|
| 1 | +// Copyright 2025 The OpenVEX Authors |
| 2 | +// SPDX-License-Identifier: Apache-2.0 |
| 3 | + |
| 4 | +package index |
| 5 | + |
| 6 | +import ( |
| 7 | + "fmt" |
| 8 | + "slices" |
| 9 | + |
| 10 | + "github.com/openvex/go-vex/pkg/vex" |
| 11 | +) |
| 12 | + |
| 13 | +// New creates a new VEX index with the specified functions |
| 14 | +func New(funcs ...constructorFunc) (*StatementIndex, error) { |
| 15 | + si := &StatementIndex{} |
| 16 | + for _, fn := range funcs { |
| 17 | + if err := fn(si); err != nil { |
| 18 | + return nil, err |
| 19 | + } |
| 20 | + } |
| 21 | + return si, nil |
| 22 | +} |
| 23 | + |
| 24 | +type constructorFunc func(*StatementIndex) error |
| 25 | + |
| 26 | +// WithDocument adds all the statements in a document to the index |
| 27 | +func WithDocument(doc *vex.VEX) constructorFunc { |
| 28 | + return func(si *StatementIndex) error { |
| 29 | + statements := []*vex.Statement{} |
| 30 | + for i := range doc.Statements { |
| 31 | + statements = append(statements, &doc.Statements[i]) |
| 32 | + } |
| 33 | + si.IndexStatements(statements) |
| 34 | + return nil |
| 35 | + } |
| 36 | +} |
| 37 | + |
| 38 | +// WithStatements adds statements to a newly created index |
| 39 | +func WithStatements(statements []*vex.Statement) constructorFunc { |
| 40 | + return func(si *StatementIndex) error { |
| 41 | + si.IndexStatements(statements) |
| 42 | + return nil |
| 43 | + } |
| 44 | +} |
| 45 | + |
| 46 | +// StatementIndex is the OpenVEX statement indexer. An index reads into memory |
| 47 | +// vex statements and catalogs them by the fields in their components |
| 48 | +// (vulnerability, product, subcomponents). |
| 49 | +// |
| 50 | +// The index exposes a StatementIndex.Match() function that takes in Filters |
| 51 | +// to return indexed statements that match the filter criteria. |
| 52 | +type StatementIndex struct { |
| 53 | + vulnIndex map[string][]*vex.Statement |
| 54 | + prodIndex map[string][]*vex.Statement |
| 55 | + subIndex map[string][]*vex.Statement |
| 56 | +} |
| 57 | + |
| 58 | +// IndexStatements indexes all the passed statements by cataloguing the |
| 59 | +// fields in the product, vulnerability and subcomponents. |
| 60 | +func (si *StatementIndex) IndexStatements(statements []*vex.Statement) { |
| 61 | + si.vulnIndex = map[string][]*vex.Statement{} |
| 62 | + si.prodIndex = map[string][]*vex.Statement{} |
| 63 | + si.subIndex = map[string][]*vex.Statement{} |
| 64 | + |
| 65 | + for _, s := range statements { |
| 66 | + for _, p := range s.Products { |
| 67 | + if p.ID != "" { |
| 68 | + si.prodIndex[p.ID] = append(si.prodIndex[p.ID], s) |
| 69 | + } |
| 70 | + for _, id := range p.Identifiers { |
| 71 | + if !slices.Contains(si.prodIndex[id], s) { |
| 72 | + si.prodIndex[id] = append(si.prodIndex[id], s) |
| 73 | + } |
| 74 | + } |
| 75 | + for algo, h := range p.Hashes { |
| 76 | + if !slices.Contains(si.prodIndex[string(h)], s) { |
| 77 | + si.prodIndex[string(h)] = append(si.prodIndex[string(h)], s) |
| 78 | + } |
| 79 | + if !slices.Contains(si.prodIndex[fmt.Sprintf("%s:%s", algo, h)], s) { |
| 80 | + si.prodIndex[fmt.Sprintf("%s:%s", algo, h)] = append(si.prodIndex[fmt.Sprintf("%s:%s", algo, h)], s) |
| 81 | + } |
| 82 | + intotoAlgo := algo.ToInToto() |
| 83 | + if intotoAlgo == "" { |
| 84 | + continue |
| 85 | + } |
| 86 | + if !slices.Contains(si.prodIndex[fmt.Sprintf("%s:%s", intotoAlgo, h)], s) { |
| 87 | + si.prodIndex[fmt.Sprintf("%s:%s", intotoAlgo, h)] = append(si.prodIndex[fmt.Sprintf("%s:%s", intotoAlgo, h)], s) |
| 88 | + } |
| 89 | + } |
| 90 | + |
| 91 | + // Index the subcomponents |
| 92 | + for _, sc := range p.Subcomponents { |
| 93 | + // Match by ID too |
| 94 | + if sc.ID != "" && !slices.Contains(si.subIndex[sc.ID], s) { |
| 95 | + si.subIndex[sc.ID] = append(si.subIndex[sc.ID], s) |
| 96 | + } |
| 97 | + for _, id := range sc.Identifiers { |
| 98 | + if !slices.Contains(si.subIndex[id], s) { |
| 99 | + si.subIndex[id] = append(si.subIndex[id], s) |
| 100 | + } |
| 101 | + } |
| 102 | + for _, h := range sc.Hashes { |
| 103 | + if !slices.Contains(si.subIndex[string(h)], s) { |
| 104 | + si.subIndex[string(h)] = append(si.subIndex[string(h)], s) |
| 105 | + } |
| 106 | + } |
| 107 | + } |
| 108 | + } |
| 109 | + |
| 110 | + if s.Vulnerability.Name != "" { |
| 111 | + if !slices.Contains(si.vulnIndex[string(s.Vulnerability.Name)], s) { |
| 112 | + si.vulnIndex[string(s.Vulnerability.Name)] = append(si.vulnIndex[string(s.Vulnerability.Name)], s) |
| 113 | + } |
| 114 | + } |
| 115 | + for _, alias := range s.Vulnerability.Aliases { |
| 116 | + if !slices.Contains(si.vulnIndex[string(alias)], s) { |
| 117 | + si.vulnIndex[string(alias)] = append(si.vulnIndex[string(alias)], s) |
| 118 | + } |
| 119 | + } |
| 120 | + } |
| 121 | +} |
| 122 | + |
| 123 | +// unionIndexResults |
| 124 | +func unionIndexResults(results []map[*vex.Statement]struct{}) []*vex.Statement { |
| 125 | + if len(results) == 0 { |
| 126 | + return []*vex.Statement{} |
| 127 | + } |
| 128 | + preret := map[*vex.Statement]struct{}{} |
| 129 | + // Since we're looking for statements in all results, we can just |
| 130 | + // cycle the shortest list against the others |
| 131 | + slices.SortFunc(results, func(a, b map[*vex.Statement]struct{}) int { |
| 132 | + if len(a) == len(b) { |
| 133 | + return 0 |
| 134 | + } |
| 135 | + if len(a) < len(b) { |
| 136 | + return -1 |
| 137 | + } |
| 138 | + return 1 |
| 139 | + }) |
| 140 | + |
| 141 | + var found bool |
| 142 | + for s := range results[0] { |
| 143 | + // if this is present in all lists, we're in |
| 144 | + found = true |
| 145 | + for i := range results[1:] { |
| 146 | + if _, ok := results[i][s]; !ok { |
| 147 | + found = false |
| 148 | + break |
| 149 | + } |
| 150 | + } |
| 151 | + if found { |
| 152 | + preret[s] = struct{}{} |
| 153 | + } |
| 154 | + } |
| 155 | + |
| 156 | + // Now assemble the list |
| 157 | + ret := []*vex.Statement{} |
| 158 | + for s := range preret { |
| 159 | + ret = append(ret, s) |
| 160 | + } |
| 161 | + return ret |
| 162 | +} |
| 163 | + |
| 164 | +// Matches applies filters to the index to look for matching statements |
| 165 | +func (si *StatementIndex) Matches(filterfunc ...FilterFunc) []*vex.Statement { |
| 166 | + lists := []map[*vex.Statement]struct{}{} |
| 167 | + for _, ffunc := range filterfunc { |
| 168 | + filter := ffunc(si) |
| 169 | + lists = append(lists, filter()) |
| 170 | + } |
| 171 | + return unionIndexResults(lists) |
| 172 | +} |
0 commit comments