Skip to content

Commit edc556b

Browse files
DmitriyLewenDmitriyLewen
authored
feat(php): add installed.json file support (#4865)
1 parent 4f8b399 commit edc556b

File tree

22 files changed

+771
-105
lines changed

22 files changed

+771
-105
lines changed

‎docs/docs/coverage/language/index.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,8 @@ On the other hand, when the target is a post-build artifact, like a container im
2626
| | egg package[^1] | ✅ | ✅ | - | - |
2727
| | wheel package[^2] | ✅ | ✅ | - | - |
2828
| | conda package[^3] | ✅ | ✅ | - | - |
29-
| [PHP](php.md) | composer.lock | ✅ | ✅ | ✅ | ✅ |
29+
| [PHP](php.md) | composer.lock | - | - | ✅ | ✅ |
30+
| | installed.json | ✅ | ✅ | - | - |
3031
| [Node.js](nodejs.md) | package-lock.json | - | - | ✅ | ✅ |
3132
| | yarn.lock | - | - | ✅ | ✅ |
3233
| | pnpm-lock.yaml | - | - | ✅ | ✅ |

‎docs/docs/coverage/language/php.md

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,23 +4,27 @@ Trivy supports [Composer][composer], which is a tool for dependency management i
44

55
The following scanners are supported.
66

7-
| Package manager | SBOM | Vulnerability | License |
8-
| --------------- | :---: | :-----------: | :-----: |
9-
| Composer | ✓ | ✓ | ✓ |
7+
| Package manager | SBOM | Vulnerability | License |
8+
|-----------------|:----:|:-------------:|:-------:|
9+
| Composer | ✓ | ✓ | ✓ |
1010

1111
The following table provides an outline of the features Trivy offers.
1212

1313

14-
| Package manager | File | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position |
15-
|-----------------|---------------|:-----------------------:|:----------------:|:------------------------------------:|:--------:|
16-
| Composer | composer.lock | ✓ | Excluded | ✓ | ✓ |
14+
| Package manager | File | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position |
15+
|-----------------|----------------|:-----------------------:|:----------------:|:------------------------------------:|:--------:|
16+
| Composer | composer.lock | ✓ | Excluded | ✓ | ✓ |
17+
| Composer | installed.json | ✓ | Excluded | - | ✓ |
1718

18-
## Composer
19+
## composer.lock
1920
In order to detect dependencies, Trivy searches for `composer.lock`.
2021

2122
Trivy also supports dependency trees; however, to display an accurate tree, it needs to know whether each package is a direct dependency of the project.
2223
Since this information is not included in `composer.lock`, Trivy parses `composer.json`, which should be located next to `composer.lock`.
2324
If you want to see the dependency tree, please ensure that `composer.json` is present.
2425

26+
## installed.json
27+
Trivy also supports dependency detection for `installed.json` files. By default, you can find this file at `path_to_app/vendor/composer/installed.json`.
28+
2529
[composer]: https://getcomposer.org/
2630
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies

‎integration/repo_test.go

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -250,6 +250,16 @@ func TestRepository(t *testing.T) {
250250
},
251251
golden: "testdata/test-repo.json.golden",
252252
},
253+
{
254+
name: "installed.json",
255+
args: args{
256+
command: "rootfs",
257+
scanner: types.VulnerabilityScanner,
258+
listAllPkgs: true,
259+
input: "testdata/fixtures/repo/composer-vendor",
260+
},
261+
golden: "testdata/composer.vendor.json.golden",
262+
},
253263
{
254264
name: "dockerfile",
255265
args: args{

‎integration/testdata/composer.vendor.json.golden

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
{
2+
"SchemaVersion": 2,
3+
"CreatedAt": "2021-08-25T12:20:30.000000005Z",
4+
"ArtifactName": "testdata/fixtures/repo/composer-vendor",
5+
"ArtifactType": "filesystem",
6+
"Metadata": {
7+
"ImageConfig": {
8+
"architecture": "",
9+
"created": "0001-01-01T00:00:00Z",
10+
"os": "",
11+
"rootfs": {
12+
"type": "",
13+
"diff_ids": null
14+
},
15+
"config": {}
16+
}
17+
},
18+
"Results": [
19+
{
20+
"Target": "installed.json",
21+
"Class": "lang-pkgs",
22+
"Type": "composer-vendor",
23+
"Packages": [
24+
{
25+
"ID": "guzzlehttp/[email protected]",
26+
"Name": "guzzlehttp/psr7",
27+
"Identifier": {
28+
"PURL": "pkg:composer/guzzlehttp/[email protected]",
29+
"UID": "25fca97fe23aa7b1"
30+
},
31+
"Version": "1.8.3",
32+
"Licenses": [
33+
"MIT"
34+
],
35+
"DependsOn": [
36+
"psr/[email protected]",
37+
"ralouphie/[email protected]"
38+
],
39+
"Layer": {},
40+
"Locations": [
41+
{
42+
"StartLine": 3,
43+
"EndLine": 115
44+
}
45+
]
46+
},
47+
{
48+
"ID": "psr/[email protected]",
49+
"Name": "psr/http-message",
50+
"Identifier": {
51+
"PURL": "pkg:composer/psr/[email protected]",
52+
"UID": "299d8ff4461e894"
53+
},
54+
"Version": "1.1",
55+
"Licenses": [
56+
"MIT"
57+
],
58+
"Layer": {},
59+
"Locations": [
60+
{
61+
"StartLine": 116,
62+
"EndLine": 171
63+
}
64+
]
65+
},
66+
{
67+
"ID": "ralouphie/[email protected]",
68+
"Name": "ralouphie/getallheaders",
69+
"Identifier": {
70+
"PURL": "pkg:composer/ralouphie/[email protected]",
71+
"UID": "c383e94d979a209c"
72+
},
73+
"Version": "3.0.3",
74+
"Licenses": [
75+
"MIT"
76+
],
77+
"Layer": {},
78+
"Locations": [
79+
{
80+
"StartLine": 172,
81+
"EndLine": 218
82+
}
83+
]
84+
}
85+
],
86+
"Vulnerabilities": [
87+
{
88+
"VulnerabilityID": "CVE-2022-24775",
89+
"PkgID": "guzzlehttp/[email protected]",
90+
"PkgName": "guzzlehttp/psr7",
91+
"PkgIdentifier": {
92+
"PURL": "pkg:composer/guzzlehttp/[email protected]",
93+
"UID": "25fca97fe23aa7b1"
94+
},
95+
"InstalledVersion": "1.8.3",
96+
"FixedVersion": "1.8.4",
97+
"Status": "fixed",
98+
"Layer": {},
99+
"SeveritySource": "ghsa",
100+
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-24775",
101+
"DataSource": {
102+
"ID": "ghsa",
103+
"Name": "GitHub Security Advisory Composer",
104+
"URL": "https://github.com/advisories?query=type%%3Areviewed+ecosystem%%3Acomposer"
105+
},
106+
"Title": "Improper Input Validation in guzzlehttp/psr7",
107+
"Description": "### Impact\nIn proper header parsing. An attacker could sneak in a new line character and pass untrusted values. \n\n### Patches\nThe issue is patched in 1.8.4 and 2.1.1.\n\n### Workarounds\nThere are no known workarounds.\n",
108+
"Severity": "HIGH",
109+
"CweIDs": [
110+
"CWE-20"
111+
],
112+
"VendorSeverity": {
113+
"ghsa": 3
114+
},
115+
"CVSS": {
116+
"ghsa": {
117+
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
118+
"V3Score": 7.5
119+
}
120+
},
121+
"References": [
122+
"https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96",
123+
"https://nvd.nist.gov/vuln/detail/CVE-2022-24775"
124+
],
125+
"PublishedDate": "2022-03-25T19:26:33Z",
126+
"LastModifiedDate": "2022-06-14T20:02:29Z"
127+
}
128+
]
129+
}
130+
]
131+
}

0 commit comments

Comments
 (0)