WIP TC-1642 findTopLevelPackagesRelatedToVulnerability implementation FAO Marco Rizzi

pkg/assembler/backends/arangodb/search.go

@@ -206,6 +206,10 @@ RETURN {
 	return results, nil
 }
 
+func (c *arangoClient) FindTopLevelPackagesRelatedToVulnerability(ctx context.Context, vulnerabilityID string) ([][]model.Node, error) {
+	return nil, fmt.Errorf("not implemented: FindTopLevelPackagesRelatedToVulnerability")
+}
+
 func (c *arangoClient) FindVulnerability(ctx context.Context, purl string, offset *int, limit *int) ([]model.CertifyVulnOrCertifyVEXStatement, error) {
 	return nil, fmt.Errorf("not implemented: FindVulnerability")
 }

pkg/assembler/backends/backends.go

@@ -139,6 +139,9 @@ type Backend interface {
 	FindSoftware(ctx context.Context, searchText string) ([]model.PackageSourceOrArtifact, error)
 	FindSoftwareList(ctx context.Context, searchText string, after *string, first *int) (*model.FindSoftwareConnection, error)
 
+	// FindTopLevelPackagesRelatedToVulnerability searches for top level packages (i.e. packages with an SBOM) related to the vulnerability ID provided
+	FindTopLevelPackagesRelatedToVulnerability(ctx context.Context, vulnerabilityID string) ([][]model.Node, error)
+
 	// FindVulnerability returns all vulnerabilities related to a package
 	FindVulnerability(ctx context.Context, purl string, offset *int, limit *int) ([]model.CertifyVulnOrCertifyVEXStatement, error)
 

pkg/assembler/backends/ent/backend/search.go

@@ -18,22 +18,24 @@
 import (
 	"context"
 	"fmt"
-
 	"github.com/google/uuid"
+	"github.com/guacsec/guac/pkg/assembler/backends/ent/certifyvex"
+	"github.com/guacsec/guac/pkg/assembler/backends/ent/vulnerabilityid"
+	"github.com/vektah/gqlparser/v2/gqlerror"
+	"golang.org/x/exp/maps"
+	"slices"
+	"strconv"
+
 	"github.com/guacsec/guac/internal/testing/ptrfrom"
 	"github.com/guacsec/guac/pkg/assembler/backends/ent"
 	"github.com/guacsec/guac/pkg/assembler/backends/ent/artifact"
 	"github.com/guacsec/guac/pkg/assembler/backends/ent/billofmaterials"
-	"github.com/guacsec/guac/pkg/assembler/backends/ent/certifyvex"
 	"github.com/guacsec/guac/pkg/assembler/backends/ent/certifyvuln"
 	"github.com/guacsec/guac/pkg/assembler/backends/ent/packagename"
 	"github.com/guacsec/guac/pkg/assembler/backends/ent/packageversion"
 	"github.com/guacsec/guac/pkg/assembler/backends/ent/sourcename"
-	"github.com/guacsec/guac/pkg/assembler/backends/ent/vulnerabilityid"
 	"github.com/guacsec/guac/pkg/assembler/graphql/model"
 	"github.com/guacsec/guac/pkg/assembler/helpers"
-	"github.com/vektah/gqlparser/v2/gqlerror"
-	"golang.org/x/exp/maps"
 )
 
 // FindSoftware takes in a searchText string and looks for software
@@ -110,6 +112,85 @@
 	return nil, fmt.Errorf("not implemented: FindSoftwareList")
 }
 
+func (b *EntBackend) FindTopLevelPackagesRelatedToVulnerability(ctx context.Context, vulnerabilityID string) ([][]model.Node, error) {
+	// TODO use directly the query because the EntBackend.HasSBOM is limited to MaxPageSize
+	hasSBOMs, err := b.HasSBOM(ctx, &model.HasSBOMSpec{})
+	if err != nil {
+		return nil, gqlerror.Errorf("FindTopLevelPackagesRelatedToVulnerability failed with err: %v", err)
+	}
+
+	result := [][]model.Node{}
+	productIDsCheckedVulnerable := make(map[string]bool, len(hasSBOMs))
+	for _, hasSBOM := range hasSBOMs {
+		switch v := hasSBOM.Subject.(type) {
+		case *model.Artifact:
+			productIDsCheckedVulnerable[v.ID] = false
+		case *model.Package:
+			productIDsCheckedVulnerable[v.Namespaces[0].Names[0].Versions[0].ID] = false
+		}
+	}
+
+	if len(productIDsCheckedVulnerable) != 0 {
+		vexStatements, err := b.client.CertifyVex.Query().
+			Where(
+				certifyvex.HasVulnerabilityWith(vulnerabilityid.VulnerabilityIDEqualFold(vulnerabilityID)),
+				certifyvex.StatusNEQ(model.VexStatusNotAffected.String()),
+				certifyvex.PackageIDNotNil(),
+			).
+			All(ctx)
+		if err != nil {
+			return nil, gqlerror.Errorf("FindTopLevelPackagesRelatedToVulnerability failed with err: %v", err)
+		}
+		packagesAlreadyInvestigated := make([]uuid.UUID, 0)
+		paths := make([][]model.Node,0)
+		vexEdges := make([]model.Edge, 0)
+		vexEdges = append(vexEdges, model.EdgeCertifyVexStatementPackage)
+		for _, vexStatement := range vexStatements {
+			//paths, err := b.bfsFromVulnerablePackage(ctx, *vexStatement.PackageID, &productIDsCheckedVulnerable)
+			//I think we need to get query results into this somehow
+			subpaths, err := b.bfs(ctx, "", "", 0, vexEdges) //, &productIDsCheckedVulnerable)
+			if err != nil {
+				return nil, err
+			}
+			if len(subpaths) > 0 {
+				paths = append([][]model.Node{{toModelCertifyVEXStatement(vexStatement)}}, subpaths)
+				result = append(result, paths...)
+				packagesAlreadyInvestigated = append(packagesAlreadyInvestigated, *vexStatement.PackageID)
+			}
+		}
+
+		// if no VEX Statements have been found or no path from any VEX statement to product has been found
+		// then let's check also for CertifyVuln
+		if len(vexStatements) == 0 || slices.Contains(maps.Values(productIDsCheckedVulnerable), false) {
+			vulnStatements, err := b.CertifyVuln(ctx, &model.CertifyVulnSpec{
+				Vulnerability: &model.VulnerabilitySpec{
+					VulnerabilityID: &vulnerabilityID,
+				},
+			})
+			if err != nil {
+				return nil, gqlerror.Errorf("FindTopLevelPackagesRelatedToVulnerability failed with err: %v", err)
+			}
+			for _, vuln := range vulnStatements {
+				pkg, err := strconv.Atoi(vuln.Package.Namespaces[0].Names[0].Versions[0].ID)
+				if err != nil {
+					return nil, err
+				}
+				if !slices.Contains(packagesAlreadyInvestigated, pkg) {
+					products, err := b.bfsFromVulnerablePackage(ctx, pkg, &productIDsCheckedVulnerable)
+					if err != nil {
+						return nil, err
+					}
+					for i := range products {
+						products[i] = append([]model.Node{vuln}, products[i]...)
+					}
+					result = append(result, products...)
+				}
+			}
+		}
+	}
+	return result, nil
+}
+
 // FindVulnerability returns all vulnerabilities related to a package
 func (b *EntBackend) FindVulnerability(ctx context.Context, purl string, offset *int, limit *int) ([]model.CertifyVulnOrCertifyVEXStatement, error) {
 	pkgFilter, err := PurlToPkgSpec(purl)

pkg/assembler/backends/keyvalue/search.go

@@ -271,3 +271,7 @@ func (c *demoClient) searchPkgVersion(ctx context.Context, pkgNameNode *pkgName,
 
 	return pvs
 }
+
+func (c *demoClient) FindTopLevelPackagesRelatedToVulnerability(ctx context.Context, vulnerabilityID string) ([][]model.Node, error) {
+	return nil, fmt.Errorf("not implemented: FindTopLevelPackagesRelatedToVulnerability")
+}

pkg/assembler/backends/neo4j/search.go

@@ -30,6 +30,10 @@ func (c *neo4jClient) FindSoftwareList(ctx context.Context, searchText string, a
 	return nil, fmt.Errorf("not implemented: FindSoftwareList")
 }
 
+func (c *neo4jClient) FindTopLevelPackagesRelatedToVulnerability(ctx context.Context, vulnerabilityID string) ([][]model.Node, error) {
+	return nil, fmt.Errorf("not implemented: FindTopLevelPackagesRelatedToVulnerability")
+}
+
 func (c *neo4jClient) FindVulnerability(ctx context.Context, purl string, offset *int, limit *int) ([]model.CertifyVulnOrCertifyVEXStatement, error) {
 	return nil, fmt.Errorf("not implemented: FindVulnerability")
 }
@@ -44,4 +48,4 @@ func (c *neo4jClient) FindVulnerabilitySbomURI(ctx context.Context, cpe string,
 
 func (c *neo4jClient) FindDependentProduct(ctx context.Context, purl string, offset *int, limit *int) ([]*model.HasSbom, error) {
 	return nil, fmt.Errorf("not implemented: FindDependentProduct")
-}
+}