Add cwe name instead of Hyperlinks

Signed-off-by: ziadhany <ziadhany2016@gmail.com>

Add nexB/cwe package

Signed-off-by: ziadhany <ziadhany2016@gmail.com>

Fix test , remove empty lines

Signed-off-by: ziadhany <ziadhany2016@gmail.com>

Add CWE in the new UI
Signed-off-by: ziadhany <ziadhany2016@gmail.com>

Author: ziadhany

requirements.txt

@@ -114,3 +114,4 @@ yarl==1.7.2
 zipp==3.8.0
 dateparser==1.1.1
 fetchcode==0.2.0
+git+https://github.com/nexB/cwe2.git

setup.cfg

@@ -78,6 +78,7 @@ install_requires =
     defusedxml>=0.7.1
     Markdown>=3.3.0
     dateparser>=1.1.1
+    git+https://github.com/nexB/cwe2.git
 
     # networking
     GitPython>=3.1.17

vulnerabilities/migrations/0029_alter_vulnerabilityseverity_unique_together_and_more.py

@@ -0,0 +1,26 @@
+# Generated by Django 4.0.7 on 2022-11-01 11:09
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('vulnerabilities', '0028_alter_packagerelatedvulnerability_fix'),
+    ]
+
+    operations = [
+        migrations.AlterUniqueTogether(
+            name='vulnerabilityseverity',
+            unique_together=set(),
+        ),
+        migrations.AddField(
+            model_name='vulnerabilityseverity',
+            name='cwe_ids',
+            field=models.JSONField(blank=True, default=list, help_text="Example: ['CWE-327']"),
+        ),
+        migrations.AlterUniqueTogether(
+            name='vulnerabilityseverity',
+            unique_together={('reference', 'scoring_system', 'value', 'cwe_ids')},
+        ),
+    ]

vulnerabilities/models.py

@@ -12,6 +12,7 @@
 import logging
 from contextlib import suppress
 
+from cwe.database import Database
 from django.conf import settings
 from django.core.exceptions import ValidationError
 from django.core.validators import MaxValueValidator
@@ -405,8 +406,20 @@ class VulnerabilitySeverity(models.Model):
 
     value = models.CharField(max_length=50, help_text="Example: 9.0, Important, High")
 
+    cwe_ids = models.JSONField(blank=True, default=list, help_text="Example: ['CWE-327']")
+
+    @property
+    def cwe_details(self):
+        details = []
+        for cwe_id in self.cwe_ids:
+            cid = int(cwe_id.split("-")[1])
+            db = Database()
+            weakness = db.get(cid)
+            details.append(weakness.to_dict())
+        return details
+
     class Meta:
-        unique_together = ["reference", "scoring_system", "value"]
+        unique_together = ["reference", "scoring_system", "value", "cwe_ids"]
         ordering = ["reference", "scoring_system", "value"]
 
 

vulnerabilities/templates/vulnerability_details.html

@@ -119,6 +119,37 @@
                         </table>
                     </div>
 
+                    <div class="has-text-weight-bold tab-nested-div ml-1 mb-1 mt-6">
+                        Weakness
+                    </div>
+                    <div class="tab-nested-div">
+                        <table class="table is-bordered is-striped is-narrow is-hoverable is-fullwidth gray-header-border">
+                            <tr>
+                                <th> CWE id </th>
+                                <th> URL </th>
+                            </tr>
+                            {% for severity in severities %}
+                            {% for cwe_detail in severity.cwe_details %}
+                            <tr>
+                                <td>CWE-{{ cwe_detail.cwe_id }}</td>
+                                <td>
+                                    <a href="https://cwe.mitre.org/data/definitions/{{ cwe_detail.cwe_id }}.html" target="_blank"
+                                     title="CWE-{{ cwe_detail.cwe_id }} : description: {{cwe_detail.description}}">
+                                    {{ cwe_detail.name }} <i class="fa fa-external-link fa_link_custom"></i>
+                                    </a>
+                                    </td>
+                            </tr>
+                           {% empty %}
+                            <tr>
+                                <td colspan="3">
+                                    There are no known CWEs.
+                                </td>
+                            </tr>
+                            {% endfor %}
+                         {% endfor %}
+
+                        </table>
+                    </div>
 
                     <div class="has-text-weight-bold tab-nested-div ml-1 mb-1 mt-6">
                         Fixed by packages ({{ resolved_to|length }})