Skip to content

Commit 02b65b4

Browse files
nscuronscuro
committed
Implement user-managed vuln policies
* Allows users to manage vulnerability policies via REST API (and consequently REST API). Previously, vuln policies could only be used with bundles, which required an external file server. * Paves the way for support of multiple bundles. Introduces a default bundle to bridge the gap with the previous behaviour. * Adds the concept of priorities to enable deterministic evaluation order. * Simplifies vuln policy management by switching from multiple conditions to only a single condition per policy. Having multiple conditions is largely useless given CEL is more expressive for combining multiple conditions. * Removes S3 support for bundle retrieval. We have no actual requirement for this yet. * Migrates all endpoints related to vuln policies to API v2. * Refactors the sync task to a dex workflow. Signed-off-by: nscuro <nscuro@protonmail.com>
1 parent efeb037 commit 02b65b4

File tree

98 files changed

+4323
-4753
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

98 files changed

+4323
-4753
lines changed

‎api/src/main/openapi/components/schemas/invalid-vuln-policy-condition-problem-details.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# This file is part of Dependency-Track.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
# SPDX-License-Identifier: Apache-2.0
16+
# Copyright (c) OWASP Foundation. All Rights Reserved.
17+
type: object
18+
allOf:
19+
- $ref: "./problem-details.yaml"
20+
properties:
21+
errors:
22+
type: array
23+
items:
24+
$ref: "./vuln-policy-condition-error.yaml"
25+
required:
26+
- errors

‎api/src/main/openapi/components/schemas/vuln-policies/create-vuln-policy-request.yaml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# This file is part of Dependency-Track.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
# SPDX-License-Identifier: Apache-2.0
16+
# Copyright (c) OWASP Foundation. All Rights Reserved.
17+
type: object
18+
properties:
19+
name:
20+
type: string
21+
minLength: 1
22+
maxLength: 255
23+
description:
24+
type: string
25+
maxLength: 512
26+
author:
27+
type: string
28+
maxLength: 255
29+
condition:
30+
type: string
31+
maxLength: 4096
32+
minLength: 1
33+
analysis:
34+
$ref: "./vuln-policy-analysis.yaml"
35+
ratings:
36+
type: array
37+
items:
38+
$ref: "./vuln-policy-rating.yaml"
39+
maxItems: 3
40+
operation_mode:
41+
$ref: "./vuln-policy-operation-mode.yaml"
42+
priority:
43+
type: integer
44+
format: int32
45+
minimum: 0
46+
maximum: 100
47+
default: 0
48+
valid_from:
49+
$ref: "../../schemas/timestamp.yaml"
50+
valid_until:
51+
$ref: "../../schemas/timestamp.yaml"
52+
required:
53+
- name
54+
- condition
55+
- analysis

‎api/src/main/openapi/components/schemas/vuln-policies/get-vuln-policy-response.yaml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# This file is part of Dependency-Track.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
# SPDX-License-Identifier: Apache-2.0
16+
# Copyright (c) OWASP Foundation. All Rights Reserved.
17+
type: object
18+
properties:
19+
uuid:
20+
type: string
21+
format: uuid
22+
name:
23+
type: string
24+
description:
25+
type: string
26+
author:
27+
type: string
28+
condition:
29+
type: string
30+
analysis:
31+
$ref: "./vuln-policy-analysis.yaml"
32+
ratings:
33+
type: array
34+
items:
35+
$ref: "./vuln-policy-rating.yaml"
36+
maxItems: 3
37+
operation_mode:
38+
$ref: "./vuln-policy-operation-mode.yaml"
39+
priority:
40+
type: integer
41+
format: int32
42+
minimum: 0
43+
maximum: 100
44+
source:
45+
$ref: "./vuln-policy-source.yaml"
46+
valid_from:
47+
$ref: "../../schemas/timestamp.yaml"
48+
valid_until:
49+
$ref: "../../schemas/timestamp.yaml"
50+
created:
51+
$ref: "../../schemas/timestamp.yaml"
52+
readOnly: true
53+
updated:
54+
$ref: "../../schemas/timestamp.yaml"
55+
readOnly: true
56+
required:
57+
- uuid
58+
- name
59+
- condition
60+
- analysis
61+
- operation_mode
62+
- priority
63+
- source

‎api/src/main/openapi/components/schemas/vuln-policies/list-vuln-policies-response-item.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# This file is part of Dependency-Track.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
# SPDX-License-Identifier: Apache-2.0
16+
# Copyright (c) OWASP Foundation. All Rights Reserved.
17+
type: object
18+
properties:
19+
uuid:
20+
type: string
21+
format: uuid
22+
name:
23+
type: string
24+
description:
25+
type: string
26+
author:
27+
type: string
28+
priority:
29+
type: integer
30+
format: int32
31+
operation_mode:
32+
$ref: "./vuln-policy-operation-mode.yaml"
33+
source:
34+
$ref: "./vuln-policy-source.yaml"
35+
required:
36+
- uuid
37+
- name
38+
- priority
39+
- operation_mode
40+
- source

‎api/src/main/openapi/components/schemas/vuln-policies/list-vuln-policies-response.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# This file is part of Dependency-Track.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
# SPDX-License-Identifier: Apache-2.0
16+
# Copyright (c) OWASP Foundation. All Rights Reserved.
17+
type: object
18+
allOf:
19+
- $ref: "../paginated-response.yaml"
20+
properties:
21+
items:
22+
type: array
23+
items:
24+
$ref: "./list-vuln-policies-response-item.yaml"
25+
required:
26+
- total
27+
- items

‎api/src/main/openapi/components/schemas/vuln-policies/list-vuln-policy-bundles-response-item.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# This file is part of Dependency-Track.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
# SPDX-License-Identifier: Apache-2.0
16+
# Copyright (c) OWASP Foundation. All Rights Reserved.
17+
type: object
18+
properties:
19+
uuid:
20+
type: string
21+
format: uuid
22+
url:
23+
type: string
24+
hash:
25+
type: string
26+
last_successful_sync:
27+
$ref: "../../schemas/timestamp.yaml"
28+
created:
29+
$ref: "../../schemas/timestamp.yaml"
30+
updated:
31+
$ref: "../../schemas/timestamp.yaml"
32+
required:
33+
- uuid
34+
- url

‎api/src/main/openapi/components/schemas/vuln-policies/list-vuln-policy-bundles-response.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# This file is part of Dependency-Track.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
# SPDX-License-Identifier: Apache-2.0
16+
# Copyright (c) OWASP Foundation. All Rights Reserved.
17+
type: object
18+
allOf:
19+
- $ref: "../paginated-response.yaml"
20+
properties:
21+
items:
22+
type: array
23+
items:
24+
$ref: "./list-vuln-policy-bundles-response-item.yaml"
25+
required:
26+
- items
27+
- total

‎api/src/main/openapi/components/schemas/vuln-policies/update-vuln-policy-request.yaml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# This file is part of Dependency-Track.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
# SPDX-License-Identifier: Apache-2.0
16+
# Copyright (c) OWASP Foundation. All Rights Reserved.
17+
type: object
18+
properties:
19+
name:
20+
type: string
21+
minLength: 1
22+
maxLength: 255
23+
description:
24+
type: string
25+
maxLength: 512
26+
author:
27+
type: string
28+
maxLength: 255
29+
condition:
30+
type: string
31+
maxLength: 4096
32+
minLength: 1
33+
analysis:
34+
$ref: "./vuln-policy-analysis.yaml"
35+
ratings:
36+
type: array
37+
items:
38+
$ref: "./vuln-policy-rating.yaml"
39+
maxItems: 3
40+
operation_mode:
41+
$ref: "./vuln-policy-operation-mode.yaml"
42+
priority:
43+
type: integer
44+
format: int32
45+
minimum: 0
46+
maximum: 100
47+
default: 0
48+
valid_from:
49+
$ref: "../../schemas/timestamp.yaml"
50+
valid_until:
51+
$ref: "../../schemas/timestamp.yaml"
52+
required:
53+
- name
54+
- condition
55+
- analysis

‎api/src/main/openapi/components/schemas/vuln-policies/vuln-policy-analysis.yaml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# This file is part of Dependency-Track.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
# SPDX-License-Identifier: Apache-2.0
16+
# Copyright (c) OWASP Foundation. All Rights Reserved.
17+
type: object
18+
properties:
19+
state:
20+
type: string
21+
enum:
22+
- EXPLOITABLE
23+
- IN_TRIAGE
24+
- FALSE_POSITIVE
25+
- NOT_AFFECTED
26+
- RESOLVED
27+
justification:
28+
type: string
29+
enum:
30+
- CODE_NOT_PRESENT
31+
- CODE_NOT_REACHABLE
32+
- REQUIRES_CONFIGURATION
33+
- REQUIRES_DEPENDENCY
34+
- REQUIRES_ENVIRONMENT
35+
- PROTECTED_BY_COMPILER
36+
- PROTECTED_AT_RUNTIME
37+
- PROTECTED_AT_PERIMETER
38+
- PROTECTED_BY_MITIGATING_CONTROL
39+
vendor_response:
40+
type: string
41+
enum:
42+
- CAN_NOT_FIX
43+
- WILL_NOT_FIX
44+
- UPDATE
45+
- ROLLBACK
46+
- WORKAROUND_AVAILABLE
47+
details:
48+
type: string
49+
suppress:
50+
type: boolean
51+
default: false
52+
required:
53+
- state

0 commit comments

Comments
 (0)