Documentation
¶
Index ¶
- Variables
- func Manifest() core.Manifest
- func NewCapability(deps core.Deps) (core.Capability, error)
- func Normalize(name string) string
- func ProductForCVE(cve string, bindings []Binding) (string, [][]string, bool)
- func QueryTerms(resolutions []Resolution) []string
- func Validate(bindings []Binding) error
- type Binding
- type Kit
- type Resolution
Constants ¶
This section is empty.
Variables ¶
var DefaultBindings = []Binding{ { Product: "泛微OA", Aliases: []string{"泛微", "Weaver", "Weaver OA", "e-cology", "e-office", "ecology"}, Query: []string{"泛微", "Weaver"}, }, { Product: "通达OA", Aliases: []string{"通达", "Tongda OA", "Office Anywhere", "TDOA"}, Query: []string{"通达OA", "Office Anywhere"}, }, { Product: "致远OA", Aliases: []string{"致远", "Seeyon", "Seeyon OA", "A8"}, Query: []string{"致远OA", "Seeyon"}, }, { Product: "蓝凌OA", Aliases: []string{"蓝凌", "Landray", "Landray OA", "EKP"}, Query: []string{"蓝凌", "Landray"}, }, { Product: "用友", Aliases: []string{"用友软件", "Yonyou", "U8", "NC", "NC Cloud", "畅捷通"}, Query: []string{"用友", "Yonyou"}, }, { Product: "金蝶", Aliases: []string{"金蝶软件", "Kingdee", "EAS", "K3"}, Query: []string{"金蝶", "Kingdee"}, }, { Product: "AJ-Report", Aliases: []string{"AJ-Report数据大屏", "AJ-Report数据大屏系统", "AJ-Report数据可视化", "ajreport"}, Query: []string{"AJ-Report"}, }, { Product: "若依", Aliases: []string{"RuoYi", "若依管理系统", "RuoYi-Vue", "ruoyi"}, Query: []string{"若依", "RuoYi"}, }, { Product: "Nacos", Aliases: []string{"Alibaba Nacos", "Nacos Console"}, Query: []string{"Nacos"}, }, { Product: "Apache Struts2", Aliases: []string{"Struts2", "Struts", "Apache Struts"}, Query: []string{"Struts2", "Apache Struts"}, }, { Product: "Apache Log4j2", Aliases: []string{"Log4j", "Log4j2", "Apache Log4j"}, Query: []string{"Log4j", "Log4j2"}, }, { Product: "Spring", Aliases: []string{"Spring Framework", "Spring Boot", "Spring Cloud"}, Query: []string{"Spring", "Spring Boot"}, }, { Product: "ThinkPHP", Aliases: []string{"Think PHP", "ThinkPHP5", "ThinkPHP6"}, Query: []string{"ThinkPHP"}, }, { Product: "Shiro", Aliases: []string{"Apache Shiro", "Shiro RememberMe"}, Query: []string{"Shiro", "Apache Shiro"}, }, { Product: "Tomcat", Aliases: []string{"Apache Tomcat", "Tomcat Manager"}, Query: []string{"Tomcat", "Apache Tomcat"}, }, { Product: "Jenkins", Aliases: []string{"Jenkins CI", "Hudson"}, Query: []string{"Jenkins"}, }, { Product: "GitLab", Aliases: []string{"GitLab CE", "GitLab EE"}, Query: []string{"GitLab"}, }, { Product: "Confluence", Aliases: []string{"Atlassian Confluence", "Confluence Wiki"}, Query: []string{"Confluence"}, }, { Product: "Weblogic", Aliases: []string{"Oracle WebLogic", "WebLogic Server", "weblogic"}, Query: []string{"Weblogic", "WebLogic"}, }, { Product: "Fastjson", Aliases: []string{"alibaba fastjson", "Fastjson2"}, Query: []string{"Fastjson"}, }, }
DefaultBindings is the built-in table. It is intentionally small: it covers products whose naming varies enough between fingerprint feeds and template libraries that a substring gate is unreliable. A host is expected to ship its own table; this one exists so the capability works out of the box.
Functions ¶
func NewCapability ¶
func NewCapability(deps core.Deps) (core.Capability, error)
NewCapability implements the capability constructor used by the registry.
func Normalize ¶
Normalize folds a product name to a comparison key: lowercase, drop spaces and punctuation, and drop the trailing "系统/平台/软件/漏洞" noise that vendors append inconsistently. It is deliberately conservative — over- folding ("OA" out of "泛微OA") would merge unrelated products.
func ProductForCVE ¶
ProductForCVE resolves a CVE to its canonical product through the binding table. It returns ok=false when no binding claims the advisory.
func QueryTerms ¶
func QueryTerms(resolutions []Resolution) []string
QueryTerms flattens the effective search terms of a resolution set, deduped and order-stable.
Types ¶
type Binding ¶
type Binding struct {
// Product is the canonical key. Everything else normalizes onto it.
Product string `json:"product" yaml:"product"`
// Aliases are the spellings seen in the wild (fingerprint names, vendor
// names, English/CJK variants, abbreviations).
Aliases []string `json:"aliases,omitempty" yaml:"aliases,omitempty"`
// Query terms are what to search the template catalog with. Defaults to
// Product when empty.
Query []string `json:"query,omitempty" yaml:"query,omitempty"`
// CVEs are advisories already bound to this product, so a CVE-only lookup
// can still be resolved without a fingerprint match.
CVEs []string `json:"cves,omitempty" yaml:"cves,omitempty"`
// Templates are template ids known to belong to this product.
Templates []string `json:"templates,omitempty" yaml:"templates,omitempty"`
}
Binding maps the product name a fingerprint engine reports onto the canonical product key a template library is organized by.
The problem it solves is concrete: a fingerprint rule reports "AJ-Report数据大屏系统" while the template library files the same product under "AJ-Report". A substring gate happens to accept that pair and rejects the next one, so whether a template is reachable depends on how verbose each side's naming day was. A binding table makes the mapping explicit and reviewable.
type Kit ¶
type Kit struct{}
Kit resolves the product names a fingerprint engine reports onto the canonical keys a template library uses.
It is deliberately stateless: the binding table arrives with the call (or falls back to DefaultBindings). A host that maintains bindings in its own database passes the current table in the request, so the kit never needs a storage port and a table edit takes effect on the next call.
type Resolution ¶
type Resolution struct {
// Detected is the raw name the fingerprint engine reported.
Detected string `json:"detected"`
// Product is the canonical key. Empty when nothing matched.
Product string `json:"product,omitempty"`
// MatchedVia records how it matched: exact | alias | contains | none.
MatchedVia string `json:"matched_via"`
// Confidence is 1.0 for an exact canonical hit, 0.9 for an alias and 0.6
// for a containment fallback.
Confidence float64 `json:"confidence"`
// Query is the effective template search term for this product.
Query []string `json:"query,omitempty"`
// Templates are the template ids bound to this product.
Templates []string `json:"templates,omitempty"`
}
Resolution is one recognized product mapped onto a binding.
func Resolve ¶
func Resolve(detected []string, bindings []Binding) []Resolution
Resolve maps every detected product name onto a binding.
It never guesses across products: an unmatched name stays unmatched, and the caller decides whether that is a denial or a gap in the table. Silently widening the match is how a scan ends up running templates against the wrong product.