Skip to content

Commit 3824bf4

Browse files
nscuronscuro
committed
Implement user-managed vuln policies
* Allows users to manage vulnerability policies via REST API (and consequently REST API). Previously, vuln policies could only be used with bundles, which required an external file server. * Paves the way for support of multiple bundles. Introduces a default bundle to bridge the gap with the previous behaviour. * Adds the concept of priorities to enable deterministic evaluation order. * Removes S3 support for bundle retrieval. We have no actual requirement for this yet. * Migrates all endpoints related to vuln policies to API v2. * Refactors the sync task to a dex workflow. Signed-off-by: nscuro <nscuro@protonmail.com>
1 parent d642c25 commit 3824bf4

File tree

70 files changed

+4182
-3332
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

70 files changed

+4182
-3332
lines changed

‎api/src/main/openapi/components/schemas/invalid-vuln-policy-condition-problem-details.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# This file is part of Dependency-Track.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
# SPDX-License-Identifier: Apache-2.0
16+
# Copyright (c) OWASP Foundation. All Rights Reserved.
17+
type: object
18+
allOf:
19+
- $ref: "./problem-details.yaml"
20+
properties:
21+
errors:
22+
type: array
23+
items:
24+
$ref: "./vuln-policy-condition-error.yaml"
25+
required:
26+
- errors

‎api/src/main/openapi/components/schemas/vuln-policies/create-vuln-policy-request.yaml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
# This file is part of Dependency-Track.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
# SPDX-License-Identifier: Apache-2.0
16+
# Copyright (c) OWASP Foundation. All Rights Reserved.
17+
type: object
18+
properties:
19+
name:
20+
type: string
21+
minLength: 1
22+
maxLength: 255
23+
description:
24+
type: string
25+
maxLength: 512
26+
author:
27+
type: string
28+
maxLength: 255
29+
conditions:
30+
type: array
31+
items:
32+
type: string
33+
maxLength: 2048
34+
minItems: 1
35+
maxItems: 10
36+
analysis:
37+
$ref: "./vuln-policy-analysis.yaml"
38+
ratings:
39+
type: array
40+
items:
41+
$ref: "./vuln-policy-rating.yaml"
42+
maxItems: 3
43+
operation_mode:
44+
$ref: "./vuln-policy-operation-mode.yaml"
45+
priority:
46+
type: integer
47+
format: int32
48+
minimum: 0
49+
maximum: 100
50+
default: 0
51+
valid_from:
52+
$ref: "../../schemas/timestamp.yaml"
53+
valid_until:
54+
$ref: "../../schemas/timestamp.yaml"
55+
required:
56+
- name
57+
- conditions
58+
- analysis

‎api/src/main/openapi/components/schemas/vuln-policies/get-vuln-policy-response.yaml‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
# This file is part of Dependency-Track.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
# SPDX-License-Identifier: Apache-2.0
16+
# Copyright (c) OWASP Foundation. All Rights Reserved.
17+
type: object
18+
properties:
19+
uuid:
20+
type: string
21+
format: uuid
22+
name:
23+
type: string
24+
description:
25+
type: string
26+
author:
27+
type: string
28+
conditions:
29+
type: array
30+
items:
31+
type: string
32+
analysis:
33+
$ref: "./vuln-policy-analysis.yaml"
34+
ratings:
35+
type: array
36+
items:
37+
$ref: "./vuln-policy-rating.yaml"
38+
maxItems: 3
39+
operation_mode:
40+
$ref: "./vuln-policy-operation-mode.yaml"
41+
priority:
42+
type: integer
43+
format: int32
44+
minimum: 0
45+
maximum: 100
46+
source:
47+
$ref: "./vuln-policy-source.yaml"
48+
valid_from:
49+
$ref: "../../schemas/timestamp.yaml"
50+
valid_until:
51+
$ref: "../../schemas/timestamp.yaml"
52+
created:
53+
$ref: "../../schemas/timestamp.yaml"
54+
readOnly: true
55+
updated:
56+
$ref: "../../schemas/timestamp.yaml"
57+
readOnly: true
58+
required:
59+
- uuid
60+
- name
61+
- conditions
62+
- analysis
63+
- operation_mode
64+
- priority
65+
- source

‎api/src/main/openapi/components/schemas/vuln-policies/list-vuln-policies-response-item.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# This file is part of Dependency-Track.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
# SPDX-License-Identifier: Apache-2.0
16+
# Copyright (c) OWASP Foundation. All Rights Reserved.
17+
type: object
18+
properties:
19+
uuid:
20+
type: string
21+
format: uuid
22+
name:
23+
type: string
24+
description:
25+
type: string
26+
author:
27+
type: string
28+
priority:
29+
type: integer
30+
format: int32
31+
operation_mode:
32+
$ref: "./vuln-policy-operation-mode.yaml"
33+
source:
34+
$ref: "./vuln-policy-source.yaml"
35+
required:
36+
- uuid
37+
- name
38+
- priority
39+
- operation_mode
40+
- source

‎api/src/main/openapi/components/schemas/vuln-policies/list-vuln-policies-response.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# This file is part of Dependency-Track.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
# SPDX-License-Identifier: Apache-2.0
16+
# Copyright (c) OWASP Foundation. All Rights Reserved.
17+
type: object
18+
allOf:
19+
- $ref: "../paginated-response.yaml"
20+
properties:
21+
items:
22+
type: array
23+
items:
24+
$ref: "./list-vuln-policies-response-item.yaml"
25+
required:
26+
- total
27+
- items

‎api/src/main/openapi/components/schemas/vuln-policies/list-vuln-policy-bundles-response-item.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# This file is part of Dependency-Track.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
# SPDX-License-Identifier: Apache-2.0
16+
# Copyright (c) OWASP Foundation. All Rights Reserved.
17+
type: object
18+
properties:
19+
uuid:
20+
type: string
21+
format: uuid
22+
url:
23+
type: string
24+
hash:
25+
type: string
26+
last_successful_sync:
27+
$ref: "../../schemas/timestamp.yaml"
28+
created:
29+
$ref: "../../schemas/timestamp.yaml"
30+
updated:
31+
$ref: "../../schemas/timestamp.yaml"
32+
required:
33+
- uuid
34+
- url

‎api/src/main/openapi/components/schemas/vuln-policies/list-vuln-policy-bundles-response.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# This file is part of Dependency-Track.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
# SPDX-License-Identifier: Apache-2.0
16+
# Copyright (c) OWASP Foundation. All Rights Reserved.
17+
type: object
18+
properties:
19+
items:
20+
type: array
21+
items:
22+
$ref: "./list-vuln-policy-bundles-response-item.yaml"
23+
required:
24+
- items

‎api/src/main/openapi/components/schemas/vuln-policies/update-vuln-policy-request.yaml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
# This file is part of Dependency-Track.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
# SPDX-License-Identifier: Apache-2.0
16+
# Copyright (c) OWASP Foundation. All Rights Reserved.
17+
type: object
18+
properties:
19+
name:
20+
type: string
21+
minLength: 1
22+
maxLength: 255
23+
description:
24+
type: string
25+
maxLength: 512
26+
author:
27+
type: string
28+
maxLength: 255
29+
conditions:
30+
type: array
31+
items:
32+
type: string
33+
maxLength: 2048
34+
minItems: 1
35+
maxItems: 10
36+
analysis:
37+
$ref: "./vuln-policy-analysis.yaml"
38+
ratings:
39+
type: array
40+
items:
41+
$ref: "./vuln-policy-rating.yaml"
42+
maxItems: 3
43+
operation_mode:
44+
$ref: "./vuln-policy-operation-mode.yaml"
45+
priority:
46+
type: integer
47+
format: int32
48+
minimum: 0
49+
maximum: 100
50+
default: 0
51+
valid_from:
52+
$ref: "../../schemas/timestamp.yaml"
53+
valid_until:
54+
$ref: "../../schemas/timestamp.yaml"
55+
required:
56+
- name
57+
- conditions
58+
- analysis

‎api/src/main/openapi/components/schemas/vuln-policies/vuln-policy-analysis.yaml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# This file is part of Dependency-Track.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
# SPDX-License-Identifier: Apache-2.0
16+
# Copyright (c) OWASP Foundation. All Rights Reserved.
17+
type: object
18+
properties:
19+
state:
20+
type: string
21+
enum:
22+
- EXPLOITABLE
23+
- IN_TRIAGE
24+
- FALSE_POSITIVE
25+
- NOT_AFFECTED
26+
- RESOLVED
27+
justification:
28+
type: string
29+
enum:
30+
- CODE_NOT_PRESENT
31+
- CODE_NOT_REACHABLE
32+
- REQUIRES_CONFIGURATION
33+
- REQUIRES_DEPENDENCY
34+
- REQUIRES_ENVIRONMENT
35+
- PROTECTED_BY_COMPILER
36+
- PROTECTED_AT_RUNTIME
37+
- PROTECTED_AT_PERIMETER
38+
- PROTECTED_BY_MITIGATING_CONTROL
39+
vendor_response:
40+
type: string
41+
enum:
42+
- CAN_NOT_FIX
43+
- WILL_NOT_FIX
44+
- UPDATE
45+
- ROLLBACK
46+
- WORKAROUND_AVAILABLE
47+
details:
48+
type: string
49+
suppress:
50+
type: boolean
51+
default: false
52+
required:
53+
- state

0 commit comments

Comments
 (0)