-
Notifications
You must be signed in to change notification settings - Fork 2.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(swift): add vulns for cocoapods (#5037)
* add vulns for cocoapods, fix purl * update docs * remove go-dep-parser replace * update purl and test * bump github.com/DmitriyLewen/trivy-db * remove replace for trivy-db * remove added sbom tests * add test for Package() func * add wrong epoch test * refactor docs * add comment to join the module and submodule in purl * docs: add an example --------- Co-authored-by: knqyf263 <[email protected]>
- Loading branch information
1 parent
422fa41
commit 9c211d0
Showing
13 changed files
with
331 additions
and
73 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,10 +1,44 @@ | ||
| # Swift | ||
|
|
||
| Trivy supports [CocoaPods][cocoapods] for Swift packages. | ||
| Trivy supports [CocoaPods][cocoapods] and [Swift][swift] package managers. | ||
|
|
||
| The following scanners are supported. | ||
|
|
||
| | Package manager | SBOM | Vulnerability | License | | ||
| | --------------- | :---: | :-----------: | :-----: | | ||
| | CocoaPods | ✓ | - | - | | ||
| | Package manager | SBOM | Vulnerability | License | | ||
| |-----------------|:----:|:-------------:|:-------:| | ||
| | Swift | ✓ | ✓ | - | | ||
| | CocoaPods | ✓ | ✓ | - | | ||
|
|
||
| The following table provides an outline of the features Trivy offers. | ||
|
|
||
| | Package manager | File | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position | | ||
| |:---------------:|------------------|:-----------------------:|:----------------:|:------------------------------------:|:--------:| | ||
| | Swift | Package.resolved | ✓ | Included | - | ✓ | | ||
| | CocoaPods | Podfile.lock | ✓ | Included | ✓ | - | | ||
|
|
||
| These may be enabled or disabled depending on the target. | ||
| See [here](./index.md) for the detail. | ||
|
|
||
| ## Swift | ||
| Trivy parses [Package.resolved][package-resolved] file to find dependencies. | ||
| Don't forget to update (`swift package update` command) this file before scanning. | ||
|
|
||
| ## CocoaPods | ||
| CocoaPods uses package names in `PodFile.lock`, but [GitHub Advisory Database (GHSA)][ghsa] Trivy relies on uses Git URLs. | ||
| We parse [the CocoaPods Specs][cocoapods-specs] to match package names and links. | ||
|
|
||
| !!! note "Limitation" | ||
| Since [GHSA][ghsa] holds only Git URLs, such as github.com/apple/swift-nio, | ||
| Trivy can't identify affected submodules, and detect all submodules maintained by the same URL. | ||
| For example, [SwiftNIOHTTP1][niohttp1] and [SwiftNIOWebSocket][niowebsocket] both are maintained under `github.com/apple/swift-nio`, | ||
| and Trivy detect CVE-2022-3215 for both of them, even though only [SwiftNIOHTTP1][niohttp1] is actually affected. | ||
|
|
||
| [cocoapods]: https://cocoapods.org/ | ||
| [cocoapods-specs]: https://github.com/CocoaPods/Specs | ||
| [ghsa]: https://github.com/advisories?query=type%3Areviewed+ecosystem%3Aswift | ||
| [swift]: https://www.swift.org/package-manager/ | ||
| [package-resolved]: https://github.com/apple/swift-package-manager/blob/4a42f2519e3f7b8a731c5ed89b47ed577df8f86c/Documentation/Usage.md#resolving-versions-packageresolved-file | ||
| [dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies | ||
|
|
||
| [cocoapods]: https://cocoapods.org/ | ||
| [niohttp1]: https://cocoapods.org/pods/SwiftNIOHTTP1 | ||
| [niowebsocket]: https://cocoapods.org/pods/SwiftNIOWebSocket |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -21,44 +21,39 @@ | |
| "Type": "cocoapods", | ||
| "Packages": [ | ||
| { | ||
| "ID": "AppCenter/4.2.0", | ||
| "Name": "AppCenter", | ||
| "Version": "4.2.0", | ||
| "DependsOn": [ | ||
| "AppCenter/Analytics/4.2.0", | ||
| "AppCenter/Crashes/4.2.0" | ||
| ], | ||
| "Layer": {} | ||
| }, | ||
| { | ||
| "ID": "AppCenter/Analytics/4.2.0", | ||
| "Name": "AppCenter/Analytics", | ||
| "Version": "4.2.0", | ||
| "DependsOn": [ | ||
| "AppCenter/Core/4.2.0" | ||
| ], | ||
| "Layer": {} | ||
| }, | ||
| { | ||
| "ID": "AppCenter/Core/4.2.0", | ||
| "Name": "AppCenter/Core", | ||
| "Version": "4.2.0", | ||
| "ID": "[email protected]", | ||
| "Name": "_NIODataStructures", | ||
| "Version": "2.41.0", | ||
| "Layer": {} | ||
| }, | ||
| } | ||
| ], | ||
| "Vulnerabilities": [ | ||
| { | ||
| "ID": "AppCenter/Crashes/4.2.0", | ||
| "Name": "AppCenter/Crashes", | ||
| "Version": "4.2.0", | ||
| "DependsOn": [ | ||
| "AppCenter/Core/4.2.0" | ||
| "VulnerabilityID": "CVE-2022-3215", | ||
| "PkgID": "[email protected]", | ||
| "PkgName": "_NIODataStructures", | ||
| "InstalledVersion": "2.41.0", | ||
| "FixedVersion": "2.29.1, 2.39.1, 2.42.0", | ||
| "Status": "fixed", | ||
| "Layer": {}, | ||
| "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-3215", | ||
| "Title": "SwiftNIO vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')", | ||
| "Description": "`NIOHTTP1` and projects using it for generating HTTP responses, including SwiftNIO, can be subject to a HTTP Response Injection attack...", | ||
| "Severity": "MEDIUM", | ||
| "CVSS": { | ||
| "ghsa": { | ||
| "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", | ||
| "V3Score": 5.3 | ||
| } | ||
| }, | ||
| "References": [ | ||
| "https://github.com/apple/swift-nio/security/advisories/GHSA-7fj7-39wj-c64f", | ||
| "https://nvd.nist.gov/vuln/detail/CVE-2022-3215", | ||
| "https://github.com/apple/swift-nio/commit/a16e2f54a25b2af217044e5168997009a505930f", | ||
| "https://github.com/advisories/GHSA-7fj7-39wj-c64f" | ||
| ], | ||
| "Layer": {} | ||
| }, | ||
| { | ||
| "ID": "KeychainAccess/4.2.1", | ||
| "Name": "KeychainAccess", | ||
| "Version": "4.2.1", | ||
| "Layer": {} | ||
| "PublishedDate": "2023-06-07T16:01:53Z", | ||
| "LastModifiedDate": "2023-06-19T16:45:07Z" | ||
| } | ||
| ] | ||
| } | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| - bucket: "cocoapods::GitHub Security Advisory Cocoapods" | ||
| pairs: | ||
| - bucket: _NIODataStructures | ||
| pairs: | ||
| - key: CVE-2022-3215 | ||
| value: | ||
| PatchedVersions: | ||
| - "2.29.1" | ||
| - "2.39.1" | ||
| - "2.42.0" | ||
| VulnerableVersions: | ||
| - "< 2.29.1" | ||
| - ">= 2.39.0, < 2.39.1" | ||
| - ">= 2.41.0, < 2.42.0" |
26 changes: 15 additions & 11 deletions
26
integration/testdata/fixtures/repo/cocoapods/Podfile.lock
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,12 +1,16 @@ | ||
| PODS: | ||
| - AppCenter (4.2.0): | ||
| - AppCenter/Analytics (= 4.2.0) | ||
| - AppCenter/Crashes (= 4.2.0) | ||
| - AppCenter/Analytics (4.2.0): | ||
| - AppCenter/Core | ||
| - AppCenter/Core (4.2.0) | ||
| - AppCenter/Crashes (4.2.0): | ||
| - AppCenter/Core | ||
| - KeychainAccess (4.2.1) | ||
|
|
||
| COCOAPODS: 1.11.2 | ||
| - _NIODataStructures (2.41.0) | ||
|
|
||
| DEPENDENCIES: | ||
| - _NIODataStructures (= 2.41.0) | ||
|
|
||
| SPEC REPOS: | ||
| trunk: | ||
| - _NIODataStructures | ||
|
|
||
| SPEC CHECKSUMS: | ||
| _NIODataStructures: 3d45d8e70a1d17a15b1dc59d102c63dbc0525ffd | ||
|
|
||
| PODFILE CHECKSUM: 2acff18c7f9246879b6a1a2d04e5decbc9410ef4 | ||
|
|
||
| COCOAPODS: 1.12.1 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.