From d444c7a6ac48462adb3f34d899de4c37f7b57ac0 Mon Sep 17 00:00:00 2001
From: nscuro <nscuro@protonmail.com>
Date: Sun, 5 Nov 2023 18:54:16 +0100
Subject: [PATCH 1/3] Add UI elements to configure NVD mirroring via API

Signed-off-by: nscuro <nscuro@protonmail.com>
---
 .../vuln-sources/VulnSourceNvd.vue            | 85 ++++++++++++++++++-
 1 file changed, 83 insertions(+), 2 deletions(-)

diff --git a/src/views/administration/vuln-sources/VulnSourceNvd.vue b/src/views/administration/vuln-sources/VulnSourceNvd.vue
index 12f0cd4b3..e6353a50b 100644
--- a/src/views/administration/vuln-sources/VulnSourceNvd.vue
+++ b/src/views/administration/vuln-sources/VulnSourceNvd.vue
@@ -10,6 +10,7 @@
         v-bind="labelIcon"
       />
       {{$t('admin.vulnsource_nvd_enable')}}
+      <hr/>
       <b-validated-input-group-form-input
         id="nvd-feeds-url"
         :label="$t('admin.vulnsource_nvd_feeds_url')"
@@ -20,6 +21,55 @@
         lazy="true"
       />
       <hr/>
+      <c-switch
+        id="nvdApiEnabled"
+        color="primary"
+        v-model="nvdApiEnabled"
+        label
+        v-bind="labelIcon"
+      />
+      Enable API
+      <p class="font-sm text-muted">
+        <span class="fa fa-question-circle">&nbsp;</span>
+        <!-- TODO: Explain why users may want to enable API over feeds; Point out caveats (feed files no longer being downloaded etc.) -->
+        Foobarbaz
+      </p>
+      <b-validated-input-group-form-input
+        id="nvdApiEndpoint"
+        label="API endpoint"
+        input-group-size="mb-3"
+        v-model="nvdApiEndpoint"
+        lazy="true"
+      />
+      <b-validated-input-group-form-input
+        id="nvdApiKey"
+        label="API key"
+        input-group-size="mb-3"
+        type="password"
+        v-model="nvdApiKey"
+        lazy="true"
+      />
+      <b-form-group label="Last Modification">
+        <b-input-group>
+          <b-form-datepicker
+            id="nvdApiLastModifiedDate"
+            v-model="nvdApiLastModifiedDate"
+            :date-format-options="{ year: 'numeric', month: 'numeric', day: 'numeric' }"
+            locale="en-GB"
+          />
+          <b-form-timepicker
+            id="nvdApiLastModifiedTime"
+            v-model="nvdApiLastModifiedTime"
+            locale="en-GB"
+          />
+        </b-input-group>
+      </b-form-group>
+      <p class="font-sm text-muted">
+        <span class="fa fa-question-circle">&nbsp;</span>
+        <!-- TODO: Explain what the last modified datetime is used for and when users may want to modify it. -->
+        Foobarbaz
+      </p>
+      <hr/>
       {{ $t('admin.vulnsource_nvd_desc') }}
     </b-card-body>
     <b-card-footer>
@@ -37,6 +87,7 @@
 <script>
 import { Switch as cSwitch } from '@coreui/vue';
 import BValidatedInputGroupFormInput from '../../../forms/BValidatedInputGroupFormInput';
+import BInputGroupFormDatepicker from "../../../forms/BInputGroupFormDatepicker";
 import common from "../../../shared/common";
 import configPropertyMixin from "../mixins/configPropertyMixin";
 
@@ -47,12 +98,18 @@ export default {
   },
   components: {
     cSwitch,
-    BValidatedInputGroupFormInput
+    BValidatedInputGroupFormInput,
+    BInputGroupFormDatepicker
   },
   data() {
     return {
       vulnsourceEnabled: false,
       nvdFeedsUrl: '',
+      nvdApiEnabled: false,
+      nvdApiEndpoint: '',
+      nvdApiKey: '',
+      nvdApiLastModifiedDate: new Date().toISOString(),
+      nvdApiLastModifiedTime: '',
       labelIcon: {
         dataOn: '\u2713',
         dataOff: '\u2715'
@@ -63,8 +120,16 @@ export default {
     saveChanges: function() {
       this.updateConfigProperties([
         {groupName: 'vuln-source', propertyName: 'nvd.enabled', propertyValue: this.vulnsourceEnabled},
-        {groupName: 'vuln-source', propertyName: 'nvd.feeds.url', propertyValue: this.nvdFeedsUrl}
+        {groupName: 'vuln-source', propertyName: 'nvd.feeds.url', propertyValue: this.nvdFeedsUrl},
+        {groupName: 'vuln-source', propertyName: 'nvd.api.enabled', propertyValue: this.nvdApiEnabled},
+        {groupName: 'vuln-source', propertyName: 'nvd.api.url', propertyValue: this.nvdApiEndpoint},
+        {groupName: 'vuln-source', propertyName: 'nvd.api.key', propertyValue: this.nvdApiKey},
+        {groupName: 'vuln-source', propertyName: 'nvd.api.last.modified.epoch.seconds', propertyValue: this.getApiLastModifiedEpochSeconds()}
       ]);
+    },
+    getApiLastModifiedEpochSeconds() {
+      let lastModifiedDateTime = Date.parse(`${this.nvdApiLastModifiedDate}T${this.nvdApiLastModifiedTime}Z`);
+      return lastModifiedDateTime ? lastModifiedDateTime / 1000 : null;
     }
   },
   created () {
@@ -77,6 +142,22 @@ export default {
             this.vulnsourceEnabled = common.toBoolean(item.propertyValue); break;
           case "nvd.feeds.url":
             this.nvdFeedsUrl = item.propertyValue; break;
+          case "nvd.api.enabled":
+            this.nvdApiEnabled = common.toBoolean(item.propertyValue); break;
+          case "nvd.api.url":
+            this.nvdApiEndpoint = item.propertyValue; break;
+          case "nvd.api.key":
+            this.nvdApiKey = item.propertyValue; break;
+          case "nvd.api.last.modified.epoch.seconds":
+            let epochSeconds = parseInt(item.propertyValue);
+            if (!epochSeconds) {
+              continue;
+            }
+            let date = new Date(0);
+            date.setUTCSeconds(epochSeconds);
+            this.nvdApiLastModifiedDate = date.toISOString().split("T")[0]; // YYYY-MM-DD
+            this.nvdApiLastModifiedTime = date.toLocaleTimeString("en-GB"); // HH:mm:SS
+            break;
         }
       }
     });

From b24689061fdafca72c633df3b17bde74f9f53cb3 Mon Sep 17 00:00:00 2001
From: nscuro <nscuro@protonmail.com>
Date: Mon, 13 Nov 2023 02:32:41 +0100
Subject: [PATCH 2/3] Add i18n; Add help texts and links to NVD resources

Signed-off-by: nscuro <nscuro@protonmail.com>
---
 src/i18n/locales/en.json                      |  6 +++
 .../vuln-sources/VulnSourceNvd.vue            | 41 ++++++++++++++-----
 2 files changed, 37 insertions(+), 10 deletions(-)

diff --git a/src/i18n/locales/en.json b/src/i18n/locales/en.json
index 9c9b606e3..a83314116 100644
--- a/src/i18n/locales/en.json
+++ b/src/i18n/locales/en.json
@@ -539,6 +539,12 @@
     "snyk": "Snyk (Beta)",
     "vuln_sources": "Vulnerability Sources",
     "nvd": "NVD",
+    "nvd_enable_mirroring_via_api": "Enable mirroring via API",
+    "nvd_why_enable_api_help": "Why should I enable API mirroring?",
+    "nvd_request_api_key_help": "How do I get an API key?",
+    "nvd_api_last_modification": "Last Modification (UTC)",
+    "nvd_api_last_modification_help": "After mirroring the NVD database once completely, all following mirror operations will only request data that was modified since its last successful execution.",
+    "nvd_api_last_modification_warning": "Changing the last modification datetime manually is generally not recommended, but may be used to force re-ingestion of NVD data. Note that due to a limitation in the NVD's REST API, only data for 120 consecutive days can be requested when a last modification datetime is configured. Resetting the last modification datetime will cause the entire NVD database to be re-mirrored.",
     "national_vulnerability_database": "National Vulnerability Database",
     "github_advisories": "GitHub Advisories",
     "osv_advisories": "Google OSV Advisories (Beta)",
diff --git a/src/views/administration/vuln-sources/VulnSourceNvd.vue b/src/views/administration/vuln-sources/VulnSourceNvd.vue
index e6353a50b..dfbcbae98 100644
--- a/src/views/administration/vuln-sources/VulnSourceNvd.vue
+++ b/src/views/administration/vuln-sources/VulnSourceNvd.vue
@@ -11,6 +11,8 @@
       />
       {{$t('admin.vulnsource_nvd_enable')}}
       <hr/>
+      {{ $t('admin.vulnsource_nvd_desc') }}
+      <hr/>
       <b-validated-input-group-form-input
         id="nvd-feeds-url"
         :label="$t('admin.vulnsource_nvd_feeds_url')"
@@ -28,11 +30,10 @@
         label
         v-bind="labelIcon"
       />
-      Enable API
+      {{ $t('admin.nvd_enable_mirroring_via_api') }}
       <p class="font-sm text-muted">
         <span class="fa fa-question-circle">&nbsp;</span>
-        <!-- TODO: Explain why users may want to enable API over feeds; Point out caveats (feed files no longer being downloaded etc.) -->
-        Foobarbaz
+        <a :href="nvdApiWhyEnableUrl" target="_blank">{{ $t('admin.nvd_why_enable_api_help') }}</a>
       </p>
       <b-validated-input-group-form-input
         id="nvdApiEndpoint"
@@ -49,28 +50,38 @@
         v-model="nvdApiKey"
         lazy="true"
       />
-      <b-form-group label="Last Modification">
+      <p class="font-sm text-muted">
+        <span class="fa fa-question-circle">&nbsp;</span>
+        <a :href="nvdApiRequestApiKeyUrl" target="_blank">{{ $t('admin.nvd_request_api_key_help') }}</a>
+      </p>
+      <b-form-group :label="$t('admin.nvd_api_last_modification')">
         <b-input-group>
           <b-form-datepicker
             id="nvdApiLastModifiedDate"
             v-model="nvdApiLastModifiedDate"
             :date-format-options="{ year: 'numeric', month: 'numeric', day: 'numeric' }"
+            :min="nvdApiLastModifiedDateMin"
+            :max="nvdApiLastModifiedDateMax"
             locale="en-GB"
+            :reset-button="true"
+            :show-decade-nav="true"
           />
           <b-form-timepicker
             id="nvdApiLastModifiedTime"
             v-model="nvdApiLastModifiedTime"
             locale="en-GB"
+            :reset-button="true"
           />
         </b-input-group>
       </b-form-group>
       <p class="font-sm text-muted">
         <span class="fa fa-question-circle">&nbsp;</span>
-        <!-- TODO: Explain what the last modified datetime is used for and when users may want to modify it. -->
-        Foobarbaz
+        {{ $t('admin.nvd_api_last_modification_help') }}
+      </p>
+      <p class="font-sm text-muted">
+        <span class="fa fa-warning">&nbsp;</span>
+        {{ $t('admin.nvd_api_last_modification_warning') }}
       </p>
-      <hr/>
-      {{ $t('admin.vulnsource_nvd_desc') }}
     </b-card-body>
     <b-card-footer>
       <b-button
@@ -108,8 +119,12 @@ export default {
       nvdApiEnabled: false,
       nvdApiEndpoint: '',
       nvdApiKey: '',
-      nvdApiLastModifiedDate: new Date().toISOString(),
+      nvdApiLastModifiedDate: '',
+      nvdApiLastModifiedDateMin: new Date(1999, 1, 1),
+      nvdApiLastModifiedDateMax: new Date(new Date().getFullYear(), new Date().getMonth(), new Date().getDate()),
       nvdApiLastModifiedTime: '',
+      nvdApiWhyEnableUrl: 'https://nvd.nist.gov/General/News/change-timeline',
+      nvdApiRequestApiKeyUrl: 'https://nvd.nist.gov/developers/request-an-api-key',
       labelIcon: {
         dataOn: '\u2713',
         dataOff: '\u2715'
@@ -128,8 +143,14 @@ export default {
       ]);
     },
     getApiLastModifiedEpochSeconds() {
+      if (!this.nvdApiLastModifiedDate) {
+        return 0;
+      } else if (!this.nvdApiLastModifiedTime) {
+        let lastModifiedDateTime = Date.parse(this.nvdApiLastModifiedDate);
+        return lastModifiedDateTime ? lastModifiedDateTime / 1000 : 0;
+      }
       let lastModifiedDateTime = Date.parse(`${this.nvdApiLastModifiedDate}T${this.nvdApiLastModifiedTime}Z`);
-      return lastModifiedDateTime ? lastModifiedDateTime / 1000 : null;
+      return lastModifiedDateTime ? lastModifiedDateTime / 1000 : 0;
     }
   },
   created () {

From 8b75a750dd58a856e669b896cc91d33a073ec4ec Mon Sep 17 00:00:00 2001
From: nscuro <nscuro@protonmail.com>
Date: Mon, 13 Nov 2023 18:22:55 +0100
Subject: [PATCH 3/3] Fix last modification time conversion issues; Support
 additional download of feeds

Signed-off-by: nscuro <nscuro@protonmail.com>
---
 src/i18n/locales/en.json                      |  2 ++
 .../vuln-sources/VulnSourceNvd.vue            | 21 +++++++++++++++++--
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/src/i18n/locales/en.json b/src/i18n/locales/en.json
index a83314116..9f2a17278 100644
--- a/src/i18n/locales/en.json
+++ b/src/i18n/locales/en.json
@@ -541,6 +541,8 @@
     "nvd": "NVD",
     "nvd_enable_mirroring_via_api": "Enable mirroring via API",
     "nvd_why_enable_api_help": "Why should I enable API mirroring?",
+    "nvd_additionally_download_feeds": "Additionally download feeds",
+    "nvd_additionally_download_feeds_help": "Feeds will not be parsed, but made available to other clients at",
     "nvd_request_api_key_help": "How do I get an API key?",
     "nvd_api_last_modification": "Last Modification (UTC)",
     "nvd_api_last_modification_help": "After mirroring the NVD database once completely, all following mirror operations will only request data that was modified since its last successful execution.",
diff --git a/src/views/administration/vuln-sources/VulnSourceNvd.vue b/src/views/administration/vuln-sources/VulnSourceNvd.vue
index dfbcbae98..48d872f34 100644
--- a/src/views/administration/vuln-sources/VulnSourceNvd.vue
+++ b/src/views/administration/vuln-sources/VulnSourceNvd.vue
@@ -35,6 +35,19 @@
         <span class="fa fa-question-circle">&nbsp;</span>
         <a :href="nvdApiWhyEnableUrl" target="_blank">{{ $t('admin.nvd_why_enable_api_help') }}</a>
       </p>
+      <c-switch
+        :disabled="!this.nvdApiEnabled"
+        id="nvdApiDownloadFeeds"
+        color="primary"
+        v-model="nvdApiDownloadFeeds"
+        label
+        v-bind="labelIcon"
+      />
+      {{ $t('admin.nvd_additionally_download_feeds') }}
+      <p class="font-sm text-muted">
+        <span class="fa fa-question-circle">&nbsp;</span>
+        {{ $t('admin.nvd_additionally_download_feeds_help') }} <code>/mirror/nvd</code>
+      </p>
       <b-validated-input-group-form-input
         id="nvdApiEndpoint"
         label="API endpoint"
@@ -117,6 +130,7 @@ export default {
       vulnsourceEnabled: false,
       nvdFeedsUrl: '',
       nvdApiEnabled: false,
+      nvdApiDownloadFeeds: false,
       nvdApiEndpoint: '',
       nvdApiKey: '',
       nvdApiLastModifiedDate: '',
@@ -137,6 +151,7 @@ export default {
         {groupName: 'vuln-source', propertyName: 'nvd.enabled', propertyValue: this.vulnsourceEnabled},
         {groupName: 'vuln-source', propertyName: 'nvd.feeds.url', propertyValue: this.nvdFeedsUrl},
         {groupName: 'vuln-source', propertyName: 'nvd.api.enabled', propertyValue: this.nvdApiEnabled},
+        {groupName: 'vuln-source', propertyName: 'nvd.api.download.feeds', propertyValue: this.nvdApiDownloadFeeds},
         {groupName: 'vuln-source', propertyName: 'nvd.api.url', propertyValue: this.nvdApiEndpoint},
         {groupName: 'vuln-source', propertyName: 'nvd.api.key', propertyValue: this.nvdApiKey},
         {groupName: 'vuln-source', propertyName: 'nvd.api.last.modified.epoch.seconds', propertyValue: this.getApiLastModifiedEpochSeconds()}
@@ -146,7 +161,7 @@ export default {
       if (!this.nvdApiLastModifiedDate) {
         return 0;
       } else if (!this.nvdApiLastModifiedTime) {
-        let lastModifiedDateTime = Date.parse(this.nvdApiLastModifiedDate);
+        let lastModifiedDateTime = Date.parse(`${this.nvdApiLastModifiedDate}T00:00:00Z`);
         return lastModifiedDateTime ? lastModifiedDateTime / 1000 : 0;
       }
       let lastModifiedDateTime = Date.parse(`${this.nvdApiLastModifiedDate}T${this.nvdApiLastModifiedTime}Z`);
@@ -165,6 +180,8 @@ export default {
             this.nvdFeedsUrl = item.propertyValue; break;
           case "nvd.api.enabled":
             this.nvdApiEnabled = common.toBoolean(item.propertyValue); break;
+          case "nvd.api.download.feeds":
+            this.nvdApiDownloadFeeds = common.toBoolean(item.propertyValue); break;
           case "nvd.api.url":
             this.nvdApiEndpoint = item.propertyValue; break;
           case "nvd.api.key":
@@ -177,7 +194,7 @@ export default {
             let date = new Date(0);
             date.setUTCSeconds(epochSeconds);
             this.nvdApiLastModifiedDate = date.toISOString().split("T")[0]; // YYYY-MM-DD
-            this.nvdApiLastModifiedTime = date.toLocaleTimeString("en-GB"); // HH:mm:SS
+            this.nvdApiLastModifiedTime = date.toISOString().split("T")[1].split(".")[0]; // HH:mm:SS
             break;
         }
       }