mirror of
https://github.com/0xMarcio/cve.git
synced 2026-10-27 16:51:03 +00:00
963 lines
36 KiB
JavaScript
963 lines
36 KiB
JavaScript
'use strict';
|
|
|
|
const REPLACE_STRINGS = ['HackTheBox - ', 'VulnHub - ', 'UHC - '];
|
|
const PAGE_SIZE = 50;
|
|
const POC_PREVIEW = 5;
|
|
const ADVISORY_PREVIEW = 3;
|
|
const TREND_ROWS = 20;
|
|
const MIN_QUERY = 2;
|
|
const POC_FIELDS = ['poc', 'nuclei', 'msf', 'edb', 'vulhub', 'collections'];
|
|
const FILTER_OPTIONS = {
|
|
severity: [
|
|
['CRITICAL', 'CRITICAL'], ['HIGH', 'HIGH'], ['MEDIUM', 'MEDIUM'],
|
|
['LOW', 'LOW'], ['NONE', 'NONE']
|
|
],
|
|
source: [
|
|
['GITHUB', 'GITHUB'], ['GHSA', 'GHSA'], ['REFERENCE', 'REFERENCE'],
|
|
['NUCLEI', 'NUCLEI'], ['MSF', 'METASPLOIT'], ['EDB', 'EXPLOITDB'],
|
|
['VULHUB', 'VULHUB'], ['COLLECTIONS', 'COLLECTIONS']
|
|
]
|
|
};
|
|
|
|
const state = {
|
|
query: '',
|
|
mode: 'TRENDING',
|
|
shown: PAGE_SIZE,
|
|
descOpen: new Set(),
|
|
pocOpen: new Set(),
|
|
advisoryOpen: new Set(),
|
|
kevOnly: false,
|
|
filters: {
|
|
severity: new Set(FILTER_OPTIONS.severity.map(([value]) => value)),
|
|
source: new Set(FILTER_OPTIONS.source.map(([value]) => value))
|
|
},
|
|
ready: false,
|
|
results: []
|
|
};
|
|
|
|
let dataset = [];
|
|
let repoMeta = {};
|
|
let kev = {};
|
|
let ratings = {};
|
|
let metadata = {};
|
|
let epss = {};
|
|
let trending = [];
|
|
let indexMeta = null;
|
|
|
|
/* ---- formatting -------------------------------------------------------- */
|
|
|
|
function escapeHTML(value) {
|
|
return String(value == null ? '' : value).replace(/[&<>"']/g, ch => ({
|
|
'&': '&', '<': '<', '>': '>', '"': '"', "'": '''
|
|
}[ch]));
|
|
}
|
|
|
|
function formatCount(n) {
|
|
return n.toLocaleString('en-US');
|
|
}
|
|
|
|
function formatStars(n) {
|
|
return n >= 1000 ? (n / 1000).toFixed(1) + 'k' : String(n);
|
|
}
|
|
|
|
function hoursSince(iso) {
|
|
if (!iso) return null;
|
|
const then = Date.parse(iso.length === 10 ? iso + 'T00:00:00Z' : iso);
|
|
if (Number.isNaN(then)) return null;
|
|
return (Date.now() - then) / 36e5;
|
|
}
|
|
|
|
/** Long form for the trending table: "3 hours ago", "4 months ago". */
|
|
function longAge(hours) {
|
|
if (hours == null) return '';
|
|
const units = [
|
|
[8760, 'year'], [720, 'month'], [168, 'week'], [24, 'day'], [1, 'hour']
|
|
];
|
|
for (const [size, name] of units) {
|
|
if (hours >= size) {
|
|
const n = Math.floor(hours / size);
|
|
return `${n} ${name}${n === 1 ? '' : 's'} ago`;
|
|
}
|
|
}
|
|
const minutes = Math.max(1, Math.round(hours * 60));
|
|
return `${minutes} minute${minutes === 1 ? '' : 's'} ago`;
|
|
}
|
|
|
|
/** Compact age for the PoC columns: 3h, 3d, 2w, 5mo, 2y. */
|
|
function shortAge(hours) {
|
|
if (hours == null) return '';
|
|
if (hours < 24) return Math.max(1, Math.round(hours)) + 'h';
|
|
const days = hours / 24;
|
|
if (days < 14) return Math.round(days) + 'd';
|
|
if (days < 60) return Math.round(days / 7) + 'w';
|
|
if (days < 730) return Math.round(days / 30) + 'mo';
|
|
return Math.round(days / 365) + 'y';
|
|
}
|
|
|
|
// github.com serves more than repositories; an attachment or an advisory has
|
|
// no owner and no stars, and reads as nonsense in an owner / repo row.
|
|
const NOT_A_REPO = new Set(['user-attachments', 'advisories', 'security', 'orgs',
|
|
'apps', 'marketplace', 'sponsors', 'topics', 'collections', 'settings', 'notifications']);
|
|
|
|
function repoFromUrl(url) {
|
|
const match = /^https?:\/\/(?:www\.)?github\.com\/([^/#?]+)\/([^/#?]+)/i.exec(url || '');
|
|
if (!match || NOT_A_REPO.has(match[1].toLowerCase())) return null;
|
|
return { owner: match[1], repo: match[2].replace(/\.git$/i, '') };
|
|
}
|
|
|
|
/** Everything after the host, for links that are not GitHub repositories. */
|
|
function plainLinkLabel(url) {
|
|
try {
|
|
const parsed = new URL(url);
|
|
return parsed.host.replace(/^www\./, '') + parsed.pathname.replace(/\/$/, '');
|
|
} catch (err) {
|
|
return url;
|
|
}
|
|
}
|
|
|
|
/* ---- matching ---------------------------------------------------------- */
|
|
|
|
function normalizeToSpaces(value) {
|
|
return value.toLowerCase().replace(/[^a-z0-9]+/g, ' ').trim();
|
|
}
|
|
|
|
function buildLooseRegex(value) {
|
|
const compact = value.toLowerCase().replace(/[^a-z0-9]+/g, '');
|
|
if (compact.length < 4) return null;
|
|
const escaped = compact.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
|
|
return new RegExp(escaped.split('').join('[^a-z0-9]*'));
|
|
}
|
|
|
|
function buildMatcher(term) {
|
|
const raw = term.toLowerCase().trim();
|
|
if (!raw) return null;
|
|
const isPhrase = /\s/.test(raw);
|
|
const normalized = raw.replace(/[^a-z0-9]+/g, '');
|
|
return {
|
|
raw,
|
|
isPhrase,
|
|
phrase: isPhrase ? normalizeToSpaces(raw) : '',
|
|
loose: !isPhrase && normalized.length >= 4 ? buildLooseRegex(raw) : null
|
|
};
|
|
}
|
|
|
|
// Plain substring matching made "rce" hit "open source" and "sudo" hit
|
|
// "pseudo". Require the term to start a word; matching into the end of one is
|
|
// still allowed so that "word" finds "wordpress".
|
|
function wordStart(text, term) {
|
|
let at = text.indexOf(term);
|
|
while (at > 0) {
|
|
const code = text.charCodeAt(at - 1);
|
|
if (!((code > 96 && code < 123) || (code > 47 && code < 58))) return at;
|
|
at = text.indexOf(term, at + 1);
|
|
}
|
|
return at;
|
|
}
|
|
|
|
// A term in the opening of an advisory is what it is about; one buried deep in
|
|
// the prose is usually incidental. Coarse buckets so that a few characters of
|
|
// difference never outweighs the newest-first tie-break.
|
|
function leadBonus(index) {
|
|
if (index < 0) return 0;
|
|
if (index < 80) return 80;
|
|
if (index < 300) return 40;
|
|
return 0;
|
|
}
|
|
|
|
function pocText(entry) {
|
|
if (entry._pocText === undefined) {
|
|
entry._pocText = entryLinks(entry).join(' ').toLowerCase();
|
|
}
|
|
return entry._pocText;
|
|
}
|
|
|
|
function entryLinks(entry) {
|
|
if (entry._allLinks === undefined) {
|
|
entry._allLinks = uniqueSourceLinks(POC_FIELDS.flatMap(field => entry[field] || []));
|
|
}
|
|
return entry._allLinks;
|
|
}
|
|
|
|
function pocSpace(entry) {
|
|
if (entry._pocSpace === undefined) {
|
|
entry._pocSpace = normalizeToSpaces(pocText(entry));
|
|
}
|
|
return entry._pocSpace;
|
|
}
|
|
|
|
function descSpace(entry) {
|
|
if (entry._descSpace === undefined) {
|
|
entry._descSpace = normalizeToSpaces(entry._descText);
|
|
}
|
|
return entry._descSpace;
|
|
}
|
|
|
|
function scoreEntry(entry, matcher) {
|
|
if (!matcher || !matcher.raw) return 0;
|
|
|
|
if (matcher.isPhrase) {
|
|
const phrase = matcher.phrase;
|
|
if (!phrase) return 0;
|
|
const at = wordStart(descSpace(entry), phrase);
|
|
if (at >= 0) return 200 + leadBonus(at);
|
|
if (wordStart(pocSpace(entry), phrase) >= 0) return 80;
|
|
return 0;
|
|
}
|
|
|
|
const raw = matcher.raw;
|
|
if (entry._cveText.includes(raw)) return 600;
|
|
const at = wordStart(entry._descText, raw);
|
|
if (at >= 0) return 240 + leadBonus(at);
|
|
if (wordStart(pocText(entry), raw) >= 0) return 80;
|
|
if (matcher.loose) {
|
|
if (matcher.loose.test(entry._descText)) return 160;
|
|
if (matcher.loose.test(pocText(entry))) return 60;
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
/** How many of an entry's links carry every search term. */
|
|
function countLinkHits(entry, matchers) {
|
|
let hits = 0;
|
|
for (const url of entryLinks(entry)) {
|
|
const text = url.toLowerCase();
|
|
if (matchers.every(m => wordStart(text, m.raw) >= 0 || (m.loose && m.loose.test(text)))) {
|
|
hits += 1;
|
|
if (hits >= 999) break;
|
|
}
|
|
}
|
|
return hits;
|
|
}
|
|
|
|
function canonicalCvss(id) {
|
|
const rows = ((metadata[id] || {}).cvss || []);
|
|
if (!Array.isArray(rows) || !Array.isArray(rows[0])) return null;
|
|
const row = rows[0];
|
|
return {
|
|
score: Number(row[1]),
|
|
severity: String(row[2] || '').toUpperCase()
|
|
};
|
|
}
|
|
|
|
function entrySeverity(entry) {
|
|
const score = canonicalCvss(entry.cve);
|
|
if (score && ['NONE', 'LOW', 'MEDIUM', 'HIGH', 'CRITICAL'].includes(score.severity)) {
|
|
return score.severity;
|
|
}
|
|
const fallback = String((ratings[entry.cve] || {}).severity || '').toUpperCase();
|
|
return ['NONE', 'LOW', 'MEDIUM', 'HIGH', 'CRITICAL'].includes(fallback) ? fallback : '';
|
|
}
|
|
|
|
function hasActiveFilters() {
|
|
return state.kevOnly || Object.entries(state.filters).some(
|
|
([kind, filter]) => filter.size !== FILTER_OPTIONS[kind].length
|
|
);
|
|
}
|
|
|
|
function entrySources(entry) {
|
|
const sources = new Set();
|
|
const fields = {
|
|
NUCLEI: 'nuclei', MSF: 'msf', EDB: 'edb', VULHUB: 'vulhub', COLLECTIONS: 'collections'
|
|
};
|
|
for (const [source, field] of Object.entries(fields)) {
|
|
if ((entry[field] || []).length) sources.add(source);
|
|
}
|
|
for (const url of entry.poc || []) {
|
|
if (/^https?:\/\/(?:www\.)?github\.com\/advisories\/GHSA-/i.test(url)) {
|
|
sources.add('GHSA');
|
|
} else if (repoFromUrl(url)) {
|
|
sources.add('GITHUB');
|
|
} else {
|
|
sources.add('REFERENCE');
|
|
}
|
|
}
|
|
return sources;
|
|
}
|
|
|
|
function matchesMultiFilter(values, filter) {
|
|
for (const value of filter) {
|
|
if (values.has(value)) return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
function matchesFilters(entry) {
|
|
if (state.kevOnly && !kev[entry.cve]) return false;
|
|
if (!matchesMultiFilter(entrySources(entry), state.filters.source)) return false;
|
|
const severity = entrySeverity(entry) || 'UNSCORED';
|
|
return matchesMultiFilter(new Set([severity]), state.filters.severity);
|
|
}
|
|
|
|
function runSearch(query) {
|
|
const terms = query.match(/-?"[^"]+"|-?\S+/g) || [];
|
|
const cleaned = terms.map(t => t.replace(/^(-?)"/, '$1').replace(/"$/, ''));
|
|
const positive = cleaned.filter(t => t && t[0] !== '-');
|
|
const matchers = positive.map(buildMatcher).filter(Boolean);
|
|
// Unquoted words are matched independently, so "active directory" also hits a
|
|
// description holding "active session" and "working directory". Reward the
|
|
// words appearing together to keep those below real matches.
|
|
const adjacent = positive.length > 1 ? positive.join(' ').toLowerCase() : '';
|
|
const negatives = cleaned
|
|
.filter(t => t && t[0] === '-')
|
|
.map(t => t.slice(1))
|
|
.filter(Boolean)
|
|
.map(buildMatcher)
|
|
.filter(Boolean);
|
|
|
|
const results = [];
|
|
results.pocTotal = 0;
|
|
for (const entry of dataset) {
|
|
if (!matchesFilters(entry)) continue;
|
|
let score = 0;
|
|
let matched = true;
|
|
let describes = false;
|
|
for (const matcher of matchers) {
|
|
const termScore = scoreEntry(entry, matcher);
|
|
if (termScore === 0) { matched = false; break; }
|
|
if (termScore >= 160) describes = true;
|
|
score += termScore;
|
|
}
|
|
if (!matched) continue;
|
|
if (negatives.some(m => scoreEntry(entry, m) > 0)) continue;
|
|
|
|
if (adjacent) {
|
|
const at = wordStart(entry._descText, adjacent);
|
|
if (at >= 0) { score += 300 + leadBonus(at); describes = true; }
|
|
else if (wordStart(pocText(entry), adjacent) >= 0) score += 100;
|
|
}
|
|
entry._score = score;
|
|
// A term nobody's advisory text uses, "log4shell" for one, leaves every match tied
|
|
// at the weakest tier, where newest-first is meaningless. How many of the
|
|
// linked PoCs carry the term says far more than which CVE is newer.
|
|
entry._hits = describes ? 0 : countLinkHits(entry, matchers);
|
|
results.pocTotal += entryLinks(entry).length;
|
|
results.push(entry);
|
|
}
|
|
|
|
results.sort((a, b) => {
|
|
if (b._score !== a._score) return b._score - a._score;
|
|
if (b._hits !== a._hits) return b._hits - a._hits;
|
|
if (b._year !== a._year) return b._year - a._year;
|
|
return b._num - a._num;
|
|
});
|
|
return results;
|
|
}
|
|
|
|
function prepareDataset(raw) {
|
|
if (!Array.isArray(raw)) return [];
|
|
const out = [];
|
|
for (const entry of raw) {
|
|
const cve = (entry.cve || '').trim();
|
|
if (!cve) continue;
|
|
for (const field of POC_FIELDS) {
|
|
if (!Array.isArray(entry[field])) entry[field] = [];
|
|
}
|
|
if (!entryLinks(entry).length) continue;
|
|
const parts = cve.split('-');
|
|
entry._cveText = cve.toLowerCase();
|
|
entry._descText = REPLACE_STRINGS
|
|
.reduce((desc, str) => desc.replace(str, ''), entry.desc || '')
|
|
.toLowerCase();
|
|
entry._year = parseInt(parts[1], 10) || 0;
|
|
entry._num = parseInt(parts[2], 10) || 0;
|
|
out.push(entry);
|
|
}
|
|
return out;
|
|
}
|
|
|
|
/* ---- rendering --------------------------------------------------------- */
|
|
|
|
const el = {
|
|
input: document.querySelector('[data-search]'),
|
|
status: document.querySelector('[data-status]'),
|
|
results: document.querySelector('[data-results]'),
|
|
trending: document.querySelector('[data-trending]'),
|
|
trendNote: document.querySelector('[data-trend-note]'),
|
|
trendRows: document.querySelector('[data-trend-rows]'),
|
|
statTotal: document.querySelector('[data-stat-total]'),
|
|
statPocs: document.querySelector('[data-stat-pocs]'),
|
|
statKev: document.querySelector('[data-stat-kev]'),
|
|
refreshed: document.querySelector('[data-refreshed]'),
|
|
filterTriggers: {
|
|
severity: document.querySelector('[data-filter-trigger="severity"]'),
|
|
source: document.querySelector('[data-filter-trigger="source"]')
|
|
},
|
|
filterSummaries: {
|
|
severity: document.querySelector('[data-filter-summary="severity"]'),
|
|
source: document.querySelector('[data-filter-summary="source"]')
|
|
},
|
|
filterOptions: {
|
|
severity: document.querySelector('[data-filter-options="severity"]'),
|
|
source: document.querySelector('[data-filter-options="source"]')
|
|
},
|
|
kevOnly: document.querySelector('[data-filter-kev]'),
|
|
clearFilters: document.querySelector('[data-clear-filters]')
|
|
};
|
|
|
|
const CURATED = [
|
|
{ match: 'github.com/advisories/GHSA-', tag: 'GHSA', hint: 'GitHub reviewed advisory with reproducible exploit material',
|
|
label: url => url.split('/').pop() },
|
|
{ match: '/zan8in/afrog/', tag: 'AFROG', hint: 'Runnable afrog CVE template',
|
|
label: url => decodeURIComponent(url.split('/').pop()) },
|
|
{ match: '/chaitin/xray/', tag: 'XRAY', hint: 'Runnable xray CVE template',
|
|
label: url => decodeURIComponent(url.split('/').pop()) },
|
|
{ match: '/helloexp/0day/', tag: '0DAY', hint: 'CVE-specific exploit collection path',
|
|
label: url => decodeURIComponent(url.split('/').pop()) },
|
|
{ match: '/tzwlhack/Vulnerability/', tag: 'POC', hint: 'CVE-specific reproduction guide',
|
|
label: url => decodeURIComponent(url.split('/').pop()) },
|
|
{ match: '/nuclei-templates/', tag: 'NUCLEI', hint: 'Runnable nuclei detection template',
|
|
label: url => url.split('/').pop() },
|
|
{ match: '/metasploit-framework/', tag: 'MSF', hint: 'Metasploit module',
|
|
label: url => url.split('/modules/').pop().replace(/\.rb$/, '') },
|
|
{ match: 'exploit-db.com/exploits/', tag: 'EDB', hint: 'ExploitDB entry',
|
|
label: url => 'exploit-db.com/' + url.split('/').pop() },
|
|
{ match: '/vulhub/vulhub/tree/', tag: 'VULHUB', hint: 'Runnable Vulhub environment',
|
|
label: url => url.split('/tree/master/').pop() }
|
|
];
|
|
|
|
function pocRow(url) {
|
|
const curated = CURATED.find(source => url.includes(source.match));
|
|
if (curated) {
|
|
return '<div class="poc-row"><span class="poc-name">' +
|
|
`<span class="poc-tag is-${curated.tag.toLowerCase()}" title="${escapeHTML(curated.hint)}">${curated.tag}</span>` +
|
|
`<a href="${escapeHTML(url)}" target="_blank" rel="noopener">${escapeHTML(curated.label(url))}</a>` +
|
|
'</span><span class="poc-stars"></span><span class="poc-age"></span></div>';
|
|
}
|
|
const parsed = repoFromUrl(url);
|
|
const href = escapeHTML(url);
|
|
// A gist or an advisory has no owner and no stars; the star and age columns
|
|
// stay empty rather than inventing a repository shape for it.
|
|
if (!parsed) {
|
|
return '<div class="poc-row"><span class="poc-name">' +
|
|
`<a class="plain" href="${href}" target="_blank" rel="noopener">${escapeHTML(plainLinkLabel(url))}</a>` +
|
|
'</span><span class="poc-stars"></span><span class="poc-age"></span></div>';
|
|
}
|
|
const meta = repoMeta[(parsed.owner + '/' + parsed.repo).toLowerCase()];
|
|
const stars = meta ? meta[0] : null;
|
|
const hours = meta ? hoursSince(meta[1]) : null;
|
|
const popular = stars != null && stars >= 500 ? ' is-popular' : '';
|
|
// The glyph stays dim at every value so the column reads as numbers.
|
|
const starCell = stars == null ? '' : `${formatStars(stars)} <span class="star">★</span>`;
|
|
return '<div class="poc-row">' +
|
|
`<span class="poc-name">${escapeHTML(parsed.owner)}<span class="poc-sep"> / </span>` +
|
|
`<a href="${href}" target="_blank" rel="noopener">${escapeHTML(parsed.repo)}</a></span>` +
|
|
`<span class="poc-stars${popular}">${starCell}</span>` +
|
|
`<span class="poc-age">${escapeHTML(shortAge(hours))}</span></div>`;
|
|
}
|
|
|
|
function compact(value) {
|
|
return value.toLowerCase().replace(/[^a-z0-9]/g, '');
|
|
}
|
|
|
|
/** Best links first. A repository named after the CVE is a proof of concept for
|
|
* it; a 5k-star scanner that merely mentions it is not, so stars only order
|
|
* repositories that are already about this CVE. Links with no star count keep
|
|
* their original order behind both: a reference has no repository to rank. */
|
|
function rankedLinks(entry) {
|
|
if (entry._ranked) return entry._ranked;
|
|
const id = compact(entry.cve);
|
|
const scored = (entry.poc || []).map((url, index) => {
|
|
const parsed = repoFromUrl(url);
|
|
const meta = parsed && repoMeta[(parsed.owner + '/' + parsed.repo).toLowerCase()];
|
|
return {
|
|
url,
|
|
index,
|
|
dedicated: compact(url).includes(id) ? 1 : 0,
|
|
stars: meta ? meta[0] : -1
|
|
};
|
|
});
|
|
scored.sort((a, b) =>
|
|
(b.dedicated - a.dedicated) || (b.stars - a.stars) || (a.index - b.index));
|
|
// A nuclei template leads: of everything linked here it is the one entry that
|
|
// runs as it stands, against a target, without reading somebody's code first.
|
|
// Curated entries lead: templates, exploit archives, modules and runnable
|
|
// environments can be used as they stand without first reading a repository.
|
|
entry._ranked = uniqueSourceLinks([
|
|
...(entry.nuclei || []), ...(entry.msf || []), ...(entry.edb || []), ...(entry.vulhub || []),
|
|
...(entry.collections || []),
|
|
...scored.map(item => item.url)
|
|
]);
|
|
return entry._ranked;
|
|
}
|
|
|
|
function cvssTooltip(id) {
|
|
const rows = ((metadata[id] || {}).cvss || []);
|
|
if (!Array.isArray(rows)) return '';
|
|
return rows.filter(Array.isArray).map(row => {
|
|
const source = row[4] ? ` by ${row[4]}` : '';
|
|
const assessment = row[5] ? ` (${row[5]})` : '';
|
|
return `CVSS ${row[0]} ${row[1]} ${row[2]}${source}${assessment}\n${row[3] || ''}`.trim();
|
|
}).join('\n\n');
|
|
}
|
|
|
|
function advisoryRow(item) {
|
|
if (!Array.isArray(item) || !item[0]) return '';
|
|
const url = String(item[0]);
|
|
const tags = Array.isArray(item[1]) ? item[1].map(String) : [];
|
|
const tag = tags.includes('Vendor Advisory') ? 'VENDOR' : tags.includes('Patch') ? 'PATCH' : 'ADVISORY';
|
|
return '<div class="poc-row"><span class="poc-name">' +
|
|
`<span class="poc-tag is-advisory" title="${escapeHTML(tags.join(', ') || 'Advisory')}">${tag}</span>` +
|
|
`<a class="plain" href="${escapeHTML(url)}" target="_blank" rel="noopener">${escapeHTML(plainLinkLabel(url))}</a>` +
|
|
'</span><span class="poc-stars"></span><span class="poc-age"></span></div>';
|
|
}
|
|
|
|
function normalizedLink(url) {
|
|
const parsed = repoFromUrl(String(url || ''));
|
|
if (parsed) return `github:${parsed.owner.toLowerCase()}/${parsed.repo.toLowerCase()}`;
|
|
return String(url || '').replace(/\/$/, '');
|
|
}
|
|
|
|
function uniqueSourceLinks(urls) {
|
|
const seen = new Set();
|
|
return urls.filter(url => {
|
|
const key = normalizedLink(url);
|
|
if (seen.has(key)) return false;
|
|
seen.add(key);
|
|
return true;
|
|
});
|
|
}
|
|
|
|
function resultRow(entry) {
|
|
const id = entry.cve;
|
|
const open = state.descOpen.has(id);
|
|
const all = state.pocOpen.has(id);
|
|
const links = rankedLinks(entry);
|
|
const visible = all ? links : links.slice(0, POC_PREVIEW);
|
|
// Nothing to expand means no control: a line reading "all repositories
|
|
// shown" under a list of three is chrome that answers a question nobody has.
|
|
const moreButton = links.length > POC_PREVIEW
|
|
? `<button type="button" class="poc-more" data-toggle-poc="${escapeHTML(id)}">` +
|
|
`${all ? '↑ show fewer' : '+ ' + formatCount(links.length - POC_PREVIEW) + ' more'}</button>`
|
|
: '';
|
|
|
|
const advisoryOpen = state.advisoryOpen.has(id);
|
|
const pocLinks = new Set(entryLinks(entry).map(normalizedLink));
|
|
const advisories = ((metadata[id] || {}).advisories || [])
|
|
.filter(item => Array.isArray(item) && !pocLinks.has(normalizedLink(item[0])));
|
|
const shownAdvisories = advisoryOpen ? advisories : advisories.slice(0, ADVISORY_PREVIEW);
|
|
const advisoryMore = advisories.length > ADVISORY_PREVIEW
|
|
? `<button type="button" class="poc-more" data-toggle-advisory="${escapeHTML(id)}">` +
|
|
`${advisoryOpen ? '↑ show fewer' : '+ ' + formatCount(advisories.length - ADVISORY_PREVIEW) + ' more'}</button>`
|
|
: '';
|
|
const advisoryHtml = advisories.length
|
|
? `<div class="advisory-list"><div class="advisory-head">CREDIBLE ADVISORIES <span>${formatCount(advisories.length)}</span></div>` +
|
|
`${shownAdvisories.map(advisoryRow).join('')}${advisoryMore}</div>`
|
|
: '';
|
|
|
|
// NVD is canonical and carries every CVSS generation. Nuclei remains a
|
|
// fallback for a template scored before NVD or its CNA publishes a vector.
|
|
const canonical = canonicalCvss(id);
|
|
const fallback = ratings[id] || {};
|
|
const severity = canonical ? canonical.severity : entrySeverity(entry);
|
|
const cvss = canonical ? canonical.score : fallback.cvss;
|
|
const tooltip = canonical ? cvssTooltip(id) : String(fallback.cvss_vector || '');
|
|
const severityChip = severity
|
|
? `<span class="chip chip-sev is-${escapeHTML(severity.toLowerCase())}"${tooltip ? ` title="${escapeHTML(tooltip)}"` : ''}>` +
|
|
`${escapeHTML(severity)}${cvss != null ? ' ' + escapeHTML(cvss) : ''}</span>`
|
|
: '';
|
|
// FIRST's feed covers nearly the whole index; a template's own score is the
|
|
// fallback for the handful it misses.
|
|
const scored = epss[id] || (fallback.epss != null ? [fallback.epss, fallback.epss_pct || 0] : null);
|
|
const epssChip = scored
|
|
? `<span class="chip chip-epss${scored[0] >= 0.1 ? ' is-hot' : ''}" title="EPSS: estimated chance of exploitation in the next 30 days, ${Math.round(scored[1] * 100)}th percentile">` +
|
|
`EPSS ${(scored[0] * 100).toFixed(scored[0] >= 0.1 ? 0 : 1)}%</span>`
|
|
: '';
|
|
|
|
const flagged = kev[id];
|
|
const kevChip = flagged
|
|
? `<span class="chip chip-kev" title="Listed in CISA's Known Exploited Vulnerabilities catalogue on ${escapeHTML(flagged[0])}${flagged[1] ? ', used in ransomware campaigns' : ''}">` +
|
|
`KEV${flagged[1] ? ' RANSOMWARE' : ''}</span>`
|
|
: '';
|
|
|
|
const dates = [];
|
|
if (entry.published) dates.push(`published ${entry.published}`);
|
|
if (entry.modified) dates.push(`modified ${entry.modified}`);
|
|
const dateHtml = dates.length
|
|
? `<div class="result-dates">${dates.map(d => `<span>${escapeHTML(d)}</span>`).join('')}</div>`
|
|
: '';
|
|
|
|
return `<div class="result-row">
|
|
<div class="result-meta">
|
|
<a class="result-id" href="https://nvd.nist.gov/vuln/detail/${encodeURIComponent(id)}" target="_blank" rel="noopener">${escapeHTML(id)}</a>
|
|
<div class="result-pocs">${formatCount(links.length)} linked PoC${links.length === 1 ? '' : 's'}</div>
|
|
${dateHtml}
|
|
<div class="chips">${kevChip}${severityChip}${epssChip}
|
|
<a class="chip" href="https://www.cve.org/CVERecord?id=${encodeURIComponent(id)}" target="_blank" rel="noopener">CVE.ORG ↗</a>
|
|
</div>
|
|
</div>
|
|
<div class="result-body">
|
|
<p class="result-desc${open ? ' is-open' : ''}">${escapeHTML(entry.desc || '')}</p>
|
|
<button type="button" class="expander" data-toggle-desc="${escapeHTML(id)}">${open ? '↑ collapse' : '↓ full description'}</button>
|
|
<div class="poc-list">
|
|
${visible.map(pocRow).join('')}
|
|
${moreButton}
|
|
</div>
|
|
${advisoryHtml}
|
|
</div>
|
|
</div>`;
|
|
}
|
|
|
|
/** Hide the expander on descriptions that already fit; a button that does
|
|
* nothing when clicked is worse than no button. */
|
|
function pruneExpanders() {
|
|
for (const row of el.results.querySelectorAll('.result-row')) {
|
|
const desc = row.querySelector('.result-desc');
|
|
const button = row.querySelector('.expander');
|
|
if (!desc || !button) continue;
|
|
if (!desc.classList.contains('is-open') && desc.scrollHeight <= desc.clientHeight + 1) {
|
|
button.hidden = true;
|
|
}
|
|
}
|
|
}
|
|
|
|
function renderResults(elapsed) {
|
|
const results = state.results;
|
|
el.trending.hidden = true;
|
|
el.results.hidden = false;
|
|
|
|
if (!results.length) {
|
|
const subject = state.query.length >= MIN_QUERY
|
|
? ` for ${escapeHTML(state.query)}`
|
|
: ' for the active filters';
|
|
el.results.innerHTML = `<div class="empty">No results${subject}</div>`;
|
|
return;
|
|
}
|
|
|
|
const shown = results.slice(0, state.shown);
|
|
const pocTotal = results.pocTotal;
|
|
const remaining = results.length - shown.length;
|
|
const footer = remaining > 0
|
|
? `<button type="button" class="poc-more" style="padding:9px 16px" data-more-results>+ ${formatCount(remaining)} more matching CVEs</button>`
|
|
: '';
|
|
|
|
el.results.innerHTML = `<div class="panel-head">
|
|
<h2>Results</h2>
|
|
<span class="panel-count">${formatCount(results.length)} CVE${results.length === 1 ? '' : 's'} · ${formatCount(pocTotal)} PoCs</span>
|
|
</div>
|
|
<div class="col-head"><span>CVE</span><span>DESCRIPTION / POC LINKS</span></div>
|
|
${shown.map(resultRow).join('')}${footer}`;
|
|
pruneExpanders();
|
|
|
|
if (elapsed != null) {
|
|
el.status.textContent = `matched in ${Math.max(1, Math.round(elapsed))}ms`;
|
|
}
|
|
}
|
|
|
|
function trendRow(item) {
|
|
const popular = item.stars >= 500 ? ' is-popular' : '';
|
|
// The trending table flags the same catalogue the CVE rows do, so a row worth
|
|
// reading first is visible without opening it.
|
|
const flagged = item.cve && kev[item.cve]
|
|
? `<span class="trend-kev" title="Listed in CISA's Known Exploited Vulnerabilities catalogue">KEV</span>`
|
|
: '';
|
|
return `<div class="trend-row">
|
|
<span class="trend-stars${popular}">${formatStars(item.stars)} <span class="star">★</span></span>
|
|
<span class="trend-age">${escapeHTML(longAge(item._pushed))}</span>
|
|
<span class="trend-name-cell">${flagged}<a class="trend-name" href="${escapeHTML(item.url)}" target="_blank" rel="noopener">${escapeHTML(item.name)}</a></span>
|
|
<span class="trend-desc">${escapeHTML(item.desc || '')}</span>
|
|
</div>`;
|
|
}
|
|
|
|
function renderTrending() {
|
|
el.results.hidden = true;
|
|
el.trending.hidden = false;
|
|
|
|
const ranked = trending.slice();
|
|
if (state.mode === 'TRENDING') {
|
|
// Stars weighted against the age the row displays, so the order is legible
|
|
// from the table itself: a fresh PoC pulling stars outranks a bigger one
|
|
// that has been sitting still.
|
|
const rank = r => r.stars / Math.pow((r._pushed == null ? 8760 : r._pushed) + 6, 0.45);
|
|
ranked.sort((a, b) => rank(b) - rank(a));
|
|
} else {
|
|
ranked.sort((a, b) => (a._pushed == null ? Infinity : a._pushed) - (b._pushed == null ? Infinity : b._pushed));
|
|
}
|
|
const rows = ranked.slice(0, TREND_ROWS);
|
|
|
|
el.trendNote.textContent = state.mode === 'TRENDING'
|
|
? 'stars weighted against time since the last commit'
|
|
: 'newest commit first';
|
|
|
|
el.trendRows.innerHTML = rows.length
|
|
? rows.map(trendRow).join('')
|
|
: '<div class="trend-row"><span class="trend-desc">No recent PoCs.</span></div>';
|
|
|
|
document.querySelectorAll('.switch button').forEach(button => {
|
|
button.setAttribute('aria-pressed', String(button.dataset.mode === state.mode));
|
|
});
|
|
}
|
|
|
|
function paintHeroStats() {
|
|
if (!el.statTotal) return;
|
|
if (indexMeta) {
|
|
el.statTotal.textContent = formatCount(indexMeta.total_cves);
|
|
el.statPocs.textContent = formatCount(indexMeta.with_pocs);
|
|
}
|
|
const flagged = Object.keys(kev).length;
|
|
if (flagged) el.statKev.textContent = formatCount(flagged);
|
|
}
|
|
|
|
function idleStatus() {
|
|
// The hero carries the totals now, so the field keeps its slot for timings.
|
|
return '';
|
|
}
|
|
|
|
function render() {
|
|
if (state.query.length < MIN_QUERY && !hasActiveFilters()) {
|
|
el.status.textContent = state.ready ? idleStatus() : 'loading index…';
|
|
renderTrending();
|
|
return;
|
|
}
|
|
if (!state.ready) {
|
|
el.results.hidden = false;
|
|
el.trending.hidden = true;
|
|
el.status.textContent = 'loading index…';
|
|
el.results.innerHTML = '<div class="empty">Loading the CVE index…</div>';
|
|
return;
|
|
}
|
|
const started = performance.now();
|
|
state.results = runSearch(state.query.length >= MIN_QUERY ? state.query : '');
|
|
renderResults(performance.now() - started);
|
|
}
|
|
|
|
/* ---- wiring ------------------------------------------------------------ */
|
|
|
|
// A full pass over the index costs ~200ms, so one per keystroke makes typing
|
|
// stutter. 160ms covers an ordinary typing cadence without the wait being felt;
|
|
// clearing the field stays instant.
|
|
let searchTimer = null;
|
|
el.input.addEventListener('input', () => {
|
|
const next = el.input.value.trim();
|
|
if (next === state.query) return;
|
|
state.query = next;
|
|
state.shown = PAGE_SIZE;
|
|
clearTimeout(searchTimer);
|
|
if (next.length < MIN_QUERY) {
|
|
render();
|
|
return;
|
|
}
|
|
searchTimer = setTimeout(render, 160);
|
|
});
|
|
|
|
document.querySelector('.search').addEventListener('submit', event => event.preventDefault());
|
|
|
|
function renderFilterOptions() {
|
|
for (const [kind, options] of Object.entries(FILTER_OPTIONS)) {
|
|
el.filterOptions[kind].innerHTML = options.map(([value, label]) =>
|
|
`<label class="filter-option">` +
|
|
`<input type="checkbox" data-filter-kind="${kind}" data-filter-value="${value}">` +
|
|
`<span class="filter-check" aria-hidden="true"></span>` +
|
|
`<span class="filter-option-label">${escapeHTML(label)}</span></label>`
|
|
).join('');
|
|
}
|
|
}
|
|
|
|
function closeFilterMenus(except) {
|
|
for (const kind of Object.keys(FILTER_OPTIONS)) {
|
|
if (kind === except) continue;
|
|
el.filterOptions[kind].hidden = true;
|
|
el.filterTriggers[kind].setAttribute('aria-expanded', 'false');
|
|
}
|
|
}
|
|
|
|
function filterTitle(kind) {
|
|
const selected = [...state.filters[kind]];
|
|
return selected.length === FILTER_OPTIONS[kind].length ? 'All values' : selected.join(', ');
|
|
}
|
|
|
|
function syncFilterControls() {
|
|
for (const kind of Object.keys(FILTER_OPTIONS)) {
|
|
const filter = state.filters[kind];
|
|
const summary = filter.size === FILTER_OPTIONS[kind].length
|
|
? 'ALL'
|
|
: filter.size === 1 ? [...filter][0] : `${filter.size} SELECTED`;
|
|
el.filterSummaries[kind].textContent = summary;
|
|
el.filterTriggers[kind].title = filterTitle(kind);
|
|
for (const checkbox of el.filterOptions[kind].querySelectorAll('[data-filter-value]')) {
|
|
checkbox.checked = filter.has(checkbox.dataset.filterValue);
|
|
}
|
|
}
|
|
el.kevOnly.setAttribute('aria-pressed', String(state.kevOnly));
|
|
el.clearFilters.hidden = !hasActiveFilters();
|
|
}
|
|
|
|
for (const kind of Object.keys(FILTER_OPTIONS)) {
|
|
el.filterTriggers[kind].addEventListener('click', () => {
|
|
const opening = el.filterOptions[kind].hidden;
|
|
closeFilterMenus(kind);
|
|
el.filterOptions[kind].hidden = !opening;
|
|
el.filterTriggers[kind].setAttribute('aria-expanded', String(opening));
|
|
});
|
|
el.filterOptions[kind].addEventListener('change', event => {
|
|
const checkbox = event.target.closest('[data-filter-value]');
|
|
if (!checkbox) return;
|
|
const filter = state.filters[kind];
|
|
const value = checkbox.dataset.filterValue;
|
|
if (checkbox.checked) filter.add(value);
|
|
else filter.delete(value);
|
|
state.shown = PAGE_SIZE;
|
|
syncFilterControls();
|
|
render();
|
|
});
|
|
}
|
|
|
|
document.addEventListener('click', event => {
|
|
if (!event.target.closest('.filter-menu')) closeFilterMenus();
|
|
});
|
|
|
|
el.kevOnly.addEventListener('click', () => {
|
|
state.kevOnly = !state.kevOnly;
|
|
state.shown = PAGE_SIZE;
|
|
syncFilterControls();
|
|
render();
|
|
});
|
|
|
|
el.clearFilters.addEventListener('click', () => {
|
|
state.kevOnly = false;
|
|
for (const [kind, filter] of Object.entries(state.filters)) {
|
|
filter.clear();
|
|
for (const [value] of FILTER_OPTIONS[kind]) filter.add(value);
|
|
}
|
|
state.shown = PAGE_SIZE;
|
|
syncFilterControls();
|
|
render();
|
|
});
|
|
|
|
renderFilterOptions();
|
|
syncFilterControls();
|
|
|
|
// Typing anywhere on the page means typing into the search field. The keystroke
|
|
// is not swallowed: focusing during keydown lets the character land in the
|
|
// field it just moved to, so the first letter is never lost.
|
|
document.addEventListener('keydown', event => {
|
|
if (event.ctrlKey || event.metaKey || event.altKey) return;
|
|
const openFilter = Object.keys(FILTER_OPTIONS).find(kind =>
|
|
el.filterTriggers[kind].getAttribute('aria-expanded') === 'true');
|
|
if (event.key === 'Escape' && openFilter) {
|
|
closeFilterMenus();
|
|
el.filterTriggers[openFilter].focus();
|
|
return;
|
|
}
|
|
if (document.activeElement === el.input) {
|
|
if (event.key === 'Escape') {
|
|
el.input.value = '';
|
|
el.input.dispatchEvent(new Event('input', { bubbles: true }));
|
|
el.input.blur();
|
|
}
|
|
return;
|
|
}
|
|
const active = document.activeElement;
|
|
const editing = active && (active.isContentEditable
|
|
|| ['INPUT', 'TEXTAREA', 'SELECT', 'BUTTON'].includes(active.tagName));
|
|
if (editing) return;
|
|
// A lone slash is the shortcut, so it focuses without typing itself.
|
|
if (event.key === '/') {
|
|
event.preventDefault();
|
|
el.input.focus();
|
|
return;
|
|
}
|
|
if (event.key.length !== 1 && event.key !== 'Backspace') return;
|
|
el.input.focus();
|
|
});
|
|
|
|
// A pointer landing on the page is not a request to type, so the field is only
|
|
// focused up front where a keyboard is the likely input.
|
|
if (window.matchMedia('(min-width: 900px)').matches) el.input.focus();
|
|
|
|
document.querySelector('.switch').addEventListener('click', event => {
|
|
const button = event.target.closest('button[data-mode]');
|
|
if (!button) return;
|
|
state.mode = button.dataset.mode;
|
|
renderTrending();
|
|
});
|
|
|
|
el.results.addEventListener('click', event => {
|
|
const desc = event.target.closest('[data-toggle-desc]');
|
|
const poc = event.target.closest('[data-toggle-poc]');
|
|
const advisory = event.target.closest('[data-toggle-advisory]');
|
|
const more = event.target.closest('[data-more-results]');
|
|
if (desc) {
|
|
const id = desc.dataset.toggleDesc;
|
|
state.descOpen.has(id) ? state.descOpen.delete(id) : state.descOpen.add(id);
|
|
} else if (poc) {
|
|
const id = poc.dataset.togglePoc;
|
|
state.pocOpen.has(id) ? state.pocOpen.delete(id) : state.pocOpen.add(id);
|
|
} else if (advisory) {
|
|
const id = advisory.dataset.toggleAdvisory;
|
|
state.advisoryOpen.has(id) ? state.advisoryOpen.delete(id) : state.advisoryOpen.add(id);
|
|
} else if (more) {
|
|
state.shown += PAGE_SIZE;
|
|
} else {
|
|
return;
|
|
}
|
|
renderResults(null);
|
|
});
|
|
|
|
async function loadJSON(url, options) {
|
|
const response = await fetch(url, options);
|
|
if (!response.ok) throw new Error(`${url} (${response.status})`);
|
|
return response.json();
|
|
}
|
|
|
|
(async () => {
|
|
try {
|
|
const meta = await loadJSON('/trending_poc.json', { cache: 'no-store' });
|
|
indexMeta = meta;
|
|
trending = (meta.items || []).map(item => Object.assign({}, item, {
|
|
_pushed: hoursSince(item.pushed),
|
|
_created: hoursSince(item.created)
|
|
}));
|
|
const minutes = Math.max(0, Math.round((Date.now() - Date.parse(meta.generated)) / 60000));
|
|
el.refreshed.textContent = minutes < 60
|
|
? `index refreshed ${minutes} minute${minutes === 1 ? '' : 's'} ago`
|
|
: `index refreshed ${Math.round(minutes / 60)} hour${Math.round(minutes / 60) === 1 ? '' : 's'} ago`;
|
|
} catch (err) {
|
|
console.warn(err.message);
|
|
}
|
|
paintHeroStats();
|
|
render();
|
|
|
|
// The repository metadata is optional: without it the PoC rows simply lose
|
|
// their star and age columns, which is the documented fallback.
|
|
loadJSON('/kev.json', { cache: 'no-cache' }).then(data => {
|
|
kev = data || {};
|
|
el.kevOnly.disabled = false;
|
|
paintHeroStats();
|
|
if (state.ready && (state.query || hasActiveFilters())) render();
|
|
else renderTrending();
|
|
}).catch(err => console.warn(err.message));
|
|
|
|
loadJSON('/cve_metadata.json', { cache: 'no-cache' }).then(data => {
|
|
metadata = data || {};
|
|
el.filterTriggers.severity.disabled = false;
|
|
if (state.ready && (state.query || hasActiveFilters())) render();
|
|
}).catch(err => console.warn(err.message));
|
|
|
|
loadJSON('/nuclei.json', { cache: 'no-cache' }).then(data => {
|
|
ratings = data || {};
|
|
el.filterTriggers.severity.disabled = false;
|
|
if (state.ready && (state.query || hasActiveFilters())) render();
|
|
}).catch(err => console.warn(err.message));
|
|
|
|
loadJSON('/epss.json', { cache: 'no-cache' }).then(data => {
|
|
epss = data || {};
|
|
if (state.ready && (state.query || hasActiveFilters())) renderResults(null);
|
|
}).catch(err => console.warn(err.message));
|
|
|
|
loadJSON('/repo_meta.json', { cache: 'no-cache' }).then(data => {
|
|
repoMeta = data || {};
|
|
for (const entry of dataset) entry._ranked = null;
|
|
if (state.ready && (state.query || hasActiveFilters())) renderResults(null);
|
|
}).catch(err => console.warn(err.message));
|
|
|
|
try {
|
|
dataset = prepareDataset(await loadJSON('/CVE_list.json', { cache: 'no-cache' }));
|
|
state.ready = true;
|
|
el.filterTriggers.source.disabled = false;
|
|
render();
|
|
} catch (err) {
|
|
console.warn(err.message);
|
|
el.status.textContent = 'index unavailable';
|
|
}
|
|
})();
|