Use vdr bom as basis for jinja reports #189
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
cerrussell
requested changes
Dec 19, 2023
depscan/lib/utils.py
Outdated
| with open(vdr_file, "r", encoding="utf-8") as f: | ||
| bom = json.load(f) | ||
| else: | ||
| bom = None |
There was a problem hiding this comment.
@heubeck Here you could fall back to loading the bom_file - just add the same thing you have for vdr_file in the else block.
There was a problem hiding this comment.
great idea, thx. will do that
depscan/lib/utils.py
Outdated
| with open(template_file, "r", encoding="utf-8") as tmpl_file: | ||
| template = tmpl_file.read() | ||
| jinja_env = Environment(autoescape=False) | ||
| jinja_tmpl = jinja_env.from_string(template) | ||
| report_result = jinja_tmpl.render( | ||
| vulnerabilities=json_report, | ||
| metadata=bom['metadata'] if bom else None, |
There was a problem hiding this comment.
@heubeck I suggest doing this using the dictionary get method (e.g. bom.get('metadata', None)) and check for bom separately (or load the data from bom_file). If you think using the bom_file as a fallback seems reasonable, you'd definitely want to do this as the regular bom file will not include the vulnerabilities key.
report_result = jinja_tmpl.render(
metadata=bom.get('metadata', None),
vulnerabilities=bom.get('vulnerabilities', None),
components=bom.get('components', None),... and so on
heubeck
force-pushed
the
custom-report-based-on-vdr
branch
from
a054567
to
a3bf21b
Compare
Signed-off-by: Florian Heubeck <heubeck@mediamarktsaturn.com>
heubeck
force-pushed
the
custom-report-based-on-vdr
branch
from
a3bf21b
to
cf73c25
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
That's effectively a breaking change, but the adoption of that feature might be quite low so far.