如何在Bash中用JQ为漏洞JSON添加基于CVEID的URL字段

核心问题是之前的JQ命令错误地提取了vulnerabilities数组的元素，而非原地修改原数组结构。使用|=操作符可以在保留完整JSON层级的前提下，为每个漏洞对象添加目标字段。

基础JQ命令 #

jq '.vulnerabilities[] |= . + {
  MITRE_URL: "https://cve.mitre.org/cgi-bin/cvename.cgi?name=" + .CVEID,
  NIST_URL: "https://nvd.nist.gov/vuln/detail/" + .CVEID
}' input.json > output.json

命令解释 #

• .vulnerabilities[] |=：遍历vulnerabilities数组的每个元素，原地修改原数组（而非提取元素），确保整个JSON的层级结构完整保留。
• . + { ... }：将原漏洞对象与新生成的包含URL的对象合并，实现字段添加。

处理空CVEID的健壮版本 #

如果存在CVEID为空的漏洞，可通过// ""避免URL拼接出错：

jq '.vulnerabilities[] |= . + {
  MITRE_URL: "https://cve.mitre.org/cgi-bin/cvename.cgi?name=" + (.CVEID // ""),
  NIST_URL: "https://nvd.nist.gov/vuln/detail/" + (.CVEID // "")
}' input.json > output.json

示例验证 #

输入JSON（简化版） #

{
  "scan_metadata": {
    "scan_id": "123",
    "timestamp": "2024-05-20"
  },
  "vulnerabilities": [
    {
      "CVEID": "CVE-2023-1234",
      "severity": "Critical",
      "description": "Sample vuln"
    },
    {
      "CVEID": "CVE-2023-5678",
      "severity": "High",
      "description": "Another vuln"
    }
  ]
}

输出JSON（保留原结构并添加字段） #

{
  "scan_metadata": {
    "scan_id": "123",
    "timestamp": "2024-05-20"
  },
  "vulnerabilities": [
    {
      "CVEID": "CVE-2023-1234",
      "severity": "Critical",
      "description": "Sample vuln",
      "MITRE_URL": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234",
      "NIST_URL": "https://nvd.nist.gov/vuln/detail/CVE-2023-1234"
    },
    {
      "CVEID": "CVE-2023-5678",
      "severity": "High",
      "description": "Another vuln",
      "MITRE_URL": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5678",
      "NIST_URL": "https://nvd.nist.gov/vuln/detail/CVE-2023-5678"
    }
  ]
}

后续导出TSV #

基于修改后的完整JSON，可直接提取目标字段生成TSV：

jq -r '.vulnerabilities[] | [.CVEID, .severity, .MITRE_URL, .NIST_URL] | @tsv' output.json > output.tsv

内容的提问来源于stack exchange，提问作者z3plike