Inconsistent interpretation of http requests

#!/usr/bin/env python3
# check_cve_2025_55315.py
# Detect likely exposure to CVE-2025-55315 on a host or in a source tree.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import json
import os
import re
import subprocess
import sys
import xml.etree.ElementTree as ET
from pathlib import Path

CVE = "CVE-2025-55315"


def parse_version_tuple(v):
    # Handles numeric versions like 8.0.21 and 9.0.10
    m = re.match(r"^(\d+)\.(\d+)\.(\d+)$", v)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def compare_numeric(v1, v2):
    t1 = parse_version_tuple(v1)
    t2 = parse_version_tuple(v2)
    if t1 is None or t2 is None:
        return None
    return (t1 > t2) - (t1 < t2)


def version_in_range_numeric(v, low, high_inclusive):
    c1 = compare_numeric(v, low)
    c2 = compare_numeric(v, high_inclusive)
    return c1 is not None and c2 is not None and c1 >= 0 and c2 <= 0


def is_vulnerable_runtime(ver):
    # Microsoft-supported lines from the advisory
    if version_in_range_numeric(ver, "8.0.0", "8.0.20"):
        return True
    if version_in_range_numeric(ver, "9.0.0", "9.0.9"):
        return True
    # 10 RC handling: anything explicitly on rc.1 is vulnerable
    if ver.startswith("10.0.0-rc.1"):
        return True
    return False


def is_patched_runtime(ver):
    if compare_numeric(ver, "8.0.21") is not None and compare_numeric(ver, "8.0.21") >= 0 and ver.startswith("8."):
        return True
    if compare_numeric(ver, "9.0.10") is not None and compare_numeric(ver, "9.0.10") >= 0 and ver.startswith("9."):
        return True
    if ver.startswith("10.0.0-rc.2") or ver.startswith("10.0.0") or ver.startswith("10.1"):
        return True
    return False


def parse_dotnet_runtimes():
    try:
        proc = subprocess.run(
            ["dotnet", "--list-runtimes"],
            capture_output=True,
            text=True,
            check=False,
            timeout=15,
        )
    except Exception:
        return None, ["dotnet CLI not available"]

    if proc.returncode != 0:
        return None, [f"dotnet returned {proc.returncode}: {proc.stderr.strip()}"]

    runtimes = []
    for line in proc.stdout.splitlines():
        # Example: Microsoft.AspNetCore.App 8.0.20 [/usr/share/dotnet/shared/Microsoft.AspNetCore.App]
        m = re.match(r"^(Microsoft\.AspNetCore\.App)\s+([^\s]+)\s+\[.*\]$", line.strip())
        if m:
            runtimes.append({"name": m.group(1), "version": m.group(2)})
    return runtimes, []


def scan_csproj_for_kestrel(path):
    findings = []
    for file in path.rglob("*.csproj"):
        try:
            tree = ET.parse(file)
            root = tree.getroot()
            for elem in root.iter():
                tag = elem.tag.split('}')[-1]
                if tag == "PackageReference":
                    include = elem.attrib.get("Include") or elem.attrib.get("Update") or ""
                    version = elem.attrib.get("Version")
                    if not version:
                        for child in elem:
                            ctag = child.tag.split('}')[-1]
                            if ctag == "Version" and child.text:
                                version = child.text.strip()
                    if include == "Microsoft.AspNetCore.Server.Kestrel.Core" and version:
                        findings.append((str(file), version))
        except Exception:
            pass
    return findings


def normalize_version(s):
    # trim common NuGet range wrappers when possible
    s = s.strip()
    s = s.strip("[]()")
    s = s.split(",")[0].strip()
    return s


def assess_kestrel_pkg(ver):
    v = normalize_version(ver)
    cmp = compare_numeric(v, "2.3.0")
    if cmp is not None and cmp <= 0:
        return "vulnerable"
    cmp2 = compare_numeric(v, "2.3.6")
    if cmp2 is not None and cmp2 >= 0:
        return "patched"
    return "unknown"


def main():
    app_path = Path(sys.argv[1]).resolve() if len(sys.argv) > 1 else None
    notes = []
    vulnerable = []
    patched = []
    unknown = []

    runtimes, errs = parse_dotnet_runtimes()
    notes.extend(errs)

    if runtimes is None:
        unknown.append("Unable to inventory installed ASP.NET Core runtimes")
    else:
        asp = [r for r in runtimes if r["name"] == "Microsoft.AspNetCore.App"]
        if not asp:
            notes.append("No Microsoft.AspNetCore.App runtimes found via dotnet CLI")
        for r in asp:
            ver = r["version"]
            if is_vulnerable_runtime(ver):
                vulnerable.append(f"Runtime {ver} is in Microsoft affected range")
            elif is_patched_runtime(ver):
                patched.append(f"Runtime {ver} is at or above fixed level for its train")
            elif ver.startswith(("6.", "7.", "5.", "3.", "2.")):
                unknown.append(f"Runtime {ver} is unsupported/not covered by current Microsoft supported-range check")
            else:
                unknown.append(f"Runtime {ver} could not be classified")

    if app_path and app_path.exists() and app_path.is_dir():
        refs = scan_csproj_for_kestrel(app_path)
        if refs:
            for file, ver in refs:
                state = assess_kestrel_pkg(ver)
                if state == "vulnerable":
                    vulnerable.append(f"{file}: Microsoft.AspNetCore.Server.Kestrel.Core {ver} <= 2.3.0")
                elif state == "patched":
                    patched.append(f"{file}: Microsoft.AspNetCore.Server.Kestrel.Core {ver} >= 2.3.6")
                else:
                    unknown.append(f"{file}: could not classify Kestrel.Core version {ver}")
        else:
            notes.append("No csproj PackageReference to Microsoft.AspNetCore.Server.Kestrel.Core found")
    elif app_path:
        unknown.append(f"Path not found or not a directory: {app_path}")

    result = {
        "cve": CVE,
        "vulnerable_findings": vulnerable,
        "patched_findings": patched,
        "unknown_findings": unknown,
        "notes": notes,
    }

    print(json.dumps(result, indent=2))
    if vulnerable:
        print("VULNERABLE")
        sys.exit(1)
    if patched and not unknown:
        print("PATCHED")
        sys.exit(0)
    print("UNKNOWN")
    sys.exit(2)


if __name__ == "__main__":
    main()