Skip to content

Commit c277250

Browse files
pxp928pxp928
authored
[FIX] CDX vulnerability parsing and update ENT VEX index (#2371)
* fix invalid reference handle, add affected via bom-ref Signed-off-by: pxp928 <[email protected]> * remove field statement and status notes from vex index Signed-off-by: pxp928 <[email protected]> * update atlas migration and re-gen code Signed-off-by: pxp928 <[email protected]> * fix cert vex integration tests for status note and statement Signed-off-by: pxp928 <[email protected]> * add new unit test for CDX Signed-off-by: pxp928 <[email protected]> * add very long status note for integration testing Signed-off-by: pxp928 <[email protected]> * add long statement for vex integration testing Signed-off-by: pxp928 <[email protected]> --------- Signed-off-by: pxp928 <[email protected]>
1 parent d852677 commit c277250

File tree

11 files changed

+303
-85
lines changed

11 files changed

+303
-85
lines changed

‎internal/testing/backend/certifyVEXStatement_test.go‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -579,9 +579,9 @@ func TestVEX(t *testing.T) {
579579
},
580580
Vuln: testdata.C1,
581581
In: &model.VexStatementInputSpec{
582-
VexJustification: "test justification",
582+
VexJustification: "test justification with status note one",
583583
KnownSince: time.Unix(1e9, 0),
584-
StatusNotes: "status one",
584+
StatusNotes: "There are no applicability scanners for this specific CVE\n##### Deployment mitigations\n\nClient-side mitigation: In case a repository is cloned/pulled with no intention of pushing anything, the `git sparse-checkout` feature can be enabled to avoid pulling the `.gitattributes` file. It can be performed as follows:\r\n```\r\ngit clone \u003cREPOSITORY URL\u003e --no-checkout\r\ncd \u003cREPOSITORY NAME\u003e\r\ngit sparse-checkout init\r\ngit sparse-checkout set --no-cone '/*' '!.gitattributes'\r\ngit checkout\r\n```\n\n##### Deployment mitigations\n\nAlthough the issue resides on the Git client's side, Git servers can also avoid infection by malicious actors from their side as well. Here is a git hook that will run after each push to check the size of the `.gitattributes` file can prevent from this vulnerability. The hook should be in the `/path/to/repository.git/hooks/` folder under the name of `pre-receive`:\r\n```\r\n#!/bin/sh\r\n# pre-receive hook to prevent oversized .gitattributes files from being pushed\r\n\r\n# 1GB of maximum allowed size for .gitattributes file (in bytes)\r\nmax_size=1048576\r\n\r\n# check each pushed file\r\nwhile read oldrev newrev refname; do\r\n # check for .gitattributes file\r\n if [ \"$(git rev-parse --verify $newrev:.gitattributes 2\u003e /dev/null)\" != \"\" ]; then\r\n # check file size\r\n size=$(git cat-file -s $newrev:.gitattributes)\r\n if [ $size -gt $max_size ]; then\r\n echo \"Error: .gitattributes file exceeds maximum allowed size of $max_size bytes.\"\r\n exit 1\r\n fi\r\n fi\r\ndone\r\n\r\nexit 0\r\n```",
585585
},
586586
},
587587
{
@@ -590,14 +590,14 @@ func TestVEX(t *testing.T) {
590590
},
591591
Vuln: testdata.O1,
592592
In: &model.VexStatementInputSpec{
593-
VexJustification: "test justification",
593+
VexJustification: "test justification with status note two",
594594
KnownSince: time.Unix(1e9, 0),
595595
StatusNotes: "status two",
596596
},
597597
},
598598
},
599599
Query: &model.CertifyVEXStatementSpec{
600-
StatusNotes: ptrfrom.String("status one"),
600+
StatusNotes: ptrfrom.String("There are no applicability scanners for this specific CVE\n##### Deployment mitigations\n\nClient-side mitigation: In case a repository is cloned/pulled with no intention of pushing anything, the `git sparse-checkout` feature can be enabled to avoid pulling the `.gitattributes` file. It can be performed as follows:\r\n```\r\ngit clone \u003cREPOSITORY URL\u003e --no-checkout\r\ncd \u003cREPOSITORY NAME\u003e\r\ngit sparse-checkout init\r\ngit sparse-checkout set --no-cone '/*' '!.gitattributes'\r\ngit checkout\r\n```\n\n##### Deployment mitigations\n\nAlthough the issue resides on the Git client's side, Git servers can also avoid infection by malicious actors from their side as well. Here is a git hook that will run after each push to check the size of the `.gitattributes` file can prevent from this vulnerability. The hook should be in the `/path/to/repository.git/hooks/` folder under the name of `pre-receive`:\r\n```\r\n#!/bin/sh\r\n# pre-receive hook to prevent oversized .gitattributes files from being pushed\r\n\r\n# 1GB of maximum allowed size for .gitattributes file (in bytes)\r\nmax_size=1048576\r\n\r\n# check each pushed file\r\nwhile read oldrev newrev refname; do\r\n # check for .gitattributes file\r\n if [ \"$(git rev-parse --verify $newrev:.gitattributes 2\u003e /dev/null)\" != \"\" ]; then\r\n # check file size\r\n size=$(git cat-file -s $newrev:.gitattributes)\r\n if [ $size -gt $max_size ]; then\r\n echo \"Error: .gitattributes file exceeds maximum allowed size of $max_size bytes.\"\r\n exit 1\r\n fi\r\n fi\r\ndone\r\n\r\nexit 0\r\n```"),
601601
},
602602
ExpVEX: []*model.CertifyVEXStatement{
603603
{
@@ -606,9 +606,9 @@ func TestVEX(t *testing.T) {
606606
Type: "cve",
607607
VulnerabilityIDs: []*model.VulnerabilityID{testdata.C1out},
608608
},
609-
VexJustification: "test justification",
609+
VexJustification: "test justification with status note one",
610610
KnownSince: time.Unix(1e9, 0),
611-
StatusNotes: "status one",
611+
StatusNotes: "There are no applicability scanners for this specific CVE\n##### Deployment mitigations\n\nClient-side mitigation: In case a repository is cloned/pulled with no intention of pushing anything, the `git sparse-checkout` feature can be enabled to avoid pulling the `.gitattributes` file. It can be performed as follows:\r\n```\r\ngit clone \u003cREPOSITORY URL\u003e --no-checkout\r\ncd \u003cREPOSITORY NAME\u003e\r\ngit sparse-checkout init\r\ngit sparse-checkout set --no-cone '/*' '!.gitattributes'\r\ngit checkout\r\n```\n\n##### Deployment mitigations\n\nAlthough the issue resides on the Git client's side, Git servers can also avoid infection by malicious actors from their side as well. Here is a git hook that will run after each push to check the size of the `.gitattributes` file can prevent from this vulnerability. The hook should be in the `/path/to/repository.git/hooks/` folder under the name of `pre-receive`:\r\n```\r\n#!/bin/sh\r\n# pre-receive hook to prevent oversized .gitattributes files from being pushed\r\n\r\n# 1GB of maximum allowed size for .gitattributes file (in bytes)\r\nmax_size=1048576\r\n\r\n# check each pushed file\r\nwhile read oldrev newrev refname; do\r\n # check for .gitattributes file\r\n if [ \"$(git rev-parse --verify $newrev:.gitattributes 2\u003e /dev/null)\" != \"\" ]; then\r\n # check file size\r\n size=$(git cat-file -s $newrev:.gitattributes)\r\n if [ $size -gt $max_size ]; then\r\n echo \"Error: .gitattributes file exceeds maximum allowed size of $max_size bytes.\"\r\n exit 1\r\n fi\r\n fi\r\ndone\r\n\r\nexit 0\r\n```",
612612
},
613613
},
614614
},
@@ -623,7 +623,7 @@ func TestVEX(t *testing.T) {
623623
},
624624
Vuln: testdata.O1,
625625
In: &model.VexStatementInputSpec{
626-
VexJustification: "test justification",
626+
VexJustification: "test justification with statement one",
627627
KnownSince: time.Unix(1e9, 0),
628628
Statement: "statement one",
629629
},
@@ -634,14 +634,14 @@ func TestVEX(t *testing.T) {
634634
},
635635
Vuln: testdata.O1,
636636
In: &model.VexStatementInputSpec{
637-
VexJustification: "test justification",
637+
VexJustification: "test justification with statement two",
638638
KnownSince: time.Unix(1e9, 0),
639-
Statement: "statement two",
639+
Statement: "There are no applicability scanners for this specific CVE\n##### Deployment mitigations\n\nClient-side mitigation: In case a repository is cloned/pulled with no intention of pushing anything, the `git sparse-checkout` feature can be enabled to avoid pulling the `.gitattributes` file. It can be performed as follows:\r\n```\r\ngit clone \u003cREPOSITORY URL\u003e --no-checkout\r\ncd \u003cREPOSITORY NAME\u003e\r\ngit sparse-checkout init\r\ngit sparse-checkout set --no-cone '/*' '!.gitattributes'\r\ngit checkout\r\n```\n\n##### Deployment mitigations\n\nAlthough the issue resides on the Git client's side, Git servers can also avoid infection by malicious actors from their side as well. Here is a git hook that will run after each push to check the size of the `.gitattributes` file can prevent from this vulnerability. The hook should be in the `/path/to/repository.git/hooks/` folder under the name of `pre-receive`:\r\n```\r\n#!/bin/sh\r\n# pre-receive hook to prevent oversized .gitattributes files from being pushed\r\n\r\n# 1GB of maximum allowed size for .gitattributes file (in bytes)\r\nmax_size=1048576\r\n\r\n# check each pushed file\r\nwhile read oldrev newrev refname; do\r\n # check for .gitattributes file\r\n if [ \"$(git rev-parse --verify $newrev:.gitattributes 2\u003e /dev/null)\" != \"\" ]; then\r\n # check file size\r\n size=$(git cat-file -s $newrev:.gitattributes)\r\n if [ $size -gt $max_size ]; then\r\n echo \"Error: .gitattributes file exceeds maximum allowed size of $max_size bytes.\"\r\n exit 1\r\n fi\r\n fi\r\ndone\r\n\r\nexit 0\r\n```",
640640
},
641641
},
642642
},
643643
Query: &model.CertifyVEXStatementSpec{
644-
Statement: ptrfrom.String("statement two"),
644+
Statement: ptrfrom.String("There are no applicability scanners for this specific CVE\n##### Deployment mitigations\n\nClient-side mitigation: In case a repository is cloned/pulled with no intention of pushing anything, the `git sparse-checkout` feature can be enabled to avoid pulling the `.gitattributes` file. It can be performed as follows:\r\n```\r\ngit clone \u003cREPOSITORY URL\u003e --no-checkout\r\ncd \u003cREPOSITORY NAME\u003e\r\ngit sparse-checkout init\r\ngit sparse-checkout set --no-cone '/*' '!.gitattributes'\r\ngit checkout\r\n```\n\n##### Deployment mitigations\n\nAlthough the issue resides on the Git client's side, Git servers can also avoid infection by malicious actors from their side as well. Here is a git hook that will run after each push to check the size of the `.gitattributes` file can prevent from this vulnerability. The hook should be in the `/path/to/repository.git/hooks/` folder under the name of `pre-receive`:\r\n```\r\n#!/bin/sh\r\n# pre-receive hook to prevent oversized .gitattributes files from being pushed\r\n\r\n# 1GB of maximum allowed size for .gitattributes file (in bytes)\r\nmax_size=1048576\r\n\r\n# check each pushed file\r\nwhile read oldrev newrev refname; do\r\n # check for .gitattributes file\r\n if [ \"$(git rev-parse --verify $newrev:.gitattributes 2\u003e /dev/null)\" != \"\" ]; then\r\n # check file size\r\n size=$(git cat-file -s $newrev:.gitattributes)\r\n if [ $size -gt $max_size ]; then\r\n echo \"Error: .gitattributes file exceeds maximum allowed size of $max_size bytes.\"\r\n exit 1\r\n fi\r\n fi\r\ndone\r\n\r\nexit 0\r\n```"),
645645
},
646646
ExpVEX: []*model.CertifyVEXStatement{
647647
{
@@ -650,9 +650,9 @@ func TestVEX(t *testing.T) {
650650
Type: "osv",
651651
VulnerabilityIDs: []*model.VulnerabilityID{testdata.O1out},
652652
},
653-
VexJustification: "test justification",
653+
VexJustification: "test justification with statement two",
654654
KnownSince: time.Unix(1e9, 0),
655-
Statement: "statement two",
655+
Statement: "There are no applicability scanners for this specific CVE\n##### Deployment mitigations\n\nClient-side mitigation: In case a repository is cloned/pulled with no intention of pushing anything, the `git sparse-checkout` feature can be enabled to avoid pulling the `.gitattributes` file. It can be performed as follows:\r\n```\r\ngit clone \u003cREPOSITORY URL\u003e --no-checkout\r\ncd \u003cREPOSITORY NAME\u003e\r\ngit sparse-checkout init\r\ngit sparse-checkout set --no-cone '/*' '!.gitattributes'\r\ngit checkout\r\n```\n\n##### Deployment mitigations\n\nAlthough the issue resides on the Git client's side, Git servers can also avoid infection by malicious actors from their side as well. Here is a git hook that will run after each push to check the size of the `.gitattributes` file can prevent from this vulnerability. The hook should be in the `/path/to/repository.git/hooks/` folder under the name of `pre-receive`:\r\n```\r\n#!/bin/sh\r\n# pre-receive hook to prevent oversized .gitattributes files from being pushed\r\n\r\n# 1GB of maximum allowed size for .gitattributes file (in bytes)\r\nmax_size=1048576\r\n\r\n# check each pushed file\r\nwhile read oldrev newrev refname; do\r\n # check for .gitattributes file\r\n if [ \"$(git rev-parse --verify $newrev:.gitattributes 2\u003e /dev/null)\" != \"\" ]; then\r\n # check file size\r\n size=$(git cat-file -s $newrev:.gitattributes)\r\n if [ $size -gt $max_size ]; then\r\n echo \"Error: .gitattributes file exceeds maximum allowed size of $max_size bytes.\"\r\n exit 1\r\n fi\r\n fi\r\ndone\r\n\r\nexit 0\r\n```",
656656
},
657657
},
658658
},

‎internal/testing/testdata/exampledata/xray-cdx-vulns.json‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{
2+
"bomFormat": "CycloneDX",
3+
"specVersion": "1.4",
4+
"serialNumber": "urn:uuid:e8300d83-d8d8-4e91-63e7-3d95b8900f45",
5+
"version": 1,
6+
"metadata": {
7+
"timestamp": "2024-12-11T10:06:41Z",
8+
"tools": [
9+
{
10+
"vendor": "JFrog Inc.",
11+
"name": "Xray",
12+
"version": "3.103.6"
13+
}
14+
],
15+
"component": {
16+
"type": "container",
17+
"name": "library/maven",
18+
"version": "sha256__09c4bf58d7e7e31bdc1ab73ef10349b3a47c9a814e715e409034fb3293253ce2"
19+
}
20+
},
21+
"components": [
22+
{
23+
"bom-ref": "pkg:deb/debian:buster:[email protected]",
24+
"type": "application",
25+
"name": "debian:buster:apt",
26+
"version": "1.8.2.2",
27+
"hashes": [
28+
{
29+
"alg": "SHA-256",
30+
"content": "db5c8bd205d41e520f615251ae97c9610a0fb312841428a7a25072831f6bee83"
31+
}
32+
],
33+
"licenses": [
34+
{
35+
"license": {
36+
"id": "GPL-2.0-only",
37+
"url": "http://www.gnu.org/licenses/old-licenses/gpl-2.0-standalone.html"
38+
}
39+
}
40+
],
41+
"purl": "pkg:deb/debian:buster:[email protected]"
42+
}
43+
],
44+
"dependencies": [],
45+
"vulnerabilities": [
46+
{
47+
"bom-ref": "pkg:deb/debian:buster:[email protected]",
48+
"id": "CVE-2011-3374",
49+
"analysis": {
50+
"state": "in_triage",
51+
"response": [
52+
"workaround_available"
53+
],
54+
"detail": "There are no applicability scanners for this specific CVE\n##### Deployment mitigations\n\nClient-side mitigation: In case a repository is cloned/pulled with no intention of pushing anything, the `git sparse-checkout` feature can be enabled to avoid pulling the `.gitattributes` file. It can be performed as follows:\r\n```\r\ngit clone \u003cREPOSITORY URL\u003e --no-checkout\r\ncd \u003cREPOSITORY NAME\u003e\r\ngit sparse-checkout init\r\ngit sparse-checkout set --no-cone '/*' '!.gitattributes'\r\ngit checkout\r\n```\n\n##### Deployment mitigations\n\nAlthough the issue resides on the Git client's side, Git servers can also avoid infection by malicious actors from their side as well. Here is a git hook that will run after each push to check the size of the `.gitattributes` file can prevent from this vulnerability. The hook should be in the `/path/to/repository.git/hooks/` folder under the name of `pre-receive`:\r\n```\r\n#!/bin/sh\r\n# pre-receive hook to prevent oversized .gitattributes files from being pushed\r\n\r\n# 1GB of maximum allowed size for .gitattributes file (in bytes)\r\nmax_size=1048576\r\n\r\n# check each pushed file\r\nwhile read oldrev newrev refname; do\r\n # check for .gitattributes file\r\n if [ \"$(git rev-parse --verify $newrev:.gitattributes 2\u003e /dev/null)\" != \"\" ]; then\r\n # check file size\r\n size=$(git cat-file -s $newrev:.gitattributes)\r\n if [ $size -gt $max_size ]; then\r\n echo \"Error: .gitattributes file exceeds maximum allowed size of $max_size bytes.\"\r\n exit 1\r\n fi\r\n fi\r\ndone\r\n\r\nexit 0\r\n```"
55+
}
56+
}
57+
]
58+
}

0 commit comments

Comments
 (0)