From a986d819ed490dbeeb9edc5ce50687a46aee8bd9 Mon Sep 17 00:00:00 2001 From: Christoph Pirkl Date: Mon, 5 Feb 2024 13:55:04 +0100 Subject: [PATCH] #130 Security issues output (#131) Co-authored-by: Nicola Coretti --- .github/actions/python-environment/action.yml | 4 +- .github/actions/security-issues/action.yml | 21 ++++++++-- doc/changelog.rst | 3 ++ .../actions/python-environment/action.yml | 2 +- exasol/toolbox/tools/security.py | 12 ++++-- test/integration/cli/security-cve-convert.t | 8 ++-- test/integration/cli/security-cve-create.t | 32 +++++++++++++-- test/unit/security_test.py | 41 ++++++++++++++++++- 8 files changed, 103 insertions(+), 20 deletions(-) diff --git a/.github/actions/python-environment/action.yml b/.github/actions/python-environment/action.yml index d968434b1..953071760 100644 --- a/.github/actions/python-environment/action.yml +++ b/.github/actions/python-environment/action.yml @@ -19,7 +19,7 @@ runs: steps: - name: Setup Python (${{ inputs.python-version}}) - uses: actions/setup-python@v4 + uses: actions/setup-python@v5 with: python-version: ${{ inputs.python-version }} @@ -30,4 +30,4 @@ runs: - name: Poetry install run: poetry install - shell: bash \ No newline at end of file + shell: bash diff --git a/.github/actions/security-issues/action.yml b/.github/actions/security-issues/action.yml index 8241e99d7..d4627650f 100644 --- a/.github/actions/security-issues/action.yml +++ b/.github/actions/security-issues/action.yml @@ -19,13 +19,20 @@ inputs: description: 'Project the created tickets shall be associated with' required: false + +outputs: + + created-issues: + description: 'Information about the created issues and the vulnerabilities in JSONL format' + value: ${{ steps.get-created-issues.outputs.issues }} + runs: using: "composite" steps: - name: Setup Python (${{ inputs.python-version}}) - uses: actions/setup-python@v4 + uses: actions/setup-python@v5 with: python-version: 3.11 @@ -57,13 +64,21 @@ runs: GH_TOKEN: ${{ inputs.github-token }} shell: bash run: | - tbx security cve create --project "${{ inputs.project }}" < issues.jsonl | tee created.txt + tbx security cve create --project "${{ inputs.project }}" < issues.jsonl | tee created.jsonl + + - name: Define Output Parameter + id: get-created-issues + shell: bash + run: | + echo 'issues<> "$GITHUB_OUTPUT" + cat created.jsonl >> "$GITHUB_OUTPUT" + echo 'EOF' >> "$GITHUB_OUTPUT" - name: Create Report shell: bash run: | echo -e "# Summary\n" >> $GITHUB_STEP_SUMMARY echo -e "## Created Security Issue\n" >> $GITHUB_STEP_SUMMARY - cat created.txt >> $GITHUB_STEP_SUMMARY + cat created.jsonl >> $GITHUB_STEP_SUMMARY echo -e "## Filtered Security Issue\n" >> $GITHUB_STEP_SUMMARY tail -n +2 filtered.txt | grep . || true >> $GITHUB_STEP_SUMMARY diff --git a/doc/changelog.rst b/doc/changelog.rst index 623478bdf..c30d79526 100644 --- a/doc/changelog.rst +++ b/doc/changelog.rst @@ -6,6 +6,9 @@ Unreleased ========== +✨ Added +-------- +* Added output `created-issues` to `security-issues` action containing the found security issues including the created GitHub issues in JSONL format. .. _changelog-0.7.0: diff --git a/exasol/toolbox/templates/github/actions/python-environment/action.yml b/exasol/toolbox/templates/github/actions/python-environment/action.yml index 839e6316d..953071760 100644 --- a/exasol/toolbox/templates/github/actions/python-environment/action.yml +++ b/exasol/toolbox/templates/github/actions/python-environment/action.yml @@ -19,7 +19,7 @@ runs: steps: - name: Setup Python (${{ inputs.python-version}}) - uses: actions/setup-python@v4 + uses: actions/setup-python@v5 with: python-version: ${{ inputs.python-version }} diff --git a/exasol/toolbox/tools/security.py b/exasol/toolbox/tools/security.py index 914ba86b1..32abb0be1 100644 --- a/exasol/toolbox/tools/security.py +++ b/exasol/toolbox/tools/security.py @@ -88,14 +88,14 @@ def from_maven(report: str) -> Iterable[Issue]: # Note: Consider adding warnings if there is the same cve with multiple coordinates report = json.loads(report) dependencies = report.get("vulnerable", {}) # type: ignore - for _, dependency in dependencies.items(): # type: ignore + for dependency_name, dependency in dependencies.items(): # type: ignore for v in dependency["vulnerabilities"]: # type: ignore references = [v["reference"]] + v["externalReferences"] yield Issue( cve=v["cve"], cwe=v["cwe"], description=v["description"], - coordinates=dependency["coordinates"], + coordinates=dependency_name, references=tuple(references), ) @@ -251,10 +251,14 @@ def create( Links to the created issue(s) """ for issue in _issues(input_file): - std_err, std_out = create_security_issue(issue, project) + std_err, issue_url = create_security_issue(issue, project) stderr(std_err) - stdout(std_out) + stdout(format_jsonl(issue_url, issue)) +def format_jsonl(issue_url: str, issue: Issue) -> str: + issue_json = asdict(issue) + issue_json["url"] = issue_url.strip() + return json.dumps(issue_json) if __name__ == "__main__": CLI() diff --git a/test/integration/cli/security-cve-convert.t b/test/integration/cli/security-cve-convert.t index 9ac554413..7860a00e9 100644 --- a/test/integration/cli/security-cve-convert.t +++ b/test/integration/cli/security-cve-convert.t @@ -73,7 +73,7 @@ Test convert maven input from stdin "cve": "CVE-2020-4333", "cwe": "CWE-502", "description": "When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.\n\nThis issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro version 1.11.3 which addresses this issue.\n\n", - "coordinates": "pkg:maven/org.apache.avro/avro@1.7.7", + "coordinates": "org.apache.avro:avro:jar:1.7.7:compile", "references": [ "https://ossindex.sonatype.org/vulnerability/CVE-2023-39410?component-type=maven&component-name=org.apache.avro%2Favro&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39410", @@ -86,7 +86,7 @@ Test convert maven input from stdin "cve": "CVE-2020-36641", "cwe": "CWE-611", "description": "A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function ResponseParser of the file src/main/java/de/timroes/axmlrpc/ResponseParser.java. The manipulation leads to xml external entity reference. Upgrading to version 1.12.1 is able to address this issue. The patch is identified as ad6615b3ec41353e614f6ea5fdd5b046442a832b. It is recommended to upgrade the affected component. VDB-217450 is the identifier assigned to this vulnerability.\n\nSonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2020-36641 for details", - "coordinates": "pkg:maven/fr.turri/aXMLRPC@1.13.0", + "coordinates": "fr.turri:aXMLRPC:jar:1.13.0:test", "references": [ "https://ossindex.sonatype.org/vulnerability/CVE-2020-36641?component-type=maven&component-name=fr.turri%2FaXMLRPC&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-36641", @@ -101,7 +101,7 @@ Test convert maven input from file "cve": "CVE-2020-4333", "cwe": "CWE-502", "description": "When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.\n\nThis issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro version 1.11.3 which addresses this issue.\n\n", - "coordinates": "pkg:maven/org.apache.avro/avro@1.7.7", + "coordinates": "org.apache.avro:avro:jar:1.7.7:compile", "references": [ "https://ossindex.sonatype.org/vulnerability/CVE-2023-39410?component-type=maven&component-name=org.apache.avro%2Favro&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39410", @@ -114,7 +114,7 @@ Test convert maven input from file "cve": "CVE-2020-36641", "cwe": "CWE-611", "description": "A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function ResponseParser of the file src/main/java/de/timroes/axmlrpc/ResponseParser.java. The manipulation leads to xml external entity reference. Upgrading to version 1.12.1 is able to address this issue. The patch is identified as ad6615b3ec41353e614f6ea5fdd5b046442a832b. It is recommended to upgrade the affected component. VDB-217450 is the identifier assigned to this vulnerability.\n\nSonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2020-36641 for details", - "coordinates": "pkg:maven/fr.turri/aXMLRPC@1.13.0", + "coordinates": "fr.turri:aXMLRPC:jar:1.13.0:test", "references": [ "https://ossindex.sonatype.org/vulnerability/CVE-2020-36641?component-type=maven&component-name=fr.turri%2FaXMLRPC&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-36641", diff --git a/test/integration/cli/security-cve-create.t b/test/integration/cli/security-cve-create.t index 532171143..b4eeee735 100644 --- a/test/integration/cli/security-cve-create.t +++ b/test/integration/cli/security-cve-create.t @@ -2,7 +2,7 @@ Create a GitHub CLI mock $ cat > gh < #!/usr/bin/sh - > echo https://github.com/exasol/a-project/issues/`uuidgen` + > echo https://github.com/exasol/a-project/issues/123 > EOF $ chmod u+x gh @@ -18,6 +18,30 @@ Create test input Run test case - $ tbx security cve create cves.jsonl 2> /dev/null | grep . - https://github.com/exasol/a-project/issues/[a-f0-9\-]+ (re) - https://github.com/exasol/a-project/issues/[a-f0-9\-]+ (re) + $ tbx security cve create cves.jsonl 2> /dev/null | python -m json.tool --json-lines + { + "cve": "CVE-2023-39410", + "cwe": "CWE-502", + "description": "When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.\n\nThis issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro version 1.11.3 which addresses this issue.\n\n", + "coordinates": "pkg:maven/org.apache.avro/avro@1.7.7", + "references": [ + "https://ossindex.sonatype.org/vulnerability/CVE-2023-39410?component-type=maven&component-name=org.apache.avro%2Favro&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1", + "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39410", + "https://github.com/apache/avro/pull/2432", + "https://issues.apache.org/jira/browse/AVRO-3819", + "https://lists.apache.org/thread/q142wj99cwdd0jo5lvdoxzoymlqyjdds" + ], + "url": "https://github.com/exasol/a-project/issues/123" + } + { + "cve": "CVE-2020-36641", + "cwe": "CWE-611", + "description": "A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function ResponseParser of the file src/main/java/de/timroes/axmlrpc/ResponseParser.java. The manipulation leads to xml external entity reference. Upgrading to version 1.12.1 is able to address this issue. The patch is identified as ad6615b3ec41353e614f6ea5fdd5b046442a832b. It is recommended to upgrade the affected component. VDB-217450 is the identifier assigned to this vulnerability.\n\nSonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2020-36641 for details", + "coordinates": "pkg:maven/fr.turri/aXMLRPC@1.13.0", + "references": [ + "https://ossindex.sonatype.org/vulnerability/CVE-2020-36641?component-type=maven&component-name=fr.turri%2FaXMLRPC&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1", + "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-36641", + "https://www.tenable.com/cve/CVE-2020-36641" + ], + "url": "https://github.com/exasol/a-project/issues/123" + } diff --git a/test/unit/security_test.py b/test/unit/security_test.py index 80583e90f..dd8c50f3f 100644 --- a/test/unit/security_test.py +++ b/test/unit/security_test.py @@ -317,7 +317,7 @@ def test_convert_maven_input(maven_report): # pylint: disable=redefined-outer-n "Java SDK up to and including 1.11.2. Users should update " "to apache-avro version 1.11.3 which addresses this issue.\n" "\n", - coordinates="pkg:maven/org.apache.avro/avro@1.7.7", + coordinates="org.apache.avro:avro:jar:1.7.7:compile", references=( "https://ossindex.sonatype.org/vulnerability/CVE-2023-39410?component-type=maven&component-name=org.apache.avro%2Favro&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39410", @@ -344,7 +344,7 @@ def test_convert_maven_input(maven_report): # pylint: disable=redefined-outer-n "differ from those defined at NVD. See " "https://ossindex.sonatype.org/vulnerability/CVE-2020-36641 " "for details", - coordinates="pkg:maven/fr.turri/aXMLRPC@1.13.0", + coordinates="fr.turri:aXMLRPC:jar:1.13.0:test", references=( "https://ossindex.sonatype.org/vulnerability/CVE-2020-36641?component-type=maven&component-name=fr.turri%2FaXMLRPC&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-36641", @@ -359,3 +359,40 @@ def test_convert_maven_input(maven_report): # pylint: disable=redefined-outer-n def test_convert_maven_input_no_vulnerable(): # pylint: disable=redefined-outer-name actual = set(security.from_maven("{}")) assert len(actual) == 0 + +def test_format_jsonl(): + issue = security.Issue( + coordinates="coordinates", + cve="cve", cwe="cwe", + description="description", + references=() + ) + expected = json.dumps({ + "cve": "cve", + "cwe": "cwe", + "description": "description", + "coordinates": "coordinates", + "references": [], + "url": "issue_url" + }) + actual = security.format_jsonl("issue_url", issue) + assert actual == expected + + +def test_format_jsonl_removes_newline(): + issue = security.Issue( + coordinates="coordinates", + cve="cve", cwe="cwe", + description="description", + references=() + ) + expected = json.dumps({ + "cve": "cve", + "cwe": "cwe", + "description": "description", + "coordinates": "coordinates", + "references": [], + "url": "issue_url" + }) + actual = security.format_jsonl("issue_url\n", issue) + assert actual == expected