asdf

1 files changed, 89 insertions, 0 deletions

diff --git a/csv/critical.sh b/csv/critical.sh
new file mode 100755
index 0000000..ab20b34
--- /dev/null
+++ b/csv/critical.sh
@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ "$#" -lt 1 ]; then
+    echo "Usage: $0 doca-*-vuln.csv [more.csv ...]" >&2
+    exit 1
+fi
+
+python3 - "$@" <<'PY'
+import csv
+import os
+import re
+import sys
+
+FILENAME_RE = re.compile(
+    r"^doca-(?P<container>.+)-(?P<version>\d+\.\d+\.\d+)-(?P<host>host|dpu)-vuln\.csv$"
+)
+
+META_COLUMNS = ["doca_version", "doca_host", "doca_container"]
+
+
+def parse_metadata(path):
+    base = os.path.basename(path)
+    match = FILENAME_RE.match(base)
+
+    if not match:
+        raise ValueError(
+            f"Filename does not match expected pattern: {base}\n"
+            f"Expected: doca-(container)-(version)-(host)-vuln.csv"
+        )
+
+    return {
+        "doca_version": match.group("version"),
+        "doca_host": match.group("host"),
+        "doca_container": match.group("container"),
+    }
+
+
+def is_critical(row):
+    fields_to_check = [
+        "nvd_severity",
+        "severity",
+        "osv_severity",
+    ]
+
+    for field in fields_to_check:
+        value = row.get(field, "")
+        if value and "CRITICAL" in value.upper():
+            return True
+
+    return False
+
+
+def main(paths):
+    writer = None
+    output_header = None
+
+    for path in paths:
+        metadata = parse_metadata(path)
+
+        with open(path, "r", encoding="utf-8", newline="") as f:
+            reader = csv.DictReader(f)
+
+            if reader.fieldnames is None:
+                continue
+
+            if writer is None:
+                original_header = reader.fieldnames
+                output_header = META_COLUMNS + original_header
+                writer = csv.DictWriter(
+                    sys.stdout,
+                    fieldnames=output_header,
+                    extrasaction="ignore",
+                )
+                writer.writeheader()
+
+            for row in reader:
+                if not is_critical(row):
+                    continue
+
+                output_row = {}
+                output_row.update(metadata)
+                output_row.update(row)
+                writer.writerow(output_row)
+
+
+if __name__ == "__main__":
+    main(sys.argv[1:])
+PY