Include new elements (product name, network exploitability, modification date).

Return dict instead of tuple.
Parse several files instead of one handle.

svn path=/; revision=2

1 files changed, 50 insertions, 30 deletions

diff --git a/lib/python/nvd.py b/lib/python/nvd.py
index 87b6d14..2e375f3 100644
--- a/lib/python/nvd.py
+++ b/lib/python/nvd.py
@@ -1,6 +1,8 @@
 # nvd.py -- simplistic NVD parser
 # Copyright (C) 2005 Florian Weimer <fw@deneb.enyo.de>
 # 
+# Modifications by Robert Buchholz <rbu@gentoo.org>
+#
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation; either version 2 of the License, or
@@ -21,15 +23,16 @@ National Vulnerability Database (NVD) <http://nvd.nist.gov/>
 
 import xml.sax
 import xml.sax.handler
+import datetime
 
 class _Parser(xml.sax.handler.ContentHandler):
     """Parser helper class."""
 
     def __init__(self):
-        self.result = []
+        self.result = {}
         self.start_dispatcher = {}
-        for x in ('entry', 'local', 'range', 'remote', 'user_init',
-                  'avail', 'conf', 'int', 'sec_prot'):
+        for x in ('entry', 'local', 'range', 'network', 'local_network', 'user_init',
+                  'avail', 'conf', 'int', 'sec_prot', 'prod'):
              self.start_dispatcher[x] = getattr(self, 'TAG_' + x)
         self.path = []
 
@@ -43,23 +46,29 @@ class _Parser(xml.sax.handler.ContentHandler):
     def TAG_entry(self, name, attrs):
         self.name = attrs['name'].encode('utf-8')
         self.published = attrs['published'].encode('utf-8')
+        self.modified = attrs.get('modified', str(datetime.date.today())).encode('utf-8')
         self.severity = attrs.get('severity', u'').encode('utf-8')
         self.discovered = attrs.get('discovered', u'').encode('utf-8')
 
         self.cve_desc = ""
-        self.range_local = self.range_remote = self.range_user_init = None
+        self.range_local = self.range_network = self.range_local_network \
+            = self.range_user_init = None
 
         self.loss_avail = self.loss_conf = self.loss_int \
             = self.loss_sec_prot_user = self.loss_sec_prot_admin \
             = self.loss_sec_prot_other = 0
 
+        self.product_name = self.product_vendor = None
+
     def TAG_range(self, name, attrs):
-        self.range_local = self.range_remote = self.range_user_init = 0
+        self.range_local = self.range_local_network = self.range_network = self.range_user_init = 0
 
     def TAG_local(self, name, attrs):
         self.range_local = 1
-    def TAG_remote(self, name, attrs):
-        self.range_remote = 1
+    def TAG_network(self, name, attrs):
+        self.range_network = 1
+    def TAG_local_network(self, name, attrs):
+        self.range_local_network = 1
     def TAG_user_init(self, name, attrs):
         self.range_user_init = 1
     def TAG_loss_types(self, name, attrs):
@@ -77,27 +86,32 @@ class _Parser(xml.sax.handler.ContentHandler):
             self.loss_sec_prot_admin = 1
         if attrs.has_key('other'):
             self.loss_sec_prot_other = 1
-            
+    def TAG_prod(self, name, attrs):
+        if attrs.has_key('name'):
+            self.product_name = attrs['name'].encode('utf-8')
+        if attrs.has_key('vendor'):
+            self.product_vendor = attrs['vendor'].encode('utf-8')
+
     def endElement(self, name):
         if name == 'entry':
-            # FIXME: normalize CAN to CVE.  Should go away soon.
-            name = self.name
-            if name[0:4] == 'CAN-':
-                name = 'CVE-' + name[4:]
-            self.result.append((name,
-                                self.cve_desc,
-                                self.discovered,
-                                self.published,
-                                self.severity,
-                                self.range_local,
-                                self.range_remote,
-                                self.range_user_init,
-                                self.loss_avail,
-                                self.loss_conf,
-                                self.loss_int,
-                                self.loss_sec_prot_user,
-                                self.loss_sec_prot_admin,
-                                self.loss_sec_prot_other))
+            self.result[self.name] = {
+                                'desc': self.cve_desc,
+                                'discovered': self.discovered,
+                                'published': self.published,
+                                'modified': self.modified,
+                                'severity': self.severity,
+                                'range_local': self.range_local,
+                                'range_network': self.range_network,
+                                'range_local_network': self.range_local_network,
+                                'range_user_init': self.range_user_init,
+                                'loss_avail': self.loss_avail,
+                                'loss_conf': self.loss_conf,
+                                'loss_int': self.loss_int,
+                                'loss_sec_prot_user': self.loss_sec_prot_user,
+                                'loss_sec_prot_admin': self.loss_sec_prot_admin,
+                                'loss_sec_prot_other': self.loss_sec_prot_other,
+                                'product_name': self.product_name,
+                                'product_vendor': self.product_vendor}
         del self.path[-1]
 
     def characters(self, content):
@@ -105,16 +119,19 @@ class _Parser(xml.sax.handler.ContentHandler):
         if name == 'descript' and attrs['source'] == 'cve':
             self.cve_desc += content
 
-def parse(file):
-    """Parses the indicated file object.  Returns a list of tuples,
+def parseAll(files):
+    """Parses the indicated files.  Returns a dictionary,
     containing the following elements:
 
     - CVE name
     - discovery data (can be empty)
     - publication date
+    - last modification date
+    - name of the vulnerable software
     - severity (can be empty)
     - local range flag
-    - remote range flag
+    - network range flag
+    - local_network range flag
     - availability loss type flag
     - confidentiality loss type flag
     - integrity loss type flag
@@ -126,7 +143,10 @@ def parse(file):
     parser.setFeature(xml.sax.handler.feature_namespaces, 0)
     p = _Parser()
     parser.setContentHandler(p)
-    parser.parse(file)
+    for name in files:
+        file = open(name)
+        parser.parse(file)
+        file.close()
     return p.result
 
 if __name__ == "__main__":