解析NVD XML與PHP

我試圖解析這個XML文件：http://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-modified.xml 解析NVD XML與PHP

<?xml version='1.0' encoding='UTF-8'?> 
<nvd xmlns:cvss="http://scap.nist.gov/schema/cvss-v2/0.2" xmlns="http://scap.nist.gov/schema/feed/vulnerability/2.0" xmlns:vuln="http://scap.nist.gov/schema/vulnerability/0.4" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/0.1" xmlns:cpe-lang="http://cpe.mitre.org/language/2.0" xmlns:patch="http://scap.nist.gov/schema/patch/0.1" nvd_xml_version="2.0" pub_date="2013-07-11T12:00:45" xsi:schemaLocation="http://scap.nist.gov/schema/patch/0.1 http://nvd.nist.gov/schema/patch_0.1.xsd http://scap.nist.gov/schema/scap-core/0.1 http://nvd.nist.gov/schema/scap-core_0.1.xsd http://scap.nist.gov/schema/feed/vulnerability/2.0 http://nvd.nist.gov/schema/nvd-cve-feed_2.0.xsd"> 
    <entry id="CVE-2000-0851"> 
    <vuln:vulnerable-configuration id="http://nvd.nist.gov/"> 
     <cpe-lang:logical-test negate="false" operator="OR"> 
     <cpe-lang:fact-ref name="cpe:/o:microsoft:windows_2000"/> 
     </cpe-lang:logical-test> 
    </vuln:vulnerable-configuration> 
    <vuln:vulnerable-software-list> 
     <vuln:product>cpe:/o:microsoft:windows_2000</vuln:product> 
    </vuln:vulnerable-software-list> 
    <vuln:cve-id>CVE-2000-0851</vuln:cve-id> 
    <vuln:published-datetime>2000-11-14T00:00:00.000-05:00</vuln:published-datetime> 
    <vuln:last-modified-datetime>2013-07-06T00:11:34.357-04:00</vuln:last-modified-datetime> 
    <vuln:cvss> 
     <cvss:base_metrics upgraded-from-version="1.0"> 
     <cvss:score>4.6</cvss:score> 
     <cvss:access-vector>LOCAL</cvss:access-vector> 
     <cvss:access-complexity>LOW</cvss:access-complexity> 
     <cvss:authentication>NONE</cvss:authentication> 
     <cvss:confidentiality-impact>PARTIAL</cvss:confidentiality-impact> 
     <cvss:integrity-impact>PARTIAL</cvss:integrity-impact> 
     <cvss:availability-impact>PARTIAL</cvss:availability-impact> 
     <cvss:source>http://nvd.nist.gov</cvss:source> 
     <cvss:generated-on-datetime>2004-01-01T00:00:00.000-05:00</cvss:generated-on-datetime> 
     </cvss:base_metrics> 
    </vuln:cvss> 
    <vuln:security-protection>ALLOWS_OTHER_ACCESS</vuln:security-protection> 
    <vuln:references xml:lang="en" reference_type="VENDOR_ADVISORY"> 
     <vuln:source>BID</vuln:source> 
     <vuln:reference href="http://www.securityfocus.com/bid/1651" xml:lang="en">1651</vuln:reference> 
    </vuln:references> 
    <vuln:references xml:lang="en" reference_type="UNKNOWN"> 
     <vuln:source>MS</vuln:source> 
     <vuln:reference href="http://www.microsoft.com/technet/security/bulletin/ms00-065.asp" xml:lang="en">MS00-065</vuln:reference> 
    </vuln:references> 
    <vuln:references xml:lang="en" reference_type="UNKNOWN"> 
     <vuln:source>ATSTAKE</vuln:source> 
     <vuln:reference href="http://www.atstake.com/research/advisories/2000/a090700-1.txt" xml:lang="en">A090700-1</vuln:reference> 
    </vuln:references> 
    <vuln:references xml:lang="en" reference_type="UNKNOWN"> 
     <vuln:source>XF</vuln:source> 
     <vuln:reference href="http://xforce.iss.net/static/5203.php" xml:lang="en">w2k-still-image-service</vuln:reference> 
    </vuln:references> 
    <vuln:summary>Buffer overflow in the Still Image Service in Windows 2000 allows local users to gain additional privileges via a long WM_USER message, aka the "Still Image Service Privilege Escalation" vulnerability.</vuln:summary> 
    </entry> 
    <entry id="CVE-2004-0685"> 
    ...

我下面

$url = 'http://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-modified.xml'; 
$source = file_get_contents($url); 
$xml = new SimpleXMLElement($source);

如果我呼應$源，然後我看到整個XML文件被加載，但如果我的print_r $ XML中，只有id的是回聲ED：

SimpleXMLElement Object 
(
    [@attributes] => Array 
     (
      [nvd_xml_version] => 2.0 
      [pub_date] => 2013-07-11T12:00:45 
     ) 

    [entry] => Array 
     (
      [0] => SimpleXMLElement Object 
       (
        [@attributes] => Array 
         (
          [id] => CVE-2000-0851 
         ) 

       ) 

      [1] => SimpleXMLElement Object 
       (
        [@attributes] => Array 
         (
          [id] => CVE-2004-0685 
         ) 

       )

爲什麼我失去了T中的所有信息他「項」標籤

來源

2013-07-11 lockdoc

請讓自己習慣於稱爲XML命名空間。如果您沒有開始瞭解它們，那麼您將繼續使用XML失敗。正如您在下面的評論中宣佈的，刪除名稱空間是一個失敗。 – hakre

也許這可以讓你開始：

<?php 

$url = 'http://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-modified.xml'; 
$source = file_get_contents($url); 
$xml = new SimpleXMLElement($source); 

$entries = $xml->entry; 

foreach ($entries as $entry) { 
    $namespace = $entry->getNameSpaces(true); 
    $tmp  = $entry->children($namespace['vuln']); 
    //print_r($namespace); 
    print_r($tmp); 
    break; 
}

輸出：

SimpleXMLElement Object 
(
    [vulnerable-configuration] => SimpleXMLElement Object 
     (
     ) 

    [vulnerable-software-list] => SimpleXMLElement Object 
     (
      [product] => cpe:/o:microsoft:windows_2000 
     ) 

    [cve-id] => CVE-2000-0851 
    [published-datetime] => 2000-11-14T00:00:00.000-05:00 
    [last-modified-datetime] => 2013-07-06T00:11:34.357-04:00 
    [cvss] => SimpleXMLElement Object 
     (
     ) 

    [security-protection] => ALLOWS_OTHER_ACCESS 
    [references] => Array 
     (
      [0] => SimpleXMLElement Object 
       (
        [source] => BID 
        [reference] => 1651 
       ) 

      [1] => SimpleXMLElement Object 
       (
        [source] => MS 
        [reference] => MS00-065 
       ) 

      [2] => SimpleXMLElement Object 
       (
        [source] => ATSTAKE 
        [reference] => A090700-1 
       ) 

      [3] => SimpleXMLElement Object 
       (
        [source] => XF 
        [reference] => w2k-still-image-service 
       ) 

     ) 

    [summary] => Buffer overflow in the Still Image Service in Windows 2000 allows local users to gain additional privileges via a long WM_USER message, aka the "Still Image Service Privilege Escalation" vulnerability. 
)

您可以取消註釋print_r($namespace)，看什麼自定義命名空間包含。

如果我不打印出來$namespace，輸出爲：

Array 
(
    [] => http://scap.nist.gov/schema/feed/vulnerability/2.0 
    [vuln] => http://scap.nist.gov/schema/vulnerability/0.4 
    [cpe-lang] => http://cpe.mitre.org/language/2.0 
    [cvss] => http://scap.nist.gov/schema/cvss-v2/0.2 
    [xml] => http://www.w3.org/XML/1998/namespace 
)

然後讓vulnerable-configuration的屬性，只需使用->getAttribute('name')

這方面的一個例子是：

print_r($tmp->{"vulnerable-configuration"}->attributes());

您應該將名稱放在{}中，因爲它包含無效字符。

上面應該打印出來：

SimpleXMLElement Object 
(
    [@attributes] => Array 
     (
      [id] => http://nvd.nist.gov/ 
     ) 

)

如果你不知道前手的價值觀，你仍然可以遍歷$namespace變量：

foreach ($namespaces as $namespace) { 
    $tmp = $entry->children($namespace); 
    print_r($tmp); 
}

這樣做的輸出將是：

SimpleXMLElement Object 
(
) 
SimpleXMLElement Object 
(
    [vulnerable-configuration] => SimpleXMLElement Object 
     (
     ) 

    [vulnerable-software-list] => SimpleXMLElement Object 
     (
      [product] => cpe:/o:microsoft:windows_2000 
     ) 

    [cve-id] => CVE-2000-0851 
    [published-datetime] => 2000-11-14T00:00:00.000-05:00 
    [last-modified-datetime] => 2013-07-06T00:11:34.357-04:00 
    [cvss] => SimpleXMLElement Object 
     (
     ) 

    [security-protection] => ALLOWS_OTHER_ACCESS 
    [references] => Array 
     (
      [0] => SimpleXMLElement Object 
       (
        [source] => BID 
        [reference] => 1651 
       ) 

      [1] => SimpleXMLElement Object 
       (
        [source] => MS 
        [reference] => MS00-065 
       ) 

      [2] => SimpleXMLElement Object 
       (
        [source] => ATSTAKE 
        [reference] => A090700-1 
       ) 

      [3] => SimpleXMLElement Object 
       (
        [source] => XF 
        [reference] => w2k-still-image-service 
       ) 

     ) 

    [summary] => Buffer overflow in the Still Image Service in Windows 2000 allows local users to gain additional privileges via a long WM_USER message, aka the "Still Image Service Privilege Escalation" vulnerability. 
) 
SimpleXMLElement Object 
(
) 
SimpleXMLElement Object 
(
) 
SimpleXMLElement Object 
(
)

來源

2013-07-11 18:03:12

感謝您的回答。有沒有什麼辦法可以在不知道所有可能的子鍵的情況下將整個條目映射到一個php對象或數組？ – lockdoc

查看'$ namespace'變量。這包含所有可能的「自定義」命名空間。你可以遍歷條目，我也包括這個例子。 –

好的，prio創建xml對象，我已經刪除了所有的命名空間，現在它工作xD謝謝你的提示 – lockdoc

解析NVD XML與PHP

回答

相關問題