cveworker

package
v0.1.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 20, 2026 License: MIT Imports: 15 Imported by: 0

Documentation

Index

Constants

View Source 
const CatalogName = "cve"

CatalogName is the VGI catalog name advertised by this worker.

View Source 
const DefaultBaseURL = "https://services.nvd.nist.gov/rest/json/cves/2.0"

DefaultBaseURL is the real NVD 2.0 CVE API endpoint. Every table function accepts a base_url named option so the E2E suite can redirect requests at the local mock server.

View Source 
const MaxResults = 100

MaxResults bounds the total number of rows the search/CPE functions will fetch across pages, so an over-broad query cannot run forever.

Variables

View Source 
var SeverityBandsColumns = []resultColumn{
	{"severity", "VARCHAR", "Qualitative CVSS v3.1 band: NONE, LOW, MEDIUM, HIGH, or CRITICAL."},
	{"min_score", "DOUBLE", "Inclusive lower bound, on the 0.0-10.0 CVSS base-score scale, of the range mapped to this band."},
	{"max_score", "DOUBLE", "Inclusive upper bound, on the 0.0-10.0 CVSS base-score scale, of the range mapped to this band."},
}

SeverityBandsColumns is the structured column documentation for the cvss_severity_bands table, surfaced as vgi.result_columns_schema on both the backing function and the registered CatalogTable.

View Source 
var SeverityBandsSchema = arrow.NewSchema([]arrow.Field{
	{Name: "severity", Type: arrow.BinaryTypes.String},
	{Name: "min_score", Type: arrow.PrimitiveTypes.Float64},
	{Name: "max_score", Type: arrow.PrimitiveTypes.Float64},
}, nil)

SeverityBandsSchema is the static result schema of the cvss_severity_bands discovery table: one row per CVSS v3.1 qualitative band.

Functions

func BaseScore 

func BaseScore(vector string) (float64, error)

BaseScore computes the CVSS v3.1 Base Score from a vector string such as 

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H   (-> 9.8)

Only the Base metric group is required; any Temporal/Environmental metrics present in the vector are ignored. The "CVSS:3.0"/"CVSS:3.1" prefix is optional and accepted. Returns an error if a required metric is missing or a metric value is not recognized.

func NewCPECVEsFunction 

func NewCPECVEsFunction() vgi.TableFunction

NewCPECVEsFunction builds the registerable table function.

func NewCVEFunction 

func NewCVEFunction() vgi.TableFunction

NewCVEFunction builds the registerable table function.

func NewCVESearchFunction 

func NewCVESearchFunction() vgi.TableFunction

NewCVESearchFunction builds the registerable table function.

func NewCVSSBaseScoreFunction 

func NewCVSSBaseScoreFunction() vgi.ScalarFunction

NewCVSSBaseScoreFunction builds the registerable scalar function.

func NewCVSSSeverityFunction 

func NewCVSSSeverityFunction() vgi.ScalarFunction

NewCVSSSeverityFunction builds the registerable scalar function.

func NewSeverityBandsFunction added in v0.1.1 

func NewSeverityBandsFunction() vgi.TableFunction

NewSeverityBandsFunction builds the table function that backs the browsable cvss_severity_bands catalog table.

func Register 

func Register(w *vgi.Worker)

Register registers all CVE functions (offline scalars + NVD table functions).

func Severity 

func Severity(score float64) string

Severity maps a CVSS v3 base score to its qualitative rating band. 

0.0        -> NONE
0.1 – 3.9  -> LOW
4.0 – 6.9  -> MEDIUM
7.0 – 8.9  -> HIGH
9.0 – 10.0 -> CRITICAL

Out-of-range scores are clamped to the nearest band.

Types

type CPECVEsFunction 

type CPECVEsFunction struct{}

CPECVEsFunction lists CVEs for a CPE name.

func (*CPECVEsFunction) ArgumentSpecs 

func (f *CPECVEsFunction) ArgumentSpecs() []vgi.ArgSpec

func (*CPECVEsFunction) Metadata 

func (f *CPECVEsFunction) Metadata() vgi.FunctionMetadata

func (*CPECVEsFunction) Name 

func (f *CPECVEsFunction) Name() string

func (*CPECVEsFunction) NewState 

func (f *CPECVEsFunction) NewState(params *vgi.ProcessParams) (*cpeCVEsState, error)

func (*CPECVEsFunction) OnBind 

func (f *CPECVEsFunction) OnBind(_ *vgi.BindParams) (*vgi.BindResponse, error)

func (*CPECVEsFunction) Process 

func (f *CPECVEsFunction) Process(_ context.Context, _ *vgi.ProcessParams, state *cpeCVEsState, out *vgirpc.OutputCollector) error

type CVEFunction 

type CVEFunction struct{}

CVEFunction fetches one CVE by ID.

func (*CVEFunction) ArgumentSpecs 

func (f *CVEFunction) ArgumentSpecs() []vgi.ArgSpec

func (*CVEFunction) Metadata 

func (f *CVEFunction) Metadata() vgi.FunctionMetadata

func (*CVEFunction) Name 

func (f *CVEFunction) Name() string

func (*CVEFunction) NewState 

func (f *CVEFunction) NewState(params *vgi.ProcessParams) (*cveState, error)

func (*CVEFunction) OnBind 

func (f *CVEFunction) OnBind(_ *vgi.BindParams) (*vgi.BindResponse, error)

func (*CVEFunction) Process 

func (f *CVEFunction) Process(_ context.Context, _ *vgi.ProcessParams, state *cveState, out *vgirpc.OutputCollector) error

type CVERow 

type CVERow struct {
	ID           string
	Description  string
	Score        *float64
	SeverityStr  string
	Vector       string
	Published    string
	LastModified string
	CWE          string
}

CVERow is the flattened, SQL-friendly projection of a single NVD CVE record. A nil pointer field means the source record had no value (e.g. a CVE with no CVSS metrics yields a nil Score, surfaced as SQL NULL).

type CVESearchFunction 

type CVESearchFunction struct{}

CVESearchFunction runs a paginated keyword search.

func (*CVESearchFunction) ArgumentSpecs 

func (f *CVESearchFunction) ArgumentSpecs() []vgi.ArgSpec

func (*CVESearchFunction) Metadata 

func (f *CVESearchFunction) Metadata() vgi.FunctionMetadata

func (*CVESearchFunction) Name 

func (f *CVESearchFunction) Name() string

func (*CVESearchFunction) NewState 

func (f *CVESearchFunction) NewState(params *vgi.ProcessParams) (*cveSearchState, error)

func (*CVESearchFunction) OnBind 

func (f *CVESearchFunction) OnBind(_ *vgi.BindParams) (*vgi.BindResponse, error)

func (*CVESearchFunction) Process 

func (f *CVESearchFunction) Process(_ context.Context, _ *vgi.ProcessParams, state *cveSearchState, out *vgirpc.OutputCollector) error

type CVSSBaseScoreFunction 

type CVSSBaseScoreFunction struct{}

CVSSBaseScoreFunction computes a CVSS v3.1 base score from a vector string.

func (*CVSSBaseScoreFunction) ArgumentSpecs 

func (f *CVSSBaseScoreFunction) ArgumentSpecs() []vgi.ArgSpec

func (*CVSSBaseScoreFunction) Metadata 

func (f *CVSSBaseScoreFunction) Metadata() vgi.FunctionMetadata

func (*CVSSBaseScoreFunction) Name 

func (f *CVSSBaseScoreFunction) Name() string

func (*CVSSBaseScoreFunction) OnBind 

func (f *CVSSBaseScoreFunction) OnBind(_ *vgi.BindParams) (*vgi.BindResponse, error)

func (*CVSSBaseScoreFunction) Process 

func (f *CVSSBaseScoreFunction) Process(_ context.Context, params *vgi.ProcessParams, batch arrow.RecordBatch) (arrow.RecordBatch, error)

type CVSSSeverityFunction 

type CVSSSeverityFunction struct{}

CVSSSeverityFunction maps a numeric CVSS base score to its qualitative band.

func (*CVSSSeverityFunction) ArgumentSpecs 

func (f *CVSSSeverityFunction) ArgumentSpecs() []vgi.ArgSpec

func (*CVSSSeverityFunction) Metadata 

func (f *CVSSSeverityFunction) Metadata() vgi.FunctionMetadata

func (*CVSSSeverityFunction) Name 

func (f *CVSSSeverityFunction) Name() string

func (*CVSSSeverityFunction) OnBind 

func (f *CVSSSeverityFunction) OnBind(_ *vgi.BindParams) (*vgi.BindResponse, error)

func (*CVSSSeverityFunction) Process 

func (f *CVSSSeverityFunction) Process(_ context.Context, params *vgi.ProcessParams, batch arrow.RecordBatch) (arrow.RecordBatch, error)

type Client 

type Client struct {
	BaseURL string
	APIKey  string
	HTTP    *http.Client
}

Client talks to an NVD 2.0-compatible CVE API.

func NewClient 

func NewClient(baseURL, apiKey string) *Client

NewClient builds a Client. An empty baseURL falls back to the real NVD endpoint; an empty apiKey means unauthenticated (subject to NVD's stricter public rate limit).

func (*Client) CVEsForCPE 

func (c *Client) CVEsForCPE(ctx context.Context, cpe string) ([]CVERow, error)

CVEsForCPE returns CVEs associated with a CPE name, paginated and bounded by MaxResults.

func (*Client) FetchCVE 

func (c *Client) FetchCVE(ctx context.Context, cveID string) (*CVERow, error)

FetchCVE retrieves a single CVE by ID. Returns (nil, nil) when the API reports zero matches (e.g. an unknown but well-formed ID with 200/empty), and an error for a 404 or any other failure.

func (*Client) SearchKeyword 

func (c *Client) SearchKeyword(ctx context.Context, keyword string) ([]CVERow, error)

SearchKeyword runs a keyword search, paginating until MaxResults rows are collected or the API is exhausted.

type CursorState 

type CursorState struct {
	Rows   []CVERow
	Offset int
}

CursorState is the shared streaming cursor embedded by every table-function state: the eagerly fetched rows plus the offset of the next unemitted row. Both fields are exported so gob round-trips them through the HTTP continuation token. The TYPE is exported too (CursorState, not cursorState) because the SDK counts a state struct's exported FIELDS at registration to verify it is gob-encodable — an embedded field named after an unexported type would not be counted and the worker would panic at startup.

type SeverityBand added in v0.1.1 

type SeverityBand struct {
	// Severity is the qualitative band name (NONE/LOW/MEDIUM/HIGH/CRITICAL).
	Severity string
	// MinScore and MaxScore bound the inclusive base-score range for the band.
	MinScore float64
	MaxScore float64
}

SeverityBand is one CVSS v3.1 qualitative severity band and the inclusive base-score range that Severity() maps into it.

func SeverityBands added in v0.1.1 

func SeverityBands() []SeverityBand

SeverityBands returns the five CVSS v3.1 qualitative severity bands in ascending order, with the inclusive base-score range each covers. It is the single source the cvss_severity_bands discovery table reads, so that table and Severity()'s thresholds (above) cannot drift apart.

type SeverityBandsFunction added in v0.1.1 

type SeverityBandsFunction struct{}

SeverityBandsFunction is the no-argument producer backing the browsable cvss_severity_bands discovery table. It emits the five CVSS v3.1 severity bands (offline, deterministic) so an agent can browse the banding that cvss_severity applies without having to call any function with arguments.

func (*SeverityBandsFunction) ArgumentSpecs added in v0.1.1 

func (f *SeverityBandsFunction) ArgumentSpecs() []vgi.ArgSpec

func (*SeverityBandsFunction) Metadata added in v0.1.1 

func (f *SeverityBandsFunction) Metadata() vgi.FunctionMetadata

func (*SeverityBandsFunction) Name added in v0.1.1 

func (f *SeverityBandsFunction) Name() string

func (*SeverityBandsFunction) NewState added in v0.1.1 

func (f *SeverityBandsFunction) NewState(_ *vgi.ProcessParams) (*bandsState, error)

func (*SeverityBandsFunction) OnBind added in v0.1.1 

func (f *SeverityBandsFunction) OnBind(_ *vgi.BindParams) (*vgi.BindResponse, error)

func (*SeverityBandsFunction) Process added in v0.1.1 

func (f *SeverityBandsFunction) Process(_ context.Context, _ *vgi.ProcessParams, state *bandsState, out *vgirpc.OutputCollector) error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.