feature: adds new severity high pattern CF-1779

.circleci/config.yml

@@ -2,7 +2,7 @@ version: 2.1
 
 orbs:
   codacy: codacy/base@12.2.0
-  codacy_plugins_test: codacy/plugins-test@2.0.11
+  codacy_plugins_test: codacy/plugins-test@2.1.0
 
 references:
   install_trivy_and_download_dbs: &install_trivy_and_download_dbs

docs/description/vulnerability.md

@@ -1,2 +1,2 @@
-## Insecure dependencies detection (critical and high severity)
-Detects insecure dependencies (critical and high severity) by checking the libraries declared in the package manager and flagging used library versions with known security vulnerabilities.
+## Insecure dependencies detection (critical severity)
+Detects insecure dependencies (critical severity) by checking the libraries declared in the package manager and flagging used library versions with known security vulnerabilities.

docs/description/vulnerability_high.md

@@ -0,0 +1,2 @@
+## Insecure dependencies detection (high severity)
+Detects insecure dependencies (high severity) by checking the libraries declared in the package manager and flagging used library versions with known security vulnerabilities.

docs/multiple-tests/all-patterns/patterns.xml

@@ -2,6 +2,7 @@
 <module name="root">
     <module name="secret" />
     <module name="vulnerability" />
+    <module name="vulnerability_high" />
     <module name="vulnerability_medium" />
     <module name="vulnerability_minor" />
 </module>

docs/multiple-tests/all-patterns/results.xml

@@ -28,10 +28,10 @@
             severity="error"
         />
         <error
-            source="vulnerability"
+            source="vulnerability_high"
             line="3"
             message="Insecure dependency maven/org.apache.seatunnel/seatunnel@1.0.0 (CVE-2023-49198: Apache SeaTunnel SQL Injection vulnerability) (update to 1.0.1)"
-            severity="error"
+            severity="high"
         />
         <error
             source="vulnerability_medium"

docs/multiple-tests/pattern-vulnerability-high/patterns.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<module name="root">
+    <module name="vulnerability_high" />
+</module>

docs/multiple-tests/pattern-vulnerability-high/results.xml

@@ -0,0 +1,187 @@
+<?xml version="1.0" encoding="utf-8"?>
+<checkstyle version="1.5">
+    <file name="dart/pubspec.lock">
+        <error
+            source="vulnerability_high"
+            line="20"
+            message="Insecure dependency pub/dio@4.0.0 (CVE-2021-31402: dio vulnerable to CRLF injection with HTTP method string) (update to 5.0.0)"
+            severity="high"
+        />
+    </file>
+    <file name="golang/go.mod">
+        <error
+            source="vulnerability_high"
+            line="8"
+            message="Insecure dependency golang/github.com/ollama/ollama@v0.1.46 (CVE-2024-12055: ollama: DoS using malicious gguf model file in ollama/ollama) (no fix available)"
+            severity="high"
+        />
+    </file>
+    <file name="golang/go.mod">
+        <error
+            source="vulnerability_high"
+            line="8"
+            message="Insecure dependency golang/github.com/ollama/ollama@v0.1.46 (CVE-2024-45436: Ollama can extract members of a ZIP archive outside of the parent directory) (update to 0.1.47)"
+            severity="high"
+        />
+    </file>
+    <file name="golang/go.mod">
+        <error
+            source="vulnerability_high"
+            line="8"
+            message="Insecure dependency golang/github.com/ollama/ollama@v0.1.46 (CVE-2024-8063: ollama: Divide by Zero in ollama/ollama) (no fix available)"
+            severity="high"
+        />
+    </file>
+    <file name="golang/go.mod">
+        <error
+            source="vulnerability_high"
+            line="8"
+            message="Insecure dependency golang/github.com/ollama/ollama@v0.1.46 (CVE-2025-0312: ollama: NULL Pointer Dereference in ollama/ollama) (no fix available)"
+            severity="high"
+        />
+    </file>
+    <file name="golang/go.mod">
+        <error
+            source="vulnerability_high"
+            line="8"
+            message="Insecure dependency golang/github.com/ollama/ollama@v0.1.46 (CVE-2025-0315: ollama: Allocation of Resources Without Limits or Throttling in ollama/ollama) (no fix available)"
+            severity="high"
+        />
+    </file>
+    <file name="golang/go.mod">
+        <error
+            source="vulnerability_high"
+            line="8"
+            message="Insecure dependency golang/github.com/ollama/ollama@v0.1.46 (CVE-2025-0317: ollama: Divide By Zero in ollama/ollama) (no fix available)"
+            severity="high"
+        />
+    </file>
+    <file name="golang/go.mod">
+        <error
+            source="vulnerability_high"
+            line="8"
+            message="Insecure dependency golang/github.com/ollama/ollama@v0.1.46 (CVE-2025-1975: ollama: Improper Validation of Array Index in ollama/ollama) (no fix available)"
+            severity="high"
+        />
+    </file>
+    <file name="golang/go.mod">
+        <error
+            source="vulnerability_high"
+            line="8"
+            message="Insecure dependency golang/github.com/ollama/ollama@v0.1.46 (CVE-2024-12886: ollama: Out-Of-Memory (OOM) Vulnerability in ollama/ollama) (no fix available)"
+            severity="high"
+        />
+    </file>
+    <file name="golang/go.mod">
+        <error
+            source="vulnerability_high"
+            line="7"
+            message="Insecure dependency golang/golang.org/x/net@v0.16.0 (CVE-2023-39325: golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)) (update to 0.17.0)"
+            severity="high"
+        />
+    </file>
+    <file name="golang/go.mod">
+        <error
+            source="vulnerability_high"
+            line="5"
+            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2023-45288: golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS) (update to 1.21.9)"
+            severity="high"
+        />
+    </file>
+    <file name="golang/go.mod">
+        <error
+            source="vulnerability_high"
+            line="5"
+            message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2024-34156: encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion) (update to 1.22.7)"
+            severity="high"
+        />
+    </file>
+    <file name="gradle/gradle.lockfile">
+        <error
+            source="vulnerability_high"
+            line="1"
+            message="Insecure dependency maven/org.apache.seatunnel/seatunnel@1.0.0 (CVE-2023-49198: Apache SeaTunnel SQL Injection vulnerability) (update to 1.0.1)"
+            severity="high"
+        />
+    </file>
+    <file name="javascript/package-lock.json">
+        <error
+            source="vulnerability_high"
+            line="14"
+            message="Insecure dependency npm/axios@0.21.0 (CVE-2021-3749: nodejs-axios: Regular expression denial of service in trim function) (update to 0.21.2)"
+            severity="high"
+        />
+    </file>
+    <file name="javascript/package-lock.json">
+        <error
+            source="vulnerability_high"
+            line="14"
+            message="Insecure dependency npm/axios@0.21.0 (CVE-2025-27152: axios: Possible SSRF and Credential Leakage via Absolute URL in axios Requests) (update to 0.30.0)"
+            severity="high"
+        />
+    </file>
+    <file name="javascript/yarn.lock">
+        <error
+            source="vulnerability_high"
+            line="5"
+            message="Insecure dependency npm/axios@0.21.0 (CVE-2021-3749: nodejs-axios: Regular expression denial of service in trim function) (update to 0.21.2)"
+            severity="high"
+        />
+    </file>
+    <file name="javascript/yarn.lock">
+        <error
+            source="vulnerability_high"
+            line="5"
+            message="Insecure dependency npm/axios@0.21.0 (CVE-2025-27152: axios: Possible SSRF and Credential Leakage via Absolute URL in axios Requests) (update to 0.30.0)"
+            severity="high"
+        />
+    </file>
+    <file name="python/requirements.txt">
+        <error
+            source="vulnerability_high"
+            line="2"
+            message="Insecure dependency pypi/openstack-heat@v19.0.0 (CVE-2023-1625: openstack-heat: information leak in API) (update to 20.0.0)"
+            severity="high"
+        />
+    </file>
+    <file name="scala/build.sbt.lock">
+        <error
+            source="vulnerability_high"
+            line="13"
+            message="Insecure dependency maven/ch.qos.logback/logback-classic@1.2.3 (CVE-2023-6378: logback: serialization vulnerability in logback receiver) (update to 1.2.13)"
+            severity="high"
+        />
+    </file>
+    <file name="swift/Package.resolved">
+        <error
+            source="vulnerability_high"
+            line="67"
+            message="Insecure dependency swift/github.com/apple/swift-nio-http2@1.2.1 (CVE-2022-0618: Denial of service via HTTP/2 HEADERS frames padding) (update to 1.20)"
+            severity="high"
+        />
+    </file>
+    <file name="swift/Package.resolved">
+        <error
+            source="vulnerability_high"
+            line="67"
+            message="Insecure dependency swift/github.com/apple/swift-nio-http2@1.2.1 (CVE-2022-24666: swift-nio-http2 vulnerable to denial of service via invalid HTTP/2 HEADERS frame length) (update to 1.19.2)"
+            severity="high"
+        />
+    </file>
+    <file name="swift/Package.resolved">
+        <error
+            source="vulnerability_high"
+            line="67"
+            message="Insecure dependency swift/github.com/apple/swift-nio-http2@1.2.1 (CVE-2022-24667: swift-nio-http2 vulnerable to denial of service via mishandled HPACK variable length integer encoding) (update to 1.19.2)"
+            severity="high"
+        />
+    </file>
+    <file name="swift/Package.resolved">
+        <error
+            source="vulnerability_high"
+            line="67"
+            message="Insecure dependency swift/github.com/apple/swift-nio-http2@1.2.1 (CVE-2022-24668: swift-nio-http2 vulnerable to denial of service via ALTSVC or ORIGIN frames) (update to 1.19.2)"
+            severity="high"
+        />
+    </file>
+</checkstyle>

docs/multiple-tests/pattern-vulnerability-high/src/dart/pubspec.lock

@@ -0,0 +1,85 @@
+# Generated by pub
+# See https://dart.dev/tools/pub/glossary#lockfile
+packages:
+  async:
+    dependency: transitive
+    description:
+      name: async
+      sha256: "947bfcf187f74dbc5e146c9eb9c0f10c9f8b30743e341481c1e2ed3ecc18c20c"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.11.0"
+  collection:
+    dependency: transitive
+    description:
+      name: collection
+      sha256: ee67cb0715911d28db6bf4af1026078bd6f0128b07a5f66fb2ed94ec6783c09a
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.18.0"
+  dio:
+    dependency: "direct main"
+    description:
+      name: http
+      sha256: "5895291c13fa8a3bd82e76d5627f69e0d85ca6a30dcac95c4ea19a5d555879c2"
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.0.0"
+  http_parser:
+    dependency: transitive
+    description:
+      name: http_parser
+      sha256: "2aa08ce0341cc9b354a498388e30986515406668dbcc4f7c950c3e715496693b"
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.0.2"
+  meta:
+    dependency: transitive
+    description:
+      name: meta
+      sha256: d584fa6707a52763a52446f02cc621b077888fb63b93bbcb1143a7be5a0c0c04
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.11.0"
+  path:
+    dependency: transitive
+    description:
+      name: path
+      sha256: "8829d8a55c13fc0e37127c29fedf290c102f4e40ae94ada574091fe0ff96c917"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.8.3"
+  source_span:
+    dependency: transitive
+    description:
+      name: source_span
+      sha256: "53e943d4206a5e30df338fd4c6e7a077e02254531b138a15aec3bd143c1a8b3c"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.10.0"
+  string_scanner:
+    dependency: transitive
+    description:
+      name: string_scanner
+      sha256: "556692adab6cfa87322a115640c11f13cb77b3f076ddcc5d6ae3c20242bedcde"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.0"
+  term_glyph:
+    dependency: transitive
+    description:
+      name: term_glyph
+      sha256: a29248a84fbb7c79282b40b8c72a1209db169a2e0542bce341da992fe1bc7e84
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.1"
+  typed_data:
+    dependency: transitive
+    description:
+      name: typed_data
+      sha256: facc8d6582f16042dd49f2463ff1bd6e2c9ef9f3d5da3d9b087e244a7b564b3c
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.3.2"
+sdks:
+  dart: ">=3.1.0 <4.0.0"

docs/multiple-tests/pattern-vulnerability-high/src/golang/go.mod

@@ -0,0 +1,8 @@
+module example
+
+go 1.21.0
+
+toolchain go1.21.4
+
+require golang.org/x/net v0.16.0 // Critical
+require github.com/ollama/ollama v0.1.46 // High

docs/multiple-tests/pattern-vulnerability-high/src/gradle/gradle.lockfile

@@ -0,0 +1 @@
+org.apache.seatunnel:seatunnel:1.0.0

docs/multiple-tests/pattern-vulnerability-high/src/java/pom.xml

@@ -0,0 +1,20 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>com.example</groupId>
+    <artifactId>happy</artifactId>
+    <version>1.0.0</version>
+
+    <name>happy</name>
+    <description>Example</description>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.apache.dolphinscheduler</groupId>
+            <artifactId>dolphinscheduler-task-api</artifactId>
+            <version>3.2.1</version>
+        </dependency>
+    </dependencies>
+</project>