Skip to content

Commit 7ff9aff

Browse files
DmitriyLewenknqyf263
DmitriyLewen
and
knqyf263
authored
fix(report): fix error with unmarshal of ExperimentalModifiedFindings (#7463)
Signed-off-by: knqyf263 <[email protected]> Co-authored-by: knqyf263 <[email protected]>
1 parent 927c6e0 commit 7ff9aff

File tree

3 files changed

+265
-3
lines changed

3 files changed

+265
-3
lines changed

‎integration/convert_test.go

+23-3
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,11 @@ import (
1111

1212
func TestConvert(t *testing.T) {
1313
type args struct {
14-
input string
15-
format string
16-
scanners string
14+
input string
15+
format string
16+
scanners string
17+
showSuppressed bool
18+
listAllPkgs bool
1719
}
1820
tests := []struct {
1921
name string
@@ -37,6 +39,16 @@ func TestConvert(t *testing.T) {
3739
},
3840
golden: "testdata/npm-cyclonedx.json.golden",
3941
},
42+
{
43+
name: "npm with suppressed vulnerability",
44+
args: args{
45+
input: "testdata/fixtures/convert/npm-with-suppressed.json.golden",
46+
format: "json",
47+
showSuppressed: true,
48+
listAllPkgs: true,
49+
},
50+
golden: "testdata/fixtures/convert/npm-with-suppressed.json.golden",
51+
},
4052
}
4153

4254
for _, tt := range tests {
@@ -50,6 +62,14 @@ func TestConvert(t *testing.T) {
5062
tt.args.format,
5163
}
5264

65+
if tt.args.showSuppressed {
66+
osArgs = append(osArgs, "--show-suppressed")
67+
}
68+
69+
if tt.args.listAllPkgs {
70+
osArgs = append(osArgs, "--list-all-pkgs")
71+
}
72+
5373
// Set up the output file
5474
outputFile := filepath.Join(t.TempDir(), "output.json")
5575
if *update {

‎integration/testdata/fixtures/convert/npm-with-suppressed.json.golden

+195
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,195 @@
1+
{
2+
"SchemaVersion": 2,
3+
"CreatedAt": "2024-09-09T13:21:09.230231+06:00",
4+
"ArtifactName": "package-lock.json",
5+
"ArtifactType": "filesystem",
6+
"Metadata": {
7+
"ImageConfig": {
8+
"architecture": "",
9+
"created": "0001-01-01T00:00:00Z",
10+
"os": "",
11+
"rootfs": {
12+
"type": "",
13+
"diff_ids": null
14+
},
15+
"config": {}
16+
}
17+
},
18+
"Results": [
19+
{
20+
"Target": "package-lock.json",
21+
"Class": "lang-pkgs",
22+
"Type": "npm",
23+
"Packages": [
24+
{
25+
"ID": "[email protected]",
26+
"Name": "debug",
27+
"Identifier": {
28+
"PURL": "pkg:npm/[email protected]",
29+
"UID": "45acc377fa09cc3"
30+
},
31+
"Version": "3.0.1",
32+
"Relationship": "direct",
33+
"DependsOn": [
34+
"[email protected]"
35+
],
36+
"Layer": {},
37+
"Locations": [
38+
{
39+
"StartLine": 11,
40+
"EndLine": 19
41+
}
42+
]
43+
},
44+
{
45+
"ID": "[email protected]",
46+
"Name": "ms",
47+
"Identifier": {
48+
"PURL": "pkg:npm/[email protected]",
49+
"UID": "f51af0181daf2ced"
50+
},
51+
"Version": "2.0.0",
52+
"Indirect": true,
53+
"Relationship": "indirect",
54+
"Layer": {},
55+
"Locations": [
56+
{
57+
"StartLine": 20,
58+
"EndLine": 25
59+
}
60+
]
61+
}
62+
],
63+
"Vulnerabilities": [
64+
{
65+
"VulnerabilityID": "CVE-2017-20165",
66+
"PkgID": "[email protected]",
67+
"PkgName": "debug",
68+
"PkgIdentifier": {
69+
"PURL": "pkg:npm/[email protected]",
70+
"UID": "45acc377fa09cc3"
71+
},
72+
"InstalledVersion": "3.0.1",
73+
"FixedVersion": "3.1.0, 2.6.9",
74+
"Status": "fixed",
75+
"Layer": {},
76+
"SeveritySource": "ghsa",
77+
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-20165",
78+
"DataSource": {
79+
"ID": "ghsa",
80+
"Name": "GitHub Security Advisory npm",
81+
"URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm"
82+
},
83+
"Title": "A vulnerability classified as problematic has been found in debug-js d ...",
84+
"Description": "A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.",
85+
"Severity": "HIGH",
86+
"CweIDs": [
87+
"CWE-1333"
88+
],
89+
"VendorSeverity": {
90+
"ghsa": 3,
91+
"nvd": 3
92+
},
93+
"CVSS": {
94+
"ghsa": {
95+
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
96+
"V3Score": 7.5
97+
},
98+
"nvd": {
99+
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
100+
"V3Score": 7.5
101+
}
102+
},
103+
"References": [
104+
"https://github.com/debug-js/debug",
105+
"https://github.com/debug-js/debug/commit/c38a0166c266a679c8de012d4eaccec3f944e685",
106+
"https://github.com/debug-js/debug/commit/f53962e944a87e6ca9bb622a2a12dffc22a9bb5a",
107+
"https://github.com/debug-js/debug/pull/504",
108+
"https://github.com/debug-js/debug/releases/tag/2.6.9",
109+
"https://github.com/debug-js/debug/releases/tag/3.1.0",
110+
"https://nvd.nist.gov/vuln/detail/CVE-2017-20165",
111+
"https://vuldb.com/?ctiid.217665",
112+
"https://vuldb.com/?id.217665"
113+
],
114+
"PublishedDate": "2023-01-09T10:15:10.447Z",
115+
"LastModifiedDate": "2024-05-17T01:17:24.28Z"
116+
}
117+
],
118+
"ExperimentalModifiedFindings": [
119+
{
120+
"Type": "vulnerability",
121+
"Status": "not_affected",
122+
"Statement": "vulnerable_code_not_in_execute_path",
123+
"Source": "./vex.json",
124+
"Finding": {
125+
"VulnerabilityID": "CVE-2017-16137",
126+
"PkgID": "[email protected]",
127+
"PkgName": "debug",
128+
"PkgIdentifier": {
129+
"PURL": "pkg:npm/[email protected]",
130+
"UID": "45acc377fa09cc3"
131+
},
132+
"InstalledVersion": "3.0.1",
133+
"FixedVersion": "2.6.9, 3.1.0, 3.2.7, 4.3.1",
134+
"Status": "fixed",
135+
"Layer": {},
136+
"SeveritySource": "ghsa",
137+
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-16137",
138+
"DataSource": {
139+
"ID": "ghsa",
140+
"Name": "GitHub Security Advisory npm",
141+
"URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm"
142+
},
143+
"Title": "nodejs-debug: Regular expression Denial of Service",
144+
"Description": "The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.",
145+
"Severity": "LOW",
146+
"CweIDs": [
147+
"CWE-400"
148+
],
149+
"VendorSeverity": {
150+
"ghsa": 1,
151+
"nvd": 2,
152+
"redhat": 2
153+
},
154+
"CVSS": {
155+
"ghsa": {
156+
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
157+
"V3Score": 3.7
158+
},
159+
"nvd": {
160+
"V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
161+
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
162+
"V2Score": 5,
163+
"V3Score": 5.3
164+
},
165+
"redhat": {
166+
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
167+
"V3Score": 5.3
168+
}
169+
},
170+
"References": [
171+
"https://access.redhat.com/security/cve/CVE-2017-16137",
172+
"https://github.com/debug-js/debug/commit/4e2150207c568adb9ead8f4c4528016081c88020",
173+
"https://github.com/debug-js/debug/commit/71169065b5262f9858ac78cc0b688c84a438f290",
174+
"https://github.com/debug-js/debug/commit/b6d12fdbc63b483e5c969da33ea6adc09946b5ac",
175+
"https://github.com/debug-js/debug/commit/f53962e944a87e6ca9bb622a2a12dffc22a9bb5a",
176+
"https://github.com/debug-js/debug/issues/797",
177+
"https://github.com/visionmedia/debug",
178+
"https://github.com/visionmedia/debug/issues/501",
179+
"https://github.com/visionmedia/debug/pull/504",
180+
"https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3%40%3Ccommits.netbeans.apache.org%3E",
181+
"https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3@%3Ccommits.netbeans.apache.org%3E",
182+
"https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63%40%3Cnotifications.netbeans.apache.org%3E",
183+
"https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63@%3Cnotifications.netbeans.apache.org%3E",
184+
"https://nodesecurity.io/advisories/534",
185+
"https://nvd.nist.gov/vuln/detail/CVE-2017-16137",
186+
"https://www.cve.org/CVERecord?id=CVE-2017-16137"
187+
],
188+
"PublishedDate": "2018-06-07T02:29:03.817Z",
189+
"LastModifiedDate": "2023-11-07T02:40:28.13Z"
190+
}
191+
}
192+
]
193+
}
194+
]
195+
}

‎pkg/types/finding.go

+47
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
package types
22

3+
import (
4+
"encoding/json"
5+
6+
"golang.org/x/xerrors"
7+
)
8+
39
type FindingType string
410
type FindingStatus string
511

@@ -45,3 +51,44 @@ func NewModifiedFinding(f finding, status FindingStatus, statement, source strin
4551
Finding: f,
4652
}
4753
}
54+
55+
// UnmarshalJSON unmarshals ModifiedFinding given the type and `UnmarshalJSON` functions of struct fields
56+
func (m *ModifiedFinding) UnmarshalJSON(data []byte) error {
57+
type Alias ModifiedFinding
58+
aux := &struct {
59+
Finding json.RawMessage `json:"Finding"`
60+
*Alias
61+
}{
62+
Alias: (*Alias)(m),
63+
}
64+
65+
if err := json.Unmarshal(data, &aux); err != nil {
66+
return err
67+
}
68+
69+
// Select struct by m.Type to avoid errors with Unmarshal
70+
var err error
71+
switch m.Type {
72+
case FindingTypeVulnerability:
73+
m.Finding, err = unmarshalFinding[DetectedVulnerability](aux.Finding)
74+
case FindingTypeMisconfiguration:
75+
m.Finding, err = unmarshalFinding[DetectedMisconfiguration](aux.Finding)
76+
case FindingTypeSecret:
77+
m.Finding, err = unmarshalFinding[DetectedSecret](aux.Finding)
78+
case FindingTypeLicense:
79+
m.Finding, err = unmarshalFinding[DetectedLicense](aux.Finding)
80+
default:
81+
return xerrors.Errorf("invalid Finding type: %s", m.Type)
82+
}
83+
84+
if err != nil {
85+
return xerrors.Errorf("unable to unmarshal %q type: %w", m.Type, err)
86+
}
87+
return nil
88+
}
89+
90+
func unmarshalFinding[T finding](data []byte) (T, error) {
91+
var f T
92+
err := json.Unmarshal(data, &f)
93+
return f, err
94+
}

0 commit comments

Comments
 (0)