-
Notifications
You must be signed in to change notification settings - Fork 2.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Co-authored-by: DmitriyLewen <[email protected]>
- Loading branch information
1 parent
372efc9
commit 16b757d
Showing
16 changed files
with
344 additions
and
32 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
8 changes: 8 additions & 0 deletions
8
integration/testdata/fixtures/repo/packagesprops/Directory.Packages.props
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| <Project> | ||
|
|
||
| <ItemGroup> | ||
|
|
||
| <PackageVersion Include="Newtonsoft.Json" Version="9.0.1" /> | ||
|
|
||
| </ItemGroup> | ||
| </Project> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| { | ||
| "SchemaVersion": 2, | ||
| "CreatedAt": "2021-08-25T12:20:30.000000005Z", | ||
| "ArtifactName": "testdata/fixtures/repo/packagesprops", | ||
| "ArtifactType": "repository", | ||
| "Metadata": { | ||
| "ImageConfig": { | ||
| "architecture": "", | ||
| "created": "0001-01-01T00:00:00Z", | ||
| "os": "", | ||
| "rootfs": { | ||
| "type": "", | ||
| "diff_ids": null | ||
| }, | ||
| "config": {} | ||
| } | ||
| }, | ||
| "Results": [ | ||
| { | ||
| "Target": "Directory.Packages.props", | ||
| "Class": "lang-pkgs", | ||
| "Type": "packages-props", | ||
| "Packages": [ | ||
| { | ||
| "ID": "[email protected]", | ||
| "Name": "Newtonsoft.Json", | ||
| "Version": "9.0.1", | ||
| "Layer": {} | ||
| } | ||
| ], | ||
| "Vulnerabilities": [ | ||
| { | ||
| "VulnerabilityID": "GHSA-5crp-9r3c-p9vr", | ||
| "PkgID": "[email protected]", | ||
| "PkgName": "Newtonsoft.Json", | ||
| "InstalledVersion": "9.0.1", | ||
| "FixedVersion": "13.0.1", | ||
| "Status": "fixed", | ||
| "Layer": {}, | ||
| "SeveritySource": "ghsa", | ||
| "PrimaryURL": "https://github.com/advisories/GHSA-5crp-9r3c-p9vr", | ||
| "DataSource": { | ||
| "ID": "ghsa", | ||
| "Name": "GitHub Security Advisory Nuget", | ||
| "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anuget" | ||
| }, | ||
| "Title": "Improper Handling of Exceptional Conditions in Newtonsoft.Json", | ||
| "Description": "Newtonsoft.Json prior to version 13.0.1 is vulnerable to Insecure Defaults due to improper handling of expressions with high nesting level that lead to StackOverFlow exception or high CPU and RAM usage.", | ||
| "Severity": "HIGH", | ||
| "CweIDs": [ | ||
| "CWE-755" | ||
| ], | ||
| "CVSS": { | ||
| "ghsa": { | ||
| "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", | ||
| "V3Score": 7.5 | ||
| } | ||
| }, | ||
| "References": [ | ||
| "https://alephsecurity.com/2018/10/22/StackOverflowException/", | ||
| "https://alephsecurity.com/vulns/aleph-2018004" | ||
| ], | ||
| "PublishedDate": "2022-06-22T15:08:47Z", | ||
| "LastModifiedDate": "2022-06-27T18:37:23Z" | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
49 changes: 49 additions & 0 deletions
49
pkg/fanal/analyzer/language/dotnet/packagesprops/packagesprops.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,49 @@ | ||
| package packagesprops | ||
|
|
||
| import ( | ||
| "context" | ||
| "os" | ||
| "strings" | ||
|
|
||
| "golang.org/x/xerrors" | ||
|
|
||
| props "github.com/aquasecurity/go-dep-parser/pkg/nuget/packagesprops" | ||
| "github.com/aquasecurity/trivy/pkg/fanal/analyzer" | ||
| "github.com/aquasecurity/trivy/pkg/fanal/analyzer/language" | ||
| "github.com/aquasecurity/trivy/pkg/fanal/types" | ||
| ) | ||
|
|
||
| func init() { | ||
| analyzer.RegisterAnalyzer(&packagesPropsAnalyzer{}) | ||
| } | ||
|
|
||
| const ( | ||
| version = 1 | ||
| packagesPropsSuffix = "packages.props" // https://github.com/dotnet/roslyn-tools/blob/b4c5220f5dfc4278847b6d38eff91cc1188f8066/src/RoslynInsertionTool/RoslynInsertionTool/CoreXT.cs#L39-L40 | ||
| ) | ||
|
|
||
| type packagesPropsAnalyzer struct{} | ||
|
|
||
| func (a packagesPropsAnalyzer) Analyze(_ context.Context, input analyzer.AnalysisInput) (*analyzer.AnalysisResult, error) { | ||
| parser := props.NewParser() | ||
| res, err := language.Analyze(types.PackagesProps, input.FilePath, input.Content, parser) | ||
| if err != nil { | ||
| return nil, xerrors.Errorf("*Packages.props dependencies analysis error: %w", err) | ||
| } | ||
|
|
||
| return res, nil | ||
| } | ||
|
|
||
| func (a packagesPropsAnalyzer) Required(filePath string, _ os.FileInfo) bool { | ||
| // There is no information about this in the documentation, | ||
| // but NuGet works correctly with lowercase filenames | ||
| return strings.HasSuffix(strings.ToLower(filePath), packagesPropsSuffix) | ||
| } | ||
|
|
||
| func (a packagesPropsAnalyzer) Type() analyzer.Type { | ||
| return analyzer.TypePackagesProps | ||
| } | ||
|
|
||
| func (a packagesPropsAnalyzer) Version() int { | ||
| return version | ||
| } |
134 changes: 134 additions & 0 deletions
134
pkg/fanal/analyzer/language/dotnet/packagesprops/packagesprops_test.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,134 @@ | ||
| package packagesprops | ||
|
|
||
| import ( | ||
| "context" | ||
| "os" | ||
| "testing" | ||
|
|
||
| "github.com/stretchr/testify/assert" | ||
| "github.com/stretchr/testify/require" | ||
|
|
||
| "github.com/aquasecurity/trivy/pkg/fanal/analyzer" | ||
| "github.com/aquasecurity/trivy/pkg/fanal/types" | ||
| ) | ||
|
|
||
| func Test_packagesPropsAnalyzer_Analyze(t *testing.T) { | ||
| tests := []struct { | ||
| name string | ||
| inputFile string | ||
| want *analyzer.AnalysisResult | ||
| wantErr string | ||
| }{ | ||
| { | ||
| name: "happy path packages props", | ||
| inputFile: "testdata/Packages.props", | ||
| want: &analyzer.AnalysisResult{ | ||
| Applications: []types.Application{ | ||
| { | ||
| Type: types.PackagesProps, | ||
| FilePath: "testdata/Packages.props", | ||
| Libraries: types.Packages{ | ||
| { | ||
| ID: "[email protected]", | ||
| Name: "Package1", | ||
| Version: "22.1.4", | ||
| }, | ||
| { | ||
| ID: "[email protected]", | ||
| Name: "Package2", | ||
| Version: "2.3.0", | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| { | ||
| name: "happy path directory packages props", | ||
| inputFile: "testdata/Directory.Packages.props", | ||
| want: &analyzer.AnalysisResult{ | ||
| Applications: []types.Application{ | ||
| { | ||
| Type: types.PackagesProps, | ||
| FilePath: "testdata/Directory.Packages.props", | ||
| Libraries: types.Packages{ | ||
| { | ||
| ID: "[email protected]", | ||
| Name: "Package1", | ||
| Version: "4.2.1", | ||
| }, | ||
| { | ||
| ID: "[email protected]", | ||
| Name: "Package2", | ||
| Version: "8.2.0", | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| { | ||
| name: "sad path", | ||
| inputFile: "testdata/invalid.txt", | ||
| wantErr: "*Packages.props dependencies analysis error", | ||
| }, | ||
| } | ||
| for _, tt := range tests { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| f, err := os.Open(tt.inputFile) | ||
| require.NoError(t, err) | ||
| defer f.Close() | ||
|
|
||
| a := packagesPropsAnalyzer{} | ||
| ctx := context.Background() | ||
| got, err := a.Analyze(ctx, analyzer.AnalysisInput{ | ||
| FilePath: tt.inputFile, | ||
| Content: f, | ||
| }) | ||
|
|
||
| if tt.wantErr != "" { | ||
| assert.ErrorContains(t, err, tt.wantErr) | ||
| return | ||
| } | ||
|
|
||
| assert.NoError(t, err) | ||
| assert.Equal(t, tt.want, got) | ||
| }) | ||
| } | ||
| } | ||
|
|
||
| func Test_packagesPropsAnalyzer_Required(t *testing.T) { | ||
| tests := []struct { | ||
| name string | ||
| filePath string | ||
| want bool | ||
| }{ | ||
| { | ||
| name: "directory packages props", | ||
| filePath: "test/Directory.Packages.props", | ||
| want: true, | ||
| }, | ||
| { | ||
| name: "packages props", | ||
| filePath: "test/Packages.props", | ||
| want: true, | ||
| }, | ||
| { | ||
| name: "packages props lower case", | ||
| filePath: "test/packages.props", | ||
| want: true, | ||
| }, | ||
| { | ||
| name: "zip", | ||
| filePath: "test.zip", | ||
| want: false, | ||
| }, | ||
| } | ||
| for _, tt := range tests { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| a := packagesPropsAnalyzer{} | ||
| got := a.Required(tt.filePath, nil) | ||
| assert.Equal(t, tt.want, got) | ||
| }) | ||
| } | ||
| } |
7 changes: 7 additions & 0 deletions
7
pkg/fanal/analyzer/language/dotnet/packagesprops/testdata/Directory.Packages.props
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| <Project> | ||
|
|
||
| <ItemGroup> | ||
| <PackageVersion Include="Package1" Version="4.2.1" /> | ||
| <PackageVersion Include="Package2" Version="8.2.0" /> | ||
| </ItemGroup> | ||
| </Project> |
9 changes: 9 additions & 0 deletions
9
pkg/fanal/analyzer/language/dotnet/packagesprops/testdata/Packages.props
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| <Project> | ||
|
|
||
| <ItemGroup> | ||
|
|
||
| <PackageVersion Include="Package1" Version="22.1.4" /> | ||
| <PackageVersion Include="Package2" Version="2.3.0" /> | ||
|
|
||
| </ItemGroup> | ||
| </Project> |
1 change: 1 addition & 0 deletions
1
pkg/fanal/analyzer/language/dotnet/packagesprops/testdata/invalid.txt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| test |
Oops, something went wrong.