-
Notifications
You must be signed in to change notification settings - Fork 16
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Support Trivy JSON files as source for the security warnings metric. C…
…loses #6927.
- Loading branch information
Showing
16 changed files
with
386 additions
and
69 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,14 @@ | ||
| __new__ # unused function (src/source_collectors/azure_devops/source_up_to_dateness.py:60) | ||
| __new__ # unused function (src/source_collectors/gitlab/source_up_to_dateness.py:136) | ||
| scan_status # unused variable (src/source_collectors/harbor/security_warnings.py:43) | ||
| id # unused variable (src/source_collectors/jira/velocity.py:17) | ||
| id # unused variable (src/source_collectors/jira/velocity.py:31) | ||
| __new__ # unused function (src/source_collectors/azure_devops/source_up_to_dateness.py:56) | ||
| __new__ # unused function (src/source_collectors/gitlab/source_up_to_dateness.py:133) | ||
| scan_status # unused variable (src/source_collectors/harbor/security_warnings.py:58) | ||
| id # unused variable (src/source_collectors/jira/velocity.py:16) | ||
| id # unused variable (src/source_collectors/jira/velocity.py:30) | ||
| VulnerabilityID # unused variable (src/source_collectors/trivy/security_warnings.py:13) | ||
| Title # unused variable (src/source_collectors/trivy/security_warnings.py:14) | ||
| Description # unused variable (src/source_collectors/trivy/security_warnings.py:15) | ||
| PkgName # unused variable (src/source_collectors/trivy/security_warnings.py:17) | ||
| InstalledVersion # unused variable (src/source_collectors/trivy/security_warnings.py:18) | ||
| FixedVersion # unused variable (src/source_collectors/trivy/security_warnings.py:19) | ||
| References # unused variable (src/source_collectors/trivy/security_warnings.py:20) | ||
| Target # unused variable (src/source_collectors/trivy/security_warnings.py:26) | ||
| Vulnerabilities # unused variable (src/source_collectors/trivy/security_warnings.py:27) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Empty file.
62 changes: 62 additions & 0 deletions
62
components/collector/src/source_collectors/trivy/security_warnings.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| """Trivy JSON collector.""" | ||
|
|
||
| from typing import TypedDict, cast | ||
|
|
||
| from base_collectors import JSONFileSourceCollector | ||
| from collector_utilities.type import JSON | ||
| from model import Entities, Entity | ||
|
|
||
|
|
||
| class TrivyJSONVulnerability(TypedDict): | ||
| """Trivy JSON for one vulnerability.""" | ||
|
|
||
| VulnerabilityID: str | ||
| Title: str | ||
| Description: str | ||
| Severity: str | ||
| PkgName: str | ||
| InstalledVersion: str | ||
| FixedVersion: str | ||
| References: list[str] | ||
|
|
||
|
|
||
| class TrivyJSONDependencyRepository(TypedDict): | ||
| """Trivy JSON for one dependency repository.""" | ||
|
|
||
| Target: str | ||
| Vulnerabilities: list[TrivyJSONVulnerability] | None | ||
|
|
||
|
|
||
| TrivyJSON = list[TrivyJSONDependencyRepository] | ||
|
|
||
|
|
||
| class TrivyJSONSecurityWarnings(JSONFileSourceCollector): | ||
| """Trivy JSON collector for security warnings.""" | ||
|
|
||
| def _parse_json(self, json: JSON, filename: str) -> Entities: | ||
| """Override to parse the analysis results from the Trivy JSON.""" | ||
| entities = Entities() | ||
| for dependency_repository in cast(TrivyJSON, json): | ||
| target = dependency_repository["Target"] | ||
| for vulnerability in dependency_repository.get("Vulnerabilities") or []: | ||
| vulnerability_id = vulnerability["VulnerabilityID"] | ||
| package_name = vulnerability["PkgName"] | ||
| entities.append( | ||
| Entity( | ||
| key=f"{vulnerability_id}@{package_name}@{target}", | ||
| vulnerability_id=vulnerability_id, | ||
| title=vulnerability["Title"], | ||
| description=vulnerability["Description"], | ||
| level=vulnerability["Severity"], | ||
| package_name=package_name, | ||
| installed_version=vulnerability["InstalledVersion"], | ||
| fixed_version=vulnerability.get("FixedVersion", "none"), | ||
| url=vulnerability["References"][0], | ||
| ), | ||
| ) | ||
| return entities | ||
|
|
||
| def _include_entity(self, entity: Entity) -> bool: | ||
| """Return whether to include the entity in the measurement.""" | ||
| levels = self._parameter("levels") | ||
| return entity["level"].lower() in levels |
Empty file.
85 changes: 85 additions & 0 deletions
85
components/collector/tests/source_collectors/trivy/test_security_warnings.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,85 @@ | ||
| """Unit tests for the Trivy JSON security warnings collector.""" | ||
|
|
||
| from typing import ClassVar | ||
|
|
||
| from source_collectors.trivy.security_warnings import TrivyJSON | ||
|
|
||
| from tests.source_collectors.source_collector_test_case import SourceCollectorTestCase | ||
|
|
||
|
|
||
| class TrivyJSONSecurityWarningsTest(SourceCollectorTestCase): | ||
| """Unit tests for the security warning metric.""" | ||
|
|
||
| SOURCE_TYPE = "trivy_json" | ||
| METRIC_TYPE = "security_warnings" | ||
| VULNERABILITIES_JSON: ClassVar[TrivyJSON] = [ | ||
| { | ||
| "Target": "php-app/composer.lock", | ||
| "Vulnerabilities": None, | ||
| }, | ||
| { | ||
| "Target": "trivy-ci-test (alpine 3.7.1)", | ||
| "Vulnerabilities": [ | ||
| { | ||
| "VulnerabilityID": "CVE-2018-16840", | ||
| "PkgName": "curl", | ||
| "InstalledVersion": "7.61.0-r0", | ||
| "FixedVersion": "7.61.1-r1", | ||
| "Title": 'curl: Use-after-free when closing "easy" handle in Curl_close()', | ||
| "Description": "A heap use-after-free flaw was found in curl versions from 7.59.0 through ...", | ||
| "Severity": "HIGH", | ||
| "References": [ | ||
| "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16840", | ||
| ], | ||
| }, | ||
| { | ||
| "VulnerabilityID": "CVE-2019-3822", | ||
| "PkgName": "curl", | ||
| "InstalledVersion": "7.61.1-r0", | ||
| "FixedVersion": "7.61.2-r2", | ||
| "Title": "curl: NTLMv2 type-3 header stack buffer overflow", | ||
| "Description": "libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to ...", | ||
| "Severity": "MEDIUM", | ||
| "References": [ | ||
| "https://curl.haxx.se/docs/CVE-2019-3822.html", | ||
| "https://lists.apache.org/thread.html", | ||
| ], | ||
| }, | ||
| ], | ||
| }, | ||
| ] | ||
| EXPECTED_ENTITIES: ClassVar[list[dict[str, str]]] = [ | ||
| { | ||
| "key": "CVE-2018-16840@curl@trivy-ci-test (alpine 3_7_1)", | ||
| "vulnerability_id": "CVE-2018-16840", | ||
| "title": 'curl: Use-after-free when closing "easy" handle in Curl_close()', | ||
| "description": "A heap use-after-free flaw was found in curl versions from 7.59.0 through ...", | ||
| "level": "HIGH", | ||
| "package_name": "curl", | ||
| "installed_version": "7.61.0-r0", | ||
| "fixed_version": "7.61.1-r1", | ||
| "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16840", | ||
| }, | ||
| { | ||
| "key": "CVE-2019-3822@curl@trivy-ci-test (alpine 3_7_1)", | ||
| "vulnerability_id": "CVE-2019-3822", | ||
| "title": "curl: NTLMv2 type-3 header stack buffer overflow", | ||
| "description": "libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to ...", | ||
| "level": "MEDIUM", | ||
| "package_name": "curl", | ||
| "installed_version": "7.61.1-r0", | ||
| "fixed_version": "7.61.2-r2", | ||
| "url": "https://curl.haxx.se/docs/CVE-2019-3822.html", | ||
| }, | ||
| ] | ||
|
|
||
| async def test_warnings(self): | ||
| """Test the number of security warnings.""" | ||
| response = await self.collect(get_request_json_return_value=self.VULNERABILITIES_JSON) | ||
| self.assert_measurement(response, value="2", entities=self.EXPECTED_ENTITIES) | ||
|
|
||
| async def test_warning_levels(self): | ||
| """Test the number of security warnings when specifying a level.""" | ||
| self.set_source_parameter("levels", ["high", "critical"]) | ||
| response = await self.collect(get_request_json_return_value=self.VULNERABILITIES_JSON) | ||
| self.assert_measurement(response, value="1", entities=[self.EXPECTED_ENTITIES[0]]) |
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| """SARIF JSON for security warnings source.""" | ||
| """SARIF JSON source.""" | ||
|
|
||
| from pydantic import HttpUrl | ||
|
|
||
|
|
||
Oops, something went wrong.