From 8a1ce6b113ec4c5ca21331d39580af0b0fbefe52 Mon Sep 17 00:00:00 2001 From: Jerry Gamblin Date: Wed, 1 Apr 2026 17:09:45 -0500 Subject: [PATCH 1/4] docs: comprehensive documentation overhaul MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit README.md — complete rewrite: - Added table of contents, features list, quick start guide - Added screenshots (login screen, CVE editor modal) - Added architecture section with core files table and how-it-works - Added Node.js usage section with working cveClientlib examples - Added testing section (Vitest, 51 tests, Node 22+) - Fixed typos (rollour, sha-284/Subsource, ECMAScrip6) - Removed dead link to xdrr/cve.js - Added dependencies table with SRI info - Badges at bottom per preference CHANGELOG.md — reconstructed missing versions: - Added 1.0.24 (security fixes, ADP support, schema compatibility) - Added 1.0.23 (bug fixes, CVE AWG demo updates) - Cleaned up formatting for all existing entries INSTALL.md — expanded from 3 paragraphs to full guide: - Added quick start with 4 local server options - Added Apache and Nginx CSP configuration examples - Added CVE Services endpoints table RISKS.md — restructured and cleaned up: - Added section headers (Precautions, How cveClient Mitigates Risk) - Added encrypt-storage.js mitigation description - Cleaned up formatting and trailing whitespace Co-Authored-By: Claude Opus 4.6 --- CHANGELOG.md | 69 ++++++++----- INSTALL.md | 76 ++++++++++++++- README.md | 181 ++++++++++++++++++++++++++++------- RISKS.md | 35 ++++--- docs/images/cve-editor.png | Bin 0 -> 53146 bytes docs/images/login-screen.png | Bin 0 -> 37322 bytes 6 files changed, 276 insertions(+), 85 deletions(-) create mode 100644 docs/images/cve-editor.png create mode 100644 docs/images/login-screen.png diff --git a/CHANGELOG.md b/CHANGELOG.md index fcadd58..97a4a71 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,39 +1,56 @@ # cveClient Changelog -Version 1.0.22 2025-06-26 -* Resolved a bug as filled in #31 multiple versions under affected tree -* Moved from jquery .data() to .attr(data- to avoid unexpected behaviors. -* ProblemTypes can be array of array with only one dictionary object - fixed issue where m*n array can be consisten in JSON view and Friendly (Minimal) view. +## Version 1.0.24 — 2026-03-28 -Version 1.0.21 2025-06-24 -* Added a new version of CVE Chatbot -* Ask chatGPT button -* Fixed bugs on multi-row elements +- Security: Fixed XSS vulnerability — use `.text()` instead of `.html()` for CVE ID in modal title +- Security: Prevent plaintext API key storage and harden encryption key handling +- Security: Added prototype pollution protection to `queryParser` and removed sensitive logging +- Updated SweetAlert2 from 11.4.9 to 11.26.24 +- Made schema references version-agnostic with automatic schema version detection +- Added ADP (Authorized Data Publisher) read and delete support +## Version 1.0.23 — 2025-12-15 -Version 1.0.20 2023-08-21 +- Updates to resolve bugs including security issues (CVE-pending) +- Updates after demo to CVE AWG +- Login bug fixes +- Updated `check_json` function validation -* Add schemaToJson.js generic library to support conversion of CVE schema -* Added updates to support viewing of full schema as presented by CVE5.0 schema +## Version 1.0.22 — 2025-06-26 +- Resolved a bug as filed in #31 — multiple versions under affected tree +- Moved from jQuery `.data()` to `.attr("data-")` to avoid unexpected behaviors +- ProblemTypes can be array of array with only one dictionary object — fixed issue where m\*n array can be consistent in JSON view and Friendly (Minimal) view -Version 1.0.19 2023-08-21 +## Version 1.0.21 — 2025-06-24 -* Fixed some bugs on cveInterface.js related to apply_diff -* Added the ability to download CVE JSON from repositories for edit/duplicate -* Moved display capabilities using CSS. +- Added a new version of CVE Chatbot +- Ask ChatGPT button +- Fixed bugs on multi-row elements +- Added `cwe-common.json` for CWE autocomplete lookup +## Version 1.0.20 — 2023-08-21 -Version 1.0.18 2023-08-09 +- Added `schemaToForm.js` generic library to support conversion of CVE schema +- Added updates to support viewing of full schema as presented by CVE 5.0 schema -* Fixed some bugs on cveInterface.js related to from_json and to_json routines -* The cveclientLib on 1.0.14 now support ADP capability -* The User Management interface bug fixes on duplicate ID or duplicate name field fixed. -* ADP client interface is available only via JSON editor at this time. -* Require at least One product to have STatus "affected" or "unknown". +## Version 1.0.19 — 2023-08-21 -Version 1.0.17 2023-08-09 -* Allow entry of CVE data without being logged in just to create mock records -* Implemented offload download button for CVE records -* Fixed XSS issue due to changes to CVE Services RSUS interface -* Pagination issues resolved +- Fixed bugs on `cveInterface.js` related to `apply_diff` +- Added the ability to download CVE JSON from repositories for edit/duplicate +- Moved display capabilities using CSS + +## Version 1.0.18 — 2023-08-09 + +- Fixed bugs on `cveInterface.js` related to `from_json` and `to_json` routines +- The `cveClientlib.js` on 1.0.14 now supports ADP capability +- User Management interface bug fixes on duplicate ID or duplicate name field +- ADP client interface is available only via JSON editor at this time +- Require at least one product to have status "affected" or "unknown" + +## Version 1.0.17 — 2023-08-09 + +- Allow entry of CVE data without being logged in just to create mock records +- Implemented offload download button for CVE records +- Fixed XSS issue due to changes to CVE Services RSUS interface +- Pagination issues resolved diff --git a/INSTALL.md b/INSTALL.md index c235ba0..b367697 100644 --- a/INSTALL.md +++ b/INSTALL.md @@ -1,12 +1,78 @@ -### Installing cveClient on your webserver (apache2, IIS, nginx, tinyhttp) +# Installing cveClient -All the files in this repository are client utilities expected to served from a webserver to run inside a web browser. Directly accessing the index.html file inside a browser will NOT work as most browsers will not allow network activity from static files on your local or network attached drive/storage. +cveClient is a pure static web application — all files are served directly to the browser with no build step, no transpilation, and no server-side processing. -Clone this repository to a web accessible folder in your webserver says into a folder called `cveClient` using git command `git clone https://github.com/CERTCC/cveClient`. Once you have cloned this folder, you can visit your webserver's relative URL at `/cveClient/` to the folder where the repository was cloned. Ensure your webserver's default index file is `index.html` +## Quick Start (Local Development) -If you use Content-Security-Policy (CSP) headers on your webserver or on your web reverse proxy, make sure the appropriate domain URLs are allowed for the folder that was cloned (`cveClient`). Below is the sample Content-Security-Policy header recommended for this folder: +Any local web server will work. Pick whichever you have installed: -`default-src 'self' blob: http://127.0.0.1:* http://localhost:*; connect-src 'self' http://127.0.0.1:* http://localhost:* *.mitre.org; script-src 'self' https://stackpath.bootstrapcdn.com https://code.jquery.com https://cdnjs.cloudflare.com https://unpkg.com https://apis.google.com blob:; style-src 'self' https://stackpath.bootstrapcdn.com 'unsafe-inline' https://unpkg.com; img-src 'self' data: blob:;object-src 'self'` +```bash +# Python +python3 -m http.server 8080 +# Node.js +npx serve . +# PHP +php -S localhost:8080 +# Ruby +ruby -run -e httpd . -p 8080 +``` + +Then open `http://localhost:8080` in your browser. + +**Note:** Opening `index.html` directly from the filesystem (`file://`) will not work — browsers block network requests from local files. + +## Production Deployment (Apache, Nginx, IIS) + +Clone the repository into a web-accessible folder on your web server: + +```bash +git clone https://github.com/CERTCC/cveClient.git /var/www/html/cveClient +``` + +Then visit your server's URL at `/cveClient/`. Ensure your web server's default index file includes `index.html`. + +### Content-Security-Policy + +If you use Content-Security-Policy (CSP) headers on your web server or reverse proxy, the following CSP is recommended for the cveClient folder: + +``` +default-src 'self' blob: http://127.0.0.1:* http://localhost:*; +connect-src 'self' http://127.0.0.1:* http://localhost:* *.mitre.org; +script-src 'self' https://stackpath.bootstrapcdn.com https://code.jquery.com https://cdnjs.cloudflare.com https://unpkg.com https://apis.google.com blob:; +style-src 'self' https://stackpath.bootstrapcdn.com 'unsafe-inline' https://unpkg.com; +img-src 'self' data: blob:; +object-src 'self' +``` + +### Apache Example + +Add to your `.htaccess` or virtual host configuration: + +```apache + + Header set Content-Security-Policy "default-src 'self' blob: http://127.0.0.1:* http://localhost:*; connect-src 'self' http://127.0.0.1:* http://localhost:* *.mitre.org; script-src 'self' https://stackpath.bootstrapcdn.com https://code.jquery.com https://cdnjs.cloudflare.com https://unpkg.com https://apis.google.com blob:; style-src 'self' https://stackpath.bootstrapcdn.com 'unsafe-inline' https://unpkg.com; img-src 'self' data: blob:; object-src 'self'" + +``` + +### Nginx Example + +```nginx +location /cveClient/ { + add_header Content-Security-Policy "default-src 'self' blob: http://127.0.0.1:* http://localhost:*; connect-src 'self' http://127.0.0.1:* http://localhost:* *.mitre.org; script-src 'self' https://stackpath.bootstrapcdn.com https://code.jquery.com https://cdnjs.cloudflare.com https://unpkg.com https://apis.google.com blob:; style-src 'self' https://stackpath.bootstrapcdn.com 'unsafe-inline' https://unpkg.com; img-src 'self' data: blob:; object-src 'self'"; +} +``` + +## CVE Services Endpoints + +The application connects to one of three CVE Services environments, selectable at login: + +| Environment | URL | +| ----------- | ----------------------------------- | +| Production | `https://cveawg.mitre.org/api` | +| Test | `https://cveawg-test.mitre.org/api` | +| Local | `http://127.0.0.1:3000/api` | + +If you need to connect to a different endpoint, modify the `