Skip to content

feat: add unauthenticated response for oss-index #220

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Dec 5, 2023
Merged

feat: add unauthenticated response for oss-index #220

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
cc50df1
feat: add unauthenticated response for oss-index
ruromero Dec 1, 2023
0511233
Updated report and unit tests for multi-source with empty provider.
olavtar Dec 2, 2023
20fa939
Latest changes for the report: - Removed "N/A". - Added Remediation A…
olavtar Dec 4, 2023
1b17266
TC-778: fixed Vulnerability count alignment
olavtar Dec 4, 2023
30eb7f5
fix: undefined npm packages
ruromero Dec 5, 2023
c17db36
fix: summaryCard expects a return value
ruromero Dec 5, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
141 changes: 0 additions & 141 deletions src/main/java/com/redhat/exhort/integration/VulnerabilityProvider.java
View file
Open in desktop

This file was deleted.

2 changes: 1 addition & 1 deletion src/main/java/com/redhat/exhort/integration/backend/ExhortIntegration.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,9 +35,9 @@
import com.fasterxml.jackson.databind.ObjectMapper;
import com.redhat.exhort.analytics.AnalyticsService;
import com.redhat.exhort.integration.Constants;
import com.redhat.exhort.integration.VulnerabilityProvider;
import com.redhat.exhort.integration.backend.sbom.SbomParserFactory;
import com.redhat.exhort.integration.providers.ProviderAggregationStrategy;
import com.redhat.exhort.integration.providers.VulnerabilityProvider;
import com.redhat.exhort.monitoring.MonitoringProcessor;

import io.micrometer.core.instrument.MeterRegistry;
Expand Down
10 changes: 10 additions & 0 deletions src/main/java/com/redhat/exhort/integration/providers/ProviderResponseHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,16 @@ protected DependencyReport toDependencyReport(PackageRef ref, List<Issue> issues
.collect(Collectors.toList()));
}

public ProviderReport unauthenticatedResponse(Exchange exchange) {
return new ProviderReport()
.status(
new ProviderStatus()
.name(getProviderName())
.ok(Boolean.FALSE)
.message("Missing mandatory credentials")
.code(Response.Status.UNAUTHORIZED.getStatusCode()));
}

public void processResponseError(Exchange exchange) {
ProviderStatus status = new ProviderStatus().ok(false).name(getProviderName());
Exception exception = (Exception) exchange.getProperty(Exchange.EXCEPTION_CAUGHT);
Expand Down
13 changes: 1 addition & 12 deletions src/main/java/com/redhat/exhort/integration/providers/VulnerabilityProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,7 @@ public List<String> getProvidersFromQueryParam(@Headers Map<String, String> head
var props = URISupport.parseQuery(query);
var providers = getProviders(props);
if (providers == null || providers.isEmpty()) {
return getEnabled().stream().filter(p -> filterByAuthHeaders(p, headers)).toList();
return getEnabled();
}
var missing =
providers.stream()
Expand Down Expand Up @@ -128,15 +128,4 @@ public void addProviderPrivateData(Exchange exchange, String provider) {
exchange.setProperty(
Constants.PROVIDER_PRIVATE_DATA_PROPERTY, Collections.unmodifiableList(current));
}

private boolean filterByAuthHeaders(String provider, Map<String, String> headers) {
if (headers == null || headers.isEmpty()) {
return true;
}
return switch (provider) {
case Constants.OSS_INDEX_PROVIDER -> headers.containsKey(Constants.OSS_INDEX_USER_HEADER)
&& headers.containsKey(Constants.OSS_INDEX_TOKEN_HEADER);
default -> true;
};
}
}
4 changes: 3 additions & 1 deletion src/main/java/com/redhat/exhort/integration/providers/ossindex/OssIndexIntegration.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@
import org.eclipse.microprofile.config.inject.ConfigProperty;

import com.redhat.exhort.integration.Constants;
import com.redhat.exhort.integration.VulnerabilityProvider;
import com.redhat.exhort.integration.providers.VulnerabilityProvider;
import com.redhat.exhort.model.DependencyTree;
import com.redhat.exhort.monitoring.MonitoringProcessor;

Expand Down Expand Up @@ -58,6 +58,8 @@ public void configure() {
.routeId("ossIndexScan")
.transform(method(OssIndexRequestBuilder.class, "split"))
.choice()
.when(method(OssIndexRequestBuilder.class, "missingAuthHeaders"))
.setBody(method(OssIndexResponseHandler.class, "unauthenticatedResponse"))
.when(method(OssIndexRequestBuilder.class, "isEmpty"))
.setBody(method(OssIndexResponseHandler.class, "emptyResponse"))
.transform().method(OssIndexResponseHandler.class, "buildReport")
Expand Down
8 changes: 8 additions & 0 deletions src/main/java/com/redhat/exhort/integration/providers/ossindex/OssIndexRequestBuilder.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,11 +23,13 @@
import java.util.Objects;

import org.apache.camel.Body;
import org.apache.camel.Header;

import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.redhat.exhort.api.PackageRef;
import com.redhat.exhort.config.ObjectMapperProducer;
import com.redhat.exhort.integration.Constants;
import com.redhat.exhort.model.DependencyTree;

import io.quarkus.runtime.annotations.RegisterForReflection;
Expand Down Expand Up @@ -61,6 +63,12 @@ public boolean isEmpty(@Body List<List<PackageRef>> body) {
return body == null || body.isEmpty();
}

public boolean missingAuthHeaders(
@Header(Constants.OSS_INDEX_USER_HEADER) String user,
@Header(Constants.OSS_INDEX_TOKEN_HEADER) String token) {
return user == null || token == null;
}

public String buildRequest(List<PackageRef> packages) throws JsonProcessingException {
var coordinates = mapper.createArrayNode();
packages.stream()
Expand Down
2 changes: 1 addition & 1 deletion src/main/resources/freemarker/templates/generated/main.js
View file
Open in desktop

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion src/main/resources/freemarker/templates/generated/vendor.css
View file
Open in desktop

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion src/main/resources/freemarker/templates/generated/vendor.js
View file
Open in desktop

Large diffs are not rendered by default.

71 changes: 36 additions & 35 deletions src/test/java/com/redhat/exhort/integration/AnalysisTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,9 @@ public void testWithInvalidPkgManagers(String sbom) {
.body()
.as(AnalysisReport.class);

assertEquals(1, report.getProviders().size());
assertEquals(2, report.getProviders().size());
assertEquals(
401, report.getProviders().get(Constants.OSS_INDEX_PROVIDER).getStatus().getCode());
var status = report.getProviders().get(Constants.SNYK_PROVIDER).getStatus();
assertEquals(422, status.getCode());
assertEquals("Unsupported package types received: [foo]", status.getMessage());
Expand All @@ -125,7 +127,9 @@ public void testWithMixedPkgManagers(String sbom) {
.body()
.as(AnalysisReport.class);

assertEquals(1, report.getProviders().size());
assertEquals(2, report.getProviders().size());
assertEquals(
401, report.getProviders().get(Constants.OSS_INDEX_PROVIDER).getStatus().getCode());
var status = report.getProviders().get(Constants.SNYK_PROVIDER).getStatus();
assertEquals(422, status.getCode());
assertEquals(
Expand All @@ -139,14 +143,14 @@ public void testWithMixedPkgManagers(String sbom) {

@ParameterizedTest
@MethodSource("emptySbomArguments")
public void testEmptySbom(List<String> providers, Map<String, String> authHeaders) {
public void testEmptySbom(Map<String, Integer> providers, Map<String, String> authHeaders) {
stubAllProviders();

var report =
given()
.header(CONTENT_TYPE, CycloneDxMediaType.APPLICATION_CYCLONEDX_JSON)
.headers(authHeaders)
.queryParam(Constants.PROVIDERS_PARAM, providers)
.queryParam(Constants.PROVIDERS_PARAM, providers.keySet())
.body(loadFileAsString(String.format("%s/empty-sbom.json", CYCLONEDX)))
.when()
.post("/api/v4/analysis")
Expand All @@ -157,55 +161,48 @@ public void testEmptySbom(List<String> providers, Map<String, String> authHeader
.body()
.as(AnalysisReport.class);

providers.forEach(
p -> {
var provider =
report.getProviders().values().stream()
.filter(s -> s.getStatus().getName().equals(p))
.findFirst();
assertEquals(Response.Status.OK.getStatusCode(), provider.get().getStatus().getCode());
assertTrue(provider.get().getStatus().getOk());
assertEquals(
Response.Status.OK.getReasonPhrase(), provider.get().getStatus().getMessage());
assertTrue(provider.get().getSources().isEmpty());
});

verifyProviders(providers, authHeaders, true);
providers
.entrySet()
.forEach(
p -> {
var provider =
report.getProviders().values().stream()
.filter(s -> s.getStatus().getName().equals(p.getKey()))
.findFirst();
assertEquals(p.getValue(), provider.get().getStatus().getCode());
assertEquals(p.getValue().equals(200), provider.get().getStatus().getOk());
assertTrue(provider.get().getSources().isEmpty());
});

verifyProviders(providers.keySet(), authHeaders, true);
}

private static Stream<Arguments> emptySbomArguments() {
return Stream.of(
Arguments.of(Map.of(Constants.SNYK_PROVIDER, 200), Collections.emptyMap()),
Arguments.of(Map.of(Constants.OSS_INDEX_PROVIDER, 401), Collections.emptyMap()),
Arguments.of(
List.of(Constants.SNYK_PROVIDER), Collections.emptyMap(), Constants.MAVEN_PKG_MANAGER),
Arguments.of(List.of(Constants.OSS_INDEX_PROVIDER), Collections.emptyMap()),
Map.of(Constants.SNYK_PROVIDER, 200, Constants.OSS_INDEX_PROVIDER, 401),
Collections.emptyMap()),
Arguments.of(
List.of(Constants.SNYK_PROVIDER, Constants.OSS_INDEX_PROVIDER),
Map.of(Constants.SNYK_PROVIDER, 200, Constants.OSS_INDEX_PROVIDER, 401),
Map.of(Constants.SNYK_TOKEN_HEADER, OK_TOKEN)),
Arguments.of(
List.of(Constants.SNYK_PROVIDER, Constants.OSS_INDEX_PROVIDER),
Map.of(Constants.SNYK_PROVIDER, 200, Constants.OSS_INDEX_PROVIDER, 200),
Map.of(
Constants.OSS_INDEX_USER_HEADER,
OK_USER,
Constants.OSS_INDEX_TOKEN_HEADER,
OK_TOKEN)),
Arguments.of(
List.of(Constants.SNYK_PROVIDER, Constants.OSS_INDEX_PROVIDER),
Map.of(Constants.SNYK_PROVIDER, 200, Constants.OSS_INDEX_PROVIDER, 200),
Map.of(
Constants.SNYK_TOKEN_HEADER,
OK_TOKEN,
Constants.OSS_INDEX_USER_HEADER,
OK_USER,
Constants.OSS_INDEX_TOKEN_HEADER,
OK_TOKEN)),
Arguments.of(
List.of(Constants.SNYK_PROVIDER, Constants.OSS_INDEX_PROVIDER), Collections.emptyMap()),
Arguments.of(
List.of(Constants.SNYK_PROVIDER, Constants.OSS_INDEX_PROVIDER), Collections.emptyMap()),
Arguments.of(
List.of(Constants.SNYK_PROVIDER, Constants.OSS_INDEX_PROVIDER), Collections.emptyMap()),
Arguments.of(
List.of(Constants.SNYK_PROVIDER, Constants.OSS_INDEX_PROVIDER),
Collections.emptyMap()));
OK_TOKEN)));
}

@Test
Expand Down Expand Up @@ -279,7 +276,9 @@ public void testUnauthorizedRequest() {
.body()
.as(AnalysisReport.class);

assertEquals(1, report.getProviders().size());
assertEquals(2, report.getProviders().size());
assertEquals(
401, report.getProviders().get(Constants.OSS_INDEX_PROVIDER).getStatus().getCode());
assertTrue(report.getProviders().get(Constants.SNYK_PROVIDER).getSources().isEmpty());
var status = report.getProviders().get(Constants.SNYK_PROVIDER).getStatus();
assertFalse(status.getOk());
Expand Down Expand Up @@ -309,7 +308,9 @@ public void testForbiddenRequest() {
.body()
.as(AnalysisReport.class);

assertEquals(1, report.getProviders().size());
assertEquals(2, report.getProviders().size());
assertEquals(
401, report.getProviders().get(Constants.OSS_INDEX_PROVIDER).getStatus().getCode());
assertTrue(report.getProviders().get(Constants.SNYK_PROVIDER).getSources().isEmpty());
var status = report.getProviders().get(Constants.SNYK_PROVIDER).getStatus();
assertFalse(status.getOk());
Expand Down
Loading