Skip to content

Commit 71c87bb

Browse files
G-RathG-Rath
committed
feat: don't filter when ignoring all vulns
1 parent 7e4942a commit 71c87bb

2 files changed

Lines changed: 61 additions & 65 deletions

File tree

‎cmd/osv-scanner/scan/source/__snapshots__/command_test.snap‎

Lines changed: 46 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -5895,17 +5895,9 @@ Filtered 2 ignored package/s from the scan.
58955895
<tempdir>/nested-2/osv-scanner-test.toml has been updated to ignore 3 vulnerabilities
58965896
<tempdir>/nested-3/osv-scanner-test.toml has been updated to ignore 1 vulnerability
58975897
<tempdir>/osv-scanner-test.toml has been updated to ignore 2 vulnerabilities
5898-
CVE-2021-23424 and 1 alias have been filtered out because: Test manifest file (package-lock.json)
5899-
GHSA-2g4f-4pwh-qvx6 and 1 alias have been filtered out because: (no reason given)
5900-
GHSA-2g4f-4pwh-qvx6 and 1 alias have been filtered out because: (no reason given)
5901-
Filtered 3 vulnerabilities from output
5902-
<tempdir>/nested-2/osv-scanner-test.toml has unused ignores:
5903-
- GHSA-2g4f-4pwh-qvx6
5904-
<tempdir>/nested-3/osv-scanner-test.toml has unused ignores:
5905-
- GHSA-2g4f-4pwh-qvx6
59065898

5907-
Total 7 packages affected by 8 known vulnerabilities (0 Critical, 3 High, 5 Medium, 0 Low, 0 Unknown) from 2 ecosystems.
5908-
8 vulnerabilities can be fixed.
5899+
Total 9 packages affected by 11 known vulnerabilities (0 Critical, 4 High, 7 Medium, 0 Low, 0 Unknown) from 2 ecosystems.
5900+
11 vulnerabilities can be fixed.
59095901

59105902
RubyGems
59115903

@@ -5919,7 +5911,7 @@ lockfile:<tempdir>/Gemfile.lock: found 1 package with issues
59195911

59205912
npm
59215913

5922-
lockfile:<tempdir>/nested-1/package-lock.json: found 2 packages with issues
5914+
lockfile:<tempdir>/nested-1/package-lock.json: found 3 packages with issues
59235915

59245916
ajv@6.0.0 has the following known vulnerabilities:
59255917
GHSA-2g4f-4pwh-qvx6: ajv has ReDoS when using `$data` option
@@ -5929,19 +5921,27 @@ lockfile:<tempdir>/nested-1/package-lock.json: found 2 packages with issues
59295921
ajv@8.0.0 has the following known vulnerabilities:
59305922
GHSA-2g4f-4pwh-qvx6: ajv has ReDoS when using `$data` option
59315923
Severity: '5.5'; Minimal Fix Version: '8.18.0';
5924+
ansi-html@0.0.1 has the following known vulnerabilities:
5925+
GHSA-whgm-jr23-g3j9: Uncontrolled Resource Consumption in ansi-html
5926+
Severity: '7.5'; Minimal Fix Version: '0.0.8';
59325927

5933-
3 known vulnerabilities found in lockfile:<tempdir>/nested-1/package-lock.json
5928+
4 known vulnerabilities found in lockfile:<tempdir>/nested-1/package-lock.json
59345929

5935-
lockfile:<tempdir>/nested-2/package-lock.json: found 2 packages with issues
5930+
lockfile:<tempdir>/nested-2/package-lock.json: found 3 packages with issues
59365931

59375932
ajv@6.0.0 has the following known vulnerabilities:
5933+
GHSA-2g4f-4pwh-qvx6: ajv has ReDoS when using `$data` option
5934+
Severity: '5.5'; Minimal Fix Version: '6.14.0';
59385935
GHSA-v88g-cgmw-v5xw: Prototype Pollution in Ajv
59395936
Severity: '5.6'; Minimal Fix Version: '6.12.3';
5937+
ajv@8.0.0 has the following known vulnerabilities:
5938+
GHSA-2g4f-4pwh-qvx6: ajv has ReDoS when using `$data` option
5939+
Severity: '5.5'; Minimal Fix Version: '8.18.0';
59405940
ansi-html@0.0.1 has the following known vulnerabilities:
59415941
GHSA-whgm-jr23-g3j9: Uncontrolled Resource Consumption in ansi-html
59425942
Severity: '7.5'; Minimal Fix Version: '0.0.8';
59435943

5944-
2 known vulnerabilities found in lockfile:<tempdir>/nested-2/package-lock.json
5944+
4 known vulnerabilities found in lockfile:<tempdir>/nested-2/package-lock.json
59455945

59465946
lockfile:<tempdir>/nested-3/package-lock.json: found 1 package with issues
59475947

@@ -6072,8 +6072,6 @@ Package npm/ajv/6.0.0 has been filtered out because: (no reason given)
60726072
Package npm/ajv/8.0.0 has been filtered out because: (no reason given)
60736073
Filtered 2 ignored package/s from the scan.
60746074
<tempdir>/nested-3/osv-scanner-test.toml has been updated to ignore 1 vulnerability
6075-
<tempdir>/nested-3/osv-scanner-test.toml has unused ignores:
6076-
- GHSA-2g4f-4pwh-qvx6
60776075

60786076
Total 9 packages affected by 11 known vulnerabilities (0 Critical, 4 High, 7 Medium, 0 Low, 0 Unknown) from 2 ecosystems.
60796077
11 vulnerabilities can be fixed.
@@ -6277,16 +6275,9 @@ Filtered 2 ignored package/s from the scan.
62776275
<tempdir>/nested-2/osv-scanner-test.toml has been updated to ignore 3 vulnerabilities
62786276
<tempdir>/nested-3/osv-scanner-test.toml has been updated to ignore 1 vulnerability
62796277
<tempdir>/osv-scanner-test.toml has been updated to ignore 2 vulnerabilities
6280-
GHSA-2g4f-4pwh-qvx6 and 1 alias have been filtered out because: (no reason given)
6281-
GHSA-2g4f-4pwh-qvx6 and 1 alias have been filtered out because: (no reason given)
6282-
Filtered 2 vulnerabilities from output
6283-
<tempdir>/nested-2/osv-scanner-test.toml has unused ignores:
6284-
- GHSA-2g4f-4pwh-qvx6
6285-
<tempdir>/nested-3/osv-scanner-test.toml has unused ignores:
6286-
- GHSA-2g4f-4pwh-qvx6
62876278

6288-
Total 8 packages affected by 9 known vulnerabilities (0 Critical, 4 High, 5 Medium, 0 Low, 0 Unknown) from 2 ecosystems.
6289-
9 vulnerabilities can be fixed.
6279+
Total 9 packages affected by 11 known vulnerabilities (0 Critical, 4 High, 7 Medium, 0 Low, 0 Unknown) from 2 ecosystems.
6280+
11 vulnerabilities can be fixed.
62906281

62916282
RubyGems
62926283

@@ -6316,16 +6307,21 @@ lockfile:<tempdir>/nested-1/package-lock.json: found 3 packages with issues
63166307

63176308
4 known vulnerabilities found in lockfile:<tempdir>/nested-1/package-lock.json
63186309

6319-
lockfile:<tempdir>/nested-2/package-lock.json: found 2 packages with issues
6310+
lockfile:<tempdir>/nested-2/package-lock.json: found 3 packages with issues
63206311

63216312
ajv@6.0.0 has the following known vulnerabilities:
6313+
GHSA-2g4f-4pwh-qvx6: ajv has ReDoS when using `$data` option
6314+
Severity: '5.5'; Minimal Fix Version: '6.14.0';
63226315
GHSA-v88g-cgmw-v5xw: Prototype Pollution in Ajv
63236316
Severity: '5.6'; Minimal Fix Version: '6.12.3';
6317+
ajv@8.0.0 has the following known vulnerabilities:
6318+
GHSA-2g4f-4pwh-qvx6: ajv has ReDoS when using `$data` option
6319+
Severity: '5.5'; Minimal Fix Version: '8.18.0';
63246320
ansi-html@0.0.1 has the following known vulnerabilities:
63256321
GHSA-whgm-jr23-g3j9: Uncontrolled Resource Consumption in ansi-html
63266322
Severity: '7.5'; Minimal Fix Version: '0.0.8';
63276323

6328-
2 known vulnerabilities found in lockfile:<tempdir>/nested-2/package-lock.json
6324+
4 known vulnerabilities found in lockfile:<tempdir>/nested-2/package-lock.json
63296325

63306326
lockfile:<tempdir>/nested-3/package-lock.json: found 1 package with issues
63316327

@@ -6460,18 +6456,9 @@ Scanned <tempdir>/nested-3/package-lock.json file and found 3 packages
64606456
Scanned <tempdir>/package-lock.json file and found 1 package
64616457
Warning: plugin transitivedependency/pomxml can be risky when run on untrusted artifacts. Please ensure you trust the source code and artifacts before proceeding.
64626458
<tempdir>/custom-config.toml has been updated to ignore 4 vulnerabilities
6463-
GHSA-2g4f-4pwh-qvx6 and 1 alias have been filtered out because: (no reason given)
6464-
GHSA-2g4f-4pwh-qvx6 and 1 alias have been filtered out because: (no reason given)
6465-
GHSA-2g4f-4pwh-qvx6 and 1 alias have been filtered out because: (no reason given)
6466-
GHSA-2g4f-4pwh-qvx6 and 1 alias have been filtered out because: (no reason given)
6467-
GHSA-2g4f-4pwh-qvx6 and 1 alias have been filtered out because: (no reason given)
6468-
GHSA-2g4f-4pwh-qvx6 and 1 alias have been filtered out because: (no reason given)
6469-
Filtered 6 vulnerabilities from output
6470-
<tempdir>/custom-config.toml has unused ignores:
6471-
- CVE-123-456-789
64726459

6473-
Total 8 packages affected by 8 known vulnerabilities (0 Critical, 4 High, 4 Medium, 0 Low, 0 Unknown) from 2 ecosystems.
6474-
8 vulnerabilities can be fixed.
6460+
Total 11 packages affected by 14 known vulnerabilities (0 Critical, 4 High, 10 Medium, 0 Low, 0 Unknown) from 2 ecosystems.
6461+
14 vulnerabilities can be fixed.
64756462

64766463
RubyGems
64776464

@@ -6485,38 +6472,53 @@ lockfile:<tempdir>/Gemfile.lock: found 1 package with issues
64856472

64866473
npm
64876474

6488-
lockfile:<tempdir>/nested-1/package-lock.json: found 2 packages with issues
6475+
lockfile:<tempdir>/nested-1/package-lock.json: found 3 packages with issues
64896476

64906477
ajv@6.0.0 has the following known vulnerabilities:
6478+
GHSA-2g4f-4pwh-qvx6: ajv has ReDoS when using `$data` option
6479+
Severity: '5.5'; Minimal Fix Version: '6.14.0';
64916480
GHSA-v88g-cgmw-v5xw: Prototype Pollution in Ajv
64926481
Severity: '5.6'; Minimal Fix Version: '6.12.3';
6482+
ajv@8.0.0 has the following known vulnerabilities:
6483+
GHSA-2g4f-4pwh-qvx6: ajv has ReDoS when using `$data` option
6484+
Severity: '5.5'; Minimal Fix Version: '8.18.0';
64936485
ansi-html@0.0.1 has the following known vulnerabilities:
64946486
GHSA-whgm-jr23-g3j9: Uncontrolled Resource Consumption in ansi-html
64956487
Severity: '7.5'; Minimal Fix Version: '0.0.8';
64966488

6497-
2 known vulnerabilities found in lockfile:<tempdir>/nested-1/package-lock.json
6489+
4 known vulnerabilities found in lockfile:<tempdir>/nested-1/package-lock.json
64986490

6499-
lockfile:<tempdir>/nested-2/package-lock.json: found 2 packages with issues
6491+
lockfile:<tempdir>/nested-2/package-lock.json: found 3 packages with issues
65006492

65016493
ajv@6.0.0 has the following known vulnerabilities:
6494+
GHSA-2g4f-4pwh-qvx6: ajv has ReDoS when using `$data` option
6495+
Severity: '5.5'; Minimal Fix Version: '6.14.0';
65026496
GHSA-v88g-cgmw-v5xw: Prototype Pollution in Ajv
65036497
Severity: '5.6'; Minimal Fix Version: '6.12.3';
6498+
ajv@8.0.0 has the following known vulnerabilities:
6499+
GHSA-2g4f-4pwh-qvx6: ajv has ReDoS when using `$data` option
6500+
Severity: '5.5'; Minimal Fix Version: '8.18.0';
65046501
ansi-html@0.0.1 has the following known vulnerabilities:
65056502
GHSA-whgm-jr23-g3j9: Uncontrolled Resource Consumption in ansi-html
65066503
Severity: '7.5'; Minimal Fix Version: '0.0.8';
65076504

6508-
2 known vulnerabilities found in lockfile:<tempdir>/nested-2/package-lock.json
6505+
4 known vulnerabilities found in lockfile:<tempdir>/nested-2/package-lock.json
65096506

6510-
lockfile:<tempdir>/nested-3/package-lock.json: found 2 packages with issues
6507+
lockfile:<tempdir>/nested-3/package-lock.json: found 3 packages with issues
65116508

65126509
ajv@6.0.0 has the following known vulnerabilities:
6510+
GHSA-2g4f-4pwh-qvx6: ajv has ReDoS when using `$data` option
6511+
Severity: '5.5'; Minimal Fix Version: '6.14.0';
65136512
GHSA-v88g-cgmw-v5xw: Prototype Pollution in Ajv
65146513
Severity: '5.6'; Minimal Fix Version: '6.12.3';
6514+
ajv@8.0.0 has the following known vulnerabilities:
6515+
GHSA-2g4f-4pwh-qvx6: ajv has ReDoS when using `$data` option
6516+
Severity: '5.5'; Minimal Fix Version: '8.18.0';
65156517
ansi-html@0.0.1 has the following known vulnerabilities:
65166518
GHSA-whgm-jr23-g3j9: Uncontrolled Resource Consumption in ansi-html
65176519
Severity: '7.5'; Minimal Fix Version: '0.0.8';
65186520

6519-
2 known vulnerabilities found in lockfile:<tempdir>/nested-3/package-lock.json
6521+
4 known vulnerabilities found in lockfile:<tempdir>/nested-3/package-lock.json
65206522

65216523
lockfile:<tempdir>/package-lock.json: found 1 package with issues
65226524

@@ -6619,9 +6621,6 @@ Scanned <tempdir>/composer.lock file and found 0 packages
66196621
Scanned <tempdir>/package-lock.json file and found 1 package
66206622
Warning: plugin transitivedependency/pomxml can be risky when run on untrusted artifacts. Please ensure you trust the source code and artifacts before proceeding.
66216623
<tempdir>/custom-config.toml has been updated to ignore 2 vulnerabilities
6622-
<tempdir>/custom-config.toml has unused ignores:
6623-
- CVE-123-456-789
6624-
- GHSA-2g4f-4pwh-qvx6
66256624

66266625
Total 2 packages affected by 2 known vulnerabilities (0 Critical, 1 High, 1 Medium, 0 Low, 0 Unknown) from 2 ecosystems.
66276626
2 vulnerabilities can be fixed.
@@ -8170,7 +8169,6 @@ Scanned <tempdir>/composer.lock file and found 1 package
81708169
Warning: plugin transitivedependency/pomxml can be risky when run on untrusted artifacts. Please ensure you trust the source code and artifacts before proceeding.
81718170
Loaded filter from: <tempdir>/osv-scanner-test.toml
81728171
No issues found
8173-
81748172
---
81758173

81768174
[TestCommand_WithDetector_OnLinux/ssh_version_is_before_first_vuln_version - 2]

‎pkg/osvscanner/osvscanner.go‎

Lines changed: 15 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -391,10 +391,8 @@ func finalizeScanResult(scanResult results.ScanResults, actions ScannerActions)
391391
vulnerabilityResults.LicenseSummary = buildLicenseSummary(&scanResult)
392392
}
393393

394-
// todo: consider moving this after filtering
395-
// - p: should allow deduplicating some logic
396-
// - p: might be a better UX to present the vulns we're ignoring
397-
// - c: filtering removes vulns from results, so need to account for that
394+
// we skip filtering vulns if we're going to ignore everything,
395+
// as the output will serve as a list of what actually got ignored
398396
if actions.UpdateConfigIgnores == "all" {
399397
ignoreEntries, err := addVulnConfigIgnoresAndSave(&vulnerabilityResults, &scanResult.ConfigManager)
400398

@@ -407,21 +405,21 @@ func finalizeScanResult(scanResult results.ScanResults, actions ScannerActions)
407405
if err != nil {
408406
return models.VulnerabilityResults{}, err
409407
}
410-
}
411-
412-
filtered := filterResults(&vulnerabilityResults, &scanResult.ConfigManager, actions.ShowAllPackages)
413-
if filtered > 0 {
414-
cmdlogger.Infof(
415-
"Filtered %d %s from output",
416-
filtered,
417-
output.Form(filtered, "vulnerability", "vulnerabilities"),
418-
)
419-
}
408+
} else {
409+
filtered := filterResults(&vulnerabilityResults, &scanResult.ConfigManager, actions.ShowAllPackages)
410+
if filtered > 0 {
411+
cmdlogger.Infof(
412+
"Filtered %d %s from output",
413+
filtered,
414+
output.Form(filtered, "vulnerability", "vulnerabilities"),
415+
)
416+
}
420417

421-
err := handleUnusedIgnoreEntries(&scanResult.ConfigManager, actions.UpdateConfigIgnores == "unused")
418+
err := handleUnusedIgnoreEntries(&scanResult.ConfigManager, actions.UpdateConfigIgnores == "unused")
422419

423-
if err != nil {
424-
return models.VulnerabilityResults{}, err
420+
if err != nil {
421+
return models.VulnerabilityResults{}, err
422+
}
425423
}
426424

427425
return vulnerabilityResults, determineReturnErr(vulnerabilityResults, actions.ShowAllVulns)

0 commit comments

Comments
 (0)