Skip to content

Commit

Permalink
Updates from Vijay
Browse files Browse the repository at this point in the history
 - Use multi-line JavaScript comments for minify script
 - Remove URLs as hard-coded and use HTML data-attributes
 - Send dictionary from ajax_calls, avoid array/list to allow for extensions
 - Check to see if GET parameter is useable
  • Loading branch information
sei-vsarvepalli committed Apr 19, 2023
1 parent 2dd86be commit baea7ae
Show file tree
Hide file tree
Showing 8 changed files with 167 additions and 153 deletions.
22 changes: 21 additions & 1 deletion bigvince/settings_.py
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@
ROOT_DIR = environ.Path(__file__) - 3

# any change that requires database migrations is a minor release
VERSION = "2.0.7"
VERSION = "2.0.8"

# Quick-start development settings - unsuitable for production
# See https://docs.djangoproject.com/en/2.1/howto/deployment/checklist/
Expand Down Expand Up @@ -821,3 +821,23 @@ def get_secret(secret_arn):
#If you choose to disable TLP statements in CSAF comment out the MAP dictionary below
CSAF_TLP_MAP = { "PUBLIC": "WHITE", "PRIVATE": "AMBER" }

#Added in SECTORS for VERSION 2.0.8
SECTORS = (
('Chemical', 'Chemical'),
('Commercial Facilities', 'Commercial Facilities'),
('Communications', 'Communications'),
('Critical Manufacturing', 'Critical Manufacturing'),
('Dams', 'Dams'),
('Defense Industrial Base', 'Defense Industrial Base'),
('Emergency Services', 'Emergency Services'),
('Energy', 'Energy'),
('Financial', 'Financial'),
('Food and Agriculture', 'Food and Agriculture'),
('Government Facilities', 'Government Facilities'),
('Healthcare and Public Health', 'Healthcare and Public Health'),
('Information Technology', 'Information Technology'),
('Nuclear Reactors, Materials, and Waste', 'Nuclear Reactors, Materials, and Waste'),
('Transportation Systems', 'Transportation Systems'),
('Water and Wastewater Systems', 'Water and Wastewater Systems')
)

2 changes: 1 addition & 1 deletion requirements.txt
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,7 @@ python-jose==3.3.0
pytz==2022.6
PyYAML==5.4.1
qrcode==7.3.1
redis==4.5.3
redis==4.5.4
requests==2.28.1
rsa==4.7.2
s3transfer==0.6.0
Expand Down
5 changes: 4 additions & 1 deletion vince/forms.py
Original file line number Diff line number Diff line change
Expand Up @@ -2339,7 +2339,10 @@ def clean_cve_name(self):

class ProductContactForm(forms.ModelForm):

sector = forms.MultipleChoiceField( widget = forms.CheckboxSelectMultiple, choices=VendorProduct.INFRASTRUCTURE_TYPE, required=False)
SECTORS = (('generic','generic'))
if hasattr(settings,"SECTORS"):
SECTORS = settings.SECTORS
sector = forms.MultipleChoiceField( widget = forms.CheckboxSelectMultiple, choices=SECTORS, required=False)

def __init__(self, *args, **kwargs):
super(ProductContactForm, self).__init__(*args, **kwargs)
Expand Down
26 changes: 0 additions & 26 deletions vince/models.py
Original file line number Diff line number Diff line change
Expand Up @@ -3863,35 +3863,10 @@ class CVEAffectedProduct(models.Model):
blank=True,
null=True)

class Sector(models.Model):

name = models.CharField(
max_length=75,
blank=True,
null=True)

class VendorProduct(models.Model):
"""
Store Vendor Product information.
"""
INFRASTRUCTURE_TYPE = (
('Chemical', 'Chemical'),
('Commercial Facilities', 'Commercial Facilities'),
('Communications', 'Communications'),
('Critical Manufactoring', 'Critical Manufactoring'),
('Dams', 'Dams'),
('Defense Industrial Base', 'Defense Industrial Base'),
('Emergency Services', 'Emergency Services'),
('Energy', 'Energy'),
('Financial', 'Financial'),
('Food and Agriculture', 'Food and Agriculture'),
('Government Facilities', 'Government Facilities'),
('Healthcare and Public Health', 'Healthcare and Public Health'),
('Information Technology', 'Information Technology'),
('Nuclear Reactors, Materials, and Waste', 'Nuclear Reactors, Materials, and Waste'),
('Transportation Systems', 'Transportation Systems'),
('Water and Wastewater Systems', 'Water and Wastewater Systems')
)

name = models.CharField(
_('Product Name'),
Expand All @@ -3904,7 +3879,6 @@ class VendorProduct(models.Model):
null=False)

sector = ArrayField( models.CharField( max_length = 50 ), blank = True, null = True )


uuid = models.UUIDField(default=uuid.uuid4, editable=False, unique=True)

Expand Down
240 changes: 126 additions & 114 deletions vince/static/vince/js/cve.js
Original file line number Diff line number Diff line change
@@ -1,141 +1,153 @@
/*#########################################################################
# VINCE
#
# Copyright 2023 Carnegie Mellon University.
#
# NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING
# INSTITUTE MATERIAL IS FURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON
# UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED,
# AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR
# PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE
# MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND
# WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.
#
# Released under a MIT (SEI)-style license, please see license.txt or contact
# [email protected] for full terms.
#
# [DISTRIBUTION STATEMENT A] This material has been approved for public
# release and unlimited distribution. Please see Copyright notice for non-US
# Government use and distribution.
#
# Carnegie Mellon®, CERT® and CERT Coordination Center® are registered in the
# U.S. Patent and Trademark Office by Carnegie Mellon University.
#
# This Software includes and/or makes use of Third-Party Software each subject
# to its own license.
#
# DM21-1126
########################################################################
/*
#########################################################################
# VINCE
#
# Copyright 2023 Carnegie Mellon University.
#
# NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING
# INSTITUTE MATERIAL IS FURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON
# UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED,
# AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR
# PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE
# MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND
# WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.
#
# Released under a MIT (SEI)-style license, please see license.txt or contact
# [email protected] for full terms.
#
# [DISTRIBUTION STATEMENT A] This material has been approved for public
# release and unlimited distribution. Please see Copyright notice for non-US
# Government use and distribution.
#
# Carnegie Mellon®, CERT® and CERT Coordination Center® are registered in the
# U.S. Patent and Trademark Office by Carnegie Mellon University.
#
# This Software includes and/or makes use of Third-Party Software each subject
# to its own license.
#
# DM21-1126
########################################################################
*/

function change_org(value){
//Something with the forms required onChange to be called from the form initialization itself.
//This was to be able to access the proper elements of a row when returning to an existing cve.
retval = '#' + value.id
org_auto(retval, false)
/* Something with the forms required onChange to be called from the form initialization itself.
This was to be able to access the proper elements of a row when returning to an existing cve. */
retval = '#' + value.id
org_auto(retval, false)
}

function complete_prod(orgid, row_id, prod_input, item_found){
clear_row(row_id)
if (item_found.val()){
prod_input.autocomplete({
source: "/vince/ajax_calls/prods/"+orgid,
disabled: false,
minLength: 2,
select: function( event, ui) {
prod_input.val(ui.item.value);
$('#newprod_indicator_'+row_id).html('');
}
});
clear_row(row_id)
if (item_found.val()){
let org_url = $('.cveproduct').data('prod-autocomplete');
prod_input.autocomplete({
source: function(request,response) {
$.getJSON(org_url,{term:request.term})
.done(function(data) {
if("products" in data)
response(data.products);
else
response([]);
});
},
disabled: false,
minLength: 2,
select: function( event, ui) {
prod_input.val(ui.item.value);
$('#newprod_indicator_'+row_id).html('');
}
});

$(prod_input[0]).on("input propertychange paste", function(){
if ($(this).data('val')!=this.value && item_found.val()) {
if (this.value.length === 0){
$('#newprod_indicator_'+row_id).html('');
}else{
$('#newprod_indicator_'+row_id).html('New Product');
}
}
$(this).data('val', this.value);
});
}else {
prod_input.autocomplete({
disabled: true
});
}
$(prod_input[0]).on("input propertychange paste", function(){
if ($(this).data('val')!=this.value && item_found.val()) {
if (this.value.length === 0){
$('#newprod_indicator_'+row_id).html('');
}else{
$('#newprod_indicator_'+row_id).html('New Product');
}
}
$(this).data('val', this.value);
});
}else {
prod_input.autocomplete({
disabled: true
});
}
}

function org_auto(item, init) {
const regex = /[0-9]+/g;
let item_found = ''
let prod_input = ''
let orgid = ''
if(item){
orgid = $(item).val();
}
if (item && init == true) {
//new row in form
prod_input = $("#id_product-"+item[0].id.match(regex)[0]+"-cve_affected_product")
item_found = $("#id_product-"+item[0].id.match(regex)[0]+"-organization")
} else if (item && init == false){
//came back to form after submit or after clearing an organization selection
let row_id = $(item)[0].id.match(regex)[0]
prod_input = $("#id_product-"+item.match(regex)[0]+"-cve_affected_product")
item_found = $("#id_product-"+row_id+"-organization")
complete_prod(orgid, $(item)[0].id.match(regex)[0], prod_input, item_found)
} else {
//new form
prod_input = $('#id_product-0-cve_affected_product')
item_found = $('#id_product-0-organization')
const regex = /[0-9]+/g;
let item_found = ''
let prod_input = ''
let orgid = ''
if(item){
orgid = $(item).val();
}
if (item && init == true) {
/* new row in form */
prod_input = $("#id_product-"+item[0].id.match(regex)[0]+"-cve_affected_product")
item_found = $("#id_product-"+item[0].id.match(regex)[0]+"-organization")
} else if (item && init == false){
/* came back to form after submit or after clearing an organization selection */
let row_id = $(item)[0].id.match(regex)[0]
prod_input = $("#id_product-"+item.match(regex)[0]+"-cve_affected_product")
item_found = $("#id_product-"+row_id+"-organization")
complete_prod(orgid, $(item)[0].id.match(regex)[0], prod_input, item_found)
} else {
/* new form */
prod_input = $('#id_product-0-cve_affected_product')
item_found = $('#id_product-0-organization')
}
const row_id = item_found[0].id.match(regex)[0]
prod_input.parent().append('<div id=newprod_indicator_'+row_id+' style="color:red;font-size:14px"></div>')

$(item_found).change(function() {
if (item_found.val()){
complete_prod(orgid, row_id, prod_input, item_found)
}
const row_id = item_found[0].id.match(regex)[0]
prod_input.parent().append('<div id=newprod_indicator_'+row_id+' style="color:red;font-size:14px"></div>')

$(item_found).change(function() {
if (item_found.val()){
complete_prod(orgid, row_id, prod_input, item_found)
}
});
});
}

function clear_row(row_id) {
selected = false
$('#newprod_indicator_'+row_id).html('');
document.getElementById('id_product-'+row_id+'-cve_affected_product').value = "";
document.getElementById('id_product-'+row_id+'-version_value').value = "";
document.getElementById('id_product-'+row_id+'-version_affected').value = "None";
document.getElementById('id_product-'+row_id+'-version_name').value = "";
selected = false
$('#newprod_indicator_'+row_id).html('');
document.getElementById('id_product-'+row_id+'-cve_affected_product').value = "";
document.getElementById('id_product-'+row_id+'-version_value').value = "";
document.getElementById('id_product-'+row_id+'-version_affected').value = "None";
document.getElementById('id_product-'+row_id+'-version_name').value = "";
}

$(document).ready(function() {
function post_add_cwe_row(row) {
row.find($("input[id*=cwe]")).each(function() {
cwe_auto($(this));
});
row.find("input[id*=cwe]").each(function() {
cwe_auto($(this));
});
}

function post_add_org_name(row) {
row.find($("input[id*=product]")).each(function() {
org_auto($(this), true);
function post_add_org_name(row) {
row.find("input[id*=product]").each(function() {
org_auto($(this), true);
});
}
row.find("select[id*=organization]").trigger("change");
}

$( "#id_date_public" ).datepicker({dateFormat: 'yy-mm-dd'});
$("#id_date_public").datepicker({dateFormat: 'yy-mm-dd'});
$("#id_date_added").datepicker({dateFormat: 'yy-mm-dd'});

function cwe_auto(item) {
if (item) {
var cwe_input=item;
} else {
var cwe_input = $('#id_cwe-0-cwe');
}
cwe_input.autocomplete({
source:"/vince/ajax_calls/cwe/",
minLength: 2,
select: function( event, ui) { cwe_input.val(ui.item.value); }
});
if (item) {
var cwe_input=item;
} else {
var cwe_input = $('#id_cwe-0-cwe');
}
let cwe_url = $('#cweprefix').data('cwe-url');
cwe_input.autocomplete({
source: cwe_url,
minLength: 2,
select: function( event, ui) { cwe_input.val(ui.item.value); }
});
}

$('.cwe_formset').formset({
prefix: $("#cweprefix").html(),
deleteText: '',
Expand Down Expand Up @@ -173,5 +185,5 @@ $(document).ready(function() {
});

cwe_auto(null);
org_auto(null, true);
});
org_auto(null, true);
});
8 changes: 5 additions & 3 deletions vince/templates/vince/cveform.html
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,8 @@ <h5>Error submitting form: <b>{{ error }}</b></h5>

{{ cwe_formset.management_form }}
<table class="unstriped cve_formset_table">
<div id="cweprefix" class="hidden">{{ cwe_formset.prefix }}</div>
<div id="cweprefix" class="hidden"
data-cwe-url="{% url 'vince:cwe_autocomplete' %}">{{ cwe_formset.prefix }}</div>
{% for subform in cwe_formset %}
<tr class="cwe_formset">
<td>
Expand Down Expand Up @@ -120,7 +121,8 @@ <h5>Error submitting form: <b>{{ error }}</b></h5>
<div class="large-4 columns"></div>
</div>
<br/>
<div class="row">
<div class="row cveproduct"
data-prod-autocomplete="{% url 'vince:prod_autocomplete' %}">
<div class="large-12 columns">
<p><b>Please include at least 1 affected product</b></p>
{{ prod_formset.management_form }}
Expand Down Expand Up @@ -160,4 +162,4 @@ <h5>Error submitting form: <b>{{ error }}</b></h5>
</form>
</div>
</div>
{% endblock %}
{% endblock %}
Loading

0 comments on commit baea7ae

Please sign in to comment.