cveye 3.2.0__py3-none-any.whl

cveye/__init__.py

@@ -0,0 +1,3 @@
+"""CVEye - Check latest CVEs and exploit availability without API keys."""
+
+__version__ = "3.2.0"

cveye/__main__.py

@@ -0,0 +1,8 @@
+"""Allow `python3 -m cveye` invocation."""
+
+import sys
+
+from .cli import main
+
+if __name__ == "__main__":
+    sys.exit(main())

cveye/batch.py

@@ -0,0 +1,204 @@
+"""
+Stdin batch engine: reads CVE IDs (or nuclei/httpx JSONL) from stdin,
+warms the cache via one OSV batch request, then processes each CVE
+concurrently with per-thread stdout capture so output blocks never
+interleave.
+"""
+
+import argparse
+import io
+import json
+import re
+import sys
+import threading
+from concurrent.futures import ThreadPoolExecutor, as_completed
+
+from .colors import set_silent, tag_error, tag_success
+from .output import elapsed
+from .utils import normalize_cve_id, dedup
+
+_STDIN_CVE_RE = re.compile(r"CVE-\d{4}-\d{4,7}", re.I)
+
+
+def extract_cves_from_line(line):
+    """
+    Extract CVE IDs from a stdin line.
+
+    Accepts plain CVE IDs ('CVE-2021-44228', '2021-44228') as well as
+    structured output from other tools - any JSON blob such as nuclei or
+    httpx result lines is scanned for CVE identifiers.
+    Returns a list of normalized IDs (may be empty).
+    """
+    stripped = line.strip()
+    if stripped.startswith("{") or stripped.startswith("["):
+        found = _STDIN_CVE_RE.findall(stripped)
+        return dedup([normalize_cve_id(c) for c in found if normalize_cve_id(c)])
+    normalized = normalize_cve_id(stripped)
+    return [normalized] if normalized else []
+
+
+def read_cve_ids_from_stdin():
+    """
+    Read CVE IDs from stdin (one per line). JSON tool output (nuclei,
+    httpx, ...) is auto-detected per line and scanned for CVE IDs.
+    Returns (valid_ids, skipped_lines).
+    """
+    if sys.stdin.isatty():
+        return [], []
+    valid, skipped = [], []
+    seen = set()
+    for line in sys.stdin:
+        line = line.rstrip("\n")
+        if not line.strip():
+            continue
+        ids = extract_cves_from_line(line)
+        if ids:
+            for cid in ids:
+                if cid not in seen:
+                    seen.add(cid)
+                    valid.append(cid)
+        else:
+            skipped.append(line.strip())
+    return valid, skipped
+
+
+class BatchStdoutProxy:
+    """
+    stdout proxy used during concurrent batch processing.
+
+    Each worker thread captures its own writes into a private buffer so
+    result blocks never interleave; the main thread passes through to the
+    real stdout. Installed once for the whole batch.
+    """
+
+    def __init__(self, real):
+        self._real = real
+        self._local = threading.local()
+
+    def write(self, s):
+        buf = getattr(self._local, "buffer", None)
+        if buf is None:
+            return self._real.write(s)
+        return buf.write(s)
+
+    def flush(self):
+        buf = getattr(self._local, "buffer", None)
+        if buf is None:
+            self._real.flush()
+        else:
+            buf.flush()
+
+    def start_capture(self):
+        self._local.buffer = io.StringIO()
+
+    def stop_capture(self):
+        buf = getattr(self._local, "buffer", None)
+        self._local.buffer = None
+        return buf.getvalue() if buf else ""
+
+    def __getattr__(self, name):
+        return getattr(self._real, name)
+
+
+def handle_stdin_cves(args, func):
+    """
+    Handle stdin input for CVE IDs ('-' as cve_id).
+
+    Supports batch processing of multiple CVEs, executed concurrently
+    (-c/-concurrency, default 5). Result blocks are kept intact; JSON batch
+    mode emits a single JSON array in input order, with failures reported
+    as {"cve_id": ..., "error": ...} objects instead of being dropped.
+    """
+    cve_ids, skipped = read_cve_ids_from_stdin()
+
+    for line in skipped[:3]:
+        from .colors import tag_warning
+        tag_warning(f"Skipping invalid CVE ID: {line}")
+    if len(skipped) > 3:
+        from .colors import tag_warning
+        tag_warning(f"... and {len(skipped) - 3} more invalid lines skipped")
+
+    if not cve_ids:
+        tag_error("No valid CVE IDs found on stdin.")
+        return 1
+
+    concurrency = getattr(args, "concurrency", None) or 5
+    concurrency = max(1, min(int(concurrency), len(cve_ids)))
+
+    was_silent = getattr(args, "silent", False)
+    if args.json and not was_silent:
+        set_silent(True)
+
+    # Warm the cache: one OSV querybatch round-trip resolves aliases and
+    # fills the cache so the per-CVE phase is mostly cache hits.
+    try:
+        from .sources import fetch_cve_details_batch
+        fetch_cve_details_batch(cve_ids, max_workers=concurrency)
+    except Exception:
+        pass
+
+    real_stdout = sys.stdout
+    proxy = BatchStdoutProxy(real_stdout)
+    sys.stdout = proxy
+
+    exit_code = 0
+    print_lock = threading.Lock()
+
+    def _work(cid):
+        new_args = argparse.Namespace(**vars(args))
+        new_args.cve_id = cid
+        proxy.start_capture()
+        try:
+            code = func(new_args)
+            out = proxy.stop_capture()
+            return cid, code, out, None
+        except Exception as e:  # keep one bad CVE from killing the batch
+            proxy.stop_capture()
+            return cid, 1, "", e
+
+    try:
+        if concurrency == 1 or len(cve_ids) == 1:
+            outcomes = [_work(cid) for cid in cve_ids]
+        else:
+            outcomes = []
+            with ThreadPoolExecutor(max_workers=concurrency) as ex:
+                futures = [ex.submit(_work, cid) for cid in cve_ids]
+                for fut in as_completed(futures):
+                    outcomes.append(fut.result())
+
+        if args.json:
+            by_id = {}
+            for cid, code, out, err in outcomes:
+                if err is not None or code != 0:
+                    by_id[cid] = {"cve_id": cid, "error": "lookup failed"}
+                    exit_code = code or 1
+                    continue
+                try:
+                    by_id[cid] = json.loads(out.strip())
+                except json.JSONDecodeError:
+                    by_id[cid] = {"cve_id": cid,
+                                  "error": "invalid JSON output"}
+                    exit_code = 1
+            # Preserve input order in the emitted array.
+            batch = [by_id.get(cid) for cid in cve_ids]
+            with print_lock:
+                print(json.dumps(batch, indent=2))
+        else:
+            for cid, code, out, err in outcomes:
+                with print_lock:
+                    if out:
+                        print(out, end="" if out.endswith("\n") else "\n")
+                if err is not None:
+                    with print_lock:
+                        tag_error(f"Error processing {cid}: {err}")
+                    exit_code = 1
+                elif code != 0:
+                    exit_code = code
+    finally:
+        sys.stdout = real_stdout
+        if args.json and not was_silent:
+            set_silent(False)
+
+    tag_success(f"Processed {len(cve_ids)} CVE(s) in {elapsed()} "
+                f"(concurrency {concurrency})")
+    return exit_code

cveye/cache.py

@@ -0,0 +1,235 @@
+"""
+Persistent TTL cache for CVEye.
+
+Stores API responses (CVE details, EPSS scores, KEV index, ExploitDB CSV)
+under the user cache directory so repeated runs are instant and
+rate-limit friendly. Thread-safe; disabled at runtime via -no-cache or
+CVEYE_NO_CACHE=1.
+
+Backends:
+  - json (default): two JSON files (cache.json + big-cache.json)
+  - sqlite: a single SQLite database; better for very large batches.
+    Selected with CVEYE_CACHE_BACKEND=sqlite (stdlib sqlite3 only).
+"""
+
+import json
+import os
+import tempfile
+import threading
+import time
+
+DEFAULT_TTL = 3600
+
+_enabled = True
+
+
+def set_enabled(enabled):
+    """Enable/disable caching globally (disabled caches are no-ops)."""
+    global _enabled
+    _enabled = bool(enabled)
+
+
+def is_enabled():
+    return _enabled
+
+
+def default_cache_dir():
+    """Platform-appropriate cache directory for CVEye."""
+    if os.name == "nt":
+        base = os.environ.get("LOCALAPPDATA") or os.path.expanduser("~")
+        return os.path.join(base, "CVEye", "cache")
+    base = os.environ.get("XDG_CACHE_HOME") or os.path.join(
+        os.path.expanduser("~"), ".cache")
+    return os.path.join(base, "cveye")
+
+
+def user_cache_path(filename="cache.json"):
+    return os.path.join(default_cache_dir(), filename)
+
+
+class TTLCache:
+    """A JSON-file-backed key/value store with per-entry TTLs."""
+
+    def __init__(self, path):
+        self.path = path
+        self.ttl = DEFAULT_TTL
+        self._lock = threading.Lock()
+        self._data = {}
+        self._load()
+
+    # -- persistence ------------------------------------------------------
+
+    def _load(self):
+        try:
+            with open(self.path, "r", encoding="utf-8") as f:
+                raw = json.load(f)
+            if isinstance(raw, dict):
+                self._data = raw.get("entries", {})
+        except (OSError, ValueError):
+            self._data = {}
+
+    def save(self):
+        """Atomically persist non-expired entries."""
+        with self._lock:
+            entries = {k: v for k, v in self._data.items()
+                       if v.get("e", 0) > time.time()}
+            self._data = entries
+        try:
+            os.makedirs(os.path.dirname(self.path), exist_ok=True)
+            fd, tmp = tempfile.mkstemp(dir=os.path.dirname(self.path),
+                                       prefix=".cveye-cache-")
+            with os.fdopen(fd, "w", encoding="utf-8") as f:
+                json.dump({"version": 1, "entries": entries}, f)
+            os.replace(tmp, self.path)
+        except OSError:
+            pass
+
+    # -- api ----------------------------------------------------------------
+
+    def get(self, key):
+        """Return cached value or None if missing/expired/disabled."""
+        if not _enabled:
+            return None
+        with self._lock:
+            entry = self._data.get(key)
+            if not entry:
+                return None
+            if entry.get("e", 0) <= time.time():
+                del self._data[key]
+                return None
+            return entry.get("v")
+
+    def set(self, key, value, ttl=None):
+        """Store value with TTL (seconds) and persist."""
+        if not _enabled:
+            return
+        with self._lock:
+            self._data[key] = {
+                "v": value,
+                "e": time.time() + (ttl if ttl is not None else self.ttl),
+            }
+        self.save()
+
+    def clear(self):
+        with self._lock:
+            self._data = {}
+        try:
+            os.remove(self.path)
+        except OSError:
+            pass
+
+
+class SQLiteCache:
+    """
+    SQLite-backed key/value store with per-entry TTLs.
+
+    Same interface as TTLCache. Values are stored as JSON text; reads hit
+    the database directly so huge batches don't hold everything in memory.
+    """
+
+    def __init__(self, path):
+        import sqlite3
+        self.path = path
+        self.ttl = DEFAULT_TTL
+        self._lock = threading.Lock()
+        try:
+            os.makedirs(os.path.dirname(path), exist_ok=True)
+            self._conn = sqlite3.connect(path, check_same_thread=False)
+            self._conn.execute(
+                "CREATE TABLE IF NOT EXISTS cache ("
+                " key TEXT PRIMARY KEY, value TEXT NOT NULL,"
+                " expires REAL NOT NULL)")
+            self._conn.commit()
+        except OSError:
+            # Fall back to a disabled in-memory instance on failure.
+            self._conn = sqlite3.connect(":memory:")
+            self._conn.execute(
+                "CREATE TABLE IF NOT EXISTS cache ("
+                " key TEXT PRIMARY KEY, value TEXT NOT NULL,"
+                " expires REAL NOT NULL)")
+
+    def get(self, key):
+        if not _enabled:
+            return None
+        row = self._conn.execute(
+            "SELECT value, expires FROM cache WHERE key = ?",
+            (key,)).fetchone()
+        if row is None:
+            return None
+        if row[1] <= time.time():
+            with self._lock:
+                self._conn.execute("DELETE FROM cache WHERE key = ?", (key,))
+                self._conn.commit()
+            return None
+        try:
+            return json.loads(row[0])
+        except ValueError:
+            return None
+
+    def set(self, key, value, ttl=None):
+        if not _enabled:
+            return
+        expires = time.time() + (ttl if ttl is not None else self.ttl)
+        with self._lock:
+            self._conn.execute(
+                "INSERT OR REPLACE INTO cache (key, value, expires)"
+                " VALUES (?, ?, ?)", (key, json.dumps(value), expires))
+            self._conn.commit()
+
+    def clear(self):
+        with self._lock:
+            self._conn.execute("DELETE FROM cache")
+            self._conn.commit()
+        try:
+            os.remove(self.path)
+        except OSError:
+            pass
+
+    def save(self):
+        pass
+
+
+def _make_cache(filename):
+    backend = os.environ.get("CVEYE_CACHE_BACKEND", "json").lower()
+    if backend == "sqlite":
+        return SQLiteCache(user_cache_path("cache.db"))
+    return TTLCache(user_cache_path(filename))
+
+
+# Shared process-wide cache instances. The 'big' variant holds bulky
+# payloads (KEV index, ExploitDB CSV index) so frequent small writes never
+# rewrite megabyte-sized files.
+_instance = _make_cache("cache.json")
+if isinstance(_instance, SQLiteCache):
+    _instance_big = _instance  # single DB serves both sizes
+else:
+    _instance_big = TTLCache(user_cache_path("big-cache.json"))
+
+
+# Module-level accessors so callers can simply `from . import cache`
+# and use cache.get(...) / cache.set(...).
+
+def get(key):
+    return _instance.get(key)
+
+
+def set(key, value, ttl=None):
+    _instance.set(key, value, ttl)
+
+
+def get_big(key):
+    return _instance_big.get(key)
+
+
+def set_big(key, value, ttl=None):
+    _instance_big.set(key, value, ttl)
+
+
+def save():
+    _instance.save()
+    _instance_big.save()
+
+
+def clear():
+    _instance.clear()
+    _instance_big.clear()

cveye/cli.py

@@ -0,0 +1,129 @@
+#!/usr/bin/env python3
+"""
+CVEye CLI entry point - Check latest CVEs and exploit availability
+without API keys.
+
+The implementation is split across focused modules:
+    parser.py     argument parsing and help formatting
+    output.py     presentation helpers (banner, CVE printers)
+    batch.py      stdin batch engine
+    commands/     one module per command group
+
+This module wires them together: global-flag application (config file,
+env vars), stream redirection, and main().
+"""
+
+import sys
+
+if sys.version_info < (3, 7):
+    sys.stderr.write("CVEye requires Python 3.7 or newer.\n")
+    sys.exit(1)
+
+from . import cache
+from .config import VERSION, load_user_config
+from .colors import (
+    set_color,
+    set_silent,
+    refresh_streams,
+    tag_error,
+)
+
+# Re-exported for backward compatibility (tests and external callers).
+from .parser import build_parser, CVeyeParser, CVeyeHelpFormatter  # noqa: F401
+from .output import print_startup as _print_startup  # noqa: F401
+from .batch import (  # noqa: F401
+    handle_stdin_cves as handle_stdin_cve,
+    read_cve_ids_from_stdin as _read_cve_ids_from_stdin,
+)
+
+
+def apply_global_args(args):
+    """Apply global flags, filling unset values from the user config file.
+
+    Precedence: CLI flag > config.json > environment/built-in default.
+    """
+    import os as _os
+
+    from . import config as _config
+
+    cfg = load_user_config()
+
+    if getattr(args, "silent", None) is None:
+        args.silent = bool(cfg.get("silent", False))
+    if getattr(args, "no_color", None) is None:
+        args.no_color = bool(cfg.get("no_color", False))
+    if getattr(args, "no_cache", None) is None:
+        args.no_cache = bool(cfg.get("no_cache", False)) or \
+            bool(_os.environ.get("CVEYE_NO_CACHE"))
+    if getattr(args, "concurrency", None) is None:
+        try:
+            args.concurrency = max(1, int(cfg.get("concurrency", 5)))
+        except (TypeError, ValueError):
+            args.concurrency = 5
+    if getattr(args, "download_dir", None) is None:
+        args.download_dir = cfg.get("download_dir", "exploits")
+
+    # GitHub/NVD tokens: env var wins over config file.
+    if not _os.environ.get("GITHUB_TOKEN") and cfg.get("github_token"):
+        _config.GITHUB_TOKEN = cfg["github_token"]
+    if not _os.environ.get("NVD_API_KEY") and cfg.get("nvd_api_key"):
+        _config.NVD_API_KEY = cfg["nvd_api_key"]
+
+    cache.set_enabled(not args.no_cache)
+
+    if getattr(args, "silent", False):
+        set_silent(True)
+    if getattr(args, "no_color", False):
+        set_color(False)
+    if getattr(args, "output", None):
+        try:
+            sys.stdout = open(args.output, "w", encoding="utf-8")
+        except OSError as e:
+            tag_error(f"Cannot open output file '{args.output}': {e}")
+            raise SystemExit(2)
+        # Re-evaluate color support now that stdout points at a file.
+        refresh_streams()
+
+
+def main(argv=None):
+    """Main entry point."""
+    from .output import reset_timer, print_startup
+
+    reset_timer()
+    parser = build_parser()
+    args = parser.parse_args(argv)
+
+    if not args.command:
+        # Show the banner on bare invocation too.
+        if not getattr(args, "silent", False):
+            print_startup()
+        parser.print_help()
+        return 1
+
+    apply_global_args(args)
+
+    # Show banner and warnings unless silent or JSON mode.
+    if (not getattr(args, "silent", False)
+            and not getattr(args, "json", False)):
+        print_startup()
+
+    try:
+        if (args.command in ("check", "scan", "search", "affected")
+                and getattr(args, "cve_id", "") == "-"):
+            from .batch import handle_stdin_cves
+            code = handle_stdin_cves(args, args.func)
+        else:
+            code = args.func(args)
+    finally:
+        if getattr(args, "output", None):
+            try:
+                sys.stdout.close()
+            except OSError:
+                pass
+            sys.stdout = sys.__stdout__
+
+    return code
+
+
+if __name__ == "__main__":
+    sys.exit(main())