-
Notifications
You must be signed in to change notification settings - Fork 2.2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(report): support OPA to filter vulnerabilities (#562)
* feat(cli): add --filter option * feat(opa): support OPA * test(opa): add a test case with OPA * test: update a mock * chore(mod): update dependencies * chore(filter): add example Rego files * chore(README): update * chore(rego): apply opa fmt * refactor: replace filter with policy * chore(policy): update rego files * fix(vulnerability): evaluate each vulnerability * chore(README): update * Update README.md Co-authored-by: Itay Shakury <itay@itaysk.com> * Update README.md Co-authored-by: Itay Shakury <itay@itaysk.com> * chore(README): update a TOC link * fix: replace allow with ignore * chore(README): update Co-authored-by: Itay Shakury <itay@itaysk.com>
- Loading branch information
Showing
17 changed files
with
470 additions
and
47 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,94 @@ | ||
| package trivy | ||
|
|
||
| import data.lib.trivy | ||
|
|
||
| default ignore = false | ||
|
|
||
| nvd_v3_vector = v { | ||
| v := input.CVSS.nvd.v3 | ||
| } | ||
|
|
||
| # Ignore a vulnerability which requires high privilege | ||
| ignore { | ||
| cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector) | ||
| cvss_vector.PrivilegesRequired == "High" | ||
| } | ||
|
|
||
| # Ignore a vulnerability which requires user interaction | ||
| ignore { | ||
| cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector) | ||
| cvss_vector.UserInteraction == "Required" | ||
| } | ||
|
|
||
| ignore { | ||
| input.PkgName == "openssl" | ||
|
|
||
| # Split CVSSv3 vector | ||
| cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector) | ||
|
|
||
| # Evaluate Attack Vector | ||
| ignore_attack_vectors := {"Physical", "Local"} | ||
| cvss_vector.AttackVector == ignore_attack_vectors[_] | ||
| } | ||
|
|
||
| ignore { | ||
| input.PkgName == "openssl" | ||
|
|
||
| # Evaluate severity | ||
| input.Severity == {"LOW", "MEDIUM", "HIGH"}[_] | ||
|
|
||
| # Evaluate CWE-ID | ||
| deny_cwe_ids := { | ||
| "CWE-119", # Improper Restriction of Operations within the Bounds of a Memory Buffer | ||
| "CWE-200", # Exposure of Sensitive Information to an Unauthorized Actor | ||
| } | ||
|
|
||
| count({x | x := input.CweIDs[_]; x == deny_cwe_ids[_]}) == 0 | ||
| } | ||
|
|
||
| ignore { | ||
| input.PkgName == "bash" | ||
|
|
||
| # Split CVSSv3 vector | ||
| cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector) | ||
|
|
||
| # Evaluate Attack Vector | ||
| ignore_attack_vectors := {"Physical", "Local", "Adjacent"} | ||
| cvss_vector.AttackVector == ignore_attack_vectors[_] | ||
|
|
||
| # Evaluate severity | ||
| input.Severity == {"LOW", "MEDIUM", "HIGH"}[_] | ||
| } | ||
|
|
||
| ignore { | ||
| input.PkgName == "django" | ||
|
|
||
| # Split CVSSv3 vector | ||
| cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector) | ||
|
|
||
| # Evaluate Attack Vector | ||
| ignore_attack_vectors := {"Physical", "Local"} | ||
| cvss_vector.AttackVector == ignore_attack_vectors[_] | ||
|
|
||
| # Evaluate severity | ||
| input.Severity == {"LOW", "MEDIUM"}[_] | ||
|
|
||
| # Evaluate CWE-ID | ||
| deny_cwe_ids := { | ||
| "CWE-89", # SQL Injection | ||
| "CWE-78", # OS Command Injection | ||
| } | ||
|
|
||
| count({x | x := input.CweIDs[_]; x == deny_cwe_ids[_]}) == 0 | ||
| } | ||
|
|
||
| ignore { | ||
| input.PkgName == "jquery" | ||
|
|
||
| # Split CVSSv3 vector | ||
| cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector) | ||
|
|
||
| # Evaluate CWE-ID | ||
| deny_cwe_ids := {"CWE-79"} # XSS | ||
| count({x | x := input.CweIDs[_]; x == deny_cwe_ids[_]}) == 0 | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| package trivy | ||
|
|
||
| import data.lib.trivy | ||
|
|
||
| default ignore = false | ||
|
|
||
| ignore_pkgs := {"bash", "bind-license", "rpm", "vim", "vim-minimal"} | ||
|
|
||
| ignore_severities := {"LOW", "MEDIUM"} | ||
|
|
||
| nvd_v3_vector = v { | ||
| v := input.CVSS.nvd.v3 | ||
| } | ||
|
|
||
| ignore { | ||
| input.PkgName == ignore_pkgs[_] | ||
| } | ||
|
|
||
| ignore { | ||
| input.Severity == ignore_severities[_] | ||
| } | ||
|
|
||
| # Ignore a vulnerability which is not remotely exploitable | ||
| ignore { | ||
| cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector) | ||
| cvss_vector.AttackVector != "Network" | ||
| } | ||
|
|
||
| # Ignore a vulnerability which requires high privilege | ||
| ignore { | ||
| cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector) | ||
| cvss_vector.PrivilegesRequired == "High" | ||
| } | ||
|
|
||
| # Ignore a vulnerability which requires user interaction | ||
| ignore { | ||
| cvss_vector := trivy.parse_cvss_vector_v3(nvd_v3_vector) | ||
| cvss_vector.UserInteraction == "Required" | ||
| } | ||
|
|
||
| # Ignore CSRF | ||
| ignore { | ||
| # https://cwe.mitre.org/data/definitions/352.html | ||
| input.CweIDs[_] == "CWE-352" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.