-
Notifications
You must be signed in to change notification settings - Fork 2.2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: add Package.resolved swift files support (#4932)
* add Package.resolved files analyzer * add Swift detector and integration test * refactor after go-dep-parser changes * bump go-dep-parser * remove replaces * use filePath for Required func * add ID field
- Loading branch information
1 parent
ec5d8be
commit ef70d20
Showing
16 changed files
with
330 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -73,6 +73,7 @@ jobs: | |
| c\+\+ | ||
| elixir | ||
| dart | ||
| swift | ||
| os | ||
| lang | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| - bucket: "swift::GitHub Security Advisory Swift" | ||
| pairs: | ||
| - bucket: github.com/apple/swift-nio | ||
| pairs: | ||
| - key: CVE-2022-3215 | ||
| value: | ||
| PatchedVersions: | ||
| - "2.29.1" | ||
| - "2.39.1" | ||
| - "2.42.0" | ||
| VulnerableVersions: | ||
| - "< 2.29.1" | ||
| - ">= 2.39.0, < 2.39.1" | ||
| - ">= 2.41.0, < 2.42.0" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| { | ||
| "object": { | ||
| "pins": [ | ||
| { | ||
| "package": "swift-atomics", | ||
| "repositoryURL": "https://github.com/apple/swift-atomics.git", | ||
| "state": { | ||
| "branch": null, | ||
| "revision": "6c89474e62719ddcc1e9614989fff2f68208fe10", | ||
| "version": "1.1.0" | ||
| } | ||
| }, | ||
| { | ||
| "package": "swift-nio", | ||
| "repositoryURL": "https://github.com/apple/swift-nio", | ||
| "state": { | ||
| "branch": null, | ||
| "revision": "ece5057615d1bee848341eceafdf04ca54d60177", | ||
| "version": "2.41.0" | ||
| } | ||
| } | ||
| ] | ||
| }, | ||
| "version": 1 | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,79 @@ | ||
| { | ||
| "SchemaVersion": 2, | ||
| "ArtifactName": "testdata/fixtures/repo/swift", | ||
| "ArtifactType": "repository", | ||
| "Metadata": { | ||
| "ImageConfig": { | ||
| "architecture": "", | ||
| "created": "0001-01-01T00:00:00Z", | ||
| "os": "", | ||
| "rootfs": { | ||
| "type": "", | ||
| "diff_ids": null | ||
| }, | ||
| "config": {} | ||
| } | ||
| }, | ||
| "Results": [ | ||
| { | ||
| "Target": "Package.resolved", | ||
| "Class": "lang-pkgs", | ||
| "Type": "swift", | ||
| "Packages": [ | ||
| { | ||
| "ID": "github.com/apple/swift-atomics@1.1.0", | ||
| "Name": "github.com/apple/swift-atomics", | ||
| "Version": "1.1.0", | ||
| "Layer": {}, | ||
| "Locations": [ | ||
| { | ||
| "StartLine": 4, | ||
| "EndLine": 12 | ||
| } | ||
| ] | ||
| }, | ||
| { | ||
| "ID": "github.com/apple/swift-nio@2.41.0", | ||
| "Name": "github.com/apple/swift-nio", | ||
| "Version": "2.41.0", | ||
| "Layer": {}, | ||
| "Locations": [ | ||
| { | ||
| "StartLine": 13, | ||
| "EndLine": 21 | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "Vulnerabilities": [ | ||
| { | ||
| "VulnerabilityID": "CVE-2022-3215", | ||
| "PkgID": "github.com/apple/swift-nio@2.41.0", | ||
| "PkgName": "github.com/apple/swift-nio", | ||
| "InstalledVersion": "2.41.0", | ||
| "FixedVersion": "2.29.1, 2.39.1, 2.42.0", | ||
| "Status": "fixed", | ||
| "Layer": {}, | ||
| "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-3215", | ||
| "Title": "SwiftNIO vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')", | ||
| "Description": "`NIOHTTP1` and projects using it for generating HTTP responses, including SwiftNIO, can be subject to a HTTP Response Injection attack...", | ||
| "Severity": "MEDIUM", | ||
| "CVSS": { | ||
| "ghsa": { | ||
| "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", | ||
| "V3Score": 5.3 | ||
| } | ||
| }, | ||
| "References": [ | ||
| "https://github.com/apple/swift-nio/security/advisories/GHSA-7fj7-39wj-c64f", | ||
| "https://nvd.nist.gov/vuln/detail/CVE-2022-3215", | ||
| "https://github.com/apple/swift-nio/commit/a16e2f54a25b2af217044e5168997009a505930f", | ||
| "https://github.com/advisories/GHSA-7fj7-39wj-c64f" | ||
| ], | ||
| "PublishedDate": "2023-06-07T16:01:53Z", | ||
| "LastModifiedDate": "2023-06-19T16:45:07Z" | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| package swift | ||
|
|
||
| import ( | ||
| "context" | ||
| "os" | ||
| "path" | ||
|
|
||
| "github.com/aquasecurity/go-dep-parser/pkg/swift/swift" | ||
| "github.com/aquasecurity/trivy/pkg/fanal/analyzer" | ||
| "github.com/aquasecurity/trivy/pkg/fanal/analyzer/language" | ||
| "github.com/aquasecurity/trivy/pkg/fanal/types" | ||
|
|
||
| "golang.org/x/xerrors" | ||
| ) | ||
|
|
||
| func init() { | ||
| analyzer.RegisterAnalyzer(&swiftLockAnalyzer{}) | ||
| } | ||
|
|
||
| const ( | ||
| version = 1 | ||
| ) | ||
|
|
||
| // swiftLockAnalyzer analyzes Package.resolved files | ||
| type swiftLockAnalyzer struct{} | ||
|
|
||
| func (a swiftLockAnalyzer) Analyze(_ context.Context, input analyzer.AnalysisInput) (*analyzer.AnalysisResult, error) { | ||
| p := swift.NewParser() | ||
| res, err := language.Analyze(types.Swift, input.FilePath, input.Content, p) | ||
| if err != nil { | ||
| return nil, xerrors.Errorf("%s parse error: %w", input.FilePath, err) | ||
| } | ||
| return res, nil | ||
| } | ||
|
|
||
| func (a swiftLockAnalyzer) Required(filePath string, _ os.FileInfo) bool { | ||
| return path.Base(filePath) == types.SwiftResolved | ||
| } | ||
|
|
||
| func (a swiftLockAnalyzer) Type() analyzer.Type { | ||
| return analyzer.TypeSwift | ||
| } | ||
|
|
||
| func (a swiftLockAnalyzer) Version() int { | ||
| return version | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,88 @@ | ||
| package swift | ||
|
|
||
| import ( | ||
| "github.com/aquasecurity/trivy/pkg/fanal/analyzer" | ||
| "github.com/aquasecurity/trivy/pkg/fanal/types" | ||
| "github.com/stretchr/testify/assert" | ||
| "github.com/stretchr/testify/require" | ||
| "os" | ||
| "testing" | ||
| ) | ||
|
|
||
| func Test_swiftLockAnalyzer_Analyze(t *testing.T) { | ||
| tests := []struct { | ||
| name string | ||
| inputFile string | ||
| want *analyzer.AnalysisResult | ||
| }{ | ||
| { | ||
| name: "happy path", | ||
| inputFile: "testdata/happy/Package.resolved", | ||
| want: &analyzer.AnalysisResult{ | ||
| Applications: []types.Application{ | ||
| { | ||
| Type: types.Swift, | ||
| FilePath: "testdata/happy/Package.resolved", | ||
| Libraries: types.Packages{ | ||
|
|
||
| { | ||
| ID: "github.com/Quick/Nimble@9.2.1", | ||
| Name: "github.com/Quick/Nimble", | ||
| Version: "9.2.1", | ||
| Locations: []types.Location{ | ||
| { | ||
| StartLine: 4, | ||
| EndLine: 12, | ||
| }, | ||
| }, | ||
| }, | ||
| { | ||
| ID: "github.com/Quick/Quick@7.0.0", | ||
| Name: "github.com/Quick/Quick", | ||
| Version: "7.0.0", | ||
| Locations: []types.Location{ | ||
| { | ||
| StartLine: 13, | ||
| EndLine: 21, | ||
| }, | ||
| }, | ||
| }, | ||
| { | ||
| ID: "github.com/ReactiveCocoa/ReactiveSwift@7.1.1", | ||
| Name: "github.com/ReactiveCocoa/ReactiveSwift", | ||
| Version: "7.1.1", | ||
| Locations: []types.Location{ | ||
| { | ||
| StartLine: 22, | ||
| EndLine: 30, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| { | ||
| name: "empty file", | ||
| inputFile: "testdata/empty/Package.resolved", | ||
| }, | ||
| } | ||
|
|
||
| for _, tt := range tests { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| f, err := os.Open(tt.inputFile) | ||
| require.NoError(t, err) | ||
| defer f.Close() | ||
|
|
||
| a := swiftLockAnalyzer{} | ||
| got, err := a.Analyze(nil, analyzer.AnalysisInput{ | ||
| FilePath: tt.inputFile, | ||
| Content: f, | ||
| }) | ||
|
|
||
| assert.NoError(t, err) | ||
| assert.Equal(t, tt.want, got) | ||
| }) | ||
| } | ||
| } |
1 change: 1 addition & 0 deletions
1
pkg/fanal/analyzer/language/swift/swift/testdata/empty/Package.resolved
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| {} |
Oops, something went wrong.