vulncheck/tools/diagnose_scan.py

"""Is the running container actually on the current scanner code?

Copy-pasted one-liners kept failing on invisible characters picked up from
chat, so the checks live here instead. Run inside the backend container:

    docker compose exec backend python tools/diagnose_scan.py

Each line states what it expects, so the output is readable without looking
anything up. A failing line means the container is running older code — every
other symptom is downstream of that.
"""
import sys

sys.path.insert(0, "/app")

CHECKS = []


def check(name, expect):
    def deco(fn):
        CHECKS.append((name, expect, fn))
        return fn
    return deco


@check("Adobe add-on is ignored", "None")
def _adobe():
    from app.services.app_cve_scanner_service import resolve_product
    return resolve_product(
        "Asian Language And Spelling Dictionaries Support For Adobe Acrobat Reader")


@check("Teams build shapes are not compared", "[]")
def _teams():
    from app.services.msrc_scan_service import affected_cves
    return affected_cves([{"cve": "X", "build": "25060212643"}],
                         "26183.1903.4892.4448", branch_match=False)


@check("Node 24.13.1 IS affected by CVE-2026-56846", "True")
def _node():
    from app.services.cvelistv5_scan_service import _affected, _ranges_from_affected
    rg = _ranges_from_affected({
        "vendor": "nodejs", "product": "node", "defaultStatus": "unaffected",
        "versions": [{"version": "24.18.0", "lessThanOrEqual": "24.18.0",
                      "versionType": "semver", "status": "affected"}]})
    return any(_affected("24.13.1", s, lt, lte) for s, lt, lte in rg)


@check("Node 22.23.2 is NOT affected by it", "False")
def _node_other_line():
    from app.services.cvelistv5_scan_service import _affected, _ranges_from_affected
    rg = _ranges_from_affected({
        "vendor": "nodejs", "product": "node", "defaultStatus": "unaffected",
        "versions": [{"version": "24.18.0", "lessThanOrEqual": "24.18.0",
                      "versionType": "semver", "status": "affected"}]})
    return any(_affected("22.23.2", s, lt, lte) for s, lt, lte in rg)


@check("Browser-extension CPEs rejected on Windows", "False")
def _target_sw():
    from app.services.app_cve_scanner_service import _platform_ok
    return _platform_ok(["chrome"], "windows")


@check("Acrobat 26.001.21771 is NOT hit by CVE-2019-7819", "False")
def _adobe_new_scheme():
    from app.services.app_cve_scanner_service import _vcmp
    return _vcmp("26.001.21771", "2019.010.20098") <= 0


@check("Acrobat 19.010.20098 IS still hit by it", "True")
def _adobe_old_scheme():
    from app.services.app_cve_scanner_service import _vcmp
    return _vcmp("19.010.20098", "2019.010.20098") <= 0


@check("Autodesk release years are untouched", "(2026, 0, 0)")
def _autodesk_years():
    from app.services.app_cve_scanner_service import _vtuple
    return _vtuple("2026.0.0")


@check("AutoCAD LT 25.1.172.0 reads as the patched 2026.1.2", "2026.1.2")
def _autocad_build_map():
    from app.services import cvelistv5_scan_service as c5
    from app.services.app_cve_scanner_service import _effective_version
    name = "Autodesk AutoCAD LT 2026 - Deutsch (German)"
    return _effective_version(name, "25.1.172.0",
                              c5._KEY_ENTRY.get(c5.resolve(name)) or {})


@check("Teams 26183.x is NOT hit by CVE-2025-49731", "False")
def _teams_scheme():
    from app.services.cvelistv5_scan_service import _affected
    return any(_affected("26183.1903.4892.4448", None, b, None, scheme_strict=True)
               for b in ("25060212643", "1.0.0.2025112902", "7.10.1"))


@check("Node.js reaches the cvelistV5 path", "nodejs")
def _node_resolves():
    from app.services import cvelistv5_scan_service as c5
    return c5.resolve("Node.js")


@check("Wazuh agent 4.14.5-1 is scannable", "4.14.5")
def _wazuh():
    from app.services.app_cve_scanner_service import (
        _effective_version, resolve_product)
    e = resolve_product("wazuh-agent") or {}
    return _effective_version("wazuh-agent", "4.14.5-1", e)


@check("cvelistV5 index key", "cvelistv5_product_index_v24")
def _index():
    from app.services.cvelistv5_scan_service import _INDEX_SETTING
    return _INDEX_SETTING


@check("NVD result cache prefix", "v3:")
def _cache():
    from app.services.app_cve_scanner_service import CACHE_PREFIX
    return CACHE_PREFIX


def main():
    bad = 0
    for name, expect, fn in CHECKS:
        try:
            got = fn()
        except Exception as e:
            got = f"ERROR: {e}"
        ok = str(got) == expect
        bad += 0 if ok else 1
        print(f"[{'ok ' if ok else 'BAD'}] {name}")
        print(f"      expected {expect!r}, got {got!r}")
    print()
    if bad:
        print(f"{bad} check(s) failed — this container is NOT running the current code.")
    else:
        print("All checks current. If findings still look wrong, the cause is "
              "elsewhere — send the scan log.")
    return 1 if bad else 0


if __name__ == "__main__":
    sys.exit(main())