troubadix 24.9.3__tar.gz → 24.10.0__tar.gz

{troubadix-24.9.3 → troubadix-24.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: troubadix
-Version: 24.9.3
+Version: 24.10.0
 Summary: A linting and QA check tool for NASL files
 Home-page: https://github.com/greenbone/troubadix
 License: GPL-3.0-or-later

{troubadix-24.9.3 → troubadix-24.10.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "troubadix"
-version = "24.9.3"
+version = "24.10.0"
 description = "A linting and QA check tool for NASL files"
 authors = ["Greenbone <info@greenbone.net>"]
 license = "GPL-3.0-or-later"

troubadix-24.10.0/tests/plugins/test_spaces_before_dots.py

@@ -0,0 +1,103 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+# SPDX-FileCopyrightText: 2024 Greenbone AG
+
+from pathlib import Path
+
+from tests.plugins import PluginTestCase
+from troubadix.helper import CURRENT_ENCODING
+from troubadix.plugin import LinterFix
+from troubadix.plugins.spaces_before_dots import CheckSpacesBeforeDots
+
+
+class TestSpacesBeforeDots(PluginTestCase):
+
+    def test_ok(self):
+        nasl_file = Path("/some/fake/directory/test.nasl")
+        content = """
+              script_tag(name:"summary", value:"Foo Bar.");
+              script_tag(name:"solution", value:"Foo .NET.");
+              script_tag(name:"insight", value:"Foo Bar ...");
+            """
+        fake_context = self.create_file_plugin_context(
+            nasl_file=nasl_file, file_content=content
+        )
+        plugin = CheckSpacesBeforeDots(fake_context)
+        results = list(plugin.run())
+        self.assertEqual(len(results), 0)
+
+    def test_fail(self):
+        nasl_file = Path("/some/fake/directory/test.nasl")
+        content = (
+            """
+              script_tag(name:"summary", value:"Foo Bar .");
+              script_tag(name:"vuldetect", value:"Foo Bar .");
+              script_tag(name:"insight", value:"Foo Bar .");
+              script_tag(name:"impact", value:"Foo . Bar . Foo");
+            """
+            'script_tag(name:"affected", value:"Foo\n.\nBar.");'
+            'script_tag(name:"solution", value:"Foo Bar\n.");'
+        )
+        fake_context = self.create_file_plugin_context(
+            nasl_file=nasl_file, file_content=content
+        )
+        plugin = CheckSpacesBeforeDots(fake_context)
+        results = list(plugin.run())
+        self.assertEqual(len(results), 7)
+        self.assertEqual(
+            results[0].message,
+            "value of script_tag summary has at least one occurence of excess"
+            " whitespace before a dot:\n"
+            " 'script_tag(name:"
+            '"summary", value:"Foo Bar .");'
+            "'",
+        )
+
+    def test_ignore(self):
+        nasl_file = Path("/some/fake/directory/test.inc")
+        fake_context = self.create_file_plugin_context(nasl_file=nasl_file)
+        plugin = CheckSpacesBeforeDots(fake_context)
+
+        results = list(plugin.run())
+
+        self.assertEqual(len(results), 0)
+
+    def test_fix(self):
+        with self.create_directory() as tempdir:
+            path = tempdir / "file.nasl"
+            content = (
+                """
+                  script_tag(name:"summary", value:"Foo Bar .");
+                  script_tag(name:"vuldetect", value:"Foo Bar .");
+                  script_tag(name:"insight", value:"Foo .Net Bar .");
+                  script_tag(name:"impact", value:"Foo . Bar . Foo");
+                """
+                'script_tag(name:"affected", value:"Foo\n.\nBar.");'
+                'script_tag(name:"solution", value:"Foo Bar\n.");'
+            )
+            expected_modified_content = (
+                """
+                  script_tag(name:"summary", value:"Foo Bar.");
+                  script_tag(name:"vuldetect", value:"Foo Bar.");
+                  script_tag(name:"insight", value:"Foo .Net Bar.");
+                  script_tag(name:"impact", value:"Foo. Bar. Foo");
+                """
+                'script_tag(name:"affected", value:"Foo.\nBar.");'
+                'script_tag(name:"solution", value:"Foo Bar.");'
+            )
+            path.write_text(content, encoding=CURRENT_ENCODING)
+
+            fake_context = self.create_file_plugin_context(
+                nasl_file=path, file_content=content
+            )
+
+            plugin = CheckSpacesBeforeDots(fake_context)
+
+            # keep list() to consume the iterator
+            list(plugin.run())
+
+            results = list(plugin.fix())
+            self.assertEqual(len(results), 1)
+
+            self.assertIsInstance(results[0], LinterFix)
+            modified_content = path.read_text(encoding=CURRENT_ENCODING)
+            self.assertEqual(modified_content, expected_modified_content)

{troubadix-24.9.3 → troubadix-24.10.0}/troubadix/__version__.py

@@ -2,4 +2,4 @@
 
 # THIS IS AN AUTOGENERATED FILE. DO NOT TOUCH!
 
-__version__ = "24.9.3"
+__version__ = "24.10.0"

{troubadix-24.9.3 → troubadix-24.10.0}/troubadix/codespell/codespell.additions

@@ -17,3 +17,6 @@ sequest->request
 sequests->requests
 sequesting->requesting
 sequested->requested
+entrepris->enterprise
+entreprise->enterprise
+entreprises->enterprises

{troubadix-24.9.3 → troubadix-24.10.0}/troubadix/codespell/codespell.exclude

@@ -91,7 +91,7 @@ Add more important informations
  * Add suppor... [Please see the references for more information on the vulnerabilities]");
   a denial of service. (CVE-2016-4429) Tim Ruehsen discovered that the
   - A division by zero in the CAF demuxer
-"admin:admin:huawei,3com,allied,alteon,amitech,billon,checkpoint,cisco,com3,davox,dlink,draytek,dynalink,everfocus,flowpoint,foundry networks,hp:all,ftp",
+"admin:admin:huawei,3com,allied,alteon,amitech,billon,checkpoint,cisco,com3,davox,dlink,draytek,dynalink,everfocus,flowpoint,foundry networks,hp,ibm,intel,ivanti:all,http,ssh,ftp",
   Admin endpoints to a public WAN (Internet) / public LAN without authentication.
 "Administrator:admin:cisco,conexant,corecess,gvc:all",
   # admin:<redacted>:0:0:Adminstrator:/:/bin/sh
@@ -355,8 +355,11 @@ drbd: Avoid Clang warning about pointless switch statment (bsc#1051510).
  eliptic curve parameters were not sufficiently validated during
   } else if( banner =~ "^220 (RICOH|LANIER|SAVIN|Gestetner|NRG) (Aficio |Pro)?([A-Z]+)? [^ ]+ (\([^)]+\) )?FTP server" ) {
   } else if("diese Vorgabe muss manuell ueberprueft werden" >< tolower(status)) {
+else if (prod =~ "^BMX\s*NOE\s*0100$" || prod =~ "^BMX\s*NOE\s*0100H$") {
+else if (prod =~ "^BMX\s*NOE\s*0110$" || prod =~ "^BMX\s*NOE\s*0110H$") {
   else if( svc == "agobot.fo" )
 Enable log information of starting/stoping services. (bsc#1144923,
+  Engineering (TE) database and then a subsequent operation attempts to process these, rpd will
 Engineering (TE) tunnel's physical source interface is not propagated to hardware after the adjacency is lost.
   eSpace IAD, eSpace U1981 and eSpace USM.");
   establishment of the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch
@@ -508,8 +511,14 @@ if( model =~ '^TE[3456]0' && revcomp( a: version, b: "v600r006c00spc500" ) < 0 )
 if (prod =~ "^BMX\s*NOC\s*0401$" || prod =~ "^BMX\s*NOE\s*0100$" || prod =~ "^BMX\s*NOE\s*0110$" || prod =~ "^BMX\s*NOE\s*0110H$" ||
 if (prod =~ "^BMX\s*NOE\s*0100$") {
 if (prod =~ "^BMX\s*NOE\s*0100$" || prod =~ "^BMX\s*NOE\s*0100H$") {
+if (prod =~ "^BMX\s*NOE\s*0100" && version_is_less(version: version, test_version: "3.3")) {
+if (prod =~ "^BMX\s*NOE\s*0100" && version_is_less(version: version, test_version: "3.50")) {
 if (prod =~ "^BMX\s*NOE\s*0110$") {
 if (prod =~ "^BMX\s*NOE\s*0110$" || prod =~ "^BMX\s*NOE\s*0110H$") {
+if (prod =~ "^BMX\s*NOE\s*0110" && version_is_less(version: version, test_version: "6.5")) {
+if (prod =~ "^BMX\s*NOE\s*0110" && version_is_less(version: version, test_version: "6.70")) {
+if (!prod || (prod !~ "^BMX\s*P34" && prod !~ "^BMX\s*NOE\s*01[01]0"))
+if (!prod || (prod !~ "^BMX\s*P34" && prod !~ "^BMX\s*NOR\s*0200H" && prod !~ "^BMX\s*NOE\s*0100" &&
 if( r =~ " (A\. A\. Milne|Albert Einstein|Anonimo|Antico proverbio cinese|Autor desconocido|Charles Dickens|Francisco de Quevedo y Villegas|George Bernard Shaw|Jaime Balmes|Johann Wolfgang von Goethe|Jil Sander|Juana de Asbaje|Konfucius|Lord Philip Chesterfield|Montaigne|Petrarca|Ralph Waldo Emerson|Seneca|Syrus|Werner von Siemens)" ||
   if(rcvRes && '>iAm[i]nE<' >< rcvRes)
     if( res =~ "^HTTP/1\.[01] 200" && "Powered by" >< res && "ANG" >< res ) {
@@ -759,6 +768,8 @@ Prevent sporious 'salt-api' stuck processes when managing SSH minions.
   processing malformed files packed with UPack.
 processing Upack files. A remote attacker could send a crafted file and
   processor_arch_id = 'oval:org.mitre.oval:obj:1576';
+    prod !~ "^BMX\s*NOC\s*0401" && prod !~ "^BMX\s*NOE\s*01" && prod !~ "^BMX\s*NOR\s*0200H" &&
+    prod !~ "^BMX\s*NOE\s*0110" && prod !~ "^BMX\s*NOC\s*\s*0401" && prod !~ "^140CPU65" &&
   product_os_name_id = 'oval:org.mitre.oval:obj:5590';
  prompted to give a password when acessing root owned files. (bsc#1125084)");
 Provide the 32bit samba winbind PAM module and its dependend 32bit
@@ -781,7 +792,7 @@ Readded what missing in last update: BDX-ML B0/M0/R0 6-4f-1/ef 0b00002e->0000003
   Red Hat would like to thank Tim Bunce for responsibly reporting the
   Red Hat would like to thank Timo Warns of PRESENSE Technologies GmbH for
 reenable php7-dba support of Berkeley DB (bsc#1108554)");
-             "Referer: http://",host,":",port,"/UE/welcome_login.html\r\n",
+             "Referer: http://", host, "/UE/welcome_login.html\r\n",
 # Ref : http://www.hsc.fr/ressources/articles/win_net_srv/index.html.en by Jean-Baptiste Marchand
         register_and_report_cpe( app:"Netsparker - Web Application Security Scanner", ver:netVer, base:"cpe:/a:netsparker:wass:", expr:"^([0-9.]+)", insloc:netPath );
     register_and_report_cpe(app:"Wiesemann & Theis GmbH " + appName, ver:version, concluded:concluded,
@@ -1339,6 +1350,7 @@ triggerD = raw_string(0x06,0x00,0x07,0x00,0x20,0x00,0x00,0x00,0x0e,0x00,0x32,
 Tuomas Haanpaa and Matti Kamunen from Synopsys Ltd discovered that the NFSv2 and NFSv3 server implementations are vulnerable to an out-of-bounds memory access issue while processing arbitrarily long arguments sent by NFSv2/NFSv3 PRC clients, leading to a denial of service.
 two intermediate CAs which could be used to generate rogue end-entity
 udev: Downgrade message when settting inotify watch up fails.
+"UE",
  unconstrained interal data buffering (bsc#1145575).
  unconstrained interal data buffering (bsc#1146097).
   - Undefined behavior in bounded channel of crossbeam rust crate.
@@ -1372,7 +1384,7 @@ url = "/statics/pageChallenge.html";
       url = "/status/infomation.htm";
   url = string(dir, "/config.xml.sav");
   url = string(openVer[2], "/obj/autorisation.class.php?path_om=../../../../../../../../vt-rfi.txt");
-url = '/UE/advanced.html';
+url = "/UE/advanced.html";
 url = "/UE/welcome_login.html";
  * usb/net: rndis: remove ambigous status codes. only net/hyperv part
  use-after-free due to the AB/BA lock with buffer_mutex and mmap_lock

{troubadix-24.9.3 → troubadix-24.10.0}/troubadix/codespell/codespell.ignore

@@ -26,3 +26,8 @@ racoon
 # As e.g. the spelling correction in Mozilla Firefox is accepting both we're excluding this for now
 re-use
 re-usable
+# Bootup is commonly used in e.g. example output and seems to be also generally valid like seen on:
+# https://en.wiktionary.org/wiki/bootup
+# so it is ignored (at least for now)
+bootup
+Bootup

{troubadix-24.9.3 → troubadix-24.10.0}/troubadix/plugins/__init__.py

@@ -18,6 +18,7 @@
 from typing import Iterable, List
 
 from troubadix.plugin import FilePlugin, FilesPlugin, Plugin
+from troubadix.plugins.spaces_before_dots import CheckSpacesBeforeDots
 
 from .badwords import CheckBadwords
 from .copyright_text import CheckCopyrightText
@@ -140,6 +141,7 @@ _FILE_PLUGINS = [
     CheckVTFilePermissions,
     CheckVTPlacement,
     CheckWrongSetGetKBCalls,
+    CheckSpacesBeforeDots,
 ]
 
 # plugins checking all files

troubadix-24.10.0/troubadix/plugins/spaces_before_dots.py

@@ -0,0 +1,130 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+# SPDX-FileCopyrightText: 2024 Greenbone AG
+import re
+from collections.abc import Iterator
+from pathlib import Path
+
+from troubadix.helper import CURRENT_ENCODING
+from troubadix.helper.helper import is_ignore_file
+from troubadix.helper.patterns import (
+    ScriptTag,
+    get_script_tag_pattern,
+)
+from troubadix.plugin import (
+    FileContentPlugin,
+    LinterFix,
+    LinterResult,
+    LinterWarning,
+)
+
+TAGS = [
+    ScriptTag.SUMMARY,
+    ScriptTag.VULDETECT,
+    ScriptTag.INSIGHT,
+    ScriptTag.IMPACT,
+    ScriptTag.AFFECTED,
+    ScriptTag.SOLUTION,
+]
+
+# Regex pattern to match:
+# 1. A dot preceded and/or followed by any whitespace character (floating between words)
+# 2. A dot preceded by any whitespace character at the end of the string
+PATTERN = re.compile(r"\s+\.(\s|$)")
+IGNORE = [
+    # 21.04 and 22.04 are generated and should not be touched manually
+    "21.04/",
+    "22.04/",
+    # uses dots for beginning of entry in enumeration
+    "common/2008/debian/deb_246.nasl",
+    "common/2008/debian/deb_266.nasl",
+    "common/2008/freebsd/freebsd_5e92e8a2.nasl",
+    "common/2008/freebsd/freebsdsa_cpio.nasl",
+    "common/2008/freebsd/freebsdsa_cvs2.nasl",
+    "common/2009/osc_photoGallery_sql_injection.nasl",
+    "common/2009/secpod_novell_edir_mult_vuln_jul09_lin.nasl",
+    "common/2009/secpod_novell_edir_mult_vuln_jul09_win.nasl",
+    "common/2010/freebsd/freebsd_3a7c5fc4.nasl",
+    "common/2012/freebsd/freebsd_a4a809d8.nasl",
+    "common/2015/amazon/alas-2014-455.nasl",
+    "common/2015/gb_mozilla_firefox_mult_vuln01_mar15_macosx.nasl",
+    "common/2015/gb_mozilla_firefox_mult_vuln01_mar15_win.nasl",
+    "common/2015/oracle/ELSA-2009-1619.nasl",
+    "common/2015/oracle/ELSA-2011-0586.nasl",
+    "common/2016/gb_perl_privilege_escalation_vuln_win.nasl",
+    "common/2021/dropbear/gb_dropbear_ssh_filename_vuln_may20.nasl",
+    "common/2021/eclipse/gb_jetty_GHSA-v7ff-8wcx-gmc5_lin.nasl",
+    "common/2021/eclipse/gb_jetty_GHSA-v7ff-8wcx-gmc5_win.nasl",
+    "common/gsf/2009/mandriva/gb_mandriva_MDVSA_2008_140.nasl",
+    "common/gsf/2009/mandriva/gb_mandriva_MDVSA_2008_141.nasl",
+    "common/gsf/2010/mandriva/gb_mandriva_MDVA_2010_173.nasl",
+    "common/gsf/2010/mandriva/gb_mandriva_MDVSA_2010_155.nasl",
+    "common/gsf/2010/mandriva/gb_mandriva_MDVSA_2010_155_1.nasl",
+    "common/gsf/2010/mandriva/gb_mandriva_MDVSA_2010_167.nasl",
+    "common/gsf/2020/f5/gb_f5_big_ip_K11315080.nasl",
+    "common/gsf/2020/f5/gb_f5_big_iq_K11315080.nasl",
+    "common/2022/opensuse/gb_opensuse_2022_1548_1.nasl",
+    "common/2024/opensuse/gb_opensuse_2023_3247_1.nasl",
+    "common/attic/debian/deb_232_1.nasl",
+]
+
+
+class CheckSpacesBeforeDots(FileContentPlugin):
+    name = "check_spaces_before_dots"
+
+    def check_content(
+        self, nasl_file: Path, file_content: str
+    ) -> Iterator[LinterResult]:
+        """
+        This plugin checks for excess whitespace before a dot
+        in script_tags that have full sentence values
+        """
+        self.matches = []
+        if nasl_file.suffix == ".inc" or is_ignore_file(nasl_file, IGNORE):
+            return
+        for tag in TAGS:
+            pattern = get_script_tag_pattern(tag)
+            match = pattern.search(file_content)
+            if not match:
+                continue
+
+            value = match.group("value")
+            value_start = match.start("value")
+
+            for excess_match in PATTERN.finditer(value):
+                whitespace_pos = excess_match.start() + value_start
+                self.matches.append((whitespace_pos, excess_match.group()))
+                fullmatch = match.group()
+                yield LinterWarning(
+                    f"value of script_tag {match.group('name')} has at least"
+                    " one occurence of excess whitespace before a dot:"
+                    f"\n '{fullmatch}'",
+                    file=nasl_file,
+                    plugin=self.name,
+                )
+
+    def fix(self) -> Iterator[LinterResult]:
+
+        if not self.matches:
+            return
+
+        # Sort matches by position, descending order to avoid messing up indices during replacement
+        self.matches.sort(reverse=True)
+
+        file_content = self.context.file_content
+        for pos, match_str in self.matches:
+            # Replace the match by removing the excess whitespace before the dot
+            fixed_str = re.sub(r"\s+\.", ".", match_str)
+            file_content = (
+                file_content[:pos]
+                + fixed_str
+                + file_content[pos + len(match_str) :]
+            )
+
+        with open(self.context.nasl_file, "w", encoding=CURRENT_ENCODING) as f:
+            f.write(file_content)
+
+        yield LinterFix(
+            "Excess spaces were removed",
+            file=self.context.nasl_file,
+            plugin=self.name,
+        )

{troubadix-24.9.3 → troubadix-24.10.0}/troubadix/standalone_plugins/version_updated.py

@@ -42,6 +42,7 @@ _IGNORE_FILES = [
     "policy_control_template.nasl",
     "test_version_func_inc.nasl",
     "test_ipv6_packet_forgery.nasl",
+    "test_http_extract_location_from_redirect.nasl",
 ]