mirror of
https://github.com/0xMarcio/cve.git
synced 2026-10-27 16:51:03 +00:00
0xMarcio
0e5e8d7e8c
The per-CVE pages read as a different site and disagreed with search about
their own contents. Both traced to the page generator having grown its own
copy of rules the browser already had.
Security:
- JSON-LD was serialised with json.dumps alone, which leaves < > and & raw. A
description containing "</script>" ended the element and turned the rest into
live markup. 78 descriptions in the corpus already carry that sequence; only
the 155-character meta trim kept them out of the payload. Escape to \u00XX.
Correctness:
- The PoC count summed only the repository column, so 19,940 pages announced
"0 public PoC exploits" directly above the ExploitDB and Metasploit entries
they were listing, in the title and meta description too. Count every source
the page renders, matching POC_FIELDS in logic.js.
- The severity chip took the highest score while search took the first, so
18,434 CVEs showed one severity in the results and another on the page. Both
now take the primary assessment, with the same Nuclei fallback search uses.
- Identical CVSS rows printed two and three times on 13,340 pages. Dedupe on
(version, score, vector) and label each survivor with its assessor from
row[4]; row[5] is the assessment type and left 129 pages showing two rows
both marked "Secondary".
- repo_from_url accepted any host containing "github" and kept .git suffixes,
so a clone URL and its plain form counted as two sources on the page and one
in search. 273 CVEs disagreed. Match repoFromUrl in logic.js exactly.
- 41 CVEs nobody has scored were unreachable by search, including by exact ID:
the severity filter tested membership of a list naming only the four scored
bands, so ALL excluded them. ALL now means all.
- EPSS percentiles printed a hard-coded "th": 51th, 62th, 93th on 21,100 pages.
- Search reported "1 PoCs", and the empty-results branch returned before
updating the live region, leaving it reading "loading index..." forever.
Deploy safety:
- A failed EPSS fetch returned {} and published it, silently erasing every
score from 82,000 pages. It now raises, as does a feed covering under 90%
of the index.
Presentation:
- CVE pages never loaded the webfonts the homepage loads, so all 82,468 fell
back to system fonts. This is why they looked unlike the rest of the site.
- 404.html referenced four CSS classes that no longer existed and rendered
unstyled, and its meta refresh threw a reader out of a search after two
seconds. It is now generated from the same constants and header as every
other page, and offers the search box instead.
- The homepage and the generated footer credited different sources. Both now
come from brand.SOURCES_LINE, and the build refuses to publish a homepage
that has drifted from it.
- Three aria-labels sat on div elements with no role, where they are ignored.
SEO:
- 61,936 pages filled "Related" with numerically adjacent CVEs, which are not
related to anything. Keep only shared-author relations; 20,532 pages have one.
- Sitemap lastmod described the CVE record, so a CVE that gained forty PoCs
still advertised a date from 2021. It now reflects the page, and each shard
carries its newest page's date rather than today's.
- TechArticle is not a type Google draws a rich result from, and its dates
claimed the CVE record's publication as the page's. Use WebPage with the
vulnerability as mainEntity.
- Curated sources and the CVE and NVD records no longer carry nofollow; the
crowd-sourced repository list still does.
45 lines
1.9 KiB
Python
45 lines
1.9 KiB
Python
"""Every user-facing name and URL, in one place.
|
|
|
|
The site header, the browser title, the social card, the README banner and the
|
|
GitHub About box all have to say the same thing. When they disagree Google picks
|
|
its own site name, and mentions stop compounding into one brand. Change a string
|
|
here and every generated surface follows.
|
|
"""
|
|
|
|
BRAND = "PoC Index"
|
|
TITLE = f"{BRAND}: Search CVE Proof-of-Concept Exploits"
|
|
# Short line under the wordmark, on the site and on both cards. Also carries
|
|
# og:description and twitter:description.
|
|
SUBTITLE = "Public proof-of-concept exploits, indexed by CVE."
|
|
# Meta description, the JSON-LD description and the GitHub About box, which are
|
|
# three places a reader meets the same sentence and so should be one string.
|
|
# States what the thing is and stops. No trailing feature list.
|
|
DESCRIPTION = (
|
|
"Search 82,000+ public CVE proof-of-concept exploits from GitHub, Nuclei, "
|
|
"ExploitDB, Metasploit and Vulhub."
|
|
)
|
|
|
|
SITE = "https://pocindex.io"
|
|
SLUG = "0xMarcio/pocindex"
|
|
|
|
|
|
def host() -> str:
|
|
"""SITE without the scheme, for the places that display a bare domain."""
|
|
return SITE.split("://", 1)[-1].rstrip("/")
|
|
|
|
# The head fragment every page shares. The per-CVE pages rendered without it and
|
|
# fell back to system fonts, which is why they read as a different site.
|
|
FONTS = (
|
|
'<link rel="preconnect" href="https://fonts.googleapis.com"/>\n'
|
|
'<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin/>\n'
|
|
'<link href="https://fonts.googleapis.com/css2?family=Space+Grotesk:wght@400;500;600'
|
|
'&family=IBM+Plex+Mono:wght@400;500&display=swap" rel="stylesheet"/>'
|
|
)
|
|
|
|
# One footer credit line. The homepage and the generated pages listed different
|
|
# sources, so a reader met two different claims about where the data comes from.
|
|
SOURCES_LINE = (
|
|
"sources: nvd · cve program · github · github advisories "
|
|
"· cisa vulnrichment · cisa kev · first epss"
|
|
)
|