File Coverage

blib/lib/Net/NVD.pm

Criterion	Covered	Total	%
statement	58	60	96.6
branch	8	16	50.0
condition	3	11	27.2
subroutine	12	12	100.0
pod	3	3	100.0
total	84	102	82.3

use v5.20;
use warnings;
use feature 'signatures';
no warnings qw(experimental::signatures);

use Carp ();
use JSON ();
use HTTP::Tiny;

our $VERSION = '0.0.3';

package Net::NVD {
  sub new ($class, %args) {
    Carp::croak('"format" must be "cve" or "complete"')
      if exists $args{format} && $args{format} ne 'complete' && $args{format} ne 'cve';
    return bless {
      ua     => _build_user_agent($args{api_key}),
      format => $args{format} // 'cve',
    }, $class;
  }

  sub get ($self, $cve_id) {
    my ($single) = $self->search( cve_id => $cve_id );
    return $single;
  }

  sub search ($self, %params) {
    my $res = $self->{ua}->request('GET', 'https://services.nvd.nist.gov/rest/json/cves/2.0?' . _build_url_params($self->{ua}, %params));
    if ($res->{success}) {
      my $json = JSON::decode_json($res->{content});
      return $self->{format} eq 'complete'
        ? $json : map $_->{cve}, $json->{vulnerabilities}->@*;
    }
    Carp::carp($res->{headers}{message} // "error querying NVD service ($res->{status})");
    return ();
  }

  sub _build_user_agent($api_key) {
    return HTTP::Tiny->new(
      agent      => __PACKAGE__ . '/' . $VERSION,
      verify_SSL => 1,
      ($api_key ? (default_headers => { apiKey => $api_key }) : ()),
    );
  }

  sub _build_url_params ($ua, %params) {
    my $iso8061 = qr{\A\d{4}\-\d{2}\-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?(?:[\+\-]\d{2}:\d{2})?\z};
    my %translation = (
      cpe_name             => { name => 'cpeName'           , validation => qr{\Acpe:2.3(\:[^*:]+){4}(\:[^:]+){7}\z} },
      cve_id               => { name => 'cveId'             , validation => qr{\ACVE\-[0-9]{4}\-[0-9]+\z} },
      cvssv2_metrics       => { name => 'cvssV2Metrics'     , validation => qr{.} },
      cvssV2Severity       => { name => 'cvssV2Severity'    , validation => qr{\A(?:LOW|MEDIUM|HIGH)\z} },
      cvssv3_metrics       => { name => 'cvssV3Metrics'     , validation => qr{.} },
      cvssv3_severity      => { name => 'cvssV3Severity'    , validation => qr{\A(?:LOW|MEDIUM|HIGH|CRITICAL)\z} },
      cwe_id               => { name => 'cweId'             , validation => qr{\ACWE\-\d+\z} },
      keyword_search       => { name => 'keywordSearch'     , validation => qr{\A.+\z} },
      last_mod_start_date  => { name => 'lastModStartDate'  , validation => $iso8061 },
      last_mod_end_date    => { name => 'lastModEndDate'    , validation => $iso8061 },
      pub_start_date       => { name => 'pubStartDate'      , validation => $iso8061 },
      pub_end_date         => { name => 'pubEndDate'        , validation => $iso8061 },
      results_per_page     => { name => 'resultsPerPage'    , validation => qr{\A\d+\z} },
      start_index          => { name => 'startIndex'        , validation => qr{\A\d+\z} },
      source_identifier    => { name => 'sourceIdentifier'  , validation => qr{.} },
      version_end          => { name => 'versionEnd'        , validation => qr{.} },
      version_end_type     => { name => 'versionEndType'    , validation => qr{\A(?:including|excluding)\z} },
      version_start        => { name => 'versionStart'      , validation => qr{.} },
      version_start_type   => { name => 'versionStartType'  , validation => qr{\A(?:including|excluding)\z} },
      virtual_match_string => { name => 'virtualMatchString', validation => qr{.} },
      has_cert_alerts      => { name => 'hasCertAlerts'     , boolean => 1 },
      has_cert_notes       => { name => 'hasCertNotes'      , boolean => 1 },
      has_kev              => { name => 'hasKev'            , boolean => 1 },
      has_oval             => { name => 'hasOval'           , boolean => 1 },
      is_vulnerable        => { name => 'isVulnerable'      , boolean => 1 },
      keyword_exact_match  => { name => 'keywordExactMatch' , boolean => 1 },
      no_rejected          => { name => 'noRejected'        , boolean => 1 },
    );

    my @params;
    my %translated;
    foreach my $p (keys %params) {
      Carp::croak("'$p' is not a valid search parameter") unless exists $translation{$p};
      if ($translation{$p}{boolean}) {
        push @params, $translation{$p}{name} if delete $params{$p};
      }
      else {
        Carp::croak("invalid value '$params{$p}' for '$p'") unless $params{$p} =~ $translation{$p}{validation};
        $translated{$translation{$p}{name}} = $params{$p};
      }
    }
    return join('&', @params, $ua->www_form_urlencode(\%translated));
  }
};

1;
__END__