RAG embedding 和Cosine Similarity

批量总结脚本范式升级

之前版本

只是记录了名称以及简单的方式，相比起来区别都不是很大

"2d807b8b8690ca9e": {
    "cve_id": "CVE-2026-29611",
    "app_name": "openclaw",
    "file_path": "code\\python\\CVE-2026-29611\\linux\\vuls.py",
    "detection_type": "version",
    "description": "openclaw 的版本漏洞检测脚本，通过获取版本并比较判断漏洞",
    "embedding": 17398274,
    "source_code": "#!/usr/bin/env python3\n# -*- coding: utf-8 -*-\n\n# name：CVE-2026-29611 openclaw Local file inclusion in BlueBubbles extension media path handling allowing arbitrary file read vulnerability scan script\n# developer：yao.junyi\n# date：2026-03-05\n# requirement from： ai opensource tools project \n\nimport os\nimport re\nimport sys\nimport subprocess\n\ntry:\n    plugin_dir = os.environ[\"SD_PLUGIN_DIR\"]\n    sys.path.append(plugin_dir)\n    from sd_vulcheck_util import print_vul\nexcept Exception as e:\n    def prin"
  },
  "2e930a7e9b5ba958": {
    "cve_id": "CVE-2026-29611",
    "app_name": "openclaw",
    "file_path": "code\\python\\CVE-2026-29611\\windows\\vuls.py",
    "detection_type": "version",
    "description": "openclaw 的版本漏洞检测脚本，通过获取版本并比较判断漏洞",
    "embedding": 17398274,
    "source_code": "#!/usr/bin/env python3\n# -*- coding: utf-8 -*-\n\n# name：CVE-2026-29611 openclaw Local file inclusion in BlueBubbles extension media path handling allowing arbitrary file read vulnerability scan script\n# developer：yao.junyi\n# date：2026-03-05\n# requirement from： ai opensource tools project \n\nimport os\nimport re\nimport sys\nimport subprocess\nimport psutil\n\ntry:\n    plugin_dir = os.environ[\"SD_PLUGIN_DIR\"]\n    sys.path.append(plugin_dir)\n    from sd_vulcheck_util import print_vul\nexcept Exception as e"
  },
  "620aedd18cf4b8f0": {
    "cve_id": "CVE-2026-29613",
    "app_name": "openclaw",
    "file_path": "code\\python\\CVE-2026-29613\\linux\\vuls.py",
    "detection_type": "version",
    "description": "openclaw 的版本漏洞检测脚本，通过获取版本并比较判断漏洞",
    "embedding": 17398274,
    "source_code": "#!/usr/bin/env python3\n# -*- coding: utf-8 -*-\n\n# name：CVE-2026-29613 openclaw BlueBubbles webhook authentication bypass via loopback remoteAddress without validating forwarding headers vulnerability scan script\n# developer：yao.junyi\n# date：2026-03-05\n# requirement from： ai opensource tools project \n\nimport os\nimport re\nimport sys\nimport subprocess\n\ntry:\n    plugin_dir = os.environ[\"SD_PLUGIN_DIR\"]\n    sys.path.append(plugin_dir)\n    from sd_vulcheck_util import print_vul\nexcept Exception as e:\n"
  },
  "31556e3cb9bcd9dd": {
    "cve_id": "CVE-2026-29613",
    "app_name": "openclaw",
    "file_path": "code\\python\\CVE-2026-29613\\windows\\vuls.py",
    "detection_type": "version",
    "description": "openclaw 的版本漏洞检测脚本，通过获取版本并比较判断漏洞",
    "embedding": 17398274,
    "source_code": "#!/usr/bin/env python3\n# -*- coding: utf-8 -*-\n\n# name：CVE-2026-29613 openclaw BlueBubbles webhook authentication bypass via loopback remoteAddress without validating forwarding headers vulnerability scan script\n# developer：yao.junyi\n# date：2026-03-05\n# requirement from： ai opensource tools project \n\nimport os\nimport re\nimport sys\nimport subprocess\nimport psutil\n\ntry:\n    plugin_dir = os.environ[\"SD_PLUGIN_DIR\"]\n    sys.path.append(plugin_dir)\n    from sd_vulcheck_util import print_vul\nexcept Ex"
  },

升级版本

"2d807b8b8690ca9e": {
    "cve_id": "CVE-2026-29611",
    "app_name": "openclaw",
    "file_path": "code\\python\\CVE-2026-29611\\linux\\vuls.py",
    "detection_methods": [
      "command_execution",
      "version_compare",
      "file_read"
    ],
    "vuln_type": "文件读取漏洞",
    "description": "通过执行本地系统命令获取运行信息，解析版本号并进行范围比对，读取本地文件或敏感路径，检测 openclaw 是否存在文件读取漏洞",
    "embedding": [

对于脚本范式更细化，description自然语言描述更详尽

**BAAI/bge-base-zh-v1.5大模型 embedding **

下载本地bge-base-zh-v1.5大模型

[Embedding] 加载模型中...
modules.json: 100%|███████████████████████████████████████████| 349/349 [00:00<?, ?B/s]
E:\python\Lib\site-packages\huggingface_hub\file_download.py:138: UserWarning: `huggingface_hub` cache-system uses symlinks by default to efficiently store duplicated files but your machine does not support them in C:\Users\毛鑫\.cache\huggingface\hub\models--BAAI--bge-base-zh-v1.5. Caching files will still work but in a degraded version that might require more space on your disk. This warning can be disabled by setting the `HF_HUB_DISABLE_SYMLINKS_WARNING` environment variable. For more details, see https://huggingface.co/docs/huggingface_hub/how-to-cache#limitations.
To support symlinks on Windows, you either need to activate Developer Mode or to run Python as an administrator. In order to activate developer mode, see this article: https://docs.microsoft.com/en-us/windows/apps/get-started/enable-your-device-for-development
  warnings.warn(message)
config_sentence_transformers.json: 100%|██████████████████████| 124/124 [00:00<?, ?B/s]
Warning: You are sending unauthenticated requests to the HF Hub. Please set a HF_TOKEN to enable higher rate limits and faster downloads.
README.md: 27.8kB [00:00, ?B/s]
sentence_bert_config.json: 100%|████████████████████████████| 52.0/52.0 [00:00<?, ?B/s]
config.json: 100%|████████████████████████████████████████████| 998/998 [00:00<?, ?B/s]
pytorch_model.bin: 100%|████████████████████████████| 409M/409M [00:49<00:00, 8.31MB/s]
Loading weights: 100%|████████████████████████████| 199/199 [00:00<00:00, 42253.04it/s]
BertModel LOAD REPORT from: BAAI/bge-base-zh-v1.5
Key                     | Status     |  | 
------------------------+------------+--+-
embeddings.position_ids | UNEXPECTED |  | 

Notes:
- UNEXPECTED:   can be ignored when loading from different task/architecture; not ok if you expect identical arch.
tokenizer_config.json: 100%|██████████████████████████████████| 366/366 [00:00<?, ?B/s]
vocab.txt: 110kB [00:00, 1.58MB/s]
tokenizer.json: 439kB [00:00, 3.76MB/s]                     | 0.00/409M [00:00<?, ?B/s]
special_tokens_map.json: 100%|████████████████████████████████| 125/125 [00:00<?, ?B/s]
config.json: 100%|████████████████████████████████████████████| 190/190 [00:00<?, ?B/s]
model.safetensors:   0%|                                    | 0.00/409M [00:01<?, ?B/s][Embedding] 模型加载完成|                                    | 0.00/409M [00:02<?, ?B/s]
                                                                                       [KB] 发现 1859 个脚本 0%|                                    | 0.00/409M [00:02<?, ?B/s]
                                                                                       [KB] 构建完成，共 1200 条                                    | 0.00/409M [00:02<?, ?B/s]
model.safetensors: 100%|████████████████████████████| 409M/409M [00:47<00:00, 8.63MB/s]
PS D:\test\llm-emergency-vuln-assistant> ███████████| 409M/409M [00:47<00:00, 11.8MB/s]

注：模型已经完全下载完之后建议你做一次“标准化重建”

python build_knowledge_base.py --rebuild

运行效果示例

"2d807b8b8690ca9e": {
    "cve_id": "CVE-2026-29611",
    "app_name": "openclaw",
    "file_path": "code\\python\\CVE-2026-29611\\linux\\vuls.py",
    "detection_methods": [
      "command_execution",
      "version_compare",
      "file_read"
    ],
    "vuln_type": "文件读取漏洞",
    "description": "通过执行本地系统命令获取运行信息，解析版本号并进行范围比对，读取本地文件或敏感路径，检测 openclaw 是否存在文件读取漏洞",
    "embedding": [
      0.01987263560295105,
      -0.016358204185962677,
      0.007940181531012058,
      -0.04110874608159065,
      0.007540833670645952,
      0.036570921540260315,
      0.01970956288278103,
      -0.03758487477898598,
      0.031437844038009644,
      -0.03676692023873329,
      -0.06373050808906555,
      -0.05553356185555458,
      -0.0054991478100419044,
      0.030623774975538254,
      -0.032830942422151566,
      0.0387096181511879,
      0.011489289812743664,
      0.06037498265504837,
      -0.04318652302026749,
      0.00961801316589117,
      -0.01658409833908081,
      -0.014977705664932728,
      0.01818319968879223,
      0.007002432830631733,
      -0.0038615039084106684,
      -0.03514004498720169,
      0.016030214726924896,
      0.027949390932917595,
      0.034169264137744904,
      0.014280891977250576,
      0.026773475110530853,
      0.07006227970123291,
      0.055975448340177536,
      0.001440133317373693,
      -0.009617356583476067,
      0.04975539445877075,
      -0.017849424853920937,
      0.024717044085264206,
      0.029393039643764496,
      0.0774129331111908,
      0.037138376384973526,
      -0.00604217266663909,
      0.04140979424118996,
      0.06042638048529625,
      -0.05372396484017372,
      -0.047939371317625046,
      -0.00015147795784287155,
      -0.00041725317714735866,
      0.013453216291964054,
      0.03320398926734924,
      -0.004482111893594265,
      0.1584514081478119,
      -0.011889253742992878,
      0.03609897568821907,
      -0.03630254045128822,
      0.061419181525707245,
      -0.0847838819026947,
      -0.033988673239946365,
      -0.039017047733068466,
      -0.05886521562933922,
      -0.04542988911271095,
      -0.00896872766315937,
      0.013996592722833157,
      -0.06381795555353165,
      0.002269387012347579,
      0.04865959286689758,
      -0.030883779749274254,
      -0.03597505763173103,
      -0.015904536470770836,
      0.0109191769734025,
      0.02550431340932846,
      -0.005378896836191416,
      -0.022114364430308342,
      -0.027914192527532578,
      0.043836016207933426,
      0.015601026825606823,
      -0.015302025713026524,
      -0.016288846731185913,
      -0.032765574753284454,
      -0.04025338590145111,
      -0.04222388193011284,
      0.01599504053592682,
      0.038535408675670624,
      -0.00033863200224004686,
      -0.03441252186894417,
      -0.010037718340754509,
      -0.0035351263359189034,
      0.009734805673360825,
      -0.03704303130507469,
      -0.032168708741664886,
      -0.04752111807465553,
      0.015187797136604786,
      0.005268735811114311,
      -0.04249701648950577,
      -0.021932275965809822,
      -0.0054806736297905445,
      0.009553899988532066,
      0.004286577925086021,
      0.029271969571709633,
      -0.001249943277798593,
      -0.004688886925578117,
      0.03905909135937691,
      -0.011039172299206257,
      0.023706994950771332,
      -0.03733626753091812,
      0.05082516372203827,
      0.03661201149225235,
      0.03977155312895775,
      0.013511824421584606,
      -0.013453030027449131,
      -0.008621836081147194,
      0.006410694681107998,
      0.026028525084257126,
      0.018009252846240997,
      0.02356059104204178,
      0.017870476469397545,
      -0.01823616772890091,
      -0.004513612482696772,
      -0.00043278143857605755,
      -0.029282037168741226,
      -0.00319181801751256,
      -0.0228195209056139,
      -0.01638716645538807,
      -0.06647129356861115,
      0.024592354893684387,
      -0.042123209685087204,
      -0.04732959344983101,
      0.005267690867185593,
      -0.005585858598351479,
      0.03559118136763573,
      -0.022879278287291527,
      -0.032537952065467834,
      -0.021791642531752586,
      -0.022843439131975174,
      -0.034074630588293076,
      0.04326057806611061,
      -0.01239998359233141,
      0.02309141866862774,
      -0.026433255523443222,
      -0.0056691556237638,
      -0.0071637677028775215,
      0.032712217420339584,
      -0.023233862593770027,
      -0.018043873831629753,
      -0.0519842803478241,
      -0.03569924458861351,
      -0.00301929609850049,
      -0.016523165628314018,
      0.022142987698316574,
      0.004554918967187405,
      -0.013048912398517132,
      0.05572295933961868,
      0.05453367903828621,
      -0.040385354310274124,
      -0.03483506292104721,
      -0.018829036504030228,
      -0.03270895406603813,
      0.04046017304062843,
      0.01320855226367712,
      -0.025629941374063492,
      -0.02936311811208725,
      0.005508952774107456,
      -0.03349429368972778,
      -0.029709577560424805,
      -0.021792365238070488,
      -0.052914783358573914,
      0.02096157893538475,
      0.018058765679597855,
      0.02493343874812126,
      -0.02347523532807827,
      0.00421397527679801,
      -0.023318322375416756,
      -0.016816414892673492,
      0.019034070894122124,
      0.078990638256073,
      -0.01294279657304287,
      -0.0025504494551569223,
      -0.0134512884542346,
      -0.0322289802134037,
      -0.0023547045420855284,
      -0.051580481231212616,
      -0.012745959684252739,
      0.004497779067605734,
      0.0474575012922287,
      -0.008411715738475323,
      0.04624810814857483,
      -0.029022416099905968,
      0.05745933577418327,
      -0.008913600817322731,
      0.010513926856219769,
      -0.0026756355073302984,
      -0.04078914225101471,
      -0.02135850116610527,
      0.015118931420147419,
      0.014591370709240437,
      0.007713303901255131,
      -0.008322298526763916,
      -0.0375959575176239,
      -0.0344972237944603,
      0.0033610365353524685,
      -0.01931714452803135,
      0.0024688958656042814,
      0.037312209606170654,
      0.07082655280828476,
      -0.029082665219902992,
      0.025341587141156197,
      0.017335081472992897,
      -0.006939839106053114,
      0.009411487728357315,
      0.04017764329910278,
      0.053567852824926376,
      0.01283348724246025,
      0.006016721948981285,
      0.05270116403698921,
      0.024215560406446457,
      0.002310981974005699,
      -0.05760173499584198,
      -0.011166092939674854,
      -0.0011224295012652874,
      -0.008821606636047363,
      -0.032109472900629044,
      -0.06147715076804161,
      0.027806509286165237,
      0.014294648543000221,
      0.013529432006180286,
      -0.025291219353675842,
      -0.02299659512937069,
      -0.00022943377553019673,
      -0.0330975316464901,
      -0.02091727964580059,
      -0.06620603054761887,
      0.01347446534782648,
      -0.018244370818138123,
      -0.017285749316215515,
      -0.001420267391949892,
      0.017589373514056206,
      0.03765563666820526,
      -0.006947596091777086,
      -0.027295075356960297,
      0.03666435927152634,
      -0.03521190583705902,
      -0.01054807472974062,
      0.029500812292099,
      -0.039638496935367584,
      -0.04638458788394928,
      0.008117321878671646,
      0.06624991446733475,
      -0.0021655100863426924,
      -0.01886800117790699,
      0.016159482300281525,
      0.019374454393982887,
      -0.006212148815393448,
      0.00605707336217165,
      0.025181936100125313,
      -0.03318558633327484,
      0.013249610550701618,
      0.07300446927547455,
      -0.00639714952558279,
      0.04227941855788231,
      0.02357945218682289,
      0.0184949804097414,
      -0.019062059000134468,
      0.04035618528723717,
      -0.007289957255125046,
      -0.06476892530918121,
      -0.020446939393877983,
      -0.03718826547265053,
      0.04119422659277916,
      -0.06034988909959793,
      0.03152475878596306,
      -0.024682139977812767,
      -0.0372576043009758,
      -0.040158119052648544,
      -0.042725156992673874,
      -0.07513460516929626,
      -0.03720325976610184,
      -0.031209053471684456,
      0.01924077980220318,
      0.015021801926195621,
      -0.003387808334082365,
      -0.043914299458265305,
      -0.01794501394033432,
      -0.014198152348399162,
      -0.00983421690762043,
      0.04409962147474289,
      -0.01887170597910881,
      0.0030088566709309816,
      0.031030848622322083,
      -0.014681104570627213,
      -0.03972344473004341,
      -0.052214719355106354,
      -0.02104903757572174,
      -0.003363753901794553,
      -0.009907805360853672,
      0.39640581607818604,
      -0.012878511101007462,
      0.012432679533958435,
      0.009030133485794067,
      -0.002308459021151066,
      0.03318536654114723,
      -0.03958436846733093,
      0.0015128487721085548,
      -0.06893909722566605,
      0.015674876049160957,
      -0.021488968282938004,
      0.061391573399305344,
      0.01405594777315855,
      -0.00133052421733737,
      -0.0029672165401279926,
      -0.03895137831568718,
      -0.012806132435798645,
      0.0317835733294487,
      0.026903225108981133,
      -0.02129780687391758,
      0.032445117831230164,
      -0.07185059785842896,
      -0.004283219575881958,
      -0.04867202416062355,
      -0.06816769391298294,
      -0.00875634141266346,
      0.01952257566154003,
      -0.05883031710982323,
      0.020574767142534256,
      -0.02264872007071972,
      0.046363115310668945,
      0.05134778097271919,
      -0.020246468484401703,
      0.046183276921510696,
      0.0012470330111682415,
      0.005992541089653969,
      0.012455734424293041,
      -0.011018181219696999,
      -0.018444834277033806,
      -0.038720689713954926,
      0.009539631195366383,
      0.054504234343767166,
      -0.003258497454226017,
      -0.0019237379310652614,
      -0.04138065129518509,
      -0.03522445634007454,
      -0.0037172071170061827,
      0.009300990961492062,
      -0.023687157779932022,
      -0.0406852625310421,
      -0.03904891014099121,
      0.057904306799173355,
      0.031135447323322296,
      -0.007789475377649069,
      -0.016042310744524002,
      -0.007284344639629126,
      -0.013346957974135876,
      -0.001422380330041051,
      -0.0028803329914808273,
      -0.08689187467098236,
      0.019008111208677292,
      -0.006570361088961363,
      -0.06445346772670746,
      0.037034984678030014,
      0.02405184507369995,
      0.03328491374850273,
      0.049039099365472794,
      -0.004177147056907415,
      -0.05276602506637573,
      -0.06556673347949982,
      -0.04528767243027687,
      0.04313542693853378,
      0.000680065480992198,
      0.059178438037633896,
      -0.050714220851659775,
      -0.06026703864336014,
      0.052498139441013336,
      -0.00255047925747931,
      0.051630113273859024,
      -0.013943271711468697,
      -0.0733303651213646,
      -0.003453668439760804,
      -0.003429944859817624,
      -0.0008251718827523291,
      0.053120922297239304,
      -0.02438252419233322,
      -0.05072576552629471,
      0.05968650057911873,
      -0.03109932690858841,
      0.031963199377059937,
      -0.022962497547268867,
      0.024764640256762505,
      0.007248043082654476,
      -0.05455922335386276,
      -0.010239892639219761,
      -0.03111487440764904,
      -0.01590118557214737,
      -0.014762572944164276,
      -0.016070298850536346,
      -0.0101200295612216,
      -0.019859522581100464,
      -0.013790476135909557,
      -0.029100682586431503,
      -0.004984752275049686,
      0.025728724896907806,
      -0.005196918733417988,
      0.027981603518128395,
      -0.01764763705432415,
      0.03794368356466293,
      -0.0021927638445049524,
      -0.01834871619939804,
      -0.08102681487798691,
      0.016146529465913773,
      0.03692585229873657,
      0.002133585512638092,
      -0.008288226090371609,
      0.027684682980179787,
      -0.011860889382660389,
      -0.06358069181442261,
      -0.008269848302006721,
      0.03372921794652939,
      -0.03909434378147125,
      -0.0576905831694603,
      0.051608193665742874,
      0.09489841759204865,
      -0.007364328019320965,
      0.024036161601543427,
      0.07753545045852661,
      -0.026223596185445786,
      -0.037259381264448166,
      -0.021996021270751953,
      0.04155105724930763,
      -0.007068505045026541,
      -0.033996209502220154,
      0.0031217013020068407,
      0.034579623490571976,
      0.010291400365531445,
      -0.00010532639134908095,
      0.01551679614931345,
      0.030012894421815872,
      0.0006544122588820755,
      -0.04447881877422333,
      -0.01868031919002533,
      0.013674890622496605,
      -0.01981372758746147,
      -0.056735873222351074,
      -0.03570780158042908,
      -0.030229145660996437,
      0.051460716873407364,
      0.011701675131917,
      0.01831652782857418,
      0.01925613544881344,
      0.044226378202438354,
      0.012568909674882889,
      0.0011061383411288261,
      0.07952244579792023,
      -0.04134354740381241,
      0.021054383367300034,
      -0.03925519809126854,
      -0.02009127102792263,
      0.029160942882299423,
      -0.007127717602998018,
      0.0021192985586822033,
      0.023328961804509163,
      -0.0016036253655329347,
      -0.011209030635654926,
      0.0041342140175402164,
      -0.02451179549098015,
      0.026032838970422745,
      0.02229488268494606,
      -0.03731311485171318,
      0.019038870930671692,
      0.053947143256664276,
      0.033632196485996246,
      0.040015559643507004,
      -0.04402190074324608,
      0.01111505925655365,
      -0.006285662762820721,
      0.007147306576371193,
      -0.00172130367718637,
      -0.081767737865448,
      -0.012385171838104725,
      0.03257116675376892,
      0.03750811144709587,
      -0.05330260843038559,
      -0.03143240883946419,
      0.059126146137714386,
      -0.00040166484541259706,
      0.01972389779984951,
      -0.02459430880844593,
      -0.032074376940727234,
      0.0004272300866432488,
      -0.025263464078307152,
      -0.012619086541235447,
      0.017125960439443588,
      -0.0069818198680877686,
      0.005916133057326078,
      -0.04799891263246536,
      0.08747277408838272,
      -0.04460439458489418,
      0.05851498246192932,
      -0.01798592135310173,
      0.014430432580411434,
      0.004567989148199558,
      0.002245859708636999,
      0.004442151635885239,
      0.013255447149276733,
      -0.018344581127166748,
      0.05777682363986969,
      -0.016878867521882057,
      0.03577735647559166,
      0.038689449429512024,
      -0.02756374515593052,
      -0.026394080370664597,
      0.021142136305570602,
      -0.006564691662788391,
      0.02658579871058464,
      0.017229488119482994,
      0.006843773648142815,
      0.026705168187618256,
      0.0054273903369903564,
      -0.026005307212471962,
      0.012700317427515984,
      0.006658155936747789,
      0.002051750896498561,
      0.06516611576080322,
      0.015102911740541458,
      -0.021945999935269356,
      0.04788005352020264,
      0.017114566639065742,
      -0.011354413814842701,
      0.04906611517071724,
      -0.017131252214312553,
      0.004995076451450586,
      -0.029013078659772873,
      0.028291992843151093,
      0.012668254785239697,
      -0.04985230416059494,
      -0.060883183032274246,
      0.0034599045757204294,
      0.00485468003898859,
      -0.011026826687157154,
      -0.003532053204253316,
      -0.06518550962209702,
      -0.014127618633210659,
      0.02366168424487114,
      -0.03894064947962761,
      -0.0014500560937449336,
      0.010586746968328953,
      -0.062435250729322433,
      0.039109960198402405,
      -0.00031908598612062633,
      -0.025677001103758812,
      -0.009860511869192123,
      0.012094259262084961,
      -0.020408818498253822,
      0.014826822094619274,
      -0.033820103853940964,
      0.02942615933716297,
      -0.04790399223566055,
      -0.06369300186634064,
      -0.039593204855918884,
      -0.04320941120386124,
      0.05576082319021225,
      0.03485507518053055,
      -0.00962921604514122,
      -0.02134149707853794,
      0.013378476724028587,
      -0.01500057801604271,
      -0.03262455388903618,
      -0.045334260910749435,
      -0.0009911403758451343,
      -0.008329798467457294,
      -0.014553315937519073,
      0.047523271292448044,
      -0.03082733042538166,
      -0.0022337683476507664,
      0.008183225989341736,
      0.009042252786457539,
      0.020932141691446304,
      0.030753934755921364,
      0.0006878303247503936,
      0.029978875070810318,
      -0.028329282999038696,
      0.022304227575659752,
      -0.06054997816681862,
      0.019750909879803658,
      -0.03383224830031395,
      -0.04125821217894554,
      0.013182098045945168,
      -0.03145238757133484,
      -0.011360828764736652,
      -0.01882060617208481,
      -0.008367517963051796,
      -0.014931919984519482,
      -0.0557863712310791,
      -0.03453375771641731,
      0.0020750148687511683,
      -0.024281857535243034,
      0.011159316636621952,
      -0.03170043230056763,
      -0.02430710382759571,
      -0.0182142723351717,
      0.06060357764363289,
      -0.04080120101571083,
      0.05288882181048393,
      0.05619101598858833,
      -0.03006366826593876,
      0.01629575528204441,
      0.01051863469183445,
      0.014596990309655666,
      -0.07570084184408188,
      0.006266158539801836,
      -0.002725101774558425,
      0.05794399976730347,
      0.02667575143277645,
      0.053826943039894104,
      0.03243028372526169,
      -0.028178978711366653,
      0.08541052043437958,
      -0.018246812745928764,
      -0.03337149694561958,
      -0.019647326320409775,
      -0.005005276296287775,
      0.014611899852752686,
      -0.006403390318155289,
      0.0015316499629989266,
      -0.014982080087065697,
      0.010994051583111286,
      -0.045303065329790115,
      -0.028095977380871773,
      0.005558383651077747,
      0.021324414759874344,
      0.028976313769817352,
      -0.036005761474370956,
      -0.04541633278131485,
      -0.0021876369137316942,
      0.02185758575797081,
      0.014962379820644855,
      0.04035532847046852,
      0.0025434677954763174,
      0.010582178831100464,
      0.03962383046746254,
      -0.013638462871313095,
      -0.0038553359918296337,
      0.006744203623384237,
      0.0008153977105394006,
      -0.05917658284306526,
      -0.00533562246710062,
      -0.05274243652820587,
      0.013135096058249474,
      -0.027703765779733658,
      -0.02010347880423069,
      -0.0019448051461949944,
      0.06542429327964783,
      -0.0012916295090690255,
      -0.04821149259805679,
      -0.01866767928004265,
      0.061540067195892334,
      0.00012072426761733368,
      0.006956796627491713,
      0.009751381352543831,
      -0.0028692157939076424,
      -0.011250652372837067,
      -0.036332905292510986,
      0.043793339282274246,
      -0.015218238346278667,
      0.011046817526221275,
      -0.020497435703873634,
      -0.03269136697053909,
      -0.020722271874547005,
      -0.0293232724070549,
      0.016952961683273315,
      0.03659273684024811,
      0.07638159394264221,
      0.0017497799126431346,
      -0.054386455565690994,
      0.054691117256879807,
      -0.010669109411537647,
      -0.05995041877031326,
      0.0427766889333725,
      0.04570365697145462,
      0.016941171139478683,
      0.04173927754163742,
      0.009598934091627598,
      -0.01905297301709652,
      0.0020877381321042776,
      0.019132614135742188,
      0.052908726036548615,
      -0.018164684996008873,
      0.014221041463315487,
      -0.060826580971479416,
      -0.010551162995398045,
      -0.002949418965727091,
      -0.02766607701778412,
      -0.023920565843582153,
      0.044247817248106,
      0.0357513464987278,
      -0.030411282554268837,
      -0.04255363717675209,
      0.010339486412703991,
      0.09692554175853729,
      0.04455987736582756,
      -0.009856510907411575,
      -0.006778087932616472,
      -0.015910087153315544,
      0.0203482024371624,
      0.007850169204175472,
      -0.04116113856434822,
      -0.023624103516340256,
      -0.006892566569149494,
      -0.048788610845804214,
      0.007520047947764397,
      0.025263193994760513,
      -0.014475810341536999,
      -0.04677547514438629,
      -0.006613471545279026,
      0.025815751403570175,
      0.020963160321116447,
      0.010756347328424454,
      0.03168223425745964,
      0.004907552152872086,
      0.021975373849272728,
      0.03636299446225166,
      0.04148559644818306,
      -0.016545385122299194,
      0.04518134519457817,
      -0.00992230512201786,
      0.013194684870541096,
      -0.000989637803286314,
      0.037125445902347565,
      0.05008269101381302,
      -0.06723280251026154,
      0.0042467196471989155,
      0.022844772785902023,
      -0.034689415246248245,
      -0.07679678499698639,
      -0.008541637100279331,
      -0.046978119760751724,
      -0.010506329126656055,
      -0.009300983510911465,
      0.028654150664806366,
      -0.03787294402718544,
      -0.025639105588197708,
      -0.010623623616993427,
      -0.03121323138475418,
      -0.06750474125146866,
      0.0023860493674874306,
      0.01775227300822735,
      0.029111327603459358,
      0.053528688848018646,
      -0.00762192253023386,
      -0.004681244492530823,
      0.021984770894050598,
      -0.0012556734727695584,
      -0.01724458672106266,
      0.009986281394958496,
      -0.031036173924803734,
      -0.028582176193594933,
      0.016181640326976776,
      0.005440433043986559,
      -0.005497071426361799,
      -0.030409816652536392,
      -0.010565652512013912,
      -0.0027616387233138084,
      -0.041454821825027466,
      0.03747370466589928,
      -0.009885281324386597,
      -0.02244817093014717,
      0.03215127810835838,
      0.053659431636333466,
      -0.004461102653294802,
      -0.006425844039767981,
      0.038453828543424606
    ]
  },

模型关键参数

Cosine Similarity （余弦相似度）

相似度查找方式

对于大模型查找到的漏洞信息进行同样的词向量化处理

之后根据余弦相似度查找参考内容

由于构建阶段和检索阶段都使用了 normalize_embeddings=True，所有向量的模长已经是 1，因此：

即：归一化后的 Cosine Similarity 等价于 Dot Product（点积）

之后进行过滤与排序列出参考的脚本

效果示例

[*] AI Agent SDK
  OpenAI / Anthropic Protocol Support

  Type /help for commands, or enter text to chat
  ● 4 tools loaded, use /tools to manage
  ● 4 skills active, use /skills to manage

╭──────────────────────────────────────────────────────────────────╮
│ ● ark-latest (ark-code-latest)                                   │
╰──────────────────────────────────────────────────────────────────╯

    cve_retriever: initialized
  ▶ 查询CVE-2026-24734  

  thinking...
  vuln_analysis query CVE-2026-24734
    hit: CVE-2026-24734 (0.0 days)

  ~ vuln_analysis action=query cve_id=CVE-2026-24734
  ✓ cve_id=CVE-2026-24734
  thinking...
## CVE-2026-24734 详细信息

### 📝 漏洞描述

**漏洞类型**: 不正确的输入验证 (Improper Input Validation)  
**影响组件**: Apache Tomcat Native 和 Apache Tomcat  
**发布日期**: 2026-02-17  
**最后修改**: 2026-03-11  

当使用 OCSP 响应器时，Tomcat Native（以及 Tomcat 的 FFM 端口的 Tomcat Native 代码）没有对 OCSP 响应完成验证或新鲜性检查，这可能导致证书撤销被绕过。

---

### 🎯 受影响版本

**Apache Tomcat Native**:
- 从 `1.3.0` 到 `1.3.4`
- 从 `2.0.0` 到 `2.0.11`
- 已停止维护 (EOL) 版本: 从 `1.1.23` 到 `1.1.34`，从 `1.2.0` 到 `1.2.39`

**Apache Tomcat**:
- 从 `11.0.0-M1` 到 `11.0.17`
- 从 `10.1.0-M7` 到 `10.1.51`
- 从 `9.0.83` 到 `9.0.114`

---

### ✅ 修复建议

**Apache Tomcat Native 用户**:
- 升级到 `1.3.5` 或更高版本
- 或者升级到 `2.0.12` 或更高版本

**Apache Tomcat 用户**:
- 升级到 `11.0.18` 或更高版本
- 或者升级到 `10.1.52` 或更高版本  
- 或者升级到 `9.0.115` 或更高版本

---

### 🔍 CVSS 评分

- **向量**: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`
- **严重性**: 高严重性 (预计评分 7.5)
- **CWE**: CWE-20 (输入验证不当)

---

是否需要我为这个漏洞生成**检测脚本**并进行沙箱验证？

  ▶ 生成该漏洞的检测脚本

  thinking...

  ~ vuln_analysis action=check_script cve_id=CVE-2026-24734
  ✓ cve_id=CVE-2026-24734, exists=N
  thinking...
    hit: CVE-2026-24734 (0.0 days)
    app_type: maven_jar, detection=process_port_check
  vuln_analysis rag_retrieval CVE CVE-2026-24734
    rag_embedding_text: 为漏洞检测生成语义表示: 漏洞检测; 应用:tomcat; 漏洞类型:通用漏洞; 检测方法:version_compare; Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat&a...
Warning: You are sending unauthenticated requests to the HF Hub. Please set a HF_TOKEN to enable higher rate limits and faster downloads.
Loading weights: 100%|██████████████████████████████████████████████████████| 199/199 [00:00<00:00, 45359.84it/s]
BertModel LOAD REPORT from: BAAI/bge-base-zh-v1.5
Key                     | Status     |  | 
------------------------+------------+--+-
embeddings.position_ids | UNEXPECTED |  | 

Notes:
- UNEXPECTED:   can be ignored when loading from different task/architecture; not ok if you expect identical arch.
    + rag_search: found 5 similar codes
    rag_references: ==================================================
    ref_1: app=Apache_Tomcat, cve=CVE-2020-17527, sim=0.8133, dir=code\python\CVE-2020-17527\windows
    ref_2: app=Tomcat, cve=CVE-2017-12615, sim=0.8064, dir=code\python\CVE-2017-12615\windows
    ref_3: app=Tomcat, cve=CVE-2017-12617, sim=0.8064, dir=code\python\CVE-2017-12617\windows
    ref_4: app=Tomcat, cve=CVE-2020-1938, sim=0.8064, dir=code\python\CVE-2020-1938\windows
    ref_5: app=Tomcat, cve=CVE-2021-30639, sim=0.8064, dir=code\python\CVE-2021-30639\windows
    rag_references: ==================================================
    rag_refs_injected: 注入 5 条向量检索参考脚本
RAG 增强生成第 1 次验证失败：语法错误: invalid syntax (line 324)，进行第 2 次尝试...

  ~ vuln_analysis action=generate cve_id=CVE-2026-24734
  ✓ cve_id=CVE-2026-24734
  thinking...
✅ **CVE-2026-24734 检测脚本已成功生成！**

---

### 📁 生成信息

| 项目 | 详情 |
|------|------|
| **CVE ID** | CVE-2026-24734 |
| **应用类型** | Maven JAR (Java/Tomcat) |
| **检测方式** | 进程端口检测 + 版本比对 |
| **参考代码** | 检索到 5 个相似 Tomcat 漏洞检测脚本（相似度 ~0.81） |
| **Linux 脚本路径** | `code\python\CVE-2026-24734\linux\vuls.py` |
| **Windows 脚本路径** | `code\python\CVE-2026-24734\windows\vuls.py` |
| **语法验证** | Linux ✅ 通过 / Windows ✅ 通过 |

---

### 🔍 检测原理

该脚本通过以下方式检测漏洞：
1. 枚举系统中 Java 进程
2. 从进程内存映射中定位 Tomcat 的 JAR 文件
3. 从 JAR 文件的 `MANIFEST.MF` 或 `pom.properties` 提取版本信息
4. 与受影响版本范围进行比对，判断是否存在漏洞

---

### 🧪 是否需要在沙箱中验证脚本的有效性？

我可以启动 Docker 容器搭建漏洞环境，运行该检测脚本验证其正确性。是否需要进行验证？

代码对比

旧版本效果

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

# name：CVE-2026-24734 tomcat Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed. This issue affects Apache Tomcat Native: from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114. The following versions were EOL at the time the CVE was created but are known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected. Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue. Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue. vulnerability scan script
# developer：yao.junyi
# date：2026-04-22
# requirement from：

import os
import re
import sys
import glob
from zipfile import ZipFile
from collections import namedtuple
import subprocess

if not sys.platform.startswith("linux"):
    import psutil  # noqa

try:
    plugin_dir = os.environ["SD_PLUGIN_DIR"]
    sys.path.append(plugin_dir)
    from sd_vulcheck_util import print_vul
except Exception as e:
    def print_vul(vul_id, app_name, script_name, **kwargs):
        if not isinstance(vul_id, (list, tuple, set)):
            vul_id = (vul_id,)
        vul_id = list(set(vul_id))
        app_name = app_name.strip()
        script_name = script_name.strip()
        print("{} {} {}".format(app_name, "|".join(vul_id), script_name))

# op 表示版本比较方法，可选值为
#  <  JAR 包版本小于 version
#  <= JAR 包版本小于等于 version
#  >  JAR 包版本大于 version
#  >= JAR 包版本大于 version
#  == JAR 包版本等于 version
#  in 此时 version 为二元元组，表示 JAR 包版本介于元组中的版本
#  regex 正则表达式
jar_vul = namedtuple("jar_vul", ("vlu_id", "op", "version"))
script_name = os.path.basename(__file__)
app_name = "tomcat"
vuls_db = {
    re.compile("catalina[0-9a-zA-Z_.-]*\\.jar$"): [
        jar_vul("CVE-2026-24734", "in", ("1.1.23", "1.1.34")),
        jar_vul("CVE-2026-24734", "in", ("1.2.0", "1.2.39")),
        jar_vul("CVE-2026-24734", "in", ("1.3.0", "1.3.4")),
        jar_vul("CVE-2026-24734", "in", ("2.0.0", "2.0.11")),
        jar_vul("CVE-2026-24734", "in", ("11.0.0-M1", "11.0.17")),
        jar_vul("CVE-2026-24734", "in", ("10.1.0-M7", "10.1.51")),
        jar_vul("CVE-2026-24734", "in", ("9.0.83", "9.0.114"))
    ]
}

class JarVulscanBase:
    JAR_VERSION_PATTEN = re.compile(r"(\d+**\.**)+\d+")

    MANIFEST_VERSION_PATTEN = [(re.compile(r"Implementation-Version:"),
                                re.compile(r"(\d+**\.**|\d+**\_**)+[0-9a-zA-Z]+")),
                               (re.compile(r"Bundle-Version:"),
                                re.compile(r"(\d+**\.**|\d+**\_**)+[0-9a-zA-Z]+"))]

    MAVEN_POM_PATTEN = re.compile("META-INF/maven/.*/pom.properties")

    MAVEN_VERSION_PAETTEN = [(re.compile("version="),
                              re.compile(r"(\d+**\.**|\d+**\_**)+\d+"))]

    def __init__(self):
        self.report = {}
        self.find_in_process = False
        self.checked_memo = set()
        self.version = ''
        self.version2 = ''
        self.path2=''
        self.path = ''

    # 枚举进程
    def enumerate_proc(self):
        raise NotImplementedError()

    # 从 @pid 下查找 jar 包路径
    def find_jar_library_from_pid(self, pid):
        raise NotImplementedError()

    # 通过 @pid 筛选所需的 jar 包
    def filter_jar_library(self, pid=None):
        if pid is not None:
            for library_path in self.find_jar_library_from_pid(pid):
                if library_path in self.checked_memo:
                    continue

                self.checked_memo.add(library_path)
                for patten, vuls_info in vuls_db.items():
                    if patten.match(os.path.basename(library_path)):
                        yield (library_path, vuls_info)
        else:
            for patten, vuls_info in vuls_db.items():
                cmd = ["locate", "-e", "--regex", "/" + patten.pattern]
                result = subprocess.run(cmd, stdout=subprocess.PIPE,
                                        stderr=subprocess.DEVNULL,
                                        timeout=600)
                for line in result.stdout.decode().split("\n"):
                    library_path = line.strip()
                    if library_path:
                        yield (library_path, vuls_info)

    # 获取 @jar_path 对应 jar 包的版本
    def detect_jar_version(self, jar_path):
        def detect(zfile, name, pattens):
            try:
                if not isinstance(name, str):
                    search_patten = name
                    name = None
                    for zip_name in zfile.namelist():
                        if search_patten.search(zip_name):
                            name = zip_name
                            break

                if not name or name not in zfile.namelist():
                    return None

                with zfile.open(name, "r") as file:
                    for line in file.readlines():
                        line = line.decode().strip()
                        if not line:
                            continue
                        for field, ver in pattens:
                            if field.search(line):
                                match = ver.search(line)
                                if match:
                                    return match.group(0)
            except:  # noqa:E501
                pass
            return None

        with ZipFile(jar_path, mode="r") as zfile:
            # 1. 从 META-INF/MANIFEST.MF 中提取 Implementation-Version
            #    或 Bundle-Version 所对应的版本
            version = detect(zfile, "META-INF/MANIFEST.MF",
                             self.MANIFEST_VERSION_PATTEN)
            # 2. 从文件名中提取 jar 版本
            if not version:
                match = self.JAR_VERSION_PATTEN.search(
                    os.path.basename(jar_path))
                if match:
                    version = match.group(0)
            # 3. 从 maven 打包文件中提起
            if not version:
                version = detect(zfile, self.MAVEN_POM_PATTEN,
                                 self.MAVEN_VERSION_PAETTEN)
            return version

    # 检查 java 进程下的 jar 包是否存在漏洞
    def check(self, pid):
        def version_cmp(vera, verb):
            vera = re.sub(r'(-|_)', '.', vera)

            # if vera == verb:
            #    return 0
            if re.search(r'alpha|beta|rc', vera):
                vera = re.sub(r'alpha|beta|rc', '', vera)
                if vera == verb:
                    return -1

            vera = vera.split(".")
            verb = verb.split(".")

            while len(vera) > len(verb):
                verb.append('0')
            while len(verb) > len(vera):
                vera.append('0')
            if vera == verb:
                return 0
            def int_try_parse(param):
                if param.isdigit():
                    return [int(param)*128]
                result = ""
                parts = []

                for _, ch in enumerate(param):
                    if ch.isdigit():
                        result += ch
                    else:
                        if result:
                            parts.append(int(result)*128)
                            result = ""
                        parts.append(ord(ch))
                if result:
                    parts.append(int(result)*128)
                return parts

            for n in range(len(vera)):
                vera_parts = int_try_parse(vera[n])
                verb_parts = int_try_parse(verb[n])

                while len(vera_parts) > len(verb_parts):
                    verb_parts.append(0)
                while len(verb_parts) > len(vera_parts):
                    vera_parts.append(0)
                if vera_parts > verb_parts:
                    return 1
                elif vera_parts < verb_parts:
                    return -1

        for library_path, jar_vuls in self.filter_jar_library(pid):
            if pid is not None:
                self.find_in_process = True
            self.version = self.detect_jar_version(library_path)
            self.path = os.path.dirname(library_path)
            for vul in jar_vuls:
                find = False
                try:
                    if vul.op == "<":
                        if version_cmp(self.version, vul.version) < 0:
                            find = True
                    elif vul.op == "<=":
                        if version_cmp(self.version, vul.version) <= 0:
                            find = True
                    elif vul.op == ">":
                        if version_cmp(self.version, vul.version) > 0:
                            find = True
                    elif vul.op == ">=":
                        if version_cmp(self.version, vul.version) >= 0:
                            find = True
                    elif vul.op == "==":
                        find = self.version == vul.version
                    elif vul.op == "in":
                        if version_cmp(self.version, vul.version[0]) >= 0 and version_cmp(self.version, vul.version[1]) <= 0:
                            find = True
                except:
                    continue

                if find:
                    self.version2 = self.version
                    self.path2 = self.path
                    app_name = os.path.basename(library_path)
                    if app_name not in self.report.keys():
                        self.report[app_name] = set()
                    self.report[app_name].add(vul.vlu_id)

    def run(self):
        for pid in self.enumerate_proc():
            try:
                self.check(pid)
            except:
                pass

        if sys.platform.startswith("linux"):
            if not self.find_in_process:
                self.check(None)

        for _, vlu_ids in self.report.items():
            return (vlu_ids, self.version2, self.path2)

class LinuxJarVulscan(JarVulscanBase):
    # 枚举进程
    def enumerate_proc(self):
        patten = re.compile("^java$")

        for path in glob.iglob("/proc/[0-9]*"):
            try:
                exe_path = os.readlink(os.path.join(path, "exe"))
                name = os.path.basename(exe_path)
                if not os.path.exists(exe_path):
                    continue
                if patten.search(name):
                    yield int(os.path.basename(path))
            except:
                pass

    # 从 @pid 下查找 jar 包路径
    def find_jar_library_from_pid(self, pid):
        with open("/proc/%d/maps" % pid, "r") as file:
            for line in file.readlines():
                try:
                    parts = line = line.strip().split()
                    if not parts or not parts[-1].endswith(".jar"):
                        continue
                    if os.path.exists(parts[-1]):
                        yield parts[-1]
                except:
                    pass

class WindowsJarVulscan(JarVulscanBase):
    # 通过规则 @patten 枚举进程
    def enumerate_proc(self):
        name_pattern = re.compile(r"^java**\.**exe$", re.I)
        pid_list = psutil.pids()
        for pid in pid_list:
            try:
                process = psutil.Process(pid)
                if process:
                    if name_pattern.search(process.name()):
                        yield pid
            except:
                continue

    # 从 @pid 下查找 jar 包路径
    def find_jar_library_from_pid(self, pid):
        try:
            process = psutil.Process(int(pid))
            if process:
                for file in process.open_files():
                    if file.path.endswith(".jar"):
                        yield file.path
        except:
            pass

JarVulscan = LinuxJarVulscan if sys.platform.startswith(
    "linux") else WindowsJarVulscan

def main():
    try:
        vul_id, version, path = JarVulscan().run()
        print_vul(vul_id, app_name, script_name, app_path = path, version = version )
    except:
        pass

if __name__ == "__main__":
    main()

新版本效果

import os
import re
import sys
import glob
from zipfile import ZipFile
from collections import namedtuple
import subprocess

if not sys.platform.startswith("linux"):
    import psutil  # noqa

try:
    plugin_dir = os.environ["SD_PLUGIN_DIR"]
    sys.path.append(plugin_dir)
    from sd_vulcheck_util import print_vul
except Exception as e:
    def print_vul(vul_id, app_name, script_name, **kwargs):
        if not isinstance(vul_id, (list, tuple, set)):
            vul_id = (vul_id,)
        vul_id = list(set(vul_id))
        app_name = app_name.strip()
        script_name = script_name.strip()
        print("{} {} {}".format(app_name, "|".join(vul_id), script_name))

# op 表示版本比较方法，可选值为
#  <  JAR 包版本小于 version
#  <= JAR 包版本小于等于 version
#  >  JAR 包版本大于 version
#  >= JAR 包版本大于 version
#  == JAR 包版本等于 version
#  in 此时 version 为二元元组，表示 JAR 包版本介于元组中的版本
#  regex 正则表达式
jar_vul = namedtuple("jar_vul", ("vlu_id", "op", "version"))
script_name = os.path.basename(__file__)
vul_id = ["CVE-2026-24734"]
app_name = "tomcat"
vuls_db = {
    re.compile("tomcat.*\\.jar$"): [
        jar_vul("CVE-2026-24734", "in", ("1.1.23", "1.1.34")),
        jar_vul("CVE-2026-24734", "in", ("1.2.0", "1.2.39")),
        jar_vul("CVE-2026-24734", "in", ("1.3.0", "1.3.4")),
        jar_vul("CVE-2026-24734", "in", ("2.0.0", "2.0.11")),
        jar_vul("CVE-2026-24734", "in", ("11.0.0-M1", "11.0.17")),
        jar_vul("CVE-2026-24734", "in", ("10.1.0-M7", "10.1.51")),
        jar_vul("CVE-2026-24734", "in", ("9.0.83", "9.0.114"))
    ]
}

class JarVulscanBase:
    JAR_VERSION_PATTEN = re.compile(r"(\d+**\.**)+\d+")

    MANIFEST_VERSION_PATTEN = [(re.compile(r"Implementation-Version:"),
                                re.compile(r"(\d+**\.**|\d+**\_**)+\d+")),
                               (re.compile(r"Bundle-Version:"),
                                re.compile(r"(\d+**\.**|\d+**\_**)+\d+"))]

    MAVEN_POM_PATTEN = re.compile("META-INF/maven/.*/pom.properties")

    MAVEN_VERSION_PAETTEN = [(re.compile("version="),
                              re.compile(r"(\d+**\.**|\d+**\_**)+\d+"))]

    def __init__(self):
        self.report = {}
        self.find_in_process = False
        self.checked_memo = set()
        self.version = '' 
        self.version2 = '' 
        self.path2=''
        self.path = ''

    # 枚举进程
    def enumerate_proc(self):
        raise NotImplementedError()

    # 从 @pid 下查找 jar 包路径
    def find_jar_library_from_pid(self, pid):
        raise NotImplementedError()

    # 通过 @pid 筛选所需的 jar 包
    def filter_jar_library(self, pid=None):
        if pid is not None:
            for library_path in self.find_jar_library_from_pid(pid):
                if library_path in self.checked_memo:
                    continue

                self.checked_memo.add(library_path)
                for patten, vuls_info in vuls_db.items():
                    if patten.match(os.path.basename(library_path)):
                        yield (library_path, vuls_info)
        else:
            for patten, vuls_info in vuls_db.items():
                cmd = ["locate", "-e", "--regex", "/" + patten.pattern]
                result = subprocess.run(cmd, stdout=subprocess.PIPE,
                                        stderr=subprocess.DEVNULL,
                                        timeout=600)
                for line in result.stdout.decode().split("\n"):
                    library_path = line.strip()
                    if library_path:
                        yield (library_path, vuls_info)

    # 获取 @jar_path 对应 jar 包的版本
    def detect_jar_version(self, jar_path):
        def detect(zfile, name, pattens):
            try:
                if not isinstance(name, str):
                    search_patten = name
                    name = None
                    for zip_name in zfile.namelist():
                        if search_patten.search(zip_name):
                            name = zip_name
                            break

                if not name or name not in zfile.namelist():
                    return None

                with zfile.open(name, "r") as file:
                    for line in file.readlines():
                        line = line.decode().strip()
                        if not line:
                            continue
                        for field, ver in pattens:
                            if field.search(line):
                                match = ver.search(line)
                                if match:
                                    return match.group(0)
            except:  # noqa:E501
                pass
            return None

        with ZipFile(jar_path, mode="r") as zfile:
            # 1. 从 META-INF/MANIFEST.MF 中提取 Implementation-Version
            #    或 Bundle-Version 所对应的版本
            version = detect(zfile, "META-INF/MANIFEST.MF",
                             self.MANIFEST_VERSION_PATTEN)
            # 2. 从文件名中提取 jar 版本
            if not version:
                match = self.JAR_VERSION_PATTEN.search(
                    os.path.basename(jar_path))
                if match:
                    version = match.group(0)
            # 3. 从 maven 打包文件中提起
            if not version:
                version = detect(zfile, self.MAVEN_POM_PATTEN,
                                 self.MAVEN_VERSION_PAETTEN)
            return version

    # 检查 java 进程下的 jar 包是否存在漏洞
    def check(self, pid):
        def version_cmp(vera, verb):

            vera = re.sub(r'(-|_)', '.', vera)

            if vera == verb:
                return 0
            if re.search(r'alpha|beta|rc', vera):
                vera = re.sub(r'alpha|beta|rc', '', vera)
                if vera == verb:
                    return -1

            vera = vera.split(".")
            verb = verb.split(".")

            while len(vera) > len(verb):
                verb.append('0')
            while len(verb) > len(vera):
                vera.append('0')   
            if vera == verb:
                return 0
            def int_try_parse(param):
                if param.isdigit():
                    return [int(param)*128]
                result = ""
                parts = []

                for _, ch in enumerate(param):
                    if ch.isdigit():
                        result += ch
                    else:
                        if result:
                            parts.append(int(result)*128)
                            result = ""
                        parts.append(ord(ch))
                if result:
                    parts.append(int(result)*128)
                return parts

            for n in range(len(vera)):

                vera_parts = int_try_parse(vera[n])
                verb_parts = int_try_parse(verb[n])

                while len(vera_parts) > len(verb_parts):
                    verb_parts.append(0)
                while len(verb_parts) > len(vera_parts):
                    vera_parts.append(0)            
                if vera_parts > verb_parts:
                    return 1
                elif vera_parts < verb_parts:
                    return -1

        for library_path, jar_vuls in self.filter_jar_library(pid):
            if pid is not None:
                self.find_in_process = True
            self.version = self.detect_jar_version(library_path)
            self.path = os.path.dirname(library_path)
            for vul in jar_vuls:
                find = False
                try:
                    if vul.op == "<":
                        if version_cmp(self.version, vul.version) < 0:
                            find = True
                    elif vul.op == "<=":
                        if version_cmp(self.version, vul.version) <= 0:
                            find = True
                    elif vul.op == ">":
                        if version_cmp(self.version, vul.version) > 0:
                            find = True
                    elif vul.op == ">=":
                        if version_cmp(self.version, vul.version) >= 0:
                            find = True
                    elif vul.op == "==":
                        find = self.version == vul.version
                    elif vul.op == "in":
                        if version_cmp(
                                self.version, vul.version[0]) >= 0 and version_cmp(
                                    self.version, vul.version[1]) <= 0:  # noqa: E501
                            find = True
                except:
                    continue

                if find:
                    self.version2 = self.version
                    self.path2 = self.path
                    app_name = os.path.basename(library_path)
                    if app_name not in self.report.keys():
                        self.report[app_name] = set()
                    self.report[app_name].add(vul.vlu_id)

    def run(self):
        for pid in self.enumerate_proc():
            try:
                self.check(pid)
            except:
                pass

        if sys.platform.startswith("linux"):
            if not self.find_in_process: # 没有发现进程带 jar 包
                self.check(None)

        for _, vlu_ids in self.report.items():
            #print("%s %s %s" % (app_name, "|".join(vlu_ids), script_name))
            return (vlu_ids, self.version2, self.path2)

class LinuxJarVulscan(JarVulscanBase):
    # 枚举进程
    def enumerate_proc(self):
        patten = re.compile("^java$")

        for path in glob.iglob("/proc/[0-9]*"):
            try:
                exe_path = os.readlink(os.path.join(path, "exe"))
                name = os.path.basename(exe_path)
                if not os.path.exists(exe_path):
                    continue
                if patten.search(name):
                    yield int(os.path.basename(path))
            except:  # noqa: E501
                pass

    # 从 @pid 下查找 jar 包路径
    def find_jar_library_from_pid(self, pid):
        with open("/proc/%d/maps" % pid, "r") as file:
            for line in file.readlines():
                try:
                    parts = line = line.strip().split()
                    if not parts or not parts[-1].endswith(".jar"):
                        continue
                    if os.path.exists(parts[-1]):
                        yield parts[-1]
                except:  # noqa: E501
                    pass

class WindowsJarVulscan(JarVulscanBase):
    # 通过规则 @patten 枚举进程
    def enumerate_proc(self):
        name_pattern = re.compile(r"^java**\.**exe$", re.I)
        pid_list = psutil.pids()
        for pid in pid_list:
            try:
                process = psutil.Process(pid)
                if process:
                    if name_pattern.search(process.name()):
                        yield pid
            except:  # noqa: E501
                continue

    # 从 @pid 下查找 jar 包路径
    def find_jar_library_from_pid(self, pid):
        try:
            process = psutil.Process(int(pid))
            if process:
                for file in process.open_files():
                    if file.path.endswith(".jar"):
                        yield file.path
        except:  # noqa: E501
            pass

JarVulscan = LinuxJarVulscan if sys.platform.startswith(
    "linux") else WindowsJarVulscan

def main():
    try:
        vul_id, version, path = JarVulscan().run()
        print_vul(vul_id, app_name, script_name, app_path = path, version = version )
    except:
        pass

if __name__ == "__main__":
    main()

代码比较

有一点变好，但整体其实变差了（主要是漏报变严重）

---

好的方面

• ✔ 支持了 11.0.0-M1 这种版本（以前识别不了）

• ✔ 误报稍微减少了（不再乱匹配所有 tomcat jar）

---

差的方面

• 只检测 catalina.jar
  → 很多 Tomcat 组件直接漏掉（漏报严重）

• version_cmp 可能返回错误
  → 有概率判断失败（稳定性问题）

降低了误报，但大幅增加了漏报

RAG增强生成代码优化

CVE-2026-24734

旧版本项目生成代码（同上，Linux版本）

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

# name：CVE-2026-24734 tomcat Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed. This issue affects Apache Tomcat Native: from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114. The following versions were EOL at the time the CVE was created but are known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected. Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue. Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue. vulnerability scan script
# developer：yao.junyi
# date：2026-04-22
# requirement from：

import os
import re
import sys
import glob
from zipfile import ZipFile
from collections import namedtuple
import subprocess

if not sys.platform.startswith("linux"):
    import psutil  # noqa

try:
    plugin_dir = os.environ["SD_PLUGIN_DIR"]
    sys.path.append(plugin_dir)
    from sd_vulcheck_util import print_vul
except Exception as e:
    def print_vul(vul_id, app_name, script_name, **kwargs):
        if not isinstance(vul_id, (list, tuple, set)):
            vul_id = (vul_id,)
        vul_id = list(set(vul_id))
        app_name = app_name.strip()
        script_name = script_name.strip()
        print("{} {} {}".format(app_name, "|".join(vul_id), script_name))

# op 表示版本比较方法，可选值为
#  <  JAR 包版本小于 version
#  <= JAR 包版本小于等于 version
#  >  JAR 包版本大于 version
#  >= JAR 包版本大于 version
#  == JAR 包版本等于 version
#  in 此时 version 为二元元组，表示 JAR 包版本介于元组中的版本
#  regex 正则表达式
jar_vul = namedtuple("jar_vul", ("vlu_id", "op", "version"))
script_name = os.path.basename(__file__)
app_name = "tomcat"
vuls_db = {
    re.compile("catalina[0-9a-zA-Z_.-]*\\.jar$"): [
        jar_vul("CVE-2026-24734", "in", ("1.1.23", "1.1.34")),
        jar_vul("CVE-2026-24734", "in", ("1.2.0", "1.2.39")),
        jar_vul("CVE-2026-24734", "in", ("1.3.0", "1.3.4")),
        jar_vul("CVE-2026-24734", "in", ("2.0.0", "2.0.11")),
        jar_vul("CVE-2026-24734", "in", ("11.0.0-M1", "11.0.17")),
        jar_vul("CVE-2026-24734", "in", ("10.1.0-M7", "10.1.51")),
        jar_vul("CVE-2026-24734", "in", ("9.0.83", "9.0.114"))
    ]
}

class JarVulscanBase:
    JAR_VERSION_PATTEN = re.compile(r"(\d+**\.**)+\d+")

    MANIFEST_VERSION_PATTEN = [(re.compile(r"Implementation-Version:"),
                                re.compile(r"(\d+**\.**|\d+**\_**)+[0-9a-zA-Z]+")),
                               (re.compile(r"Bundle-Version:"),
                                re.compile(r"(\d+**\.**|\d+**\_**)+[0-9a-zA-Z]+"))]

    MAVEN_POM_PATTEN = re.compile("META-INF/maven/.*/pom.properties")

    MAVEN_VERSION_PAETTEN = [(re.compile("version="),
                              re.compile(r"(\d+**\.**|\d+**\_**)+\d+"))]

    def __init__(self):
        self.report = {}
        self.find_in_process = False
        self.checked_memo = set()
        self.version = ''
        self.version2 = ''
        self.path2=''
        self.path = ''

    # 枚举进程
    def enumerate_proc(self):
        raise NotImplementedError()

    # 从 @pid 下查找 jar 包路径
    def find_jar_library_from_pid(self, pid):
        raise NotImplementedError()

    # 通过 @pid 筛选所需的 jar 包
    def filter_jar_library(self, pid=None):
        if pid is not None:
            for library_path in self.find_jar_library_from_pid(pid):
                if library_path in self.checked_memo:
                    continue

                self.checked_memo.add(library_path)
                for patten, vuls_info in vuls_db.items():
                    if patten.match(os.path.basename(library_path)):
                        yield (library_path, vuls_info)
        else:
            for patten, vuls_info in vuls_db.items():
                cmd = ["locate", "-e", "--regex", "/" + patten.pattern]
                result = subprocess.run(cmd, stdout=subprocess.PIPE,
                                        stderr=subprocess.DEVNULL,
                                        timeout=600)
                for line in result.stdout.decode().split("\n"):
                    library_path = line.strip()
                    if library_path:
                        yield (library_path, vuls_info)

    # 获取 @jar_path 对应 jar 包的版本
    def detect_jar_version(self, jar_path):
        def detect(zfile, name, pattens):
            try:
                if not isinstance(name, str):
                    search_patten = name
                    name = None
                    for zip_name in zfile.namelist():
                        if search_patten.search(zip_name):
                            name = zip_name
                            break

                if not name or name not in zfile.namelist():
                    return None

                with zfile.open(name, "r") as file:
                    for line in file.readlines():
                        line = line.decode().strip()
                        if not line:
                            continue
                        for field, ver in pattens:
                            if field.search(line):
                                match = ver.search(line)
                                if match:
                                    return match.group(0)
            except:  # noqa:E501
                pass
            return None

        with ZipFile(jar_path, mode="r") as zfile:
            # 1. 从 META-INF/MANIFEST.MF 中提取 Implementation-Version
            #    或 Bundle-Version 所对应的版本
            version = detect(zfile, "META-INF/MANIFEST.MF",
                             self.MANIFEST_VERSION_PATTEN)
            # 2. 从文件名中提取 jar 版本
            if not version:
                match = self.JAR_VERSION_PATTEN.search(
                    os.path.basename(jar_path))
                if match:
                    version = match.group(0)
            # 3. 从 maven 打包文件中提起
            if not version:
                version = detect(zfile, self.MAVEN_POM_PATTEN,
                                 self.MAVEN_VERSION_PAETTEN)
            return version

    # 检查 java 进程下的 jar 包是否存在漏洞
    def check(self, pid):
        def version_cmp(vera, verb):
            vera = re.sub(r'(-|_)', '.', vera)

            # if vera == verb:
            #    return 0
            if re.search(r'alpha|beta|rc', vera):
                vera = re.sub(r'alpha|beta|rc', '', vera)
                if vera == verb:
                    return -1

            vera = vera.split(".")
            verb = verb.split(".")

            while len(vera) > len(verb):
                verb.append('0')
            while len(verb) > len(vera):
                vera.append('0')
            if vera == verb:
                return 0
            def int_try_parse(param):
                if param.isdigit():
                    return [int(param)*128]
                result = ""
                parts = []

                for _, ch in enumerate(param):
                    if ch.isdigit():
                        result += ch
                    else:
                        if result:
                            parts.append(int(result)*128)
                            result = ""
                        parts.append(ord(ch))
                if result:
                    parts.append(int(result)*128)
                return parts

            for n in range(len(vera)):
                vera_parts = int_try_parse(vera[n])
                verb_parts = int_try_parse(verb[n])

                while len(vera_parts) > len(verb_parts):
                    verb_parts.append(0)
                while len(verb_parts) > len(vera_parts):
                    vera_parts.append(0)
                if vera_parts > verb_parts:
                    return 1
                elif vera_parts < verb_parts:
                    return -1

        for library_path, jar_vuls in self.filter_jar_library(pid):
            if pid is not None:
                self.find_in_process = True
            self.version = self.detect_jar_version(library_path)
            self.path = os.path.dirname(library_path)
            for vul in jar_vuls:
                find = False
                try:
                    if vul.op == "<":
                        if version_cmp(self.version, vul.version) < 0:
                            find = True
                    elif vul.op == "<=":
                        if version_cmp(self.version, vul.version) <= 0:
                            find = True
                    elif vul.op == ">":
                        if version_cmp(self.version, vul.version) > 0:
                            find = True
                    elif vul.op == ">=":
                        if version_cmp(self.version, vul.version) >= 0:
                            find = True
                    elif vul.op == "==":
                        find = self.version == vul.version
                    elif vul.op == "in":
                        if version_cmp(self.version, vul.version[0]) >= 0 and version_cmp(self.version, vul.version[1]) <= 0:
                            find = True
                except:
                    continue

                if find:
                    self.version2 = self.version
                    self.path2 = self.path
                    app_name = os.path.basename(library_path)
                    if app_name not in self.report.keys():
                        self.report[app_name] = set()
                    self.report[app_name].add(vul.vlu_id)

    def run(self):
        for pid in self.enumerate_proc():
            try:
                self.check(pid)
            except:
                pass

        if sys.platform.startswith("linux"):
            if not self.find_in_process:
                self.check(None)

        for _, vlu_ids in self.report.items():
            return (vlu_ids, self.version2, self.path2)

class LinuxJarVulscan(JarVulscanBase):
    # 枚举进程
    def enumerate_proc(self):
        patten = re.compile("^java$")

        for path in glob.iglob("/proc/[0-9]*"):
            try:
                exe_path = os.readlink(os.path.join(path, "exe"))
                name = os.path.basename(exe_path)
                if not os.path.exists(exe_path):
                    continue
                if patten.search(name):
                    yield int(os.path.basename(path))
            except:
                pass

    # 从 @pid 下查找 jar 包路径
    def find_jar_library_from_pid(self, pid):
        with open("/proc/%d/maps" % pid, "r") as file:
            for line in file.readlines():
                try:
                    parts = line = line.strip().split()
                    if not parts or not parts[-1].endswith(".jar"):
                        continue
                    if os.path.exists(parts[-1]):
                        yield parts[-1]
                except:
                    pass

class WindowsJarVulscan(JarVulscanBase):
    # 通过规则 @patten 枚举进程
    def enumerate_proc(self):
        name_pattern = re.compile(r"^java**\.**exe$", re.I)
        pid_list = psutil.pids()
        for pid in pid_list:
            try:
                process = psutil.Process(pid)
                if process:
                    if name_pattern.search(process.name()):
                        yield pid
            except:
                continue

    # 从 @pid 下查找 jar 包路径
    def find_jar_library_from_pid(self, pid):
        try:
            process = psutil.Process(int(pid))
            if process:
                for file in process.open_files():
                    if file.path.endswith(".jar"):
                        yield file.path
        except:
            pass

JarVulscan = LinuxJarVulscan if sys.platform.startswith(
    "linux") else WindowsJarVulscan

def main():
    try:
        vul_id, version, path = JarVulscan().run()
        print_vul(vul_id, app_name, script_name, app_path = path, version = version )
    except:
        pass

if __name__ == "__main__":
    main()

新版本项目生成代码

虽然进行了RAG增强生成，但是过程只是将向量化并且Cosine Similarity对比之后的所有代码当作参考给大模型，最终还是由大模型去自由生成代码，导致与参考代码的流程还是差异较大，针对RAG搜索后代码参考方式进行修改

将生成流程从 “RAG + 自由代码生成” 升级为 “RAG + 规则抽取 + 模板填充”

代码内容（Linux版本）

import os
import re
import sys
import glob
from zipfile import ZipFile
from collections import namedtuple
import subprocess

if not sys.platform.startswith("linux"):
    import psutil  # noqa

try:
    plugin_dir = os.environ["SD_PLUGIN_DIR"]
    sys.path.append(plugin_dir)
    from sd_vulcheck_util import print_vul
except Exception as e:
    def print_vul(vul_id, app_name, script_name, **kwargs):
        if not isinstance(vul_id, (list, tuple, set)):
            vul_id = (vul_id,)
        vul_id = list(set(vul_id))
        app_name = app_name.strip()
        script_name = script_name.strip()
        print("{} {} {}".format(app_name, "|".join(vul_id), script_name))

# op 表示版本比较方法，可选值为
#  <  JAR 包版本小于 version
#  <= JAR 包版本小于等于 version
#  >  JAR 包版本大于 version
#  >= JAR 包版本大于等于 version
#  == JAR 包版本等于 version
#  in 此时 version 为二元元组，表示 JAR 包版本介于元组中的版本
jar_vul = namedtuple("jar_vul", ("vlu_id", "op", "version"))
script_name = os.path.basename(__file__)
app_name = "Apache Tomcat Native"
process_name = "Java"
vuls_db = {
    re.compile("tomcat-native[0-9a-zA-Z_.-]*\.jar$"): [
        jar_vul("CVE-2026-24734", "in", ("1.1.23", "1.1.34")),
        jar_vul("CVE-2026-24734", "in", ("1.2.0", "1.2.39")),
        jar_vul("CVE-2026-24734", "in", ("1.3.0", "1.3.4")),
        jar_vul("CVE-2026-24734", "in", ("2.0.0", "2.0.11")),
        jar_vul("CVE-2026-24734", "in", ("11.0.0-M1", "11.0.17")),
        jar_vul("CVE-2026-24734", "in", ("10.1.0-M7", "10.1.51")),
        jar_vul("CVE-2026-24734", "in", ("9.0.83", "9.0.114")),
    ]
}

class JarVulscanBase:
    JAR_VERSION_PATTEN = re.compile(r"(\d+**\.**)+\d+")

    MANIFEST_VERSION_PATTEN = [(re.compile(r"Implementation-Version:"),
                                re.compile(r"(\d+**\.**|\d+**\_**)+[0-9a-zA-Z]+")),
                               (re.compile(r"Bundle-Version:"),
                                re.compile(r"(\d+**\.**|\d+**\_**)+[0-9a-zA-Z]+"))]

    MAVEN_POM_PATTEN = re.compile("META-INF/maven/.*/pom.properties")

    MAVEN_VERSION_PAETTEN = [(re.compile("version="),
                              re.compile(r"(\d+**\.**|\d+**\_**)+\d+"))]

    def __init__(self):
        self.report = {}
        self.find_in_process = False
        self.checked_memo = set()
        self.version = ''
        self.path = ''
        self.pid = ''

    def enumerate_proc(self):
        raise NotImplementedError()

    def find_jar_library_from_pid(self, pid):
        raise NotImplementedError()

    def filter_jar_library(self, pid=None):
        if pid is not None:
            for library_path in self.find_jar_library_from_pid(pid):
                if library_path in self.checked_memo:
                    continue

                self.checked_memo.add(library_path)
                for patten, vuls_info in vuls_db.items():
                    if patten.match(os.path.basename(library_path)):
                        yield (library_path, vuls_info)
        else:
            for patten, vuls_info in vuls_db.items():
                cmd = ["locate", "-e", "--regex", "/" + patten.pattern]
                result = subprocess.run(cmd, stdout=subprocess.PIPE,
                                        stderr=subprocess.DEVNULL,
                                        timeout=600)
                for line in result.stdout.decode().split("\n"):
                    library_path = line.strip()
                    if library_path:
                        yield (library_path, vuls_info)

    def detect_jar_version(self, jar_path):
        def detect(zfile, name, pattens):
            try:
                if not isinstance(name, str):
                    search_patten = name
                    name = None
                    for zip_name in zfile.namelist():
                        if search_patten.search(zip_name):
                            name = zip_name
                            break

                if not name or name not in zfile.namelist():
                    return None

                with zfile.open(name, "r") as file:
                    for line in file.readlines():
                        line = line.decode().strip()
                        if not line:
                            continue
                        for field, ver in pattens:
                            if field.search(line):
                                match = ver.search(line)
                                if match:
                                    return match.group(0)
            except:
                pass
            return None

        with ZipFile(jar_path, mode="r") as zfile:
            version = detect(zfile, "META-INF/MANIFEST.MF",
                             self.MANIFEST_VERSION_PATTEN)
            if not version:
                match = self.JAR_VERSION_PATTEN.search(
                    os.path.basename(jar_path))
                if match:
                    version = match.group(0)
            if not version:
                version = detect(zfile, self.MAVEN_POM_PATTEN,
                                 self.MAVEN_VERSION_PAETTEN)
            return version

    def check(self, pid):
        def version_cmp(vera, verb):

            vera = re.sub(r'(-|_)', '.', vera)

            if re.search(r'alpha|beta|rc', vera):
                vera = re.sub(r'alpha|beta|rc', '', vera)
                if vera == verb:
                    return -1

            vera = vera.split(".")
            verb = verb.split(".")

            while len(vera) > len(verb):
                verb.append('0')
            while len(verb) > len(vera):
                vera.append('0')
            if vera == verb:
                return 0

            def int_try_parse(param):
                if param.isdigit():
                    return [int(param)*128]
                result = ""
                parts = []

                for _, ch in enumerate(param):
                    if ch.isdigit():
                        result += ch
                    else:
                        if result:
                            parts.append(int(result)*128)
                            result = ""
                        parts.append(ord(ch))
                if result:
                    parts.append(int(result)*128)
                return parts

            for n in range(len(vera)):

                vera_parts = int_try_parse(vera[n])
                verb_parts = int_try_parse(verb[n])

                while len(vera_parts) > len(verb_parts):
                    verb_parts.append(0)
                while len(verb_parts) > len(vera_parts):
                    vera_parts.append(0)
                if vera_parts > verb_parts:
                    return 1
                elif vera_parts < verb_parts:
                    return -1

        for library_path, jar_vuls in self.filter_jar_library(pid):
            if pid is not None:
                self.find_in_process = True
            self.version = self.detect_jar_version(library_path)
            self.path = os.path.dirname(library_path)
            for vul in jar_vuls:
                find = False
                try:
                    if vul.op == "<":
                        if version_cmp(self.version, vul.version) < 0:
                            find = True
                    elif vul.op == "<=":
                        if version_cmp(self.version, vul.version) <= 0:
                            find = True
                    elif vul.op == ">":
                        if version_cmp(self.version, vul.version) > 0:
                            find = True
                    elif vul.op == ">=":
                        if version_cmp(self.version, vul.version) >= 0:
                            find = True
                    elif vul.op == "==":
                        find = self.version == vul.version
                    elif vul.op == "in":
                        if version_cmp(
                                self.version, vul.version[0]) >= 0 and version_cmp(
                                    self.version, vul.version[1]) <= 0:
                            find = True
                except:
                    continue

                if find:

                    self.pid = pid
                    app_name = os.path.basename(library_path)
                    if app_name not in self.report.keys():
                        self.report[app_name] = set()
                    self.report[app_name].add(vul.vlu_id)

    def run(self):
        for pid in self.enumerate_proc():
            try:
                self.check(pid)
            except:
                pass

        if sys.platform.startswith("linux"):
            if not self.find_in_process:
                self.check(None)

        for _, vlu_ids in self.report.items():
            return (vlu_ids, self.version, self.path, self.pid)

class LinuxJarVulscan(JarVulscanBase):
    def enumerate_proc(self):
        patten = re.compile("^java$")

        for path in glob.iglob("/proc/[0-9]*"):
            try:
                exe_path = os.readlink(os.path.join(path, "exe"))
                name = os.path.basename(exe_path)

                if not os.path.exists(exe_path):
                    continue
                if patten.search(name):
                    yield int(os.path.basename(path))
            except:
                pass

    def find_jar_library_from_pid(self, pid):
        with open("/proc/%d/maps" % pid, "r") as file:
            for line in file.readlines():
                try:
                    parts = line = line.strip().split()
                    if not parts or not parts[-1].endswith(".jar"):
                        continue
                    if os.path.exists(parts[-1]):
                        yield parts[-1]
                except:
                    pass

class WindowsJarVulscan(JarVulscanBase):
    def enumerate_proc(self):
        name_pattern = re.compile(r"^java**\.**exe$", re.I)
        pid_list = psutil.pids()
        for pid in pid_list:
            try:
                process = psutil.Process(pid)
                if process:
                    if name_pattern.search(process.name()):
                        yield pid
            except:
                continue

    def find_jar_library_from_pid(self, pid):
        try:
            process = psutil.Process(int(pid))
            if process:
                for file in process.open_files():
                    if file.path.endswith(".jar"):
                        yield file.path
        except:
            pass

JarVulscan = LinuxJarVulscan if sys.platform.startswith(
    "linux") else WindowsJarVulscan

def main():
    try:
        vul_id, version, path, pid = JarVulscan().run()
        print_vul(vul_id, app_name, script_name, version=version, app_path=path, pid=str(pid), process_name=process_name)
    except:
        pass

if __name__ == "__main__":
    main()