GSoC 20: Week 5
Tags: gsoc, python, opensource
Published: 2020-07-07 08:05:57

Hello everyone,
It's Niraj again and today, I will be sharing my code contribution of the fifth week of the GSoC.
## Background
The CVE Binary Tool package also includes a tool called *csv2cve* which is a helper tool that allows you to search the local database for a list of known vendor, product and version. It takes a list of vendor, product and version from a CSV file and outputs a list of CVEs known to affect those products.

*csv2cve* is a separate module which supports all the command line arguments supported by *cve-bin-tool* with just a one difference instead of taking directory to scan as an input it takes a CSV file as an input.

> If you want to know more about *csv2cve*, checkout our official [user-manual](https://github.com/intel/cve-bin-tool/blob/master/doc/CSV2CVE.md)

One of the big things that people often have to do with lists of known CVEs is to figure out which of them really apply to their product (and ignore any false positives), as well as just decide which ones they'll fix and which ones they may ignore. I would expect people to, say, export to CSV and then open that in their spreadsheet reader and make notes, but then if they run a new scan they have to redo it all again. 

One of my goal for GSoC is to extend functionality of *csv2cve* for other formats like JSON and allow *cve-bin-tool* to accept some form of triage data and incorporate that into the output so that people could spend less time re-triaging.

So, my plan is to replace *csv2cve* with new *input_engine* module which will introduce a new flag `-i` to specify input file. It will handle parsing different input format and triage data. With this new architecture, we can retire *csv2cve* and have everything run via a flag on *cve-bin-tool*.

## What did I do this week?
I have created the *input_engine* module that supports parsing data from any input format (currently CSV and JSON). User can now add remarks field in CSV or JSON which can have any value from following values:
1. NewFound (1, n, N)
2. Unexplored (2, u, U)
3. Confirmed (3, c, C)
4. Mitigated, (4, m, M)
5. Ignored (5, i, I)

I have also provided aliases for this values. All the characters denoted in parenthesis are aliases for that specific value. Output will be displayed in the same order as priority given to the remarks.

One can implement functionality of aliases using dictionary but that won't look that much idiomatic. So, I have implemented remarks functionality using *enum* with custom constructor.

```python
class Remarks(OrderedEnum):
    NewFound = 1, "1", "NewFound", "n", "N"
    Unexplored = 2, "2", "Unexplored", "u", "U", ""
    Mitigated = 4, "4", "Mitigated", "m", "M"
    Confirmed = 3, "3", "Confirmed", "c", "C"
    Ignored = 5, "5", "Ignored", "i", "I"

    def __new__(cls, value, *aliases):
        obj = object.__new__(cls)
        obj._value_ = value
        for alias in aliases:
            cls._value2member_map_[alias] = obj
        return obj
```
Here, I am using [OrderedEnum](https://docs.python.org/3/library/enum.html#orderedenum) as base class instead of normal [Enum](https://docs.python.org/3/library/enum.html#creating-an-enum) which provides comparison operators necessary for priority wise sorting.

I have also added --input-file(-i) option in the *cli.py* to specify input file which will be parsed by *input_engine* and this parsed data will be used by *output_engine* to display CVEs according to remarks.

User can now use `--input-file` option to produce list of CVEs
 (Usage: `cve-bin-tool -i=test.csv`) or supplement triage data while scanning directory so that output will be sorted according to remarks (Usage: `cve-bin-tool -i=test.csv /path/to/scan`). 

As you can see in below output snippet, CVEs are now categorized according to remarks specified in input file.
{% jsfiddle https://jsfiddle.net/r5oLhbkt/ result %}


I have also added test cases for *input_engine* and removed test cases for old *csv2cve*.

## What am I doing this week? 
I have exams this week from 6th July to 9th July. So, I won't be able to do much during this week but I will spend my weekend improving input_engine.