"""
Module contains functionality that determines whether a vulnerability
causes remote code execution.
"""

from cve_connector.nvd_cve.categorization.helpers import test_incidence


def has_code_execution_as_root(description, cvssv2, cvssv3):
    """
    Function determines whether CVE has "Arbitrary code execution as
    root/administrator/system" as its impact.

    :param description: description of CVE
    :param cvssv2: CVSS version 2 of CVE
    :param cvssv3: CVSS version 3 of CVE
    :return: True if CVE has "Arbitrary code execution as
    root/administrator/system" as its impact
    """

    necessary_condition = [
        "execute arbitrary code as root",
        "execute arbitrary code with root privileges",
        "execute arbitrary code as the root user",
        "execute arbitrary code as a root user",
        "execute arbitrary code as LocalSystem",
        "execute arbitrary code as SYSTEM",
        "execute arbitrary code as Local System"
        "execute arbitrary code with SYSTEM privileges",
        "execute arbitrary code with LocalSystem privileges",
        "execute dangerous commands as root",
        "execute shell commands as the root user",
        "execute arbitrary commands as root",
        "execute arbitrary commands with root privileges",
        "execute arbitrary commands with root-level privileges",
        "execute commands as root",
        "execute root commands",
        "execute arbitrary os commands as root",
        "execute arbitrary shell commands as root",
        "execute arbitrary commands as SYSTEM",
        "execute arbitrary commands with SYSTEM privileges",
        "run commands as root",
        "run arbitrary commands as root",
        "run arbitrary commands as the root user",
        "execute code with root privileges",
        "run commands as root",
        "load malicious firmware",
        "succeed in uploading malicious Firmware",
        "executed under the SYSTEM account"
    ]

    for phrase in necessary_condition:
        if phrase in description:
            return True

    return has_code_execution_as_user(description.lower(),
                                      cvssv3) and \
        (cvssv2['c'] == "COMPLETE") and \
        (cvssv2['i'] == "COMPLETE") and \
        (cvssv2['a'] == "COMPLETE")


def has_code_execution_as_user(description, cvssv3):
    """
    Function determines whether particular CVE has "Arbitrary code execution
    as user of application" as its impact.

    :param description: description of CVE
    :param cvssv3: CVSS version 3 of CVE
    :return: True if CVE has "Arbitrary code execution as user of application"
    as its impact.
    """

    necessary_condition = [
        "include and execute arbitrary local php files",
        "execute arbitrary code",
        "command injection",
        "execute files",
        "run arbitrary code",
        "execute a malicious file",
        "execution of arbitrary code",
        "remote execution of arbitrary php code",
        "execute code",
        "code injection vulnerability",
        "execute any code",
        "malicious file could be then executed on the affected system",
        "inject arbitrary commands",
        "execute arbitrary files",
        "inject arbitrary sql code",
        "run the setuid executable",
        "vbscript injection",
        "execute administrative operations",
        "performs arbitrary actions",
        "submit arbitrary requests to an affected device",
        "perform arbitrary actions on an affected device",
        "executes an arbitrary program",
        "attacker can upload a malicious payload",
        "execute malicious code",
        "modify sql commands to the portal server",
        "execute arbitrary os commands",
        "execute arbitrary code with administrator privileges",
        "execute administrator commands",
        "executed with administrator privileges",
        "remote procedure calls on the affected system",
        "run a specially crafted application on a targeted system",
        "execute arbitrary code in a privileged context",
        "execute arbitrary code with super-user privileges",
        "run processes in an elevated context",
    ]
    for phrase in necessary_condition:
        if phrase in description:
            return True

    # searching for such an injection vulnerability that changes integrity and
    # confidentiality
    if "sql injection" in description and \
            cvssv3['i'] == "HIGH" and \
            cvssv3['c'] == "HIGH" and \
            "blind sql injection" not in description:
        return True

    required_verbs = [
        " execut",
        " run ",
        ' inject'
    ]
    required_nouns = [
        " code ",
        " command",
        "arbitrary script",
        " code."
    ]

    if test_incidence(description, required_nouns) and \
            test_incidence(description, required_verbs):
        return True

    return False
