revert: add new classes for vulnerabilities (#2701)

aquasecurity · Aug 15, 2022 · ed1fa89 · ed1fa89
1 parent a5d4f7f
commit ed1fa89
Show file tree

Hide file tree

Showing 50 changed files with 127 additions and 142 deletions.
diff --git a/go.mod b/go.mod
@@ -8,7 +8,7 @@ require (
 	github.com/NYTimes/gziphandler v1.1.1
 	github.com/alicebob/miniredis/v2 v2.22.0
 	github.com/aquasecurity/bolt-fixtures v0.0.0-20200903104109-d34e7f983986
-	github.com/aquasecurity/go-dep-parser v0.0.0-20220807122629-b5a21d267b03
+	github.com/aquasecurity/go-dep-parser v0.0.0-20220815163410-fcf26eb92b86
 	github.com/aquasecurity/go-gem-version v0.0.0-20201115065557-8eed6fe000ce
 	github.com/aquasecurity/go-npm-version v0.0.0-20201110091526-0b796d180798
 	github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46

diff --git a/go.sum b/go.sum
@@ -206,8 +206,8 @@ github.com/aquasecurity/bolt-fixtures v0.0.0-20200903104109-d34e7f983986 h1:2a30
 github.com/aquasecurity/bolt-fixtures v0.0.0-20200903104109-d34e7f983986/go.mod h1:NT+jyeCzXk6vXR5MTkdn4z64TgGfE5HMLC8qfj5unl8=
 github.com/aquasecurity/defsec v0.71.5 h1:HOao1TaP74lhbsLUmYaNgHx1afdYImDicB8b/f54FIM=
 github.com/aquasecurity/defsec v0.71.5/go.mod h1:+ouYrROGLz3lGutl+K+ilXX5V41S76JIi+L8aXPBsAQ=
-github.com/aquasecurity/go-dep-parser v0.0.0-20220807122629-b5a21d267b03 h1:Axx5KwV0c83IlPLIIsi/Ht6sGsSJBzABUngXjFHFg4I=
-github.com/aquasecurity/go-dep-parser v0.0.0-20220807122629-b5a21d267b03/go.mod h1:SONYN1M+sYu6VIJsZnltmVfcGOCvp09HWbhpnHDn3aY=
+github.com/aquasecurity/go-dep-parser v0.0.0-20220815163410-fcf26eb92b86 h1:sc8hDjSxO3aiG0R7HvaAVnY6329NTtv9AqDGpVQxAPQ=
+github.com/aquasecurity/go-dep-parser v0.0.0-20220815163410-fcf26eb92b86/go.mod h1:wwxn1SyOEY8W5hy8aDQDoExX+ybVsi+xfIllXz93+Fk=
 github.com/aquasecurity/go-gem-version v0.0.0-20201115065557-8eed6fe000ce h1:QgBRgJvtEOBtUXilDb1MLi1p1MWoyFDXAu5DEUl5nwM=
 github.com/aquasecurity/go-gem-version v0.0.0-20201115065557-8eed6fe000ce/go.mod h1:HXgVzOPvXhVGLJs4ZKO817idqr/xhwsTcj17CLYY74s=
 github.com/aquasecurity/go-mock-aws v0.0.0-20220726154943-99847deb62b0 h1:tihCUjLWkF0b1SAjAKcFltUs3SpsqGrLtI+Frye0D10=

diff --git a/integration/client_server_test.go b/integration/client_server_test.go
@@ -12,6 +12,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/samber/lo"
+
 	cdx "github.com/CycloneDX/cyclonedx-go"
 	"github.com/docker/go-connections/nat"
 	"github.com/stretchr/testify/assert"
@@ -399,10 +401,10 @@ func TestClientServerWithCycloneDX(t *testing.T) {
 			err = json.NewDecoder(f).Decode(&got)
 			require.NoError(t, err)
 
-			assert.EqualValues(t, tt.wantComponentsCount, len(*got.Components))
-			assert.EqualValues(t, tt.wantDependenciesCount, len(*got.Dependencies))
+			assert.EqualValues(t, tt.wantComponentsCount, len(lo.FromPtr(got.Components)))
+			assert.EqualValues(t, tt.wantDependenciesCount, len(lo.FromPtr(got.Dependencies)))
 			for i, dep := range *got.Dependencies {
-				assert.EqualValues(t, tt.wantDependsOnCount[i], len(*dep.Dependencies))
+				assert.EqualValues(t, tt.wantDependsOnCount[i], len(lo.FromPtr(dep.Dependencies)))
 			}
 		})
 	}

diff --git a/integration/testdata/almalinux-8.json.golden b/integration/testdata/almalinux-8.json.golden
@@ -48,7 +48,7 @@
   "Results": [
     {
       "Target": "testdata/fixtures/images/almalinux-8.tar.gz (alma 8.5)",
-      "Class": "vuln-os-pkgs",
+      "Class": "os-pkgs",
       "Type": "alma",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/alpine-310-registry.json.golden b/integration/testdata/alpine-310-registry.json.golden
@@ -56,7 +56,7 @@
   "Results": [
     {
       "Target": "localhost:63577/alpine:3.10 (alpine 3.10.2)",
-      "Class": "vuln-os-pkgs",
+      "Class": "os-pkgs",
       "Type": "alpine",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/alpine-310.json.golden b/integration/testdata/alpine-310.json.golden
@@ -50,7 +50,7 @@
   "Results": [
     {
       "Target": "testdata/fixtures/images/alpine-310.tar.gz (alpine 3.10.2)",
-      "Class": "vuln-os-pkgs",
+      "Class": "os-pkgs",
       "Type": "alpine",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/alpine-39-high-critical.json.golden b/integration/testdata/alpine-39-high-critical.json.golden
@@ -50,7 +50,7 @@
   "Results": [
     {
       "Target": "testdata/fixtures/images/alpine-39.tar.gz (alpine 3.9.4)",
-      "Class": "vuln-os-pkgs",
+      "Class": "os-pkgs",
       "Type": "alpine",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/alpine-39-ignore-cveids.json.golden b/integration/testdata/alpine-39-ignore-cveids.json.golden
@@ -50,7 +50,7 @@
   "Results": [
     {
       "Target": "testdata/fixtures/images/alpine-39.tar.gz (alpine 3.9.4)",
-      "Class": "vuln-os-pkgs",
+      "Class": "os-pkgs",
       "Type": "alpine",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/alpine-39.json.golden b/integration/testdata/alpine-39.json.golden
@@ -50,7 +50,7 @@
   "Results": [
     {
       "Target": "testdata/fixtures/images/alpine-39.tar.gz (alpine 3.9.4)",
-      "Class": "vuln-os-pkgs",
+      "Class": "os-pkgs",
       "Type": "alpine",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/alpine-distroless.json.golden b/integration/testdata/alpine-distroless.json.golden
@@ -45,7 +45,7 @@
   "Results": [
     {
       "Target": "testdata/fixtures/images/alpine-distroless.tar.gz (alpine 3.16)",
-      "Class": "vuln-os-pkgs",
+      "Class": "os-pkgs",
       "Type": "alpine",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/amazon-1.json.golden b/integration/testdata/amazon-1.json.golden
@@ -49,7 +49,7 @@
   "Results": [
     {
       "Target": "testdata/fixtures/images/amazon-1.tar.gz (amazon AMI release 2018.03)",
-      "Class": "vuln-os-pkgs",
+      "Class": "os-pkgs",
       "Type": "amazon",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/amazon-2.json.golden b/integration/testdata/amazon-2.json.golden
@@ -49,7 +49,7 @@
   "Results": [
     {
       "Target": "testdata/fixtures/images/amazon-2.tar.gz (amazon 2 (Karoo))",
-      "Class": "vuln-os-pkgs",
+      "Class": "os-pkgs",
       "Type": "amazon",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/busybox-with-lockfile.json.golden b/integration/testdata/busybox-with-lockfile.json.golden
@@ -49,7 +49,7 @@
   "Results": [
     {
       "Target": "Cargo.lock",
-      "Class": "vuln-lang-pkgs",
+      "Class": "lang-pkgs",
       "Type": "cargo",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/centos-6.json.golden b/integration/testdata/centos-6.json.golden
@@ -71,7 +71,7 @@
   "Results": [
     {
       "Target": "testdata/fixtures/images/centos-6.tar.gz (centos 6.10)",
-      "Class": "vuln-os-pkgs",
+      "Class": "os-pkgs",
       "Type": "centos",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/centos-7-cyclonedx.json.golden b/integration/testdata/centos-7-cyclonedx.json.golden
@@ -3,7 +3,7 @@
   "specVersion": "1.4",
   "version": 1,
   "metadata": {
-    "timestamp": "2022-07-03T08:45:54+00:00",
+    "timestamp": "2022-08-14T12:39:11+00:00",
     "tools": [
       {
         "vendor": "aquasecurity",

diff --git a/integration/testdata/centos-7-ignore-unfixed.json.golden b/integration/testdata/centos-7-ignore-unfixed.json.golden
@@ -61,7 +61,7 @@
   "Results": [
     {
       "Target": "testdata/fixtures/images/centos-7.tar.gz (centos 7.6.1810)",
-      "Class": "vuln-os-pkgs",
+      "Class": "os-pkgs",
       "Type": "centos",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/centos-7-medium.json.golden b/integration/testdata/centos-7-medium.json.golden
@@ -61,7 +61,7 @@
   "Results": [
     {
       "Target": "testdata/fixtures/images/centos-7.tar.gz (centos 7.6.1810)",
-      "Class": "vuln-os-pkgs",
+      "Class": "os-pkgs",
       "Type": "centos",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/centos-7.json.golden b/integration/testdata/centos-7.json.golden
@@ -61,7 +61,7 @@
   "Results": [
     {
       "Target": "testdata/fixtures/images/centos-7.tar.gz (centos 7.6.1810)",
-      "Class": "vuln-os-pkgs",
+      "Class": "os-pkgs",
       "Type": "centos",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/debian-buster-ignore-unfixed.json.golden b/integration/testdata/debian-buster-ignore-unfixed.json.golden
@@ -49,7 +49,7 @@
   "Results": [
     {
       "Target": "testdata/fixtures/images/debian-buster.tar.gz (debian 10.1)",
-      "Class": "vuln-os-pkgs",
+      "Class": "os-pkgs",
       "Type": "debian",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/debian-buster.json.golden b/integration/testdata/debian-buster.json.golden
@@ -49,7 +49,7 @@
   "Results": [
     {
       "Target": "testdata/fixtures/images/debian-buster.tar.gz (debian 10.1)",
-      "Class": "vuln-os-pkgs",
+      "Class": "os-pkgs",
       "Type": "debian",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/debian-stretch.json.golden b/integration/testdata/debian-stretch.json.golden
@@ -50,7 +50,7 @@
   "Results": [
     {
       "Target": "testdata/fixtures/images/debian-stretch.tar.gz (debian 9.9)",
-      "Class": "vuln-os-pkgs",
+      "Class": "os-pkgs",
       "Type": "debian",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/distroless-base.json.golden b/integration/testdata/distroless-base.json.golden
@@ -48,7 +48,7 @@
   "Results": [
     {
       "Target": "testdata/fixtures/images/distroless-base.tar.gz (debian 9.9)",
-      "Class": "vuln-os-pkgs",
+      "Class": "os-pkgs",
       "Type": "debian",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/distroless-python27.json.golden b/integration/testdata/distroless-python27.json.golden
@@ -65,7 +65,7 @@
   "Results": [
     {
       "Target": "testdata/fixtures/images/distroless-python27.tar.gz (debian 9.9)",
-      "Class": "vuln-os-pkgs",
+      "Class": "os-pkgs",
       "Type": "debian",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/fluentd-gems.json.golden b/integration/testdata/fluentd-gems.json.golden
@@ -102,7 +102,7 @@
   "Results": [
     {
       "Target": "testdata/fixtures/images/fluentd-multiple-lockfiles.tar.gz (debian 10.2)",
-      "Class": "vuln-os-pkgs",
+      "Class": "os-pkgs",
       "Type": "debian",
       "Vulnerabilities": [
         {
@@ -165,7 +165,7 @@
     },
     {
       "Target": "Ruby",
-      "Class": "vuln-lang-pkgs",
+      "Class": "lang-pkgs",
       "Type": "gemspec",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/fluentd-multiple-lockfiles-cyclonedx.json.golden b/integration/testdata/fluentd-multiple-lockfiles-cyclonedx.json.golden
@@ -3,7 +3,7 @@
   "specVersion": "1.4",
   "version": 1,
   "metadata": {
-    "timestamp": "2022-07-03T08:45:54+00:00",
+    "timestamp": "2022-08-14T12:39:11+00:00",
     "tools": [
       {
         "vendor": "aquasecurity",

diff --git a/integration/testdata/gomod.json.golden b/integration/testdata/gomod.json.golden
@@ -17,7 +17,7 @@
   "Results": [
     {
       "Target": "go.mod",
-      "Class": "vuln-lang-pkgs",
+      "Class": "lang-pkgs",
       "Type": "gomod",
       "Vulnerabilities": [
         {
@@ -103,7 +103,7 @@
     },
     {
       "Target": "submod/go.mod",
-      "Class": "vuln-lang-pkgs",
+      "Class": "lang-pkgs",
       "Type": "gomod",
       "Vulnerabilities": [
         {
@@ -131,7 +131,7 @@
     },
     {
       "Target": "submod2/go.mod",
-      "Class": "vuln-lang-pkgs",
+      "Class": "lang-pkgs",
       "Type": "gomod",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/mariner-1.0.json.golden b/integration/testdata/mariner-1.0.json.golden
@@ -34,7 +34,7 @@
   "Results": [
     {
       "Target": "testdata/fixtures/images/mariner-1.0.tar.gz (cbl-mariner 1.0.20220122)",
-      "Class": "vuln-os-pkgs",
+      "Class": "os-pkgs",
       "Type": "cbl-mariner",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/nodejs.json.golden b/integration/testdata/nodejs.json.golden
@@ -17,7 +17,7 @@
   "Results": [
     {
       "Target": "package-lock.json",
-      "Class": "vuln-lang-pkgs",
+      "Class": "lang-pkgs",
       "Type": "npm",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/opensuse-leap-151.json.golden b/integration/testdata/opensuse-leap-151.json.golden
@@ -57,7 +57,7 @@
   "Results": [
     {
       "Target": "testdata/fixtures/images/opensuse-leap-151.tar.gz (opensuse.leap 15.1)",
-      "Class": "vuln-os-pkgs",
+      "Class": "os-pkgs",
       "Type": "opensuse.leap",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/oraclelinux-8.json.golden b/integration/testdata/oraclelinux-8.json.golden
@@ -58,7 +58,7 @@
   "Results": [
     {
       "Target": "testdata/fixtures/images/oraclelinux-8.tar.gz (oracle 8.0)",
-      "Class": "vuln-os-pkgs",
+      "Class": "os-pkgs",
       "Type": "oracle",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/photon-30.json.golden b/integration/testdata/photon-30.json.golden
@@ -59,7 +59,7 @@
   "Results": [
     {
       "Target": "testdata/fixtures/images/photon-30.tar.gz (photon 3.0)",
-      "Class": "vuln-os-pkgs",
+      "Class": "os-pkgs",
       "Type": "photon",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/pip.json.golden b/integration/testdata/pip.json.golden
@@ -55,12 +55,7 @@
           "Version": "2.0.0",
           "Layer": {}
         }
-      ]
-    },
-    {
-      "Target": "requirements.txt",
-      "Class": "vuln-lang-pkgs",
-      "Type": "pip",
+      ],
       "Vulnerabilities": [
         {
           "VulnerabilityID": "CVE-2019-14806",

diff --git a/integration/testdata/pnpm.json.golden b/integration/testdata/pnpm.json.golden
@@ -2,10 +2,22 @@
   "SchemaVersion": 2,
   "ArtifactName": "testdata/fixtures/fs/pnpm",
   "ArtifactType": "filesystem",
+  "Metadata": {
+    "ImageConfig": {
+      "architecture": "",
+      "created": "0001-01-01T00:00:00Z",
+      "os": "",
+      "rootfs": {
+        "type": "",
+        "diff_ids": null
+      },
+      "config": {}
+    }
+  },
   "Results": [
     {
       "Target": "pnpm-lock.yaml",
-      "Class": "vuln-lang-pkgs",
+      "Class": "lang-pkgs",
       "Type": "pnpm",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/pom.json.golden b/integration/testdata/pom.json.golden
@@ -17,7 +17,7 @@
   "Results": [
     {
       "Target": "pom.xml",
-      "Class": "vuln-lang-pkgs",
+      "Class": "lang-pkgs",
       "Type": "pom",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/rockylinux-8.json.golden b/integration/testdata/rockylinux-8.json.golden
@@ -48,7 +48,7 @@
   "Results": [
     {
       "Target": "testdata/fixtures/images/rockylinux-8.tar.gz (rocky 8.5)",
-      "Class": "vuln-os-pkgs",
+      "Class": "os-pkgs",
       "Type": "rocky",
       "Vulnerabilities": [
         {

diff --git a/integration/testdata/spring4shell-jre11.json.golden b/integration/testdata/spring4shell-jre11.json.golden
@@ -185,12 +185,12 @@
   "Results": [
     {
       "Target": "testdata/fixtures/images/spring4shell-jre11.tar.gz (debian 11.3)",
-      "Class": "vuln-os-pkgs",
+      "Class": "os-pkgs",
       "Type": "debian"
     },
     {
       "Target": "Java",
-      "Class": "vuln-lang-pkgs",
+      "Class": "lang-pkgs",
       "Type": "jar",
       "Vulnerabilities": [
         {