Refactored parsing for nuclei to allow for multiple cwe/cve ids

Ilyesbdlala · Ilyesbdlala · commit f89446bbb8d1 · 2023-04-18T13:57:24.000+02:00
also made timestamp and references immutable

Signed-off-by: Ilyes Ben Dlala &lt;ilyes.bendlala@iteratec.com&gt;
diff --git a/scanners/nuclei/parser/parser.js b/scanners/nuclei/parser/parser.js
@@ -12,50 +12,43 @@ async function parse(fileContent) {
 
   return jsonResult.map((finding) => {
     const hostname = parseHostname(finding.host);
-    let timestamp;
-    let references = [];
-    finding.info?.reference?.forEach(element => {
-      references.push(
-        {
-          "type": "URL",
-          "value": element
-        }
-      );
-    });
-
-    const cweId = finding?.info?.classification?.["cwe-id"]?.[0] ?? null; 
-    if(cweId !== null) {
-      references.push(
-          {
-            "type": "CWE",
-            "value": cweId.toUpperCase()
-          },
-          {
-            "type": "URL",
-            "value": `https://cwe.mitre.org/data/definitions/${cweId}.html`
-          }
-      );
-    }
-
-    const cveId = finding?.info?.classification?.["cve-id"]?.[0] ?? null;
-    if(cveId !== null) {
-      references.push(
-        {
-          "type": "CVE",
-          "value": cveId.toUpperCase()
-        },
-
-        {
-          "type": "URL",
-          "value": `https://nvd.nist.gov/vuln/detail/${cveId}`
-        }
-      );
-    }
-
-
-    if (finding.timestamp) {
-        timestamp = new Date(finding.timestamp).toISOString();
-    }
+   // Add reference URLs to the references array
+    const urlReferences = finding.info.reference ? finding.info.reference.flatMap(url => ({
+      type: "URL",
+      value: url
+    })) : [];
+
+    // Add CWE reference to the references array
+    const cweIds = finding?.info?.classification?.["cwe-id"] ?? [];
+    const cweReferences = cweIds.flatMap(cweId => [
+      {
+        type: "CWE",
+        value: cweId.toUpperCase()
+      },
+      {
+        type: "URL",
+        value: `https://cwe.mitre.org/data/definitions/${cweId}.html`
+      }
+    ]);
+    
+    // Add CVE reference to the references array
+    const cveIds = finding?.info?.classification?.["cve-id"] ?? [];
+    const cveReferences = cveIds.flatMap(cveId => [
+      {
+        type: "CVE",
+        value: cveId.toUpperCase()
+      },
+      {
+        type: "URL",
+        value: `https://nvd.nist.gov/vuln/detail/${cveId}`
+      }
+    ]);
+  
+      
+  
+    const references = [...urlReferences, ...cweReferences, ...cveReferences];
+
+    const timestamp = finding.timestamp ? new Date(finding.timestamp).toISOString() : null;
 
     return {
       name: finding.info.name,
