add CLI support for vulntotal

Signed-off-by: Keshav Priyadarshi <git@keshav.space>

Author: keshav-space

vulntotal/vulntotal-cli.py

@@ -0,0 +1,177 @@
+#!/usr/bin/env python
+#
+# Copyright (c) nexB Inc. and others. All rights reserved.
+# http://nexb.com and https://github.com/nexB/vulnerablecode/
+# The VulnTotal software is licensed under the Apache License version 2.0.
+# Data generated with VulnTotal require an acknowledgment.
+#
+# You may not use this software except in compliance with the License.
+# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing, software distributed
+# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+# CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+#
+# When you publish or redistribute any data created with VulnTotal or any VulnTotal
+# derivative work, you must accompany this data with the following acknowledgment:
+#
+#  Generated with VulnTotal and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
+#  OR CONDITIONS OF ANY KIND, either express or implied. No content created from
+#  VulnTotal should be considered or used as legal advice. Consult an Attorney
+#  for any legal advice.
+#  VulnTotal is a free software code scanning tool from nexB Inc. and others.
+#  Visit https://github.com/nexB/vulnerablecode/ for support and download.
+
+import argparse
+import pydoc
+
+from packageurl import PackageURL
+from texttable import Texttable
+
+from vulntotal.validators import VALIDATORS_REGISTRY
+
+
+def get_help():
+    return """
+ ██╗░░░██╗██╗░░░██╗██╗░░░░░███╗░░██╗████████╗░█████╗░████████╗░█████╗░██╗░░░░░
+ ██║░░░██║██║░░░██║██║░░░░░████╗░██║╚══██╔══╝██╔══██╗╚══██╔══╝██╔══██╗██║░░░░░
+ ╚██╗░██╔╝██║░░░██║██║░░░░░██╔██╗██║░░░██║░░░██║░░██║░░░██║░░░███████║██║░░░░░
+ ░╚████╔╝░██║░░░██║██║░░░░░██║╚████║░░░██║░░░██║░░██║░░░██║░░░██╔══██║██║░░░░░
+ ░░╚██╔╝░░╚██████╔╝███████╗██║░╚███║░░░██║░░░╚█████╔╝░░░██║░░░██║░░██║███████╗
+ ░░░╚═╝░░░░╚═════╝░╚══════╝╚═╝░░╚══╝░░░╚═╝░░░░╚════╝░░░░╚═╝░░░╚═╝░░╚═╝╚══════╝
+
+Usage: vulntotal-cli.py [-h] [-p PURL] [-l] [-d validator [validator ...]]
+                        [-e validator [validator ...]]
+
+Discription:
+    When no -e/-d flag is provided CLI will run the PURL through
+    all the available validators.
+
+
+Optional arguments:
+  -h, --help                        Show this help message and exit
+  -p PURL, --purl PURL              PackageURL to run through validator/s
+  -l, --list                        Lists all the available validators
+
+  -e validator [validator ...]      Enable these validator/s only
+  --enable validator [validator ...]
+
+  -d validator [validator ...]      Disable these validator/s
+  --disable validator [validator ...]
+
+Examples:
+    python vultotal-cli.py --list
+    python vultotal-cli.py -p 'pkg:pypi/jinja2@2.4.1'
+    python vultotal-cli.py -e osv vulnerablecode -p 'pkg:pypi/jinja2@2.4.1'
+    python vultotal-cli.py -d osv -p 'pkg:pypi/jinja2@2.4.1'
+"""
+
+
+def get_valid_validators(validators):
+    valid_validators = {}
+    unknown_validators = []
+    for validator in validators:
+        try:
+            valid_validators[validator] = VALIDATORS_REGISTRY[validator]
+        except KeyError:
+            unknown_validators.append(validator)
+    if unknown_validators:
+        raise CommandError(f"Unknown validator: {unknown_validators}")
+    return valid_validators
+
+
+def get_undisabled_validator(validators):
+    disabled = get_valid_validators(validators)
+    return {key: value for key, value in VALIDATORS_REGISTRY.items() if key not in disabled}
+
+
+def get_enabled_validator(validators):
+    return get_valid_validators(validators)
+
+
+def list_validators():
+    validators = list(VALIDATORS_REGISTRY)
+    print("Currently supported validators:")
+    print("\n".join(validators))
+
+
+def formatted_row(validator, advisory):
+    aliases = "\n".join(advisory.aliases)
+    affected = " ".join(advisory.affected_versions)
+    fixed = " ".join(advisory.fixed_versions)
+    return [validator.upper(), aliases, affected, fixed]
+
+
+def run_validators(purl, validators):
+    if not validators:
+        print("No validators available!")
+        return
+    print("PURL: ", purl)
+    print("Active Validators: ", ", ".join(validators.keys()))
+    table = Texttable()
+    table.set_cols_dtype(["t", "t", "t", "t"])
+    table.set_cols_align(["c", "l", "l", "l"])
+    table.set_cols_valign(["t", "t", "a", "t"])
+    table.header(["VALIDATOR", "ALIASES", "AFFECTED", "FIXED"])
+    for key, validator in validators.items():
+        vendor = validator()
+        vendor_advisories = vendor.validator_advisory(PackageURL.from_string(purl))
+        not_vulnerable_in_vendor_advisory = True
+
+        for advisory in vendor_advisories:
+            if not_vulnerable_in_vendor_advisory:
+                not_vulnerable_in_vendor_advisory = False
+            table.add_row(formatted_row(key, advisory))
+
+        if not_vulnerable_in_vendor_advisory:
+            table.add_row([key.upper(), "None", "None", "None"])
+
+    pydoc.pager(table.draw())
+
+
+def handler():
+    parser = argparse.ArgumentParser(
+        add_help=False,
+    )
+    parser.add_argument("-h", "--help", action="store_true", help="Show this help message and exit")
+    parser.add_argument("-p", "--purl", help="PackageURL to run through validator/s")
+    parser.add_argument(
+        "-l", "--list", action="store_true", help="Lists all the available validators"
+    )
+    parser.add_argument(
+        "-e", "--enable", metavar="validator", nargs="+", help="Enable these validator/s only"
+    )
+    parser.add_argument(
+        "-d",
+        "--disable",
+        metavar="validator",
+        nargs="+",
+        help="Disable these validator/s",
+    )
+
+    args = parser.parse_args()
+
+    if not any(vars(args).values()) or args.help:
+        print(get_help())
+
+    elif args.list:
+        list_validators()
+
+    elif args.purl:
+        if args.enable:
+            run_validators(args.purl, get_enabled_validator(args.enable))
+
+        elif args.disable:
+            run_validators(args.purl, get_undisabled_validator(args.disable))
+
+        else:
+            # Run on all the validators
+            run_validators(args.purl, VALIDATORS_REGISTRY)
+
+
+def main():
+    handler()
+
+
+if __name__ == "__main__":
+    main()