Skip to content

Fix CVE-less SCA violations dropped under a Watch #835

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Jordanh1996 wants to merge 1 commit into
base: dev
Choose a base branch
from
Draft

Fix CVE-less SCA violations dropped under a Watch #835

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 21 additions & 9 deletions policy/enforcer/policyenforcer.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -460,25 +460,21 @@ func convertToBasicViolation(violationType violationutils.ViolationIssueType, vi

func convertToCveViolations(cmdResults *results.SecurityCommandResults, violation services.XrayViolation) (cveViolations []violationutils.CveViolation) {
resolved, unresolvedCount := resolveInfectedComponents(cmdResults, violation)
for _, cve := range violation.Cves {
if cve.Id == "" {
log.Warn(fmt.Sprintf("Skipping CVE violation with empty CVE ID for violation ID %s", violation.Id))
continue
}
for _, cveId := range getCveIds(violation) {
if len(resolved) == 0 {
logComponentLessFallback(violation, unresolvedCount)
cveViolation := createCveViolation(cmdResults, "", cve.Id, violation, nil)
cveViolation := createCveViolation(cmdResults, "", cveId, violation, nil)
if cveViolation == nil {
log.Warn(fmt.Sprintf("CVE (%s) violation with no located affected components for violation ID %s", cve.Id, violation.Id))
log.Warn(fmt.Sprintf("CVE (%s) violation with no located affected components for violation ID %s", cveId, violation.Id))
continue
}
cveViolations = append(cveViolations, *cveViolation)
continue
}
for i := range resolved {
cveViolation := createCveViolation(cmdResults, resolved[i].xrayId, cve.Id, violation, &resolved[i])
cveViolation := createCveViolation(cmdResults, resolved[i].xrayId, cveId, violation, &resolved[i])
if cveViolation == nil {
log.Warn(fmt.Sprintf("CVE (%s) violation for component (%s) with no located affected components for violation ID %s", cve.Id, resolved[i].xrayId, violation.Id))
log.Warn(fmt.Sprintf("CVE (%s) violation for component (%s) with no located affected components for violation ID %s", cveId, resolved[i].xrayId, violation.Id))
continue
}
cveViolations = append(cveViolations, *cveViolation)
Expand All @@ -487,6 +483,22 @@ func convertToCveViolations(cmdResults *results.SecurityCommandResults, violatio
return cveViolations
}

// getCveIds returns the identifiers to convert for a Security violation. Xray-native vulnerabilities
// with no assigned CVE (e.g. XRAY-XXXXX) still report through the CVE-keyed Security violation type,
// with a CveDetails entry whose Id is empty. Fall back to the violation's own issue ID for those,
// mirroring the fallback already used when building the SBOM (see ExtractIssuesInfoForCdx).
func getCveIds(violation services.XrayViolation) (cveIds []string) {
for _, cve := range violation.Cves {
if cve.Id != "" {
cveIds = append(cveIds, cve.Id)
}
}
if len(cveIds) == 0 && violation.IssueId != "" {
cveIds = append(cveIds, violation.IssueId)
}
return
}

func createCveViolation(cmdResults *results.SecurityCommandResults, impactedComponentXrayId, cveId string, violation services.XrayViolation, preResolved *bomResolvedComponent) *violationutils.CveViolation {
affectedComponent, scaViolation := convertToScaViolation(cmdResults, impactedComponentXrayId, violation, preResolved)
vulnerability, contextualAnalysis := locateBomVulnerabilityInfo(cmdResults, cveId, affectedComponent)
Expand Down
Loading