Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Undetermined reason for undetermined contextual analysis status #155

Merged
merged 14 commits into from
Sep 12, 2024
Merged

Undetermined reason for undetermined contextual analysis status #155

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
d5c433a
Undetermined reason for undetermined contextual analysis status
barv-jfrog Aug 25, 2024
92ed481
Undetermined reason for undetermined contextual analysis status
barv-jfrog Aug 25, 2024
6563175
Undetermined reason for undetermined contextual analysis status
barv-jfrog Aug 25, 2024
7e21a31
Merge branch 'dev' into undetermined-text
barv-jfrog Aug 28, 2024
2131ae5
Merge branch 'dev' into undetermined-text
barv-jfrog Sep 3, 2024
83ecc95
sarif utils fixes
barv-jfrog Sep 5, 2024
7acda7f
undetermined text fixes
barv-jfrog Sep 5, 2024
c65d385
undetermined text fixes
barv-jfrog Sep 5, 2024
58bb739
undetermined text fixes
barv-jfrog Sep 5, 2024
a443a30
undetermined text fixes
barv-jfrog Sep 5, 2024
8001482
Merge branch 'dev' into undetermined-text
barv-jfrog Sep 5, 2024
4d3773f
Merge branch 'dev' of https://github.com/jfrog/jfrog-cli-security int…
barv-jfrog Sep 5, 2024
61962a3
undetermined text fixes
barv-jfrog Sep 5, 2024
b931f91
Merge remote-tracking branch 'origin/undetermined-text' into undeterm…
barv-jfrog Sep 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions formats/sarifutils/sarifutils.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -395,6 +395,17 @@ func GetRuleShortDescriptionText(rule *sarif.ReportingDescriptor) string {
return ""
}

func GetRuleProperty(key string, rule *sarif.ReportingDescriptor) string {
if rule != nil && rule.Properties != nil && rule.Properties[key] != nil {
prop, ok := rule.Properties[key].(string)
if !ok {
return ""
}
return prop
}
return ""
}

func GetRunRules(run *sarif.Run) []*sarif.ReportingDescriptor {
if run != nil && run.Tool.Driver != nil {
return run.Tool.Driver.Rules
Expand Down
15 changes: 11 additions & 4 deletions formats/sarifutils/test_sarifutils.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
package sarifutils

import "github.com/owenrumney/go-sarif/v2/sarif"
import (
"github.com/owenrumney/go-sarif/v2/sarif"
)

func CreateRunWithDummyResultsInWd(wd string, results ...*sarif.Result) *sarif.Run {
return createRunWithDummyResults("", results...).WithInvocations([]*sarif.Invocation{sarif.NewInvocation().WithWorkingDirectory(sarif.NewSimpleArtifactLocation(wd))})
Expand Down Expand Up @@ -33,14 +35,19 @@ func createRunWithDummyResults(toolName string, results ...*sarif.Result) *sarif
return run
}

func CreateRunWithDummyResultAndRuleProperties(property, value string, result *sarif.Result) *sarif.Run {
func CreateRunWithDummyResultAndRuleProperties(result *sarif.Result, properties, values []string) *sarif.Run {
if len(properties) != len(values) {
return nil
}
run := sarif.NewRunWithInformationURI("", "")
if result.RuleID != nil {
run.AddRule(*result.RuleID)
}
run.AddResult(result)
run.Tool.Driver.Rules[0].Properties = make(sarif.Properties)
run.Tool.Driver.Rules[0].Properties[property] = value
run.Tool.Driver.Rules[0].Properties = make(sarif.Properties, len(properties))
for index := range properties {
run.Tool.Driver.Rules[0].Properties[properties[index]] = values[index]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggest makeing sure that len(values)==len(properties)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

right, fixed

}
return run
}

Expand Down
1 change: 1 addition & 0 deletions formats/simplejsonapi.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,7 @@ type CveRow struct {
type Applicability struct {
Status string `json:"status"`
ScannerDescription string `json:"scannerDescription,omitempty"`
UndeterminedReason string `json:"undeterminedReason,omitempty"`
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

where do we use it? UndeterminedReason is being inserted into - but not called...

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is only in simple-json, and it is under CveRow (CveRow has Applicability struct as one of its components, it gets printed automatically)

Evidence []Evidence `json:"evidence,omitempty"`
}

Expand Down
5 changes: 5 additions & 0 deletions utils/resultstable.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -937,6 +937,7 @@ func getCveApplicabilityField(cveId string, applicabilityScanResults []*sarif.Ru
if rule, _ := applicabilityRun.GetRuleById(jasutils.CveToApplicabilityRuleId(cveId)); rule != nil {
applicability.ScannerDescription = sarifutils.GetRuleFullDescriptionText(rule)
status := getApplicabilityStatusFromRule(rule)
applicability.UndeterminedReason = GetRuleUndeterminedReason(rule)
if status != "" {
applicabilityStatuses = append(applicabilityStatuses, status)
}
Expand Down Expand Up @@ -1025,6 +1026,10 @@ func extractDependencyNameFromComponent(key string, techIdentifier string) (depe
return
}

func GetRuleUndeterminedReason(rule *sarif.ReportingDescriptor) string {
return sarifutils.GetRuleProperty("undetermined_reason", rule)
}

func getApplicabilityStatusFromRule(rule *sarif.ReportingDescriptor) jasutils.ApplicabilityStatus {
if rule.Properties["applicability"] != nil {
status, ok := rule.Properties["applicability"].(string)
Expand Down
27 changes: 20 additions & 7 deletions utils/resultstable_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -682,9 +682,9 @@ func TestGetApplicableCveValue(t *testing.T) {
name: "new scan statuses - applicable wins all statuses",
scanResults: &ExtendedScanResults{
ApplicabilityScanResults: []*sarif.Run{
sarifutils.CreateRunWithDummyResultAndRuleProperties("applicability", "applicable", sarifutils.CreateDummyPassingResult("applic_testCve1")),
sarifutils.CreateRunWithDummyResultAndRuleProperties("applicability", "not_applicable", sarifutils.CreateDummyPassingResult("applic_testCve2")),
sarifutils.CreateRunWithDummyResultAndRuleProperties("applicability", "not_covered", sarifutils.CreateDummyPassingResult("applic_testCve3")),
sarifutils.CreateRunWithDummyResultAndRuleProperties(sarifutils.CreateDummyPassingResult("applic_testCve1"), []string{"applicability"}, []string{"applicable"}),
sarifutils.CreateRunWithDummyResultAndRuleProperties(sarifutils.CreateDummyPassingResult("applic_testCve2"), []string{"applicability"}, []string{"not_applicable"}),
sarifutils.CreateRunWithDummyResultAndRuleProperties(sarifutils.CreateDummyPassingResult("applic_testCve3"), []string{"applicability"}, []string{"not_covered"}),
},
EntitledForJas: true},
cves: []services.Cve{{Id: "testCve1"}, {Id: "testCve2"}, {Id: "testCve3"}},
Expand All @@ -698,8 +698,8 @@ func TestGetApplicableCveValue(t *testing.T) {
name: "new scan statuses - not covered wins not applicable",
scanResults: &ExtendedScanResults{
ApplicabilityScanResults: []*sarif.Run{
sarifutils.CreateRunWithDummyResultAndRuleProperties("applicability", "not_covered", sarifutils.CreateDummyPassingResult("applic_testCve1")),
sarifutils.CreateRunWithDummyResultAndRuleProperties("applicability", "not_applicable", sarifutils.CreateDummyPassingResult("applic_testCve2")),
sarifutils.CreateRunWithDummyResultAndRuleProperties(sarifutils.CreateDummyPassingResult("applic_testCve1"), []string{"applicability"}, []string{"not_covered"}),
sarifutils.CreateRunWithDummyResultAndRuleProperties(sarifutils.CreateDummyPassingResult("applic_testCve2"), []string{"applicability"}, []string{"not_applicable"}),
},
EntitledForJas: true},
cves: []services.Cve{{Id: "testCve1"}, {Id: "testCve2"}},
Expand All @@ -712,8 +712,8 @@ func TestGetApplicableCveValue(t *testing.T) {
name: "new scan statuses - undetermined wins not covered",
scanResults: &ExtendedScanResults{
ApplicabilityScanResults: []*sarif.Run{
sarifutils.CreateRunWithDummyResultAndRuleProperties("applicability", "not_covered", sarifutils.CreateDummyPassingResult("applic_testCve1")),
sarifutils.CreateRunWithDummyResultAndRuleProperties("applicability", "undetermined", sarifutils.CreateDummyPassingResult("applic_testCve2")),
sarifutils.CreateRunWithDummyResultAndRuleProperties(sarifutils.CreateDummyPassingResult("applic_testCve1"), []string{"applicability"}, []string{"not_covered"}),
sarifutils.CreateRunWithDummyResultAndRuleProperties(sarifutils.CreateDummyPassingResult("applic_testCve2"), []string{"applicability"}, []string{"undetermined"}),
},
EntitledForJas: true},
cves: []services.Cve{{Id: "testCve1"}, {Id: "testCve2"}},
Expand All @@ -722,6 +722,19 @@ func TestGetApplicableCveValue(t *testing.T) {
{Id: "testCve2", Applicability: &formats.Applicability{Status: jasutils.ApplicabilityUndetermined.String()}},
},
},
{
name: "undetermined with undetermined reason",
scanResults: &ExtendedScanResults{
ApplicabilityScanResults: []*sarif.Run{
sarifutils.CreateRunWithDummyResultAndRuleProperties(sarifutils.CreateDummyPassingResult("applic_testCve2"), []string{"applicability", "undetermined_reason"}, []string{"undetermined", "however"}),
},
EntitledForJas: true},
cves: []services.Cve{{Id: "testCve2"}},
expectedResult: jasutils.ApplicabilityUndetermined,
expectedCves: []formats.CveRow{
{Id: "testCve2", Applicability: &formats.Applicability{Status: jasutils.ApplicabilityUndetermined.String(), UndeterminedReason: "however"}},
},
},
}

for _, testCase := range testCases {
Expand Down
9 changes: 4 additions & 5 deletions utils/resultwriter_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -674,7 +674,7 @@ func TestPatchRunsToPassIngestionRules(t *testing.T) {
cmdResult: &Results{ResultType: DockerImage, ScaResults: []*ScaScanResult{{Name: "dockerImage:imageVersion"}}},
subScan: ScaScan,
input: []*sarif.Run{
sarifutils.CreateRunWithDummyResultAndRuleProperties("applicability", "applicable", sarifutils.CreateDummyResultWithPathAndLogicalLocation("sha256__f752cb05a39e65f231a3c47c2e08cbeac1c15e4daff0188cb129c12a3ea3049d", "f752cb05a39e65f231a3c47c2e08cbeac1c15e4daff0188cb129c12a3ea3049d", "layer", "algorithm", "sha256").WithMessage(sarif.NewTextMessage("some-msg"))).
sarifutils.CreateRunWithDummyResultAndRuleProperties(sarifutils.CreateDummyResultWithPathAndLogicalLocation("sha256__f752cb05a39e65f231a3c47c2e08cbeac1c15e4daff0188cb129c12a3ea3049d", "f752cb05a39e65f231a3c47c2e08cbeac1c15e4daff0188cb129c12a3ea3049d", "layer", "algorithm", "sha256").WithMessage(sarif.NewTextMessage("some-msg")), []string{"applicability"}, []string{"applicable"}).
WithInvocations([]*sarif.Invocation{
sarif.NewInvocation().WithWorkingDirectory(sarif.NewSimpleArtifactLocation(wd)),
},
Expand All @@ -684,10 +684,9 @@ func TestPatchRunsToPassIngestionRules(t *testing.T) {
),
},
expectedResults: []*sarif.Run{
sarifutils.CreateRunWithDummyResultAndRuleProperties("applicability", "applicable",
sarifutils.CreateDummyResultWithFingerprint("some-msg\nImage: dockerImage:imageVersion\nLayer (sha256): f752cb05a39e65f231a3c47c2e08cbeac1c15e4daff0188cb129c12a3ea3049d", "some-msg", jfrogFingerprintAlgorithmName, "9522c1d915eef55b4a0dc9e160bf5dc7",
sarifutils.CreateDummyLocationWithPathAndLogicalLocation("sha256__f752cb05a39e65f231a3c47c2e08cbeac1c15e4daff0188cb129c12a3ea3049d", "f752cb05a39e65f231a3c47c2e08cbeac1c15e4daff0188cb129c12a3ea3049d", "layer", "algorithm", "sha256"),
),
sarifutils.CreateRunWithDummyResultAndRuleProperties(sarifutils.CreateDummyResultWithFingerprint("some-msg\nImage: dockerImage:imageVersion\nLayer (sha256): f752cb05a39e65f231a3c47c2e08cbeac1c15e4daff0188cb129c12a3ea3049d", "some-msg", jfrogFingerprintAlgorithmName, "9522c1d915eef55b4a0dc9e160bf5dc7",
sarifutils.CreateDummyLocationWithPathAndLogicalLocation("sha256__f752cb05a39e65f231a3c47c2e08cbeac1c15e4daff0188cb129c12a3ea3049d", "f752cb05a39e65f231a3c47c2e08cbeac1c15e4daff0188cb129c12a3ea3049d", "layer", "algorithm", "sha256"),
), []string{"applicability"}, []string{"applicable"},
).WithInvocations([]*sarif.Invocation{
sarif.NewInvocation().WithWorkingDirectory(sarif.NewSimpleArtifactLocation(wd)),
}),
Expand Down
Loading