-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Paul Norton
committed
Jan 11, 2024
1 parent
cf01e6f
commit b4a8e11
Showing
7 changed files
with
435 additions
and
50 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
156 changes: 156 additions & 0 deletions
156
policy/policy_handler/legacy/image_packages_by_digest.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,156 @@ | ||
| package legacy | ||
|
|
||
| import ( | ||
| "context" | ||
| "github.com/atomist-skills/go-skill" | ||
| "github.com/atomist-skills/go-skill/policy/data" | ||
| ) | ||
|
|
||
| // Versions of scout-cli-plugin created before the introduction of fixedQueryResults | ||
| // directly passed a []Package object in the metadata for local evaluation. | ||
| // This was then supplemented by a synchronous GraphQL call to load vulnerability data, | ||
| // so we mock the entire process to support these older versions. | ||
| // TODO remove this whole system when no longer used | ||
|
|
||
| const ( | ||
| ImagePackagesByDigestQueryName = "image-packages-by-digest" | ||
| vulnerabilitiesByPackageQueryName = "vulnerabilities-by-package" | ||
|
|
||
| // language=graphql | ||
| vulnerabilitiesByPackageQuery = ` | ||
| query ($context: Context!, $packageUrls: [String!]!) { | ||
| vulnerabilitiesByPackage(context: $context, packageUrls: $packageUrls) { | ||
| purl | ||
| vulnerabilities { | ||
| cvss { | ||
| severity | ||
| score | ||
| } | ||
| fixedBy | ||
| publishedAt | ||
| source | ||
| sourceId | ||
| updatedAt | ||
| url | ||
| vulnerableRange | ||
| } | ||
| } | ||
| }` | ||
| ) | ||
|
|
||
| type ( | ||
| Package struct { | ||
| Licenses []string `edn:"licenses,omitempty"` // only needed for the license policy evaluation | ||
| Name string `edn:"name"` | ||
| Namespace string `edn:"namespace"` | ||
| Version string `edn:"version"` | ||
| Purl string `edn:"purl"` | ||
| Type string `edn:"type"` | ||
| } | ||
|
|
||
| ImagePackagesByDigestResponse struct { | ||
| ImagePackagesByDigest *ImagePackagesByDigest `json:"imagePackagesByDigest" edn:"imagePackagesByDigest"` | ||
| } | ||
|
|
||
| ImagePackagesByDigest struct { | ||
| ImagePackages ImagePackages `json:"imagePackages" edn:"imagePackages"` | ||
| } | ||
|
|
||
| ImagePackages struct { | ||
| Packages []Packages `json:"packages" edn:"packages"` | ||
| } | ||
|
|
||
| Packages struct { | ||
| Package PackageWithLicenses `json:"package" edn:"package"` | ||
| } | ||
|
|
||
| PackageWithLicenses struct { | ||
| Licenses []string `json:"licenses" edn:"licenses"` | ||
| Name string `json:"name" edn:"name"` | ||
| Namespace *string `json:"namespace" edn:"namespace"` | ||
| Version string `json:"version" edn:"version"` | ||
| Purl string `json:"purl" edn:"purl"` | ||
| Type string `json:"type" edn:"type"` | ||
| Vulnerabilities []Vulnerability `json:"vulnerabilities" edn:"vulnerabilities"` | ||
| } | ||
|
|
||
| Vulnerability struct { | ||
| Cvss Cvss `json:"cvss"` | ||
| FixedBy *string `json:"fixedBy"` | ||
| PublishedAt string `json:"publishedAt"` | ||
| Source string `json:"source"` | ||
| SourceID string `json:"sourceId"` | ||
| UpdatedAt string `json:"updatedAt"` | ||
| URL *string `json:"url"` | ||
| VulnerableRange string `json:"vulnerableRange"` | ||
| } | ||
|
|
||
| Cvss struct { | ||
| Severity *string `json:"severity"` | ||
| Score *float32 `json:"score"` | ||
| } | ||
|
|
||
| VulnerabilitiesByPackageResponse struct { | ||
| VulnerabilitiesByPackage []VulnerabilitiesByPackage `json:"vulnerabilitiesByPackage"` | ||
| } | ||
|
|
||
| VulnerabilitiesByPackage struct { | ||
| Purl string `json:"purl"` | ||
| Vulnerabilities []Vulnerability `json:"vulnerabilities"` | ||
| } | ||
| ) | ||
|
|
||
| func MockImagePackagesByDigest(ctx context.Context, req skill.RequestContext, sbomPkgs []Package) (ImagePackagesByDigestResponse, error) { | ||
| // separated for testing | ||
| ds, err := data.NewSyncGraphqlDataSource(ctx, req) | ||
| if err != nil { | ||
| return ImagePackagesByDigestResponse{}, err | ||
| } | ||
|
|
||
| return mockImagePackagesByDigest(ctx, req, sbomPkgs, ds) | ||
| } | ||
|
|
||
| func mockImagePackagesByDigest(ctx context.Context, req skill.RequestContext, sbomPkgs []Package, ds data.DataSource) (ImagePackagesByDigestResponse, error) { | ||
| purls := []string{} | ||
| for _, p := range sbomPkgs { | ||
| purls = append(purls, p.Purl) | ||
| } | ||
|
|
||
| var vulnsResponse VulnerabilitiesByPackageResponse | ||
| _, err := ds.Query(ctx, vulnerabilitiesByPackageQueryName, vulnerabilitiesByPackageQuery, map[string]interface{}{ | ||
| "context": data.GqlContext(req), | ||
| "packageUrls": purls, | ||
| }, &vulnsResponse) | ||
| if err != nil { | ||
| return ImagePackagesByDigestResponse{}, err | ||
| } | ||
|
|
||
| vulns := map[string][]Vulnerability{} | ||
| for _, v := range vulnsResponse.VulnerabilitiesByPackage { | ||
| vulns[v.Purl] = v.Vulnerabilities | ||
| } | ||
|
|
||
| pkgs := []Packages{} | ||
| for _, a := range sbomPkgs { | ||
| ns := a.Namespace | ||
| pkgs = append(pkgs, Packages{ | ||
| Package: PackageWithLicenses{ | ||
| Licenses: a.Licenses, | ||
| Name: a.Name, | ||
| Namespace: &ns, | ||
| Version: a.Version, | ||
| Purl: a.Purl, | ||
| Type: a.Type, | ||
| Vulnerabilities: vulns[a.Purl], | ||
| }, | ||
| }) | ||
| } | ||
|
|
||
| return ImagePackagesByDigestResponse{ | ||
| ImagePackagesByDigest: &ImagePackagesByDigest{ | ||
| ImagePackages: ImagePackages{ | ||
| Packages: pkgs, | ||
| }, | ||
| }, | ||
| }, nil | ||
| } |
110 changes: 110 additions & 0 deletions
110
policy/policy_handler/legacy/image_packages_by_digest_test.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,110 @@ | ||
| package legacy | ||
|
|
||
| import ( | ||
| "context" | ||
| "github.com/atomist-skills/go-skill" | ||
| "github.com/atomist-skills/go-skill/internal/test_util" | ||
| "github.com/atomist-skills/go-skill/policy/data" | ||
| "github.com/stretchr/testify/assert" | ||
| "testing" | ||
| ) | ||
|
|
||
| type MockDs struct { | ||
| t *testing.T | ||
| } | ||
|
|
||
| func (ds MockDs) Query(ctx context.Context, queryName string, query string, variables map[string]interface{}, output interface{}) (*data.QueryResponse, error) { | ||
| assert.Equal(ds.t, queryName, vulnerabilitiesByPackageQueryName) | ||
| assert.Equal(ds.t, query, vulnerabilitiesByPackageQuery) | ||
|
|
||
| r := output.(*VulnerabilitiesByPackageResponse) | ||
| r.VulnerabilitiesByPackage = []VulnerabilitiesByPackage{ | ||
| { | ||
| Purl: "pkg:deb/ubuntu/libpcre3@2:8.39-12ubuntu0.1?arch=amd64&upstream=pcre3&distro=ubuntu-20.04", | ||
| Vulnerabilities: []Vulnerability{{ | ||
| Cvss: Cvss{ | ||
| Severity: test_util.Pointer("HIGH"), | ||
| Score: test_util.Pointer(float32(7.5)), | ||
| }, | ||
| FixedBy: nil, | ||
| PublishedAt: "2017-07-10T11:29:00Z", | ||
| Source: "nist", | ||
| SourceID: "CVE-2017-11164", | ||
| UpdatedAt: "2023-04-12T11:15:00Z", // 2006-01-02T15:04:05Z07:00 | ||
| URL: test_util.Pointer("https://scout.docker.com/v/CVE-2017-11164"), | ||
| VulnerableRange: ">=0", | ||
| }}, | ||
| }, | ||
| } | ||
|
|
||
| return &data.QueryResponse{}, nil | ||
| } | ||
|
|
||
| func Test_mockImagePackagesByDigest(t *testing.T) { | ||
| lPkgs := []Package{ | ||
| { | ||
| Licenses: []string{"GPL-3.0"}, | ||
| Name: "libpcre3", | ||
| Namespace: "pkgNamespace", | ||
| Version: "2:8.39-12ubuntu0.1", | ||
| Purl: "pkg:deb/ubuntu/libpcre3@2:8.39-12ubuntu0.1?arch=amd64&upstream=pcre3&distro=ubuntu-20.04", | ||
| Type: "pkgType", | ||
| }, | ||
| { | ||
| Licenses: []string{"AGPL"}, | ||
| Name: "coreutils", | ||
| Namespace: "coreutilsNamespace", | ||
| Version: "8.30-3ubuntu2", | ||
| Purl: "pkg:deb/ubuntu/[email protected]?arch=amd64&distro=ubuntu-20.04", | ||
| Type: "coreutilsType", | ||
| }, | ||
| } | ||
|
|
||
| actual, err := mockImagePackagesByDigest(context.TODO(), skill.RequestContext{}, lPkgs, MockDs{t}) | ||
| assert.NoError(t, err) | ||
|
|
||
| expected := ImagePackagesByDigestResponse{ | ||
| ImagePackagesByDigest: &ImagePackagesByDigest{ | ||
| ImagePackages: ImagePackages{ | ||
| Packages: []Packages{ | ||
| { | ||
| Package: PackageWithLicenses{ | ||
| Licenses: []string{"GPL-3.0"}, | ||
| Name: "libpcre3", | ||
| Namespace: test_util.Pointer("pkgNamespace"), | ||
| Version: "2:8.39-12ubuntu0.1", | ||
| Purl: "pkg:deb/ubuntu/libpcre3@2:8.39-12ubuntu0.1?arch=amd64&upstream=pcre3&distro=ubuntu-20.04", | ||
| Type: "pkgType", | ||
| Vulnerabilities: []Vulnerability{{ | ||
| Cvss: Cvss{ | ||
| Severity: test_util.Pointer("HIGH"), | ||
| Score: test_util.Pointer(float32(7.5)), | ||
| }, | ||
| FixedBy: nil, | ||
| PublishedAt: "2017-07-10T11:29:00Z", | ||
| Source: "nist", | ||
| SourceID: "CVE-2017-11164", | ||
| UpdatedAt: "2023-04-12T11:15:00Z", // 2006-01-02T15:04:05Z07:00 | ||
| URL: test_util.Pointer("https://scout.docker.com/v/CVE-2017-11164"), | ||
| VulnerableRange: ">=0", | ||
| }}, | ||
| }, | ||
| }, | ||
| { | ||
| Package: PackageWithLicenses{ | ||
| Licenses: []string{"AGPL"}, | ||
| Name: "coreutils", | ||
| Namespace: test_util.Pointer("coreutilsNamespace"), | ||
| Version: "8.30-3ubuntu2", | ||
| Purl: "pkg:deb/ubuntu/[email protected]?arch=amd64&distro=ubuntu-20.04", | ||
| Type: "coreutilsType", | ||
| Vulnerabilities: nil, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| } | ||
|
|
||
| assert.Equal(t, expected, actual) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.