Skip to content

Commit d3fdcdf

Browse files
rohitkrai03rohitkrai03
authored
fix(quay): fix sorting and ordering of vulneribilities based on severity (#1033)
* fix(quay): fix ordering of vulneribilities based on severity * fix(quay): fix list page sorting of vulnerabilities based on severity
1 parent 0f6799b commit d3fdcdf

File tree

6 files changed

+249
-25
lines changed

6 files changed

+249
-25
lines changed

‎plugins/quay/src/components/QuayRepository/tableHeading.tsx

Lines changed: 1 addition & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -5,27 +5,9 @@ import { Link, Progress, TableColumn } from '@backstage/core-components';
55
import { Tooltip } from '@material-ui/core';
66
import makeStyles from '@material-ui/core/styles/makeStyles';
77

8+
import { vulnerabilitySummary } from '../../lib/utils';
89
import type { Layer } from '../../types';
910

10-
const vulnerabilitySummary = (layer: Layer): string => {
11-
const summary: Record<string, number> = {};
12-
13-
layer?.Features.forEach(feature => {
14-
feature.Vulnerabilities?.forEach(vulnerability => {
15-
const { Severity } = vulnerability;
16-
if (!summary[Severity]) {
17-
summary[Severity] = 0;
18-
}
19-
summary[Severity]++;
20-
});
21-
});
22-
23-
const scanResults = Object.entries(summary)
24-
.map(([severity, count]) => `${severity}: ${count}`)
25-
.join(', ');
26-
return scanResults.trim() !== '' ? scanResults : 'Passed';
27-
};
28-
2911
export const columns: TableColumn[] = [
3012
{
3113
title: 'Tag',

‎plugins/quay/src/components/QuayTagDetails/component.tsx

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,12 @@ import LinkIcon from '@material-ui/icons/Link';
99
import WarningIcon from '@material-ui/icons/Warning';
1010

1111
import { SEVERITY_COLORS } from '../../lib/utils';
12-
import { Layer, Vulnerability, VulnerabilityListItem } from '../../types';
12+
import {
13+
Layer,
14+
Vulnerability,
15+
VulnerabilityListItem,
16+
VulnerabilityOrder,
17+
} from '../../types';
1318

1419
type QuayTagDetailsProps = {
1520
layer: Layer;
@@ -125,7 +130,13 @@ export const QuayTagDetails = ({
125130
},
126131
);
127132
})
128-
.flat();
133+
.flat()
134+
.sort((a, b) => {
135+
const severityA = VulnerabilityOrder[a.Severity];
136+
const severityB = VulnerabilityOrder[b.Severity];
137+
138+
return severityA - severityB;
139+
});
129140

130141
return (
131142
<TableContainer>

‎plugins/quay/src/lib/utils.data.ts

Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
export const mockLayer = {
2+
Name: 'TestLayer',
3+
ParentName: 'ParentLayer',
4+
NamespaceName: 'Namespace',
5+
IndexedByVersion: 1,
6+
Features: [
7+
{
8+
Name: 'openssl-libs',
9+
VersionFormat: '',
10+
NamespaceName: '',
11+
AddedBy:
12+
'sha256:2fe2b9e85b7c384f07f3665132f448c43aa7a5a600f89b5adde70258bc22e5f2',
13+
Version: '1:1.1.1k-6.el8_5',
14+
Vulnerabilities: [
15+
{
16+
Severity: 'Medium',
17+
NamespaceName: 'RHEL8-rhel-8',
18+
Link: 'https://access.redhat.com/errata/RHSA-2022:5818 https://access.redhat.com/security/cve/CVE-2022-1292 https://access.redhat.com/security/cve/CVE-2022-2068 https://access.redhat.com/security/cve/CVE-2022-2097',
19+
FixedBy: '1:1.1.1k-7.el8_6',
20+
Description:
21+
'OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: c_rehash script allows command injection (CVE-2022-1292)\n\n* openssl: the c_rehash script allows command injection (CVE-2022-2068)\n\n* openssl: AES OCB fails to encrypt some bytes (CVE-2022-2097)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.',
22+
Name: 'RHSA-2022:5818: openssl security update (Moderate)',
23+
Metadata: {
24+
UpdatedBy: 'RHEL8-rhel-8',
25+
RepoName: 'cpe:/o:redhat:enterprise_linux:8::baseos',
26+
RepoLink: null,
27+
DistroName: 'Red Hat Enterprise Linux Server',
28+
DistroVersion: '8',
29+
NVD: {
30+
CVSSv3: {
31+
Vectors: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H',
32+
Score: 9.8,
33+
},
34+
},
35+
},
36+
},
37+
{
38+
Severity: 'High',
39+
NamespaceName: 'RHEL8-rhel-8',
40+
Link: 'https://access.redhat.com/errata/RHSA-2023:1405 https://access.redhat.com/security/cve/CVE-2022-4304 https://access.redhat.com/security/cve/CVE-2022-4450 https://access.redhat.com/security/cve/CVE-2023-0215 https://access.redhat.com/security/cve/CVE-2023-0286',
41+
FixedBy: '1:1.1.1k-9.el8_7',
42+
Description:
43+
'OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)\n\n* openssl: timing attack in RSA Decryption implementation (CVE-2022-4304)\n\n* openssl: double free after calling PEM_read_bio_ex (CVE-2022-4450)\n\n* openssl: use-after-free following BIO_new_NDEF (CVE-2023-0215)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.',
44+
Name: 'RHSA-2023:1405: openssl security update (Important)',
45+
Metadata: {
46+
UpdatedBy: 'RHEL8-rhel-8',
47+
RepoName: 'cpe:/o:redhat:enterprise_linux:8::baseos',
48+
RepoLink: null,
49+
DistroName: 'Red Hat Enterprise Linux Server',
50+
DistroVersion: '8',
51+
NVD: {
52+
CVSSv3: {
53+
Vectors: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H',
54+
Score: 7.5,
55+
},
56+
},
57+
},
58+
},
59+
{
60+
Severity: 'Low',
61+
NamespaceName: 'RHEL8-rhel-8-including-unpatched',
62+
Link: 'https://access.redhat.com/errata/RHSA-2023:7877 https://access.redhat.com/security/cve/CVE-2023-3446 https://access.redhat.com/security/cve/CVE-2023-3817 https://access.redhat.com/security/cve/CVE-2023-5678',
63+
FixedBy: '1:1.1.1k-12.el8_9',
64+
Description:
65+
'OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: Excessive time spent checking DH keys and parameters (CVE-2023-3446)\n\n* OpenSSL: Excessive time spent checking DH q parameter value (CVE-2023-3817)\n\n* openssl: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow (CVE-2023-5678)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.',
66+
Name: 'RHSA-2023:7877: openssl security update (Low)',
67+
Metadata: {
68+
UpdatedBy: 'RHEL8-rhel-8-including-unpatched',
69+
RepoName: 'cpe:/o:redhat:enterprise_linux:8::baseos',
70+
RepoLink: null,
71+
DistroName: 'Red Hat Enterprise Linux Server',
72+
DistroVersion: '8',
73+
NVD: {
74+
CVSSv3: {
75+
Vectors: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L',
76+
Score: 5.3,
77+
},
78+
},
79+
},
80+
},
81+
],
82+
},
83+
{
84+
Name: 'ncurses-base',
85+
VersionFormat: '',
86+
NamespaceName: '',
87+
AddedBy:
88+
'sha256:2fe2b9e85b7c384f07f3665132f448c43aa7a5a600f89b5adde70258bc22e5f2',
89+
Version: '6.1-9.20180224.el8',
90+
Vulnerabilities: [
91+
{
92+
Severity: 'Medium',
93+
NamespaceName: 'RHEL8-rhel-8',
94+
Link: 'https://access.redhat.com/errata/RHSA-2023:5249 https://access.redhat.com/security/cve/CVE-2023-29491',
95+
FixedBy: '0:6.1-9.20180224.el8_8.1',
96+
Description:
97+
'The ncurses (new curses) library routines are a terminal-independent method of updating character screens with reasonable optimization. The ncurses packages contain support utilities including a terminfo compiler tic, a decompiler infocmp, clear, tput, tset, and a termcap conversion tool captoinfo.\n\nSecurity Fix(es):\n\n* ncurses: Local users can trigger security-relevant memory corruption via malformed data (CVE-2023-29491)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.',
98+
Name: 'RHSA-2023:5249: ncurses security update (Moderate)',
99+
Metadata: {
100+
UpdatedBy: 'RHEL8-rhel-8',
101+
RepoName: 'cpe:/o:redhat:enterprise_linux:8::baseos',
102+
RepoLink: null,
103+
DistroName: 'Red Hat Enterprise Linux Server',
104+
DistroVersion: '8',
105+
NVD: {
106+
CVSSv3: {
107+
Vectors: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H',
108+
Score: 7.8,
109+
},
110+
},
111+
},
112+
},
113+
],
114+
},
115+
{
116+
Name: 'Feature1',
117+
VersionFormat: '1.0.0',
118+
NamespaceName: 'Namespace',
119+
AddedBy: 'Tester',
120+
Version: '1.0.0',
121+
Vulnerabilities: [
122+
{
123+
Severity: 'High',
124+
NamespaceName: 'Namespace',
125+
Link: 'https://example.com',
126+
FixedBy: 'Fixer',
127+
Description: 'Sample vulnerability',
128+
Name: 'Vuln1',
129+
Metadata: {
130+
UpdatedBy: 'Updater',
131+
RepoName: 'Repo',
132+
RepoLink: 'https://repo.example.com',
133+
DistroName: 'Ubuntu',
134+
DistroVersion: '18.04',
135+
NVD: {
136+
CVSSv3: {
137+
Vectors: 'CVSSv3 Vectors',
138+
Score: 7.5,
139+
},
140+
},
141+
},
142+
},
143+
],
144+
},
145+
{
146+
Name: 'Feature2',
147+
VersionFormat: '2.0.0',
148+
NamespaceName: 'Namespace',
149+
AddedBy: 'Tester',
150+
Version: '2.0.0',
151+
Vulnerabilities: [
152+
{
153+
Severity: 'High',
154+
NamespaceName: 'Namespace',
155+
Link: 'https://example.com',
156+
FixedBy: 'Fixer',
157+
Description: 'Another vulnerability',
158+
Name: 'Vuln2',
159+
Metadata: {
160+
UpdatedBy: 'Updater',
161+
RepoName: 'Repo',
162+
RepoLink: 'https://repo.example.com',
163+
DistroName: 'Ubuntu',
164+
DistroVersion: '20.04',
165+
NVD: {
166+
CVSSv3: {
167+
Vectors: 'CVSSv3 Vectors',
168+
Score: 5.0,
169+
},
170+
},
171+
},
172+
},
173+
],
174+
},
175+
],
176+
};

‎plugins/quay/src/lib/utils.test.ts

Lines changed: 31 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
1-
import { VulnerabilitySeverity } from '../types';
2-
import { SEVERITY_COLORS } from './utils';
1+
import { Layer, VulnerabilitySeverity } from '../types';
2+
import { SEVERITY_COLORS, vulnerabilitySummary } from './utils';
3+
import { mockLayer } from './utils.data';
34

45
describe('SEVERITY_COLORS', () => {
56
it('should return the correct hex color code', () => {
@@ -16,3 +17,31 @@ describe('SEVERITY_COLORS', () => {
1617
expect(result).toBe('#8A8D90');
1718
});
1819
});
20+
21+
describe('vulnerabilitySummary', () => {
22+
test('returns "Passed" when no vulnerabilities are present', () => {
23+
const layer: Layer = {
24+
Name: 'TestLayer',
25+
ParentName: 'ParentLayer',
26+
NamespaceName: 'Namespace',
27+
IndexedByVersion: 1,
28+
Features: [
29+
{
30+
Name: 'Feature1',
31+
VersionFormat: '1.0.0',
32+
NamespaceName: 'Namespace',
33+
AddedBy: 'Tester',
34+
Version: '1.0.0',
35+
Vulnerabilities: [],
36+
},
37+
],
38+
};
39+
40+
expect(vulnerabilitySummary(layer)).toBe('Passed');
41+
});
42+
43+
test('returns a string with vulnerability counts in the correct order', () => {
44+
const result = vulnerabilitySummary(mockLayer as Layer);
45+
expect(result).toMatch('High: 3, Medium: 2, Low: 1');
46+
});
47+
});

‎plugins/quay/src/lib/utils.ts

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
import { VulnerabilitySeverity } from '../types';
1+
import { Layer, VulnerabilityOrder, VulnerabilitySeverity } from '../types';
22

33
export const SEVERITY_COLORS = new Proxy(
44
new Map([
@@ -13,3 +13,28 @@ export const SEVERITY_COLORS = new Proxy(
1313
o.has(k) ? o.get(k) : '#8A8D90',
1414
},
1515
);
16+
17+
export const vulnerabilitySummary = (layer: Layer): string => {
18+
const summary: Record<string, number> = {};
19+
20+
layer?.Features.forEach(feature => {
21+
feature.Vulnerabilities?.forEach(vulnerability => {
22+
const { Severity } = vulnerability;
23+
if (!summary[Severity]) {
24+
summary[Severity] = 0;
25+
}
26+
summary[Severity]++;
27+
});
28+
});
29+
30+
const scanResults = Object.entries(summary)
31+
.sort((a, b) => {
32+
const severityA = VulnerabilityOrder[a[0] as VulnerabilitySeverity];
33+
const severityB = VulnerabilityOrder[b[0] as VulnerabilitySeverity];
34+
35+
return severityA - severityB;
36+
})
37+
.map(([severity, count]) => `${severity}: ${count}`)
38+
.join(', ');
39+
return scanResults.trim() !== '' ? scanResults : 'Passed';
40+
};

‎plugins/quay/src/types.ts

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,8 @@ export const VulnerabilityOrder = {
115115
[VulnerabilitySeverity.Medium]: 2,
116116
[VulnerabilitySeverity.Low]: 3,
117117
[VulnerabilitySeverity.Negligible]: 4,
118-
[VulnerabilitySeverity.Unknown]: 5,
118+
[VulnerabilitySeverity.None]: 5,
119+
[VulnerabilitySeverity.Unknown]: 6,
119120
};
120121

121122
export interface ManifestByDigestResponse {

0 commit comments

Comments
 (0)