0

Hi so I have a curl command for checking some data on an api, then using jq to parse the data for only relevant information.

The issue is some of the data contains a certain class known as .result.CVE_Items[].configurations.nodes[].children[] but others do not have it. So I am trying to write an if, elif and else statement that will parse the data. I am trying to figure out how to place an elif statement to check if this class is present .result.CVE_Items[].configurations.nodes[].children[] and if it is present for it to query the data.

Below are the two commands where one contains the class and the other one doesn't contain the class and brings an error:


# First command works: has the class 

curl -s https://services.nvd.nist.gov/rest/json/cve/1.0/CVE-2020-12389 | jq -r 'if .totalResults == 1 then . | {CVE: .result.CVE_Items[].cve.CVE_data_meta.ID, Description: .result.CVE_Items[].cve.description.description_data[].value, "CVSS V3 Score": .result.CVE_Items[].impact.baseMetricV3.cvssV3.baseSeverity, "Attack Vector": .result.CVE_Items[].impact.baseMetricV3.cvssV3.attackVector, "Privileges Required": .result.CVE_Items[].impact.baseMetricV3.cvssV3.privilegesRequired, "User Interaction": .result.CVE_Items[].impact.baseMetricV3.cvssV3.userInteraction, "Impact Score": .result.CVE_Items[].impact.baseMetricV3.impactScore, "Products Affected": [.result.CVE_Items[].configurations.nodes[].children[].cpe_match[].cpe23Uri]} else . | {Results: .message} end'

Output:

{
  "CVE": "CVE-2020-12389",
  "Description": "The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.",
  "CVSS V3 Score": "CRITICAL",
  "Attack Vector": "NETWORK",
  "Privileges Required": "NONE",
  "User Interaction": "NONE",
  "Impact Score": 6,
  "Products Affected": [
    "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
    "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*",
    "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*"
  ]
}



# Second command as the above but different data output and doesn't contain the class hence errors out.

curl -s https://services.nvd.nist.gov/rest/json/cve/1.0/CVE-2020-0796 | jq -r 'if .totalResults == 1 then . | {CVE: .result.CVE_Items[].cve.CVE_data_meta.ID, Description: .result.CVE_Items[].cve.description.description_data[].value, "CVSS V3 Score": .result.CVE_Items[].impact.baseMetricV3.cvssV3.baseSeverity, "Attack Vector": .result.CVE_Items[].impact.baseMetricV3.cvssV3.attackVector, "Privileges Required": .result.CVE_Items[].impact.baseMetricV3.cvssV3.privilegesRequired, "User Interaction": .result.CVE_Items[].impact.baseMetricV3.cvssV3.userInteraction, "Impact Score": .result.CVE_Items[].impact.baseMetricV3.impactScore, "Products Affected": [.result.CVE_Items[].configurations.nodes[].children[].cpe_match[].cpe23Uri]} else . | {Results: .message} end'

Output:

jq: error (at <stdin>:0): Cannot iterate over null (null)

# Error is mainly at the Products affected .... when you remove .children[] it works


curl -s https://services.nvd.nist.gov/rest/json/cve/1.0/CVE-2020-0796 | jq -r 'if .totalResults == 1 then . | {CVE: .result.CVE_Items[].cve.CVE_data_meta.ID, Description: .result.CVE_Items[].cve.description.description_data[].value, "CVSS V3 Score": .result.CVE_Items[].impact.baseMetricV3.cvssV3.baseSeverity, "Attack Vector": .result.CVE_Items[].impact.baseMetricV3.cvssV3.attackVector, "Privileges Required": .result.CVE_Items[].impact.baseMetricV3.cvssV3.privilegesRequired, "User Interaction": .result.CVE_Items[].impact.baseMetricV3.cvssV3.userInteraction, "Impact Score": .result.CVE_Items[].impact.baseMetricV3.impactScore, "Products Affected": [.result.CVE_Items[].configurations.nodes[].cpe_match[].cpe23Uri]} else . | {Results: .message} end'

Output:

{
  "CVE": "CVE-2020-0796",
  "Description": "A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.",
  "CVSS V3 Score": "CRITICAL",
  "Attack Vector": "NETWORK",
  "Privileges Required": "NONE",
  "User Interaction": "NONE",
  "Impact Score": 6,
  "Products Affected": [
    "cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*",
    "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*",
    "cpe:2.3:o:microsoft:windows_server_2016:1903:*:*:*:*:*:*:*",
    "cpe:2.3:o:microsoft:windows_server_2016:1909:*:*:*:*:*:*:*"
  ]
}


I have tried has("children") and has("children[]") but nothing has worked and I really don't have a clue, I have checked all the github issues raised for checking an element before parsing and also did a search on stackoverflow. I have also checked the docs. I would love it to be in one command where it first check if totalResults == 1 and has(children) == false to query the information elif totalResults == 1 and has(children) == true to query the information else to print out the error message which means the data is not available.

Kindly assist

thanks.

\n00b

4
  • Post the JSON you have and an exact output needed
    – Inian
    Commented Nov 4, 2020 at 5:50
  • Could you try out the command that works and the one that doesn't work so that you can understand what I am saying. Because I have explained exactly what the problem is
    – n00b
    Commented Nov 4, 2020 at 5:57
  • 1
    Please have a look at stackoverflow.com/help/minimal-reproducible-example. Authors of the question are expected post a minimal reproducible example of the problem they are dealing with and not leave it open for answerers to determine it.
    – Inian
    Commented Nov 4, 2020 at 6:01
  • I have added the outputs, you see the error I am facing is that I don't know how to place the elif to check for the array that is present in some data. The output I require is just as above. I just need to know how to do an elif to check for the class.
    – n00b
    Commented Nov 4, 2020 at 6:04

2 Answers 2

1

So @peak gave me some ideas on how to solve this... this code solves it.

curl -s https://services.nvd.nist.gov/rest/json/cve/1.0/CVE-2020-11066 
| jq -r 'if .totalResults == 1 then .result.CVE_Items[] 
| .cve.CVE_data_meta.ID as $ID 
| .cve.description.description_data[].value as $value 
| .configurations.nodes[] as $node 
| if $node | (type == "object" and has("children")) 
then .impact.baseMetricV3 | 
{CVE: $ID, Description: $value, 
"CVSS V3 Score": .cvssV3.baseSeverity, 
"Attack Vector": .cvssV3.attackVector, 
"Privileges Required": .cvssV3.privilegesRequired, 
"User Interaction": .cvssV3.userInteraction, 
"Impact Score": .impactScore, 
"Products Affected": [$node.children[].cpe_match[].cpe23Uri]} 
else .impact.baseMetricV3 | 
{CVE: $ID, Description: $value, 
"CVSS V3 Score": .cvssV3.baseSeverity, 
"Attack Vector": .cvssV3.attackVector, 
"Privileges Required": .cvssV3.privilegesRequired, 
"User Interaction": .cvssV3.userInteraction, 
"Impact Score": .impactScore, 
"Products Affected": [$node.cpe_match[].cpe23Uri]} 
end else . | {Results: .message} end'

So basically if you follow the above answer, @peak showed us how to place an if statement to check if the object class children is present inside an if statement. The else statement fixes our issue and we are good to go.

0

A glib answer would be to say to use the following if/then/else structure:

if .result.CVE_Items[].configurations.nodes[] | has("children")
then ...
else ...
end

But what is to say that each of the arrays has length equal to 1? Or that the item in the nodes array is a JSON object?

So perhaps it would be better to write something like:

.result.CVE_Items[0].configurations.nodes[0] as $node
| if ($node | ( type == "object" and has("children") ))
  then ...
  else ...
  end

But the same problem exists with the rest of your query, which runs the risk not only of generating an error, but also of generating an unwanted combinatorial explosion.

So what you should probably do is introduce jq variables along the way to ensure that you are only selecting as many items as you really want, as illustrated in the following section.

On a minor note: instead of (. | E) you can simply write E.

Example

    if .totalResults == 1 
    then .result.CVE_Items[] 
    | .cve.CVE_data_meta.ID as $ID
    | .cve.description.description_data[].value as $value
    | .configurations.nodes[] as $node
    | if $node | (type == "object" and has("children"))
      then .impact.baseMetricV3
      |  {CVE: $ID,
          Description: $value, 
          "CVSS V3 Score":  .cvssV3.baseSeverity,
          "Attack Vector":  .cvssV3.attackVector,
          "Privileges Required": .cvssV3.privilegesRequired,
          "User Interaction": .cvssV3.userInteraction,
          "Impact Score": .impactScore,
          "Products Affected": [$node.children[].cpe_match[].cpe23Uri]}
      else {Results: .message} 
      end
    else {Results: .message} 
    end

5
  • Hey this doesn't work, but I like the idea, but it seems like the two else are confusing ... could you try it out then tell me.
    – n00b
    Commented Nov 4, 2020 at 7:56
  • can't I use this as the elif ?? if .result.CVE_Items[].configurations.nodes[] | has("children") then ... else ... end
    – n00b
    Commented Nov 4, 2020 at 7:57
  • (1) I've double checked the jq program using both the curl commands in the Q, so it doesn't help to say it doesn't work. (2) The jq program listed in the Example section is just an example. You could easily adapt it to your needs. (3) If the fragile approach is adequate for your current needs, then good luck using it!
    – peak
    Commented Nov 4, 2020 at 8:07
  • Thanks let me give it a try and see how I can hack this to my needs ...
    – n00b
    Commented Nov 4, 2020 at 8:10
  • I got it to work with your assistance.. posting the answer below.... :smile:
    – n00b
    Commented Nov 4, 2020 at 8:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.