<commit_before>#!/usr/bin/env python3
"""Takes JSON output and creates a vulnerability roundup issue.

Feed the output of `vulnix --json` into this script to create the issue
description.
"""

import urllib.parse
import argparse
import json
import sys


def whitelist(pkgs, ignore):
    res = []
    for pkg in pkgs:
        affected_by = [cve for cve in pkg['affected_by'] if cve not in ignore]
        pkg['affected_by'] = affected_by
        if len(affected_by):
            res.append(pkg)
    return res


def parse(json_file):
    if json_file:
        return json.load(json_file)
    return json.load(sys.stdin)


def fmt(pkgs):
    for pkg in sorted(pkgs, key=lambda p: p['name']):
        name = pkg['name']
        quotedname = urllib.parse.quote_plus(pkg['pname'])
        search = 'https://search.nix.gsc.io/?q={}&i=fosho&repos=nixos-nixpkgs'.\
            format(quotedname)
        files = 'https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q={}+in%3Apath&type=Code'.\
            format(quotedname)
        print("### {name} ([search]({search}), [files]({files}))".\
              format(name=name, search=search, files=files))
        cves = ("[{}]({})".format(
            cve, "https://web.nvd.nist.gov/view/vuln/detail?vulnId="+cve)
            for cve in sorted(pkg['affected_by']))
        for cve in cves:
            print(' - [ ] {}'.format(cve))
        print()

def main():
    a = argparse.ArgumentParser(description=__doc__)
    a.add_argument('VULNIX_JSON', nargs='?', type=argparse.FileType('r'),
                   help='vulnix json output (file or "-")')
    a.add_argument('-i', '--ignore', type=argparse.FileType('r'),
                   help='List of CVEs to ignore (one per line)')
    a.add_argument('-g', '--git-id', default='HEAD',
                   help='nixpkgs commit used for scanning')
    args = a.parse_args()
    if args.ignore:
        ignore = set(args.ignore.read().split())
    else:
        ignore = set()
    print('Scanned nixos/release-combined.nix @ {id}. Filtered out '
          'previously reported CVEs. May contain false positives.\n'.
          format(id=args.git_id[:7]))
    fmt(whitelist(parse(args.VULNIX_JSON), ignore))
    print("""\
Cc:  @NixOS/security-notifications, @joepie91, @phanimahesh, @the-kenny, @7c6f434c, @k0001, @peterhoeg, @nh2, @LnL7

Contact @ckauhaus for any questions.
""")

<commit_msg>Remove obsolete notification<commit_after>#!/usr/bin/env python3
"""Takes JSON output and creates a vulnerability roundup issue.

Feed the output of `vulnix --json` into this script to create the issue
description.
"""

import urllib.parse
import argparse
import json
import sys


def whitelist(pkgs, ignore):
    res = []
    for pkg in pkgs:
        affected_by = [cve for cve in pkg['affected_by'] if cve not in ignore]
        pkg['affected_by'] = affected_by
        if len(affected_by):
            res.append(pkg)
    return res


def parse(json_file):
    if json_file:
        return json.load(json_file)
    return json.load(sys.stdin)


def fmt(pkgs):
    for pkg in sorted(pkgs, key=lambda p: p['name']):
        name = pkg['name']
        quotedname = urllib.parse.quote_plus(pkg['pname'])
        search = 'https://search.nix.gsc.io/?q={}&i=fosho&repos=nixos-nixpkgs'.\
            format(quotedname)
        files = 'https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q={}+in%3Apath&type=Code'.\
            format(quotedname)
        print("### {name} ([search]({search}), [files]({files}))".\
              format(name=name, search=search, files=files))
        cves = ("[{}]({})".format(
            cve, "https://web.nvd.nist.gov/view/vuln/detail?vulnId="+cve)
            for cve in sorted(pkg['affected_by']))
        for cve in cves:
            print(' - [ ] {}'.format(cve))
        print()

def main():
    a = argparse.ArgumentParser(description=__doc__)
    a.add_argument('VULNIX_JSON', nargs='?', type=argparse.FileType('r'),
                   help='vulnix json output (file or "-")')
    a.add_argument('-i', '--ignore', type=argparse.FileType('r'),
                   help='List of CVEs to ignore (one per line)')
    a.add_argument('-g', '--git-id', default='HEAD',
                   help='nixpkgs commit used for scanning')
    args = a.parse_args()
    if args.ignore:
        ignore = set(args.ignore.read().split())
    else:
        ignore = set()
    print('Scanned nixos/release-combined.nix @ {id}. Filtered out '
          'previously reported CVEs. May contain false positives.\n'.
          format(id=args.git_id[:7]))
    fmt(whitelist(parse(args.VULNIX_JSON), ignore))
    print("""\
Cc: @joepie91, @phanimahesh, @the-kenny, @7c6f434c, @k0001, @peterhoeg, @nh2, @LnL7

Contact @ckauhaus for any questions.
""")


{'fraction_non_alphanumeric': 0.16023613746573898, 'fraction_numerical': 0.008855154965211892, 'mean_word_length': 2.77406523468576, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 6, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6063983', 'n_tokens_mistral': 1709, 'n_tokens_neox': 1616, 'n_words': 359}