secomlint/src/parser.py at 925b45012283ef49eefa5d29166b6a7a1c9df3fa · security-commits/secomlint · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

def parse_header(header):
    ftype, fheader, vuln_id = '', header, ''
    if ':' in header:
        ftype, fheader = header.split(':')
    if '(' in header:
        header, vuln_id = header.split('(')
        fheader = header.strip()
        vuln_id = vuln_id.replace(')','').strip()
    return ftype, fheader, vuln_id

def parse_body(body):
    what, why, how = '', '', ''
    if len(body) > 0:
        body_sentences = body.split('\n')
        if len(body_sentences) > 0:
            for sentence in body_sentences:
                if '(what)' in sentence:
                    what = sentence.replace('(what)', '').lstrip()
                elif '(why)' in sentence:
                    why = sentence
                elif '(how)' in sentence:
                    how = sentence
        if len(body_sentences) == 3:
            what, why, how = body_sentences[0].replace('(what)', '').lstrip(), \
                            body_sentences[1].replace('(why)', '').lstrip(), \
                            body_sentences[2].replace('(how)', '').lstrip()

    return what, why, how

def split(message):
    smsg = message.split("\n\n")
    header, body, metadata, contacts, tracker = '', '', '', '', ''
    for idx, info in enumerate(smsg):
        info_split = info.split('\n')
        if idx == 0 and len(info_split) == 1:
            header = info
        elif 'weakness:' in info.lower() or \
            'severity:' in info.lower() or \
            'cvss:' in info.lower() or \
            'detection:' in info.lower() or \
            'introduced in:' in info.lower():
            metadata = info
        elif 'reported-by:' in info.lower() or \
            'signed-off-by:' in info.lower() or \
                'reported by:' in info.lower() or \
                'signed off by:' in info.lower():
            contacts = info
        elif 'resolves:' in info.lower() or \
            'bug-tracker:' in info.lower():
            tracker = info
        else:
            body = info
    return header, body, metadata, contacts, tracker

def parse(message):
    header, body, metadata, contacts, tracker = split(message)
    ftype, header, vuln_id = parse_header(header)
    what, why, how = parse_body(body)
    return ftype, header, vuln_id, {'what': what, 'why': why, 'how': how}#, body, metadata, contacts, tracker