Skip to content

Commit f40cc80

Browse files
MaineK00nMaineK00n
committed
fix(contrib/trivy): fix convert for src package
1 parent ea84385 commit f40cc80

File tree

3 files changed

+239
-23
lines changed

3 files changed

+239
-23
lines changed

‎contrib/trivy/parser/v2/parser_test.go

Lines changed: 194 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,10 @@ func TestParse(t *testing.T) {
2626
vulnJSON: osAndLibTrivy,
2727
expected: osAndLibSR,
2828
},
29+
"image alma": {
30+
vulnJSON: almaTrivy,
31+
expected: almaSR,
32+
},
2933
}
3034

3135
for testcase, v := range cases {
@@ -257,6 +261,16 @@ var redisSR = &models.ScanResult{
257261
},
258262
},
259263
SrcPackages: models.SrcPackages{
264+
"apt": models.SrcPackage{
265+
Name: "apt",
266+
Version: "1.8.2.3",
267+
BinaryNames: []string{"apt"},
268+
},
269+
"adduser": models.SrcPackage{
270+
Name: "adduser",
271+
Version: "3.118",
272+
BinaryNames: []string{"adduser"},
273+
},
260274
"util-linux": models.SrcPackage{
261275
Name: "util-linux",
262276
Version: "2.33.1-0.1",
@@ -525,10 +539,35 @@ var osAndLibTrivy = []byte(`
525539
"Type": "debian",
526540
"Packages": [
527541
{
542+
"ID": "[email protected]",
528543
"Name": "libgnutls30",
529-
"Version": "3.6.7-4",
544+
"Version": "3.6.7",
545+
"Release": "4",
546+
"Arch": "amd64",
530547
"SrcName": "gnutls28",
531-
"SrcVersion": "3.6.7-4",
548+
"SrcVersion": "3.6.7",
549+
"SrcRelease": "4",
550+
"Licenses": [
551+
"LGPL-3.0",
552+
"GPL-3.0",
553+
"GFDL-1.3",
554+
"CC0",
555+
"The MIT License",
556+
"LGPLv3+",
557+
"GPL-2.0",
558+
"Apache-2.0"
559+
],
560+
"Maintainer": "Debian GnuTLS Maintainers \[email protected]\u003e",
561+
"DependsOn": [
562+
"[email protected]",
563+
"libgmp10@2:6.1.2+dfsg-4",
564+
"[email protected]",
565+
"[email protected]",
566+
"[email protected]",
567+
"[email protected]",
568+
"[email protected]",
569+
"[email protected]"
570+
],
532571
"Layer": {
533572
"Digest": "sha256:000eee12ec04cc914bf96e8f5dee7767510c2aca3816af6078bd9fbe3150920c",
534573
"DiffID": "sha256:831c5620387fb9efec59fc82a42b948546c6be601e3ab34a87108ecf852aa15f"
@@ -538,15 +577,22 @@ var osAndLibTrivy = []byte(`
538577
"Vulnerabilities": [
539578
{
540579
"VulnerabilityID": "CVE-2021-20231",
580+
"PkgID": "[email protected]",
541581
"PkgName": "libgnutls30",
542582
"InstalledVersion": "3.6.7-4",
543583
"FixedVersion": "3.6.7-4+deb10u7",
584+
"Status": "fixed",
544585
"Layer": {
545586
"Digest": "sha256:000eee12ec04cc914bf96e8f5dee7767510c2aca3816af6078bd9fbe3150920c",
546587
"DiffID": "sha256:831c5620387fb9efec59fc82a42b948546c6be601e3ab34a87108ecf852aa15f"
547588
},
548589
"SeveritySource": "nvd",
549590
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-20231",
591+
"DataSource": {
592+
"ID": "debian",
593+
"Name": "Debian Security Tracker",
594+
"URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
595+
},
550596
"Title": "gnutls: Use after free in client key_share extension",
551597
"Description": "A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequences.",
552598
"Severity": "CRITICAL",
@@ -712,6 +758,7 @@ var osAndLibSR = &models.ScanResult{
712758
"libgnutls30": models.Package{
713759
Name: "libgnutls30",
714760
Version: "3.6.7-4",
761+
Arch: "amd64",
715762
},
716763
},
717764
SrcPackages: models.SrcPackages{
@@ -727,6 +774,151 @@ var osAndLibSR = &models.ScanResult{
727774
},
728775
}
729776

777+
var almaTrivy = []byte(`
778+
{
779+
"SchemaVersion": 2,
780+
"CreatedAt": "2024-02-01T04:48:35.451128019+09:00",
781+
"ArtifactName": "almalinux:9",
782+
"ArtifactType": "container_image",
783+
"Metadata": {
784+
"OS": {
785+
"Family": "alma",
786+
"Name": "9.1"
787+
},
788+
"ImageID": "sha256:6fda3265debce36565356d0e5f9f2403c751da40f8a2538d76dfcb934661b427",
789+
"DiffIDs": [
790+
"sha256:f025ce333a9dc974e0ec5ff9440cc0b7404a3277b5bff4ca3d45bc10313f845b"
791+
],
792+
"RepoTags": [
793+
"almalinux:9"
794+
],
795+
"RepoDigests": [
796+
"almalinux@sha256:904f3b03a151a7970255158103578de658ca955045b9cd6b78a9ea7d13a596ef"
797+
],
798+
"ImageConfig": {
799+
"architecture": "amd64",
800+
"container": "0711a01b461394b83799a4125a9a6490052f74a5fafb084c72abcc09b01703d5",
801+
"created": "2023-02-22T18:20:30.49146312Z",
802+
"docker_version": "20.10.23",
803+
"history": [
804+
{
805+
"created": "2023-02-22T18:20:29Z",
806+
"created_by": "/bin/sh -c #(nop) ADD file:97cfcd4d2e9fb628ab2192a2c99ea93dc2b97c852191d6dda024a33def36ff98 in / "
807+
},
808+
{
809+
"created": "2023-02-22T18:20:30Z",
810+
"created_by": "/bin/sh -c #(nop) CMD [\"/bin/bash\"]",
811+
"empty_layer": true
812+
}
813+
],
814+
"os": "linux",
815+
"rootfs": {
816+
"type": "layers",
817+
"diff_ids": [
818+
"sha256:f025ce333a9dc974e0ec5ff9440cc0b7404a3277b5bff4ca3d45bc10313f845b"
819+
]
820+
},
821+
"config": {
822+
"Cmd": [
823+
"/bin/bash"
824+
],
825+
"Env": [
826+
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
827+
],
828+
"Image": "sha256:721f6c57a6da1faf2745fe501a3940bd4597d0936f994b76a9f19fb8035b7372"
829+
}
830+
}
831+
},
832+
"Results": [
833+
{
834+
"Target": "almalinux:9 (alma 9.1)",
835+
"Class": "os-pkgs",
836+
"Type": "alma",
837+
"Packages": [
838+
{
839+
"ID": "[email protected]_64",
840+
"Name": "acl",
841+
"Version": "2.3.1",
842+
"Release": "3.el9",
843+
"Arch": "x86_64",
844+
"SrcName": "acl",
845+
"SrcVersion": "2.3.1",
846+
"SrcRelease": "3.el9",
847+
"Licenses": [
848+
"GPLv2+"
849+
],
850+
"Maintainer": "AlmaLinux",
851+
"DependsOn": [
852+
"[email protected]_1.1.x86_64",
853+
"[email protected]_64"
854+
],
855+
"Layer": {
856+
"DiffID": "sha256:f025ce333a9dc974e0ec5ff9440cc0b7404a3277b5bff4ca3d45bc10313f845b"
857+
},
858+
"Digest": "md5:30ed35fe284aa1ffee4fc8cf082ab6fa",
859+
"InstalledFiles": [
860+
"/usr/bin/chacl",
861+
"/usr/bin/getfacl",
862+
"/usr/bin/setfacl",
863+
"/usr/lib/.build-id",
864+
"/usr/lib/.build-id/5a",
865+
"/usr/lib/.build-id/5a/d6848c63ed1dcb59a88e8ed5b3f936b6561d03",
866+
"/usr/lib/.build-id/88",
867+
"/usr/lib/.build-id/88/95863a5e92751dbb37a43dd2939511a9f3d9b5",
868+
"/usr/lib/.build-id/e6",
869+
"/usr/lib/.build-id/e6/f27b5253f5ffb6b5398896c720a4cbc108efe8",
870+
"/usr/share/licenses/acl",
871+
"/usr/share/licenses/acl/COPYING",
872+
"/usr/share/licenses/acl/COPYING.LGPL",
873+
"/usr/share/locale/de/LC_MESSAGES/acl.mo",
874+
"/usr/share/locale/en@boldquot/LC_MESSAGES/acl.mo",
875+
"/usr/share/locale/en@quot/LC_MESSAGES/acl.mo",
876+
"/usr/share/locale/es/LC_MESSAGES/acl.mo",
877+
"/usr/share/locale/fr/LC_MESSAGES/acl.mo",
878+
"/usr/share/locale/gl/LC_MESSAGES/acl.mo",
879+
"/usr/share/locale/pl/LC_MESSAGES/acl.mo",
880+
"/usr/share/locale/sv/LC_MESSAGES/acl.mo",
881+
"/usr/share/man/man1/chacl.1.gz",
882+
"/usr/share/man/man1/getfacl.1.gz",
883+
"/usr/share/man/man1/setfacl.1.gz",
884+
"/usr/share/man/man5/acl.5.gz"
885+
]
886+
}
887+
]
888+
}
889+
]
890+
}`)
891+
892+
var almaSR = &models.ScanResult{
893+
JSONVersion: 4,
894+
ServerName: "almalinux:9",
895+
Family: "alma",
896+
Release: "9.1",
897+
ScannedBy: "trivy",
898+
ScannedVia: "trivy",
899+
ScannedCves: models.VulnInfos{},
900+
LibraryScanners: models.LibraryScanners{},
901+
Packages: models.Packages{
902+
"acl": models.Package{
903+
Name: "acl",
904+
Version: "2.3.1",
905+
Release: "3.el9",
906+
Arch: "x86_64",
907+
},
908+
},
909+
SrcPackages: models.SrcPackages{
910+
"acl": models.SrcPackage{
911+
Name: "acl",
912+
Version: "2.3.1-3.el9",
913+
BinaryNames: []string{"acl"},
914+
},
915+
},
916+
Optional: map[string]interface{}{
917+
"TRIVY_IMAGE_NAME": "almalinux",
918+
"TRIVY_IMAGE_TAG": "9",
919+
},
920+
}
921+
730922
func TestParseError(t *testing.T) {
731923
cases := map[string]struct {
732924
vulnJSON []byte

‎contrib/trivy/pkg/converter.go

Lines changed: 41 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package pkg
22

33
import (
4+
"fmt"
45
"sort"
56
"time"
67

@@ -111,22 +112,49 @@ func Convert(results types.Results) (result *models.ScanResult, err error) {
111112
// --list-all-pkgs flg of trivy will output all installed packages, so collect them.
112113
if trivyResult.Class == types.ClassOSPkg {
113114
for _, p := range trivyResult.Packages {
114-
pkgs[p.Name] = models.Package{
115-
Name: p.Name,
116-
Version: p.Version,
115+
switch trivyResult.Type {
116+
case os.Debian, os.Ubuntu:
117+
pv := p.Version
118+
if p.Release != "" {
119+
pv = fmt.Sprintf("%s-%s", pv, p.Release)
120+
}
121+
if p.Epoch > 0 {
122+
pv = fmt.Sprintf("%d:%s", p.Epoch, pv)
123+
}
124+
pkgs[p.Name] = models.Package{
125+
Name: p.Name,
126+
Version: pv,
127+
Arch: p.Arch,
128+
}
129+
default:
130+
pv := p.Version
131+
if p.Epoch > 0 {
132+
pv = fmt.Sprintf("%d:%s", p.Epoch, pv)
133+
}
134+
pkgs[p.Name] = models.Package{
135+
Name: p.Name,
136+
Version: pv,
137+
Release: p.Release,
138+
Arch: p.Arch,
139+
}
117140
}
118-
if p.Name != p.SrcName {
119-
if v, ok := srcPkgs[p.SrcName]; !ok {
120-
srcPkgs[p.SrcName] = models.SrcPackage{
121-
Name: p.SrcName,
122-
Version: p.SrcVersion,
123-
BinaryNames: []string{p.Name},
124-
}
125-
} else {
126-
v.AddBinaryName(p.Name)
127-
srcPkgs[p.SrcName] = v
141+
142+
v, ok := srcPkgs[p.SrcName]
143+
if !ok {
144+
sv := p.SrcVersion
145+
if p.SrcRelease != "" {
146+
sv = fmt.Sprintf("%s-%s", sv, p.SrcRelease)
147+
}
148+
if p.SrcEpoch > 0 {
149+
sv = fmt.Sprintf("%d:%s", p.SrcEpoch, sv)
150+
}
151+
v = models.SrcPackage{
152+
Name: p.SrcName,
153+
Version: sv,
128154
}
129155
}
156+
v.AddBinaryName(p.Name)
157+
srcPkgs[p.SrcName] = v
130158
}
131159
} else if trivyResult.Class == types.ClassLangPkg {
132160
libScanner := uniqueLibraryScannerPaths[trivyResult.Target]

‎models/packages.go

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import (
66
"regexp"
77
"strings"
88

9+
"golang.org/x/exp/slices"
910
"golang.org/x/xerrors"
1011
)
1112

@@ -234,15 +235,10 @@ type SrcPackage struct {
234235

235236
// AddBinaryName add the name if not exists
236237
func (s *SrcPackage) AddBinaryName(name string) {
237-
found := false
238-
for _, n := range s.BinaryNames {
239-
if n == name {
240-
return
241-
}
242-
}
243-
if !found {
244-
s.BinaryNames = append(s.BinaryNames, name)
238+
if slices.Contains(s.BinaryNames, name) {
239+
return
245240
}
241+
s.BinaryNames = append(s.BinaryNames, name)
246242
}
247243

248244
// SrcPackages is Map of SrcPackage

0 commit comments

Comments
 (0)