diff --git a/.circleci/config.yml b/.circleci/config.yml
index 88482ac3..1478db44 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -2,7 +2,7 @@ version: 2.1
orbs:
codacy: codacy/base@12.2.0
- codacy_plugins_test: codacy/plugins-test@2.0.11
+ codacy_plugins_test: codacy/plugins-test@2.1.0
references:
install_trivy_and_download_dbs: &install_trivy_and_download_dbs
diff --git a/.gitignore b/.gitignore
index cfb4e959..2cee729c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -17,3 +17,6 @@ cache
#Ignore vscode AI rules
.github/copilot-instructions.md
+
+#Ignore cursor AI rules
+.cursor/rules/codacy.mdc
diff --git a/docs/description/vulnerability.md b/docs/description/vulnerability.md
index 291aad52..cf3c0f7f 100644
--- a/docs/description/vulnerability.md
+++ b/docs/description/vulnerability.md
@@ -1,2 +1,2 @@
-## Insecure dependencies detection (critical and high severity)
-Detects insecure dependencies (critical and high severity) by checking the libraries declared in the package manager and flagging used library versions with known security vulnerabilities.
\ No newline at end of file
+## Insecure dependencies detection (critical severity)
+Detects insecure dependencies (critical severity) by checking the libraries declared in the package manager and flagging used library versions with known security vulnerabilities.
\ No newline at end of file
diff --git a/docs/description/vulnerability_high.md b/docs/description/vulnerability_high.md
new file mode 100644
index 00000000..4e77b6c1
--- /dev/null
+++ b/docs/description/vulnerability_high.md
@@ -0,0 +1,2 @@
+## Insecure dependencies detection (high severity)
+Detects insecure dependencies (high severity) by checking the libraries declared in the package manager and flagging used library versions with known security vulnerabilities.
\ No newline at end of file
diff --git a/docs/multiple-tests/all-patterns/patterns.xml b/docs/multiple-tests/all-patterns/patterns.xml
index fca8fe89..44982da6 100644
--- a/docs/multiple-tests/all-patterns/patterns.xml
+++ b/docs/multiple-tests/all-patterns/patterns.xml
@@ -2,6 +2,7 @@
+
diff --git a/docs/multiple-tests/all-patterns/results.xml b/docs/multiple-tests/all-patterns/results.xml
index e2c5613e..97848bb1 100644
--- a/docs/multiple-tests/all-patterns/results.xml
+++ b/docs/multiple-tests/all-patterns/results.xml
@@ -28,10 +28,10 @@
severity="error"
/>
+
+
+
diff --git a/docs/multiple-tests/pattern-vulnerability-high/results.xml b/docs/multiple-tests/pattern-vulnerability-high/results.xml
new file mode 100644
index 00000000..4a280b08
--- /dev/null
+++ b/docs/multiple-tests/pattern-vulnerability-high/results.xml
@@ -0,0 +1,187 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/c/conan.lock b/docs/multiple-tests/pattern-vulnerability-high/src/c/conan.lock
new file mode 100644
index 00000000..e69de29b
diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/csharp/packages.lock.json b/docs/multiple-tests/pattern-vulnerability-high/src/csharp/packages.lock.json
new file mode 100644
index 00000000..e69de29b
diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/csharp/sample.deps.json b/docs/multiple-tests/pattern-vulnerability-high/src/csharp/sample.deps.json
new file mode 100644
index 00000000..e69de29b
diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/dart/pubspec.lock b/docs/multiple-tests/pattern-vulnerability-high/src/dart/pubspec.lock
new file mode 100644
index 00000000..c74de402
--- /dev/null
+++ b/docs/multiple-tests/pattern-vulnerability-high/src/dart/pubspec.lock
@@ -0,0 +1,85 @@
+# Generated by pub
+# See https://dart.dev/tools/pub/glossary#lockfile
+packages:
+ async:
+ dependency: transitive
+ description:
+ name: async
+ sha256: "947bfcf187f74dbc5e146c9eb9c0f10c9f8b30743e341481c1e2ed3ecc18c20c"
+ url: "https://pub.dev"
+ source: hosted
+ version: "2.11.0"
+ collection:
+ dependency: transitive
+ description:
+ name: collection
+ sha256: ee67cb0715911d28db6bf4af1026078bd6f0128b07a5f66fb2ed94ec6783c09a
+ url: "https://pub.dev"
+ source: hosted
+ version: "1.18.0"
+ dio:
+ dependency: "direct main"
+ description:
+ name: http
+ sha256: "5895291c13fa8a3bd82e76d5627f69e0d85ca6a30dcac95c4ea19a5d555879c2"
+ url: "https://pub.dev"
+ source: hosted
+ version: "4.0.0"
+ http_parser:
+ dependency: transitive
+ description:
+ name: http_parser
+ sha256: "2aa08ce0341cc9b354a498388e30986515406668dbcc4f7c950c3e715496693b"
+ url: "https://pub.dev"
+ source: hosted
+ version: "4.0.2"
+ meta:
+ dependency: transitive
+ description:
+ name: meta
+ sha256: d584fa6707a52763a52446f02cc621b077888fb63b93bbcb1143a7be5a0c0c04
+ url: "https://pub.dev"
+ source: hosted
+ version: "1.11.0"
+ path:
+ dependency: transitive
+ description:
+ name: path
+ sha256: "8829d8a55c13fc0e37127c29fedf290c102f4e40ae94ada574091fe0ff96c917"
+ url: "https://pub.dev"
+ source: hosted
+ version: "1.8.3"
+ source_span:
+ dependency: transitive
+ description:
+ name: source_span
+ sha256: "53e943d4206a5e30df338fd4c6e7a077e02254531b138a15aec3bd143c1a8b3c"
+ url: "https://pub.dev"
+ source: hosted
+ version: "1.10.0"
+ string_scanner:
+ dependency: transitive
+ description:
+ name: string_scanner
+ sha256: "556692adab6cfa87322a115640c11f13cb77b3f076ddcc5d6ae3c20242bedcde"
+ url: "https://pub.dev"
+ source: hosted
+ version: "1.2.0"
+ term_glyph:
+ dependency: transitive
+ description:
+ name: term_glyph
+ sha256: a29248a84fbb7c79282b40b8c72a1209db169a2e0542bce341da992fe1bc7e84
+ url: "https://pub.dev"
+ source: hosted
+ version: "1.2.1"
+ typed_data:
+ dependency: transitive
+ description:
+ name: typed_data
+ sha256: facc8d6582f16042dd49f2463ff1bd6e2c9ef9f3d5da3d9b087e244a7b564b3c
+ url: "https://pub.dev"
+ source: hosted
+ version: "1.3.2"
+sdks:
+ dart: ">=3.1.0 <4.0.0"
diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/elixir/mix.lock b/docs/multiple-tests/pattern-vulnerability-high/src/elixir/mix.lock
new file mode 100644
index 00000000..e69de29b
diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/golang/go.mod b/docs/multiple-tests/pattern-vulnerability-high/src/golang/go.mod
new file mode 100644
index 00000000..48c4659f
--- /dev/null
+++ b/docs/multiple-tests/pattern-vulnerability-high/src/golang/go.mod
@@ -0,0 +1,8 @@
+module example
+
+go 1.21.0
+
+toolchain go1.21.4
+
+require golang.org/x/net v0.16.0 // Critical
+require github.com/ollama/ollama v0.1.46 // High
diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/gradle/gradle.lockfile b/docs/multiple-tests/pattern-vulnerability-high/src/gradle/gradle.lockfile
new file mode 100644
index 00000000..015b11e2
--- /dev/null
+++ b/docs/multiple-tests/pattern-vulnerability-high/src/gradle/gradle.lockfile
@@ -0,0 +1 @@
+org.apache.seatunnel:seatunnel:1.0.0
\ No newline at end of file
diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/java/pom.xml b/docs/multiple-tests/pattern-vulnerability-high/src/java/pom.xml
new file mode 100644
index 00000000..ac8e56fe
--- /dev/null
+++ b/docs/multiple-tests/pattern-vulnerability-high/src/java/pom.xml
@@ -0,0 +1,20 @@
+
+ 4.0.0
+
+ com.example
+ happy
+ 1.0.0
+
+ happy
+ Example
+
+
+
+ org.apache.dolphinscheduler
+ dolphinscheduler-task-api
+ 3.2.1
+
+
+
\ No newline at end of file
diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/javascript/package-lock.json b/docs/multiple-tests/pattern-vulnerability-high/src/javascript/package-lock.json
new file mode 100644
index 00000000..df3d7b27
--- /dev/null
+++ b/docs/multiple-tests/pattern-vulnerability-high/src/javascript/package-lock.json
@@ -0,0 +1,43 @@
+{
+ "name": "node-js-sample",
+ "version": "0.2.0",
+ "lockfileVersion": 3,
+ "requires": true,
+ "packages": {
+ "": {
+ "name": "node-js-sample",
+ "version": "0.2.0",
+ "dependencies": {
+ "axios": "0.21.0"
+ }
+ },
+ "node_modules/axios": {
+ "version": "0.21.0",
+ "resolved": "https://registry.npmjs.org/axios/-/axios-0.21.0.tgz",
+ "integrity": "sha512-fmkJBknJKoZwem3/IKSSLpkdNXZeBu5Q7GA/aRsr2btgrptmSCxi2oFjZHqGdK9DoTil9PIHlPIZw2EcRJXRvw==",
+ "deprecated": "Critical security vulnerability fixed in v0.21.1. For more information, see https://github.com/axios/axios/pull/3410",
+ "dependencies": {
+ "follow-redirects": "^1.10.0"
+ }
+ },
+ "node_modules/follow-redirects": {
+ "version": "1.15.6",
+ "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.6.tgz",
+ "integrity": "sha512-wWN62YITEaOpSK584EZXJafH1AGpO8RVgElfkuXbTOrPX4fIfOyEpW/CsiNd8JdYrAoOvafRTOEnvsO++qCqFA==",
+ "funding": [
+ {
+ "type": "individual",
+ "url": "https://github.com/sponsors/RubenVerborgh"
+ }
+ ],
+ "engines": {
+ "node": ">=4.0"
+ },
+ "peerDependenciesMeta": {
+ "debug": {
+ "optional": true
+ }
+ }
+ }
+ }
+}
diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/javascript/package.json b/docs/multiple-tests/pattern-vulnerability-high/src/javascript/package.json
new file mode 100644
index 00000000..78ee70dd
--- /dev/null
+++ b/docs/multiple-tests/pattern-vulnerability-high/src/javascript/package.json
@@ -0,0 +1,8 @@
+{
+ "name": "node-js-sample",
+ "version": "0.2.0",
+ "main": "index.js",
+ "dependencies": {
+ "axios": "0.21.0"
+ }
+}
diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/javascript/yarn.lock b/docs/multiple-tests/pattern-vulnerability-high/src/javascript/yarn.lock
new file mode 100644
index 00000000..aa5e8fd5
--- /dev/null
+++ b/docs/multiple-tests/pattern-vulnerability-high/src/javascript/yarn.lock
@@ -0,0 +1,15 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+axios@0.21.0:
+ version "0.21.0"
+ resolved "https://registry.yarnpkg.com/axios/-/axios-0.21.0.tgz#26df088803a2350dff2c27f96fef99fe49442aca"
+ integrity sha512-fmkJBknJKoZwem3/IKSSLpkdNXZeBu5Q7GA/aRsr2btgrptmSCxi2oFjZHqGdK9DoTil9PIHlPIZw2EcRJXRvw==
+ dependencies:
+ follow-redirects "^1.10.0"
+
+follow-redirects@^1.10.0:
+ version "1.15.6"
+ resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.15.6.tgz#7f815c0cda4249c74ff09e95ef97c23b5fd0399b"
+ integrity sha512-wWN62YITEaOpSK584EZXJafH1AGpO8RVgElfkuXbTOrPX4fIfOyEpW/CsiNd8JdYrAoOvafRTOEnvsO++qCqFA==
diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/php/composer.lock b/docs/multiple-tests/pattern-vulnerability-high/src/php/composer.lock
new file mode 100644
index 00000000..e69de29b
diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/python/Pipfile b/docs/multiple-tests/pattern-vulnerability-high/src/python/Pipfile
new file mode 100644
index 00000000..d8bbc33a
--- /dev/null
+++ b/docs/multiple-tests/pattern-vulnerability-high/src/python/Pipfile
@@ -0,0 +1,12 @@
+[[source]]
+url = "https://pypi.org/simple"
+verify_ssl = true
+name = "pypi"
+
+[packages]
+pymysql = "==v1.1.0"
+
+[dev-packages]
+
+[requires]
+python_version = "3.11"
\ No newline at end of file
diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/python/Pipfile.lock b/docs/multiple-tests/pattern-vulnerability-high/src/python/Pipfile.lock
new file mode 100644
index 00000000..8cc1765b
--- /dev/null
+++ b/docs/multiple-tests/pattern-vulnerability-high/src/python/Pipfile.lock
@@ -0,0 +1,30 @@
+{
+ "_meta": {
+ "hash": {
+ "sha256": "4e3999b31c605843bea82f9ef428cbdc2cd0cc845d4076982ce4a86708b6c16b"
+ },
+ "pipfile-spec": 6,
+ "requires": {
+ "python_version": "3.11"
+ },
+ "sources": [
+ {
+ "name": "pypi",
+ "url": "https://pypi.org/simple",
+ "verify_ssl": true
+ }
+ ]
+ },
+ "default": {
+ "pymysql": {
+ "hashes": [
+ "sha256:4f13a7df8bf36a51e81dd9f3605fede45a4878fe02f9236349fd82a3f0612f96",
+ "sha256:8969ec6d763c856f7073c4c64662882675702efcb114b4bcbb955aea3a069fa7"
+ ],
+ "index": "pypi",
+ "markers": "python_version >= '3.7'",
+ "version": "==1.1.0"
+ }
+ },
+ "develop": {}
+}
\ No newline at end of file
diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/python/requirements.txt b/docs/multiple-tests/pattern-vulnerability-high/src/python/requirements.txt
new file mode 100644
index 00000000..bf0de54c
--- /dev/null
+++ b/docs/multiple-tests/pattern-vulnerability-high/src/python/requirements.txt
@@ -0,0 +1,2 @@
+# dependencies
+openstack-heat==v19.0.0
diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/ruby/Gemfile.lock b/docs/multiple-tests/pattern-vulnerability-high/src/ruby/Gemfile.lock
new file mode 100644
index 00000000..663f2d5d
--- /dev/null
+++ b/docs/multiple-tests/pattern-vulnerability-high/src/ruby/Gemfile.lock
@@ -0,0 +1,7 @@
+GEM
+ remote: https://rubygems.org/
+ specs:
+ discordrb (3.4.2)
+
+BUNDLED WITH
+ 2.3.22
diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/rust/Cargo.lock b/docs/multiple-tests/pattern-vulnerability-high/src/rust/Cargo.lock
new file mode 100644
index 00000000..e69de29b
diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/scala/build.sbt.lock b/docs/multiple-tests/pattern-vulnerability-high/src/scala/build.sbt.lock
new file mode 100644
index 00000000..cc3f0b91
--- /dev/null
+++ b/docs/multiple-tests/pattern-vulnerability-high/src/scala/build.sbt.lock
@@ -0,0 +1,30 @@
+{
+ "lockVersion" : 1,
+ "timestamp" : "2024-07-01T14:48:58.191275Z",
+ "configurations" : [
+ "compile",
+ "optional",
+ "provided",
+ "runtime",
+ "scalafix",
+ "test"
+ ],
+ "dependencies" : [
+ {
+ "org" : "ch.qos.logback",
+ "name" : "logback-classic",
+ "version" : "1.2.3",
+ "artifacts" : [
+ {
+ "name" : "logback-classic.jar",
+ "hash" : "sha1:7c4f3c474fb2c041d8028740440937705ebb473a"
+ }
+ ],
+ "configurations" : [
+ "compile",
+ "runtime",
+ "test"
+ ]
+ }
+ ]
+}
\ No newline at end of file
diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/swift/Package.resolved b/docs/multiple-tests/pattern-vulnerability-high/src/swift/Package.resolved
new file mode 100644
index 00000000..48e319b7
--- /dev/null
+++ b/docs/multiple-tests/pattern-vulnerability-high/src/swift/Package.resolved
@@ -0,0 +1,79 @@
+{
+ "object": {
+ "pins": [
+ {
+ "package": "DeckOfPlayingCards",
+ "repositoryURL": "https://github.com/apple/example-package-deckofplayingcards.git",
+ "state": {
+ "branch": null,
+ "revision": "2c0e5ac3e10216151fc78ac1ec6bd9c2c0111a3a",
+ "version": "3.0.4"
+ }
+ },
+ {
+ "package": "FisherYates",
+ "repositoryURL": "https://github.com/apple/example-package-fisheryates.git",
+ "state": {
+ "branch": null,
+ "revision": "e729f197bbc3831b9a3005fa71ad6f38c1e7e17e",
+ "version": "2.0.6"
+ }
+ },
+ {
+ "package": "PlayingCard",
+ "repositoryURL": "https://github.com/apple/example-package-playingcard.git",
+ "state": {
+ "branch": null,
+ "revision": "39ddabb01e8102ab548a8c6bb3eb20b15f3b4fbc",
+ "version": "3.0.5"
+ }
+ },
+ {
+ "package": "swift-argument-parser",
+ "repositoryURL": "https://github.com/apple/swift-argument-parser.git",
+ "state": {
+ "branch": null,
+ "revision": "6b2aa2748a7881eebb9f84fb10c01293e15b52ca",
+ "version": "0.5.0"
+ }
+ },
+ {
+ "package": "swift-atomics",
+ "repositoryURL": "https://github.com/apple/swift-atomics.git",
+ "state": {
+ "branch": null,
+ "revision": "cd142fd2f64be2100422d658e7411e39489da985",
+ "version": "1.2.0"
+ }
+ },
+ {
+ "package": "swift-collections",
+ "repositoryURL": "https://github.com/apple/swift-collections.git",
+ "state": {
+ "branch": null,
+ "revision": "a902f1823a7ff3c9ab2fba0f992396b948eda307",
+ "version": "1.0.5"
+ }
+ },
+ {
+ "package": "swift-nio",
+ "repositoryURL": "https://github.com/apple/swift-nio.git",
+ "state": {
+ "branch": null,
+ "revision": "3db5c4aeee8100d2db6f1eaf3864afdad5dc68fd",
+ "version": "2.59.0"
+ }
+ },
+ {
+ "package": "swift-nio-http2",
+ "repositoryURL": "https://github.com/apple/swift-nio-http2.git",
+ "state": {
+ "branch": null,
+ "revision": "c2638ff60910a0d468ff9a882c8586a827da1a0d",
+ "version": "1.2.1"
+ }
+ }
+ ]
+ },
+ "version": 1
+}
\ No newline at end of file
diff --git a/docs/multiple-tests/pattern-vulnerability-high/src/swift/Package.swift b/docs/multiple-tests/pattern-vulnerability-high/src/swift/Package.swift
new file mode 100644
index 00000000..82d41d38
--- /dev/null
+++ b/docs/multiple-tests/pattern-vulnerability-high/src/swift/Package.swift
@@ -0,0 +1,50 @@
+// swift-tools-version:5.5
+// The swift-tools-version declares the minimum version of Swift required to build this package.
+
+/*
+ This source file is part of the Swift.org open source project
+
+ Copyright 2015 – 2021 Apple Inc. and the Swift project authors
+ Licensed under Apache License v2.0 with Runtime Library Exception
+
+ See http://swift.org/LICENSE.txt for license information
+ See http://swift.org/CONTRIBUTORS.txt for Swift project authors
+*/
+
+import PackageDescription
+
+let package = Package(
+ name: "dealer",
+ platforms: [
+ .macOS(.v11)
+ ],
+ products: [
+ .executable(name: "dealer", targets: ["dealer"]),
+ ],
+ dependencies: [
+ // Dependencies declare other packages that this package depends on.
+ .package(url: "https://github.com/apple/example-package-deckofplayingcards.git",
+ from: "3.0.0"),
+ .package(url: "https://github.com/apple/swift-argument-parser.git",
+ from: "0.4.4"),
+ .package(url: "https://github.com/apple/swift-nio-http2.git",
+ "1.0.0"..<"1.2.8"),
+ ],
+ targets: [
+ // Targets are the basic building blocks of a package. A target can define a module or a test suite.
+ // Targets can depend on other targets in this package, and on products in packages which this package depends on.
+ .executableTarget(
+ name: "dealer",
+ dependencies: [
+ .product(name: "DeckOfPlayingCards",
+ package: "example-package-deckofplayingcards"),
+ .product(name: "ArgumentParser",
+ package: "swift-argument-parser")
+ ]),
+ .testTarget(
+ name: "DealerTests",
+ dependencies: [
+ .byName(name: "dealer")
+ ]),
+ ]
+)
\ No newline at end of file
diff --git a/docs/multiple-tests/pattern-vulnerability/results.xml b/docs/multiple-tests/pattern-vulnerability/results.xml
index 6e90b9a9..1160a5c5 100644
--- a/docs/multiple-tests/pattern-vulnerability/results.xml
+++ b/docs/multiple-tests/pattern-vulnerability/results.xml
@@ -1,90 +1,13 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
-
-
-
-
-
-
-
-
-
-
-
\ No newline at end of file
diff --git a/internal/docgen/rule.go b/internal/docgen/rule.go
index 83be9a48..d5500fda 100644
--- a/internal/docgen/rule.go
+++ b/internal/docgen/rule.go
@@ -67,14 +67,24 @@ func trivyRules() Rules {
},
{
ID: "vulnerability",
- Title: "Insecure dependencies detection (critical and high severity)",
- Description: "Detects insecure dependencies (critical and high severity) by checking the libraries declared in the package manager and flagging used library versions with known security vulnerabilities.",
+ Title: "Insecure dependencies detection (critical severity)",
+ Description: "Detects insecure dependencies (critical severity) by checking the libraries declared in the package manager and flagging used library versions with known security vulnerabilities.",
Level: "Error",
Category: "Security",
SubCategory: "InsecureModulesLibraries",
ScanType: "SCA",
Enabled: true,
},
+ {
+ ID: "vulnerability_high",
+ Title: "Insecure dependencies detection (high severity)",
+ Description: "Detects insecure dependencies (high severity) by checking the libraries declared in the package manager and flagging used library versions with known security vulnerabilities.",
+ Level: "High",
+ Category: "Security",
+ SubCategory: "InsecureModulesLibraries",
+ ScanType: "SCA",
+ Enabled: true,
+ },
{
ID: "vulnerability_medium",
Title: "Insecure dependencies detection (medium severity)",
diff --git a/internal/tool/tool.go b/internal/tool/tool.go
index 5518f7fc..e963a54b 100644
--- a/internal/tool/tool.go
+++ b/internal/tool/tool.go
@@ -31,6 +31,7 @@ import (
const (
ruleIDSecret string = "secret"
ruleIDVulnerability string = "vulnerability"
+ ruleIDVulnerabilityHigh string = "vulnerability_high"
ruleIDVulnerabilityMedium string = "vulnerability_medium"
ruleIDVulnerabilityMinor string = "vulnerability_minor"
@@ -44,7 +45,7 @@ const (
)
// ruleIDsVulnerability contains IDs all rule (or pattern) IDs that find vulnerable dependencies.
-var ruleIDsVulnerability = []string{ruleIDVulnerability, ruleIDVulnerabilityMedium, ruleIDVulnerabilityMinor}
+var ruleIDsVulnerability = []string{ruleIDVulnerability, ruleIDVulnerabilityHigh, ruleIDVulnerabilityMedium, ruleIDVulnerabilityMinor}
// New creates a new instance of Codacy Trivy.
func New() codacyTrivy {
@@ -310,7 +311,9 @@ func getRuleIDFromTrivySeverity(severity string) (string, error) {
return ruleIDVulnerabilityMinor, nil
case trivySeverityMedium:
return ruleIDVulnerabilityMedium, nil
- case trivySeverityHigh, trivySeverityCritical:
+ case trivySeverityHigh:
+ return ruleIDVulnerabilityHigh, nil
+ case trivySeverityCritical:
return ruleIDVulnerability, nil
default:
return "", &ToolError{msg: fmt.Sprintf("Failed to run Codacy Trivy: unexpected Trivy severity %s", severity)}
@@ -324,7 +327,9 @@ func getTrivySeveritiesFromPatterns(patterns []codacy.Pattern) []dbTypes.Severit
for _, pattern := range patterns {
switch strings.ToLower(pattern.ID) {
case ruleIDVulnerability:
- trivySeverities = append(trivySeverities, dbTypes.SeverityCritical, dbTypes.SeverityHigh)
+ trivySeverities = append(trivySeverities, dbTypes.SeverityCritical)
+ case ruleIDVulnerabilityHigh:
+ trivySeverities = append(trivySeverities, dbTypes.SeverityHigh)
case ruleIDVulnerabilityMedium:
trivySeverities = append(trivySeverities, dbTypes.SeverityMedium)
case ruleIDVulnerabilityMinor:
diff --git a/internal/tool/tool_test.go b/internal/tool/tool_test.go
index dee031ee..7582bf67 100644
--- a/internal/tool/tool_test.go
+++ b/internal/tool/tool_test.go
@@ -70,6 +70,9 @@ func TestRun(t *testing.T) {
{
ID: ruleIDVulnerability,
},
+ {
+ ID: ruleIDVulnerabilityHigh,
+ },
{
ID: "unknown",
},
@@ -233,7 +236,7 @@ func TestRun(t *testing.T) {
{
File: fileName,
Line: 1,
- PatternID: ruleIDVulnerability,
+ PatternID: ruleIDVulnerabilityHigh,
Message: "Insecure dependency type/@namespace/package-1@version+incompatible (vuln id no fixed version: vuln no fixed version) (no fix available)",
SourceID: "vuln id no fixed version",
},
@@ -614,7 +617,7 @@ func TestGetRuleIdFromTrivySeverity(t *testing.T) {
},
"high": {
trivySeverity: "hiGh",
- expectedRuleID: ruleIDVulnerability,
+ expectedRuleID: ruleIDVulnerabilityHigh,
},
"critical": {
trivySeverity: "CrItIcAl",
@@ -642,6 +645,7 @@ func TestGetTrivySeveritiesFromPatterns(t *testing.T) {
// Assert
patterns := []codacy.Pattern{
{ID: ruleIDVulnerability},
+ {ID: ruleIDVulnerabilityHigh},
{ID: ruleIDVulnerabilityMedium},
{ID: ruleIDVulnerabilityMinor},
{ID: ruleIDSecret},