PHP code example of mteu / advisory-assessor

    
        
<?php
require_once('vendor/autoload.php');

/* Start to develop here. Best regards https://php-download.com/ */

    

mteu / advisory-assessor example snippets

use mteu\AdvisoryAssessor\Matching\Finding;
use mteu\AdvisoryAssessor\Matching\AssessmentMatcher;
use mteu\AdvisoryAssessor\Assessment\Justification;
use mteu\AdvisoryAssessor\Assessment\Origin;
use mteu\AdvisoryAssessor\Assessment\Assessment;
use mteu\AdvisoryAssessor\Assessment\Status;
use mteu\AdvisoryMatcher\Advisory\AdvisoryFingerprint;
use mteu\AdvisoryMatcher\Source\PackageRef;

// $advisory: mteu\AdvisoryMatcher\Advisory\Advisory, from the matcher
// $clock: Psr\Clock\ClockInterface
$component = PackageRef::fromString('pkg:composer/symfony/[email protected]');

$assessment = new Assessment(
    identities: AdvisoryFingerprint::identitiesOf($advisory),
    component: $component,
    status: Status::NotAffected,
    reason: 'We never render fragments, so the vulnerable path is never called.',
    origin: Origin::user('42'),
    issuedAt: $clock->now(),
    justification: Justification::CodeNotReachable,
);

$resolution = (new AssessmentMatcher($clock))->resolve(new Finding($advisory, $component), [$assessment]);

if ($resolution->isHidden()) {
    printf("hidden by a %s assessment\n", $resolution->covering[0]->status->value);
}

use mteu\AdvisoryAssessor\CycloneDx\CycloneDxVexWriter;
use mteu\AdvisoryAssessor\CycloneDx\ExportScope;
use mteu\AdvisoryAssessor\Document\Author;
use mteu\AdvisoryAssessor\Document\VexDocumentMetadata;

// Keep the document ID for the life of the document. Raise the version and
// renew the issue time whenever its content changes.
$document = new VexDocumentMetadata(
    documentId: '3e671687-395b-41f5-a30f-a58921a69b79',
    version: 4,
    author: Author::organization('Acme Security Team'),
    issuedAt: $clock->now(),
);

// ExportScope::All also writes affected and under_investigation assessments.
// They list known, unfixed vulnerabilities, so think twice before using it.
$json = (new CycloneDxVexWriter())->write($assessments, ExportScope::ResolvedOnly, $document);

use mteu\AdvisoryAssessor\CycloneDx\CycloneDxVexReader;
use mteu\AdvisoryAssessor\CycloneDx\RejectedVexEntries;
use mteu\AdvisoryAssessor\CycloneDx\UnreadableVexDocument;
use mteu\AdvisoryAssessor\Assessment\Origin;
use mteu\SbomParser\Parser\CycloneDxParser;

$reader = new CycloneDxVexReader(new CycloneDxParser(), $clock);

try {
    // CycloneDX names neither who made an assessment nor when it expires, so you say.
    $reading = $reader->read($json, Origin::pipeline('acme/shop', $commit), new \DateInterval('P90D'));
} catch (UnreadableVexDocument) {
    // Not CycloneDX 1.4 to 1.7 JSON.
} catch (RejectedVexEntries $rejection) {
    foreach ($rejection->entries as $entry) {
        // $entry->index, $entry->vulnerabilityId, $entry->ref and $entry->reason.
        // The id and the ref come from the document: escape them.
    }
}

// $reading->assessments, and $reading->skippedEntries for the entries that claim nothing.