Fixes duplicate & incorrect version in requirements.txt & empty Upgrade To Version Suggestion #401
Conversation
vet Summary ReportThis report is generated by vet Policy Checks
Malicious Package AnalysisMalicious package analysis is performed using SafeDep Cloud API. Malicious Package Analysis Report
|
| @@ -47,6 +48,16 @@ func (p *lockfileReader) EnumManifests(handler func(*models.PackageManifest, | |||
| if err != nil { | |||
| return err | |||
| } | |||
| var updatedPkgs []*models.Package | |||
| for _, pkg := range manifest.Packages { | |||
| if pkg.PackageDetails.Version != "0.0.0" && pkg.PackageDetails.Version != "" { | |||
There was a problem hiding this comment.
This seems like a hack. Whats the rationale behind this check? It seems to me we are working around a problem with a different root cause, probably related to parser. I think it makes sense to do some analysis and identify the root cause on why version will be empty or 0.0.0
There was a problem hiding this comment.
I checked the parser & the issue exists in the osv-scanner lib we are using for parsing the file
https://github.com/google/osv-scanner/blob/v1/pkg/lockfile/parse-requirements-txt.go#L182
There was a problem hiding this comment.
It parses the pkg with default version as 0.0.0 whenever there is no version given for a pkg
| @@ -474,8 +474,10 @@ func (r *markdownSummaryReporter) getCheckIconForThreats(internalModel *vetResul | |||
| func (r *markdownSummaryReporter) getAdviceSummary(adv *jsonreportspec.RemediationAdvice) (string, error) { | |||
| switch adv.Type { | |||
| case jsonreportspec.RemediationAdviceType_UpgradePackage: | |||
| return fmt.Sprintf("Upgrade to %s@%s", adv.GetTargetPackageName(), | |||
| adv.GetTargetPackageVersion()), nil | |||
| if adv.GetTargetPackageVersion() != "" { | |||
There was a problem hiding this comment.
I think we should do some analysis on why GetTargetPackageVersion() return empty version. May be we will discover a much more fundamental problem.
There was a problem hiding this comment.
Its probably a issue in the backend right?
Fixes #343 #344