mirror of
https://github.com/RuoJi6/ARTEX.git
synced 2026-10-27 17:03:49 +08:00
638 lines
25 KiB
Go
638 lines
25 KiB
Go
package db
|
|
|
|
import (
|
|
"context"
|
|
"database/sql"
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"sort"
|
|
"strconv"
|
|
"strings"
|
|
"time"
|
|
)
|
|
|
|
var ErrFindingCaseConflict = errors.New("漏洞组已变更，请重新读取证据后再操作")
|
|
|
|
type FindingCase struct {
|
|
ID int64 `json:"id,string"`
|
|
TaskID *int64 `json:"task_id,string"`
|
|
Title string `json:"title"`
|
|
Reason string `json:"reason"`
|
|
Severity string `json:"severity"`
|
|
SeverityReason string `json:"severity_reason"`
|
|
Report string `json:"report,omitempty"`
|
|
Version int64 `json:"version"`
|
|
ReportVersion int64 `json:"report_version"`
|
|
Active bool `json:"active"`
|
|
Count int `json:"count"`
|
|
Critical int `json:"critical"`
|
|
High int `json:"high"`
|
|
Medium int `json:"medium"`
|
|
Low int `json:"low"`
|
|
CreatedAt time.Time `json:"created_at"`
|
|
}
|
|
type FindingCaseEvent struct {
|
|
ID int64 `json:"id,string"`
|
|
Action string `json:"action"`
|
|
Actor string `json:"actor"`
|
|
Reason string `json:"reason"`
|
|
FindingIDs json.RawMessage `json:"finding_ids"`
|
|
CreatedAt time.Time `json:"created_at"`
|
|
}
|
|
type FindingCaseSuggestion struct {
|
|
ID int64 `json:"id,string"`
|
|
TaskID int64 `json:"task_id,string"`
|
|
LeftID int64 `json:"left_id,string"`
|
|
RightID int64 `json:"right_id,string"`
|
|
Title string `json:"title"`
|
|
Reason string `json:"reason"`
|
|
State string `json:"state"`
|
|
}
|
|
type FindingCaseRow struct {
|
|
Case *FindingCase `json:"case,omitempty"`
|
|
FindingID int64 `json:"finding_id,string,omitempty"`
|
|
MatchedIDs []int64 `json:"matched_ids"`
|
|
}
|
|
|
|
const caseColumns = `c.id,c.task_id,c.title,c.reason,c.severity,c.severity_reason,c.report,c.version,c.report_version,c.active,c.created_at`
|
|
|
|
func scanCase(row interface{ Scan(...any) error }) (*FindingCase, error) {
|
|
c := new(FindingCase)
|
|
err := row.Scan(&c.ID, &c.TaskID, &c.Title, &c.Reason, &c.Severity, &c.SeverityReason, &c.Report, &c.Version, &c.ReportVersion, &c.Active, &c.CreatedAt)
|
|
return c, err
|
|
}
|
|
func (d *DB) GetFindingCase(id int64) (*FindingCase, error) {
|
|
c, err := scanCase(d.QueryRow(`SELECT `+caseColumns+` FROM finding_cases c WHERE id=$1`, id))
|
|
if errors.Is(err, sql.ErrNoRows) {
|
|
return nil, nil
|
|
}
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
err = d.QueryRow(`SELECT count(*),count(*) FILTER(WHERE severity='critical'),count(*) FILTER(WHERE severity='high'),count(*) FILTER(WHERE severity='medium'),count(*) FILTER(WHERE severity='low') FROM findings f JOIN finding_case_members m ON m.finding_id=f.id WHERE m.case_id=$1`, id).Scan(&c.Count, &c.Critical, &c.High, &c.Medium, &c.Low)
|
|
return c, err
|
|
}
|
|
func (d *DB) FindingCaseID(id int64) (int64, error) {
|
|
var cid int64
|
|
err := d.QueryRow(`SELECT case_id FROM finding_case_members WHERE finding_id=$1`, id).Scan(&cid)
|
|
if errors.Is(err, sql.ErrNoRows) {
|
|
return 0, nil
|
|
}
|
|
return cid, err
|
|
}
|
|
func (d *DB) FindingCaseMembers(id int64, page, size int) ([]*DBFinding, int, error) {
|
|
var count int
|
|
if err := d.QueryRow(`SELECT count(*) FROM finding_case_members WHERE case_id=$1`, id).Scan(&count); err != nil {
|
|
return nil, 0, err
|
|
}
|
|
rows, err := d.Query(`SELECT `+findingSelectCols+` FROM findings f LEFT JOIN tasks t ON t.id=f.task_id JOIN finding_case_members m ON m.finding_id=f.id WHERE m.case_id=$1 ORDER BY f.id LIMIT $2 OFFSET $3`, id, size, (page-1)*size)
|
|
if err != nil {
|
|
return nil, 0, err
|
|
}
|
|
defer rows.Close()
|
|
fs, err := scanFindings(rows)
|
|
return fs, count, err
|
|
}
|
|
func (d *DB) FindingCaseEvents(id int64) ([]FindingCaseEvent, error) {
|
|
rows, err := d.Query(`SELECT id,action,actor,reason,finding_ids,created_at FROM finding_case_events WHERE case_id=$1 ORDER BY id DESC`, id)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
out := []FindingCaseEvent{}
|
|
for rows.Next() {
|
|
var e FindingCaseEvent
|
|
if err := rows.Scan(&e.ID, &e.Action, &e.Actor, &e.Reason, &e.FindingIDs, &e.CreatedAt); err != nil {
|
|
return nil, err
|
|
}
|
|
out = append(out, e)
|
|
}
|
|
return out, rows.Err()
|
|
}
|
|
func (d *DB) ListFindingCases(filter FindingFilter, page, size int) ([]FindingCaseRow, int, error) {
|
|
var err error
|
|
filter, err = d.applyAssetScope(filter)
|
|
if err != nil {
|
|
return nil, 0, err
|
|
}
|
|
where, args := filter.where()
|
|
base := `WITH matched AS (SELECT f.id,f.severity,f.created_at,COALESCE(m.case_id,0) cid FROM findings f LEFT JOIN tasks t ON t.id=f.task_id LEFT JOIN finding_case_members m ON m.finding_id=f.id` + where + `), entities AS (SELECT CASE WHEN cid>0 THEN 'c:'||cid ELSE 'f:'||id END key,MAX(cid) cid,MIN(id) fid,jsonb_agg(id ORDER BY id) matched_ids,MAX(created_at) created,MAX(CASE severity WHEN 'critical' THEN 4 WHEN 'high' THEN 3 WHEN 'medium' THEN 2 WHEN 'low' THEN 1 ELSE 0 END) severity_rank FROM matched GROUP BY key)`
|
|
var total int
|
|
if err := d.QueryRow(base+` SELECT count(*) FROM entities`, args...).Scan(&total); err != nil {
|
|
return nil, 0, err
|
|
}
|
|
order := `e.created DESC,e.fid DESC`
|
|
if filter.Sort == "severity" {
|
|
order = `e.severity_rank DESC,` + order
|
|
}
|
|
args = append(args, size, (page-1)*size)
|
|
rows, err := d.Query(base+fmt.Sprintf(` SELECT e.cid,e.fid,e.matched_ids FROM entities e ORDER BY %s LIMIT $%d OFFSET $%d`, order, len(args)-1, len(args)), args...)
|
|
if err != nil {
|
|
return nil, 0, err
|
|
}
|
|
out := []FindingCaseRow{}
|
|
groups := []int64{}
|
|
for rows.Next() {
|
|
var cid, fid int64
|
|
var raw []byte
|
|
if err := rows.Scan(&cid, &fid, &raw); err != nil {
|
|
rows.Close()
|
|
return nil, 0, err
|
|
}
|
|
r := FindingCaseRow{FindingID: fid}
|
|
if err := json.Unmarshal(raw, &r.MatchedIDs); err != nil {
|
|
rows.Close()
|
|
return nil, 0, err
|
|
}
|
|
out = append(out, r)
|
|
groups = append(groups, cid)
|
|
}
|
|
err = rows.Err()
|
|
rows.Close()
|
|
if err != nil {
|
|
return nil, 0, err
|
|
}
|
|
for i, cid := range groups {
|
|
if cid > 0 {
|
|
c, err := scanCase(d.QueryRow(`SELECT `+strings.Replace(caseColumns, "c.report,", "''::text,", 1)+` FROM finding_cases c WHERE id=$1`, cid))
|
|
if err != nil {
|
|
return nil, 0, err
|
|
}
|
|
if err := d.QueryRow(`SELECT count(*),count(*) FILTER(WHERE severity='critical'),count(*) FILTER(WHERE severity='high'),count(*) FILTER(WHERE severity='medium'),count(*) FILTER(WHERE severity='low') FROM findings f JOIN finding_case_members m ON m.finding_id=f.id WHERE m.case_id=$1`, cid).Scan(&c.Count, &c.Critical, &c.High, &c.Medium, &c.Low); err != nil {
|
|
return nil, 0, err
|
|
}
|
|
out[i].Case = c
|
|
out[i].FindingID = 0
|
|
}
|
|
}
|
|
return out, total, nil
|
|
}
|
|
|
|
func sortedFindingIDs(ids []int64) ([]int64, error) {
|
|
set := map[int64]bool{}
|
|
out := []int64{}
|
|
for _, id := range ids {
|
|
if id <= 0 {
|
|
return nil, errors.New("无效漏洞编号")
|
|
}
|
|
if !set[id] {
|
|
set[id] = true
|
|
out = append(out, id)
|
|
}
|
|
}
|
|
sort.Slice(out, func(i, j int) bool { return out[i] < out[j] })
|
|
if len(out) < 2 {
|
|
return nil, errors.New("至少需要两条漏洞记录")
|
|
}
|
|
return out, nil
|
|
}
|
|
func lockCaseTask(tx *sql.Tx, taskID int64) error {
|
|
if taskID <= 0 {
|
|
return errors.New("归并需要仍存在的同一任务")
|
|
}
|
|
if _, err := tx.Exec(`SELECT pg_advisory_xact_lock($1)`, int64(5100000000000000)+taskID); err != nil {
|
|
return err
|
|
}
|
|
var id int64
|
|
return tx.QueryRow(`SELECT id FROM tasks WHERE id=$1 FOR UPDATE`, taskID).Scan(&id)
|
|
}
|
|
func (d *DB) MergeFindingCase(ctx context.Context, taskID int64, ids []int64, title, reason, actor string) (int64, error) {
|
|
return d.mergeFindingCase(ctx, taskID, ids, title, reason, actor, 0)
|
|
}
|
|
func (d *DB) mergeFindingCase(ctx context.Context, taskID int64, ids []int64, title, reason, actor string, suggestionID int64) (int64, error) {
|
|
ids, err := sortedFindingIDs(ids)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
if strings.TrimSpace(title) == "" || strings.TrimSpace(reason) == "" {
|
|
return 0, errors.New("必须提供漏洞名称及基于证据的归并理由")
|
|
}
|
|
var cid int64
|
|
err = d.WithEvidenceTx(ctx, func(tx *sql.Tx) error {
|
|
if err := lockCaseTask(tx, taskID); err != nil {
|
|
return err
|
|
}
|
|
if suggestionID > 0 {
|
|
var state string
|
|
if err := tx.QueryRow(`SELECT state FROM finding_case_suggestions WHERE id=$1 FOR UPDATE`, suggestionID).Scan(&state); err != nil {
|
|
return err
|
|
}
|
|
if state != "pending" {
|
|
return ErrFindingCaseConflict
|
|
}
|
|
}
|
|
groupSet := map[int64]bool{}
|
|
for _, id := range ids {
|
|
var tid sql.NullInt64
|
|
var group int64
|
|
if err := tx.QueryRow(`SELECT f.task_id,COALESCE(m.case_id,0) FROM findings f LEFT JOIN finding_case_members m ON m.finding_id=f.id WHERE f.id=$1`, id).Scan(&tid, &group); err != nil {
|
|
return err
|
|
}
|
|
if !tid.Valid || tid.Int64 != taskID {
|
|
return errors.New("只能归并同一任务的漏洞")
|
|
}
|
|
if group > 0 {
|
|
groupSet[group] = true
|
|
}
|
|
}
|
|
groups := []int64{}
|
|
for g := range groupSet {
|
|
groups = append(groups, g)
|
|
}
|
|
sort.Slice(groups, func(i, j int) bool { return groups[i] < groups[j] })
|
|
all := map[int64]bool{}
|
|
for _, id := range ids {
|
|
all[id] = true
|
|
}
|
|
for _, g := range groups {
|
|
rows, err := tx.Query(`SELECT finding_id FROM finding_case_members WHERE case_id=$1`, g)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
for rows.Next() {
|
|
var id int64
|
|
if err := rows.Scan(&id); err != nil {
|
|
rows.Close()
|
|
return err
|
|
}
|
|
all[id] = true
|
|
}
|
|
err = rows.Err()
|
|
rows.Close()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
}
|
|
ids = ids[:0]
|
|
for id := range all {
|
|
ids = append(ids, id)
|
|
}
|
|
sort.Slice(ids, func(i, j int) bool { return ids[i] < ids[j] })
|
|
raw, _ := json.Marshal(ids)
|
|
var blocked bool
|
|
if err := tx.QueryRow(`SELECT EXISTS(SELECT 1 FROM finding_case_blocks WHERE left_id IN(SELECT value::bigint FROM jsonb_array_elements_text($1::jsonb)) AND right_id IN(SELECT value::bigint FROM jsonb_array_elements_text($1::jsonb)))`, string(raw)).Scan(&blocked); err != nil {
|
|
return err
|
|
}
|
|
if blocked {
|
|
return errors.New("人工已否决或撤销这些记录的归并")
|
|
}
|
|
if len(groups) > 0 {
|
|
cid = groups[0]
|
|
} else {
|
|
if err := tx.QueryRow(`INSERT INTO finding_cases(task_id,origin_task_id,title,reason) VALUES($1,$1,$2,$3) RETURNING id`, taskID, title, reason).Scan(&cid); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
var changed int64
|
|
for _, id := range ids {
|
|
res, err := tx.Exec(`INSERT INTO finding_case_members(finding_id,case_id) VALUES($1,$2) ON CONFLICT(finding_id) DO UPDATE SET case_id=EXCLUDED.case_id WHERE finding_case_members.case_id<>EXCLUDED.case_id`, id, cid)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
n, _ := res.RowsAffected()
|
|
changed += n
|
|
}
|
|
for _, g := range groups {
|
|
if g != cid {
|
|
if _, err := tx.Exec(`UPDATE finding_cases SET active=false,version=version+1 WHERE id=$1`, g); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
}
|
|
if changed > 0 {
|
|
if _, err := tx.Exec(`UPDATE finding_cases SET version=version+1 WHERE id=$1`, cid); err != nil {
|
|
return err
|
|
}
|
|
if _, err := tx.Exec(`INSERT INTO finding_case_events(case_id,action,actor,reason,finding_ids) VALUES($1,'merge',$2,$3,$4)`, cid, actor, reason, string(raw)); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
_, err := tx.Exec(`UPDATE finding_case_suggestions SET state='accepted' WHERE state='pending' AND left_id IN(SELECT value::bigint FROM jsonb_array_elements_text($1::jsonb)) AND right_id IN(SELECT value::bigint FROM jsonb_array_elements_text($1::jsonb))`, string(raw))
|
|
return err
|
|
})
|
|
return cid, err
|
|
}
|
|
func (d *DB) RemoveFindingCaseMember(ctx context.Context, cid, fid int64, reason string) error {
|
|
c, err := d.GetFindingCase(cid)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if c == nil {
|
|
return errors.New("归并组不存在")
|
|
}
|
|
return d.WithEvidenceTx(ctx, func(tx *sql.Tx) error {
|
|
var origin int64
|
|
if err := tx.QueryRow(`SELECT origin_task_id FROM finding_cases WHERE id=$1`, cid).Scan(&origin); err != nil {
|
|
return err
|
|
}
|
|
if _, err := tx.Exec(`SELECT pg_advisory_xact_lock($1)`, int64(5100000000000000)+origin); err != nil {
|
|
return err
|
|
}
|
|
// Deleting a task retains its findings and folder history.
|
|
var live int64
|
|
if err := tx.QueryRow(`SELECT id FROM tasks WHERE id=$1 FOR UPDATE`, origin).Scan(&live); err != nil && !errors.Is(err, sql.ErrNoRows) {
|
|
return err
|
|
}
|
|
var current int64
|
|
if err := tx.QueryRow(`SELECT case_id FROM finding_case_members WHERE finding_id=$1`, fid).Scan(¤t); err != nil {
|
|
if errors.Is(err, sql.ErrNoRows) {
|
|
var removed bool
|
|
// A repeated removal, or a last member released by dissolution, is idempotent.
|
|
err = tx.QueryRow(`SELECT EXISTS(SELECT 1 FROM finding_case_events WHERE case_id=$1 AND finding_ids @> jsonb_build_array($2::bigint))`, cid, fid).Scan(&removed)
|
|
if err == nil && removed {
|
|
return nil
|
|
}
|
|
}
|
|
return err
|
|
}
|
|
if current != cid {
|
|
return ErrFindingCaseConflict
|
|
}
|
|
if _, err := tx.Exec(`INSERT INTO finding_case_blocks(left_id,right_id,reason) SELECT LEAST($1,finding_id),GREATEST($1,finding_id),$3 FROM finding_case_members WHERE case_id=$2 AND finding_id<>$1 ON CONFLICT DO NOTHING`, fid, cid, reason); err != nil {
|
|
return err
|
|
}
|
|
if _, err := tx.Exec(`INSERT INTO finding_case_events(case_id,action,actor,reason,finding_ids) VALUES($1,'detach','human',$2,jsonb_build_array($3::bigint))`, cid, reason, fid); err != nil {
|
|
return err
|
|
}
|
|
_, err := tx.Exec(`DELETE FROM finding_case_members WHERE case_id=$1 AND finding_id=$2`, cid, fid)
|
|
return err
|
|
})
|
|
}
|
|
func (d *DB) UpdateFindingCaseReport(ctx context.Context, cid, version int64, title, report, severity, reason string) error {
|
|
if !ValidSeverity(severity) || strings.TrimSpace(report) == "" || strings.TrimSpace(reason) == "" || strings.TrimSpace(title) == "" {
|
|
return errors.New("完整报告、名称、有效等级和评级依据必填")
|
|
}
|
|
return d.WithEvidenceTx(ctx, func(tx *sql.Tx) error {
|
|
c, err := scanCase(tx.QueryRow(`SELECT `+caseColumns+` FROM finding_cases c WHERE id=$1 FOR UPDATE`, cid))
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if !c.Active || c.Version != version {
|
|
return ErrFindingCaseConflict
|
|
}
|
|
if c.Title == title && c.Report == report && c.Severity == severity && c.SeverityReason == reason && c.ReportVersion == version {
|
|
return nil
|
|
}
|
|
_, err = tx.Exec(`UPDATE finding_cases SET title=$2,report=$3,severity=$4,severity_reason=$5,report_version=$6 WHERE id=$1`, cid, title, report, severity, reason, version)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
_, err = tx.Exec(`INSERT INTO finding_case_events(case_id,action,actor,reason) VALUES($1,'report_updated','reporter',$2)`, cid, "统一报告已更新；评级依据："+reason)
|
|
return err
|
|
})
|
|
}
|
|
func (d *DB) SuggestFindingCase(ctx context.Context, taskID, left, right int64, title, reason string) (int64, error) {
|
|
if strings.TrimSpace(title) == "" || strings.TrimSpace(reason) == "" {
|
|
return 0, errors.New("建议需要名称和具体证据理由")
|
|
}
|
|
ids, err := sortedFindingIDs([]int64{left, right})
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
var id int64
|
|
err = d.WithEvidenceTx(ctx, func(tx *sql.Tx) error {
|
|
if err := lockCaseTask(tx, taskID); err != nil {
|
|
return err
|
|
}
|
|
for _, fid := range ids {
|
|
var tid sql.NullInt64
|
|
if err := tx.QueryRow(`SELECT task_id FROM findings WHERE id=$1`, fid).Scan(&tid); err != nil {
|
|
return err
|
|
}
|
|
if !tid.Valid || tid.Int64 != taskID {
|
|
return errors.New("只能建议同一任务的归并")
|
|
}
|
|
}
|
|
var blocked bool
|
|
if err := tx.QueryRow(`SELECT EXISTS(SELECT 1 FROM finding_case_blocks WHERE left_id=$1 AND right_id=$2)`, ids[0], ids[1]).Scan(&blocked); err != nil {
|
|
return err
|
|
}
|
|
if blocked {
|
|
return errors.New("人工已否决该归并")
|
|
}
|
|
return tx.QueryRow(`INSERT INTO finding_case_suggestions(task_id,left_id,right_id,title,reason) VALUES($1,$2,$3,$4,$5) ON CONFLICT(left_id,right_id) DO UPDATE SET reason=EXCLUDED.reason WHERE finding_case_suggestions.state='pending' RETURNING id`, taskID, ids[0], ids[1], title, reason).Scan(&id)
|
|
})
|
|
return id, err
|
|
}
|
|
func (d *DB) FindingCaseSuggestions(taskID int64) ([]FindingCaseSuggestion, error) {
|
|
rows, err := d.Query(`SELECT id,task_id,left_id,right_id,title,reason,state FROM finding_case_suggestions WHERE state='pending' AND ($1::bigint=0 OR task_id=$1) ORDER BY id DESC`, taskID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
out := []FindingCaseSuggestion{}
|
|
for rows.Next() {
|
|
var s FindingCaseSuggestion
|
|
if err := rows.Scan(&s.ID, &s.TaskID, &s.LeftID, &s.RightID, &s.Title, &s.Reason, &s.State); err != nil {
|
|
return nil, err
|
|
}
|
|
out = append(out, s)
|
|
}
|
|
return out, rows.Err()
|
|
}
|
|
func (d *DB) ResolveFindingCaseSuggestion(ctx context.Context, id int64, accept bool) (int64, error) {
|
|
var s FindingCaseSuggestion
|
|
if err := d.QueryRow(`SELECT task_id,left_id,right_id,title,reason,state FROM finding_case_suggestions WHERE id=$1`, id).Scan(&s.TaskID, &s.LeftID, &s.RightID, &s.Title, &s.Reason, &s.State); err != nil {
|
|
return 0, err
|
|
}
|
|
if s.State != "pending" {
|
|
return 0, ErrFindingCaseConflict
|
|
}
|
|
if accept {
|
|
return d.mergeFindingCase(ctx, s.TaskID, []int64{s.LeftID, s.RightID}, s.Title, s.Reason, "human", id)
|
|
}
|
|
return 0, d.WithEvidenceTx(ctx, func(tx *sql.Tx) error {
|
|
if err := lockCaseTask(tx, s.TaskID); err != nil {
|
|
return err
|
|
}
|
|
res, err := tx.Exec(`UPDATE finding_case_suggestions SET state='rejected' WHERE id=$1 AND state='pending'`, id)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if n, _ := res.RowsAffected(); n != 1 {
|
|
return ErrFindingCaseConflict
|
|
}
|
|
if _, err := tx.Exec(`INSERT INTO finding_case_blocks(left_id,right_id,reason) VALUES($1,$2,'人工否决') ON CONFLICT DO NOTHING`, s.LeftID, s.RightID); err != nil {
|
|
return err
|
|
}
|
|
return nil
|
|
})
|
|
}
|
|
|
|
type FindingDistinctStats struct {
|
|
Total int `json:"total"`
|
|
Reports int `json:"reports"`
|
|
Critical int `json:"critical"`
|
|
High int `json:"high"`
|
|
Medium int `json:"medium"`
|
|
Low int `json:"low"`
|
|
Unassessed int `json:"unassessed"`
|
|
}
|
|
|
|
func (d *DB) DistinctFindingStats(taskID string) (*FindingDistinctStats, error) {
|
|
filter := FindingFilter{TaskID: taskID}
|
|
where, args := filter.where()
|
|
s := new(FindingDistinctStats)
|
|
err := d.QueryRow(`WITH observations AS (SELECT f.id,f.severity,COALESCE(m.case_id,0) cid FROM findings f LEFT JOIN tasks t ON t.id=f.task_id LEFT JOIN finding_case_members m ON m.finding_id=f.id`+where+`), defects AS (SELECT severity FROM observations WHERE cid=0 UNION ALL SELECT c.severity FROM finding_cases c WHERE c.id IN(SELECT cid FROM observations WHERE cid>0)) SELECT count(*),(SELECT count(*) FROM observations),count(*) FILTER(WHERE severity='critical'),count(*) FILTER(WHERE severity='high'),count(*) FILTER(WHERE severity='medium'),count(*) FILTER(WHERE severity='low'),count(*) FILTER(WHERE severity='') FROM defects`, args...).Scan(&s.Total, &s.Reports, &s.Critical, &s.High, &s.Medium, &s.Low, &s.Unassessed)
|
|
return s, err
|
|
}
|
|
|
|
// Compact candidate pages exclude PoC/report bodies and do not treat severity as identity.
|
|
func (d *DB) FindingCaseCandidates(fid int64, page, size int, scope ...[]int64) ([]map[string]any, int, error) {
|
|
f, err := d.FindingCaseSummary(fid)
|
|
if err != nil {
|
|
return nil, 0, err
|
|
}
|
|
if f == nil || f.TaskID == nil {
|
|
return nil, 0, errors.New("漏洞任务不可用")
|
|
}
|
|
if page < 1 {
|
|
page = 1
|
|
}
|
|
if size < 1 || size > 100 {
|
|
size = 20
|
|
}
|
|
assets, _ := json.Marshal(f.AssetIDs)
|
|
if f.AssetIDs == nil {
|
|
assets = []byte("[]")
|
|
}
|
|
// Type/asset/name only retrieve candidates; the Reporter must still prove the root cause.
|
|
where := ` WHERE f.task_id=$1 AND f.id<>$2 AND NOT EXISTS(SELECT 1 FROM finding_case_blocks b WHERE b.left_id=LEAST(f.id,$2::bigint) AND b.right_id=GREATEST(f.id,$2::bigint))
|
|
AND ((trim($3::text)<>'' AND lower(f.vulnclass)=lower($3)) OR (trim($4::text)<>'' AND lower(f.name)=lower($4))
|
|
OR EXISTS(SELECT 1 FROM jsonb_array_elements(COALESCE(NULLIF(f.asset_ids,'null'::jsonb),'[]'::jsonb)) a WHERE a.value IN(SELECT value FROM jsonb_array_elements($5::jsonb))))`
|
|
args := []any{*f.TaskID, fid, f.VulnClass, f.Name, string(assets)}
|
|
if len(scope) > 0 {
|
|
raw, err := json.Marshal(scope[0])
|
|
if err != nil {
|
|
return nil, 0, err
|
|
}
|
|
where += ` AND f.id IN (SELECT jsonb_array_elements_text($6::jsonb)::bigint)`
|
|
args = append(args, string(raw))
|
|
}
|
|
var total int
|
|
if err := d.QueryRow(`SELECT count(*) FROM findings f`+where, args...).Scan(&total); err != nil {
|
|
return nil, 0, err
|
|
}
|
|
args = append(args, size, (page-1)*size)
|
|
rows, err := d.Query(`SELECT f.id,f.name,f.vulnclass,f.severity,left(f.summary,400),f.asset_ids,COALESCE(m.case_id,0) FROM findings f LEFT JOIN finding_case_members m ON m.finding_id=f.id`+where+fmt.Sprintf(` ORDER BY f.id DESC LIMIT $%d OFFSET $%d`, len(args)-1, len(args)), args...)
|
|
if err != nil {
|
|
return nil, 0, err
|
|
}
|
|
defer rows.Close()
|
|
out := []map[string]any{}
|
|
for rows.Next() {
|
|
var id, cid int64
|
|
var name, class, severity, summary string
|
|
var assetIDs json.RawMessage
|
|
if err := rows.Scan(&id, &name, &class, &severity, &summary, &assetIDs, &cid); err != nil {
|
|
return nil, 0, err
|
|
}
|
|
out = append(out, map[string]any{"finding_id": strconv.FormatInt(id, 10), "name": name, "vulnclass": class, "severity": severity, "summary": summary, "asset_ids": assetIDs, "case_id": strconv.FormatInt(cid, 10)})
|
|
}
|
|
return out, total, rows.Err()
|
|
}
|
|
|
|
// Batch task-list counters avoid an additional database round trip per task.
|
|
func (d *DB) DistinctFindingStatsByTask() (map[string]*FindingDistinctStats, error) {
|
|
rows, err := d.Query(`WITH observations AS (
|
|
SELECT f.task_id,CASE WHEN m.case_id IS NULL THEN 'f:'||f.id ELSE 'c:'||m.case_id END entity,
|
|
CASE WHEN m.case_id IS NULL THEN f.severity ELSE c.severity END severity
|
|
FROM findings f LEFT JOIN finding_case_members m ON m.finding_id=f.id LEFT JOIN finding_cases c ON c.id=m.case_id WHERE f.task_id IS NOT NULL)
|
|
SELECT task_id,count(DISTINCT entity),count(*),
|
|
count(DISTINCT entity) FILTER(WHERE severity='critical'),count(DISTINCT entity) FILTER(WHERE severity='high'),
|
|
count(DISTINCT entity) FILTER(WHERE severity='medium'),count(DISTINCT entity) FILTER(WHERE severity='low'),
|
|
count(DISTINCT entity) FILTER(WHERE severity='') FROM observations GROUP BY task_id`)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
out := map[string]*FindingDistinctStats{}
|
|
for rows.Next() {
|
|
var id int64
|
|
s := new(FindingDistinctStats)
|
|
if err := rows.Scan(&id, &s.Total, &s.Reports, &s.Critical, &s.High, &s.Medium, &s.Low, &s.Unassessed); err != nil {
|
|
return nil, err
|
|
}
|
|
out[strconv.FormatInt(id, 10)] = s
|
|
}
|
|
return out, rows.Err()
|
|
}
|
|
|
|
// Folder rows and candidate searches omit PoC bodies. The original table can
|
|
// request evidence for ungrouped rows without fetching report bodies.
|
|
func (d *DB) FindingCaseSummary(id int64, originalRow ...bool) (*DBFinding, error) {
|
|
cols := strings.Replace(findingSelectCols, "f.evidence,", "''::text,", 1)
|
|
if len(originalRow) > 0 && originalRow[0] {
|
|
cols = findingSelectCols
|
|
}
|
|
rows, err := d.Query(`SELECT `+cols+` FROM findings f LEFT JOIN tasks t ON t.id=f.task_id WHERE f.id=$1`, id)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
fs, err := scanFindings(rows)
|
|
if err != nil || len(fs) == 0 {
|
|
return nil, err
|
|
}
|
|
return fs[0], nil
|
|
}
|
|
|
|
// FindingCaseListContext contains bounded metadata for collapsed folder rows.
|
|
// Reports and member evidence are still fetched only when opened.
|
|
type FindingCaseListContext struct {
|
|
TaskName string
|
|
TaskDescription string
|
|
AssetIDs []int64
|
|
AssetCount int
|
|
LastFoundAt time.Time
|
|
}
|
|
|
|
func (d *DB) FindingCaseListContexts(ids []int64) (map[int64]FindingCaseListContext, error) {
|
|
result := map[int64]FindingCaseListContext{}
|
|
if len(ids) == 0 {
|
|
return result, nil
|
|
}
|
|
raw, err := json.Marshal(ids)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
rows, err := d.Query(`SELECT c.id,COALESCE(t.name,''),COALESCE(t.description,''),
|
|
COALESCE((SELECT MAX(f.created_at) FROM finding_case_members m JOIN findings f ON f.id=m.finding_id WHERE m.case_id=c.id),c.created_at),
|
|
COALESCE((SELECT jsonb_agg(v.id ORDER BY v.id) FROM (
|
|
SELECT DISTINCT a.id FROM finding_case_members m JOIN findings f ON f.id=m.finding_id
|
|
CROSS JOIN LATERAL jsonb_array_elements_text(f.asset_ids) e(v) JOIN assets a ON a.id=e.v::bigint
|
|
WHERE m.case_id=c.id ORDER BY a.id LIMIT 4) v),'[]'::jsonb),
|
|
(SELECT COUNT(DISTINCT a.id) FROM finding_case_members m JOIN findings f ON f.id=m.finding_id
|
|
CROSS JOIN LATERAL jsonb_array_elements_text(f.asset_ids) e(v) JOIN assets a ON a.id=e.v::bigint WHERE m.case_id=c.id)
|
|
FROM finding_cases c LEFT JOIN tasks t ON t.id=c.task_id
|
|
WHERE c.id IN (SELECT jsonb_array_elements_text($1::jsonb)::bigint)`, string(raw))
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer rows.Close()
|
|
for rows.Next() {
|
|
var id int64
|
|
var c FindingCaseListContext
|
|
var assets []byte
|
|
if err := rows.Scan(&id, &c.TaskName, &c.TaskDescription, &c.LastFoundAt, &assets, &c.AssetCount); err != nil {
|
|
return nil, err
|
|
}
|
|
if err := json.Unmarshal(assets, &c.AssetIDs); err != nil {
|
|
return nil, err
|
|
}
|
|
result[id] = c
|
|
}
|
|
return result, rows.Err()
|
|
}
|
|
func (d *DB) MatchingFindingReportCount(filter FindingFilter) (int, error) {
|
|
filter, err := d.applyAssetScope(filter)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
where, args := filter.where()
|
|
var n int
|
|
err = d.QueryRow(`SELECT COUNT(*) FROM findings f LEFT JOIN tasks t ON t.id=f.task_id`+where, args...).Scan(&n)
|
|
return n, err
|
|
}
|