cisagov / crossfeed

External monitoring for organization assets
https://docs.crossfeed.cyber.dhs.gov
Creative Commons Zero v1.0 Universal
370 stars 54 forks source link

2521 Refactor CVE and Product Info Tables #2526

Closed Matthew-Grayson closed 7 months ago

Matthew-Grayson commented 7 months ago

πŸ—£ Description

πŸ’­ Motivation and context

We recently added two tables, cve and product_info. The column names follow a different naming convention than the rest of the codebase. For one thing they use snake case instead of camel case. This makes our API inconsistent and adds confusion to frontend development.

I renamed the product_info table to cpe so that references to entries are more informative: cpe = single entry and cpes is a collection of entries. This isn't the case now with product_info being used as both singular and plural.

I also removed the cpe_list column since there is already a join table between cves and cpes coded into the db model.

Closes issue #2534 Closes issue #2521

πŸ§ͺ Testing

Modified tests for API functionality. Manually tested Vulnerability Details page.

βœ… Pre-approval checklist

βœ… Pre-merge checklist

βœ… Post-merge checklist

Matthew-Grayson commented 7 months ago

PR currently includes commits from #2352. I will mark this ready for review once #2352 is merged.

Matthew-Grayson commented 7 months ago

This is difficult to test due to issues calling the PE API today. Let's prioritize adding the new tables to the syncdb populate method to assist local development.

Matthew-Grayson commented 7 months ago

I've updated syncdb's populate method to include the cve and cpe tables to assist local development. To this PR's changes:

  1. Run npm run syncdb -- -d dangerouslypopulate
  2. Run npm run syncdb
  3. Run npm run syncdb -- -d populate
  4. Confirm that vulnerability details page populates data properly
  5. Confirm that all tests pass