Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Explicitly ignore certain PYSECs #245

Closed
Elkasitu opened this issue Mar 2, 2022 · 2 comments · Fixed by #275
Closed

Explicitly ignore certain PYSECs #245

Elkasitu opened this issue Mar 2, 2022 · 2 comments · Fixed by #275
Labels
component:cli CLI components enhancement New feature or request

Comments

@Elkasitu
Copy link
Contributor

Elkasitu commented Mar 2, 2022

Is your feature request related to a problem? Please describe.

Certain libraries have unfixed PYSECs that are acknowledged yet not a problem in certain scenarios.

For example, there is PYSEC-2017-49 for the kerberos library, however the function impacted by said PYSEC is already documented to be dangerous by the lib maintainers, and essentially if your application doesn't use said function it's not impacted.

Describe the solution you'd like

A flag like --ignore and/or a config file wherein PYSECs to be ignored can be defined, akin to how pylint and flake8 do it, this would allow people to more easily integrate the tool with CI/CD pipelines as any detected vulnerability currently triggers a non-zero exit-code

Describe alternatives you've considered

None

Additional context

None
@Elkasitu Elkasitu added the enhancement New feature or request label Mar 2, 2022
@di
Copy link
Sponsor Member

di commented Mar 2, 2022

Thanks for the issue! See also #209. This may be a better approach than just ignoring entire projects.

@woodruffw woodruffw added the component:cli CLI components label Mar 2, 2022
@Elkasitu
Copy link
Contributor Author

Elkasitu commented Mar 2, 2022

@di actually I think both issues are valid, I checked #209 before writing this issue because #209 also applies to us as we have in-house libraries that we don't deploy to PyPI or any other public repository, and for which there will never be any public advisories.

Elkasitu pushed a commit to Elkasitu/pip-audit that referenced this issue May 10, 2022
cli: allow ignoring specific PYSEC ids
ad15d39 
This commit introduces a new flag to pip-audit's CLI (--ignore-vuln)
that takes a string representing a PYSEC id, if any of the packages
scanned detect said vulnerability, it will be ignored in the final
report.

This allows users of pip-audit to ignore certain vulnerabilities that
they may deem not exploitable for whatever reason.

The flag can be used multiple times to ignore multiple PYSEC ids.

Closes pypa#245
Elkasitu pushed a commit to Elkasitu/pip-audit that referenced this issue May 10, 2022
cli: allow ignoring specific PYSEC ids
87033a0 
This commit introduces a new flag to pip-audit's CLI (--ignore-vuln)
that takes a string representing a PYSEC id, if any of the packages
scanned detect said vulnerability, it will be ignored in the final
report.

This allows users of pip-audit to ignore certain vulnerabilities that
they may deem not exploitable for whatever reason.

The flag can be used multiple times to ignore multiple PYSEC ids.

Closes pypa#245
@Elkasitu Elkasitu mentioned this issue May 10, 2022
Merged
Elkasitu pushed a commit to Elkasitu/pip-audit that referenced this issue May 10, 2022
cli: allow ignoring specific PYSEC ids
43d3821 
This commit introduces a new flag to pip-audit's CLI (--ignore-vuln)
that takes a string representing a PYSEC id, if any of the packages
scanned detect said vulnerability, it will be ignored in the final
report.

This allows users of pip-audit to ignore certain vulnerabilities that
they may deem not exploitable for whatever reason.

The flag can be used multiple times to ignore multiple PYSEC ids.

Closes pypa#245
Elkasitu pushed a commit to Elkasitu/pip-audit that referenced this issue May 10, 2022
cli: allow ignoring specific vulnerability IDs
05680f8 
This commit introduces a new flag to pip-audit's CLI (--ignore-vuln)
that takes a string representing a vulnerability id, if any of the
packages scanned detect said vulnerability, it will be ignored in the
final report.

This allows users of pip-audit to ignore certain vulnerabilities that
they may deem not exploitable for whatever reason.

The flag can be used multiple times to ignore multiple vulnerabilities.

Closes pypa#245
Elkasitu pushed a commit to Elkasitu/pip-audit that referenced this issue May 10, 2022
cli: allow ignoring specific vulnerability IDs
27c2574 
This commit introduces a new flag to pip-audit's CLI (--ignore-vuln)
that takes a string representing a vulnerability id, if any of the
packages scanned detect said vulnerability, it will be ignored in the
final report.

This allows users of pip-audit to ignore certain vulnerabilities that
they may deem not exploitable for whatever reason.

The flag can be used multiple times to ignore multiple vulnerabilities.

Closes pypa#245
Elkasitu pushed a commit to Elkasitu/pip-audit that referenced this issue May 12, 2022
cli: allow ignoring specific vulnerability IDs
4690869 
This commit introduces a new flag to pip-audit's CLI (--ignore-vuln)
that takes a string representing a vulnerability id, if any of the
packages scanned detect said vulnerability, it will be ignored in the
final report.

This allows users of pip-audit to ignore certain vulnerabilities that
they may deem not exploitable for whatever reason.

The flag can be used multiple times to ignore multiple vulnerabilities.

Closes pypa#245
Elkasitu pushed a commit to Elkasitu/pip-audit that referenced this issue May 12, 2022
cli: allow ignoring specific vulnerability IDs
d1e1782 
This commit introduces a new flag to pip-audit's CLI (--ignore-vuln)
that takes a string representing a vulnerability id, if any of the
packages scanned detect said vulnerability, it will be ignored in the
final report.

This allows users of pip-audit to ignore certain vulnerabilities that
they may deem not exploitable for whatever reason.

The flag can be used multiple times to ignore multiple vulnerabilities.

Closes pypa#245
Elkasitu pushed a commit to Elkasitu/pip-audit that referenced this issue May 12, 2022
cli: allow ignoring specific vulnerability IDs
38ef697 
This commit introduces a new flag to pip-audit's CLI (--ignore-vuln)
that takes a string representing a vulnerability id, if any of the
packages scanned detect said vulnerability, it will be ignored in the
final report.

This allows users of pip-audit to ignore certain vulnerabilities that
they may deem not exploitable for whatever reason.

The flag can be used multiple times to ignore multiple vulnerabilities.

Closes pypa#245
woodruffw added a commit that referenced this issue May 12, 2022
@Elkasitu @woodruffw
cli: allow ignoring specific vulnerability IDs (#275)
1e03403 
* pip_audit: provide has_any_id API for VulnerabilityResult

This API allows developers to query whether a VulnerabilityResult
contains at least one of the vulnerability IDs passed in as argument
either as its ID or as one of the aliases.

This method will return True if the vulnerability IDs passed in as
argument intersect with the VulnerabilityResult's aliases + ID, False
otherwise.

* cli: allow ignoring specific vulnerability IDs

This commit introduces a new flag to pip-audit's CLI (--ignore-vuln)
that takes a string representing a vulnerability id, if any of the
packages scanned detect said vulnerability, it will be ignored in the
final report.

This allows users of pip-audit to ignore certain vulnerabilities that
they may deem not exploitable for whatever reason.

The flag can be used multiple times to ignore multiple vulnerabilities.

Closes #245

Co-authored-by: William Woodruff <william@trailofbits.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
component:cli CLI components enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

cli: allow ignoring specific vulnerability IDs Elkasitu/pip-audit
3 participants
@di @woodruffw @Elkasitu