Skip to content

Commit 1c62396

Browse files
cx-ben-alvocx-ben-alvo
committed
Add vulnerability handling in OSS package and cache logic
Introduced support for tracking vulnerabilities in OSS package data structures and cache handling. Updated relevant methods to process and populate vulnerability details from realtime scanner and cache. This change enhances reporting and visibility of security issues in OSS packages.
1 parent dfbe215 commit 1c62396

File tree

6 files changed

+125
-48
lines changed

6 files changed

+125
-48
lines changed

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ require (
3434
)
3535

3636
require (
37+
helm.sh/helm/v3 v3.17.3 // indirect
3738
dario.cat/mergo v1.0.1 // indirect
3839
github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 // indirect
3940
github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20240914100643-eb91380d8434 // indirect
@@ -289,7 +290,6 @@ require (
289290
gopkg.in/inf.v0 v0.9.1 // indirect
290291
gopkg.in/warnings.v0 v0.1.2 // indirect
291292
gopkg.in/yaml.v2 v2.4.0 // indirect
292-
helm.sh/helm/v3 v3.17.3 // indirect
293293
k8s.io/api v0.32.3 // indirect
294294
k8s.io/apiextensions-apiserver v0.32.3 // indirect
295295
k8s.io/apimachinery v0.32.3 // indirect

‎internal/services/ossrealtime/config.go‎

Lines changed: 45 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,55 @@
11
package ossrealtime
22

3+
import (
4+
"github.com/checkmarx/ast-cli/internal/services/ossrealtime/osscache"
5+
"github.com/checkmarx/ast-cli/internal/wrappers"
6+
)
7+
38
// OssPackage represents a package's details for OSS scanning.
49
type OssPackage struct {
5-
PackageManager string `json:"PackageManager"`
6-
PackageName string `json:"PackageName"`
7-
PackageVersion string `json:"PackageVersion"`
8-
FilePath string `json:"FilePath"`
9-
LineStart int `json:"LineStart"`
10-
LineEnd int `json:"LineEnd"`
11-
StartIndex int `json:"StartIndex"`
12-
EndIndex int `json:"EndIndex"`
13-
Status string `json:"Status"`
10+
PackageManager string `json:"PackageManager"`
11+
PackageName string `json:"PackageName"`
12+
PackageVersion string `json:"PackageVersion"`
13+
FilePath string `json:"FilePath"`
14+
LineStart int `json:"LineStart"`
15+
LineEnd int `json:"LineEnd"`
16+
StartIndex int `json:"StartIndex"`
17+
EndIndex int `json:"EndIndex"`
18+
Status string `json:"Status"`
19+
Vulnerabilities []Vulnerability `json:"Vulnerabilities"`
1420
}
1521

1622
// OssPackageResults holds the results of an OSS scan.
1723
type OssPackageResults struct {
1824
Packages []OssPackage `json:"Packages"`
1925
}
26+
27+
type Vulnerability struct {
28+
CVE string `json:"CVE"`
29+
Description string `json:"Description"`
30+
Severity string `json:"Severity"`
31+
}
32+
33+
func NewOssVulnerabilitiesFromRealtimeScannerVulnerabilities(vulnerabilities []wrappers.RealtimeScannerVulnerability) []Vulnerability {
34+
vulns := make([]Vulnerability, len(vulnerabilities))
35+
for i, v := range vulnerabilities {
36+
vulns[i] = Vulnerability{
37+
CVE: v.CVE,
38+
Description: v.Description,
39+
Severity: v.Severity,
40+
}
41+
}
42+
return vulns
43+
}
44+
45+
func NewOssVulnerabilitiesFromOssCacheVulnerabilities(vulnerabilities []osscache.Vulnerability) []Vulnerability {
46+
vulns := make([]Vulnerability, len(vulnerabilities))
47+
for i, v := range vulnerabilities {
48+
vulns[i] = Vulnerability{
49+
CVE: v.CVE,
50+
Description: v.Description,
51+
Severity: v.Severity,
52+
}
53+
}
54+
return vulns
55+
}

‎internal/services/ossrealtime/oss-realtime.go‎

Lines changed: 24 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -37,9 +37,9 @@ func (o *OssRealtimeService) RunOssRealtimeScan(filePath string) (*OssPackageRes
3737
return nil, errors.New("file path is required")
3838
}
3939

40-
if enabled, err := o.isFeatureFlagEnabled(); err != nil || !enabled {
41-
return nil, err
42-
}
40+
//if enabled, err := o.isFeatureFlagEnabled(); err != nil || !enabled {
41+
// return nil, err
42+
//}
4343

4444
if err := o.ensureLicense(); err != nil {
4545
return nil, err
@@ -71,15 +71,16 @@ func enrichResponseWithRealtimeScannerResults(
7171
for _, pkg := range result.Packages {
7272
entry := getPackageEntryFromPackageMap(packageMap, &pkg)
7373
response.Packages = append(response.Packages, OssPackage{
74-
PackageManager: pkg.PackageManager,
75-
PackageName: pkg.PackageName,
76-
PackageVersion: pkg.Version,
77-
FilePath: entry.FilePath,
78-
LineStart: entry.LineStart,
79-
LineEnd: entry.LineEnd,
80-
StartIndex: entry.StartIndex,
81-
EndIndex: entry.EndIndex,
82-
Status: pkg.Status,
74+
PackageManager: pkg.PackageManager,
75+
PackageName: pkg.PackageName,
76+
PackageVersion: pkg.Version,
77+
FilePath: entry.FilePath,
78+
LineStart: entry.LineStart,
79+
LineEnd: entry.LineEnd,
80+
StartIndex: entry.StartIndex,
81+
EndIndex: entry.EndIndex,
82+
Status: pkg.Status,
83+
Vulnerabilities: NewOssVulnerabilitiesFromRealtimeScannerVulnerabilities(pkg.Vulnerabilities),
8384
})
8485
}
8586
}
@@ -143,17 +144,18 @@ func prepareScan(pkgs []models.Package) (*OssPackageResults, *wrappers.RealtimeS
143144
cacheMap := osscache.BuildCacheMap(*cache)
144145
for _, pkg := range pkgs {
145146
key := osscache.GenerateCacheKey(pkg.PackageManager, pkg.PackageName, pkg.Version)
146-
if status, found := cacheMap[key]; found {
147+
if cachedPkg, found := cacheMap[key]; found {
147148
resp.Packages = append(resp.Packages, OssPackage{
148-
PackageManager: pkg.PackageManager,
149-
PackageName: pkg.PackageName,
150-
PackageVersion: pkg.Version,
151-
LineStart: pkg.LineStart,
152-
LineEnd: pkg.LineEnd,
153-
FilePath: pkg.FilePath,
154-
StartIndex: pkg.StartIndex,
155-
EndIndex: pkg.EndIndex,
156-
Status: status,
149+
PackageManager: pkg.PackageManager,
150+
PackageName: pkg.PackageName,
151+
PackageVersion: pkg.Version,
152+
LineStart: pkg.LineStart,
153+
LineEnd: pkg.LineEnd,
154+
FilePath: pkg.FilePath,
155+
StartIndex: pkg.StartIndex,
156+
EndIndex: pkg.EndIndex,
157+
Status: cachedPkg.Status,
158+
Vulnerabilities: NewOssVulnerabilitiesFromOssCacheVulnerabilities(cachedPkg.Vulnerabilities),
157159
})
158160
} else {
159161
req.Packages = append(req.Packages, pkgToRequest(&pkg))

‎internal/services/ossrealtime/osscache/oss-realtime-cache.go‎

Lines changed: 16 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -68,12 +68,21 @@ func AppendToCache(packages *wrappers.RealtimeScannerPackageResponse) error {
6868
}
6969

7070
for _, pkg := range packages.Packages {
71+
vulnerabilities := make([]Vulnerability, 0)
7172
if pkg.Status != "Unknown" {
73+
for _, v := range pkg.Vulnerabilities {
74+
vulnerabilities = append(vulnerabilities, Vulnerability{
75+
CVE: v.CVE,
76+
Description: v.Description,
77+
Severity: v.Severity,
78+
})
79+
}
7280
cache.Packages = append(cache.Packages, PackageEntry{
73-
PackageManager: pkg.PackageManager,
74-
PackageName: pkg.PackageName,
75-
PackageVersion: pkg.Version,
76-
Status: pkg.Status,
81+
PackageManager: pkg.PackageManager,
82+
PackageName: pkg.PackageName,
83+
PackageVersion: pkg.Version,
84+
Status: pkg.Status,
85+
Vulnerabilities: vulnerabilities,
7786
})
7887
}
7988
}
@@ -86,10 +95,10 @@ func GetCacheFilePath() string {
8695
}
8796

8897
// BuildCacheMap creates a lookup map from cache entries.
89-
func BuildCacheMap(cache Cache) map[string]string {
90-
m := make(map[string]string, len(cache.Packages))
98+
func BuildCacheMap(cache Cache) map[string]PackageEntry {
99+
m := make(map[string]PackageEntry, len(cache.Packages))
91100
for _, pkg := range cache.Packages {
92-
m[GenerateCacheKey(pkg.PackageManager, pkg.PackageName, pkg.PackageVersion)] = pkg.Status
101+
m[GenerateCacheKey(pkg.PackageManager, pkg.PackageName, pkg.PackageVersion)] = pkg
93102
}
94103
return m
95104
}

‎internal/services/ossrealtime/osscache/types.go‎

Lines changed: 28 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,35 @@
11
package osscache
22

3-
import "time"
3+
import (
4+
"time"
5+
6+
"github.com/checkmarx/ast-cli/internal/wrappers"
7+
)
48

59
type PackageEntry struct {
6-
PackageManager string `json:"packageManager"`
7-
PackageName string `json:"packageName"`
8-
PackageVersion string `json:"packageVersion"`
9-
Status string `json:"status"`
10+
PackageManager string `json:"packageManager"`
11+
PackageName string `json:"packageName"`
12+
PackageVersion string `json:"packageVersion"`
13+
Status string `json:"status"`
14+
Vulnerabilities []Vulnerability `json:"vulnerabilities"`
15+
}
16+
17+
type Vulnerability struct {
18+
CVE string `json:"CVE"`
19+
Description string `json:"Description"`
20+
Severity string `json:"Severity"`
21+
}
22+
23+
func (p *PackageEntry) ConvertVulnerabilities() []wrappers.RealtimeScannerVulnerability {
24+
vulnerabilities := make([]wrappers.RealtimeScannerVulnerability, len(p.Vulnerabilities))
25+
for i, v := range p.Vulnerabilities {
26+
vulnerabilities[i] = wrappers.RealtimeScannerVulnerability{
27+
CVE: v.CVE,
28+
Description: v.Description,
29+
Severity: v.Severity,
30+
}
31+
}
32+
return vulnerabilities
1033
}
1134

1235
type Cache struct {

‎internal/wrappers/realtime-scanner.go‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,17 @@ type RealtimeScannerWrapper interface {
55
}
66

77
type RealtimeScannerResults struct {
8-
PackageManager string `json:"PackageManager"`
9-
PackageName string `json:"PackageName"`
10-
Version string `json:"PackageVersion"`
11-
Status string `json:"Status,omitempty"`
8+
PackageManager string `json:"PackageManager"`
9+
PackageName string `json:"PackageName"`
10+
Version string `json:"PackageVersion"`
11+
Status string `json:"Status"`
12+
Vulnerabilities []RealtimeScannerVulnerability `json:"Vulnerabilities"`
13+
}
14+
15+
type RealtimeScannerVulnerability struct {
16+
CVE string `json:"CVE"`
17+
Description string `json:"Description"`
18+
Severity string `json:"Severity"`
1219
}
1320

1421
type RealtimeScannerPackageResponse struct {

0 commit comments

Comments
 (0)