Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Support Additional Metadata + CVSS Score Logic Update #2199

Open
wants to merge 9 commits into
base: main
Choose a base branch
from
Open

feat: Support Additional Metadata + CVSS Score Logic Update #2199

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
c25e5b8
init commit
Hacks4Snacks Jul 12, 2024
017a416
update static
Hacks4Snacks Jul 12, 2024
4c35f12
only return cvss if source matches else nil
Hacks4Snacks Jul 12, 2024
6b5e4df
update match logic + type conversion
Hacks4Snacks Jul 22, 2024
d92f973
update logic
Hacks4Snacks Jul 23, 2024
389e8b4
update TestGetScoreFromCVSS test
Hacks4Snacks Jul 23, 2024
f7eefb0
update docs
Hacks4Snacks Jul 23, 2024
aea8e4f
mage generations
Hacks4Snacks Jul 25, 2024
681f71e
check for nil values + update test
Jul 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
update TestGetScoreFromCVSS test
  • Loading branch information
@Hacks4Snacks
Hacks4Snacks authored and hacks4snacks committed Jul 23, 2024
commit 389e8b4cd0493259ceee22027268cb0dc5456e76
46 changes: 34 additions & 12 deletions pkg/plugins/trivy/plugin_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6797,9 +6797,12 @@ func TestPlugin_ParseReportData(t *testing.T) {

func TestGetScoreFromCVSS(t *testing.T) {
testCases := []struct {
name string
cvss dbtypes.VendorCVSS
expectedScore *float64
name string
cvss dbtypes.VendorCVSS
severitySource string
preferredSources []string
expectedScore *float64
expectedSource string
}{
{
name: "Should return nvd score when nvd and vendor v3 score exist",
Expand All @@ -6811,7 +6814,10 @@ func TestGetScoreFromCVSS(t *testing.T) {
V3Score: 8.3,
},
},
expectedScore: ptr.To[float64](8.1),
severitySource: "",
preferredSources: []string{"nvd", "redhat"},
expectedScore: ptr.To[float64](8.1),
expectedSource: "nvd",
},
{
name: "Should return nvd score when vendor v3 score is nil",
Expand All @@ -6823,7 +6829,10 @@ func TestGetScoreFromCVSS(t *testing.T) {
V3Score: 0.0,
},
},
expectedScore: ptr.To[float64](8.1),
severitySource: "",
preferredSources: []string{"nvd", "redhat"},
expectedScore: ptr.To[float64](8.1),
expectedSource: "nvd",
},
{
name: "Should return nvd score when vendor doesn't exist",
Expand All @@ -6832,7 +6841,10 @@ func TestGetScoreFromCVSS(t *testing.T) {
V3Score: 8.1,
},
},
expectedScore: ptr.To[float64](8.1),
severitySource: "",
preferredSources: []string{"nvd", "redhat"},
expectedScore: ptr.To[float64](8.1),
expectedSource: "nvd",
},
{
name: "Should return vendor score when nvd doesn't exist",
Expand All @@ -6841,7 +6853,10 @@ func TestGetScoreFromCVSS(t *testing.T) {
V3Score: 8.1,
},
},
expectedScore: ptr.To[float64](8.1),
severitySource: "",
preferredSources: []string{"nvd", "redhat"},
expectedScore: ptr.To[float64](8.1),
expectedSource: "redhat",
},
{
name: "Should return nil when vendor and nvd both v3 scores are nil",
Expand All @@ -6853,19 +6868,26 @@ func TestGetScoreFromCVSS(t *testing.T) {
V3Score: 0.0,
},
},
expectedScore: nil,
severitySource: "",
preferredSources: []string{"nvd", "redhat"},
expectedScore: nil,
expectedSource: "",
},
{
name: "Should return nil when cvss doesn't exist",
cvss: dbtypes.VendorCVSS{},
expectedScore: nil,
name: "Should return nil when cvss doesn't exist",
cvss: dbtypes.VendorCVSS{},
severitySource: "",
preferredSources: []string{"nvd", "redhat"},
expectedScore: nil,
expectedSource: "",
},
}

for _, tc := range testCases {
t.Run(tc.name, func(t *testing.T) {
score := vulnerabilityreport.GetScoreFromCVSS(vulnerabilityreport.GetCvssV3(tc.cvss))
score, source := vulnerabilityreport.GetScoreFromCVSS(vulnerabilityreport.GetCvssV3(tc.cvss), tc.severitySource, tc.preferredSources)
assert.Equal(t, tc.expectedScore, score)
assert.Equal(t, tc.expectedSource, source)
})
}
}
Expand Down
1 change: 1 addition & 0 deletions pkg/vulnerabilityreport/io.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,6 +141,7 @@ type AdditionalFields struct {

func GetVulnerabilitiesFromScanResult(report ty.Result, addFields AdditionalFields) []v1alpha1.Vulnerability {
vulnerabilities := make([]v1alpha1.Vulnerability, 0)
// match Trivy preferred sources (this may change in the future)
preferredSources := []string{
"nvd", "redhat", "debian", "ubuntu", "alpine", "amazon", "oracleoval", "susecvrf", "photon",
"archlinux", "alma", "rocky", "cblmariner", "rubysec", "phpsecurityadvisories", "nodejssecuritywg",
Expand Down