diff --git a/vulnerabilities/templates/weakness_curation.html b/vulnerabilities/templates/weakness_curation.html
new file mode 100644
index 000000000..b027861dd
--- /dev/null
+++ b/vulnerabilities/templates/weakness_curation.html
@@ -0,0 +1,261 @@
+{% extends "base.html" %}
+{% load static %}
+{% load utils %}
+
+{% block extrahead %}
+
+{% endblock %}
+
+{% block content %}
+
+
+
+
+
Advisory Weakness Curation
+ {{ vulnerability_id }}
+
+
+
+
+
+
+ Progress
+
+ 0 / 0
+
+
+
+
+
+
+
+
+
+
Advisory Summaries
+
+ {% for avid, text in advisory_summaries.items %}
+
+
{{ avid }}
+
{{ text|normalize_links|urlize }}
+
+ {% empty %}
+
+ No summaries available.
+
+ {% endfor %}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+{% endblock %}
+
+
+{% block scripts %}
+
+
+{% endblock %}
diff --git a/vulnerabilities/views.py b/vulnerabilities/views.py
index 0a152951c..53c522875 100644
--- a/vulnerabilities/views.py
+++ b/vulnerabilities/views.py
@@ -1198,3 +1198,24 @@ def get_context_data(self, **kwargs):
context["vulnerability_id"] = todo.alias
context["curation_items"] = json.dumps(todo.issue_detail["curation_items"])
return context
+
+
+class AdvisoryWeaknessCurationView(DetailView):
+ model = AdvisoryToDoV2
+ template_name = "weakness_curation.html"
+ slug_url_kwarg = "todo_id"
+ slug_field = "todo_id"
+
+ def get_queryset(self):
+ return super().get_queryset().filter(issue_type="CONFLICTING_WEAKNESSES")
+
+ def get_context_data(self, **kwargs):
+ context = super().get_context_data(**kwargs)
+ todo = self.object
+
+ context["advisory_summaries"] = {
+ adv.avid: adv.summary for adv in todo.advisories.all() if adv.summary.strip()
+ }
+ context["vulnerability_id"] = todo.alias
+ context["curation_items"] = json.dumps(todo.issue_detail["curation_items"])
+ return context
diff --git a/vulnerablecode/static/js/package_curation.js b/vulnerablecode/static/js/package_curation.js
index e0083614b..0961b5f3f 100644
--- a/vulnerablecode/static/js/package_curation.js
+++ b/vulnerablecode/static/js/package_curation.js
@@ -16,7 +16,7 @@ const app = {
renderPackageCuration() {
const item = curationItems[this.currentIndex];
- const versions = item.all_versions || item.all_version;
+ const versions = item.all_versions;
const total = curationItems.length;
const progPercentage = ((this.currentIndex + 1) / total) * 100;
@@ -222,7 +222,7 @@ const app = {
resetCurrentCuration() {
const item = curationItems[this.currentIndex];
- const versions = item.all_versions || item.all_version;
+ const versions = item.all_versions;
versions.forEach(v => {
if (item.partial_curation.affected.includes(v)) {
this.userStates[this.currentIndex][v] = 'affected';
@@ -257,13 +257,12 @@ const app = {
if (isExpanded && advGroup.secondaries) {
advGroup.secondaries.forEach(sec => {
- const secAffected = sec.affected || advGroup.affected;
- const secFixing = sec.fixing || advGroup.fixing;
+ const secAffected = advGroup.affected;
+ const secFixing = advGroup.fixing;
const secState = secAffected.includes(v) ? 'affected' : (secFixing.includes(v) ? 'fixed' : 'unaffected');
const secTd = document.createElement('td');
secTd.className = `state-${secState} has-text-centered advisory-cell`;
- secTd.style.borderLeft = "1px dashed #dbdbdb";
secTd.innerText = secState.toUpperCase();
tr.appendChild(secTd);
});
@@ -314,7 +313,7 @@ const app = {
}
}
const item = curationItems[this.currentIndex];
- const versions = item.all_versions || item.all_version;
+ const versions = item.all_versions;
this.renderBody(item, versions);
},
@@ -326,7 +325,7 @@ const app = {
this.expandedFolds.add(colKey);
}
const item = curationItems[this.currentIndex];
- const versions = item.all_versions || item.all_version;
+ const versions = item.all_versions;
this.renderHeader(item);
this.renderBody(item, versions);
@@ -335,7 +334,7 @@ const app = {
toggleRanges() {
this.showRanges = !this.showRanges;
const item = curationItems[this.currentIndex];
- const versions = item.all_versions || item.all_version;
+ const versions = item.all_versions;
this.renderBody(item, versions);
},
@@ -344,14 +343,14 @@ const app = {
const current = this.userStates[this.currentIndex][v];
this.userStates[this.currentIndex][v] = seq[(seq.indexOf(current) + 1) % 3];
const item = curationItems[this.currentIndex];
- const versions = item.all_versions || item.all_version;
+ const versions = item.all_versions;
this.renderBody(item, versions);
},
pickAdvisory(advIdx, type, secondaryIdx) {
const item = curationItems[this.currentIndex];
const advGroup = item.advisories[advIdx];
- const versions = item.all_versions || item.all_version;
+ const versions = item.all_versions;
versions.forEach(v => {
if (advGroup.affected.includes(v)) this.userStates[this.currentIndex][v] = 'affected';
diff --git a/vulnerablecode/static/js/weakness_curation.js b/vulnerablecode/static/js/weakness_curation.js
new file mode 100644
index 000000000..f696a4650
--- /dev/null
+++ b/vulnerablecode/static/js/weakness_curation.js
@@ -0,0 +1,329 @@
+const app = {
+ currentIndex: 0,
+ userStates: {},
+ expandedFolds: new Set(),
+ showRanges: false,
+ foldAgreementBlocks: true,
+ init() {
+ this.renderPackageCuration();
+
+ document.querySelector('.summary-text')?.addEventListener('click', (e) => {
+ if (e.target.closest('a')) {
+ e.target.target = '_blank';
+ }
+ });
+ },
+
+ renderPackageCuration() {
+ const item = curationItems[this.currentIndex];
+ const weaknesses = item.all_cwes;
+
+ const total = curationItems.length;
+ const progPercentage = ((this.currentIndex + 1) / total) * 100;
+ document.getElementById('progress').value = progPercentage;
+ document.getElementById('progress-text').innerText = `${this.currentIndex + 1} / ${total}`;
+ document.getElementById('current-purl').innerText = item.conflict_reason;
+
+ if (!this.userStates[this.currentIndex]) {
+ this.userStates[this.currentIndex] = {};
+ weaknesses.forEach(v => {
+ if (item.partial_curation.cwes.includes(v)) this.userStates[this.currentIndex][v] = 'applicable';
+ else this.userStates[this.currentIndex][v] = 'empty';
+ });
+ }
+
+ this.renderHeader(item);
+ this.renderBody(item, weaknesses);
+ this.updateNavButtons();
+ },
+
+ renderHeader(item) {
+ const header = document.getElementById('table-header');
+ header.innerHTML = `
+
Weaknesses |
+
+
+ | `;
+
+ item.advisories.forEach((advGroup, groupIdx) => {
+ const secondaries = advGroup.secondaries || [];
+ const hasSecondaries = secondaries.length > 0;
+
+ const colKey = `${this.currentIndex}-col-${groupIdx}`;
+ const isExpanded = this.expandedFolds.has(colKey);
+
+ const primaryTh = document.createElement('th');
+ primaryTh.className = "has-text-centered";
+
+ const primaryUrl = baseAdvisoryUrl.replace('0', advGroup.primary.advisory_uid);
+ let primaryUidHtml = `
+
+ `;
+
+ let toggleHtml = "";
+ if (hasSecondaries) {
+ toggleHtml = `
+
+ `;
+ }
+
+ primaryTh.innerHTML = `
+
+
+ ${toggleHtml}
+ ${primaryUidHtml}
+
+
+
+ `;
+ header.appendChild(primaryTh);
+
+ if (hasSecondaries && isExpanded) {
+ secondaries.forEach((sec, secIdx) => {
+ const secTh = document.createElement('th');
+ secTh.className = "has-text-centered";
+ secTh.style.backgroundColor = "#fafafa";
+
+ const secUrl = baseAdvisoryUrl.replace('0', sec.advisory_uid);
+ secTh.innerHTML = `
+
+ `;
+ header.appendChild(secTh);
+ });
+ }
+ });
+ },
+
+ renderBody(item, weaknesses) {
+ const body = document.getElementById('curation-body');
+ body.innerHTML = '';
+
+ let totalColumns = 2;
+ item.advisories.forEach((advGroup, groupIdx) => {
+ totalColumns += 1;
+ const colKey = `${this.currentIndex}-col-${groupIdx}`;
+ if (this.expandedFolds.has(colKey)) {
+ totalColumns += (advGroup.secondaries || []).length;
+ }
+ });
+
+ const foldable = this.getFoldableRanges(item, weaknesses);
+ for (let i = 0; i < weaknesses.length; i++) {
+ const range = foldable.find(r => i >= r.start && i <= r.end);
+ if (range) {
+ const foldKey = `${this.currentIndex}-${range.start}`;
+ let isExpanded = this.expandedFolds.has(foldKey);
+ if (!this.foldAgreementBlocks) {
+ isExpanded = !this.expandedFolds.has(`${this.currentIndex}-${range.start}-collapsed`);
+ }
+ if (i === range.start) {
+ const marker = document.createElement('tr');
+ marker.innerHTML = `
+
+ ${isExpanded ? 'Hide' : 'Show'} Consensus Range (${range.end - range.start + 1} weaknesses)
+ | `;
+ body.appendChild(marker);
+ }
+ if (!isExpanded) {
+ if (i === range.end) continue;
+ i = range.end;
+ continue;
+ }
+ }
+ body.appendChild(this.createRow(weaknesses[i], item));
+ }
+ },
+
+ resetCurrentCuration() {
+ const item = curationItems[this.currentIndex];
+ const weaknesses = item.all_cwes;
+ weaknesses.forEach(v => {
+ if (item.partial_curation.cwes.includes(v)) {
+ this.userStates[this.currentIndex][v] = 'applicable';
+ }
+ else {
+ this.userStates[this.currentIndex][v] = 'empty';
+ }
+ });
+ this.renderBody(item, weaknesses);
+ },
+
+ createRow(v, item) {
+ const tr = document.createElement('tr');
+ const cwe_info = item.cwe_details[v]
+ const isLastItem = item.all_cwes[item.all_cwes.length - 1] === v;
+ const tooltipPosition = isLastItem ? "has-tooltip-top" : "has-tooltip-right";
+ const state = this.userStates[this.currentIndex][v];
+ tr.innerHTML = `
+
+ CWE-${v}
+ ${cwe_info.name}
+
+
+
+ | `;
+ const userTd = document.createElement('td');
+ userTd.className = `curation-cell state-${state}`;
+ userTd.innerText = state === "empty"? "Select value": state.replace('-', ' ').toUpperCase();
+ userTd.onclick = () => this.cycleState(v);
+ tr.appendChild(userTd);
+
+ item.advisories.forEach((advGroup, groupIdx) => {
+ const colKey = `${this.currentIndex}-col-${groupIdx}`;
+ const isExpanded = this.expandedFolds.has(colKey);
+
+ const primaryState = advGroup.cwes.includes(v) ? 'applicable' : 'not-applicable';
+ const td = document.createElement('td');
+ td.className = `state-${primaryState} has-text-centered advisory-cell`;
+ td.innerText = primaryState.replace('-', ' ').toUpperCase();
+ tr.appendChild(td);
+
+ if (isExpanded && advGroup.secondaries) {
+ advGroup.secondaries.forEach(sec => {
+ const secAffected = advGroup.cwes;
+
+ const secState = secAffected.includes(v) ? 'applicable' : 'not-applicable';
+ const secTd = document.createElement('td');
+ secTd.className = `state-${secState} has-text-centered advisory-cell`;
+ secTd.style.borderLeft = "1px dashed #dbdbdb";
+ secTd.innerText = secState.replace('-', ' ').toUpperCase();
+ tr.appendChild(secTd);
+ });
+ }
+ });
+ return tr;
+ },
+
+ getFoldableRanges(item, weaknesses) {
+ const ranges = [];
+ const foldThreshHold = 3;
+ let start = -1;
+ for (let i = 0; i < weaknesses.length; i++) {
+ const v = weaknesses[i];
+ const states = item.advisories.map(a => a.cwes.includes(v) ? 'applicable' : 'not-applicable');
+ const allMatch = states.every(s => s === states[0]);
+ if (allMatch) {
+ if (start === -1) start = i;
+ } else {
+ if (start !== -1 && (i - start) >= foldThreshHold) ranges.push({
+ start,
+ end: i - 1
+ });
+ start = -1;
+ }
+ }
+ if (start !== -1 && (weaknesses.length - start) >= foldThreshHold) ranges.push({
+ start,
+ end: weaknesses.length - 1
+ });
+ return ranges;
+ },
+
+ toggleFold(startIdx) {
+ const foldKey = `${this.currentIndex}-${startIdx}`;
+ const collapseKey = `${this.currentIndex}-${startIdx}-collapsed`;
+
+ if (this.foldAgreementBlocks) {
+ if (this.expandedFolds.has(foldKey)) {
+ this.expandedFolds.delete(foldKey);
+ } else {
+ this.expandedFolds.add(foldKey);
+ }
+ } else {
+ if (this.expandedFolds.has(collapseKey)) {
+ this.expandedFolds.delete(collapseKey);
+ } else {
+ this.expandedFolds.add(collapseKey);
+ }
+ }
+ const item = curationItems[this.currentIndex];
+ const weaknesses = item.all_cwes;
+ this.renderBody(item, weaknesses);
+ },
+
+ toggleColumnFold(groupIdx) {
+ const colKey = `${this.currentIndex}-col-${groupIdx}`;
+ if (this.expandedFolds.has(colKey)) {
+ this.expandedFolds.delete(colKey);
+ } else {
+ this.expandedFolds.add(colKey);
+ }
+ const item = curationItems[this.currentIndex];
+ const weaknesses = item.all_cwes;
+
+ this.renderHeader(item);
+ this.renderBody(item, weaknesses);
+ },
+
+ toggleRanges() {
+ this.showRanges = !this.showRanges;
+ const item = curationItems[this.currentIndex];
+ const weaknesses = item.all_cwes;
+ this.renderBody(item, weaknesses);
+ },
+
+ cycleState(v) {
+ const seq = ['applicable', 'not-applicable'];
+ const current = this.userStates[this.currentIndex][v];
+ this.userStates[this.currentIndex][v] = seq[(seq.indexOf(current) + 1) % 2];
+ const item = curationItems[this.currentIndex];
+ const weaknesses = item.all_cwes;
+ this.renderBody(item, weaknesses);
+ },
+
+ pickAdvisory(advIdx, type, secondaryIdx) {
+ const item = curationItems[this.currentIndex];
+ const advGroup = item.advisories[advIdx];
+ const weaknesses = item.all_cwes;
+
+ weaknesses.forEach(v => {
+ if (advGroup.cwes.includes(v)) this.userStates[this.currentIndex][v] = 'applicable';
+ else this.userStates[this.currentIndex][v] = 'not-applicable';
+ });
+ this.renderBody(item, weaknesses);
+ },
+
+ navigate(dir) {
+ this.currentIndex += dir;
+ this.renderPackageCuration();
+ },
+
+ updateNavButtons() {
+ document.getElementById('prev-btn').disabled = this.currentIndex === 0;
+ const isLast = this.currentIndex === curationItems.length - 1;
+ document.getElementById('next-btn').classList.toggle('is-hidden', isLast);
+ document.getElementById('finish-btn').classList.toggle('is-hidden', !isLast);
+ },
+
+};
+document.addEventListener('DOMContentLoaded', () => app.init());
\ No newline at end of file
diff --git a/vulnerablecode/urls.py b/vulnerablecode/urls.py
index cc63632bd..0f43f919e 100644
--- a/vulnerablecode/urls.py
+++ b/vulnerablecode/urls.py
@@ -28,6 +28,7 @@
from vulnerabilities.views import AdvisoryPackagesDetails
from vulnerabilities.views import AdvisorySeverityCurationView
from vulnerabilities.views import AdvisoryToDoListView
+from vulnerabilities.views import AdvisoryWeaknessCurationView
from vulnerabilities.views import AffectedByAdvisoriesListView
from vulnerabilities.views import AltchaView
from vulnerabilities.views import ApiUserCreateView
@@ -91,6 +92,11 @@ def __init__(self, *args, **kwargs):
AdvisorySeverityCurationView.as_view(),
name="todo-severity-detail",
),
+ path(
+ "advisories/todos/
/weakness/curate/",
+ AdvisoryWeaknessCurationView.as_view(),
+ name="todo-weakness-detail",
+ ),
path(
"pipelines//runs/",
PipelineRunListView.as_view(),