test of CVE violation

Author: rlxdev

src/components/AdpVulnerabilityEnrichment.vue

@@ -120,12 +120,14 @@
               </span>
             </nav>
           </div>
-          <div id="cve-description" v-if="!container.isSadp">
-            <h4 class="title is-size-5">Description</h4>
-            <p class="content cve-x-scroll">
+        </div>
+        <div id="cve-description" class="mt-5"
+          v-if="(container.isCna || container.isCveProgram)
+            && container.englishDescription.length">
+          <h4 class="title is-size-5">Description</h4>
+          <p class="content cve-x-scroll">
               {{container.englishDescription}}
-            </p>
-          </div>
+          </p>
         </div>
         <div v-if="!container.isCveProgram">
           <div id="cve-cwes" v-if="container.cwes.length > 0" class="mt-5">

src/stores/genericGlobals.ts

@@ -1,24 +1,31 @@
 import { defineStore } from 'pinia';
 
+const cveServicesBaseUrl = import.meta.env.VITE_CVE_SERVICES_BASE_URL;
+
+const cveBaseUrl = import.meta.env.VITE_API_BASE_URL;
+
+const cveServicesTestBaseUrl = cveBaseUrl.toLowerCase().includes('dev.')
+  ? 'https://cveawg-dev.mitre.org' : 'https://cveawg-test.mitre.org';
+
 export const useGenericGlobalsStore = defineStore('genericGlobals', {
   state: () => {
-    const cveServicesBaseUrlFromEnv = `https://${import.meta.env.VITE_CVE_SERVICES_BASE_URL}`;
+    const cveServicesBaseUrlFromEnv = `https://${cveServicesBaseUrl}`;
     const storedUseSearch = sessionStorage.getItem('useSearch');
     const storedCurrentServicesUrl = sessionStorage.getItem('currentServicesUrl');
     return {
       isProductionWebsite: import.meta.env.VITE_WEBSITE_ENVIRONMENT === 'prd',
-      useSearch: storedUseSearch ? JSON.parse(storedUseSearch) : true, 
+      useSearch: storedUseSearch ? JSON.parse(storedUseSearch) : true,
       currentServicesUrl: storedCurrentServicesUrl ? JSON.parse(storedCurrentServicesUrl)
                           : cveServicesBaseUrlFromEnv,
       cveServicesBaseUrl: cveServicesBaseUrlFromEnv,
-      cveServiceTestBaseUrl: 'https://cveawg-test.mitre.org',
+      cveServiceTestBaseUrl: cveServicesTestBaseUrl,
       legacyCveWebsiteLink: 'https://cve.mitre.org/cve/search_cve_list.html'
     };
   },
   actions: {
     setUseSearch(value: boolean) {
       this.useSearch = value;
-      sessionStorage.setItem('useSearch', JSON.stringify(value)); 
+      sessionStorage.setItem('useSearch', JSON.stringify(value));
     },
     setCurrentServicesUrl(value: boolean) {
       this.currentServicesUrl = value;

src/views/CVERecord/PublishedRecord.vue

@@ -65,7 +65,8 @@
           <div class="mt-2">
             <div :id="onPageMenu[cveRecordHeading].anchorId">
               <h2 class="title">{{cveRecordHeading}}</h2>
-              <AdpVulnerabilityEnrichment v-if="publishedRecord.hasCna"
+              <AdpVulnerabilityEnrichment
+                v-if="publishedRecord.hasCna && !cnaViolation"
                 :datePublished="publishedRecord.datePublished"
                 :containerObject="publishedRecord.cna"
                 :orgId="`cna-${publishedRecord.cna.orgId}`"
@@ -82,6 +83,16 @@
                   {{onPageMenu[cveRecordHeading].items['CVE Program'].label}}
                 </h1>
               </AdpVulnerabilityEnrichment>
+              <AdpVulnerabilityEnrichment
+                v-if="cnaViolation"
+                :datePublished="publishedRecord.datePublished"
+                :containerObject="publishedRecord.cna"
+                :orgId="`cna-${publishedRecord.cna.orgId}`"
+                :id="onPageMenu[cveRecordHeading].items['CNA'].anchorId">
+                <h1 class="mb-1 has-text-white">
+                  {{ onPageMenu[cveRecordHeading].items['CNA'].label }}
+                </h1>
+              </AdpVulnerabilityEnrichment>
             </div>
             <div v-if="publishedRecord.hasAdp"
               :id="onPageMenu[adpRecordHeading].anchorId" class="mt-6">
@@ -155,6 +166,7 @@ export default {
       isMessageExpanded: false,
       isHelpTestShown: false,
       originalRecordData: usecveRecordStore().recordData || {},
+      cnaViolation: false,
       cveServicesBaseUrl: this.GenericGlobalsStore.currentServicesUrl,
       cveRecordStore: usecveRecordStore(),
       partnerStore: usePartnerStore(),
@@ -280,12 +292,60 @@ export default {
       this.publishedRecord = new CveObject(this.cveRecordStore.idData);
       this.publishedRecord.apply(this.originalRecordData);
       this.onPageMenuData();
+      this.cnaViolation = this.isViolatingCna();
+
     },
+    isViolatingCna() {
+
+      // If a CVE Program container exists for this CVE record, and one of
+      // the references' URLs ends with the following, then the CVE is
+      // considered "in violation" and the CNA will be displayed differently
+      // to indicate this violation.
+
+      const targetUrl = '/preserving-vulnerability-level-identification';
+
+      const isViolating = this.publishedRecord.cveProgram?.references.some((ref) => {
+
+        return ref.url.toLowerCase().endsWith(targetUrl);
+      })
+
+      return !!isViolating;
+    },
+    handleCnaViolation() {
+
+      // For a CVE record violation, both the subtitle on the on-page menu and
+      // the accordion section heading for the CNA are changed to indicate the
+      // violation.  The CNA accordion section is initially collapsed, which is
+      // also a difference from a "conforming" CVE record.
+
+      const cnaLabelRegex = /^CNA:\s+(?<cnaName>.*)$/i;
+      const onPageMenuItems = this.onPageMenu[this.cveRecordHeading].items;
+      const cnaItem = onPageMenuItems['CNA'];
+      const newMenuItems = {};
+      const violationText = 'CNA (incomplete; multiple vulnerabilities)';
+
+      for (const [key, item] of Object.entries(onPageMenuItems)) {
+
+        if (key !== 'CNA') {
+            newMenuItems[key] = item;
+        }
+      }
+
+      cnaItem.label = cnaItem.label.replace(cnaLabelRegex,
+                                            `${violationText}: $<cnaName>`);
+
+      newMenuItems['CNA'] = cnaItem;
+
+      this.cveRecordStore.accordionState[cnaItem.anchorId] = false;
+    }
   },
   beforeMount() {
 
     this.initializeFields();
     this.setupAccordionStateOnPageMenu();
+
+    if (this.isViolatingCna())
+      this.handleCnaViolation();
   }
 };