Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(swift): add vulns for cocoapods #5037

Merged
merged 12 commits into from
Aug 29, 2023
Merged

feat(swift): add vulns for cocoapods #5037

merged 12 commits into from
Aug 29, 2023

Conversation

DmitriyLewen
Copy link
Contributor

@DmitriyLewen DmitriyLewen commented Aug 24, 2023 •
edited
Loading

Description

Add vulnerability detection for Cocoapods.
Update purl - use subpath.

➜ trivy fs ./Podfile.lock 
2023-08-25T12:17:43.021+0600    INFO    Vulnerability scanning is enabled
2023-08-25T12:17:43.022+0600    INFO    Secret scanning is enabled
2023-08-25T12:17:43.022+0600    INFO    If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2023-08-25T12:17:43.022+0600    INFO    Please see also https://aquasecurity.github.io/trivy/dev/docs/scanner/secret/#recommendation for faster secret detection
2023-08-25T12:17:43.027+0600    INFO    Number of language-specific files: 1
2023-08-25T12:17:43.027+0600    INFO    Detecting cocoapods vulnerabilities...

Podfile.lock (cocoapods)

Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌────────────────────┬───────────────┬──────────┬────────┬───────────────────┬────────────────────────┬────────────────────────────────────────────────────────┐
│      Library       │ Vulnerability │ Severity │ Status │ Installed Version │     Fixed Version      │                         Title                          │
├────────────────────┼───────────────┼──────────┼────────┼───────────────────┼────────────────────────┼────────────────────────────────────────────────────────┤
│ _NIODataStructures │ CVE-2022-3215 │ MEDIUM   │ fixed  │ 2.41.0            │ 2.29.1, 2.39.1, 2.42.0 │ SwiftNIO vulnerable to Improper Neutralization of CRLF │
│                    │               │          │        │                   │                        │ Sequences in HTTP Headers ('HTTP...                    │
│                    │               │          │        │                   │                        │ https://avd.aquasec.com/nvd/cve-2022-3215              │
└────────────────────┴───────────────┴──────────┴────────┴───────────────────┴────────────────────────┴────────────────────────────────────────────────────────┘

Related issues

Related PRs

Checklist

  • I've read the guidelines for contributing to this repository.
  • I've followed the conventions in the PR title.
  • I've added tests that prove my fix is effective or that my feature works.
  • I've updated the documentation with the relevant information (if needed).
  • I've added usage information (if the PR introduces new options)
  • I've included a "before" and "after" example to the description (if the PR is a user interface change).

knqyf263
knqyf263 reviewed Aug 28, 2023
View reviewed changes
pkg/sbom/cyclonedx/unmarshal_test.go Outdated
@@ -313,6 +313,50 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
},
},
},
{
name: "happy path for cocoapods with purl subpath",
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there any specific logic for the combination of CycloneDX and CocoaPods besides PURL? If not, we don't need to test the same thing again here as we test the PURL logic in the purl package enough.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't test Package() function in purl package.
I only found 1 my mistake with subpath when testing SBOM manually.
That is why i added tests in SBOM.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, we should add TestPackage then.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removed added test for SBOM and added TestPackage.

@DmitriyLewen DmitriyLewen marked this pull request as ready for review August 28, 2023 11:32
@DmitriyLewen DmitriyLewen self-assigned this Aug 29, 2023
knqyf263
knqyf263 reviewed Aug 29, 2023
View reviewed changes
docs/docs/coverage/language/swift.md Outdated
Trivy parses [Package.resolved][package-resolved] file to find dependencies. Don't forger to update (`swift package update` command) this file before scanning.

## cocoapods
Cocoapods uses package names in `PodFile.lock`, but [GitHub advisory database][ghsa] uses git links.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should mention the limitation that all modules are detected under the same git URL.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

docs/docs/coverage/language/swift.md Outdated
| Package manager | File | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position |
|:---------------:|------------------|:-----------------------:|:----------------:|:------------------------------------:|:--------:|
| Swift | Package.resolved | ✓ | Included | - | ✓ |
| Cocoapods | Podfile.lock | ✓ | Included | ✓ | - |
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
| Cocoapods | Podfile.lock | ✓ | Included | ✓ | - |
| CocoaPods | Podfile.lock | ✓ | Included | ✓ | - |

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

docs/docs/coverage/language/swift.md Outdated
These may be enabled or disabled depending on the target.
See [here](./index.md) for the detail.

## swift
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
## swift
## Swift

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

docs/docs/coverage/language/swift.md Outdated
## swift
Trivy parses [Package.resolved][package-resolved] file to find dependencies. Don't forger to update (`swift package update` command) this file before scanning.

## cocoapods
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
## cocoapods
## CocoaPods

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

docs/docs/coverage/language/swift.md Outdated
[ghsa]: https://github.com/advisories?query=type%3Areviewed+ecosystem%3Aswift
[swift]: https://www.swift.org/package-manager/
[package-resolved]: https://github.com/apple/swift-package-manager/blob/main/Documentation/Usage.md#resolving-versions-packageresolved-file
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The link should be permanent. The main branch can be updated.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

docs/docs/coverage/language/swift.md Outdated
Trivy parses [Package.resolved][package-resolved] file to find dependencies. Don't forger to update (`swift package update` command) this file before scanning.

## cocoapods
Cocoapods uses package names in `PodFile.lock`, but [GitHub advisory database][ghsa] uses git links.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Cocoapods uses package names in `PodFile.lock`, but [GitHub advisory database][ghsa] uses git links.
CocoaPods uses package names in `PodFile.lock`, but [GitHub Advisory Database][ghsa] uses git links.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

pkg/purl/purl.go Show resolved Hide resolved
@knqyf263 knqyf263 added this pull request to the merge queue Aug 29, 2023
Merged via the queue into aquasecurity:main with commit 9c211d0 Aug 29, 2023
17 checks passed
@DmitriyLewen DmitriyLewen deleted the feat/cocoapods-vulns branch August 30, 2023 02:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@knqyf263 knqyf263 knqyf263 approved these changes

Assignees

@DmitriyLewen DmitriyLewen

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Add support for Swift packages vulnerabilities
2 participants
@DmitriyLewen @knqyf263