schema

type APIResp[T APIRespItem] struct {
	APIRespInfo
	Items []T
}

type APIRespInfo struct {
	ResultsPerPage int    `json:"resultsPerPage"`
	StartIndex     int    `json:"startIndex"`
	TotalResults   int    `json:"totalResults"`
	Format         string `json:"format"`
	Version        string `json:"version"`
	Timestamp      string `json:"timestamp"`
}

type APIRespItem interface {
	CveItem | CpeItem
}

type CPEField int

type CPEParsed struct {
	// Ori is the original cpe string
	Ori string

	// Parsed is the map to store all parts in cpeName
	Parsed CPEParsedMap

	// PrefixToProduct is the prefix to product
	// E.g., prefix of "cpe:2.3:o:freebsd:freebsd:4.4:*:*:*:*:*:*:*" is "cpe:2.3:o:freebsd:freebsd"
	PrefixToProduct string
}

type CPEParsedMap map[string]string

type CVSSV2 struct {
	Source                  string     `json:"source" bson:"source"`
	Type                    string     `json:"type" bson:"type"`
	CvssData                CVSSV2Data `json:"cvssData" bson:"cvssData"`
	BaseSeverity            string     `json:"baseSeverity" bson:"baseSeverity"`
	ExploitabilityScore     float64    `json:"exploitabilityScore" bson:"exploitabilityScore"`
	ImpactScore             float64    `json:"impactScore" bson:"impactScore"`
	AcInsufInfo             bool       `json:"acInsufInfo" bson:"acInsufInfo"`
	ObtainAllPrivilege      bool       `json:"obtainAllPrivilege" bson:"obtainAllPrivilege"`
	ObtainUserPrivilege     bool       `json:"obtainUserPrivilege" bson:"obtainUserPrivilege"`
	ObtainOtherPrivilege    bool       `json:"obtainOtherPrivilege" bson:"obtainOtherPrivilege"`
	UserInteractionRequired bool       `json:"userInteractionRequired" bson:"userInteractionRequired"`
}

type CVSSV2Data struct {
	Version               string  `json:"version" bson:"version"` // "2.0"
	VectorString          string  `json:"vectorString" bson:"vectorString"`
	AccessVector          string  `json:"accessVector" bson:"accessVector"`
	AccessComplexity      string  `json:"accessComplexity" bson:"accessComplexity"`
	Authentication        string  `json:"authentication" bson:"authentication"`
	ConfidentialityImpact string  `json:"confidentialityImpact" bson:"confidentialityImpact"`
	IntegrityImpact       string  `json:"integrityImpact" bson:"integrityImpact"`
	AvailabilityImpact    string  `json:"availabilityImpact" bson:"availabilityImpact"`
	BaseScore             float64 `json:"baseScore" bson:"baseScore"`
}

type CVSSV3 struct {
	Source              string     `json:"source" bson:"source"`
	Type                string     `json:"type" bson:"type"`
	CvssData            CVSSV3Data `json:"cvssData" bson:"cvssData"`
	ExploitabilityScore float64    `json:"exploitabilityScore" bson:"exploitabilityScore"`
	ImpactScore         float64    `json:"impactScore" bson:"impactScore"`
}

type CVSSV3Data struct {
	Version               string  `json:"version" bson:"version"` // "3.0", "3.1"
	VectorString          string  `json:"vectorString" bson:"vectorString"`
	AttackVector          string  `json:"attackVector" bson:"attackVector"`
	AttackComplexity      string  `json:"attackComplexity" bson:"attackComplexity"`
	PrivilegesRequired    string  `json:"privilegesRequired" bson:"privilegesRequired"`
	UserInteraction       string  `json:"userInteraction" bson:"userInteraction"`
	Scope                 string  `json:"scope" bson:"scope"`
	ConfidentialityImpact string  `json:"confidentialityImpact" bson:"confidentialityImpact"`
	IntegrityImpact       string  `json:"integrityImpact" bson:"integrityImpact"`
	AvailabilityImpact    string  `json:"availabilityImpact" bson:"availabilityImpact"`
	BaseScore             float64 `json:"baseScore" bson:"baseScore"`
	BaseSeverity          string  `json:"baseSeverity" bson:"baseSeverity"`
}

type Config struct {
	Operator string `json:"operator,omitempty" bson:"operator,omitempty"` // "AND", "OR"
	Negate   bool   `json:"negate,omitempty" bson:"negate,omitempty"`
	Nodes    []Node `json:"nodes" bson:"nodes"`
}

type Cpe struct {
	// Id is the auto generated ID for document DB
	Id *primitive.ObjectID `json:"-" bson:"_id,omitempty"`

	// Name is the cpe 2.3 format of CPE, which is also the primary key in cpe collection (index)
	Name string `json:"cpeName" bson:"cpeName"`

	// NameID is the UUID given from NVD, mitre does not contain this field
	NameID string `json:"cpeNameId" bson:"cpeNameId"`

	// NameParsed is the parsed result for 'Name' which is generated by ourselves to improve search performance
	NameParsed CPEParsedMap `json:"-" bson:"cpeNameParsed"`

	// LastModified is the last time this CPE has been modified
	// Format: 2022-08-11T15:15:10.593
	// Note: mitre does not contain this field
	LastModified *string `json:"lastModified" bson:"lastModified"`

	// Created is the time when CPE is created
	// Format: 2022-08-11T15:15:10.593
	// Note: mitre does not contain this field
	Created *string `json:"created" bson:"created"`

	// Titles are Human readable title for CPE
	Titles []Title `json:"titles,omitempty" bson:"titles"`

	// References are Internet resource for CPE
	References []ReferenceCpe `json:"refs,omitempty" bson:"refs"`

	// Deprecated shows whether the cpe is deprecated due to other cpes
	// Note: mitre does not contain this field
	Deprecated   bool        `json:"deprecated" bson:"deprecated"`
	DeprecatedBy []Deprecate `json:"deprecatedBy,omitempty" bson:"deprecatedBy"`
	Deprecates   []Deprecate `json:"deprecates,omitempty" bson:"deprecates"`
}

type CpeItem struct {
	Cpe Cpe `json:"cpe"`
}

type CpeMatch struct {
	Vulnerable bool `json:"vulnerable" bson:"vulnerable"`

	// Criteria is cpe 2.3 format string as one of the condition that might contains this CVE
	// E.g., cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
	Criteria string `json:"criteria" bson:"criteria"` // cpe2.3

	// CriteriaProductPrefix is generated from field 'Criteria', which is not in either NVD or Mitre response
	// We generate this field as one of the index which benefits the performance when query with cpe name
	//
	// For example, when Criteria is "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*", then
	// CriteriaProductPrefix will be "cpe:2.3:a:apache:http_server".
	//
	// Since user can query with many kinds of version formats (E.g., '*', '-', '2.0', '3', ...),
	// When trying to match CVEs from CPE, we search with ProductPrefix first, then filter the result before return
	CriteriaProductPrefix string `json:"-" bson:"criteriaProductPrefix"`

	// MatchCriteriaID is the unique ID in NVD response which is used as query parameter for other API.
	// Mitre does not contains this field
	MatchCriteriaID string `json:"matchCriteriaId" bson:"matchCriteriaId"`

	// When Criteria does not specify the version, the range of the version is given by below 4 fields
	VersionStartIncluding string `json:"versionStartIncluding,omitempty" bson:"versionStartIncluding"`
	VersionEndIncluding   string `json:"versionEndIncluding,omitempty" bson:"versionEndIncluding"`
	VersionStartExcluding string `json:"versionStartExcluding,omitempty" bson:"versionStartExcluding"`
	VersionEndExcluding   string `json:"versionEndExcluding,omitempty" bson:"versionEndExcluding"`
}

type Cve struct {
	// Id is the auto generated ID for document DB
	Id *primitive.ObjectID `json:"-" bson:"_id,omitempty"`

	// CVEID is the ID of CVE, E.g., CVE-2022-45197
	CVEID string `json:"id" bson:"cveId"`

	// SourceIdentifier is the source name, values can be 'nvd@nist.gov', 'cve@mitre.org', ...
	SourceIdentifier string `json:"sourceIdentifier" bson:"sourceIdentifier"`

	// Published is the time when this CVE is published.
	// Format: 2022-08-11T15:15:10.593
	Published string `json:"published" bson:"published"`

	// LastModified is the last time this CVE has been modified
	// Format: 2022-08-11T15:15:10.593
	LastModified string `json:"lastModified" bson:"lastModified"`

	// VulnStatus is the new field in NVD to describe the analysis status
	// Value includes: Analyzed, Undergoing Analysis, Modified.
	// All the data from Mitre is given with 'Analyzed'
	VulnStatus string `json:"vulnStatus" bson:"vulnStatus"`

	// Descriptions describe the vulnerability with sufficient detail
	// NVD contains more description than mitre
	Descriptions []Description `json:"descriptions" bson:"descriptions"`

	// Metrics contains multiple version of CVSS scores
	// In NVD, there might be multiple scores with same version which is given from different sources
	// It can be differenciate by Source and Type (Primary, Secondary) fields
	Metrics Metrics `json:"metrics"`

	// Weaknesses is Common Weakness Enumeration (CWE), which was created to identify
	// common software security weaknesses.
	Weaknesses []Weaknesses `json:"weaknesses" bson:"weaknesses"`

	// Configurations is a container that holds a set of nodes which then contain CPE Name Match Criteria
	Configurations []Config `json:"configurations" bson:"configurations"`

	// References are supplemental information relevant to the vulnerability
	References []Reference `json:"references" bson:"references"`
}

type CveItem struct {
	Cve Cve `json:"cve"`
}

type Deprecate struct {
	CpeName   string `json:"cpeName"`
	CpeNameId string `json:"cpeNameId"`
}

type Description struct {
	Lang  string `json:"lang" bson:"lang"`
	Value string `json:"value" bson:"value"`
}

type Metrics struct {
	CvssMetricV31 []CVSSV3 `json:"cvssMetricV31,omitempty" bson:"cvssMetricV31,omitempty"`
	CvssMetricV30 []CVSSV3 `json:"cvssMetricV30,omitempty" bson:"cvssMetricV30,omitempty"`
	CvssMetricV2  []CVSSV2 `json:"cvssMetricV2,omitempty" bson:"cvssMetricV2,omitempty"`
}

type MitreCVSSV2 struct {
	CvssData                CVSSV2Data `json:"cvssV2"`
	BaseSeverity            string     `json:"baseSeverity"`
	ExploitabilityScore     float64    `json:"exploitabilityScore"`
	ImpactScore             float64    `json:"impactScore"`
	AcInsufInfo             bool       `json:"acInsufInfo"`
	ObtainAllPrivilege      bool       `json:"obtainAllPrivilege"`
	ObtainUserPrivilege     bool       `json:"obtainUserPrivilege"`
	ObtainOtherPrivilege    bool       `json:"obtainOtherPrivilege"`
	UserInteractionRequired bool       `json:"userInteractionRequired"`
}

type MitreCVSSV3 struct {
	CvssData            CVSSV3Data `json:"cvssV3"`
	ExploitabilityScore float64    `json:"exploitabilityScore"`
	ImpactScore         float64    `json:"impactScore"`
}

type MitreCpe struct {
	Text  string `xml:",chardata"`
	Name  string `xml:"name,attr"`
	Title struct {
		Text string `xml:",chardata"`
		Lang string `xml:"lang,attr"`
	} `xml:"title"`
	References struct {
		Text      string `xml:",chardata"`
		Reference []struct {
			Text string `xml:",chardata"`
			Href string `xml:"href,attr"`
		} `xml:"reference"`
	} `xml:"references"`
	Cpe23Item struct {
		Text string `xml:",chardata"`
		Name string `xml:"name,attr"`
	} `xml:"cpe23-item"`
}

type MitreCpeList struct {
	XMLName        xml.Name `xml:"cpe-list"`
	Text           string   `xml:",chardata"`
	Config         string   `xml:"config,attr"`
	Xmlns          string   `xml:"xmlns,attr"`
	Xsi            string   `xml:"xsi,attr"`
	ScapCore       string   `xml:"scap-core,attr"`
	Cpe23          string   `xml:"cpe-23,attr"`
	Ns6            string   `xml:"ns6,attr"`
	Meta           string   `xml:"meta,attr"`
	SchemaLocation string   `xml:"schemaLocation,attr"`
	Generator      struct {
		Text           string `xml:",chardata"`
		ProductName    string `xml:"product_name"`
		ProductVersion string `xml:"product_version"`
		SchemaVersion  string `xml:"schema_version"`
		Timestamp      string `xml:"timestamp"`
	} `xml:"generator"`
	CpeItem []MitreCpe `xml:"cpe-item"`
}

type MitreCve struct {
	// DataType is the type of data, while most of them is "cve"
	DataType string `json:"data_type"`

	// CVEDataMeta is the meta for CVE, includes ID and sources
	CVEDataMeta struct {
		// ID is the ID of CVE, E.g., CVE-2022-45197
		ID string `json:"ID"`
		// SourceIdentifier is the source name, while most of them is 'cve@mitre.org'
		SourceIdentifier string `json:"ASSIGNER"` // maps to sourceIdentifier
	} `json:"CVE_data_meta"`

	// Description describes the vulnerability with sufficient detail
	Description struct {
		Data []Description `json:"description_data"`
	} `json:"description"`

	// Weaknesses is Common Weakness Enumeration (CWE), which was created to identify
	// common software security weaknesses.
	Weaknesses struct {
		Data []struct {
			Descr []Description `json:"description"` // E.g., value: "CWE-668"
		} `json:"problemtype_data"`
	} `json:"problemtype"`

	// References are supplemental information relevant to the vulnerability
	References struct {
		Data []Reference `json:"reference_data"`
	} `json:"references"`
}

type MitreCveItem struct {
	Cve    MitreCve `json:"cve"`
	Config struct {
		Nodes []NodeWChild `json:"nodes"`
	} `json:"configurations"`
	Impact struct {
		CvssMetricV3 MitreCVSSV3 `json:"baseMetricV3"`
		CvssMetricV2 MitreCVSSV2 `json:"baseMetricV2"`
	} `json:"impact"`
	Published    string `json:"publishedDate"`    // format: "2022-12-25T05:15Z"
	LastModified string `json:"lastModifiedDate"` // format: "2022-12-25T05:15Z"
}

type MitreData struct {
	Timestamp    string         `json:"CVE_data_timestamp"` // "2022-12-25T06:00Z"
	NumberOfCVEs string         `json:"CVE_data_numberOfCVEs"`
	Items        []MitreCveItem `json:"CVE_Items"`
}

type Node struct {
	Operator string     `json:"operator" bson:"operator"` // "AND", "OR"
	Negate   bool       `json:"negate" bson:"negate"`
	CpeMatch []CpeMatch `json:"cpeMatch" bson:"cpeMatch"`
}

type NodeWChild struct {
	Operator string       `json:"operator"` // "AND", "OR"
	Children []NodeWChild `json:"children"`
	CpeMatch []struct {
		Vulnerable            bool   `json:"vulnerable"`
		Criteria              string `json:"cpe23Uri"` // cpe2.3
		CPEV22                string `json:"cpe22Uri"` // cpe2.2
		VersionStartIncluding string `json:"versionStartIncluding,omitempty"`
		VersionEndIncluding   string `json:"versionEndIncluding,omitempty"`
		VersionStartExcluding string `json:"versionStartExcluding,omitempty"`
		VersionEndExcluding   string `json:"versionEndExcluding,omitempty"`
	} `json:"cpe_match"`
}

type Reference struct {
	URL    string   `json:"url" bson:"url"`
	Source string   `json:"source" bson:"source"` // vulnerability@ncsc.ch. Mitre does not contains this field (there's refsource but not the same)
	Tags   []string `json:"tags,omitempty" bson:"tags,omitempty"`
}

type ReferenceCpe struct {
	// Ref is the URL link that related to the product
	Ref string `json:"ref" bson:"ref"`

	// Type is the type of the reference.
	// All possible value: "Advisory", "Change Log", "Product", "Project", "Vendor", "Version"
	// ref. https://csrc.nist.gov/schema/nvd/api/2.0/cpe_api_json_2.0.schema
	Type string `json:"type" bson:"type"`
}

type Title struct {
	// Title is the name of the product. E.g., McAfee e-Business Server 8.5.2, GNU Emacs 22.1
	Title string `json:"title" bson:"title"`

	// Lang is the language of product. E.g., en
	Lang string `json:"lang" bson:"lang"`
}

type Weaknesses struct {
	Source      string        `json:"source" bson:"source"`
	Type        string        `json:"type" bson:"type"`
	Description []Description `json:"description" bson:"description"` // E.g., value: "CWE-668"
}