Feat/rootio provider #914
Open
Feat/rootio provider #914
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* Added following the existing directory structure a provider folder for rootio plus a provider class and a parser * Added to the global cli config the rootio provider config mapping * Added the rootio provider to the mapping in the global provider initialization * Added the appropriate configuration for testing the new provider with a unit test Signed-off-by: Shaked Dembo <[email protected]>
* Added root api for cve_feed as supported data sources * Updated the output for vunnel list (noticed a drift with other ecosystems so I updated it to the latest) Signed-off-by: Shaked Dembo <[email protected]>
Signed-off-by: Shaked Dembo <[email protected]>
patched packages - Add ROOTIO_UNAFFECTED marker emission for packages with .root.io version suffix - Include vulnerable range constraint to exclude Root.io patched versions - Support both OS packages (Alpine, Debian, Ubuntu) and language packages (Python) - Add comprehensive unit tests for the parser modifications This prevents false positive vulnerability reports for packages that have been patched by Root.io security team. Signed-off-by: Chai Tadmor <[email protected]>
chait-slim
force-pushed
the
feat/rootio-provider
branch
from
fc331e6 to
9efe013
Compare
| if not fixed_versions: | ||
| cve_record["Vulnerability"]["FixedIn"].append({ | ||
| "Name": package_name, | ||
| "Version": "", # Empty version indicates no fix available |
Contributor
There was a problem hiding this comment.
I thought we had discussed at #863 (comment) that this vulnerability feed only supports records of fixes? Should this code ever be reachable?
| namespace = data["Vulnerability"].get("NamespaceName", "") | ||
| if namespace == "rootio:language:python": | ||
| for fixed_in in data["Vulnerability"].get("FixedIn", []): | ||
| if fixed_in.get("Version") == "ROOTIO_UNAFFECTED": |
Contributor
There was a problem hiding this comment.
Please don't use magic / sentinel values like this. You want the vunnel to emit an actual version at which the vulnerability was fixed.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.