"No publisher found in document",
|
||||
"document.publisher"));
|
||||
return null;
|
||||
}
|
||||
|
||||
var issuerId = publisher.TryGetProperty("namespace", out var nsProp)
|
||||
? nsProp.GetString() ?? "unknown"
|
||||
: "unknown";
|
||||
|
||||
var issuerName = publisher.TryGetProperty("name", out var nameProp)
|
||||
? nameProp.GetString() ?? issuerId
|
||||
: issuerId;
|
||||
|
||||
var categoryStr = publisher.TryGetProperty("category", out var catProp)
|
||||
? catProp.GetString()
|
||||
: null;
|
||||
|
||||
var category = MapPublisherCategory(categoryStr);
|
||||
|
||||
return new VexIssuer(
|
||||
Id: issuerId,
|
||||
Name: issuerName,
|
||||
Category: category,
|
||||
TrustTier: TrustTier.Unknown,
|
||||
KeyFingerprints: null);
|
||||
}
|
||||
|
||||
private static IssuerCategory? MapPublisherCategory(string? category)
|
||||
{
|
||||
return category?.ToLowerInvariant() switch
|
||||
{
|
||||
"vendor" => IssuerCategory.Vendor,
|
||||
"discoverer" or "coordinator" => IssuerCategory.Community,
|
||||
"user" => IssuerCategory.Internal,
|
||||
"other" => null,
|
||||
_ => null
|
||||
};
|
||||
}
|
||||
|
||||
private static (DateTimeOffset? IssuedAt, DateTimeOffset? LastUpdatedAt) ExtractTimestamps(JsonElement document)
|
||||
{
|
||||
DateTimeOffset? issuedAt = null;
|
||||
DateTimeOffset? lastUpdatedAt = null;
|
||||
|
||||
if (document.TryGetProperty("tracking", out var tracking))
|
||||
{
|
||||
if (tracking.TryGetProperty("initial_release_date", out var initialRelease) &&
|
||||
initialRelease.ValueKind == JsonValueKind.String)
|
||||
{
|
||||
if (DateTimeOffset.TryParse(initialRelease.GetString(), out var parsed))
|
||||
{
|
||||
issuedAt = parsed;
|
||||
}
|
||||
}
|
||||
|
||||
if (tracking.TryGetProperty("current_release_date", out var currentRelease) &&
|
||||
currentRelease.ValueKind == JsonValueKind.String)
|
||||
{
|
||||
if (DateTimeOffset.TryParse(currentRelease.GetString(), out var parsed))
|
||||
{
|
||||
lastUpdatedAt = parsed;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return (issuedAt, lastUpdatedAt);
|
||||
}
|
||||
|
||||
private static IReadOnlyList<NormalizedStatement> ExtractStatements(
|
||||
JsonElement root,
|
||||
JsonElement productTree,
|
||||
List<NormalizationWarning> warnings,
|
||||
ref int skipped)
|
||||
{
|
||||
if (!root.TryGetProperty("vulnerabilities", out var vulnerabilities) ||
|
||||
vulnerabilities.ValueKind != JsonValueKind.Array)
|
||||
{
|
||||
warnings.Add(new NormalizationWarning(
|
||||
"WARN_CSAF_003",
|
||||
"No vulnerabilities array found",
|
||||
"vulnerabilities"));
|
||||
return [];
|
||||
}
|
||||
|
||||
var statements = new List<NormalizedStatement>();
|
||||
var statementIndex = 0;
|
||||
|
||||
foreach (var vuln in vulnerabilities.EnumerateArray())
|
||||
{
|
||||
var vulnStatements = ExtractVulnerabilityStatements(
|
||||
vuln, productTree, statementIndex, warnings, ref skipped);
|
||||
statements.AddRange(vulnStatements);
|
||||
statementIndex += vulnStatements.Count;
|
||||
}
|
||||
|
||||
return statements;
|
||||
}
|
||||
|
||||
private static List<NormalizedStatement> ExtractVulnerabilityStatements(
|
||||
JsonElement vuln,
|
||||
JsonElement productTree,
|
||||
int startIndex,
|
||||
List<NormalizationWarning> warnings,
|
||||
ref int skipped)
|
||||
{
|
||||
var statements = new List<NormalizedStatement>();
|
||||
|
||||
// Extract vulnerability ID (CVE or other identifier)
|
||||
string? vulnerabilityId = null;
|
||||
var aliases = new List<string>();
|
||||
|
||||
if (vuln.TryGetProperty("cve", out var cve))
|
||||
{
|
||||
vulnerabilityId = cve.GetString();
|
||||
}
|
||||
|
||||
if (vuln.TryGetProperty("ids", out var ids) && ids.ValueKind == JsonValueKind.Array)
|
||||
{
|
||||
foreach (var id in ids.EnumerateArray())
|
||||
{
|
||||
if (id.TryGetProperty("text", out var text))
|
||||
{
|
||||
var idStr = text.GetString();
|
||||
if (!string.IsNullOrWhiteSpace(idStr))
|
||||
{
|
||||
if (vulnerabilityId == null)
|
||||
{
|
||||
vulnerabilityId = idStr;
|
||||
}
|
||||
else if (idStr != vulnerabilityId)
|
||||
{
|
||||
aliases.Add(idStr);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (string.IsNullOrWhiteSpace(vulnerabilityId))
|
||||
{
|
||||
warnings.Add(new NormalizationWarning(
|
||||
"WARN_CSAF_004",
|
||||
"Vulnerability missing CVE or ID; skipped",
|
||||
"vulnerabilities[].cve"));
|
||||
skipped++;
|
||||
return statements;
|
||||
}
|
||||
|
||||
// Extract product_status for VEX statements
|
||||
if (!vuln.TryGetProperty("product_status", out var productStatus))
|
||||
{
|
||||
warnings.Add(new NormalizationWarning(
|
||||
"WARN_CSAF_005",
|
||||
$"Vulnerability {vulnerabilityId} has no product_status",
|
||||
"vulnerabilities[].product_status"));
|
||||
return statements;
|
||||
}
|
||||
|
||||
// Process each status category
|
||||
var localIndex = 0;
|
||||
|
||||
// Known not affected
|
||||
if (productStatus.TryGetProperty("known_not_affected", out var knownNotAffected) &&
|
||||
knownNotAffected.ValueKind == JsonValueKind.Array)
|
||||
{
|
||||
foreach (var productRef in knownNotAffected.EnumerateArray())
|
||||
{
|
||||
var product = ResolveProduct(productRef, productTree);
|
||||
if (product != null)
|
||||
{
|
||||
var justification = ExtractJustification(vuln, productRef.GetString());
|
||||
statements.Add(CreateStatement(
|
||||
startIndex + localIndex++,
|
||||
vulnerabilityId,
|
||||
aliases,
|
||||
product,
|
||||
VexStatus.NotAffected,
|
||||
justification,
|
||||
vuln));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Fixed
|
||||
if (productStatus.TryGetProperty("fixed", out var fixedProducts) &&
|
||||
fixedProducts.ValueKind == JsonValueKind.Array)
|
||||
{
|
||||
foreach (var productRef in fixedProducts.EnumerateArray())
|
||||
{
|
||||
var product = ResolveProduct(productRef, productTree);
|
||||
if (product != null)
|
||||
{
|
||||
statements.Add(CreateStatement(
|
||||
startIndex + localIndex++,
|
||||
vulnerabilityId,
|
||||
aliases,
|
||||
product,
|
||||
VexStatus.Fixed,
|
||||
null,
|
||||
vuln));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Known affected
|
||||
if (productStatus.TryGetProperty("known_affected", out var knownAffected) &&
|
||||
knownAffected.ValueKind == JsonValueKind.Array)
|
||||
{
|
||||
foreach (var productRef in knownAffected.EnumerateArray())
|
||||
{
|
||||
var product = ResolveProduct(productRef, productTree);
|
||||
if (product != null)
|
||||
{
|
||||
statements.Add(CreateStatement(
|
||||
startIndex + localIndex++,
|
||||
vulnerabilityId,
|
||||
aliases,
|
||||
product,
|
||||
VexStatus.Affected,
|
||||
null,
|
||||
vuln));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Under investigation
|
||||
if (productStatus.TryGetProperty("under_investigation", out var underInvestigation) &&
|
||||
underInvestigation.ValueKind == JsonValueKind.Array)
|
||||
{
|
||||
foreach (var productRef in underInvestigation.EnumerateArray())
|
||||
{
|
||||
var product = ResolveProduct(productRef, productTree);
|
||||
if (product != null)
|
||||
{
|
||||
statements.Add(CreateStatement(
|
||||
startIndex + localIndex++,
|
||||
vulnerabilityId,
|
||||
aliases,
|
||||
product,
|
||||
VexStatus.UnderInvestigation,
|
||||
null,
|
||||
vuln));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return statements;
|
||||
}
|
||||
|
||||
private static NormalizedProduct? ResolveProduct(JsonElement productRef, JsonElement productTree)
|
||||
{
|
||||
if (productRef.ValueKind != JsonValueKind.String)
|
||||
{
|
||||
return null;
|
||||
}
|
||||
|
||||
var productId = productRef.GetString();
|
||||
if (string.IsNullOrWhiteSpace(productId))
|
||||
{
|
||||
return null;
|
||||
}
|
||||
|
||||
// Try to find product details in product_tree
|
||||
string? name = null;
|
||||
string? version = null;
|
||||
string? purl = null;
|
||||
string? cpe = null;
|
||||
|
||||
if (productTree.ValueKind == JsonValueKind.Object)
|
||||
{
|
||||
// Search in full_product_names
|
||||
if (productTree.TryGetProperty("full_product_names", out var fullNames) &&
|
||||
fullNames.ValueKind == JsonValueKind.Array)
|
||||
{
|
||||
foreach (var fpn in fullNames.EnumerateArray())
|
||||
{
|
||||
if (fpn.TryGetProperty("product_id", out var pid) &&
|
||||
pid.GetString() == productId)
|
||||
{
|
||||
name = fpn.TryGetProperty("name", out var n) ? n.GetString() : null;
|
||||
|
||||
if (fpn.TryGetProperty("product_identification_helper", out var pih))
|
||||
{
|
||||
purl = pih.TryGetProperty("purl", out var p) ? p.GetString() : null;
|
||||
cpe = pih.TryGetProperty("cpe", out var c) ? c.GetString() : null;
|
||||
}
|
||||
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Search in branches recursively
|
||||
if (name == null && productTree.TryGetProperty("branches", out var branches))
|
||||
{
|
||||
var result = SearchBranches(branches, productId);
|
||||
if (result.HasValue)
|
||||
{
|
||||
name = result.Value.Name;
|
||||
version = result.Value.Version;
|
||||
purl = result.Value.Purl;
|
||||
cpe = result.Value.Cpe;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return new NormalizedProduct(
|
||||
Key: productId,
|
||||
Name: name,
|
||||
Version: version,
|
||||
Purl: purl,
|
||||
Cpe: cpe,
|
||||
Hashes: null);
|
||||
}
|
||||
|
||||
private static (string? Name, string? Version, string? Purl, string? Cpe)? SearchBranches(
|
||||
JsonElement branches,
|
||||
string productId)
|
||||
{
|
||||
if (branches.ValueKind != JsonValueKind.Array)
|
||||
{
|
||||
return null;
|
||||
}
|
||||
|
||||
foreach (var branch in branches.EnumerateArray())
|
||||
{
|
||||
// Check product in this branch
|
||||
if (branch.TryGetProperty("product", out var product) &&
|
||||
product.TryGetProperty("product_id", out var pid) &&
|
||||
pid.GetString() == productId)
|
||||
{
|
||||
var name = product.TryGetProperty("name", out var n) ? n.GetString() : null;
|
||||
var version = branch.TryGetProperty("name", out var bn) &&
|
||||
branch.TryGetProperty("category", out var bc) &&
|
||||
bc.GetString() == "product_version"
|
||||
? bn.GetString()
|
||||
: null;
|
||||
|
||||
string? purl = null;
|
||||
string? cpe = null;
|
||||
|
||||
if (product.TryGetProperty("product_identification_helper", out var pih))
|
||||
{
|
||||
purl = pih.TryGetProperty("purl", out var p) ? p.GetString() : null;
|
||||
cpe = pih.TryGetProperty("cpe", out var c) ? c.GetString() : null;
|
||||
}
|
||||
|
||||
return (name, version, purl, cpe);
|
||||
}
|
||||
|
||||
// Recurse into sub-branches
|
||||
if (branch.TryGetProperty("branches", out var subBranches))
|
||||
{
|
||||
var result = SearchBranches(subBranches, productId);
|
||||
if (result.HasValue)
|
||||
{
|
||||
return result;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
private static VexJustification? ExtractJustification(JsonElement vuln, string? productId)
|
||||
{
|
||||
// Look for flags that indicate justification
|
||||
if (!vuln.TryGetProperty("flags", out var flags) ||
|
||||
flags.ValueKind != JsonValueKind.Array)
|
||||
{
|
||||
return null;
|
||||
}
|
||||
|
||||
foreach (var flag in flags.EnumerateArray())
|
||||
{
|
||||
// Check if this flag applies to our product
|
||||
if (flag.TryGetProperty("product_ids", out var productIds) &&
|
||||
productIds.ValueKind == JsonValueKind.Array)
|
||||
{
|
||||
var applies = false;
|
||||
foreach (var pid in productIds.EnumerateArray())
|
||||
{
|
||||
if (pid.GetString() == productId)
|
||||
{
|
||||
applies = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
if (!applies)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
}
|
||||
|
||||
if (flag.TryGetProperty("label", out var label))
|
||||
{
|
||||
var labelStr = label.GetString();
|
||||
var justification = MapCsafFlagToJustification(labelStr);
|
||||
if (justification.HasValue)
|
||||
{
|
||||
return justification;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
private static VexJustification? MapCsafFlagToJustification(string? label)
|
||||
{
|
||||
return label?.ToLowerInvariant() switch
|
||||
{
|
||||
"component_not_present" => VexJustification.ComponentNotPresent,
|
||||
"vulnerable_code_not_present" => VexJustification.VulnerableCodeNotPresent,
|
||||
"vulnerable_code_not_in_execute_path" or "vulnerable_code_cannot_be_controlled_by_adversary" =>
|
||||
VexJustification.VulnerableCodeNotInExecutePath,
|
||||
"inline_mitigations_already_exist" => VexJustification.InlineMitigationsAlreadyExist,
|
||||
_ => null
|
||||
};
|
||||
}
|
||||
|
||||
private static NormalizedStatement CreateStatement(
|
||||
int index,
|
||||
string vulnerabilityId,
|
||||
List<string> aliases,
|
||||
NormalizedProduct product,
|
||||
VexStatus status,
|
||||
VexJustification? justification,
|
||||
JsonElement vuln)
|
||||
{
|
||||
// Extract notes for status notes
|
||||
string? statusNotes = null;
|
||||
if (vuln.TryGetProperty("notes", out var notes) && notes.ValueKind == JsonValueKind.Array)
|
||||
{
|
||||
foreach (var note in notes.EnumerateArray())
|
||||
{
|
||||
if (note.TryGetProperty("category", out var cat) &&
|
||||
cat.GetString() == "description" &&
|
||||
note.TryGetProperty("text", out var text))
|
||||
{
|
||||
statusNotes = text.GetString();
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Extract action statement from remediations
|
||||
string? actionStatement = null;
|
||||
DateTimeOffset? actionTimestamp = null;
|
||||
|
||||
if (vuln.TryGetProperty("remediations", out var remediations) &&
|
||||
remediations.ValueKind == JsonValueKind.Array)
|
||||
{
|
||||
foreach (var rem in remediations.EnumerateArray())
|
||||
{
|
||||
if (rem.TryGetProperty("details", out var details))
|
||||
{
|
||||
actionStatement = details.GetString();
|
||||
}
|
||||
|
||||
if (rem.TryGetProperty("date", out var date) &&
|
||||
date.ValueKind == JsonValueKind.String)
|
||||
{
|
||||
if (DateTimeOffset.TryParse(date.GetString(), out var parsed))
|
||||
{
|
||||
actionTimestamp = parsed;
|
||||
}
|
||||
}
|
||||
|
||||
break; // Take first remediation
|
||||
}
|
||||
}
|
||||
|
||||
// Extract release date as timestamp
|
||||
DateTimeOffset? timestamp = null;
|
||||
if (vuln.TryGetProperty("release_date", out var releaseDate) &&
|
||||
releaseDate.ValueKind == JsonValueKind.String)
|
||||
{
|
||||
if (DateTimeOffset.TryParse(releaseDate.GetString(), out var parsed))
|
||||
{
|
||||
timestamp = parsed;
|
||||
}
|
||||
}
|
||||
|
||||
return new NormalizedStatement(
|
||||
StatementId: $"stmt-{index}",
|
||||
VulnerabilityId: vulnerabilityId,
|
||||
VulnerabilityAliases: aliases.Count > 0 ? aliases : null,
|
||||
Product: product,
|
||||
Status: status,
|
||||
StatusNotes: statusNotes,
|
||||
Justification: justification,
|
||||
ImpactStatement: null,
|
||||
ActionStatement: actionStatement,
|
||||
ActionStatementTimestamp: actionTimestamp,
|
||||
Versions: null,
|
||||
Subcomponents: null,
|
||||
FirstSeen: timestamp,
|
||||
LastSeen: timestamp);
|
||||
}
|
||||
|
||||
private static string ComputeDigest(string content)
|
||||
{
|
||||
var hash = SHA256.HashData(Encoding.UTF8.GetBytes(content));
|
||||
return $"sha256:{Convert.ToHexString(hash).ToLowerInvariant()}";
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user