Skip to content

Latest commit

 

History

History
57 lines (39 loc) · 1.92 KB

README.md

File metadata and controls

57 lines (39 loc) · 1.92 KB
Raw

Vulnerability Lookup Service API

The Vulnerability Lookup Service API (VLS-API) is a go-lang based API, to get Vulnerabilities associated with the packages used in different programming languages. VLS-API supports multiple ecosystems for detecting vulnerabilities in packages.

Features

  • Fetches the latest vulnerabilities data from Open Source Vulnerability Database.
  • Supports searching for vulnerabilities associated with specific packages.
  • Supports multiple package scan.
  • Ecosystem Supports: PyPI, NPM, Maven, crates.io/Rust, Go
  • Easy to integrate with other applications & services.
  • Fast and Efficient performance.

Build

It is recommended to run the VLS-API as a docker container. To build and run the VLS-API, follow these steps

  1. We have a docker file, build a docker image using:

    docker build -t iss-lab/vls-api .

  2. Start the docker container :

    docker run --rm -d -p 3000:3000 iss-lab/vls-api

Note : The vls-api can be accessed via url http://localhost:3000/

API Endpoints

The API provides the following endpoints:

1. POST /scan

  • The request sent to /scan returns the Summary, Description and Severity of the vulnerabilities existing in the package. An attribute overallSeverity gives a summary of the severity of the package, based upon the severities of different vulnerabilities that exist in a package for it's specific version.

1.1 Request - Body

The request is sent in form of JSON, which is as follows:

{
    "scan_request": [
        {
            "version":"",   // Version of package to be scanned
            "name": "",     // Name of package to be scanned
            "ecosystem": "" // Ecosystem of package to be scanned (e.g. PyPI, Maven, Go, etc.)
        }
    ]
}

2. GET /health

This endpoint is used to check whether the API is alive or not.