#130 Security issues output (#131)

Co-authored-by: Nicola Coretti <[email protected]>
exasol · Feb 5, 2024 · a986d81 · a986d81
1 parent b0a7037
commit a986d81
Show file tree

Hide file tree

Showing 8 changed files with 103 additions and 20 deletions.
diff --git a/.github/actions/python-environment/action.yml b/.github/actions/python-environment/action.yml
@@ -19,7 +19,7 @@ runs:
   steps:
 
     - name: Setup Python (${{ inputs.python-version}})
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
       with:
         python-version: ${{ inputs.python-version }}
 
@@ -30,4 +30,4 @@ runs:
 
     - name: Poetry install
       run: poetry install
-      shell: bash
+      shell: bash
diff --git a/.github/actions/security-issues/action.yml b/.github/actions/security-issues/action.yml
@@ -19,13 +19,20 @@ inputs:
     description: 'Project the created tickets shall be associated with'
     required: false
 
+
+outputs:
+
+  created-issues:
+    description: 'Information about the created issues and the vulnerabilities in JSONL format'
+    value: ${{ steps.get-created-issues.outputs.issues }}
+
 runs:
 
   using: "composite"
   steps:
 
     - name: Setup Python (${{ inputs.python-version}})
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
       with:
         python-version: 3.11
 
@@ -57,13 +64,21 @@ runs:
         GH_TOKEN: ${{ inputs.github-token }}
       shell: bash
       run: |
-        tbx security cve create --project "${{ inputs.project }}" < issues.jsonl | tee created.txt
+        tbx security cve create --project "${{ inputs.project }}" < issues.jsonl | tee created.jsonl
+
+    - name: Define Output Parameter
+      id: get-created-issues
+      shell: bash
+      run: |
+        echo 'issues<<EOF' >> "$GITHUB_OUTPUT"
+        cat created.jsonl >> "$GITHUB_OUTPUT"
+        echo 'EOF' >> "$GITHUB_OUTPUT"
 
     - name: Create Report
       shell: bash
       run: |
         echo -e "# Summary\n" >> $GITHUB_STEP_SUMMARY
         echo -e "## Created Security Issue\n" >> $GITHUB_STEP_SUMMARY
-        cat created.txt >> $GITHUB_STEP_SUMMARY
+        cat created.jsonl >> $GITHUB_STEP_SUMMARY
         echo -e "## Filtered Security Issue\n" >> $GITHUB_STEP_SUMMARY
         tail -n +2 filtered.txt | grep . || true >> $GITHUB_STEP_SUMMARY
diff --git a/doc/changelog.rst b/doc/changelog.rst
@@ -6,6 +6,9 @@
 Unreleased
 ==========
 
+✨ Added
+--------
+* Added output `created-issues` to `security-issues` action containing the found security issues including the created GitHub issues in JSONL format.
 
 .. _changelog-0.7.0:
 

diff --git a/exasol/toolbox/templates/github/actions/python-environment/action.yml b/exasol/toolbox/templates/github/actions/python-environment/action.yml
@@ -19,7 +19,7 @@ runs:
   steps:
 
     - name: Setup Python (${{ inputs.python-version}})
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
       with:
         python-version: ${{ inputs.python-version }}
 

diff --git a/exasol/toolbox/tools/security.py b/exasol/toolbox/tools/security.py
@@ -88,14 +88,14 @@ def from_maven(report: str) -> Iterable[Issue]:
     # Note: Consider adding warnings if there is the same cve with multiple coordinates
     report = json.loads(report)
     dependencies = report.get("vulnerable", {})  # type: ignore
-    for _, dependency in dependencies.items():  # type: ignore
+    for dependency_name, dependency in dependencies.items():  # type: ignore
         for v in dependency["vulnerabilities"]:  # type: ignore
             references = [v["reference"]] + v["externalReferences"]
             yield Issue(
                 cve=v["cve"],
                 cwe=v["cwe"],
                 description=v["description"],
-                coordinates=dependency["coordinates"],
+                coordinates=dependency_name,
                 references=tuple(references),
             )
 
@@ -251,10 +251,14 @@ def create(
     Links to the created issue(s)
     """
     for issue in _issues(input_file):
-        std_err, std_out = create_security_issue(issue, project)
+        std_err, issue_url = create_security_issue(issue, project)
         stderr(std_err)
-        stdout(std_out)
+        stdout(format_jsonl(issue_url, issue))
 
+def format_jsonl(issue_url: str, issue: Issue) -> str:
+    issue_json = asdict(issue)
+    issue_json["url"] = issue_url.strip()
+    return json.dumps(issue_json)
 
 if __name__ == "__main__":
     CLI()
diff --git a/test/integration/cli/security-cve-convert.t b/test/integration/cli/security-cve-convert.t
@@ -73,7 +73,7 @@ Test convert maven input from stdin
       "cve": "CVE-2020-4333",
       "cwe": "CWE-502",
       "description": "When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.\n\nThis issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2.  Users should update to apache-avro version 1.11.3 which addresses this issue.\n\n",
-      "coordinates": "pkg:maven/org.apache.avro/avro@1.7.7",
+      "coordinates": "org.apache.avro:avro:jar:1.7.7:compile",
       "references": [
           "https://ossindex.sonatype.org/vulnerability/CVE-2023-39410?component-type=maven&component-name=org.apache.avro%2Favro&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1",
           "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39410",
@@ -86,7 +86,7 @@ Test convert maven input from stdin
       "cve": "CVE-2020-36641",
       "cwe": "CWE-611",
       "description": "A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function ResponseParser of the file src/main/java/de/timroes/axmlrpc/ResponseParser.java. The manipulation leads to xml external entity reference. Upgrading to version 1.12.1 is able to address this issue. The patch is identified as ad6615b3ec41353e614f6ea5fdd5b046442a832b. It is recommended to upgrade the affected component. VDB-217450 is the identifier assigned to this vulnerability.\n\nSonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2020-36641 for details",
-      "coordinates": "pkg:maven/fr.turri/aXMLRPC@1.13.0",
+      "coordinates": "fr.turri:aXMLRPC:jar:1.13.0:test",
       "references": [
           "https://ossindex.sonatype.org/vulnerability/CVE-2020-36641?component-type=maven&component-name=fr.turri%2FaXMLRPC&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1",
           "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-36641",
@@ -101,7 +101,7 @@ Test convert maven input from file
       "cve": "CVE-2020-4333",
       "cwe": "CWE-502",
       "description": "When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.\n\nThis issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2.  Users should update to apache-avro version 1.11.3 which addresses this issue.\n\n",
-      "coordinates": "pkg:maven/org.apache.avro/avro@1.7.7",
+      "coordinates": "org.apache.avro:avro:jar:1.7.7:compile",
       "references": [
           "https://ossindex.sonatype.org/vulnerability/CVE-2023-39410?component-type=maven&component-name=org.apache.avro%2Favro&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1",
           "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39410",
@@ -114,7 +114,7 @@ Test convert maven input from file
       "cve": "CVE-2020-36641",
       "cwe": "CWE-611",
       "description": "A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function ResponseParser of the file src/main/java/de/timroes/axmlrpc/ResponseParser.java. The manipulation leads to xml external entity reference. Upgrading to version 1.12.1 is able to address this issue. The patch is identified as ad6615b3ec41353e614f6ea5fdd5b046442a832b. It is recommended to upgrade the affected component. VDB-217450 is the identifier assigned to this vulnerability.\n\nSonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2020-36641 for details",
-      "coordinates": "pkg:maven/fr.turri/aXMLRPC@1.13.0",
+      "coordinates": "fr.turri:aXMLRPC:jar:1.13.0:test",
       "references": [
           "https://ossindex.sonatype.org/vulnerability/CVE-2020-36641?component-type=maven&component-name=fr.turri%2FaXMLRPC&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1",
           "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-36641",

diff --git a/test/integration/cli/security-cve-create.t b/test/integration/cli/security-cve-create.t
@@ -2,7 +2,7 @@ Create a GitHub CLI mock
 
   $ cat > gh <<EOF
   > #!/usr/bin/sh
-  > echo https://github.com/exasol/a-project/issues/`uuidgen`
+  > echo https://github.com/exasol/a-project/issues/123
   > EOF
 
   $ chmod u+x gh
@@ -18,6 +18,30 @@ Create test input
 
 Run test case
 
-  $ tbx security cve create cves.jsonl 2> /dev/null | grep .
-  https://github.com/exasol/a-project/issues/[a-f0-9\-]+ (re)
-  https://github.com/exasol/a-project/issues/[a-f0-9\-]+ (re)
+  $ tbx security cve create cves.jsonl 2> /dev/null | python -m json.tool --json-lines
+  {
+      "cve": "CVE-2023-39410",
+      "cwe": "CWE-502",
+      "description": "When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.\n\nThis issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2.  Users should update to apache-avro version 1.11.3 which addresses this issue.\n\n",
+      "coordinates": "pkg:maven/org.apache.avro/[email protected]",
+      "references": [
+          "https://ossindex.sonatype.org/vulnerability/CVE-2023-39410?component-type=maven&component-name=org.apache.avro%2Favro&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1",
+          "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39410",
+          "https://github.com/apache/avro/pull/2432",
+          "https://issues.apache.org/jira/browse/AVRO-3819",
+          "https://lists.apache.org/thread/q142wj99cwdd0jo5lvdoxzoymlqyjdds"
+      ],
+      "url": "https://github.com/exasol/a-project/issues/123"
+  }
+  {
+      "cve": "CVE-2020-36641",
+      "cwe": "CWE-611",
+      "description": "A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function ResponseParser of the file src/main/java/de/timroes/axmlrpc/ResponseParser.java. The manipulation leads to xml external entity reference. Upgrading to version 1.12.1 is able to address this issue. The patch is identified as ad6615b3ec41353e614f6ea5fdd5b046442a832b. It is recommended to upgrade the affected component. VDB-217450 is the identifier assigned to this vulnerability.\n\nSonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2020-36641 for details",
+      "coordinates": "pkg:maven/fr.turri/[email protected]",
+      "references": [
+          "https://ossindex.sonatype.org/vulnerability/CVE-2020-36641?component-type=maven&component-name=fr.turri%2FaXMLRPC&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1",
+          "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-36641",
+          "https://www.tenable.com/cve/CVE-2020-36641"
+      ],
+      "url": "https://github.com/exasol/a-project/issues/123"
+  }
diff --git a/test/unit/security_test.py b/test/unit/security_test.py
@@ -317,7 +317,7 @@ def test_convert_maven_input(maven_report):  # pylint: disable=redefined-outer-n
             "Java SDK up to and including 1.11.2.  Users should update "
             "to apache-avro version 1.11.3 which addresses this issue.\n"
             "\n",
-            coordinates="pkg:maven/org.apache.avro/avro@1.7.7",
+            coordinates="org.apache.avro:avro:jar:1.7.7:compile",
             references=(
                 "https://ossindex.sonatype.org/vulnerability/CVE-2023-39410?component-type=maven&component-name=org.apache.avro%2Favro&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1",
                 "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39410",
@@ -344,7 +344,7 @@ def test_convert_maven_input(maven_report):  # pylint: disable=redefined-outer-n
             "differ from those defined at NVD. See "
             "https://ossindex.sonatype.org/vulnerability/CVE-2020-36641 "
             "for details",
-            coordinates="pkg:maven/fr.turri/aXMLRPC@1.13.0",
+            coordinates="fr.turri:aXMLRPC:jar:1.13.0:test",
             references=(
                 "https://ossindex.sonatype.org/vulnerability/CVE-2020-36641?component-type=maven&component-name=fr.turri%2FaXMLRPC&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1",
                 "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-36641",
@@ -359,3 +359,40 @@ def test_convert_maven_input(maven_report):  # pylint: disable=redefined-outer-n
 def test_convert_maven_input_no_vulnerable():  # pylint: disable=redefined-outer-name
     actual = set(security.from_maven("{}"))
     assert len(actual) == 0
+
+def test_format_jsonl():
+    issue = security.Issue(
+        coordinates="coordinates",
+        cve="cve", cwe="cwe",
+        description="description", 
+        references=()
+    )
+    expected = json.dumps({ 
+        "cve": "cve",
+        "cwe": "cwe",
+        "description": "description",
+        "coordinates": "coordinates",
+        "references": [],
+        "url": "issue_url"
+    })
+    actual = security.format_jsonl("issue_url", issue)
+    assert actual == expected
+
+
+def test_format_jsonl_removes_newline():
+    issue = security.Issue(
+        coordinates="coordinates",
+        cve="cve", cwe="cwe",
+        description="description",
+        references=()
+    )
+    expected = json.dumps({
+        "cve": "cve",
+        "cwe": "cwe",
+        "description": "description",
+        "coordinates": "coordinates",
+        "references": [],
+        "url": "issue_url"
+    })
+    actual = security.format_jsonl("issue_url\n", issue)
+    assert actual == expected