vulncheck
0b71453c48
Comments across the codebase credited one individual by role and, in places, described that person's own machines: which SQL Server versions a host ran, which devices were enrolled, what a particular dashboard showed, how many findings sat open on which server. In a public repository that reads as a profile of someone's unpatched estate. The observations are why the code looks the way it does, so they stay. Every CVE id, version, build number, count and date is preserved, as are the verbatim quotes that motivated specific sort and filter rules — only the attribution changes, to "field report", "observed", "a host". A local variable in tests/test_autodesk_year.py was renamed for the same reason; its value and every assertion around it are byte-identical. PROJECT_OVERVIEW.md additionally loses a subtitle naming the kind of organisation this was built for, and a support section pointing at an internal team, both replaced with neutral wording. Comments, docstrings and markdown prose only: 74 files, 200 lines, one-for-one swaps. detect_changes reports 104 touched symbols and zero affected execution flows, and all 55 test scripts pass. Nothing here needs re-testing.
80 lines
3.0 KiB
Python
80 lines
3.0 KiB
Python
"""EOL supersede must not fire on side-by-side products.
|
|
|
|
One reported host has Visual C++ 2008, 2010, 2012, 2013, 2015 and 2022
|
|
redistributables installed at once — normal on Windows, and several of them
|
|
genuinely EOL. Supersede assumed one release per product, so within a single
|
|
scan the 2008 entry closed the 2013 finding as "superseded", the 2013 entry
|
|
reopened it and closed 2008, and so on: 50 alternating change-history rows and
|
|
hundreds of audit entries a night, with nothing on the host changing.
|
|
"""
|
|
import os
|
|
import sys
|
|
|
|
sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
|
|
|
|
from app.services.eol_service import ( # noqa: E402
|
|
_SINGLE_RELEASE_SLUGS, _pseudo_cve_id, _supersede_old_eol,
|
|
resolve_product_slug)
|
|
from app.models.vulnerability import VulnerabilityStatus # noqa: E402
|
|
|
|
|
|
class _Vuln:
|
|
def __init__(self, vid, cve_id):
|
|
self.id, self.cve_id = vid, cve_id
|
|
self.status = VulnerabilityStatus.open
|
|
self.patched_at = None
|
|
|
|
|
|
class _Query:
|
|
def __init__(self, rows): self.rows = rows
|
|
def filter(self, *a, **k): return self
|
|
def all(self): return self.rows
|
|
|
|
|
|
class _DB:
|
|
def __init__(self, rows): self.rows = rows
|
|
def query(self, *a, **k): return _Query(self.rows)
|
|
|
|
|
|
def protect_check():
|
|
"""A finding this same sweep confirmed must never be superseded — that
|
|
mutual close/reopen is the open→patched→open loop."""
|
|
other = _Vuln(7, "EOL-MSEXCHANGE-2019")
|
|
db = _DB([other])
|
|
_supersede_old_eol(db, 1, "msexchange", "EOL-MSEXCHANGE-2016",
|
|
protect_ids={7})
|
|
assert other.status == VulnerabilityStatus.open
|
|
|
|
# Unprotected (not seen this run) → still closed, as before.
|
|
_supersede_old_eol(db, 1, "msexchange", "EOL-MSEXCHANGE-2016")
|
|
assert other.status == VulnerabilityStatus.patched
|
|
|
|
|
|
def demo():
|
|
protect_check()
|
|
# Side by side → never superseded.
|
|
for name in ("Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005",
|
|
"Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729"):
|
|
assert resolve_product_slug(name) not in _SINGLE_RELEASE_SLUGS, name
|
|
for slug in ("mssqlserver", "oracle-jdk", "dotnetfx", "nodejs", "python"):
|
|
assert slug not in _SINGLE_RELEASE_SLUGS, slug
|
|
|
|
# One per device → supersede is what keeps the old release from lingering.
|
|
for slug in ("chrome", "firefox", "windows", "windows-server", "msexchange"):
|
|
assert slug in _SINGLE_RELEASE_SLUGS, slug
|
|
assert resolve_product_slug("Google Chrome") in _SINGLE_RELEASE_SLUGS
|
|
|
|
# The reported case: the two ids are distinct, so the old code saw each as
|
|
# the other's stale duplicate.
|
|
a = _pseudo_cve_id("ms-lifecycle", "Visual C++ 2013 Redistributable")
|
|
b = _pseudo_cve_id("ms-lifecycle", "Visual C++ 2008 Redistributable")
|
|
assert a != b
|
|
assert "ms-lifecycle" not in _SINGLE_RELEASE_SLUGS, (
|
|
"the Microsoft lifecycle export covers many co-installed products")
|
|
|
|
print("ok supersede fires only where a device runs one release")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
demo()
|