Skip to content

ROX-29531: include advisory in output #431

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
janisz merged 7 commits into from
Dec 15, 2025
Merged

ROX-29531: include advisory in output #431

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
c9398ab
fix: wait for scanner
janisz Sep 2, 2025
dc4c6a7
Apply suggestion from @janisz
janisz Sep 2, 2025
e256c54
ROX-29531: include advisory in output
RTann May 29, 2025
724e691
update api schema to 4.8.0
RTann Jul 25, 2025
f9ebf4a
add advisory in table
janisz Sep 2, 2025
586b8fb
Merge branch 'master' into ROX-29531
janisz Nov 25, 2025
f7d4073
Merge branch 'master' into ROX-29531
janisz Dec 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18,689 changes: 12,557 additions & 6,132 deletions stackrox-container-image-scanner/api.yaml
View file
Open in desktop
Copy link
Contributor Author

@RTann RTann May 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was generated by going to <staging environment>/main/apidocs then pressing the Download button. From there, I went to https://www.geeksforgeeks.org/json-to-yaml-converter/ and copy/pasted the JSON into the converter and saved the output to this file

Copy link
Contributor Author

@RTann RTann Jul 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I also re-added the security stuff at the bottom of the file

Large diffs are not rendered by default.

6 changes: 5 additions & 1 deletion stackrox-container-image-scanner/src/main/java/com/stackrox/jenkins/plugins/data/CVE.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,8 @@ public class CVE {
private final boolean fixable;
private final String link;
private final String severity;
private final String advisory;
private final String advisoryLink;

public CVE(String packageName, String packageVersion, @Nonnull StorageEmbeddedVulnerability vulnerability) {
this(
Expand All @@ -30,7 +32,9 @@ public CVE(String packageName, String packageVersion, @Nonnull StorageEmbeddedVu
packageVersion,
!Strings.isNullOrEmpty(vulnerability.getFixedBy()),
vulnerability.getLink(),
SeverityUtil.prettySeverity(vulnerability.getSeverity())
SeverityUtil.prettySeverity(vulnerability.getSeverity()),
vulnerability.getAdvisory() != null ? vulnerability.getAdvisory().getName() : null,
vulnerability.getAdvisory() != null ? vulnerability.getAdvisory().getLink() : null
);
}
}
6 changes: 4 additions & 2 deletions ...iner-image-scanner/src/main/java/com/stackrox/jenkins/plugins/report/ReportGenerator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

public class ReportGenerator {

private static final String[] CVES_HEADER = {"COMPONENT", "VERSION", "CVE", "SEVERITY", "FIXABLE", "CVSS SCORE", "SCORE TYPE", "LINK"};
private static final String[] CVES_HEADER = {"COMPONENT", "VERSION", "CVE", "SEVERITY", "FIXABLE", "CVSS SCORE", "SCORE TYPE", "LINK", "ADVISORY", "ADVISORY LINK"};
private static final String[] VIOLATED_POLICIES_HEADER = {"POLICY", "SEVERITY", "DESCRIPTION", "VIOLATION", "REMEDIATION", "ENFORCED"};
private static final String CVES_FILENAME = "cves.csv";
private static final String POLICY_VIOLATIONS_FILENAME = "policyViolations.csv";
Expand Down Expand Up @@ -54,7 +54,9 @@ private static void generateReport(FilePath reportsDir, ImageCheckResults result
cve.isFixable(),
cve.getCvssScore(),
cve.getScoreType(),
cve.getLink()
cve.getLink(),
cve.getAdvisory(),
cve.getAdvisoryLink()
));
}
}
Expand Down
4 changes: 2 additions & 2 deletions ...r-image-scanner/src/main/java/com/stackrox/jenkins/plugins/services/ServiceException.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
import com.google.gson.JsonSyntaxException;

import com.stackrox.invoker.ApiException;
import com.stackrox.model.RuntimeError;
import com.stackrox.model.GooglerpcStatus;

public class ServiceException extends IOException {

Expand All @@ -23,7 +23,7 @@ public static ServiceException fromApiException(String ownMessage, ApiException
String responseBody = apiException.getResponseBody();
if (!Strings.isNullOrEmpty(responseBody)) {
try {
RuntimeError error = GSON.fromJson(responseBody, RuntimeError.class);
GooglerpcStatus error = GSON.fromJson(responseBody, GooglerpcStatus.class);
if (!Strings.isNullOrEmpty(error.getMessage())) {
messageBuilder.append(String.format(" Error: %s", error.getMessage()));
}
Expand Down
7 changes: 7 additions & 0 deletions stackrox-container-image-scanner/src/main/webapp/js/renderTables.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,13 @@ function renderCVETable(tableId, cves) {
}
},
{ title: 'FIXABLE', data : 'fixable' },
{ title: 'ADVISORY',mData : function (data, type, dataToSet) {
if (!data.hasOwnProperty('advisory')) {
return "-"
}
return `<a target="_blank" href="${data.advisoryLink}">${data.advisory}</a>`;
}
},
],
columnDefs: [
{
Expand Down
16 changes: 13 additions & 3 deletions ...-image-scanner/src/test/java/com/stackrox/jenkins/plugins/report/ReportGeneratorTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@
import com.stackrox.jenkins.plugins.data.CVE;
import com.stackrox.jenkins.plugins.data.ImageCheckResults;
import com.stackrox.jenkins.plugins.data.PolicyViolation;
import com.stackrox.model.StorageAdvisory;
import com.stackrox.model.StorageEmbeddedVulnerability;
import com.stackrox.model.StoragePolicy;

Expand Down Expand Up @@ -92,7 +93,10 @@ void testGenerateReportForResultsWritesReportsForEveryImageInSeparatedDirectory(
.severity(IMPORTANT_VULNERABILITY_SEVERITY)
.cvss(9.8F)
.scoreVersion(V3)
.link("https://security-tracker.debian.org/tracker/CVE-2015-5224")),
.link("https://security-tracker.debian.org/tracker/CVE-2015-5224")
.advisory(new StorageAdvisory()
.name("DSA-SOMETHING")
.link("https://advisory.com"))),
new CVE("gcc-4.8", "4.8.4-1", new StorageEmbeddedVulnerability()
.cve("CVE-2017-11671")
.severity(MODERATE_VULNERABILITY_SEVERITY)
Expand All @@ -105,7 +109,10 @@ void testGenerateReportForResultsWritesReportsForEveryImageInSeparatedDirectory(
.cvss(6.5F)
.scoreVersion(V3)
.link("https://security-tracker.debian.org/tracker/CVE-2016-3189")
.fixedBy("1.0.6-8"))
.fixedBy("1.0.6-8")
.advisory(new StorageAdvisory()
.name("DSA-SOMETHING-ELSE")
.link("https://advisory.com")))
),
ImmutableList.of(
new PolicyViolation(new StoragePolicy()
Expand All @@ -123,7 +130,10 @@ void testGenerateReportForResultsWritesReportsForEveryImageInSeparatedDirectory(
.severity(LOW_VULNERABILITY_SEVERITY)
.cvss(5.8F)
.scoreVersion(V2)
.link("https://security-tracker.debian.org/tracker/CVE-2007-6755")),
.link("https://security-tracker.debian.org/tracker/CVE-2007-6755")
.advisory(new StorageAdvisory()
.name("DSA-SOMETHING")
.link("https://advisory.com"))),
new CVE(null, null, new StorageEmbeddedVulnerability()
.cve("CVE-MISSING-DATA")
.scoreVersion(null)
Expand Down
8 changes: 4 additions & 4 deletions stackrox-container-image-scanner/src/test/resources/report/jenkins.lts/cves.csv
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
COMPONENT,VERSION,CVE,SEVERITY,FIXABLE,CVSS SCORE,SCORE TYPE,LINK
util-linux,2.25.2-6,CVE-2015-5224,IMPORTANT,false,9.8,V3,https://security-tracker.debian.org/tracker/CVE-2015-5224
gcc-4.8,4.8.4-1,CVE-2017-11671,MODERATE,false,4.0,V3,https://security-tracker.debian.org/tracker/CVE-2017-11671
bzip2,1.0.6-7,CVE-2016-3189,LOW,true,6.5,V3,https://security-tracker.debian.org/tracker/CVE-2016-3189
COMPONENT,VERSION,CVE,SEVERITY,FIXABLE,CVSS SCORE,SCORE TYPE,LINK,ADVISORY,ADVISORY LINK
util-linux,2.25.2-6,CVE-2015-5224,IMPORTANT,false,9.8,V3,https://security-tracker.debian.org/tracker/CVE-2015-5224,DSA-SOMETHING,https://advisory.com
gcc-4.8,4.8.4-1,CVE-2017-11671,MODERATE,false,4.0,V3,https://security-tracker.debian.org/tracker/CVE-2017-11671,-,-
bzip2,1.0.6-7,CVE-2016-3189,LOW,true,6.5,V3,https://security-tracker.debian.org/tracker/CVE-2016-3189,DSA-SOMETHING-ELSE,https://advisory.com
6 changes: 3 additions & 3 deletions stackrox-container-image-scanner/src/test/resources/report/nginx.latest/cves.csv
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
COMPONENT,VERSION,CVE,SEVERITY,FIXABLE,CVSS SCORE,SCORE TYPE,LINK
openssl,1.1.1d-0+deb10u7,CVE-2007-6755,LOW,false,5.8,V2,https://security-tracker.debian.org/tracker/CVE-2007-6755
-,-,CVE-MISSING-DATA,UNKNOWN,false,0.0,-,-
COMPONENT,VERSION,CVE,SEVERITY,FIXABLE,CVSS SCORE,SCORE TYPE,LINK,ADVISORY,ADVISORY LINK
openssl,1.1.1d-0+deb10u7,CVE-2007-6755,LOW,false,5.8,V2,https://security-tracker.debian.org/tracker/CVE-2007-6755,DSA-SOMETHING,https://advisory.com
-,-,CVE-MISSING-DATA,UNKNOWN,false,0.0,-,-,-,-
2 changes: 1 addition & 1 deletion ...container-image-scanner/src/test/resources/report_with_no_issues/mis-spelled.lts/cves.csv
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
COMPONENT,VERSION,CVE,SEVERITY,FIXABLE,CVSS SCORE,SCORE TYPE,LINK
COMPONENT,VERSION,CVE,SEVERITY,FIXABLE,CVSS SCORE,SCORE TYPE,LINK,ADVISORY,ADVISORY LINK