importer.rb in dradis-wpscan-4.10.0

- old
+ new

@@ -5,62 +5,60 @@
     end
 
     # The framework will call this function if the user selects this plugin from
     # the dropdown list and uploads a file.
     # @returns true if the operation was successful, false otherwise
-    def import(params={})
+    def import(params = {})
+      file_content = File.read(params[:file])
 
-      file_content = File.read( params[:file] )
-
       # Parse the uploaded file into a Ruby Hash
       logger.info { "Parsing WPScan output from #{ params[:file] }..." }
       data = MultiJson.decode(file_content)
       logger.info { 'Done.' }
 
       # Do a sanity check to confirm the user uploaded the right file
       # format.
       if data['target_url'].nil?
         error = "ERROR: No 'target_url' field present in the provided " \
-                "JSON data. Are you sure you uploaded a WPScan JSON output file?"
+                'JSON data. Are you sure you uploaded a WPScan JSON output file?'
         logger.fatal { error }
         content_service.create_note text: error
         return false
       end
 
       # Initial data normalisation
-      data = parse_json( data )
+      data = parse_json(data)
 
       # Create a node based on the target_url
-      node = create_node( data )
+      node = create_node(data)
 
       # Parse vulnerability data and make more human readable.
       # NOTE: You need an API token for the WPVulnDB vulnerability data.
-      parse_known_vulnerabilities( data, node )
+      parse_known_vulnerabilities(data, node)
 
-
       # Add bespoke/config vulnerabilities to Dradis
       #
       # TODO: Can we add severity to issues?
       #
       # Note: No API key needed.
-      parse_config_vulnerabilities( data, node )
+      parse_config_vulnerabilities(data, node)
     end
 
-    def parse_json( data )
+    def parse_json(data)
       # Parse scan info data and make more human readable.
       data['wpscan_version']    = data.dig('banner', 'version')
-      data['start_time']        = DateTime.strptime(data['start_time'].to_s,'%s')
+      data['start_time']        = DateTime.strptime(data['start_time'].to_s, '%s')
       data['elapsed']           = "#{data["elapsed"]} seconds"
       data['wordpress_version'] = data.dig('version', 'number')   if data['version']
       data['plugins_string']    = data['plugins'].keys.join("\n") if data['plugins']
       data['themes_string']     = data['themes'].keys.join("\n")  if data['themes']
       data['users']             = data['users'].keys.join("\n")   if data['users']
 
       data
     end
 
-    def create_node( data )
+    def create_node(data)
       node = content_service.create_node(label: data['target_url'], type: :host)
 
       # Define Node properties
       if node.respond_to?(:properties)
         node.set_property(:start_url, data['target_url'])
@@ -72,38 +70,37 @@
       content_service.create_note text: scan_info, node: node
 
       node
     end
 
-
-    def parse_known_vulnerabilities( data, node )
+    def parse_known_vulnerabilities(data, node)
       vulnerabilities = []
 
       # WordPress Vulnerabilities
-      if data['version'] && data['version']['status'] == 'insecure'
+      if data['version'] && ['insecure', 'outdated'].include?(data['version']['status'])
         data['version']['vulnerabilities'].each do |vulnerability_data|
-          vulnerabilities << parse_vulnerability( vulnerability_data )
+          vulnerabilities << parse_vulnerability(vulnerability_data)
         end
       end
 
       # Plugin Vulnerabilities
       if data['plugins']
         data['plugins'].each do |key, plugin|
           if plugin['vulnerabilities']
             plugin['vulnerabilities'].each do |vulnerability_data|
-              vulnerabilities << parse_vulnerability( vulnerability_data )
+              vulnerabilities << parse_vulnerability(vulnerability_data)
             end
           end
         end
       end
 
       # Theme Vulnerabilities
       if data['themes']
         data['themes'].each do |key, theme|
           if theme['vulnerabilities']
             theme['vulnerabilities'].each do |vulnerability_data|
-              vulnerabilities << parse_vulnerability( vulnerability_data )
+              vulnerabilities << parse_vulnerability(vulnerability_data)
             end
           end
         end
       end
 
@@ -119,11 +116,11 @@
           content_service.create_evidence(issue: issue, node: node, content: vulnerability['evidence'])
         end
       end
     end
 
-    def parse_config_vulnerabilities( data, node )
+    def parse_config_vulnerabilities(data, node)
       vulnerabilities = []
 
       if data['config_backups']
         data['config_backups'].each do |url, value|
           vulnerability = {}
@@ -146,22 +143,22 @@
 
       if data['timthumbs']
         data['timthumbs'].each do |url, value|
           unless value['vulnerabilities'].empty?
             vulnerability = {}
-            vulnerability['title']    = "Timthumb RCE File Found"
+            vulnerability['title']    = 'Timthumb RCE File Found'
             vulnerability['evidence'] = url
 
             vulnerabilities << vulnerability
           end
         end
       end
 
       if data['password_attack']
         data['password_attack'].each do |user|
           vulnerability = {}
-          vulnerability['title'] = "WordPres Weak User Password Found"
+          vulnerability['title'] = 'WordPres Weak User Password Found'
           vulnerability['evidence'] = "#{user[0]}:#{user[1]['password']}"
 
           vulnerabilities << vulnerability
         end
       end
@@ -178,10 +175,10 @@
           content_service.create_evidence(issue: issue, node: node, content: vulnerability['evidence'])
         end
       end
     end
 
-    def parse_vulnerability( vulnerability_data )
+    def parse_vulnerability(vulnerability_data)
       wpvulndb_url = 'https://wpvulndb.com/vulnerabilities/'
 
       vulnerability = {}
       vulnerability['title']        = vulnerability_data['title']
       vulnerability['fixed_in']     = vulnerability_data['fixed_in'] if vulnerability_data['fixed_in']