mirror of
https://github.com/yogeshojha/rengine.git
synced 2026-09-17 15:27:43 +02:00
vulnerability filtering done
This commit is contained in:
Yogesh Ojha
+36
-50
@@ -987,64 +987,57 @@ class EndPointViewSet(viewsets.ModelViewSet):
|
||||
|
||||
|
||||
class VulnerabilityViewSet(viewsets.ModelViewSet):
|
||||
queryset = Vulnerability.objects.all().order_by('-discovered_date')
|
||||
queryset = Vulnerability.objects.none()
|
||||
serializer_class = VulnerabilitySerializer
|
||||
|
||||
def get_queryset(self):
|
||||
req = self.request
|
||||
vulnerability_of = req.query_params.get('scan_history')
|
||||
scan_id = req.query_params.get('scan_id')
|
||||
|
||||
target_id = req.query_params.get('target_id')
|
||||
|
||||
url_query = req.query_params.get('query_param')
|
||||
if url_query:
|
||||
if url_query.isnumeric():
|
||||
self.queryset = Vulnerability.objects.filter(
|
||||
Q(
|
||||
scan_history__domain__name=url_query) | Q(
|
||||
name=url_query) | Q(
|
||||
id=url_query))
|
||||
else:
|
||||
self.queryset = Vulnerability.objects.filter(
|
||||
Q(scan_history__domain__name=url_query) | Q(name=url_query))
|
||||
elif vulnerability_of:
|
||||
|
||||
if target_id:
|
||||
self.queryset = Vulnerability.objects.filter(
|
||||
scan_history__id=vulnerability_of)
|
||||
elif target_id:
|
||||
target_domain__id=target_id).distinct()
|
||||
elif url_query:
|
||||
self.queryset = Vulnerability.objects.filter(
|
||||
target_domain__id=target_id)
|
||||
Q(target_domain__name=url_query)).distinct()
|
||||
elif scan_id:
|
||||
self.queryset = Vulnerability.objects.filter(
|
||||
scan_history__id=scan_id).distinct()
|
||||
else:
|
||||
self.queryset = Vulnerability.objects.distinct()
|
||||
return self.queryset
|
||||
|
||||
def filter_queryset(self, qs):
|
||||
qs = self.queryset.filter()
|
||||
search_value = self.request.GET.get(u'search[value]', None)
|
||||
column = self.request.GET.get(u'order[0][column]', None)
|
||||
_order_col = self.request.GET.get(u'order[0][column]', None)
|
||||
_order_direction = self.request.GET.get(u'order[0][dir]', None)
|
||||
order_col = 'severity'
|
||||
if column == '0':
|
||||
print(_order_col)
|
||||
if _order_col == '0' or _order_col == '5':
|
||||
order_col = 'open_status'
|
||||
elif column == '1':
|
||||
order_col = 'title'
|
||||
elif column == '2':
|
||||
elif _order_col == '1':
|
||||
order_col = 'name'
|
||||
elif _order_col == '2':
|
||||
order_col = 'severity'
|
||||
elif column == '3':
|
||||
order_col = 'url'
|
||||
elif column == '4':
|
||||
order_col = 'description'
|
||||
elif column == '5':
|
||||
column = 'discovered_date'
|
||||
elif column == '6':
|
||||
order_col = 'open_status'
|
||||
elif _order_col == '3':
|
||||
order_col = 'http_url'
|
||||
if _order_direction == 'desc':
|
||||
order_col = '-{}'.format(order_col)
|
||||
# if the search query is separated by = means, it is a specific lookup
|
||||
# divide the search query into two half and lookup
|
||||
if '=' in search_value or '&' in search_value or '|' in search_value or '!' in search_value:
|
||||
if '=' in search_value or '&' in search_value or '|' in search_value or '>' in search_value or '<' in search_value or '!' in search_value:
|
||||
if '&' in search_value:
|
||||
complex_query = search_value.split('&')
|
||||
for query in complex_query:
|
||||
if query.strip():
|
||||
qs = qs & self.special_lookup(query.strip())
|
||||
elif '|' in search_value:
|
||||
qs = Vulnerability.objects.none()
|
||||
qs = Subdomain.objects.none()
|
||||
complex_query = search_value.split('|')
|
||||
for query in complex_query:
|
||||
if query.strip():
|
||||
@@ -1057,7 +1050,6 @@ class VulnerabilityViewSet(viewsets.ModelViewSet):
|
||||
|
||||
def general_lookup(self, search_value):
|
||||
qs = self.queryset.filter(
|
||||
Q(discovered_date__icontains=search_value) |
|
||||
Q(http_url__icontains=search_value) |
|
||||
Q(name__icontains=search_value) |
|
||||
Q(severity__icontains=search_value) |
|
||||
@@ -1071,8 +1063,8 @@ class VulnerabilityViewSet(viewsets.ModelViewSet):
|
||||
qs = self.queryset.filter()
|
||||
if '=' in search_value:
|
||||
search_param = search_value.split("=")
|
||||
lookup_title = search_param[0].lower()
|
||||
lookup_content = search_param[1].lower()
|
||||
lookup_title = search_param[0].lower().strip()
|
||||
lookup_content = search_param[1].lower().strip()
|
||||
if 'severity' in lookup_title:
|
||||
severity_value = ''
|
||||
if lookup_content == 'info':
|
||||
@@ -1087,12 +1079,10 @@ class VulnerabilityViewSet(viewsets.ModelViewSet):
|
||||
severity_value = 4
|
||||
if severity_value:
|
||||
qs = self.queryset.filter(severity=severity_value)
|
||||
elif 'title' in lookup_title:
|
||||
elif 'name' in lookup_title:
|
||||
qs = self.queryset.filter(name__icontains=lookup_content)
|
||||
elif 'vulnerable_url' in lookup_title:
|
||||
qs = self.queryset.filter(url__icontains=lookup_content)
|
||||
elif 'url' in lookup_title:
|
||||
qs = self.queryset.filter(url__icontains=lookup_content)
|
||||
elif 'http_url' in lookup_title:
|
||||
qs = self.queryset.filter(http_url__icontains=lookup_content)
|
||||
elif 'status' in lookup_title:
|
||||
if lookup_content == 'open':
|
||||
qs = self.queryset.filter(open_status=True)
|
||||
@@ -1105,12 +1095,11 @@ class VulnerabilityViewSet(viewsets.ModelViewSet):
|
||||
Q(extracted_results__icontains=lookup_content) |
|
||||
Q(matcher_name__icontains=lookup_content))
|
||||
elif '!' in search_value:
|
||||
search_param = search_value.split("!")
|
||||
lookup_title = search_param[0].lower()
|
||||
lookup_content = search_param[1].lower()
|
||||
search_param = search_value.split("=")
|
||||
lookup_title = search_param[0].lower().strip()
|
||||
lookup_content = search_param[1].lower().strip()
|
||||
if 'severity' in lookup_title:
|
||||
# TODO: figure out this BS
|
||||
severity_value = 5
|
||||
severity_value = ''
|
||||
if lookup_content == 'info':
|
||||
severity_value = 0
|
||||
elif lookup_content == 'low':
|
||||
@@ -1121,15 +1110,12 @@ class VulnerabilityViewSet(viewsets.ModelViewSet):
|
||||
severity_value = 3
|
||||
elif lookup_content == 'critical':
|
||||
severity_value = 4
|
||||
print("severity_value" + str(severity_value))
|
||||
if severity_value < 5:
|
||||
if severity_value:
|
||||
qs = self.queryset.exclude(severity=severity_value)
|
||||
elif 'title' in lookup_title:
|
||||
qs = self.queryset.exclude(name__icontains=lookup_content)
|
||||
elif 'vulnerable_url' in lookup_title:
|
||||
qs = self.queryset.exclude(url__icontains=lookup_content)
|
||||
elif 'url' in lookup_title:
|
||||
qs = self.queryset.exclude(url__icontains=lookup_content)
|
||||
elif 'http_url' in lookup_title:
|
||||
qs = self.queryset.exclude(http_url__icontains=lookup_content)
|
||||
elif 'status' in lookup_title:
|
||||
if lookup_content == 'open':
|
||||
qs = self.queryset.exclude(open_status=True)
|
||||
|
||||
@@ -0,0 +1,115 @@
|
||||
var vulnerabilitySearchWrapper = document.querySelector("#vulnerability-search-input");
|
||||
var vulnerabilityInputBox = vulnerabilitySearchWrapper.querySelector("input");
|
||||
var vulnerabilitySuggBox = vulnerabilitySearchWrapper.querySelector(".autocom-box");
|
||||
var vulnerability_filter_icon = `<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-filter"><polygon points="22 3 2 3 10 12.46 10 19 14 21 14 12.46 22 3"></polygon></svg>`;
|
||||
|
||||
var vulnerability_col_suggestions = [
|
||||
'name',
|
||||
"severity",
|
||||
"tags",
|
||||
"status",
|
||||
"description"
|
||||
];
|
||||
|
||||
var vulnerability_condition_suggestions = [
|
||||
"=",
|
||||
"!"
|
||||
];
|
||||
|
||||
var vulnerability_joiner = [
|
||||
"&",
|
||||
"|"
|
||||
];
|
||||
|
||||
var vulnerability_suggestion_selector = vulnerability_col_suggestions;
|
||||
|
||||
vulnerabilityInputBox.onclick = (event) => {
|
||||
emptyArray = vulnerability_suggestion_selector.filter((data)=>{
|
||||
return data.toLocaleLowerCase();
|
||||
});
|
||||
badge_color = "warning";
|
||||
emptyArray = emptyArray.map((data)=>{
|
||||
switch (data) {
|
||||
case "=":
|
||||
title = `Filters vulnerability <span class="badge badge-success">Equals</span> Some Value`;
|
||||
break;
|
||||
case "!":
|
||||
title = `Filters vulnerability <span class="badge badge-danger">Not Equals</span> Some Value`;
|
||||
break;
|
||||
case ">":
|
||||
title = `Filters vulnerability <span class="badge badge-dark">Greater than</span> Some Value`;
|
||||
break;
|
||||
case "<":
|
||||
title = `Filters vulnerability <span class="badge badge-dark">Less than</span> Some Value`;
|
||||
break;
|
||||
case "&":
|
||||
title = `<span class="badge badge-danger">& and</span> Match vulnerability if <span class="badge badge-danger">all args</span> are true`;
|
||||
break;
|
||||
case "|":
|
||||
title = `<span class="badge badge-warning">| or</span> Match vulnerability if <span class="badge badge-warning">either of one</span> is true`;
|
||||
break;
|
||||
default:
|
||||
badge_color = "info";
|
||||
title = `Filter vulnerability that contains <span class="badge badge-dark">${data}</span>`;
|
||||
}
|
||||
return data = `<li id="dropdown-li" class="text-dark"><div class="row"><div class="col-6" id="filter_name"><span class="text-${badge_color}">${vulnerability_filter_icon}</span>${data}</div><div class="col-6 text-dark" id="filter_name"> ${title}</span></div></div></li>`;
|
||||
});
|
||||
|
||||
vulnerabilitySearchWrapper.classList.add("active");
|
||||
vulnerability_showSuggestions(emptyArray);
|
||||
let allList = vulnerabilitySuggBox.querySelectorAll("li");
|
||||
for (let i = 0; i < allList.length; i++) {
|
||||
allList[i].setAttribute("onclick", "vulnerability_select(this)");
|
||||
}
|
||||
}
|
||||
|
||||
function vulnerability_showSuggestions(list){
|
||||
let listData;
|
||||
listData = list.join('');
|
||||
vulnerabilitySuggBox.innerHTML = listData;
|
||||
}
|
||||
|
||||
function vulnerability_select(element){
|
||||
let selectData = element.textContent.split(" ")[0];
|
||||
vulnerabilityInputBox.value = $('#vulnerability-search').val() + selectData;
|
||||
$("#vulnerability-search").change();
|
||||
}
|
||||
|
||||
|
||||
$('#vulnerability-search').on("change paste keyup", function(event) {
|
||||
if (event.which == 13 || event.which == 27) {
|
||||
vulnerabilitySearchWrapper.classList.remove("active");
|
||||
return;
|
||||
}
|
||||
if ($(this).val().length == 0) {
|
||||
vulnerability_suggestion_selector = vulnerability_col_suggestions;
|
||||
}
|
||||
cond_split_val = $(this).val().split(new RegExp('[=><!&|]', 'g'));
|
||||
|
||||
last_obj = cond_split_val.slice(-1)[0];
|
||||
|
||||
if (vulnerability_col_suggestions.indexOf(last_obj) > -1) {
|
||||
vulnerability_suggestion_selector = vulnerability_condition_suggestions;
|
||||
}
|
||||
|
||||
else if (["=", "!", ">", "<"].indexOf($(this).val().slice(-1)) > -1) {
|
||||
vulnerability_suggestion_selector = vulnerability_joiner;
|
||||
}
|
||||
|
||||
|
||||
else if (["&", "|"].indexOf($(this).val().slice(-1)) > -1) {
|
||||
vulnerability_suggestion_selector = vulnerability_col_suggestions;
|
||||
}
|
||||
|
||||
document.getElementById("vulnerability-search").click();
|
||||
});
|
||||
|
||||
|
||||
|
||||
|
||||
$(document).on('click', function (e) {
|
||||
// console.log($(e.target).attr('id'));
|
||||
if ($(e.target).attr('id') != 'vulnerability-search' && $(e.target).attr('id') != 'filter_name') {
|
||||
vulnerabilitySearchWrapper.classList.remove("active");
|
||||
}
|
||||
});
|
||||
@@ -26,23 +26,39 @@ All Vulnerabilities
|
||||
|
||||
|
||||
{% block main_content %}
|
||||
<div class="widget widget-table-two">
|
||||
<div class="widget-content">
|
||||
<table class="multi-table table table-striped table-bordered table-hover" style="width:100%" id="vulnerability_results">
|
||||
<thead>
|
||||
<tr>
|
||||
<th class="checkbox-column">Status</th>
|
||||
<th>Title</th>
|
||||
<th class="text-center">Severity</th>
|
||||
<th>Vulnerable URL</th>
|
||||
<th>Detail</th>
|
||||
<th>Status</th>
|
||||
<th>Matcher Name</th>
|
||||
<th>Tags</th>
|
||||
<th>Reference</th>
|
||||
</tr>
|
||||
</thead>
|
||||
</table>
|
||||
<div class="row justify-content-center">
|
||||
<div class="col-xl-8 col-lg-8 col-sm-8">
|
||||
<div class="wrapper">
|
||||
<div class="search-input" id="vulnerability-search-input">
|
||||
<a href="" target="_blank" hidden></a>
|
||||
<div class="w-100">
|
||||
<input type="text" placeholder="Filter Vulnerabilities" id="vulnerability-search">
|
||||
</div>
|
||||
<div class="autocom-box mt-container mx-auto" id="autocom-box">
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="col-xl-12 col-lg-12 col-sm-12">
|
||||
<div class="widget widget-table-two">
|
||||
<div class="widget-content">
|
||||
<table class="multi-table table table-striped table-bordered table-hover" style="width:100%" id="vulnerability_results">
|
||||
<thead>
|
||||
<tr>
|
||||
<th class="checkbox-column">Status</th>
|
||||
<th>Title</th>
|
||||
<th class="text-center">Severity</th>
|
||||
<th>Vulnerable URL</th>
|
||||
<th>Detail</th>
|
||||
<th>Status</th>
|
||||
<th>Matcher Name</th>
|
||||
<th>Tags</th>
|
||||
<th>Reference</th>
|
||||
</tr>
|
||||
</thead>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
{% endblock main_content %}
|
||||
@@ -56,21 +72,19 @@ All Vulnerabilities
|
||||
<script src="{% static 'custom/custom.js' %}"></script>
|
||||
<script src="//cdn.datatables.net/1.10.16/js/dataTables.bootstrap4.min.js"></script>
|
||||
<script src="//cdn.datatables.net/colreorder/1.5.2/js/dataTables.colReorder.min.js" charset="utf-8"></script>
|
||||
|
||||
<script src="{% static 'startScan/js/vulnerability-datatables-suggestions.js' %}"></script>
|
||||
<script type="text/javascript">
|
||||
$(document).ready(function() {
|
||||
$('#vulnerability_results').DataTable({
|
||||
var vulnerability_table = $('#vulnerability_results').DataTable({
|
||||
"destroy": true,
|
||||
"oLanguage": {
|
||||
"oPaginate": { "sPrevious": '<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-arrow-left"><line x1="19" y1="12" x2="5" y2="12"></line><polyline points="12 19 5 12 12 5"></polyline></svg>', "sNext": '<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-arrow-right"><line x1="5" y1="12" x2="19" y2="12"></line><polyline points="12 5 19 12 12 19"></polyline></svg>' },
|
||||
"sInfo": "Showing page _PAGE_ of _PAGES_",
|
||||
"sSearch": '<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-search"><circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line></svg>',
|
||||
"sSearchPlaceholder": "Search...",
|
||||
"sLengthMenu": "Results : _MENU_",
|
||||
"sProcessing": "Processing... Please wait..."
|
||||
},
|
||||
"processing": true,
|
||||
"dom": "<'row'<'col-lg-10 col-md-10 col-12'f><'col-lg-2 col-md-2 col-12'l>>" +
|
||||
"dom": "<'row'<'col-lg-12 col-md-12 col-12 mb-2'l>>" +
|
||||
"<'row'<'col'tr>>" +
|
||||
"<'dt--bottom-section d-sm-flex justify-content-sm-between text-center'<'dt--pages-count mb-sm-0 mb-3'i><'dt--pagination'p>>",
|
||||
"stripeClasses": [],
|
||||
@@ -78,10 +92,10 @@ $(document).ready(function() {
|
||||
"pageLength": 20,
|
||||
'serverSide': true,
|
||||
{% if request.GET.query %}
|
||||
"ajax": '/api/listVulnerability/?scan_history=&format=datatables&query_param={{request.GET.query}}',
|
||||
{% else %}
|
||||
"ajax": '/api/listVulnerability/?scan_history=&format=datatables',
|
||||
{% endif %}
|
||||
"ajax": '/api/listVulnerability/?scan_history=&format=datatables&query_param={{request.GET.query}}',
|
||||
{% else %}
|
||||
"ajax": '/api/listVulnerability/?scan_history=&format=datatables',
|
||||
{% endif %}
|
||||
"order": [[ 2, "desc" ]],
|
||||
"columns": [
|
||||
{'data': 'id'},
|
||||
@@ -97,6 +111,7 @@ $(document).ready(function() {
|
||||
{'data': 'reference'},
|
||||
],
|
||||
"columnDefs": [
|
||||
{ "orderable": false, "targets": [4,9,10]},
|
||||
{
|
||||
"targets": [ 6, 7, 8, 9, 10 ],
|
||||
"visible": false,
|
||||
@@ -214,6 +229,9 @@ $(document).ready(function() {
|
||||
}
|
||||
},
|
||||
});
|
||||
$('#vulnerability-search').on("change paste keyup", function() {
|
||||
vulnerability_table.search($(this).val()).draw() ;
|
||||
});
|
||||
});
|
||||
</script>
|
||||
{% endblock page_level_script %}
|
||||
|
||||
Reference in New Issue
Block a user