get_capec/

lib.rs

use crate::CapecDisplayType::{
    All, Alternates, Attacks, Consequences, Description, Flow, Indicators, Instances, Likelihood,
    Mitigations, Name, Prerequisites, Resources, Severity, Skills, Taxonomy, Weaknesses,
};
use fenir::capec::{extract_mitre_attack_ids, CapecRecord};
use fenir::cve::cve_from_cwe;
use fenir::cwe::show_weaknesses;
use fenir::database::{
    criteria_analysis, db_mitre_path, execute_query, find_capec_by_id, find_cwe_by_id,
    find_domain_and_criteria, parse_id_to_u32, prepare_query, search, text_or_null, MitreDatabase,
};
use fenir::facilities::{
    configure_csv_reader, hierarchical_show, ProgressText, Standardize, Transform, Uppercase,
};
use fenir::package::{
    concepts::simplify_cve_list_content,
    errors::{write_error_message, write_error_message_and_exit},
};
use fenir::query::{build_query, QueryType::ByCwe};
use fenir::section;
use termint::widgets::ToSpan;
use termint::{enums::Color};
use treelog::builder::TreeBuilder;
use treelog::Tree;

use csv::Reader;

use fenir::db_mitre;
use fenir::os::parse_id;
use rusqlite::{params, Connection, Rows};
use std::error::Error;
use std::fs::File;
use std::path::Path;

fn parse_to_id_format(elements: String, criteria: &str) -> String {
    let mut result = String::new();
    let prefix = criteria.split(" ").collect::<Vec<&str>>()[0];

    let mut previous = 0;
    elements.match_indices(criteria).for_each(|part| {
        let start_at = part.0 + criteria.len();
        result.push_str(&elements[previous..start_at]);
        let next = &elements[start_at..];
        let next_separator = next.find(':').unwrap();
        let str_id = &next[0..next_separator];
        let tmp_id = parse_id(
            format!("{}-{}", prefix.to_lowercase(), str_id).as_str(),
            prefix.to_lowercase().as_str(),
        );
        if let Some(id) = tmp_id {
            let opt_capec = find_capec_by_id(id);
            if let Some(capec) = opt_capec {
                result
                    .push_str(format!("{}-{} - {}", prefix, str_id, capec.name.as_str()).as_str());
            }
        }

        previous = start_at + next_separator;
    });
    
    result
}

/// Injects data from a CSV file into the CAPEC table in the specified SQLite database.
///
/// This function performs the following steps:
/// 1. Opens a connection to the specified SQLite database.
/// 2. Initializes the CAPEC table in the database by calling `initialize_capec_table`.
/// 3. Configures and opens the CSV file for reading using `configure_csv_reader`.
/// 4. Reads the data from the CSV file and inserts it into the CAPEC table by calling `inject_capec_data`.
///
/// # Arguments
///
/// * `csv_file` - A string slice that holds the file path of the CSV file containing the CAPEC data.
///
/// # Returns
///
/// * `Result<(), Box<dyn Error>>` - Returns `Ok(())` if the operation is successful, or an error wrapped in a `Box` if failed.
///
/// # Errors
///
/// * This function returns an error if connecting to the SQLite database fails.
/// * It returns an error if reading from the CSV file fails.
/// * It can also return an error if inserting data into the SQLite database fails.
///
/// # Example
///
///
/// `inject_csv_into_capec_table(Path::new("path/to/capec.csv")).unwrap();`
///
pub fn inject_csv_into_capec_table(csv_file: &Path) -> Result<(), Box<dyn Error>> {
    // Open the CSV file and read its content
    let mut reader = configure_csv_reader(csv_file)?;

    let file_name = csv_file.file_name().unwrap().to_str().unwrap();
    inject_capec_data(&mut reader, file_name)
}

/// Injects CAPEC data from a CSV file into an SQLite database.
///
/// # Arguments
///
/// * `reader` - A mutable reference to a CSV reader that provides access to CSV records.
///
/// # Returns
///
/// This function returns a `Result` with an empty tuple on success, or a boxed `dyn Error` trait object on failure.
///
/// # Errors
///
/// Returns an error if there is any issue with reading the CSV records or executing the SQL insert commands.
fn inject_capec_data(reader: &mut Reader<File>, file: &str) -> Result<(), Box<dyn Error>> {
    let records = reader.records().collect::<Result<Vec<_>, _>>()?;
    let mut progress_bar = ProgressText::new(1, records.len(), file.to_string());

    let connection = db_mitre!()?;
    for record in records {
        progress_bar.progress();

        let _ = connection.execute("INSERT INTO capec (id, name, abstraction, status, description, alternates, likelihood, severity, attacks, flow, prerequisites, skills, resources, indicators, consequences, mitigations, instances, weaknesses, taxonomy)
        VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13, ?14, ?15, ?16, ?17, ?18, ?19)", params![record[0].parse::<i64>()?, record[1].to_string(), record[2].to_string(), record[3].to_string(), record[4].to_string(),
            text_or_null(record[5].to_string()), text_or_null(record[6].to_string()), text_or_null(record[7].to_string()), text_or_null(record[8].to_string()), text_or_null(record[9].to_string()), text_or_null(record[10].to_string()), text_or_null(record[11].to_string()), text_or_null(record[12].to_string()), text_or_null(record[13].to_string()), text_or_null(record[14].to_string()),
            text_or_null(record[15].to_string()), text_or_null(record[16].to_string()), text_or_null(record[17].to_string()), text_or_null(record[18].to_string())]);
    }

    println!("\nCAPEC data injected into SQLite database successfully.");
    Ok(())
}

pub struct CapecTable;

impl MitreDatabase for CapecTable {
    fn table_definitions(&self) -> Vec<(&'static str, &'static str)> {
        vec![(
            "capec",
            "CREATE TABLE IF NOT EXISTS capec (
                    id INTEGER PRIMARY KEY,
                    name TEXT NOT NULL,
                    abstraction TEXT,
                    status TEXT,
                    description TEXT,
                    alternates TEXT,
                    likelihood TEXT,
                    severity TEXT,
                    attacks TEXT,
                    flow TEXT,
                    prerequisites TEXT,
                    skills TEXT,
                    resources TEXT,
                    indicators TEXT,
                    consequences TEXT,
                    mitigations TEXT,
                    instances TEXT,
                    weaknesses TEXT,
                    taxonomy TEXT)",
        )]
    }

    fn index_definitions(&self) -> Vec<(&'static str, &'static str)> {
        vec![
            (
                "weaknesses_idx",
                "CREATE INDEX IF NOT EXISTS weaknesses_idx ON capec (weaknesses)",
            ),
        ]
    }
}

/// Find the list of Capec from the CWE table.
///
/// # Argument
///
/// * `cwe_id` - CWE's id for which we want the list of corresponding CAPEC records
///
/// # Return
///
/// The list of associated Capec records.
///
/// # Example
///
/// ```rust
/// use get_capec::find_capec_list;
///
/// let _ = find_capec_list(1);
/// ```
pub fn find_capec_list(cwe_id: u32) -> Result<Vec<Option<CapecRecord>>, Box<dyn Error>> {
    let binding = db_mitre!()?;
    let statement = binding.prepare("SELECT id FROM capec WHERE weaknesses LIKE :cwe");
    let mut binding = statement?;
    let mut rows = binding.query(&[(":cwe", format!("%::{cwe_id}::%").as_str())])?;
    let mut result: Vec<Option<CapecRecord>> = vec![];
    while let Some(row) = rows.next()? {
        result.push(find_capec_by_id(row.get(0)?));
    }

    Ok(result)
}

fn extract_capec_records(rows: &mut Rows) -> Vec<CapecRecord> {
    let mut records = Vec::new();
    while let Some(row) = rows.next().unwrap() {
        let result = find_capec_by_id(row.get(0).unwrap());
        if let Some(result) = result {
            records.push(result);
        }
    }

    records
}

/// Create the tree of the capec schema. This schema included the list of associated CWE and CVE for a capec record
///
/// # Argument
/// * `capec` - Capec record for which the schema must be built
///
/// # Return
/// The tree schema.
///
/// # Example
///
/// ```rust
/// use fenir::database::find_capec_by_id;
/// use get_capec::build_tree_schema;
///
/// let capec = find_capec_by_id(1).unwrap();
/// let schema = build_tree_schema(&capec);
///
/// println!("{}", schema.render_to_string())
/// ```
pub fn build_tree_schema(capec: &CapecRecord) -> Tree {
    let mut builder = TreeBuilder::new();

    let cwe_node = builder.node(section!(format!("CAPEC-{}", capec.id), Color::Green).to_string());

    let cwe_ids = parse_id_to_u32(capec.weaknesses.clone());
    cwe_node.node("CWE");
    cwe_ids.iter().for_each(|id| {
        if let Some(cwe) = find_cwe_by_id(*id) {
            cwe_node.node(
                format!("CWE-{} - {}", cwe.id, cwe.name)
                    .fg(Color::DarkRed)
                    .to_string(),
            );
            eprint!(
                "{}",
                format!("Search cves for cwe: CWE-{}\r", cwe.id).fg(Color::DarkYellow)
            );
            let query_result =
                execute_query(build_query(ByCwe, format!("CWE-{}", cwe.id).as_str()));

            let mut cves = cve_from_cwe(&query_result);
            simplify_cve_list_content(&mut cves);

            if !cves.is_empty() {
                let cve_node = cwe_node.node("CVE");
                cves.iter().for_each(|cve| {
                    cve_node.leaf(cve.reference.clone());
                });
                cve_node.end();
            }

            cwe_node.end();
        }
    });

    builder.end();
    println!();

    builder.build()
}

/// Enum representing different types of CAPEC information to display
#[derive(Debug)]
pub enum CapecDisplayType {
    /// Display all information
    All,

    /// Display alternates
    Alternates,

    /// Display attacks
    Attacks,

    /// Display Consequences
    Consequences,

    /// Display description
    Description,

    /// Display flow
    Flow,

    /// Display indicators
    Indicators,

    /// Display instances
    Instances,

    /// Display likelihood
    Likelihood,

    /// Display name
    Name,

    /// Display mitigations
    Mitigations,

    /// Display prerequisites
    Prerequisites,

    /// Display resources
    Resources,

    /// Display severity
    Severity,

    /// Display skills
    Skills,

    /// Display taxonomy
    Taxonomy,

    /// Show only MITRE ATTACK ids
    TaxonomyMitreAttackIds,

    /// Display weaknesses
    Weaknesses,
}

impl CapecDisplayType {
    /// Shows capec records elements according to the enum type that's specifying what should be displayed.
    ///
    /// # Arguments
    ///
    /// * `capec_record` - The cwe records for displaying    
    pub fn show(&self, capec_record: &CapecRecord) {
        match self {
            Alternates => hierarchical_show(
                "Alternates",
                capec_record
                    .alternates
                    .standardize(vec!["TERM", "DESCRIPTION"]),
            ),
            Attacks => hierarchical_show(
                "Attacks",
                parse_to_id_format(
                    capec_record.attacks.standardize(vec!["NATURE", "CAPEC ID"]),
                    "CAPEC ID:",
                ),
            ),
            Consequences => hierarchical_show("Consequences", capec_record.clone().consequences),
            Description => hierarchical_show("Description", capec_record.clone().description),
            Flow => hierarchical_show(
                "Flow",
                capec_record.clone().flow.standardize(vec![
                    "STEP",
                    "PHASE",
                    "DESCRIPTION",
                    "TECHNIQUE",
                ]),
            ),
            Indicators => hierarchical_show("Indicators", capec_record.clone().indicators),
            Instances => hierarchical_show(
                "Instances",
                capec_record.instances.transform(vec!["Attack Example"]),
            ),
            Likelihood => hierarchical_show("Likelihood", capec_record.clone().likelihood),
            Name => print!(""),
            Mitigations => hierarchical_show("Mitigations", capec_record.clone().mitigations),
            Prerequisites => hierarchical_show("Prerequisites", capec_record.clone().prerequisites),
            Resources => hierarchical_show("Resources", capec_record.clone().resources),
            Severity => hierarchical_show("Severity", capec_record.clone().severity),
            Skills => hierarchical_show(
                "Skills",
                capec_record
                    .clone()
                    .skills
                    .standardize(vec!["SKILL", "LEVEL"]),
            ),
            Taxonomy => {
                hierarchical_show(
                    "Classification",
                    capec_record.taxonomy.standardize(vec![
                        "TAXONOMY NAME",
                        "ENTRY ID",
                        "ENTRY NAME",
                    ]),
                );
            }

            CapecDisplayType::TaxonomyMitreAttackIds => {
                println!("{}", section!("Mitre Att&ck", Color::DarkRed));
                let mitre_attacks = extract_mitre_attack_ids(capec_record.taxonomy.clone());
                mitre_attacks
                    .iter()
                    .for_each(|id| println!("{:>3} {}", ">", id.fg(Color::DarkRed)));
            }

            Weaknesses => show_weaknesses("Weaknesses", capec_record.clone().weaknesses),
            All => {
                Alternates.show(capec_record);
                Attacks.show(capec_record);
                Consequences.show(capec_record);
                Description.show(capec_record);
                Flow.show(capec_record);
                Instances.show(capec_record);
                Indicators.show(capec_record);
                Likelihood.show(capec_record);
                Name.show(capec_record);
                Mitigations.show(capec_record);
                Prerequisites.show(capec_record);
                Resources.show(capec_record);
                Severity.show(capec_record);
                Skills.show(capec_record);
                Taxonomy.show(capec_record);
                Weaknesses.show(capec_record);
            }
        }
    }
}
fn switch_to_display_type(name: &str) -> CapecDisplayType {
    match name.trim().to_lowercase().as_str() {
        "all" => All,
        "alternates" => Alternates,
        "attacks" => Attacks,
        "consequences" => Consequences,
        "description" => Description,
        "flow" => Flow,
        "instances" => Instances,
        "likelihood" => Likelihood,
        "mitigations" => Mitigations,
        "name" => Name,
        "prerequisites" => Prerequisites,
        "taxonomy" => Taxonomy,
        "weaknesses" => Weaknesses,
        _ => All,
    }
}

pub fn run_search(args: &[String]) {
    let extraction = find_domain_and_criteria(args);
    if let Some(elements) = extraction {
        let domain = elements.0;
        let criteria = elements.1;

        let crit_analysis = criteria_analysis(criteria.clone());
        let (words, operators) = crit_analysis.unwrap();
        let found = search(
            prepare_query(
                format!("SELECT id FROM capec WHERE {domain}"),
                words,
                &operators,
            ),
            extract_capec_records,
        );
        if found.is_empty() {
            write_error_message(format!("{domain} with {criteria} not found").as_str(), None);
        }

        found.iter().for_each(|x| {
            println!("{}", x);
            switch_to_display_type(domain.as_str()).show(x);
        });
    } else {
        write_error_message_and_exit("Invalid argument: '=' missing. See help.", None);
    }
}

#[cfg(test)]
mod test {

    mod search {
        use crate::extract_capec_records;
        use fenir::database::{criteria_analysis, find_domain_and_criteria, prepare_query, search};

        #[test]
        fn simple_taxonomy_criteria() -> Result<(), &'static str> {
            let args = &[String::from("taxonomy = Hijack")];
            let values = find_domain_and_criteria(args);
            let (domain, argument) = values.unwrap();
            let (words, operators) = criteria_analysis(argument).unwrap();
            let result = search(
                prepare_query(
                    format!("SELECT id FROM capec WHERE {domain}"),
                    words,
                    &operators,
                ),
                extract_capec_records,
            );

            match result.is_empty() {
                true => Err("taxonomy not found"),
                false => Ok(()),
            }
        }

        #[test]
        fn taxonomy_criteria_or() -> Result<(), &'static str> {
            let args = &[String::from("taxonomy = Hijack or impair defense")];
            let values = find_domain_and_criteria(args);
            let (domain, argument) = values.unwrap();
            let (words, operators) = criteria_analysis(argument).unwrap();
            let result = search(
                prepare_query(
                    format!("SELECT id FROM capec WHERE {domain}"),
                    words,
                    &operators,
                ),
                extract_capec_records,
            );

            match result.is_empty() {
                false => Ok(()),
                true => Err("taxonomy not found"),
            }
        }

        #[test]
        fn taxonomy_criteria_and() -> Result<(), &'static str> {
            let args = &[String::from("taxonomy = Hijack and Thread")];
            let values = find_domain_and_criteria(args);
            let (domain, argument) = values.unwrap();
            let (words, operators) = criteria_analysis(argument).unwrap();
            let result = search(
                prepare_query(
                    format!("SELECT id FROM capec WHERE {domain}"),
                    words,
                    &operators,
                ),
                extract_capec_records,
            );

            match result.is_empty() {
                true => Err("taxonomy not found"),
                false => Ok(()),
            }
        }

        #[test]
        fn taxonomy_criteria_or_and_not() -> Result<(), &'static str> {
            let args = &[String::from(
                "taxonomy = Hijack or impair defense and not Thread",
            )];
            let values = find_domain_and_criteria(args);
            let (domain, argument) = values.unwrap();
            let (words, operators) = criteria_analysis(argument).unwrap();
            let result = search(
                prepare_query(
                    format!("SELECT id FROM capec WHERE {domain}"),
                    words,
                    &operators,
                ),
                extract_capec_records,
            );

            match result.is_empty() {
                false => Ok(()),
                true => Err("taxonomy not found"),
            }
        }

        #[test]
        fn taxonomy_criteria_or_and_not_second() -> Result<(), &'static str> {
            let args = &[String::from(
                "taxonomy = Hijack or impair and defense and not Thread",
            )];
            let values = find_domain_and_criteria(args);
            let (domain, argument) = values.unwrap();
            let (words, operators) = criteria_analysis(argument).unwrap();
            let result = search(
                prepare_query(
                    format!("SELECT id FROM capec WHERE {domain}"),
                    words,
                    &operators,
                ),
                extract_capec_records,
            );

            match result.is_empty() {
                false => Ok(()),
                true => Err("taxonomy not found"),
            }
        }

        #[test]
        fn taxonomy_not_only_criteria() -> Result<(), &'static str> {
            let args = &[String::from("taxonomy not exploit")];
            let values = find_domain_and_criteria(args);
            let (domain, argument) = values.unwrap();
            let (words, operators) = criteria_analysis(argument).unwrap();
            let result = search(
                prepare_query(
                    format!("SELECT id FROM capec WHERE {domain}"),
                    words,
                    &operators,
                ),
                extract_capec_records,
            );

            match result.is_empty() {
                false => Ok(()),
                true => Err("taxonomy not found"),
            }
        }

        #[test]
        fn skills_not_or_not_complex_criteria() -> Result<(), &'static str> {
            let args = &[String::from("skills not redirection or not attacker")];
            let values = find_domain_and_criteria(args);
            let (domain, argument) = values.unwrap();
            let (words, operators) = criteria_analysis(argument).unwrap();
            let result = search(
                prepare_query(
                    format!("SELECT id FROM capec WHERE {domain}"),
                    words,
                    &operators,
                ),
                extract_capec_records,
            );

            match result.is_empty() {
                true => Err("skills not found"),
                false => Ok(()),
            }
        }
    }

    mod mitre {
        use fenir::capec::extract_mitre_attack_ids;
        use fenir::database::find_capec_by_id;

        #[test]
        fn find_mitre_attacks_ids() -> Result<(), &'static str> {
            let capec = find_capec_by_id(13).unwrap();
            let ids = extract_mitre_attack_ids(capec.taxonomy);

            match ids.is_empty() {
                false => Ok(()),
                true => Err("no mitre attached ids"),
            }
        }

        #[test]
        fn find_mitre_attacks_empty() -> Result<(), &'static str> {
            let ids = extract_mitre_attack_ids("".to_string());

            match ids.is_empty() {
                true => Ok(()),
                false => Err("Mitre ids found"),
            }
        }
    }
}