class

KEV::Query

Inherits Indexable < Enumerable < Iterable < Enumerable < Reference < Object

Chainable filter over a list of Vulnerability records.

Each filter method returns a new Query so chains compose cleanly:

catalog.query
  .vendor("Microsoft")
  .ransomware
  .added_on_or_after(Time.utc(2024, 1, 1))
  .to_a

The query is lazy in shape (each method is just a transformation), but eager in execution — every step allocates an Array of the filtered subset. For typical KEV sizes (~1.5k entries) this is fine; if you need streaming you can drop down to vulnerabilities.each and write a block-form filter yourself.

Constructors

new(vulnerabilities : Array(Vulnerability))

Instance methods

added_on_or_after(date : Time) : Query

Keep entries with date_added on or after date.

added_on_or_before(date : Time) : Query

Keep entries with date_added on or before date.

cwe(code : String) : Query

Filter by CWE code ("CWE-79" or "79").

description_matches(substr : String) : Query

Substring match against short_description (case-insensitive).

due_on_or_after(date : Time) : Query

Keep entries with due_date on or after date.

due_on_or_before(date : Time) : Query

Keep entries with due_date on or before date.

due_within(span : Time::Span, now : Time = Time.utc) : Query

Keep entries due within span from now and not yet overdue. An entry whose deadline is today still counts as upcoming — see Vulnerability#overdue?.

each

Calls the given block once for each element in self, passing that element as a parameter.

a = ["a", "b", "c"]
a.each { |x| print x, " -- " }

produces:

a -- b -- c --

first?

Returns the first element in the collection. When the collection is empty, returns nil.

([1, 2, 3]).first?   # => 1
([] of Int32).first? # => nil

last?

Returns the last element of self if it's not empty, or nil.

([1, 2, 3]).last?   # => 3
([] of Int32).last? # => nil

name_matches(substr : String) : Query

Substring match against vulnerability_name (case-insensitive).

non_ransomware

Keep only entries where ransomware use is not known.

overdue(now : Time = Time.utc) : Query

Keep entries whose remediation deadline has already passed.

product(name : String) : Query

Filter by product (exact, case-insensitive).

ransomware

Keep only entries with knownRansomwareCampaignUse: "Known".

size

Returns the number of elements in this container.

sort_by_date_added

Sort the current set by date_added (ascending) into a new Query.

sort_by_due_date

Sort the current set by due_date (ascending) into a new Query.

to_a

Materialise the query as a plain Array.

unsafe_fetch(index : Int) : Vulnerability

Returns the element at the given index, without doing any bounds check.

Indexable makes sure to invoke this method with index in 0...size, so converting negative indices to positive ones is not needed here.

Clients never invoke this method directly. Instead, they access elements with #[](index) and #[]?(index).

This method should only be directly invoked if you are absolutely sure the index is in bounds, to avoid a bounds check for a small boost of performance.

vendor(name : String) : Query

Filter by vendor (exact, case-insensitive).

vulnerabilities

where

Generic escape hatch — pass any predicate.

year(year : Int32) : Query

Filter by CVE year (the YYYY portion of the CVE id).