From 2669f7b18792dc944f86d126f71899c0733ab5de Mon Sep 17 00:00:00 2001 From: Pedro Pereira Date: Fri, 1 Aug 2025 15:17:06 +0100 Subject: [PATCH] feature: adds new severity high pattern CF-1779 --- .circleci/config.yml | 2 +- docs/description/vulnerability.md | 4 +- docs/description/vulnerability_high.md | 2 + docs/multiple-tests/all-patterns/patterns.xml | 1 + docs/multiple-tests/all-patterns/results.xml | 4 +- .../pattern-vulnerability-high/patterns.xml | 4 + .../pattern-vulnerability-high/results.xml | 187 ++++++++++++++++++ .../src/c/conan.lock | 0 .../src/csharp/packages.lock.json | 0 .../src/csharp/sample.deps.json | 0 .../src/dart/pubspec.lock | 85 ++++++++ .../src/elixir/mix.lock | 0 .../src/golang/go.mod | 8 + .../src/gradle/gradle.lockfile | 1 + .../src/java/pom.xml | 20 ++ .../src/javascript/package-lock.json | 43 ++++ .../src/javascript/package.json | 8 + .../src/javascript/yarn.lock | 15 ++ .../src/php/composer.lock | 0 .../src/python/Pipfile | 12 ++ .../src/python/Pipfile.lock | 30 +++ .../src/python/requirements.txt | 2 + .../src/ruby/Gemfile.lock | 7 + .../src/rust/Cargo.lock | 0 .../src/scala/build.sbt.lock | 30 +++ .../src/swift/Package.resolved | 79 ++++++++ .../src/swift/Package.swift | 50 +++++ .../pattern-vulnerability/results.xml | 157 +-------------- internal/docgen/rule.go | 14 +- internal/tool/tool.go | 11 +- internal/tool/tool_test.go | 8 +- 31 files changed, 616 insertions(+), 168 deletions(-) create mode 100644 docs/description/vulnerability_high.md create mode 100644 docs/multiple-tests/pattern-vulnerability-high/patterns.xml create mode 100644 docs/multiple-tests/pattern-vulnerability-high/results.xml create mode 100644 docs/multiple-tests/pattern-vulnerability-high/src/c/conan.lock create mode 100644 docs/multiple-tests/pattern-vulnerability-high/src/csharp/packages.lock.json create mode 100644 docs/multiple-tests/pattern-vulnerability-high/src/csharp/sample.deps.json create mode 100644 docs/multiple-tests/pattern-vulnerability-high/src/dart/pubspec.lock create mode 100644 docs/multiple-tests/pattern-vulnerability-high/src/elixir/mix.lock create mode 100644 docs/multiple-tests/pattern-vulnerability-high/src/golang/go.mod create mode 100644 docs/multiple-tests/pattern-vulnerability-high/src/gradle/gradle.lockfile create mode 100644 docs/multiple-tests/pattern-vulnerability-high/src/java/pom.xml create mode 100644 docs/multiple-tests/pattern-vulnerability-high/src/javascript/package-lock.json create mode 100644 docs/multiple-tests/pattern-vulnerability-high/src/javascript/package.json create mode 100644 docs/multiple-tests/pattern-vulnerability-high/src/javascript/yarn.lock create mode 100644 docs/multiple-tests/pattern-vulnerability-high/src/php/composer.lock create mode 100644 docs/multiple-tests/pattern-vulnerability-high/src/python/Pipfile create mode 100644 docs/multiple-tests/pattern-vulnerability-high/src/python/Pipfile.lock create mode 100644 docs/multiple-tests/pattern-vulnerability-high/src/python/requirements.txt create mode 100644 docs/multiple-tests/pattern-vulnerability-high/src/ruby/Gemfile.lock create mode 100644 docs/multiple-tests/pattern-vulnerability-high/src/rust/Cargo.lock create mode 100644 docs/multiple-tests/pattern-vulnerability-high/src/scala/build.sbt.lock create mode 100644 docs/multiple-tests/pattern-vulnerability-high/src/swift/Package.resolved create mode 100644 docs/multiple-tests/pattern-vulnerability-high/src/swift/Package.swift diff --git a/.circleci/config.yml b/.circleci/config.yml index 88482ac3..1478db44 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -2,7 +2,7 @@ version: 2.1 orbs: codacy: codacy/base@12.2.0 - codacy_plugins_test: codacy/plugins-test@2.0.11 + codacy_plugins_test: codacy/plugins-test@2.1.0 references: install_trivy_and_download_dbs: &install_trivy_and_download_dbs diff --git a/docs/description/vulnerability.md b/docs/description/vulnerability.md index 291aad52..cf3c0f7f 100644 --- a/docs/description/vulnerability.md +++ b/docs/description/vulnerability.md @@ -1,2 +1,2 @@ -## Insecure dependencies detection (critical and high severity) -Detects insecure dependencies (critical and high severity) by checking the libraries declared in the package manager and flagging used library versions with known security vulnerabilities. \ No newline at end of file +## Insecure dependencies detection (critical severity) +Detects insecure dependencies (critical severity) by checking the libraries declared in the package manager and flagging used library versions with known security vulnerabilities. \ No newline at end of file diff --git a/docs/description/vulnerability_high.md b/docs/description/vulnerability_high.md new file mode 100644 index 00000000..4e77b6c1 --- /dev/null +++ b/docs/description/vulnerability_high.md @@ -0,0 +1,2 @@ +## Insecure dependencies detection (high severity) +Detects insecure dependencies (high severity) by checking the libraries declared in the package manager and flagging used library versions with known security vulnerabilities. \ No newline at end of file diff --git a/docs/multiple-tests/all-patterns/patterns.xml b/docs/multiple-tests/all-patterns/patterns.xml index fca8fe89..44982da6 100644 --- a/docs/multiple-tests/all-patterns/patterns.xml +++ b/docs/multiple-tests/all-patterns/patterns.xml @@ -2,6 +2,7 @@ + diff --git a/docs/multiple-tests/all-patterns/results.xml b/docs/multiple-tests/all-patterns/results.xml index e2c5613e..97848bb1 100644 --- a/docs/multiple-tests/all-patterns/results.xml +++ b/docs/multiple-tests/all-patterns/results.xml @@ -28,10 +28,10 @@ severity="error" /> + + + diff --git a/docs/multiple-tests/pattern-vulnerability-high/results.xml b/docs/multiple-tests/pattern-vulnerability-high/results.xml new file mode 100644 index 00000000..4a280b08 --- /dev/null +++ b/docs/multiple-tests/pattern-vulnerability-high/results.xml @@ -0,0 +1,187 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/c/conan.lock b/docs/multiple-tests/pattern-vulnerability-high/src/c/conan.lock new file mode 100644 index 00000000..e69de29b diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/csharp/packages.lock.json b/docs/multiple-tests/pattern-vulnerability-high/src/csharp/packages.lock.json new file mode 100644 index 00000000..e69de29b diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/csharp/sample.deps.json b/docs/multiple-tests/pattern-vulnerability-high/src/csharp/sample.deps.json new file mode 100644 index 00000000..e69de29b diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/dart/pubspec.lock b/docs/multiple-tests/pattern-vulnerability-high/src/dart/pubspec.lock new file mode 100644 index 00000000..c74de402 --- /dev/null +++ b/docs/multiple-tests/pattern-vulnerability-high/src/dart/pubspec.lock @@ -0,0 +1,85 @@ +# Generated by pub +# See https://dart.dev/tools/pub/glossary#lockfile +packages: + async: + dependency: transitive + description: + name: async + sha256: "947bfcf187f74dbc5e146c9eb9c0f10c9f8b30743e341481c1e2ed3ecc18c20c" + url: "https://pub.dev" + source: hosted + version: "2.11.0" + collection: + dependency: transitive + description: + name: collection + sha256: ee67cb0715911d28db6bf4af1026078bd6f0128b07a5f66fb2ed94ec6783c09a + url: "https://pub.dev" + source: hosted + version: "1.18.0" + dio: + dependency: "direct main" + description: + name: http + sha256: "5895291c13fa8a3bd82e76d5627f69e0d85ca6a30dcac95c4ea19a5d555879c2" + url: "https://pub.dev" + source: hosted + version: "4.0.0" + http_parser: + dependency: transitive + description: + name: http_parser + sha256: "2aa08ce0341cc9b354a498388e30986515406668dbcc4f7c950c3e715496693b" + url: "https://pub.dev" + source: hosted + version: "4.0.2" + meta: + dependency: transitive + description: + name: meta + sha256: d584fa6707a52763a52446f02cc621b077888fb63b93bbcb1143a7be5a0c0c04 + url: "https://pub.dev" + source: hosted + version: "1.11.0" + path: + dependency: transitive + description: + name: path + sha256: "8829d8a55c13fc0e37127c29fedf290c102f4e40ae94ada574091fe0ff96c917" + url: "https://pub.dev" + source: hosted + version: "1.8.3" + source_span: + dependency: transitive + description: + name: source_span + sha256: "53e943d4206a5e30df338fd4c6e7a077e02254531b138a15aec3bd143c1a8b3c" + url: "https://pub.dev" + source: hosted + version: "1.10.0" + string_scanner: + dependency: transitive + description: + name: string_scanner + sha256: "556692adab6cfa87322a115640c11f13cb77b3f076ddcc5d6ae3c20242bedcde" + url: "https://pub.dev" + source: hosted + version: "1.2.0" + term_glyph: + dependency: transitive + description: + name: term_glyph + sha256: a29248a84fbb7c79282b40b8c72a1209db169a2e0542bce341da992fe1bc7e84 + url: "https://pub.dev" + source: hosted + version: "1.2.1" + typed_data: + dependency: transitive + description: + name: typed_data + sha256: facc8d6582f16042dd49f2463ff1bd6e2c9ef9f3d5da3d9b087e244a7b564b3c + url: "https://pub.dev" + source: hosted + version: "1.3.2" +sdks: + dart: ">=3.1.0 <4.0.0" diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/elixir/mix.lock b/docs/multiple-tests/pattern-vulnerability-high/src/elixir/mix.lock new file mode 100644 index 00000000..e69de29b diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/golang/go.mod b/docs/multiple-tests/pattern-vulnerability-high/src/golang/go.mod new file mode 100644 index 00000000..48c4659f --- /dev/null +++ b/docs/multiple-tests/pattern-vulnerability-high/src/golang/go.mod @@ -0,0 +1,8 @@ +module example + +go 1.21.0 + +toolchain go1.21.4 + +require golang.org/x/net v0.16.0 // Critical +require github.com/ollama/ollama v0.1.46 // High diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/gradle/gradle.lockfile b/docs/multiple-tests/pattern-vulnerability-high/src/gradle/gradle.lockfile new file mode 100644 index 00000000..015b11e2 --- /dev/null +++ b/docs/multiple-tests/pattern-vulnerability-high/src/gradle/gradle.lockfile @@ -0,0 +1 @@ +org.apache.seatunnel:seatunnel:1.0.0 \ No newline at end of file diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/java/pom.xml b/docs/multiple-tests/pattern-vulnerability-high/src/java/pom.xml new file mode 100644 index 00000000..ac8e56fe --- /dev/null +++ b/docs/multiple-tests/pattern-vulnerability-high/src/java/pom.xml @@ -0,0 +1,20 @@ + + 4.0.0 + + com.example + happy + 1.0.0 + + happy + Example + + + + org.apache.dolphinscheduler + dolphinscheduler-task-api + 3.2.1 + + + \ No newline at end of file diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/javascript/package-lock.json b/docs/multiple-tests/pattern-vulnerability-high/src/javascript/package-lock.json new file mode 100644 index 00000000..df3d7b27 --- /dev/null +++ b/docs/multiple-tests/pattern-vulnerability-high/src/javascript/package-lock.json @@ -0,0 +1,43 @@ +{ + "name": "node-js-sample", + "version": "0.2.0", + "lockfileVersion": 3, + "requires": true, + "packages": { + "": { + "name": "node-js-sample", + "version": "0.2.0", + "dependencies": { + "axios": "0.21.0" + } + }, + "node_modules/axios": { + "version": "0.21.0", + "resolved": "https://registry.npmjs.org/axios/-/axios-0.21.0.tgz", + "integrity": "sha512-fmkJBknJKoZwem3/IKSSLpkdNXZeBu5Q7GA/aRsr2btgrptmSCxi2oFjZHqGdK9DoTil9PIHlPIZw2EcRJXRvw==", + "deprecated": "Critical security vulnerability fixed in v0.21.1. For more information, see https://github.com/axios/axios/pull/3410", + "dependencies": { + "follow-redirects": "^1.10.0" + } + }, + "node_modules/follow-redirects": { + "version": "1.15.6", + "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.6.tgz", + "integrity": "sha512-wWN62YITEaOpSK584EZXJafH1AGpO8RVgElfkuXbTOrPX4fIfOyEpW/CsiNd8JdYrAoOvafRTOEnvsO++qCqFA==", + "funding": [ + { + "type": "individual", + "url": "https://github.com/sponsors/RubenVerborgh" + } + ], + "engines": { + "node": ">=4.0" + }, + "peerDependenciesMeta": { + "debug": { + "optional": true + } + } + } + } +} diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/javascript/package.json b/docs/multiple-tests/pattern-vulnerability-high/src/javascript/package.json new file mode 100644 index 00000000..78ee70dd --- /dev/null +++ b/docs/multiple-tests/pattern-vulnerability-high/src/javascript/package.json @@ -0,0 +1,8 @@ +{ + "name": "node-js-sample", + "version": "0.2.0", + "main": "index.js", + "dependencies": { + "axios": "0.21.0" + } +} diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/javascript/yarn.lock b/docs/multiple-tests/pattern-vulnerability-high/src/javascript/yarn.lock new file mode 100644 index 00000000..aa5e8fd5 --- /dev/null +++ b/docs/multiple-tests/pattern-vulnerability-high/src/javascript/yarn.lock @@ -0,0 +1,15 @@ +# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY. +# yarn lockfile v1 + + +axios@0.21.0: + version "0.21.0" + resolved "https://registry.yarnpkg.com/axios/-/axios-0.21.0.tgz#26df088803a2350dff2c27f96fef99fe49442aca" + integrity sha512-fmkJBknJKoZwem3/IKSSLpkdNXZeBu5Q7GA/aRsr2btgrptmSCxi2oFjZHqGdK9DoTil9PIHlPIZw2EcRJXRvw== + dependencies: + follow-redirects "^1.10.0" + +follow-redirects@^1.10.0: + version "1.15.6" + resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.15.6.tgz#7f815c0cda4249c74ff09e95ef97c23b5fd0399b" + integrity sha512-wWN62YITEaOpSK584EZXJafH1AGpO8RVgElfkuXbTOrPX4fIfOyEpW/CsiNd8JdYrAoOvafRTOEnvsO++qCqFA== diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/php/composer.lock b/docs/multiple-tests/pattern-vulnerability-high/src/php/composer.lock new file mode 100644 index 00000000..e69de29b diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/python/Pipfile b/docs/multiple-tests/pattern-vulnerability-high/src/python/Pipfile new file mode 100644 index 00000000..d8bbc33a --- /dev/null +++ b/docs/multiple-tests/pattern-vulnerability-high/src/python/Pipfile @@ -0,0 +1,12 @@ +[[source]] +url = "https://pypi.org/simple" +verify_ssl = true +name = "pypi" + +[packages] +pymysql = "==v1.1.0" + +[dev-packages] + +[requires] +python_version = "3.11" \ No newline at end of file diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/python/Pipfile.lock b/docs/multiple-tests/pattern-vulnerability-high/src/python/Pipfile.lock new file mode 100644 index 00000000..8cc1765b --- /dev/null +++ b/docs/multiple-tests/pattern-vulnerability-high/src/python/Pipfile.lock @@ -0,0 +1,30 @@ +{ + "_meta": { + "hash": { + "sha256": "4e3999b31c605843bea82f9ef428cbdc2cd0cc845d4076982ce4a86708b6c16b" + }, + "pipfile-spec": 6, + "requires": { + "python_version": "3.11" + }, + "sources": [ + { + "name": "pypi", + "url": "https://pypi.org/simple", + "verify_ssl": true + } + ] + }, + "default": { + "pymysql": { + "hashes": [ + "sha256:4f13a7df8bf36a51e81dd9f3605fede45a4878fe02f9236349fd82a3f0612f96", + "sha256:8969ec6d763c856f7073c4c64662882675702efcb114b4bcbb955aea3a069fa7" + ], + "index": "pypi", + "markers": "python_version >= '3.7'", + "version": "==1.1.0" + } + }, + "develop": {} +} \ No newline at end of file diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/python/requirements.txt b/docs/multiple-tests/pattern-vulnerability-high/src/python/requirements.txt new file mode 100644 index 00000000..bf0de54c --- /dev/null +++ b/docs/multiple-tests/pattern-vulnerability-high/src/python/requirements.txt @@ -0,0 +1,2 @@ +# dependencies +openstack-heat==v19.0.0 diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/ruby/Gemfile.lock b/docs/multiple-tests/pattern-vulnerability-high/src/ruby/Gemfile.lock new file mode 100644 index 00000000..663f2d5d --- /dev/null +++ b/docs/multiple-tests/pattern-vulnerability-high/src/ruby/Gemfile.lock @@ -0,0 +1,7 @@ +GEM + remote: https://rubygems.org/ + specs: + discordrb (3.4.2) + +BUNDLED WITH + 2.3.22 diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/rust/Cargo.lock b/docs/multiple-tests/pattern-vulnerability-high/src/rust/Cargo.lock new file mode 100644 index 00000000..e69de29b diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/scala/build.sbt.lock b/docs/multiple-tests/pattern-vulnerability-high/src/scala/build.sbt.lock new file mode 100644 index 00000000..cc3f0b91 --- /dev/null +++ b/docs/multiple-tests/pattern-vulnerability-high/src/scala/build.sbt.lock @@ -0,0 +1,30 @@ +{ + "lockVersion" : 1, + "timestamp" : "2024-07-01T14:48:58.191275Z", + "configurations" : [ + "compile", + "optional", + "provided", + "runtime", + "scalafix", + "test" + ], + "dependencies" : [ + { + "org" : "ch.qos.logback", + "name" : "logback-classic", + "version" : "1.2.3", + "artifacts" : [ + { + "name" : "logback-classic.jar", + "hash" : "sha1:7c4f3c474fb2c041d8028740440937705ebb473a" + } + ], + "configurations" : [ + "compile", + "runtime", + "test" + ] + } + ] +} \ No newline at end of file diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/swift/Package.resolved b/docs/multiple-tests/pattern-vulnerability-high/src/swift/Package.resolved new file mode 100644 index 00000000..48e319b7 --- /dev/null +++ b/docs/multiple-tests/pattern-vulnerability-high/src/swift/Package.resolved @@ -0,0 +1,79 @@ +{ + "object": { + "pins": [ + { + "package": "DeckOfPlayingCards", + "repositoryURL": "https://github.com/apple/example-package-deckofplayingcards.git", + "state": { + "branch": null, + "revision": "2c0e5ac3e10216151fc78ac1ec6bd9c2c0111a3a", + "version": "3.0.4" + } + }, + { + "package": "FisherYates", + "repositoryURL": "https://github.com/apple/example-package-fisheryates.git", + "state": { + "branch": null, + "revision": "e729f197bbc3831b9a3005fa71ad6f38c1e7e17e", + "version": "2.0.6" + } + }, + { + "package": "PlayingCard", + "repositoryURL": "https://github.com/apple/example-package-playingcard.git", + "state": { + "branch": null, + "revision": "39ddabb01e8102ab548a8c6bb3eb20b15f3b4fbc", + "version": "3.0.5" + } + }, + { + "package": "swift-argument-parser", + "repositoryURL": "https://github.com/apple/swift-argument-parser.git", + "state": { + "branch": null, + "revision": "6b2aa2748a7881eebb9f84fb10c01293e15b52ca", + "version": "0.5.0" + } + }, + { + "package": "swift-atomics", + "repositoryURL": "https://github.com/apple/swift-atomics.git", + "state": { + "branch": null, + "revision": "cd142fd2f64be2100422d658e7411e39489da985", + "version": "1.2.0" + } + }, + { + "package": "swift-collections", + "repositoryURL": "https://github.com/apple/swift-collections.git", + "state": { + "branch": null, + "revision": "a902f1823a7ff3c9ab2fba0f992396b948eda307", + "version": "1.0.5" + } + }, + { + "package": "swift-nio", + "repositoryURL": "https://github.com/apple/swift-nio.git", + "state": { + "branch": null, + "revision": "3db5c4aeee8100d2db6f1eaf3864afdad5dc68fd", + "version": "2.59.0" + } + }, + { + "package": "swift-nio-http2", + "repositoryURL": "https://github.com/apple/swift-nio-http2.git", + "state": { + "branch": null, + "revision": "c2638ff60910a0d468ff9a882c8586a827da1a0d", + "version": "1.2.1" + } + } + ] + }, + "version": 1 +} \ No newline at end of file diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/swift/Package.swift b/docs/multiple-tests/pattern-vulnerability-high/src/swift/Package.swift new file mode 100644 index 00000000..82d41d38 --- /dev/null +++ b/docs/multiple-tests/pattern-vulnerability-high/src/swift/Package.swift @@ -0,0 +1,50 @@ +// swift-tools-version:5.5 +// The swift-tools-version declares the minimum version of Swift required to build this package. + +/* + This source file is part of the Swift.org open source project + + Copyright 2015 – 2021 Apple Inc. and the Swift project authors + Licensed under Apache License v2.0 with Runtime Library Exception + + See http://swift.org/LICENSE.txt for license information + See http://swift.org/CONTRIBUTORS.txt for Swift project authors +*/ + +import PackageDescription + +let package = Package( + name: "dealer", + platforms: [ + .macOS(.v11) + ], + products: [ + .executable(name: "dealer", targets: ["dealer"]), + ], + dependencies: [ + // Dependencies declare other packages that this package depends on. + .package(url: "https://github.com/apple/example-package-deckofplayingcards.git", + from: "3.0.0"), + .package(url: "https://github.com/apple/swift-argument-parser.git", + from: "0.4.4"), + .package(url: "https://github.com/apple/swift-nio-http2.git", + "1.0.0"..<"1.2.8"), + ], + targets: [ + // Targets are the basic building blocks of a package. A target can define a module or a test suite. + // Targets can depend on other targets in this package, and on products in packages which this package depends on. + .executableTarget( + name: "dealer", + dependencies: [ + .product(name: "DeckOfPlayingCards", + package: "example-package-deckofplayingcards"), + .product(name: "ArgumentParser", + package: "swift-argument-parser") + ]), + .testTarget( + name: "DealerTests", + dependencies: [ + .byName(name: "dealer") + ]), + ] +) \ No newline at end of file diff --git a/docs/multiple-tests/pattern-vulnerability/results.xml b/docs/multiple-tests/pattern-vulnerability/results.xml index 6e90b9a9..1160a5c5 100644 --- a/docs/multiple-tests/pattern-vulnerability/results.xml +++ b/docs/multiple-tests/pattern-vulnerability/results.xml @@ -1,90 +1,13 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + - - - - - - - - - - - \ No newline at end of file diff --git a/internal/docgen/rule.go b/internal/docgen/rule.go index 83be9a48..b1caf47f 100644 --- a/internal/docgen/rule.go +++ b/internal/docgen/rule.go @@ -67,14 +67,24 @@ func trivyRules() Rules { }, { ID: "vulnerability", - Title: "Insecure dependencies detection (critical and high severity)", - Description: "Detects insecure dependencies (critical and high severity) by checking the libraries declared in the package manager and flagging used library versions with known security vulnerabilities.", + Title: "Insecure dependencies detection (critical severity)", + Description: "Detects insecure dependencies (critical) by checking the libraries declared in the package manager and flagging used library versions with known security vulnerabilities.", Level: "Error", Category: "Security", SubCategory: "InsecureModulesLibraries", ScanType: "SCA", Enabled: true, }, + { + ID: "vulnerability_high", + Title: "Insecure dependencies detection (high severity)", + Description: "Detects insecure dependencies (high severity) by checking the libraries declared in the package manager and flagging used library versions with known security vulnerabilities.", + Level: "High", + Category: "Security", + SubCategory: "InsecureModulesLibraries", + ScanType: "SCA", + Enabled: true, + }, { ID: "vulnerability_medium", Title: "Insecure dependencies detection (medium severity)", diff --git a/internal/tool/tool.go b/internal/tool/tool.go index 5518f7fc..e963a54b 100644 --- a/internal/tool/tool.go +++ b/internal/tool/tool.go @@ -31,6 +31,7 @@ import ( const ( ruleIDSecret string = "secret" ruleIDVulnerability string = "vulnerability" + ruleIDVulnerabilityHigh string = "vulnerability_high" ruleIDVulnerabilityMedium string = "vulnerability_medium" ruleIDVulnerabilityMinor string = "vulnerability_minor" @@ -44,7 +45,7 @@ const ( ) // ruleIDsVulnerability contains IDs all rule (or pattern) IDs that find vulnerable dependencies. -var ruleIDsVulnerability = []string{ruleIDVulnerability, ruleIDVulnerabilityMedium, ruleIDVulnerabilityMinor} +var ruleIDsVulnerability = []string{ruleIDVulnerability, ruleIDVulnerabilityHigh, ruleIDVulnerabilityMedium, ruleIDVulnerabilityMinor} // New creates a new instance of Codacy Trivy. func New() codacyTrivy { @@ -310,7 +311,9 @@ func getRuleIDFromTrivySeverity(severity string) (string, error) { return ruleIDVulnerabilityMinor, nil case trivySeverityMedium: return ruleIDVulnerabilityMedium, nil - case trivySeverityHigh, trivySeverityCritical: + case trivySeverityHigh: + return ruleIDVulnerabilityHigh, nil + case trivySeverityCritical: return ruleIDVulnerability, nil default: return "", &ToolError{msg: fmt.Sprintf("Failed to run Codacy Trivy: unexpected Trivy severity %s", severity)} @@ -324,7 +327,9 @@ func getTrivySeveritiesFromPatterns(patterns []codacy.Pattern) []dbTypes.Severit for _, pattern := range patterns { switch strings.ToLower(pattern.ID) { case ruleIDVulnerability: - trivySeverities = append(trivySeverities, dbTypes.SeverityCritical, dbTypes.SeverityHigh) + trivySeverities = append(trivySeverities, dbTypes.SeverityCritical) + case ruleIDVulnerabilityHigh: + trivySeverities = append(trivySeverities, dbTypes.SeverityHigh) case ruleIDVulnerabilityMedium: trivySeverities = append(trivySeverities, dbTypes.SeverityMedium) case ruleIDVulnerabilityMinor: diff --git a/internal/tool/tool_test.go b/internal/tool/tool_test.go index dee031ee..7582bf67 100644 --- a/internal/tool/tool_test.go +++ b/internal/tool/tool_test.go @@ -70,6 +70,9 @@ func TestRun(t *testing.T) { { ID: ruleIDVulnerability, }, + { + ID: ruleIDVulnerabilityHigh, + }, { ID: "unknown", }, @@ -233,7 +236,7 @@ func TestRun(t *testing.T) { { File: fileName, Line: 1, - PatternID: ruleIDVulnerability, + PatternID: ruleIDVulnerabilityHigh, Message: "Insecure dependency type/@namespace/package-1@version+incompatible (vuln id no fixed version: vuln no fixed version) (no fix available)", SourceID: "vuln id no fixed version", }, @@ -614,7 +617,7 @@ func TestGetRuleIdFromTrivySeverity(t *testing.T) { }, "high": { trivySeverity: "hiGh", - expectedRuleID: ruleIDVulnerability, + expectedRuleID: ruleIDVulnerabilityHigh, }, "critical": { trivySeverity: "CrItIcAl", @@ -642,6 +645,7 @@ func TestGetTrivySeveritiesFromPatterns(t *testing.T) { // Assert patterns := []codacy.Pattern{ {ID: ruleIDVulnerability}, + {ID: ruleIDVulnerabilityHigh}, {ID: ruleIDVulnerabilityMedium}, {ID: ruleIDVulnerabilityMinor}, {ID: ruleIDSecret},