FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

tools: add support for using API key to vuln checking script · nodejs/node@373304b · GitHub

/ node Public

Commit 373304b

Browse files
facutuesca
authored and
danielleadams
committed
tools: add support for using API key to vuln checking script
This change adds a new parameter `--nvd-key` to `dep_checker`, which allows the user to specify a NVD API key with which to query the National Vulnerability Database. This increases the rate at which we are allowed to query the database, which speeds up the running time of the script. PR-URL: #43909 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com> Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: Michael Dawson <midawson@redhat.com>
1 parent 8b02485 commit 373304b

3 files changed

Lines changed: 33 additions & 11 deletions

File tree

‎tools/dep_checker/README.md‎

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,19 +6,29 @@ in Node's dependencies.
66

77
## How to use
88

9-
In order to query the GitHub Advisory Database,
10-
a [Personal Access Token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)
11-
has to be created (no permissions need to be given to the token, since it's only used to query the public database).
9+
### Database authentication
10+
11+
- In order to query the GitHub Advisory Database,
12+
a [Personal Access Token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)
13+
has to be created (no permissions need to be given to the token, since it's only used to query the public database).
14+
- The NVD can be queried without authentication, but it will be rate limited to one query every six seconds. In order to
15+
remove
16+
that limitation [request an API key](https://nvd.nist.gov/developers/request-an-api-key) and pass it as a parameter.
17+
18+
### Running the script
19+
1220
Once acquired, the script can be run as follows:
1321

1422
```shell
1523
cd node/tools/dep_checker/
1624
pip install -r requirements.txt
1725

1826
# Python >= 3.9 required
19-
python main.py --gh-token=$PERSONAL_ACCESS_TOKEN
27+
python main.py --gh-token=$PERSONAL_ACCESS_TOKEN --nvd-key=$NVD_API_KEY
2028

21-
# or to skip querying the GitHub Advisory Database, simply run:
29+
# The command can also be run without parameters
30+
# This will skip querying the GitHub Advisory Database, and query the NVD
31+
# using the anonymous (rate-limited) API
2232
python main.py
2333
```
2434

@@ -51,8 +61,8 @@ non-affected version.
5161
- The queries can return false positives (
5262
see [this](https://github.com/nodejs/security-wg/issues/802#issuecomment-1144207417) comment for an example). These
5363
can be ignored by adding the vulnerability to the `ignore_list` in `dependencies.py`
54-
- The script takes a while to finish (~2 min) because queries to the NVD
55-
are [rate-limited](https://nvd.nist.gov/developers)
64+
- If no NVD API key is provided, the script will take a while to finish (~2 min) because queries to the NVD
65+
are [rate-limited](https://nvd.nist.gov/developers/start-here)
5666
- If any vulnerabilities are found, the script returns 1 and prints out a list with the ID and a link to a description
5767
of
5868
the vulnerability. This is the case except when the ID matches one in the ignore-list (inside `dependencies.py`) in

‎tools/dep_checker/main.py‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
from gql.transport.aiohttp import AIOHTTPTransport
1919
from nvdlib import searchCVE # type: ignore
2020
from packaging.specifiers import SpecifierSet
21+
from typing import Optional
2122

2223

2324
class Vulnerability:
@@ -105,7 +106,7 @@ def query_ghad(gh_token: str) -> dict[str, list[Vulnerability]]:
105106
return found_vulnerabilities
106107

107108

108-
def query_nvd() -> dict[str, list[Vulnerability]]:
109+
def query_nvd(api_key: Optional[str]) -> dict[str, list[Vulnerability]]:
109110
"""Queries the National Vulnerability Database for vulnerabilities reported for Node's dependencies.
110111
111112
The database supports querying by CPE (Common Platform Enumeration) or by a keyword present in the CVE's
@@ -121,7 +122,9 @@ def query_nvd() -> dict[str, list[Vulnerability]]:
121122
for name, dep in deps_in_nvd.items():
122123
query_results = [
123124
cve
124-
for cve in searchCVE(cpeMatchString=dep.get_cpe(), keyword=dep.keyword)
125+
for cve in searchCVE(
126+
cpeMatchString=dep.get_cpe(), keyword=dep.keyword, key=api_key
127+
)
125128
if cve.id not in ignore_list
126129
]
127130
if query_results:
@@ -140,15 +143,24 @@ def main():
140143
"--gh-token",
141144
help="the GitHub authentication token for querying the GH Advisory Database",
142145
)
146+
parser.add_argument(
147+
"--nvd-key",
148+
help="the NVD API key for querying the National Vulnerability Database",
149+
)
143150
gh_token = parser.parse_args().gh_token
151+
nvd_key = parser.parse_args().nvd_key
144152
if gh_token is None:
145153
print(
146154
"Warning: GitHub authentication token not provided, skipping GitHub Advisory Database queries"
147155
)
156+
if nvd_key is None:
157+
print(
158+
"Warning: NVD API key not provided, queries will be slower due to rate limiting"
159+
)
148160
ghad_vulnerabilities: dict[str, list[Vulnerability]] = (
149161
{} if gh_token is None else query_ghad(gh_token)
150162
)
151-
nvd_vulnerabilities = query_nvd()
163+
nvd_vulnerabilities: dict[str, list[Vulnerability]] = query_nvd(nvd_key)
152164

153165
if not ghad_vulnerabilities and not nvd_vulnerabilities:
154166
print(f"No new vulnerabilities found ({len(ignore_list)} ignored)")

‎tools/dep_checker/requirements.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
gql[aiohttp]
2-
nvdlib
2+
nvdlib==0.5.8
33
packaging

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL