Maxfield Luke
af6077b9c3
Fresh repository history for elektrine/tarakan hosted at https://git.elektrine.com/elektrine/tarakan.
454 lines
15 KiB
Elixir
454 lines
15 KiB
Elixir
defmodule TarakanWeb.FindingLive.Show do
|
|
use TarakanWeb, :live_view
|
|
|
|
alias Tarakan.Discussion
|
|
alias Tarakan.FindingMemory
|
|
alias Tarakan.Policy
|
|
alias Tarakan.Reputation
|
|
alias Tarakan.Scans
|
|
alias Tarakan.Scans.Finding
|
|
alias Tarakan.Work
|
|
|
|
@impl true
|
|
def mount(%{"public_id" => public_id}, _session, socket) do
|
|
{scan, finding} = fetch_finding!(socket, public_id)
|
|
|
|
if connected?(socket) do
|
|
Scans.subscribe(scan.repository_id)
|
|
Discussion.subscribe(finding.id)
|
|
Reputation.subscribe()
|
|
end
|
|
|
|
public_url = TarakanWeb.Endpoint.url() <> ~p"/findings/#{finding.public_id}"
|
|
|
|
{:ok,
|
|
socket
|
|
|> assign(:page_title, finding.title)
|
|
|> assign(:meta_description, meta_description(scan, finding))
|
|
|> assign(:canonical_path, ~p"/findings/#{finding.public_id}")
|
|
|> assign(:public_url, public_url)
|
|
|> assign(
|
|
:open_bounties,
|
|
Tarakan.Market.open_bounties_for_target(:finding, finding.canonical_finding_id)
|
|
)
|
|
|> assign(:og_type, "article")
|
|
|> assign(:first_finder, FindingMemory.first_finder(finding.canonical_finding_id))
|
|
|> assign(:json_ld, finding_json_ld(scan, finding))
|
|
|> assign(:comment_body, "")
|
|
|> assign(:reply_to, nil)
|
|
|> assign(:can_vote, can_vote?(socket))
|
|
|> assign_record(scan, finding)
|
|
|> load_comments()
|
|
|> load_votes()}
|
|
end
|
|
|
|
@impl true
|
|
def handle_event(
|
|
"record_finding_verdict",
|
|
%{"verdict" => verdict} = params,
|
|
%{assigns: %{current_scope: %{account: account}}} = socket
|
|
)
|
|
when not is_nil(account) do
|
|
attrs = %{
|
|
"commit_sha" => socket.assigns.scan.commit_sha,
|
|
"verdict" => verdict,
|
|
"provenance" => "human",
|
|
"notes" => params["notes"]
|
|
}
|
|
|
|
case FindingMemory.record_check(
|
|
socket.assigns.current_scope,
|
|
socket.assigns.repository,
|
|
socket.assigns.finding.canonical_finding.public_id,
|
|
attrs
|
|
) do
|
|
{:ok, _check, _canonical} ->
|
|
{:noreply, socket |> refresh_record() |> load_votes()}
|
|
|
|
{:error, :conflict_of_interest} ->
|
|
{:noreply, put_flash(socket, :error, "You cannot verify a finding you submitted.")}
|
|
|
|
{:error, :unauthorized} ->
|
|
{:noreply, put_flash(socket, :error, "You are not authorized to verify this finding.")}
|
|
|
|
{:error, %Ecto.Changeset{errors: [{_field, {message, _meta}} | _]}} ->
|
|
{:noreply, put_flash(socket, :error, "Finding check not recorded: #{message}.")}
|
|
|
|
{:error, _reason} ->
|
|
{:noreply, put_flash(socket, :error, "Finding check could not be recorded.")}
|
|
end
|
|
end
|
|
|
|
def handle_event("record_finding_verdict", _params, socket) do
|
|
{:noreply, redirect(socket, to: ~p"/accounts/log-in")}
|
|
end
|
|
|
|
def handle_event(
|
|
"record_vendor_notification",
|
|
%{"vendor_notification" => %{"notified_on" => notified_on}},
|
|
%{assigns: %{current_scope: %{account: account}}} = socket
|
|
)
|
|
when not is_nil(account) do
|
|
case parse_notified_on(notified_on) do
|
|
{:ok, notified_at} ->
|
|
case FindingMemory.record_vendor_notification(
|
|
socket.assigns.current_scope,
|
|
socket.assigns.repository,
|
|
socket.assigns.finding.canonical_finding.public_id,
|
|
%{"vendor_notified_at" => notified_at}
|
|
) do
|
|
{:ok, _canonical} ->
|
|
Scans.broadcast_refresh(socket.assigns.scan)
|
|
{:noreply, refresh_record(socket)}
|
|
|
|
{:error, :unauthorized} ->
|
|
{:noreply,
|
|
put_flash(socket, :error, "You are not authorized to record vendor notification.")}
|
|
|
|
{:error, _reason} ->
|
|
{:noreply, put_flash(socket, :error, "Vendor notification could not be recorded.")}
|
|
end
|
|
|
|
:error ->
|
|
{:noreply, put_flash(socket, :error, "Enter a valid notification date.")}
|
|
end
|
|
end
|
|
|
|
def handle_event("open_finding_job", %{"kind" => kind}, socket) do
|
|
finding = socket.assigns.finding.canonical_finding
|
|
|
|
case Work.open_finding_job(socket.assigns.current_scope, finding, kind) do
|
|
{:ok, :skipped_duplicate} ->
|
|
{:noreply, put_flash(socket, :info, "That job is already open on this finding.")}
|
|
|
|
{:ok, task} ->
|
|
{:noreply,
|
|
socket
|
|
|> put_flash(:info, "Job opened.")
|
|
|> push_navigate(to: ~p"/jobs/#{task.id}")}
|
|
|
|
{:error, :unauthorized} ->
|
|
{:noreply, put_flash(socket, :error, "Not authorized to open jobs here.")}
|
|
|
|
{:error, _reason} ->
|
|
{:noreply, put_flash(socket, :error, "Could not open that job.")}
|
|
end
|
|
end
|
|
|
|
def handle_event("record_vendor_notification", _params, socket) do
|
|
{:noreply, redirect(socket, to: ~p"/accounts/log-in")}
|
|
end
|
|
|
|
def handle_event("reply_to", %{"parent" => parent_id}, socket) do
|
|
{:noreply, assign(socket, :reply_to, parent_id)}
|
|
end
|
|
|
|
def handle_event("cancel_reply", _params, socket) do
|
|
{:noreply, assign(socket, :reply_to, nil)}
|
|
end
|
|
|
|
def handle_event(
|
|
"post_comment",
|
|
%{"body" => body} = params,
|
|
%{assigns: %{current_scope: %{account: account}}} = socket
|
|
)
|
|
when not is_nil(account) do
|
|
attrs = %{"body" => body, "parent_id" => params["parent_id"]}
|
|
|
|
case Discussion.create_comment(socket.assigns.current_scope, socket.assigns.finding, attrs) do
|
|
{:ok, _comment} ->
|
|
{:noreply,
|
|
socket
|
|
|> assign(:comment_body, "")
|
|
|> assign(:reply_to, nil)
|
|
|> load_comments()}
|
|
|
|
{:error, :too_deep} ->
|
|
{:noreply, put_flash(socket, :error, "This thread is too deeply nested to reply to.")}
|
|
|
|
{:error, reason} when reason in [:invalid_parent, :not_found] ->
|
|
{:noreply, put_flash(socket, :error, "That comment is no longer available.")}
|
|
|
|
{:error, :unauthorized} ->
|
|
{:noreply,
|
|
put_flash(socket, :error, "Your account cannot post to the discussion right now.")}
|
|
|
|
{:error, %Ecto.Changeset{}} ->
|
|
{:noreply, put_flash(socket, :error, "Write a comment before posting.")}
|
|
end
|
|
end
|
|
|
|
def handle_event("post_comment", _params, socket) do
|
|
{:noreply, redirect(socket, to: ~p"/accounts/log-in")}
|
|
end
|
|
|
|
def handle_event(
|
|
"remove_comment",
|
|
%{"id" => id, "reason" => reason},
|
|
%{assigns: %{current_scope: %{account: account}}} = socket
|
|
)
|
|
when not is_nil(account) do
|
|
with {:ok, comment} <- Discussion.get_comment(id),
|
|
{:ok, _removed} <-
|
|
Discussion.remove_comment(socket.assigns.current_scope, comment, %{
|
|
"removed_reason" => reason
|
|
}) do
|
|
{:noreply, load_comments(socket)}
|
|
else
|
|
_error ->
|
|
{:noreply, put_flash(socket, :error, "The comment could not be removed.")}
|
|
end
|
|
end
|
|
|
|
def handle_event(
|
|
"vote",
|
|
%{"type" => subject_type, "id" => subject_id, "vote" => value},
|
|
%{assigns: %{current_scope: %{account: account}}} = socket
|
|
)
|
|
when not is_nil(account) do
|
|
with {:ok, subject_id} <- normalize_id(subject_id),
|
|
{:ok, value} <- normalize_vote(value) do
|
|
case Reputation.cast_vote(
|
|
socket.assigns.current_scope,
|
|
subject_type,
|
|
subject_id,
|
|
value
|
|
) do
|
|
{:ok, _summary} ->
|
|
{:noreply, socket |> load_votes() |> load_comments()}
|
|
|
|
{:error, :own_content} ->
|
|
{:noreply, put_flash(socket, :error, "You cannot vote on your own contribution.")}
|
|
|
|
{:error, _reason} ->
|
|
{:noreply, put_flash(socket, :error, "Your vote could not be recorded.")}
|
|
end
|
|
else
|
|
_invalid -> {:noreply, put_flash(socket, :error, "Your vote could not be recorded.")}
|
|
end
|
|
end
|
|
|
|
def handle_event("vote", _params, socket) do
|
|
{:noreply, redirect(socket, to: ~p"/accounts/log-in")}
|
|
end
|
|
|
|
@impl true
|
|
def handle_info({:scan_updated, %{id: scan_id}}, %{assigns: %{scan: %{id: scan_id}}} = socket) do
|
|
{:noreply, refresh_record(socket)}
|
|
end
|
|
|
|
def handle_info({event, _comment}, socket)
|
|
when event in [:comment_posted, :comment_removed] do
|
|
{:noreply, socket |> load_comments() |> load_votes()}
|
|
end
|
|
|
|
def handle_info({:vote_changed, _type, _id}, socket) do
|
|
{:noreply, load_votes(socket)}
|
|
end
|
|
|
|
def handle_info(_event, socket), do: {:noreply, socket}
|
|
|
|
defp load_comments(socket) do
|
|
comments = Discussion.list_comments(socket.assigns.current_scope, socket.assigns.finding)
|
|
|
|
socket
|
|
|> assign(:comments, comments)
|
|
|> assign(:comment_count, Enum.count(flatten_comments(comments)))
|
|
|> assign(
|
|
:can_moderate_comments,
|
|
Discussion.can_moderate?(socket.assigns.current_scope, socket.assigns.finding)
|
|
)
|
|
end
|
|
|
|
defp load_votes(socket) do
|
|
account_id = current_account_id(socket)
|
|
|
|
comment_ids =
|
|
socket.assigns |> Map.get(:comments, []) |> flatten_comments() |> Enum.map(& &1.id)
|
|
|
|
socket
|
|
|> assign(
|
|
:finding_votes,
|
|
Reputation.vote_summary(
|
|
"canonical_finding",
|
|
socket.assigns.finding.canonical_finding.id,
|
|
account_id
|
|
)
|
|
)
|
|
|> assign(:comment_votes, Reputation.vote_summaries("comment", comment_ids, account_id))
|
|
end
|
|
|
|
defp current_account_id(%{assigns: %{current_scope: %{account: %{id: id}}}}), do: id
|
|
defp current_account_id(_socket), do: nil
|
|
|
|
# phx-value params are client-controlled; never feed them to String.to_integer/1.
|
|
defp normalize_id(id) when is_integer(id) and id > 0, do: {:ok, id}
|
|
|
|
defp normalize_id(id) when is_binary(id) do
|
|
case Integer.parse(id) do
|
|
{parsed, ""} when parsed > 0 -> {:ok, parsed}
|
|
_other -> {:error, :invalid_id}
|
|
end
|
|
end
|
|
|
|
defp normalize_id(_id), do: {:error, :invalid_id}
|
|
|
|
defp normalize_vote(value) when is_integer(value), do: {:ok, value}
|
|
|
|
defp normalize_vote(value) when is_binary(value) do
|
|
case Integer.parse(value) do
|
|
{parsed, ""} -> {:ok, parsed}
|
|
_other -> {:error, :invalid_vote}
|
|
end
|
|
end
|
|
|
|
defp normalize_vote(_value), do: {:error, :invalid_vote}
|
|
|
|
defp can_vote?(socket), do: not is_nil(current_account_id(socket))
|
|
|
|
defp flatten_comments(comments) do
|
|
Enum.flat_map(comments, fn comment -> [comment | flatten_comments(comment.replies)] end)
|
|
end
|
|
|
|
defp refresh_record(socket) do
|
|
{scan, finding} = fetch_finding!(socket, socket.assigns.finding.public_id)
|
|
assign_record(socket, scan, finding)
|
|
end
|
|
|
|
defp assign_record(socket, scan, finding) do
|
|
socket
|
|
|> assign(:scan, scan)
|
|
|> assign(:finding, finding)
|
|
|> assign(:repository, scan.repository)
|
|
|> assign(
|
|
:finding_checks,
|
|
FindingMemory.list_checks(finding.canonical_finding.id, scan.commit_sha)
|
|
)
|
|
|> assign(
|
|
:finding_trust,
|
|
FindingMemory.trust_summary(finding.canonical_finding, scan.commit_sha)
|
|
)
|
|
|> assign(
|
|
:can_check,
|
|
FindingMemory.can_check?(
|
|
socket.assigns.current_scope,
|
|
scan.repository,
|
|
finding.canonical_finding.public_id,
|
|
scan.commit_sha
|
|
)
|
|
)
|
|
|> assign(
|
|
:can_record_vendor_notification,
|
|
FindingMemory.can_record_vendor_notification?(
|
|
socket.assigns.current_scope,
|
|
scan.repository
|
|
)
|
|
)
|
|
|> assign(:vendor_form, vendor_form(finding.canonical_finding))
|
|
|> assign(:review_stake, Reputation.review_stake(scan))
|
|
|> assign(
|
|
:can_open_finding_job,
|
|
Policy.allowed?(socket.assigns.current_scope, :propose_task, scan.repository)
|
|
)
|
|
end
|
|
|
|
defp fetch_finding!(socket, public_id) do
|
|
case Scans.get_finding(socket.assigns.current_scope, public_id) do
|
|
# Attach the resolved scan so Discussion can read the repository id
|
|
# without another query.
|
|
{:ok, {scan, finding}} -> {scan, %{finding | scan: scan}}
|
|
{:error, :not_found} -> raise Ecto.NoResultsError, queryable: Finding
|
|
end
|
|
end
|
|
|
|
# Search snippets truncate around 160 characters; lead with the facts that
|
|
# identify the finding before the free-text description.
|
|
defp meta_description(scan, finding) do
|
|
prefix =
|
|
"#{String.capitalize(finding.severity)} in " <>
|
|
"#{scan.repository.owner}/#{scan.repository.name} (#{finding.file_path}): "
|
|
|
|
truncate(prefix <> String.replace(finding.description, ~r/\s+/, " "), 160)
|
|
end
|
|
|
|
defp finding_json_ld(scan, finding) do
|
|
url = TarakanWeb.Endpoint.url() <> ~p"/findings/#{finding.public_id}"
|
|
canonical = finding.canonical_finding
|
|
|
|
%{
|
|
"@context" => "https://schema.org",
|
|
"@type" => "TechArticle",
|
|
"headline" => finding.title,
|
|
"description" => meta_description(scan, finding),
|
|
"url" => url,
|
|
"datePublished" => DateTime.to_iso8601(finding.inserted_at),
|
|
"dateModified" => DateTime.to_iso8601(finding.updated_at),
|
|
"author" => %{
|
|
"@type" => "Organization",
|
|
"name" => "Tarakan public security record"
|
|
},
|
|
"about" => %{
|
|
"@type" => "SoftwareSourceCode",
|
|
"name" => "#{scan.repository.owner}/#{scan.repository.name}",
|
|
"codeRepository" => scan.repository.canonical_url
|
|
},
|
|
"keywords" =>
|
|
Enum.join(
|
|
[
|
|
finding.severity,
|
|
"security finding",
|
|
scan.repository.owner,
|
|
scan.repository.name,
|
|
"open source"
|
|
],
|
|
", "
|
|
)
|
|
}
|
|
|> maybe_put_json_ld("cwe", canonical && canonical.cwe_id)
|
|
|> maybe_put_json_ld("cve", canonical && canonical.cve_id)
|
|
end
|
|
|
|
defp maybe_put_json_ld(map, _key, value) when value in [nil, false, ""], do: map
|
|
defp maybe_put_json_ld(map, key, value), do: Map.put(map, key, value)
|
|
|
|
# An empty date clears the recorded vendor notification; anything else must
|
|
# be an ISO calendar date, stored at midnight UTC.
|
|
defp parse_notified_on(value) when value in [nil, ""], do: {:ok, nil}
|
|
|
|
defp parse_notified_on(value) when is_binary(value) do
|
|
case Date.from_iso8601(value) do
|
|
{:ok, date} -> {:ok, DateTime.new!(date, ~T[00:00:00], "Etc/UTC")}
|
|
{:error, _reason} -> :error
|
|
end
|
|
end
|
|
|
|
defp vendor_form(canonical) do
|
|
notified_on =
|
|
case canonical.vendor_notified_at do
|
|
%DateTime{} = datetime -> datetime |> DateTime.to_date() |> Date.to_iso8601()
|
|
_other -> ""
|
|
end
|
|
|
|
to_form(%{"notified_on" => notified_on}, as: :vendor_notification)
|
|
end
|
|
|
|
defp truncate(text, max) when byte_size(text) <= max, do: text
|
|
|
|
defp truncate(text, max) do
|
|
String.slice(text, 0, max - 1) <> "…"
|
|
end
|
|
|
|
defp record_time(%DateTime{} = datetime) do
|
|
Calendar.strftime(datetime, "%Y-%m-%d %H:%M")
|
|
end
|
|
|
|
defp stake_label(:at_risk), do: "at risk (awaiting review)"
|
|
defp stake_label(:returned), do: "returned (verified)"
|
|
defp stake_label(:slashed), do: "slashed (refuted)"
|
|
|
|
defp finding_lines(%{line_start: nil}), do: ""
|
|
defp finding_lines(%{line_start: line, line_end: line}), do: ":#{line}"
|
|
|
|
defp finding_lines(%{line_start: line_start, line_end: line_end}),
|
|
do: ":#{line_start}-#{line_end}"
|
|
end
|