nexpose 5.3.2 → 6.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: a81282ac5cad0586a065e9db120e0eb159e6ce11
-  data.tar.gz: 87a487b2d42c5605c3ba9fdc4c06a98141462399
+  metadata.gz: 029e85ea3805696b880d54b2da6bf87848e675c1
+  data.tar.gz: 9a612be818593467a71c2f03602e5aff84c2b45e
 SHA512:
-  metadata.gz: 4840e5bf5a3492b567bf1b143b199fc409a88a684f0a780668c2fb358bc6194764b6fc3347ab615ca98bc1afb0dde6e2152d4069e84a65f3384b7a8ef0f9472c
-  data.tar.gz: 522bbae451cfc73d630d5c85c95af60c1d0caccd8095613328d48d7724affb885e30ea909b24cec39e850f1fb80f6ae0b70b93e9691208c06fefb2de92758072
+  metadata.gz: ed7e089a3dddde81fb7d4fb5b4417a2a82a9acf5c6207e9daec1afe96c48dd20674f10f8b2eea4c3b6dfff4353e4b589b0dae65a824e6c3dc4b9dbfee636c781
+  data.tar.gz: e0dde0ee45a096eca308c3cf4f5b716109c0acac15fbdd45e45b456775f168c3486bee536466a9046695f284ecc8662d7d6a68e0f57a052d74b4204733c629f8

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    nexpose (5.3.2)
+    nexpose (6.0.0)
 
 GEM
   remote: https://rubygems.org/

data/lib/nexpose/version.rb

@@ -1,4 +1,4 @@
 module Nexpose
   # The latest version of the Nexpose gem
-  VERSION = '5.3.2'
+  VERSION = '6.0.0'
 end

data/lib/nexpose/vuln_exception.rb

@@ -3,31 +3,69 @@ module Nexpose
   class Connection
     include XMLUtils
 
-    # Retrieve vulnerability exceptions.
+    # Retrieve all active vulnerability exceptions.
     #
     # @param [String] status Filter exceptions by the current status.
     #   @see Nexpose::VulnException::Status
-    # @param [String] duration A time interval in the format "PnYnMnDTnHnMnS".
     # @return [Array[VulnException]] List of matching vulnerability exceptions.
     #
-    def list_vuln_exceptions(status = nil, duration = nil)
-      option = {}
-      option['status'] = status if status
-      option['time-duration'] = duration if duration
-      xml = make_xml('VulnerabilityExceptionListingRequest', option)
-      response = execute(xml, '1.2')
-
-      xs = []
-      if response.success
-        response.res.elements.each('//VulnerabilityException') do |ve|
-          xs << VulnException.parse(ve)
+    def list_vuln_exceptions(status = nil)
+      unless is_valid_vuln_exception_status?(status)
+        raise "Unknown Status ~> '#{status}' :: For available options refer to Nexpose::VulnException::Status"
+      end
+
+      status = Nexpose::VulnException::Status.const_get(status_string_to_constant(status)) unless status.nil?
+
+      results = []
+      ajax_data = []
+
+      url_size = 500
+      url_page = 0
+
+      req = Nexpose::AJAX.get(self, "/api/experimental/vulnerability_exceptions?_size=#{url_size}&_page=#{url_page}")
+      data = JSON.parse(req, object_class: OpenStruct)
+      ajax_data << data._resources
+
+      if data._links.count > 1
+        loop do
+          url_page += 1
+          req = Nexpose::AJAX.get(self, "/api/experimental/vulnerability_exceptions?_size=#{url_size}&_page=#{url_page}")
+          data = JSON.parse(req, object_class: OpenStruct)
+          ajax_data << data._resources
+          links = data._links.select { |ll| ['self', 'last'].include?(ll.rel) }
+          break if links[0].href == links[1].href
         end
       end
-      xs
+
+      ajax_data.compact!
+      ajax_data.flatten!
+
+      ajax_data.each do |vuln_excep|
+        ve = VulnException.new(vuln_excep.scope.vulnerabilityID, vuln_excep.scope.type, vuln_excep.submit.reason, vuln_excep.state)
+        ve.id                = vuln_excep.id
+        ve.submitter         = vuln_excep.submit.name
+        ve.submitter_comment = vuln_excep.submit.comment
+        ve.submit_date       = Time.parse(vuln_excep.submit.date) unless vuln_excep.submit.date.nil?
+        ve.asset_id          = vuln_excep.scope.assetID
+        ve.site_id           = vuln_excep.scope.siteID
+        ve.asset_group_id    = vuln_excep.scope.assetGroupID
+        ve.port              = vuln_excep.scope.port
+        ve.vuln_key          = vuln_excep.scope.key
+        ve.expiration        = Time.parse(vuln_excep.expires) unless vuln_excep.expires.nil?
+        unless vuln_excep.review.nil?
+          ve.reviewer          = vuln_excep.review.name
+          ve.reviewer_comment  = vuln_excep.review.comment
+          ve.review_date       = Time.parse(vuln_excep.review.date) unless vuln_excep.review.date.nil?
+        end
+        results << ve
+      end
+      results.keep_if { |v| v.status == status } unless status.nil?
+      return results
     end
 
     alias_method :vuln_exceptions, :list_vuln_exceptions
 
+
     # Resubmit a vulnerability exception request with a new comment and reason
     # after an exception has been rejected.
     #
@@ -76,6 +114,24 @@ module Nexpose
                      { 'exception-id' => id })
       execute(xml, '1.2').success
     end
+
+
+    private
+
+      def is_valid_vuln_exception_status?(status)
+        return true if status.nil?
+        valid_status = []
+        Nexpose::VulnException::Status.constants.each {|con| valid_status << Nexpose::VulnException::Status.const_get(con) }
+        valid_status << Nexpose::VulnException::Status.constants.map(&:to_s).map(&:downcase)
+        valid_status.flatten.map(&:downcase).include?(status.downcase)
+      end
+
+      def status_string_to_constant(status)
+        Nexpose::VulnException::Status.constants.find do |name|
+          Nexpose::VulnException::Status.const_get(name).to_s.downcase==status.downcase || status.to_sym.downcase == name.downcase
+        end
+      end
+
   end
 
   # A vulnerability exception.
@@ -117,6 +173,8 @@ module Nexpose
     alias :device_id= :asset_id=
     # Id of the site, if this exception applies to all instances on a site
     attr_accessor :site_id
+    # ID of the Asset Group, if this exception applies to all instances on an asset group
+    attr_accessor :asset_group_id
     # Port on a asset, if this exception applies to a specific port.
     attr_accessor :port
     # The specific vulnerable component in a discovered instance of the
@@ -130,6 +188,11 @@ module Nexpose
     attr_accessor :submitter_comment
     # Any comment provided by the reviewer.
     attr_accessor :reviewer_comment
+    # Date when the Review occurred [Time]
+    attr_accessor :review_date
+    # Date when Submit occurred [Time]
+    attr_accessor :submit_date
+
 
     def initialize(vuln_id, scope, reason, status = nil)
       @vuln_id, @scope, @reason, @status = vuln_id, scope, reason, status

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: nexpose
 version: !ruby/object:Gem::Version
-  version: 5.3.2
+  version: 6.0.0
 platform: ruby
 authors:
 - HD Moore
@@ -13,7 +13,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-03-28 00:00:00.000000000 Z
+date: 2017-04-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -206,6 +206,7 @@ files:
 - lib/nexpose/vuln_exception.rb
 - lib/nexpose/wait.rb
 - lib/nexpose/web_credentials.rb
+- nexpose-5.3.3.gem
 - nexpose.gemspec
 homepage: https://github.com/rapid7/nexpose-client
 licenses: