-
Notifications
You must be signed in to change notification settings - Fork 203
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add endpoints for bulk requesting vulnerabilities and packages #303
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why not using proper filtering support instead of custom endpoints?
The use case is different, since the request is going to be a |
What's the reason for those actions to be POST in the first place? |
@tdruez re
#284 (comment) . The idea is essentially to retrieve vulnerability info of multiple detected packages via a single request. |
@sbs2001 I get the idea, but again, why POST is your chosen solution over GET? |
@tdruez typically something like ort could detect 100+ packages. If we use a GET request, then either:
So POST request makes sense, also it's tried and tested by sonatype at https://ossindex.sonatype.org/rest |
fbff4f6
to
136476b
Compare
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
{
"vulnerabilities": [
"CVE-2009-1382",
"CVE-2014-8242",
"RANDOM-fictional-CVE"
]
} The response would look like {
"CVE-2009-1382": {
"url": "http://127.0.0.1:8000/api/vulnerabilities/2/",
"unresolved_packages": [],
"resolved_packages": [
{
"url": "http://127.0.0.1:8000/api/packages/2/",
"purl": "pkg:deb/debian/mimetex@1.74-1?distro=jessie"
},
{
"url": "http://127.0.0.1:8000/api/packages/3/",
"purl": "pkg:deb/debian/mimetex@1.50-1.1?distro=jessie"
}
]
},
"CVE-2014-8242": {
"url": "http://127.0.0.1:8000/api/vulnerabilities/1/",
"unresolved_packages": [
{
"url": "http://127.0.0.1:8000/api/packages/1/",
"purl": "pkg:deb/debian/librsync@0.9.7-10?distro=jessie"
}
],
"resolved_packages": []
},
"RANDOM-fictional-CVE": {}
} |
For {
"packages": [
"pkg:deb/debian/librsync@0.9.7-10?distro=jessie",
"pkg:deb/debian/mimetex@1.50-1.1?distro=jessie",
"pkg:deb/lalaland/doesnotexist@1.50-1.1?distro=jessie"
]
} the response would look like : {
"pkg:deb/debian/librsync@0.9.7-10?distro=jessie": {
"resolved_vulnerabilities": [],
"unresolved_vulnerabilities": [
{
"url": "http://127.0.0.1:8000/api/vulnerabilities/1/",
"vulnerability_id": "CVE-2014-8242"
}
]
},
"pkg:deb/debian/mimetex@1.50-1.1?distro=jessie": {
"resolved_vulnerabilities": [
{
"url": "http://127.0.0.1:8000/api/vulnerabilities/2/",
"vulnerability_id": "CVE-2009-1382"
},
{
"url": "http://127.0.0.1:8000/api/vulnerabilities/3/",
"vulnerability_id": "CVE-2009-2459"
}
],
"unresolved_vulnerabilities": []
},
"pkg:deb/lalaland/doesnotexist@1.50-1.1?distro=jessie": {}
} |
Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
f9aef59
to
9ab1c2f
Compare
Fixes #284
Signed-off-by: Shivam Sandbhor shivam.sandbhor@gmail.com