Repository: CVEProject/cve-services
Pull request #351 (2021-03-30 00:08:17)

Issue 276/277
This PR resolves issue #276 and issue #277 



Patch:
diff --git a/src/controller/cve-id.controller/cve-id.middleware.js b/src/controller/cve-id.controller/cve-id.middleware.js
index ae5b0293..223bdd9b 100644
--- a/src/controller/cve-id.controller/cve-id.middleware.js
+++ b/src/controller/cve-id.controller/cve-id.middleware.js
@@ -4,9 +4,7 @@ const error = new errors.CveIdControllerError()
 const utils = require('../../utils/utils')
 
 function parseGetParams (req, res, next) {
-  utils.reqCtxMapping(req, 'query', [
-    'state', 'cve_id_year',
-    'time_reserved.lt', 'time_reserved.gt', 'time_modified.lt', 'time_modified.gt'])
+  utils.reqCtxMapping(req, 'query', ['state', 'cve_id_year', 'time_reserved.lt', 'time_reserved.gt', 'time_modified.lt', 'time_modified.gt'])
   utils.reqCtxMapping(req, 'params', ['id'])
   next()
 }
diff --git a/src/controller/cve.controller/cve.controller.js b/src/controller/cve.controller/cve.controller.js
index d3a88748..0980af87 100644
--- a/src/controller/cve.controller/cve.controller.js
+++ b/src/controller/cve.controller/cve.controller.js
@@ -22,11 +22,44 @@ async function getCve (req, res, next) {
   }
 }
 
-async function getAllCves (req, res, next) {
+async function getFilteredCves (req, res, next) {
   try {
     options.page = req.ctx.paginator.page
     const cveRepo = req.ctx.repositories.getCveRepository()
+    const timeModified = {
+      timeStamp: [],
+      dateOperator: []
+    }
+
+    Object.keys(req.ctx.query).forEach(k => {
+      const key = k.toLowerCase()
+
+      if (key === 'time_modified.lt') {
+        timeModified.dateOperator.push('lt')
+        timeModified.timeStamp.push(req.ctx.query['time_modified.lt'])
+      } else if (key === 'time_modified.gt') {
+        timeModified.dateOperator.push('gt')
+        timeModified.timeStamp.push(req.ctx.query['time_modified.gt'])
+      }
+    })
+
+    const query = {}
+    if (timeModified.timeStamp.length > 0) {
+      query['time.modified'] = {}
+
+      for (let i = 0; i < timeModified.timeStamp.length; i++) {
+        if (timeModified.dateOperator[i] === 'lt') {
+          query['time.modified'].$lt = timeModified.timeStamp[i]
+        } else {
+          query['time.modified'].$gt = timeModified.timeStamp[i]
+        }
+      }
+    }
+
     const agt = [
+      {
+        $match: query
+      },
       {
         $project: {
           _id: false,
@@ -186,7 +219,7 @@ async function updateCve (req, res, next) {
 
 module.exports = {
   CVE_GET_SINGLE: getCve,
-  CVE_LIST_ALL: getAllCves,
+  CVE_GET_FILTERED: getFilteredCves,
   CVE_SUBMIT: submitCve,
   CVE_UPDATE_SINGLE: updateCve
 }
diff --git a/src/controller/cve.controller/cve.middleware.js b/src/controller/cve.controller/cve.middleware.js
index 5777a3bb..d8d61aa3 100644
--- a/src/controller/cve.controller/cve.middleware.js
+++ b/src/controller/cve.controller/cve.middleware.js
@@ -10,10 +10,28 @@ function parsePostParams (req, res, next) {
 }
 
 function parseGetParams (req, res, next) {
+  utils.reqCtxMapping(req, 'query', ['time_modified.lt', 'time_modified.gt'])
   utils.reqCtxMapping(req, 'params', ['id'])
   next()
 }
 
+// Sanitizer for dates
+function toDate (val) {
+  let value = val.match(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}$/)
+  let result
+  if (value) {
+    result = new Date(`${value[0]}.000+00:00`)
+  } else {
+    value = val.match(/^\d{4}-\d{2}-\d{2}$/)
+    if (value) {
+      result = new Date(`${value[0]}T00:00:00.000+00:00`)
+    } else {
+      result = null
+    }
+  }
+  return result
+}
+
 function parseError (req, res, next) {
   const err = validationResult(req).formatWith(({ location, msg, param, value, nestedErrors }) => {
     return { msg: msg, param: param, location: location }
@@ -27,5 +45,6 @@ function parseError (req, res, next) {
 module.exports = {
   parseGetParams,
   parsePostParams,
-  parseError
+  parseError,
+  toDate
 }
diff --git a/src/controller/cve.controller/index.js b/src/controller/cve.controller/index.js
index 5ae1de50..58a19b02 100644
--- a/src/controller/cve.controller/index.js
+++ b/src/controller/cve.controller/index.js
@@ -2,8 +2,8 @@ const express = require('express')
 const router = express.Router()
 const mw = require('../../middleware/middleware')
 const controller = require('./cve.controller')
-const { param } = require('express-validator')
-const { parseGetParams, parsePostParams, parseError } = require('./cve.middleware')
+const { param, query } = require('express-validator')
+const { parseGetParams, parsePostParams, parseError, toDate } = require('./cve.middleware')
 
 router.get('/cve/:id',
   mw.onlySecretariat,
@@ -16,9 +16,11 @@ router.get('/cve/:id',
 router.get('/cve',
   mw.onlySecretariat,
   mw.validateUser,
+  query(['time_modified.lt']).optional().isString().trim().escape().customSanitizer(val => { return toDate(val) }).not().isEmpty(),
+  query(['time_modified.gt']).optional().isString().trim().escape().customSanitizer(val => { return toDate(val) }).not().isEmpty(),
   parseError,
   parseGetParams,
-  controller.CVE_LIST_ALL)
+  controller.CVE_GET_FILTERED)
 
 router.post('/cve/:id',
   mw.onlySecretariat,


Test patch:
diff --git a/test/unit-tests/cve/cveGetAllTest.js b/test/unit-tests/cve/cveGetAllTest.js
index deb7dd9f..ac573806 100644
--- a/test/unit-tests/cve/cveGetAllTest.js
+++ b/test/unit-tests/cve/cveGetAllTest.js
@@ -38,7 +38,7 @@ describe('Testing the GET /cve endpoint in Cve Controller', () => {
           }
           req.ctx.repositories = factory
           next()
-        }, cveParams.parseGetParams, cveController.CVE_LIST_ALL)
+        }, cveParams.parseGetParams, cveController.CVE_GET_FILTERED)
 
       chai.request(server)
         .get('/cve-get-all-records-positive-tests-non-empty')
@@ -88,7 +88,7 @@ describe('Testing the GET /cve endpoint in Cve Controller', () => {
           }
           req.ctx.repositories = factory
           next()
-        }, cveParams.parseGetParams, cveController.CVE_LIST_ALL)
+        }, cveParams.parseGetParams, cveController.CVE_GET_FILTERED)
 
       chai.request(server)
         .get('/cve-get-all-records-positive-tests-empty')