Dateien nach "sql" hochladen
This commit is contained in:
RonnyG committed
1 parent
dd3bd93c07
commit
e26c3340d6
1 file changed
+33
-186
+33
-186
@@ -1,248 +1,95 @@
|
||||
|
||||
PRAGMA foreign_keys = ON;
|
||||
|
||||
-- =========================================================
|
||||
-- Vulnerability SQLite Database
|
||||
-- Schema Version: 3
|
||||
-- =========================================================
|
||||
|
||||
-- =========================================================
|
||||
-- 1. METADATA
|
||||
-- =========================================================
|
||||
|
||||
-- New master schema, version 3. Not an in-place migration.
|
||||
CREATE TABLE IF NOT EXISTS meta (
|
||||
key TEXT PRIMARY KEY,
|
||||
key TEXT PRIMARY KEY,
|
||||
value TEXT NOT NULL
|
||||
);
|
||||
|
||||
INSERT INTO meta (key, value)
|
||||
VALUES ('schema_version', '3')
|
||||
ON CONFLICT(key) DO NOTHING;
|
||||
|
||||
|
||||
-- =========================================================
|
||||
-- 2. DATA SOURCES / LAST UPDATE / IMPORT STATUS
|
||||
-- =========================================================
|
||||
|
||||
CREATE TABLE IF NOT EXISTS sources (
|
||||
name TEXT PRIMARY KEY,
|
||||
|
||||
revision TEXT NOT NULL DEFAULT '',
|
||||
|
||||
indexed INTEGER NOT NULL DEFAULT 0
|
||||
CHECK (indexed IN (0, 1)),
|
||||
|
||||
documents INTEGER NOT NULL DEFAULT 0
|
||||
CHECK (documents >= 0),
|
||||
|
||||
indexed INTEGER NOT NULL DEFAULT 0 CHECK(indexed IN (0,1)),
|
||||
documents INTEGER NOT NULL DEFAULT 0 CHECK(documents >= 0),
|
||||
last_sync TEXT,
|
||||
last_import TEXT,
|
||||
|
||||
import_status TEXT NOT NULL DEFAULT 'pending'
|
||||
CHECK (
|
||||
import_status IN (
|
||||
'pending',
|
||||
'success',
|
||||
'unsupported',
|
||||
'failed'
|
||||
)
|
||||
),
|
||||
|
||||
import_errors INTEGER NOT NULL DEFAULT 0
|
||||
CHECK (import_errors >= 0)
|
||||
CHECK(import_status IN ('pending','success','unsupported','failed')),
|
||||
import_errors INTEGER NOT NULL DEFAULT 0 CHECK(import_errors >= 0)
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_sources_status
|
||||
ON sources(import_status);
|
||||
|
||||
|
||||
-- =========================================================
|
||||
-- 3. VULNERABILITIES
|
||||
-- =========================================================
|
||||
CREATE INDEX IF NOT EXISTS idx_sources_status ON sources(import_status);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS vulnerabilities (
|
||||
id TEXT PRIMARY KEY,
|
||||
|
||||
published TEXT,
|
||||
modified TEXT,
|
||||
|
||||
state TEXT,
|
||||
summary TEXT
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_vulnerabilities_modified
|
||||
ON vulnerabilities(modified);
|
||||
|
||||
|
||||
-- =========================================================
|
||||
-- 4. ALIASES
|
||||
-- =========================================================
|
||||
CREATE INDEX IF NOT EXISTS idx_vulnerabilities_modified ON vulnerabilities(modified);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS aliases (
|
||||
alias TEXT NOT NULL,
|
||||
|
||||
vulnerability_id TEXT NOT NULL
|
||||
REFERENCES vulnerabilities(id)
|
||||
ON DELETE CASCADE,
|
||||
|
||||
PRIMARY KEY (
|
||||
alias,
|
||||
vulnerability_id
|
||||
)
|
||||
vulnerability_id TEXT NOT NULL REFERENCES vulnerabilities(id) ON DELETE CASCADE,
|
||||
PRIMARY KEY(alias,vulnerability_id)
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_aliases_vuln
|
||||
ON aliases(vulnerability_id);
|
||||
|
||||
|
||||
-- =========================================================
|
||||
-- 5. AFFECTED PACKAGES (OSV)
|
||||
-- =========================================================
|
||||
CREATE INDEX IF NOT EXISTS idx_aliases_vuln ON aliases(vulnerability_id);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS affected_packages (
|
||||
id TEXT PRIMARY KEY,
|
||||
|
||||
vulnerability_id TEXT NOT NULL
|
||||
REFERENCES vulnerabilities(id)
|
||||
ON DELETE CASCADE,
|
||||
|
||||
vulnerability_id TEXT NOT NULL REFERENCES vulnerabilities(id) ON DELETE CASCADE,
|
||||
ecosystem TEXT,
|
||||
package_name TEXT,
|
||||
|
||||
ranges_json TEXT NOT NULL,
|
||||
versions_json TEXT NOT NULL,
|
||||
|
||||
source TEXT NOT NULL
|
||||
);
|
||||
CREATE INDEX IF NOT EXISTS idx_affected_vuln ON affected_packages(vulnerability_id);
|
||||
CREATE INDEX IF NOT EXISTS idx_affected_package ON affected_packages(ecosystem,package_name);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_affected_vuln
|
||||
ON affected_packages(vulnerability_id);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_affected_package
|
||||
ON affected_packages(ecosystem, package_name);
|
||||
|
||||
|
||||
-- =========================================================
|
||||
-- 6. CPE CONDITION TREES (NVD)
|
||||
-- =========================================================
|
||||
|
||||
-- NVD condition tree: match semantics are not flattened.
|
||||
CREATE TABLE IF NOT EXISTS cpe_nodes (
|
||||
id TEXT PRIMARY KEY,
|
||||
|
||||
vulnerability_id TEXT NOT NULL
|
||||
REFERENCES vulnerabilities(id)
|
||||
ON DELETE CASCADE,
|
||||
|
||||
parent_id TEXT
|
||||
REFERENCES cpe_nodes(id),
|
||||
|
||||
operator TEXT NOT NULL
|
||||
CHECK (operator IN ('AND', 'OR')),
|
||||
|
||||
negate INTEGER NOT NULL DEFAULT 0
|
||||
CHECK (negate IN (0, 1)),
|
||||
|
||||
vulnerability_id TEXT NOT NULL REFERENCES vulnerabilities(id) ON DELETE CASCADE,
|
||||
parent_id TEXT REFERENCES cpe_nodes(id) DEFERRABLE INITIALLY DEFERRED,
|
||||
operator TEXT NOT NULL CHECK(operator IN ('AND','OR')),
|
||||
negate INTEGER NOT NULL DEFAULT 0 CHECK(negate IN (0,1)),
|
||||
source TEXT NOT NULL
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_cpe_nodes_vuln
|
||||
ON cpe_nodes(vulnerability_id);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_cpe_nodes_parent
|
||||
ON cpe_nodes(parent_id);
|
||||
|
||||
|
||||
-- =========================================================
|
||||
-- 7. CPE MATCHES (NVD)
|
||||
-- =========================================================
|
||||
CREATE INDEX IF NOT EXISTS idx_cpe_nodes_vuln ON cpe_nodes(vulnerability_id);
|
||||
CREATE INDEX IF NOT EXISTS idx_cpe_nodes_parent ON cpe_nodes(parent_id);
|
||||
|
||||
CREATE TABLE IF NOT EXISTS cpe_matches (
|
||||
id TEXT PRIMARY KEY,
|
||||
|
||||
vulnerability_id TEXT NOT NULL
|
||||
REFERENCES vulnerabilities(id)
|
||||
ON DELETE CASCADE,
|
||||
|
||||
node_id TEXT
|
||||
REFERENCES cpe_nodes(id),
|
||||
|
||||
vulnerability_id TEXT NOT NULL REFERENCES vulnerabilities(id) ON DELETE CASCADE,
|
||||
node_id TEXT REFERENCES cpe_nodes(id) DEFERRABLE INITIALLY DEFERRED,
|
||||
criteria TEXT,
|
||||
|
||||
vulnerable INTEGER
|
||||
CHECK (vulnerable IN (0, 1)),
|
||||
|
||||
vulnerable INTEGER CHECK(vulnerable IN (0,1)),
|
||||
version_start_including TEXT,
|
||||
version_start_excluding TEXT,
|
||||
|
||||
version_end_including TEXT,
|
||||
version_end_excluding TEXT,
|
||||
|
||||
source TEXT NOT NULL
|
||||
);
|
||||
CREATE INDEX IF NOT EXISTS idx_cpe_vuln ON cpe_matches(vulnerability_id);
|
||||
CREATE INDEX IF NOT EXISTS idx_cpe_matches_node ON cpe_matches(node_id);
|
||||
CREATE INDEX IF NOT EXISTS idx_cpe_matches_criteria ON cpe_matches(criteria);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_cpe_vuln
|
||||
ON cpe_matches(vulnerability_id);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_cpe_matches_node
|
||||
ON cpe_matches(node_id);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_cpe_matches_criteria
|
||||
ON cpe_matches(criteria);
|
||||
|
||||
-- IMPORTANT:
|
||||
-- AND / OR / negate conditions must be evaluated as a tree.
|
||||
-- They must not be converted into independent vulnerability
|
||||
-- assertions, because that can produce false positives.
|
||||
|
||||
|
||||
-- =========================================================
|
||||
-- 8. RED HAT CSAF ADVISORIES
|
||||
-- =========================================================
|
||||
|
||||
-- Product IDs and remediation semantics stay intact.
|
||||
CREATE TABLE IF NOT EXISTS redhat_advisories (
|
||||
id TEXT PRIMARY KEY,
|
||||
|
||||
title TEXT,
|
||||
|
||||
initial_release_date TEXT,
|
||||
current_release_date TEXT,
|
||||
|
||||
product_tree_json TEXT NOT NULL
|
||||
);
|
||||
|
||||
|
||||
-- =========================================================
|
||||
-- 9. RED HAT CSAF CVE RELATIONSHIPS
|
||||
-- =========================================================
|
||||
|
||||
CREATE TABLE IF NOT EXISTS redhat_advisory_cves (
|
||||
id TEXT PRIMARY KEY,
|
||||
|
||||
advisory_id TEXT NOT NULL
|
||||
REFERENCES redhat_advisories(id)
|
||||
ON DELETE CASCADE,
|
||||
|
||||
cve_id TEXT NOT NULL
|
||||
REFERENCES vulnerabilities(id)
|
||||
ON DELETE CASCADE,
|
||||
|
||||
advisory_id TEXT NOT NULL REFERENCES redhat_advisories(id) ON DELETE CASCADE,
|
||||
cve_id TEXT NOT NULL REFERENCES vulnerabilities(id) ON DELETE CASCADE,
|
||||
product_status_json TEXT NOT NULL,
|
||||
remediations_json TEXT NOT NULL,
|
||||
|
||||
UNIQUE (
|
||||
advisory_id,
|
||||
cve_id
|
||||
)
|
||||
UNIQUE(advisory_id,cve_id)
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_redhat_advisory_cves_cve
|
||||
ON redhat_advisory_cves(cve_id);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_redhat_advisory_cves_advisory
|
||||
ON redhat_advisory_cves(advisory_id);
|
||||
|
||||
|
||||
-- =========================================================
|
||||
-- END OF SCHEMA VERSION 3
|
||||
-- =========================================================
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_redhat_advisory_cves_cve ON redhat_advisory_cves(cve_id);
|
||||
CREATE INDEX IF NOT EXISTS idx_redhat_advisory_cves_advisory ON redhat_advisory_cves(advisory_id);
|
||||
Reference in new issue
Block a user