forked from ossf/scorecard
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
🌱 convert vulnerabilities check to probe (ossf#3487)
* 🌱 convert vulnerabilities check to probe Signed-off-by: AdamKorcz <[email protected]> * rename probe + nits Signed-off-by: AdamKorcz <[email protected]> * edit def.yml Signed-off-by: AdamKorcz <[email protected]> * Add vuln ID dynamically to def.yml Signed-off-by: AdamKorcz <[email protected]> * Elaborate the purpose of test data in unit test Signed-off-by: AdamKorcz <[email protected]> * Move logging out of loop and change logic of negativeFindings() Signed-off-by: AdamKorcz <[email protected]> * preserve number of vulns found in output Signed-off-by: AdamKorcz <[email protected]> * Preserve grouping of vulns Signed-off-by: AdamKorcz <[email protected]> * fix linter issues Signed-off-by: AdamKorcz <[email protected]> * Add remediation data Signed-off-by: AdamKorcz <[email protected]> * use checker.LogFindings() Signed-off-by: AdamKorcz <[email protected]> --------- Signed-off-by: AdamKorcz <[email protected]>
- Loading branch information
Showing
8 changed files
with
368 additions
and
62 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| # Copyright 2023 OpenSSF Scorecard Authors | ||
| # | ||
| # Licensed under the Apache License, Version 2.0 (the "License"); | ||
| # you may not use this file except in compliance with the License. | ||
| # You may obtain a copy of the License at | ||
| # | ||
| # http://www.apache.org/licenses/LICENSE-2.0 | ||
| # | ||
| # Unless required by applicable law or agreed to in writing, software | ||
| # distributed under the License is distributed on an "AS IS" BASIS, | ||
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| # See the License for the specific language governing permissions and | ||
| # limitations under the License. | ||
|
|
||
| id: hasOSVVulnerabilities | ||
| short: Check whether the project has known vulnerabilities | ||
| motivation: > | ||
| This check determines whether the project has open, unfixed vulnerabilities in its own codebase or its dependencies using the OSV (Open Source Vulnerabilities) service. An open vulnerability may be exploited by attackers and should be fixed as soon as possible. | ||
| implementation: > | ||
| The implementation fetches data from OSV.dev about the project which shows whether a given project has known, unfixed vulnerabilities. The implementation uses the number of known, unfixed vulnerabilities to score. | ||
| outcome: | ||
| - The probe returns one negative outcome for each vulnerability found in OSV. | ||
| - If there are no known vulnerabilities from the raw results, the probe returns one positive outcome. | ||
| remediation: | ||
| effort: High | ||
| text: | ||
| - Fix the ${{ metadata.osvid }} by following information from https://osv.dev/${{ metadata.osvid }}. | ||
| - If the vulnerability is in a dependency, update the dependency to a non-vulnerable version. If no update is available, consider whether to remove the dependency. | ||
| - If you believe the vulnerability does not affect your project, the vulnerability can be ignored. To ignore, create an osv-scanner.toml file next to the dependency manifest (e.g. package-lock.json) and specify the ID to ignore and reason. Details on the structure of osv-scanner.toml can be found on OSV-Scanner repository. | ||
| markdown: | ||
| - Fix the ${{ metadata.osvid }} by following information from [OSV](https://osv.dev/${{ metadata.osvid }}). | ||
| - If the vulnerability is in a dependency, update the dependency to a non-vulnerable version. If no update is available, consider whether to remove the dependency. | ||
| - If you believe the vulnerability does not affect your project, the vulnerability can be ignored. To ignore, create an osv-scanner.toml ([example](https://github.com/google/osv.dev/blob/eb99b02ec8895fe5b87d1e76675ddad79a15f817/vulnfeeds/osv-scanner.toml)) file next to the dependency manifest (e.g. package-lock.json) and specify the ID to ignore and reason. Details on the structure of osv-scanner.toml can be found on [OSV-Scanner repository](https://github.com/google/osv-scanner#ignore-vulnerabilities-by-id). |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,76 @@ | ||
| // Copyright 2023 OpenSSF Scorecard Authors | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
|
|
||
| // nolint:stylecheck | ||
| package hasOSVVulnerabilities | ||
|
|
||
| import ( | ||
| "embed" | ||
| "fmt" | ||
| "strings" | ||
|
|
||
| "github.com/google/osv-scanner/pkg/grouper" | ||
|
|
||
| "github.com/ossf/scorecard/v4/checker" | ||
| "github.com/ossf/scorecard/v4/finding" | ||
| "github.com/ossf/scorecard/v4/probes/internal/utils/uerror" | ||
| ) | ||
|
|
||
| //go:embed *.yml | ||
| var fs embed.FS | ||
|
|
||
| const Probe = "hasOSVVulnerabilities" | ||
|
|
||
| func Run(raw *checker.RawResults) ([]finding.Finding, string, error) { | ||
| if raw == nil { | ||
| return nil, "", fmt.Errorf("%w: raw", uerror.ErrNil) | ||
| } | ||
|
|
||
| var findings []finding.Finding | ||
|
|
||
| // if no vulns were found | ||
| if len(raw.VulnerabilitiesResults.Vulnerabilities) == 0 { | ||
| f, err := finding.NewWith(fs, Probe, | ||
| "Project does not contain OSV vulnerabilities", nil, | ||
| finding.OutcomePositive) | ||
| if err != nil { | ||
| return nil, Probe, fmt.Errorf("create finding: %w", err) | ||
| } | ||
| findings = append(findings, *f) | ||
| return findings, Probe, nil | ||
| } | ||
|
|
||
| aliasVulnerabilities := []grouper.IDAliases{} | ||
| for _, vuln := range raw.VulnerabilitiesResults.Vulnerabilities { | ||
| aliasVulnerabilities = append(aliasVulnerabilities, grouper.IDAliases(vuln)) | ||
| } | ||
|
|
||
| IDs := grouper.Group(aliasVulnerabilities) | ||
|
|
||
| for _, vuln := range IDs { | ||
| f, err := finding.NewWith(fs, Probe, | ||
| "Project contains OSV vulnerabilities", nil, | ||
| finding.OutcomeNegative) | ||
| if err != nil { | ||
| return nil, Probe, fmt.Errorf("create finding: %w", err) | ||
| } | ||
| f = f.WithMessage(fmt.Sprintf("Project is vulnerable to: %s", | ||
| strings.Join(vuln.IDs, " / "))) | ||
| f = f.WithRemediationMetadata(map[string]string{ | ||
| "osvid": strings.Join(vuln.IDs[:], ","), | ||
| }) | ||
| findings = append(findings, *f) | ||
| } | ||
| return findings, Probe, nil | ||
| } |
Oops, something went wrong.