Skip to content

Commit 1217e16

Browse files
ruromeroruromero
authored
Merge pull request #237 from ruromero/fix-coordinates
fix: oss-index requires canonicalized purls
2 parents 65ebbb8 + 59cf700 commit 1217e16

File tree

5 files changed

+205
-35
lines changed

5 files changed

+205
-35
lines changed

‎src/main/java/com/redhat/exhort/integration/backend/sbom/cyclonedx/CycloneDxParser.java‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -59,10 +59,7 @@ protected DependencyTree buildTree(InputStream input) {
5959
componentPurls.putAll(
6060
bom.getComponents().stream()
6161
.filter(c -> c.getBomRef() != null)
62-
.collect(
63-
Collectors.toMap(
64-
Component::getBomRef,
65-
c -> PackageRef.builder().purl(c.getPurl()).build())));
62+
.collect(Collectors.toMap(Component::getBomRef, c -> new PackageRef(c.getPurl()))));
6663
}
6764

6865
if (bom.getMetadata() == null) {

‎src/main/java/com/redhat/exhort/integration/providers/ossindex/OssIndexRequestBuilder.java‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@
2020

2121
import java.util.ArrayList;
2222
import java.util.List;
23-
import java.util.Objects;
2423

2524
import org.apache.camel.Body;
2625
import org.apache.camel.Header;
@@ -71,11 +70,9 @@ public boolean missingAuthHeaders(
7170

7271
public String buildRequest(List<PackageRef> packages) throws JsonProcessingException {
7372
var coordinates = mapper.createArrayNode();
74-
packages.stream()
75-
.map(PackageRef::purl)
76-
.filter(Objects::nonNull)
77-
.forEach(purl -> coordinates.add(purl.getCoordinates()));
78-
73+
// oss-index don't allow qualifiers
74+
// getCoordinates method is NOT idempotent!
75+
packages.forEach(p -> coordinates.add(new PackageRef(p.toString()).purl().getCoordinates()));
7976
var root = mapper.createObjectNode().set("coordinates", coordinates);
8077
return mapper.writeValueAsString(root);
8178
}

‎src/main/java/com/redhat/exhort/integration/providers/ossindex/OssIndexResponseHandler.java‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,10 @@
2525
import java.util.HashMap;
2626
import java.util.List;
2727
import java.util.Map;
28+
import java.util.stream.Collectors;
2829

2930
import org.apache.camel.Body;
31+
import org.apache.camel.ExchangeProperty;
3032
import org.slf4j.Logger;
3133
import org.slf4j.LoggerFactory;
3234

@@ -37,6 +39,7 @@
3739
import com.redhat.exhort.api.v4.Issue;
3840
import com.redhat.exhort.api.v4.SeverityUtils;
3941
import com.redhat.exhort.config.ObjectMapperProducer;
42+
import com.redhat.exhort.integration.Constants;
4043
import com.redhat.exhort.integration.providers.ProviderResponseHandler;
4144
import com.redhat.exhort.model.CvssParser;
4245
import com.redhat.exhort.model.DependencyTree;
@@ -83,18 +86,26 @@ public ProviderResponse aggregateSplit(ProviderResponse oldExchange, ProviderRes
8386
}
8487

8588
public ProviderResponse responseToIssues(
86-
@Body byte[] response, String privateProviders, DependencyTree tree) throws IOException {
89+
@Body byte[] response,
90+
String privateProviders,
91+
@ExchangeProperty(Constants.DEPENDENCY_TREE_PROPERTY) DependencyTree tree)
92+
throws IOException {
8793
var json = (ArrayNode) mapper.readTree(response);
88-
return new ProviderResponse(getIssues(json), null);
94+
return new ProviderResponse(getIssues(json, tree), null);
8995
}
9096

91-
private Map<String, List<Issue>> getIssues(ArrayNode response) {
97+
private Map<String, List<Issue>> getIssues(ArrayNode response, DependencyTree tree) {
9298
Map<String, List<Issue>> reports = new HashMap<>();
99+
Map<String, PackageRef> coordinates =
100+
tree.getAll().stream()
101+
.collect(
102+
Collectors.toMap(
103+
d -> new PackageRef(d.toString()).purl().getCoordinates(), d -> d));
93104
response.forEach(
94105
n -> {
95106
var pkgRef = n.get("coordinates").asText();
96107
try {
97-
var key = PackageRef.builder().purl(pkgRef).build();
108+
var key = coordinates.get(pkgRef);
98109
List<Issue> issues = new ArrayList<>();
99110
var vulnerabilities = (ArrayNode) n.get("vulnerabilities");
100111
vulnerabilities.forEach(v -> issues.add(toIssue(v)));

‎src/test/resources/__files/reports/report_all_token.json‎

Lines changed: 59 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -23,15 +23,15 @@
2323
"high": 3,
2424
"medium": 0,
2525
"low": 0,
26-
"remediations": 0,
27-
"recommendations": 0
26+
"remediations": 1,
27+
"recommendations": 2
2828
},
2929
"dependencies": [
3030
{
31-
"ref": "pkg:maven/io.quarkus/[email protected]",
31+
"ref": "pkg:maven/io.quarkus/[email protected]?type=jar",
3232
"transitive": [
3333
{
34-
"ref": "pkg:maven/com.fasterxml.jackson.core/[email protected]",
34+
"ref": "pkg:maven/com.fasterxml.jackson.core/[email protected]?type=jar",
3535
"issues": [
3636
{
3737
"id": "CVE-2020-36518",
@@ -51,7 +51,14 @@
5151
"cvssScore": 7.5,
5252
"severity": "HIGH",
5353
"cves": ["CVE-2020-36518"],
54-
"unique": false
54+
"unique": false,
55+
"remediation": {
56+
"trustedContent": {
57+
"ref": "pkg:maven/com.fasterxml.jackson.core/[email protected]?repository_url=https%3A%2F%2Fmaven.repository.redhat.com%2Fga%2F&type=jar",
58+
"status": "NotAffected",
59+
"justification": "VulnerableCodeNotPresent"
60+
}
61+
}
5562
},
5663
{
5764
"id": "CVE-2022-42003",
@@ -112,10 +119,18 @@
112119
"cvssScore": 7.5,
113120
"severity": "HIGH",
114121
"cves": ["CVE-2020-36518"],
115-
"unique": false
122+
"unique": false,
123+
"remediation": {
124+
"trustedContent": {
125+
"ref": "pkg:maven/com.fasterxml.jackson.core/[email protected]?repository_url=https%3A%2F%2Fmaven.repository.redhat.com%2Fga%2F&type=jar",
126+
"status": "NotAffected",
127+
"justification": "VulnerableCodeNotPresent"
128+
}
129+
}
116130
}
117131
}
118132
],
133+
"recommendation": "pkg:maven/io.quarkus/[email protected]?repository_url=https%3A%2F%2Fmaven.repository.redhat.com%2Fga%2F&type=jar",
119134
"highestVulnerability": {
120135
"id": "CVE-2020-36518",
121136
"title": "[CVE-2020-36518] CWE-787: Out-of-bounds Write",
@@ -134,8 +149,19 @@
134149
"cvssScore": 7.5,
135150
"severity": "HIGH",
136151
"cves": ["CVE-2020-36518"],
137-
"unique": false
152+
"unique": false,
153+
"remediation": {
154+
"trustedContent": {
155+
"ref": "pkg:maven/com.fasterxml.jackson.core/[email protected]?repository_url=https%3A%2F%2Fmaven.repository.redhat.com%2Fga%2F&type=jar",
156+
"status": "NotAffected",
157+
"justification": "VulnerableCodeNotPresent"
158+
}
159+
}
138160
}
161+
},
162+
{
163+
"ref": "pkg:maven/io.quarkus/[email protected]?type=jar",
164+
"recommendation": "pkg:maven/io.quarkus/[email protected]?repository_url=https%3A%2F%2Fmaven.repository.redhat.com%2Fga%2F&type=jar"
139165
}
140166
]
141167
}
@@ -167,15 +193,15 @@
167193
"high": 1,
168194
"medium": 3,
169195
"low": 0,
170-
"remediations": 0,
171-
"recommendations": 0
196+
"remediations": 1,
197+
"recommendations": 2
172198
},
173199
"dependencies": [
174200
{
175-
"ref": "pkg:maven/io.quarkus/[email protected]",
201+
"ref": "pkg:maven/io.quarkus/[email protected]?type=jar",
176202
"transitive": [
177203
{
178-
"ref": "pkg:maven/com.fasterxml.jackson.core/[email protected]",
204+
"ref": "pkg:maven/com.fasterxml.jackson.core/[email protected]?type=jar",
179205
"issues": [
180206
{
181207
"id": "SNYK-JAVA-COMFASTERXMLJACKSONCORE-2421244",
@@ -197,7 +223,12 @@
197223
"cves": ["CVE-2020-36518"],
198224
"unique": false,
199225
"remediation": {
200-
"fixedIn": ["2.12.6.1", "2.13.2.1", "2.14.0"]
226+
"fixedIn": ["2.12.6.1", "2.13.2.1", "2.14.0"],
227+
"trustedContent": {
228+
"ref": "pkg:maven/com.fasterxml.jackson.core/[email protected]?repository_url=https%3A%2F%2Fmaven.repository.redhat.com%2Fga%2F&type=jar",
229+
"status": "NotAffected",
230+
"justification": "VulnerableCodeNotPresent"
231+
}
201232
}
202233
},
203234
{
@@ -268,11 +299,17 @@
268299
"cves": ["CVE-2020-36518"],
269300
"unique": false,
270301
"remediation": {
271-
"fixedIn": ["2.12.6.1", "2.13.2.1", "2.14.0"]
302+
"fixedIn": ["2.12.6.1", "2.13.2.1", "2.14.0"],
303+
"trustedContent": {
304+
"ref": "pkg:maven/com.fasterxml.jackson.core/[email protected]?repository_url=https%3A%2F%2Fmaven.repository.redhat.com%2Fga%2F&type=jar",
305+
"status": "NotAffected",
306+
"justification": "VulnerableCodeNotPresent"
307+
}
272308
}
273309
}
274310
}
275311
],
312+
"recommendation": "pkg:maven/io.quarkus/[email protected]?repository_url=https%3A%2F%2Fmaven.repository.redhat.com%2Fga%2F&type=jar",
276313
"highestVulnerability": {
277314
"id": "SNYK-JAVA-COMFASTERXMLJACKSONCORE-2421244",
278315
"title": "Denial of Service (DoS)",
@@ -293,15 +330,20 @@
293330
"cves": ["CVE-2020-36518"],
294331
"unique": false,
295332
"remediation": {
296-
"fixedIn": ["2.12.6.1", "2.13.2.1", "2.14.0"]
333+
"fixedIn": ["2.12.6.1", "2.13.2.1", "2.14.0"],
334+
"trustedContent": {
335+
"ref": "pkg:maven/com.fasterxml.jackson.core/[email protected]?repository_url=https%3A%2F%2Fmaven.repository.redhat.com%2Fga%2F&type=jar",
336+
"status": "NotAffected",
337+
"justification": "VulnerableCodeNotPresent"
338+
}
297339
}
298340
}
299341
},
300342
{
301-
"ref": "pkg:maven/io.quarkus/[email protected]",
343+
"ref": "pkg:maven/io.quarkus/[email protected]?type=jar",
302344
"transitive": [
303345
{
304-
"ref": "pkg:maven/org.postgresql/[email protected]",
346+
"ref": "pkg:maven/org.postgresql/[email protected]?type=jar",
305347
"issues": [
306348
{
307349
"id": "SNYK-JAVA-ORGPOSTGRESQL-3146847",
@@ -352,6 +394,7 @@
352394
}
353395
}
354396
],
397+
"recommendation": "pkg:maven/io.quarkus/[email protected]?repository_url=https%3A%2F%2Fmaven.repository.redhat.com%2Fga%2F&type=jar",
355398
"highestVulnerability": {
356399
"id": "SNYK-JAVA-ORGPOSTGRESQL-3146847",
357400
"title": "Information Exposure",

‎src/test/resources/__files/reports/v3/report_all_token.json‎

Lines changed: 127 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,18 +6,18 @@
66
},
77
"vulnerabilities": {
88
"direct": 0,
9-
"total": 4,
9+
"total": 7,
1010
"critical": 0,
11-
"high": 1,
11+
"high": 4,
1212
"medium": 3,
1313
"low": 0
1414
},
1515
"providerStatuses": [
1616
{
17-
"ok": false,
17+
"ok": true,
1818
"provider": "oss-index",
19-
"status": 401,
20-
"message": "Unauthorized: Verify the provided credentials are valid."
19+
"status": 200,
20+
"message": "OK"
2121
},
2222
{
2323
"ok": true,
@@ -34,6 +34,128 @@
3434
]
3535
},
3636
"dependencies": [
37+
{
38+
"ref": "pkg:maven/io.quarkus/[email protected]?type=jar",
39+
"transitive": [
40+
{
41+
"ref": "pkg:maven/com.fasterxml.jackson.core/[email protected]?type=jar",
42+
"issues": [
43+
{
44+
"id": "CVE-2020-36518",
45+
"title": "[CVE-2020-36518] CWE-787: Out-of-bounds Write",
46+
"source": "oss-index",
47+
"cvss": {
48+
"attackVector": "Network",
49+
"attackComplexity": "Low",
50+
"privilegesRequired": "None",
51+
"userInteraction": "None",
52+
"scope": "Unchanged",
53+
"confidentialityImpact": "None",
54+
"integrityImpact": "None",
55+
"availabilityImpact": "High",
56+
"cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
57+
},
58+
"cvssScore": 7.5,
59+
"severity": "HIGH",
60+
"cves": ["CVE-2020-36518"],
61+
"unique": false
62+
},
63+
{
64+
"id": "CVE-2022-42003",
65+
"title": "[CVE-2022-42003] CWE-502: Deserialization of Untrusted Data",
66+
"source": "oss-index",
67+
"cvss": {
68+
"attackVector": "Network",
69+
"attackComplexity": "Low",
70+
"privilegesRequired": "None",
71+
"userInteraction": "None",
72+
"scope": "Unchanged",
73+
"confidentialityImpact": "None",
74+
"integrityImpact": "None",
75+
"availabilityImpact": "High",
76+
"cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
77+
},
78+
"cvssScore": 7.5,
79+
"severity": "HIGH",
80+
"cves": ["CVE-2022-42003"],
81+
"unique": false
82+
},
83+
{
84+
"id": "CVE-2022-42004",
85+
"title": "[CVE-2022-42004] CWE-502: Deserialization of Untrusted Data",
86+
"source": "oss-index",
87+
"cvss": {
88+
"attackVector": "Network",
89+
"attackComplexity": "Low",
90+
"privilegesRequired": "None",
91+
"userInteraction": "None",
92+
"scope": "Unchanged",
93+
"confidentialityImpact": "None",
94+
"integrityImpact": "None",
95+
"availabilityImpact": "High",
96+
"cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
97+
},
98+
"cvssScore": 7.5,
99+
"severity": "HIGH",
100+
"cves": ["CVE-2022-42004"],
101+
"unique": false
102+
}
103+
],
104+
"remediations": {
105+
"CVE-2020-36518": {
106+
"issueRef": "CVE-2020-36518",
107+
"mavenPackage": "pkg:maven/com.fasterxml.jackson.core/[email protected]?repository_url=https%3A%2F%2Fmaven.repository.redhat.com%2Fga%2F&type=jar",
108+
"productStatus": "NotAffected"
109+
}
110+
},
111+
"highestVulnerability": {
112+
"id": "CVE-2020-36518",
113+
"title": "[CVE-2020-36518] CWE-787: Out-of-bounds Write",
114+
"source": "oss-index",
115+
"cvss": {
116+
"attackVector": "Network",
117+
"attackComplexity": "Low",
118+
"privilegesRequired": "None",
119+
"userInteraction": "None",
120+
"scope": "Unchanged",
121+
"confidentialityImpact": "None",
122+
"integrityImpact": "None",
123+
"availabilityImpact": "High",
124+
"cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
125+
},
126+
"cvssScore": 7.5,
127+
"severity": "HIGH",
128+
"cves": ["CVE-2020-36518"],
129+
"unique": false
130+
}
131+
}
132+
],
133+
"recommendation": "pkg:maven/io.quarkus/[email protected]?repository_url=https%3A%2F%2Fmaven.repository.redhat.com%2Fga%2F&type=jar",
134+
"highestVulnerability": {
135+
"id": "CVE-2020-36518",
136+
"title": "[CVE-2020-36518] CWE-787: Out-of-bounds Write",
137+
"source": "oss-index",
138+
"cvss": {
139+
"attackVector": "Network",
140+
"attackComplexity": "Low",
141+
"privilegesRequired": "None",
142+
"userInteraction": "None",
143+
"scope": "Unchanged",
144+
"confidentialityImpact": "None",
145+
"integrityImpact": "None",
146+
"availabilityImpact": "High",
147+
"cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
148+
},
149+
"cvssScore": 7.5,
150+
"severity": "HIGH",
151+
"cves": ["CVE-2020-36518"],
152+
"unique": false
153+
}
154+
},
155+
{
156+
"ref": "pkg:maven/io.quarkus/[email protected]?type=jar",
157+
"recommendation": "pkg:maven/io.quarkus/[email protected]?repository_url=https%3A%2F%2Fmaven.repository.redhat.com%2Fga%2F&type=jar"
158+
},
37159
{
38160
"ref": "pkg:maven/io.quarkus/[email protected]?type=jar",
39161
"transitive": [

0 commit comments

Comments
 (0)