Skip to content

CVE Allowlist should not allow empty cve. #21882

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bupd opened this issue Apr 15, 2025 · 3 comments
Open

CVE Allowlist should not allow empty cve. #21882

bupd opened this issue Apr 15, 2025 · 3 comments

Comments

@bupd
Copy link
Contributor

bupd commented Apr 15, 2025

If you are reporting a problem, please make sure the following information are provided:

Expected behavior

The cve allowlist should not allow empty names.

Actual Behaviour

The CVE Allowlist allows empty cve to be present.

Image

Steps to reproduce the problem:

  1. Navigate to configuration > security > cve allowlist > add
  2. then type any CVE or characters ksljd then press Enter.
  3. then click on ADD. see empty line as CVE.

Versions:

  • harbor version: [2.12.0]
  • docker engine version: [y.y.y]
  • docker-compose version: [z.z.z]

Additional context:

  • Harbor config files: You can get them by packaging harbor.yml and files in the same directory, including subdirectory.
  • Log files: You can get them by package the /var/log/harbor/ .
@AllForNothing
Copy link
Contributor

There used to be a validator for the CVE names, but it was removed because we could not find a suitable rule.
Most CVEs are named with CVE-XXX-XXX, but there are always exceptions. So we decided to remove the validator.
And now you can add any CVEs, even CVEs with all spaces.

@bupd
Copy link
Contributor Author

bupd commented Apr 17, 2025

CVEs with all spaces

I believe we should not allow this one. seems outrageous to me.

@stonezdj
Copy link
Contributor

Maybe we should check it should be non-empty.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

6 participants