feat(search): add vulnerabilities vertical with NVD and OSV engines#217
feat(search): add vulnerabilities vertical with NVD and OSV engines#217Oscar-SR wants to merge 4 commits into
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
🚧 Files skipped from review as they are similar to previous changes (4)
📝 WalkthroughWalkthroughChangesThe search system adds a Vulnerability search
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant IntentRouter
participant Orchestrator
participant NVD
participant OSV
Client->>IntentRouter: vulnerability query
IntentRouter-->>Orchestrator: vulnerabilities vertical
Orchestrator->>NVD: search(query, options)
Orchestrator->>OSV: search(query, options)
NVD-->>Orchestrator: normalized results
OSV-->>Orchestrator: normalized results
Orchestrator-->>Client: vulnerability search results
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
ESLint install timed out. The project may have too many dependencies for the sandbox. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
src/search/engines/osv.ts (1)
115-154: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win
extractQuery's noise-stripping is too narrow — generic vulnerability queries dispatch garbage package lookups.Tracing the routing test's own example queries through this heuristic: "recent exploit in openssl" → package name
"recent in openssl"; "microsoft patch tuesday" → package name"microsoft patch tuesday"; "what is cwe-79" → package name"what is cwe-79". None of these are plausible OSV package names — this fires a POST to/v1/querythat will reliably return nothing, on what looks like the majority of non-ID vulnerability queries.Consider bailing out (return
null) when no known ecosystem token was found and the remaining "package name" still has more than 1-2 tokens, or extendnoiseRewith a broader stop-word list.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/search/engines/osv.ts` around lines 115 - 154, Update extractQuery so generic vulnerability questions do not become OSV package lookups: after tokenization, require a recognized ecosystem or a plausible one-to-two-token package name, and return null for longer package names without an ecosystem. Preserve valid ID extraction and ecosystem-qualified package queries.src/search/engines/nvd.ts (1)
29-62: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winUse NVD's exact CVE lookup path for bare CVE queries instead of always falling back to
keywordSearch.For canonical IDs, query
cveIdsdirectly; the fuzzy search is less precise and can miss the exact record. It also avoids unnecessary load on NVD for the most common exact-ID path.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/search/engines/nvd.ts` around lines 29 - 62, Update search in the NVD engine to detect canonical bare CVE IDs and send them via the cveIds query parameter instead of keywordSearch. Preserve keywordSearch for all other queries, while retaining the existing result limits, request flow, parsing, and date filtering.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/search/core/intent-router.ts`:
- Around line 34-35: The GHSA detection in the intent-routing logic only
recognizes standalone IDs, so embedded GHSA queries miss the vulnerabilities
route. Update the GHSA matching used by the router to detect valid GHSA IDs
within longer queries, while preserving the existing ID format validation, and
add a routing test for a query such as “explain GHSA-abcd-1234-efgh” that
expects vulnerabilities.
---
Nitpick comments:
In `@src/search/engines/nvd.ts`:
- Around line 29-62: Update search in the NVD engine to detect canonical bare
CVE IDs and send them via the cveIds query parameter instead of keywordSearch.
Preserve keywordSearch for all other queries, while retaining the existing
result limits, request flow, parsing, and date filtering.
In `@src/search/engines/osv.ts`:
- Around line 115-154: Update extractQuery so generic vulnerability questions do
not become OSV package lookups: after tokenization, require a recognized
ecosystem or a plausible one-to-two-token package name, and return null for
longer package names without an ecosystem. Preserve valid ID extraction and
ecosystem-qualified package queries.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: dc58e892-f570-4794-9bc9-82a655e1bfed
📒 Files selected for processing (11)
src/search/core/engine-health.tssrc/search/core/engine-quality.tssrc/search/core/intent-router.tssrc/search/core/orchestrator.tssrc/search/core/verticals/vulnerabilities.tssrc/search/engines/nvd.tssrc/search/engines/osv.tssrc/types.tstests/unit/search/core/vuln-routing.test.tstests/unit/search/engines/nvd.test.tstests/unit/search/engines/osv.test.ts
1 participant
What & why
Adds a dedicated vulnerabilities search vertical with two new engine adapters (NVD and OSV), so queries containing CVE/GHSA identifiers or vulnerability-related keywords are routed to authoritative vulnerability databases instead of general web search engines.
Previously, searching for "CVE-2024-21626" or "python vulnerability log4j" would fall through to general engines like Bing and DuckDuckGo, yielding inconsistent results. This change gives Wigolo users direct access to structured, sourced vulnerability data from NIST NVD and OSV.dev.
Changes
src/search/core/intent-router.ts: Extended Vertical type withvulnerabilities; addedVULN_REregex and CVE/GHSA pattern matching before the code and general branches so vulnerability queries take prioritysrc/search/engines/nvd.ts: New engine adapter for the NIST NVD CVE API 2.0; supports keyword search, client-side date filtering; no API key requiredsrc/search/engines/osv.ts: New engine adapter for the OSV.dev API; supports direct CVE/GHSA lookups and heuristic package+ecosystem extraction (PyPI, npm, Go, crates.io, Maven, etc.)src/search/core/verticals/vulnerabilities.ts: New vertical definition mapping NVD (weight 1.2, high quality) and OSV (weight 0.9, medium quality) with date filter supportsrc/search/core/orchestrator.ts: Registered vulnerabilities case ingetEntriesForVertical()and added importsrc/search/core/engine-health.ts: Registered inverticalPools()for diagnosticstests/unit/search/core/vuln-routing.test.ts: 5 tests for routing accuracy and edge casestests/unit/search/engines/nvd.test.ts: 7 tests for response parsing, date filtering, error handlingtests/unit/search/engines/osv.test.ts: 11 tests for package extraction, ID lookups, 404 handling, date filteringTesting
npm testpasses (23 new tests across 3 files)npm run lintpassesChecklist
CONTRIBUTING.mdand agree to its contribution termsSummary by CodeRabbit