Repository navigation
Remove v1 code - #2469
Open
TG1999 wants to merge 8 commits into
Open
Remove v1 code#2469TG1999 wants to merge 8 commits into
TG1999 wants to merge 8 commits into
Conversation
Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
Contributor
Author
|
#2469 PR is in progress here |
keshav-space
requested changes
Oct 16, 2026
keshav-space
left a comment
keshav-space
left a comment
Member
There was a problem hiding this comment.
Thanks @TG1999, see few nits below.
Comment on lines
+62
to
+64
| # Skip test double pipelines defined under vulnerabilities.tests | ||
| if ".tests." in obj.__module__ or obj.__module__.startswith("vulnerabilities.tests"): | ||
| continue |
Member
There was a problem hiding this comment.
Not needed we only import modules inside vulnerabilities.pipelines
Suggested change
| # Skip test double pipelines defined under vulnerabilities.tests | |
| if ".tests." in obj.__module__ or obj.__module__.startswith("vulnerabilities.tests"): | |
| continue |
|
|
||
| <link rel="stylesheet" href="{% static 'css/bulma.css' %}" /> | ||
| <link rel="stylesheet" href="{% static 'css/custom.css' %}" /> | ||
| <link rel="stylesheet" href="{% static 'css/custom.css' %}?v=tabs3" /> |
Comment on lines
+26
to
+39
| <script> | ||
| function goToTab(tabName) { | ||
| var tabs = document.getElementById('tabs'); | ||
| if (!tabs) return false; | ||
| var targetLink = tabs.querySelector('[data-tab="' + tabName + '"]'); | ||
| var targetContent = document.querySelector('#tab-content > .tab-div[data-content="' + tabName + '"]'); | ||
| if (!targetLink || !targetContent) return false; | ||
| tabs.querySelectorAll('li.is-active').forEach(function (el) { el.classList.remove('is-active'); }); | ||
| document.querySelectorAll('#tab-content > .tab-div.is-active').forEach(function (el) { el.classList.remove('is-active'); }); | ||
| targetLink.classList.add('is-active'); | ||
| targetContent.classList.add('is-active'); | ||
| return false; | ||
| } | ||
| </script> |
Member
There was a problem hiding this comment.
Why do we need to move script to the middle? It should be at the bottom of template, inside {% block scripts %}. Moreover we should not duplicate this script, we should instead reuse <script src="{% static 'js/main.js' %}"></script>
Comment on lines
+193
to
+277
| def compute_vulnerability_risk_factors(references, severities, exploits): | ||
| """ | ||
| Risk may be expressed as a number ranging from 0 to 10. | ||
| Risk is calculated from weighted severity and exploitability values. | ||
| It is the maximum value of (the weighted severity multiplied by its exploitability) or 10 | ||
|
|
||
| Risk = min(weighted severity * exploitability, 10) | ||
| """ | ||
| weighted_severity = get_weighted_severity(severities) | ||
| exploitability = get_exploitability_level(exploits, references, severities) | ||
| return weighted_severity, exploitability | ||
|
|
||
|
|
||
| def get_weighted_severity(severities): | ||
| """ | ||
| Weighted Severity is the maximum value obtained when each Severity is multiplied | ||
| by its associated Weight/10. | ||
| Example of Weighted Severity: max(7*(10/10), 8*(3/10), 6*(8/10)) = 7 | ||
| """ | ||
| if not severities: | ||
| return 0 | ||
|
|
||
| score_map = { | ||
| "low": 3, | ||
| "moderate": 6.9, | ||
| "medium": 6.9, | ||
| "high": 8.9, | ||
| "important": 8.9, | ||
| "critical": 10.0, | ||
| "urgent": 10.0, | ||
| } | ||
|
|
||
| score_list = [] | ||
| for severity in severities: | ||
| if not severity.url: | ||
| continue | ||
| parsed_url = urlparse(severity.url) | ||
| severity_source = parsed_url.netloc.replace("www.", "", 1) | ||
| weight = WEIGHT_CONFIG.get(severity_source, DEFAULT_WEIGHT) | ||
| max_weight = float(weight) / 10 | ||
| vul_score = severity.value | ||
| if not vul_score: | ||
| continue | ||
| try: | ||
| vul_score = float(vul_score) | ||
| vul_score_value = vul_score * max_weight | ||
| except ValueError: | ||
| vul_score = vul_score.lower() | ||
| vul_score_value = score_map.get(vul_score, 0) * max_weight | ||
|
|
||
| score_list.append(vul_score_value) | ||
|
|
||
| max_score = max(score_list) if score_list else 0 | ||
| return round(max_score, 1) | ||
|
|
||
|
|
||
| def get_exploitability_level(exploits, references, severities): | ||
| """ | ||
| Exploitability refers to the potential or | ||
| probability of a software package vulnerability being exploited by | ||
| malicious actors to compromise systems, applications, or networks. | ||
| It is determined automatically by discovery of exploits. | ||
| """ | ||
| # no exploit known ( default .5) | ||
| exploit_level = 0.5 | ||
|
|
||
| if exploits: | ||
| # Automatable Exploit with PoC script published OR known exploits (KEV) in the wild OR known ransomware | ||
| exploit_level = 2 | ||
|
|
||
| elif severities: | ||
| # high EPSS. | ||
| for severity in severities: | ||
| if severity.scoring_system == EPSS.identifier and float(severity.value) > 0.8: | ||
| exploit_level = 2 | ||
| break | ||
|
|
||
| elif references: | ||
| # PoC/Exploit script published | ||
| for reference in references: | ||
| if reference.reference_type == AdvisoryReference.EXPLOIT: | ||
| exploit_level = 1 | ||
| break | ||
|
|
||
| return exploit_level |
Member
There was a problem hiding this comment.
These pipeline-specific utilities should be in vulnerabilities/pipes/risk_score.py.
Comment on lines
+89
to
+91
| from vulnerabilities.pipelines.v2_improvers.compute_package_risk import ( | ||
| compute_vulnerability_risk_factors, | ||
| ) |
Member
There was a problem hiding this comment.
compute_vulnerability_risk_factors should reside in this module.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR removes vulnerability model and related importers/improvers completely from VCIO codebase.