GrypeParser: added artifact name and type to report #978
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
uhafner
approved these changes
Nov 23, 2023
|
|
||
| return issueBuilder.setFileName(fileName) | ||
| .setCategory(vuln.getString(SEVERITY_TAG)) | ||
| .setPackageName(packageName) |
There was a problem hiding this comment.
Actually module names are shown as well in the UI (if they are not unique), but I am fine with using package names here.
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #978 +/- ##
=========================================
Coverage 93.08% 93.09%
- Complexity 2381 2382 +1
=========================================
Files 347 347
Lines 6598 6603 +5
Branches 686 687 +1
=========================================
+ Hits 6142 6147 +5
Misses 256 256
Partials 200 200 ☔ View full report in Codecov by Sentry. |
|
Thanks! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The warnings-ng reports for Grype are missing important information, namely the vulnerable artifact's name and its type. This makes it difficult to see the affected packages when reviewing the report as the file path often doesn't contain the artifact name (e.g. for RPMs in a Docker image the file path reported by Grype is just "/var/lib/rpm/Packages"; only the artifact name reveals the actual RPM name like curl etc.).
This PR adds the artifact name from the Grype JSON report as package name and changes the report's category to the artifact type (instead of duplicating the severity information there). I chose package over module name as the package is visible in the warnings-ng issue list while the module isn't.
Testing done
The existing JUnit test for the GrypeParser has been adjusted to also verify the package name and the changed category.
Note that due to the added package name the report in test method
assertThatVulnerabilityWithoutDescriptionCanBeParseddoesn't contain duplicates any more.Submitter checklist