|
| 1 | +import aiohttp |
| 2 | +import importlib |
| 3 | +import json |
| 4 | +import re |
| 5 | + |
| 6 | +from asgiref.sync import sync_to_async |
| 7 | +from queue import Empty, Queue |
| 8 | +from threading import Thread |
| 9 | + |
| 10 | +from pulpcore.plugin.util import get_domain |
| 11 | +from pulpcore.plugin.models import CreatedResource, VulnerabilityReport |
| 12 | +from pulpcore.constants import OSV_QUERY_URL, VULNERABILITY_TASK_THREAD_TIMEOUT |
| 13 | + |
| 14 | + |
| 15 | +# Create a thread-safe queue to share Content units between threads |
| 16 | +content_queue = Queue() |
| 17 | + |
| 18 | +# CPE prefix from Red Hat packages |
| 19 | +cpe_prefix = re.compile(r"^cpe:\/[oa]:redhat") |
| 20 | + |
| 21 | + |
| 22 | +async def check_content(func, args=None): |
| 23 | + """ |
| 24 | + Start the background_thread and make the API requests (scan) to osv.dev with the packages |
| 25 | + from Queue. |
| 26 | +
|
| 27 | + Args: |
| 28 | + func (callable | str): The function to populate content_queue Queue with the osv.dev |
| 29 | + expected request data format. |
| 30 | + args (tuple): The positional arguments to pass on to the func. |
| 31 | + """ |
| 32 | + if not args: |
| 33 | + args = () |
| 34 | + |
| 35 | + module_name, function_name = func.rsplit(".", 1) |
| 36 | + module = importlib.import_module(module_name) |
| 37 | + func = getattr(module, function_name) |
| 38 | + |
| 39 | + background_thread = Thread(target=func, args=args) |
| 40 | + await _scan_packages(background_thread) |
| 41 | + background_thread.join() |
| 42 | + |
| 43 | + |
| 44 | +async def _scan_packages(background_thread): |
| 45 | + """ |
| 46 | + Makes a request to the osv.dev API and store the results in VulnerabilityReport model. |
| 47 | +
|
| 48 | + Args: |
| 49 | + background_thread (Thread): We need to pass the thread object used to populate the queue to |
| 50 | + prevent deadlock issues. |
| 51 | + """ |
| 52 | + scanned_packages = await _scan_packages_from_queue( |
| 53 | + background_thread=background_thread, |
| 54 | + ) |
| 55 | + await _save_vulnerability_report(scanned_packages) |
| 56 | + |
| 57 | + |
| 58 | +async def _scan_packages_from_queue(background_thread, http_client=None): |
| 59 | + """ |
| 60 | + Scans packages from a queue by making HTTP requests to OSV API. |
| 61 | +
|
| 62 | + Args: |
| 63 | + background_thread (Thread): Thread populating the queue |
| 64 | + http_client (Optional[aiohttp.ClientSession]): HTTP client for making requests |
| 65 | +
|
| 66 | + Returns: |
| 67 | + Dict[str, Any]: Dictionary mapping package names to vulnerability data |
| 68 | + """ |
| 69 | + |
| 70 | + # Use provided client or create a new one |
| 71 | + if http_client: |
| 72 | + return await _process_queue_with_client(background_thread, http_client) |
| 73 | + |
| 74 | + async with aiohttp.ClientSession() as session: |
| 75 | + return await _process_queue_with_client(background_thread, session) |
| 76 | + |
| 77 | + |
| 78 | +async def _process_queue_with_client(background_thread, session): |
| 79 | + """ |
| 80 | + Process queue items using the provided HTTP client session. |
| 81 | +
|
| 82 | + Args: |
| 83 | + background_thread (Thread): Thread populating the queue |
| 84 | + session (aiohttp.ClientSession): HTTP client session |
| 85 | +
|
| 86 | + Returns: |
| 87 | + Dict[str, Any]: Dictionary mapping package names to vulnerability data |
| 88 | + """ |
| 89 | + scanned_packages = {} |
| 90 | + try: |
| 91 | + for osv_data in iter( |
| 92 | + lambda: content_queue.get(timeout=VULNERABILITY_TASK_THREAD_TIMEOUT), None |
| 93 | + ): |
| 94 | + if isinstance(osv_data, Exception): |
| 95 | + raise RuntimeError(f"Background vuln report task failed to execute: {osv_data}") |
| 96 | + |
| 97 | + vulnerability_data = await _query_osv_api(session, osv_data) |
| 98 | + package_name = _get_package_name(osv_data) |
| 99 | + |
| 100 | + if vulnerability_data.get("vulns"): |
| 101 | + scanned_packages[package_name] = vulnerability_data["vulns"] |
| 102 | + |
| 103 | + # Handle pagination |
| 104 | + if next_page_token := vulnerability_data.get("next_page_token"): |
| 105 | + osv_data["page_token"] = next_page_token |
| 106 | + content_queue.put(osv_data) |
| 107 | + |
| 108 | + except Empty: |
| 109 | + if not background_thread.is_alive(): |
| 110 | + raise RuntimeError("Vuln report task thread died unexpectedly.") |
| 111 | + else: |
| 112 | + raise RuntimeError("Background vuln report thread took too long.") |
| 113 | + |
| 114 | + return scanned_packages |
| 115 | + |
| 116 | + |
| 117 | +async def _query_osv_api(session, osv_data): |
| 118 | + """ |
| 119 | + Make a single request to the OSV API. |
| 120 | +
|
| 121 | + Args: |
| 122 | + session (aiohttp.ClientSession): HTTP client session |
| 123 | + osv_data (Dict[str, Any]): OSV query data |
| 124 | +
|
| 125 | + Returns: |
| 126 | + Dict[str, Any]: JSON response from OSV API |
| 127 | + """ |
| 128 | + data = json.dumps(osv_data) |
| 129 | + async with session.post(url=OSV_QUERY_URL, data=data) as response: |
| 130 | + response_body = await response.text() |
| 131 | + return json.loads(response_body) |
| 132 | + |
| 133 | + |
| 134 | +def _get_package_name(osv_data): |
| 135 | + """ |
| 136 | + Extract package name from OSV data. |
| 137 | +
|
| 138 | + Args: |
| 139 | + osv_data (Dict[str, Any]): OSV query data |
| 140 | +
|
| 141 | + Returns: |
| 142 | + str: Formatted package name |
| 143 | + """ |
| 144 | + osv_package_name = osv_data["package"]["name"] |
| 145 | + if osv_package_version := osv_data.get("version", ""): |
| 146 | + return f"{osv_package_name}-{osv_package_version}" |
| 147 | + return f"{osv_package_name}" |
| 148 | + |
| 149 | + |
| 150 | +async def _save_vulnerability_report(scanned_packages): |
| 151 | + """ |
| 152 | + Save vulnerability report to the database. |
| 153 | +
|
| 154 | + Args: |
| 155 | + scanned_packages (Dict[str, Any]): Dictionary mapping package names to vulnerability data |
| 156 | + """ |
| 157 | + vuln_report, created = await sync_to_async(VulnerabilityReport.objects.get_or_create)( |
| 158 | + vulns=scanned_packages, pulp_domain=get_domain() |
| 159 | + ) |
| 160 | + if created: |
| 161 | + await CreatedResource.objects.acreate(content_object=vuln_report) |
0 commit comments