#!/usr/bin/env python3
"""Takes JSON output and creates a vulnerability roundup issue.

Feed the output of `vulnix --json` into this script to create the issue
description.
"""

import urllib.parse
import argparse
import json
import sys


def whitelist(pkgs, ignore):
    res = []
    for pkg in pkgs:
        affected_by = [cve for cve in pkg['affected_by'] if cve not in ignore]
        pkg['affected_by'] = affected_by
        if len(affected_by):
            res.append(pkg)
    return res


def parse(json_file):
    if json_file:
        return json.load(json_file)
    return json.load(sys.stdin)


def fmt(pkgs):
    for pkg in sorted(pkgs, key=lambda p: p['name']):
        name = pkg['name']
        quotedname = urllib.parse.quote_plus(pkg['pname'])
        search = 'https://search.nix.gsc.io/?q={}&i=fosho&repos=nixos-nixpkgs'.\
            format(quotedname)
        files = 'https://github.com/NixOS/nixpkgs/search?utf8=%E2%9C%93&q={}+in%3Apath&type=Code'.\
            format(quotedname)
        print("### {name} ([search]({search}), [files]({files}))".\
              format(name=name, search=search, files=files))
        cves = ("[{}]({})".format(
            cve, "https://web.nvd.nist.gov/view/vuln/detail?vulnId="+cve)
            for cve in sorted(pkg['affected_by']))
        for cve in cves:
            print(' - [ ] {}'.format(cve))
        print()

def main():
    a = argparse.ArgumentParser(description=__doc__)
    a.add_argument('VULNIX_JSON', nargs='?', type=argparse.FileType('r'),
                   help='vulnix json output (file or "-")')
    a.add_argument('-i', '--ignore', type=argparse.FileType('r'),
                   help='List of CVEs to ignore (one per line)')
    a.add_argument('-g', '--git-id', default='HEAD',
                   help='nixpkgs commit used for scanning')
    args = a.parse_args()
    if args.ignore:
        ignore = set(args.ignore.read().split())
    else:
        ignore = set()
    print('Scanned nixos/release-combined.nix @ {id}. Filtered out '
          'previously reported CVEs. May contain false positives.\n'.
          format(id=args.git_id[:7]))
    fmt(whitelist(parse(args.VULNIX_JSON), ignore))
    print("""\
Cc: @joepie91, @phanimahesh, @the-kenny, @7c6f434c, @k0001, @peterhoeg, @nh2, @LnL7, @grahamc, @adisbladis, @fpletz

Contact @ckauhaus for any questions.
""")


if __name__ == '__main__':
    main()
