CveReader2 implements ObjectFetcher<String, Cve> { private static final Cve buildFromJson(String _id, String _json) throws ParseException { final SimpleDateFormat format = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm"); final Cve cve = new Cve(); cve.setId(_id); final Configuration conf = Configuration.defaultConfiguration(); final Object document = conf.jsonProvider().parse(_json); final JSONArray descriptions = JsonPath.read(document, "$.cve.description.description_data[?(@.lang=='en')].value"); if (descriptions == null || descriptions.size() == 0) { log.warn("No english description found for CVE [" + _id + "]"); cve.setSummary("Not available"); } else { cve.setSummary(descriptions.get(0).toString()); } final String published = JsonPath.read(document, "$.publishedDate"); final Calendar publ = new GregorianCalendar(); publ.setTime(format.parse(published)); cve.setPublished(publ); final String modified = JsonPath.read(document, "$.lastModifiedDate"); final Calendar modi = new GregorianCalendar(); modi.setTime(format.parse(modified)); cve.setModified(modi); String cvss3_version = null; Double cvss3_score = null; String cvss3_vector = null; try { cvss3_version = JsonPath.read(document, "$.impact.baseMetricV3.cvssV3.version"); cvss3_score = JsonPath.read(document, "$.impact.baseMetricV3.cvssV3.baseScore"); cvss3_vector = JsonPath.read(document, "$.impact.baseMetricV3.cvssV3.vectorString"); } catch (Exception e) { log.warn( "Exception when reading CVSS v3 information for CVE [" + _id + "]: " + e.getMessage()); } String cvss2_version = null; Double cvss2_score = null; String cvss2_vector = null; try { cvss2_version = JsonPath.read(document, "$.impact.baseMetricV2.cvssV2.version"); cvss2_score = JsonPath.read(document, "$.impact.baseMetricV2.cvssV2.baseScore"); cvss2_vector = JsonPath.read(document, "$.impact.baseMetricV2.cvssV2.vectorString"); } catch (Exception e) { log.warn( "Exception when reading CVSS v2 information for CVE [" + _id + "]: " + e.getMessage()); } if (cvss3_version != null && cvss3_score != null && cvss3_vector != null) { cve.setCvssScore(cvss3_score.floatValue()); cve.setCvssVector(cvss3_vector); cve.setCvssVersion(cvss3_version); } else if (cvss2_version != null && cvss2_score != null && cvss2_vector != null) { cve.setCvssScore(cvss2_score.floatValue()); cve.setCvssVector(cvss2_vector); cve.setCvssVersion(cvss2_version); } return cve; }  static Cve read(String _key); static Cve read(String _key, boolean _force_fetch); Cve fetch(String _key);  }
@Test public void testBuildFromJson() throws CacheException { NvdRestServiceMockup.create(); try { final Cve cve_2014_0050 = CveReader2.read("CVE-2014-0050"); assertEquals(Float.valueOf("7.5"), cve_2014_0050.getCvssScore()); assertEquals("2.0", cve_2014_0050.getCvssVersion()); assertEquals("AV:N/AC:L/Au:N/C:P/I:P/A:P", cve_2014_0050.getCvssVector()); assertEquals( "MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache" + " Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial" + " of service (infinite loop and CPU consumption) via a crafted Content-Type header" + " that bypasses a loop's intended exit conditions.", cve_2014_0050.getSummary()); final Calendar publ = new GregorianCalendar(); publ.setTime(format.parse("2014-04-01T06:27Z")); assertEquals(publ, cve_2014_0050.getPublished()); final Calendar modi = new GregorianCalendar(); modi.setTime(format.parse("2018-10-09T19:35Z")); assertEquals(modi, cve_2014_0050.getModified()); final Cve cve_2018_0123 = CveReader2.read("CVE-2018-0123"); assertEquals(Float.valueOf("5.5"), cve_2018_0123.getCvssScore()); assertEquals("3.0", cve_2018_0123.getCvssVersion()); assertEquals("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", cve_2018_0123.getCvssVector()); assertEquals( "Not available", cve_2018_0123 .getSummary()); publ.setTime(format.parse("2018-02-08T07:29Z")); assertEquals(publ, cve_2018_0123.getPublished()); modi.setTime(format.parse("2018-03-13T13:53Z")); assertEquals(modi, cve_2018_0123.getModified()); final Cve cve_2018_1000865 = CveReader2.read("CVE-2018-1000865"); assertEquals(Float.valueOf("8.8"), cve_2018_1000865.getCvssScore()); assertEquals("3.0", cve_2018_1000865.getCvssVersion()); assertEquals( "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", cve_2018_1000865.getCvssVector()); assertEquals( "A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in" + " groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java" + " that allows attackers with Job/Configure permission to execute arbitrary code on" + " the Jenkins master JVM, if plugins using the Groovy sandbox are installed.", cve_2018_1000865.getSummary()); publ.setTime(format.parse("2018-12-10T14:29Z")); assertEquals(publ, cve_2018_1000865.getPublished()); modi.setTime(format.parse("2019-02-06T19:02Z")); assertEquals(modi, cve_2018_1000865.getModified()); final Cve cve_2019_0047 = CveReader2.read("CVE-2019-0047"); assertEquals(Float.valueOf("8.8"), cve_2019_0047.getCvssScore()); assertEquals("3.1", cve_2019_0047.getCvssVersion()); assertEquals("CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", cve_2019_0047.getCvssVector()); assertEquals( "A persistent Cross-Site Scripting (XSS) vulnerability in Junos OS J-Web interface may" + " allow remote unauthenticated attackers to perform administrative actions on the" + " Junos device. Successful exploitation requires a Junos administrator to first" + " perform certain diagnostic actions on J-Web. This issue affects: Juniper" + " Networks Junos OS 12.1X46 versions prior to 12.1X46-D86; 12.3 versions prior to" + " 12.3R12-S13; 12.3X48 versions prior to 12.3X48-D80; 14.1X53 versions prior to" + " 14.1X53-D51; 15.1 versions prior to 15.1F6-S13, 15.1R7-S4; 15.1X49 versions" + " prior to 15.1X49-D171, 15.1X49-D180; 15.1X53 versions prior to 15.1X53-D497," + " 15.1X53-D69; 16.1 versions prior to 16.1R7-S5; 16.2 versions prior to 16.2R2-S9;" + " 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R2-S7," + " 17.2R3-S1; 17.3 versions prior to 17.3R3-S6; 17.4 versions prior to 17.4R1-S7," + " 17.4R2-S4, 17.4R3; 18.1 versions prior to 18.1R3-S5; 18.2 versions prior to" + " 18.2R1-S5, 18.2R2-S3, 18.2R3; 18.3 versions prior to 18.3R1-S3, 18.3R2, 18.3R3;" + " 18.4 versions prior to 18.4R1-S2, 18.4R2.", cve_2019_0047.getSummary()); } catch (ParseException e) { e.printStackTrace(); assertTrue(false); } }