解析和过滤json文件中的数组

Question

我正在尝试解析https://nvd.nist.gov/vuln/data-feeds提供的json文件。我正在尝试提取所有严重程度为高、中、重的CVE-ID。

{
  "CVE_data_type" : "CVE",
  "CVE_data_format" : "MITRE",
  "CVE_data_version" : "4.0",
  "CVE_data_numberOfCVEs" : "5465",
  "CVE_data_timestamp" : "2018-07-04T07:00Z",
  "CVE_Items" : [ {
    "cve" : {
      "data_type" : "CVE",
      "data_format" : "MITRE",
      "data_version" : "4.0",
      "CVE_data_meta" : {
        "ID" : "CVE-2018-0001",
        "ASSIGNER" : "cve@mitre.org"
      },
    },
    "impact" : {
      "baseMetricV3" : {
        "cvssV3" : {
          "version" : "3.0",
          "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "attackVector" : "NETWORK",
          "attackComplexity" : "HIGH",
          "privilegesRequired" : "NONE",
          "userInteraction" : "NONE",
          "scope" : "UNCHANGED",
          "confidentialityImpact" : "NONE",
          "integrityImpact" : "NONE",
          "availabilityImpact" : "HIGH",
          "baseScore" : 5.9,
          "baseSeverity" : "MEDIUM"
        },
        "exploitabilityScore" : 2.2,
        "impactScore" : 3.6
      },
    },
  },
}

这是我尝试过的：

./jq-osx-amd64 '.CVE_Items[] | select (.impact.baseMetricV3.cvssV3.baseSeverity == ("HIGH")) | cve.CVE_data_meta.ID'

但我有

jq: error: cve/0 is not defined at <top-level>, line 1:
.CVE_Items[] | select (.impact.baseMetricV3.cvssV3.baseSeverity == ("HIGH")) | cve.CVE_data_meta.ID
jq: 1 compile error

有什么想法吗？

Answer 1

您收到此错误是因为您的JSON无效

​

​

如果你用next diff修复你的JSON：

diff --git a/j.json b/j.json
index eafb4e2..e278506 100644
--- a/j.json
+++ b/j.json
@@ -12,7 +12,7 @@
       "CVE_data_meta" : {
         "ID" : "CVE-2018-0001",
         "ASSIGNER" : "cve@mitre.org"
-      },
+      }
     },
     "impact" : {
       "baseMetricV3" : {
@@ -32,7 +32,7 @@
         },
         "exploitabilityScore" : 2.2,
         "impactScore" : 3.6
-      },
-    },
-  },
+      }
+    }
+  }]
 }

您将能够运行下一条命令：

./jq-osx-amd64 '.CVE_Items[] | select (.impact.baseMetricV3.cvssV3.baseSeverity == ("MEDIUM")) | .cve.CVE_data_meta.ID'

结果将是：

"CVE-2018-0001"

Answer 2

是的，很抱歉，我在上面编辑了复制粘贴的json手册，但是真正的json是可以的。https://nvd.nist.gov/feeds/json/cve/1.0/nvdcve-1.0-2018.json.gz