Merge branch 'cisagov:master' into DarkMode

backend/env.yml

@@ -92,7 +92,7 @@ prod:
   REACT_APP_RANDOM_PASSWORD: ${ssm:/crossfeed/prod/REACT_APP_RANDOM_PASSWORD}
   MATOMO_URL: http://matomo.crossfeed.local
   EXPORT_BUCKET_NAME: cisa-crossfeed-prod-exports
-  PE_API_URL: ${ssm:/crossfeed/staging/PE_API_URL}
+  PE_API_URL: ${ssm:/crossfeed/prod/PE_API_URL}
   REPORTS_BUCKET_NAME: cisa-crossfeed-prod-reports
   CLOUDWATCH_BUCKET_NAME: cisa-crossfeed-prod-cloudwatch
   STAGE: prod

backend/src/api/app.ts

@@ -61,7 +61,7 @@ app.use(express.json({ strict: false }));
 
 app.use(
   cors({
-    origin: [/crossfeed\.cyber\.dhs\.gov$/, /localhost$/],
+    origin: '*',
     methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS']
   })
 );

backend/src/api/organizations.ts

@@ -367,13 +367,18 @@ export const create = wrapHandler(async (event) => {
  *    - Organizations
  */
 export const list = wrapHandler(async (event) => {
+  console.log('list function called with event: ', event);
+
   if (!isGlobalViewAdmin(event) && getOrgMemberships(event).length === 0) {
     return {
+      //TODO: Should we return a 403?
       statusCode: 200,
       body: JSON.stringify([])
     };
   }
   await connectToDatabase();
+  console.log('Database connected');
+
   let where: any = { parent: null };
   if (!isGlobalViewAdmin(event)) {
     where = { id: In(getOrgMemberships(event)), parent: null };
@@ -384,6 +389,8 @@ export const list = wrapHandler(async (event) => {
     order: { name: 'ASC' }
   });
 
+  console.log('Organization.find result: ', result);
+
   return {
     statusCode: 200,
     body: JSON.stringify(result)

backend/src/tasks/vuln-sync.ts

@@ -189,35 +189,38 @@ export const handler = async (commandOptions: CommandOptions) => {
         }
 
         let serviceId;
-        try {
-          // Save discovered services to the Service table
-          [serviceId] = await saveServicesToDb([
-            plainToClass(Service, {
-              domain: { id: domainId },
-              discoveredBy: { id: commandOptions.scanId },
-              port: vuln.port,
-              lastSeen: new Date(vuln.last_seen),
-              banner:
-                vuln.banner == null ? null : sanitizeStringField(vuln.banner),
-              serviceSource: vuln.source,
-              shodanResults:
-                vuln.source === 'shodan'
-                  ? {
-                      product: vuln.product,
-                      version: vuln.version,
-                      cpe: vuln.cpe
-                    }
-                  : {}
-            })
-          ]);
-          console.log('Saved services.');
-        } catch (e) {
-          console.error(
-            'Could not save services. Continuing to next vulnerability.'
-          );
-          console.error(e);
-          continue;
+        if (vuln.port != null) {
+          try {
+            // Save discovered services to the Service table
+            [serviceId] = await saveServicesToDb([
+              plainToClass(Service, {
+                domain: { id: domainId },
+                discoveredBy: { id: commandOptions.scanId },
+                port: vuln.port,
+                lastSeen: new Date(vuln.last_seen),
+                banner:
+                  vuln.banner == null ? null : sanitizeStringField(vuln.banner),
+                serviceSource: vuln.source,
+                shodanResults:
+                  vuln.source === 'shodan'
+                    ? {
+                        product: vuln.product,
+                        version: vuln.version,
+                        cpe: vuln.cpe
+                      }
+                    : {}
+              })
+            ]);
+            console.log('Saved services.');
+          } catch (e) {
+            console.error(
+              'Could not save services. Continuing to next vulnerability.'
+            );
+            console.error(e);
+            continue;
+          }
         }
+
         try {
           const vulns: Vulnerability[] = [];
           vulns.push(
@@ -229,11 +232,12 @@ export const handler = async (commandOptions: CommandOptions) => {
               cwe: vuln.cwe,
               description: vuln.description,
               cvss: vuln.cvss,
+              severity: vuln.severity,
               state: vuln.state,
               structuredData: vuln.structuredData,
               source: vuln.source,
               needsPopulation: vuln.needsPopulation,
-              service: { id: serviceId }
+              service: vuln.port == null ? null : { id: serviceId }
             })
           );
           await saveVulnerabilitiesToDb(vulns, false);

frontend/scripts/constants.js

@@ -1,3 +1,3 @@
 //CORS Options
-export const ALLOW_ORIGIN = [/crossfeed\.cyber\.dhs\.gov$/, /localhost$/];
+export const ALLOW_ORIGIN = '*';
 export const ALLOW_METHODS = ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'];

frontend/src/App.tsx

@@ -130,7 +130,7 @@ const App: React.FC = () => (
                     exact
                     path="/inventory"
                     component={SearchPage}
-                    permissions={['globalView']}
+                    permissions={['standard', 'globalView']}
                   />
                   <RouteGuard
                     path="/inventory/domain/:domainId"
@@ -142,19 +142,19 @@ const App: React.FC = () => (
                     path="/inventory/vulnerabilities"
                     exact
                     component={Vulnerabilities}
-                    permissions={['globalView']}
+                    permissions={['standard', 'globalView']}
                   />
                   <RouteGuard
                     path="/inventory/vulnerabilities/grouped"
                     component={(props) => (
                       <Vulnerabilities {...props} groupBy="title" />
                     )}
-                    permissions={['globalView']}
+                    permissions={['standard', 'globalView']}
                   />
                   <RouteGuard
                     path="/inventory/vulnerability/:vulnerabilityId"
                     component={Vulnerability}
-                    permissions={['globalView']}
+                    permissions={['standard', 'globalView']}
                   />
                   <RouteGuard
                     path="/feeds"
@@ -170,28 +170,28 @@ const App: React.FC = () => (
                     path="/scans"
                     exact
                     component={Scans}
-                    permissions={['globalView']}
+                    permissions={['standard', 'globalView']}
                   />
                   <RouteGuard
                     path="/scans/history"
                     component={Scans}
                     exact
-                    permissions={['globalView']}
+                    permissions={['standard', 'globalView']}
                   />
                   <RouteGuard
                     path="/scans/:scanId"
                     component={Scan}
-                    permissions={['globalView']}
+                    permissions={['standard', 'globalView']}
                   />
                   <RouteGuard
                     path="/organizations/:organizationId"
                     component={Organization}
-                    permissions={['standard', 'globalView']}
+                    permissions={['globalView']}
                   />
                   <RouteGuard
                     path="/organizations"
                     component={Organizations}
-                    permissions={['globalView', 'regionalAdmin']}
+                    permissions={['standard', 'globalView', 'regionalAdmin']}
                   />
                   <RouteGuard
                     path="/users"
@@ -201,7 +201,7 @@ const App: React.FC = () => (
                   <RouteGuard
                     path="/settings"
                     component={Settings}
-                    permissions={['globalView', 'regionalAdmin']}
+                    permissions={['standard', 'globalView', 'regionalAdmin']}
                   />
                   <RouteGuard
                     path="/region-admin-dashboard"

frontend/src/components/Footer/Footer.tsx

@@ -29,6 +29,7 @@ export const CrossfeedFooter: React.FC = (props) => {
               <Link
                 className={footerClasses.footerNavLink}
                 href="https://docs.crossfeed.cyber.dhs.gov/"
+                target="_blank"
               >
                 Documentation
               </Link>
@@ -39,6 +40,7 @@ export const CrossfeedFooter: React.FC = (props) => {
               <Link
                 className={footerClasses.footerNavLink}
                 href="https://www.cisa.gov"
+                target="_blank"
               >
                 CISA Homepage
               </Link>

frontend/src/components/Header.tsx

@@ -222,7 +222,7 @@ const HeaderNoCtx: React.FC<ContextType> = (props) => {
 
   const fetchOrganizations = useCallback(async () => {
     try {
-      const rows = await apiGet<Organization[]>('/organizations/');
+      const rows = await apiGet<Organization[]>('/v2/organizations/');
       let tags: (OrganizationTag | Organization)[] = [];
       if (userLevel === GLOBAL_ADMIN) {
         tags = await apiGet<OrganizationTag[]>('/organizations/tags');
@@ -294,12 +294,12 @@ const HeaderNoCtx: React.FC<ContextType> = (props) => {
         users: GLOBAL_ADMIN,
         exact: true
       },
-      {
-        title: 'My Organizations',
-        path: '/organizations',
-        users: STANDARD_USER,
-        exact: true
-      },
+      // {
+      //   title: 'My Organizations',
+      //   path: '/organizations',
+      //   users: STANDARD_USER,
+      //   exact: true
+      // },
       {
         title: 'Manage Users',
         path: '/users',
@@ -335,12 +335,12 @@ const HeaderNoCtx: React.FC<ContextType> = (props) => {
       users: GLOBAL_ADMIN,
       exact: true
     },
-    {
-      title: 'My Organizations',
-      path: '/organizations',
-      users: STANDARD_USER,
-      exact: true
-    },
+    // {
+    //   title: 'My Organizations',
+    //   path: '/organizations',
+    //   users: STANDARD_USER,
+    //   exact: true
+    // },
     {
       title: 'Manage Users',
       path: '/users',

frontend/src/components/OrganizationList/OrganizationList.tsx

@@ -1,7 +1,7 @@
 import React, { useState, useCallback } from 'react';
 import EditNoteOutlinedIcon from '@mui/icons-material/EditNoteOutlined';
 import { Organization } from 'types';
-import { Box, Button, IconButton, Grid } from '@mui/material';
+import { Alert, Box, Button, IconButton, Grid } from '@mui/material';
 import { DataGrid, GridColDef, GridRenderCellParams } from '@mui/x-data-grid';
 import { useHistory } from 'react-router-dom';
 import { Add } from '@mui/icons-material';
@@ -16,13 +16,14 @@ export const OrganizationList: React.FC<{
   const [organizations, setOrganizations] = useState<Organization[]>([]);
   const [dialogOpen, setDialogOpen] = useState(false);
   const history = useHistory();
+  const getOrgsURL = `/v2/organizations/`;
 
   const orgCols: GridColDef[] = [
     { field: 'name', headerName: 'Organization', minWidth: 100, flex: 2 },
-    { field: 'userCount', headerName: 'Members', minWidth: 100, flex: 1 },
+    // { field: 'userCount', headerName: 'Members', minWidth: 100, flex: 1 },
     { field: 'state', headerName: 'State', minWidth: 100, flex: 1 },
     { field: 'regionId', headerName: 'Region', minWidth: 100, flex: 1 },
-    { field: 'tagNames', headerName: 'Tags', minWidth: 100, flex: 1 },
+    // { field: 'tagNames', headerName: 'Tags', minWidth: 100, flex: 1 },
     {
       field: 'view',
       headerName: 'View/Edit',
@@ -61,16 +62,16 @@ export const OrganizationList: React.FC<{
 
   const fetchOrganizations = useCallback(async () => {
     try {
-      const rows = await apiGet<Organization[]>('/organizations/');
-      rows.forEach((obj) => {
-        obj.userCount = obj.userRoles.length;
-        obj.tagNames = obj.tags.map((tag) => tag.name);
-      });
+      const rows = await apiGet<Organization[]>(getOrgsURL);
+      // rows.forEach((obj) => {
+      //   // obj.userCount = obj.userRoles.length;
+      //   obj.tagNames = obj.tags.map((tag) => tag.name);
+      // });
       setOrganizations(rows);
     } catch (e) {
       console.error(e);
     }
-  }, [apiGet]);
+  }, [apiGet, getOrgsURL]);
 
   React.useEffect(() => {
     if (!parent) fetchOrganizations();
@@ -91,21 +92,25 @@ export const OrganizationList: React.FC<{
   );
 
   return (
-    <>
+    <Box mb={3}>
       <Grid
         container
         spacing={2}
         style={{ margin: '0 auto', marginTop: '1rem', maxWidth: '1000px' }}
       ></Grid>
       <Box sx={{ backgroundColor: 'white' }}>
-        <DataGrid
-          rows={organizations}
-          columns={orgCols}
-          slots={{ toolbar: CustomToolbar }}
-          slotProps={{
-            toolbar: { children: addOrgButton }
-          }}
-        />
+        {organizations?.length === 0 ? (
+          <Alert severity="warning">No organizations found.</Alert>
+        ) : (
+          <DataGrid
+            rows={organizations}
+            columns={orgCols}
+            slots={{ toolbar: CustomToolbar }}
+            slotProps={{
+              toolbar: { children: addOrgButton }
+            }}
+          />
+        )}
       </Box>
       <OrganizationForm
         onSubmit={onSubmit}
@@ -114,6 +119,6 @@ export const OrganizationList: React.FC<{
         type="create"
         parent={parent}
       ></OrganizationForm>
-    </>
+    </Box>
   );
 };

frontend/src/components/WarningBanner/Warning.tsx

@@ -33,15 +33,15 @@ export const CrossfeedWarning: React.FC = (props) => {
               Crossfeed is hosted by Department of Homeland Security (DHS)
               Cybersecurity and Infrastructure Security Agency (CISA)
               Cybersecurity Division (CSD) Vulnerability Management (VM) Attack
-              Attack Attack Surface Management (ASM) Automation is computer
-              systems systems may systems may be monitored for all unlawful
-              unlawful purposes, including to ensure their use is authorized,
-              for management of the system, to protection against security
-              procedures, survivability, and operational operational operational
-              operational security. All information, information, including
-              information, placed or sent this system may be monitored.
-              Monitoring includes actives attacks by authorized US Government
-              entities to test or verify the security of this system.
+              Surface Management (ASM) Automation is computer systems systems
+              may systems may be monitored for all unlawful unlawful purposes,
+              including to ensure their use is authorized, for management of the
+              system, to protection against security procedures, survivability,
+              and operational operational operational operational security. All
+              information, information, including information, placed or sent
+              this system may be monitored. Monitoring includes actives attacks
+              by authorized US Government entities to test or verify the
+              security of this system.
               <br />
               <br />
               Use of the computer system, authorized or unauthorized,