Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add the weaknesses data in the API packages endpoint. #1632

Open
tdruez opened this issue Oct 29, 2024 · 0 comments
Open

Add the weaknesses data in the API packages endpoint. #1632

tdruez opened this issue Oct 29, 2024 · 0 comments

Comments

@tdruez
Copy link
Contributor

tdruez commented Oct 29, 2024

https://public.vulnerablecode.io/api/vulnerabilities/7567

...
"weaknesses": [
        {
            "cwe_id": 352,
            "name": "Cross-Site Request Forgery (CSRF)",
            "description": "The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request."
        },
        {
            "cwe_id": 1035,
            "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities",
            "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."
        },
        {
            "cwe_id": 937,
            "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities",
            "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."
        }
    ],
...

This is essential data to collect but it is missing from the affected_by_vulnerabilities data structure.
For example https://public.vulnerablecode.io/api/packages/156170

Make sure to add the proper QuerySet optimization (prefetch_related).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant