Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Missing context new status for CA #153

Merged
merged 19 commits into from
Sep 17, 2024
Merged

Missing context new status for CA #153

Show file tree
Hide file tree
Changes from 9 commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
fbc3f1b
Missing context new status
barv-jfrog Aug 20, 2024
64ce36f
Missing context new status
barv-jfrog Aug 21, 2024
d6b79a7
Merge branch 'dev' into missing-context
barv-jfrog Aug 21, 2024
e9bd8ad
Merge branch 'dev' into missing-context
barv-jfrog Aug 25, 2024
c84778b
Undetermined reason for undetermined contextual analysis status
barv-jfrog Aug 25, 2024
597966e
Missing context
barv-jfrog Aug 26, 2024
198206d
Merge branch 'dev' into missing-context
barv-jfrog Aug 28, 2024
ac53ed0
Merge branch 'dev' into missing-context
barv-jfrog Sep 3, 2024
25cd6cb
Merge branch 'dev' into missing-context
barv-jfrog Sep 5, 2024
d07ad41
Merge branch 'dev' of https://github.com/jfrog/jfrog-cli-security int…
barv-jfrog Sep 5, 2024
b3ff1d4
undetermined text fixes
barv-jfrog Sep 5, 2024
468e569
Merge branch 'dev' into missing-context
barv-jfrog Sep 12, 2024
51b039f
token validation pr fixes + pull
barv-jfrog Sep 12, 2024
5e58c92
Merge remote-tracking branch 'origin/missing-context' into missing-co…
barv-jfrog Sep 12, 2024
1e3891d
missing context fixes
barv-jfrog Sep 12, 2024
9ce45c3
missing context severities fixes
barv-jfrog Sep 12, 2024
984a6a5
fix missing-context
barv-jfrog Sep 12, 2024
2d19c4a
fix missing-context
barv-jfrog Sep 12, 2024
b7fadf1
Merge branch 'dev' into missing-context
barv-jfrog Sep 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 9 additions & 9 deletions audit_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -332,15 +332,15 @@ func TestXrayAuditMultiProjects(t *testing.T) {
assert.NoError(t, biutils.CopyDir(multiProject, tempDirPath, true, nil))
prevWd := securityTestUtils.ChangeWD(t, tempDirPath)
defer clientTests.ChangeDirAndAssert(t, prevWd)
workingDirsFlag := fmt.Sprintf("--working-dirs=%s, %s ,%s, %s",
workingDirsFlag := fmt.Sprintf("--working-dirs=%s, %s ,%s, %s, %s",
filepath.Join(tempDirPath, "package-managers", "maven", "maven"), filepath.Join(tempDirPath, "package-managers", "nuget", "single4.0"),
filepath.Join(tempDirPath, "package-managers", "python", "pip", "pip-project"), filepath.Join(tempDirPath, "jas", "jas"))
filepath.Join(tempDirPath, "package-managers", "python", "pip", "pip-project"), filepath.Join(tempDirPath, "jas", "jas"), filepath.Join(tempDirPath, "package-managers", "go", "missing-context"))
// Configure a new server named "default"
securityTestUtils.CreateJfrogHomeConfig(t, true)
defer securityTestUtils.CleanTestsHomeEnv()
output := securityTests.PlatformCli.WithoutCredentials().RunCliCmdWithOutput(t, "audit", "--format="+string(format.SimpleJson), workingDirsFlag)
securityTestUtils.VerifySimpleJsonScanResults(t, output, 0, 35, 0)
securityTestUtils.VerifySimpleJsonJasResults(t, output, 1, 9, 6, 3, 0, 25, 2)
securityTestUtils.VerifySimpleJsonJasResults(t, output, 1, 9, 6, 3, 0, 25, 2, 1)
}

func TestXrayAuditPipJson(t *testing.T) {
Expand Down Expand Up @@ -449,7 +449,7 @@ func TestXrayAuditNotEntitledForJas(t *testing.T) {
// Verify that scan results are printed
securityTestUtils.VerifySimpleJsonScanResults(t, output, 0, 8, 0)
// Verify that JAS results are not printed
securityTestUtils.VerifySimpleJsonJasResults(t, output, 0, 0, 0, 0, 0, 0, 0)
securityTestUtils.VerifySimpleJsonJasResults(t, output, 0, 0, 0, 0, 0, 0, 0, 0)
}

func getNoJasAuditMockCommand() components.Command {
Expand All @@ -471,24 +471,24 @@ func getNoJasAuditMockCommand() components.Command {
func TestXrayAuditJasSimpleJson(t *testing.T) {
output := testXrayAuditJas(t, securityTests.PlatformCli, filepath.Join("jas", "jas"), "3")
securityTestUtils.VerifySimpleJsonScanResults(t, output, 0, 8, 0)
securityTestUtils.VerifySimpleJsonJasResults(t, output, 1, 9, 6, 3, 1, 1, 2)
securityTestUtils.VerifySimpleJsonJasResults(t, output, 1, 9, 6, 3, 1, 1, 2, 0)
}

func TestXrayAuditJasSimpleJsonWithOneThread(t *testing.T) {
output := testXrayAuditJas(t, securityTests.PlatformCli, filepath.Join("jas", "jas"), "1")
securityTestUtils.VerifySimpleJsonScanResults(t, output, 0, 8, 0)
securityTestUtils.VerifySimpleJsonJasResults(t, output, 1, 9, 6, 3, 1, 1, 2)
securityTestUtils.VerifySimpleJsonJasResults(t, output, 1, 9, 6, 3, 1, 1, 2, 0)
}

func TestXrayAuditJasSimpleJsonWithConfig(t *testing.T) {
output := testXrayAuditJas(t, securityTests.PlatformCli, filepath.Join("jas", "jas-config"), "3")
securityTestUtils.VerifySimpleJsonJasResults(t, output, 0, 0, 1, 3, 1, 1, 2)
securityTestUtils.VerifySimpleJsonJasResults(t, output, 0, 0, 1, 3, 1, 1, 2, 0)
}

func TestXrayAuditJasNoViolationsSimpleJson(t *testing.T) {
output := testXrayAuditJas(t, securityTests.PlatformCli, filepath.Join("package-managers", "npm", "npm"), "3")
securityTestUtils.VerifySimpleJsonScanResults(t, output, 0, 1, 0)
securityTestUtils.VerifySimpleJsonJasResults(t, output, 0, 0, 0, 0, 0, 0, 1)
securityTestUtils.VerifySimpleJsonJasResults(t, output, 0, 0, 0, 0, 0, 0, 1, 0)
}

func testXrayAuditJas(t *testing.T, testCli *coreTests.JfrogCli, project string, threads string) string {
Expand Down Expand Up @@ -577,5 +577,5 @@ func TestAuditOnEmptyProject(t *testing.T) {
chdirCallback := clientTests.ChangeDirWithCallback(t, baseWd, tempDirPath)
defer chdirCallback()
output := securityTests.PlatformCli.WithoutCredentials().RunCliCmdWithOutput(t, "audit", "--format="+string(format.SimpleJson))
securityTestUtils.VerifySimpleJsonJasResults(t, output, 0, 0, 0, 0, 0, 0, 0)
securityTestUtils.VerifySimpleJsonJasResults(t, output, 0, 0, 0, 0, 0, 0, 0, 0)
}
2 changes: 1 addition & 1 deletion jas/applicability/applicabilitymanager_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -293,7 +293,7 @@ func TestParseResults_NewApplicabilityStatuses(t *testing.T) {
name: "new applicability statuses",
fileName: "new_ca_status.sarif",
expectedResults: 5,
expectedApplicabilityStatuses: []string{"applicable", "undetermined", "not_covered", "not_applicable"},
expectedApplicabilityStatuses: []string{"applicable", "undetermined", "not_covered", "missing_context", "not_applicable"},
},
}

Expand Down
14 changes: 14 additions & 0 deletions tests/testdata/other/applicability-scan/new_ca_status.sarif
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,20 @@
"shortDescription": {
"text": "Scanner for CVE-2020-1747"
}
},
{
"id": "applic_CVE-2020-1751",
"name": "CVE-2020-1751",
"properties": {
"applicability": "missing_context"
},
"fullDescription": {
"text": "The scanner checks whether any of the following vulnerable functions are called:\n\n- `yaml.full_load()`\n- `yaml.load()` only unsafe calls (without specifying `SafeLoader` as the `Loader`class).",
"markdown": "The scanner checks whether any of the following vulnerable functions are called:\n\n- `yaml.full_load()`\n- `yaml.load()` only unsafe calls (without specifying `SafeLoader` as the `Loader`class)."
},
"shortDescription": {
"text": "Scanner for CVE-2020-1751"
}
},
{
"id": "applic_CVE-2020-7788",
Expand Down
160 changes: 160 additions & 0 deletions tests/testdata/projects/package-managers/go/missing-context/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,160 @@
module missing_context

go 1.22

require (
cloud.google.com/go v0.38.0 // indirect
github.com/Azure/azure-sdk-for-go v40.3.0+incompatible // indirect
github.com/Azure/go-autorest/autorest v0.10.0 // indirect
github.com/Azure/go-autorest/autorest/adal v0.8.2 // indirect
github.com/Azure/go-autorest/autorest/azure/auth v0.4.2 // indirect
github.com/Azure/go-autorest/autorest/azure/cli v0.3.1 // indirect
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please only include the needed dependency for the test to reduce size and test times

github.com/Azure/go-autorest/autorest/date v0.2.0 // indirect
github.com/Azure/go-autorest/autorest/to v0.3.0 // indirect
github.com/Azure/go-autorest/autorest/validation v0.2.0 // indirect
github.com/Azure/go-autorest/logger v0.1.0 // indirect
github.com/Azure/go-autorest/tracing v0.5.0 // indirect
github.com/DataDog/datadog-go v3.2.0+incompatible // indirect
github.com/Microsoft/go-winio v0.4.3 // indirect
github.com/NYTimes/gziphandler v1.0.1 // indirect
github.com/StackExchange/wmi v0.0.0-20190523213315-cbe66965904d // indirect
github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e // indirect
github.com/armon/go-metrics v0.3.5-0.20201104215618-6fd5a4ddf425 // indirect
github.com/armon/go-radix v1.0.0 // indirect
github.com/aws/aws-sdk-go v1.25.41 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/bgentry/speakeasy v0.1.0 // indirect
github.com/boltdb/bolt v1.3.1 // indirect
github.com/census-instrumentation/opencensus-proto v0.2.1 // indirect
github.com/cespare/xxhash/v2 v2.1.1 // indirect
github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible // indirect
github.com/circonus-labs/circonusllhist v0.1.3 // indirect
github.com/cncf/udpa/go v0.0.0-20200313221541-5f7e5dd04533 // indirect
github.com/coredns/coredns v1.1.2 // indirect
github.com/coreos/go-oidc v2.1.0+incompatible // indirect
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/denverdino/aliyungo v0.0.0-20170926055100-d3308649c661 // indirect
github.com/dgrijalva/jwt-go v3.2.0+incompatible // indirect
github.com/digitalocean/godo v1.10.0 // indirect
github.com/dimchansky/utfbom v1.1.0 // indirect
github.com/docker/go-connections v0.3.0 // indirect
github.com/elazarl/go-bindata-assetfs v0.0.0-20160803192304-e1a2a7ec64b0 // indirect
github.com/envoyproxy/go-control-plane v0.9.5 // indirect
github.com/envoyproxy/protoc-gen-validate v0.1.0 // indirect
github.com/fatih/color v1.9.0 // indirect
github.com/go-ole/go-ole v1.2.4 // indirect
github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d // indirect
github.com/golang/protobuf v1.3.5 // indirect
github.com/golang/snappy v0.0.1 // indirect
github.com/google/btree v1.0.0 // indirect
github.com/google/go-querystring v1.0.0 // indirect
github.com/google/gofuzz v1.2.0 // indirect
github.com/googleapis/gax-go/v2 v2.0.5 // indirect
github.com/googleapis/gnostic v0.2.0 // indirect
github.com/gophercloud/gophercloud v0.1.0 // indirect
github.com/hashicorp/consul v1.9.1 // indirect
github.com/hashicorp/consul/api v1.8.1 // indirect
github.com/hashicorp/consul/sdk v0.7.0 // indirect
github.com/hashicorp/errwrap v1.0.0 // indirect
github.com/hashicorp/go-bexpr v0.1.2 // indirect
github.com/hashicorp/go-checkpoint v0.5.0 // indirect
github.com/hashicorp/go-cleanhttp v0.5.1 // indirect
github.com/hashicorp/go-connlimit v0.3.0 // indirect
github.com/hashicorp/go-discover v0.0.0-20200501174627-ad1e96bde088 // indirect
github.com/hashicorp/go-hclog v0.14.1 // indirect
github.com/hashicorp/go-immutable-radix v1.3.0 // indirect
github.com/hashicorp/go-memdb v1.3.0 // indirect
github.com/hashicorp/go-msgpack v0.5.5 // indirect
github.com/hashicorp/go-multierror v1.1.0 // indirect
github.com/hashicorp/go-raftchunking v0.6.1 // indirect
github.com/hashicorp/go-retryablehttp v0.6.7 // indirect
github.com/hashicorp/go-rootcerts v1.0.2 // indirect
github.com/hashicorp/go-sockaddr v1.0.2 // indirect
github.com/hashicorp/go-syslog v1.0.0 // indirect
github.com/hashicorp/go-uuid v1.0.2 // indirect
github.com/hashicorp/go-version v1.2.1 // indirect
github.com/hashicorp/golang-lru v0.5.4 // indirect
github.com/hashicorp/hcl v1.0.0 // indirect
github.com/hashicorp/hil v0.0.0-20200423225030-a18a1cd20038 // indirect
github.com/hashicorp/mdns v1.0.3 // indirect
github.com/hashicorp/memberlist v0.2.2 // indirect
github.com/hashicorp/net-rpc-msgpackrpc v0.0.0-20151116020338-a14192a58a69 // indirect
github.com/hashicorp/raft v1.2.0 // indirect
github.com/hashicorp/raft-autopilot v0.1.1 // indirect
github.com/hashicorp/raft-boltdb v0.0.0-20171010151810-6e5ba93211ea // indirect
github.com/hashicorp/serf v0.9.5 // indirect
github.com/hashicorp/vault/api v1.0.5-0.20200717191844-f687267c8086 // indirect
github.com/hashicorp/vault/sdk v0.1.14-0.20200519221838-e0cfd64bc267 // indirect
github.com/hashicorp/vic v1.5.1-0.20190403131502-bbfe86ec9443 // indirect
github.com/hashicorp/yamux v0.0.0-20200609203250-aecfd211c9ce // indirect
github.com/imdario/mergo v0.3.6 // indirect
github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af // indirect
github.com/joyent/triton-go v1.7.1-0.20200416154420-6801d15b779f // indirect
github.com/json-iterator/go v1.1.9 // indirect
github.com/konsorten/go-windows-terminal-sequences v1.0.2 // indirect
github.com/kr/text v0.1.0 // indirect
github.com/linode/linodego v0.7.1 // indirect
github.com/mattn/go-colorable v0.1.6 // indirect
github.com/mattn/go-isatty v0.0.12 // indirect
github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
github.com/miekg/dns v1.1.31 // indirect
github.com/mitchellh/cli v1.1.0 // indirect
github.com/mitchellh/copystructure v1.0.0 // indirect
github.com/mitchellh/go-homedir v1.1.0 // indirect
github.com/mitchellh/go-testing-interface v1.14.0 // indirect
github.com/mitchellh/hashstructure v0.0.0-20170609045927-2bca23e0e452 // indirect
github.com/mitchellh/mapstructure v1.3.3 // indirect
github.com/mitchellh/pointerstructure v1.0.0 // indirect
github.com/mitchellh/reflectwalk v1.0.1 // indirect
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.1 // indirect
github.com/nicolai86/scaleway-sdk v1.10.2-0.20180628010248-798f60e20bb2 // indirect
github.com/packethost/packngo v0.1.1-0.20180711074735-b9cb5096f54c // indirect
github.com/patrickmn/go-cache v2.1.0+incompatible // indirect
github.com/pierrec/lz4 v2.5.2+incompatible // indirect
github.com/pkg/errors v0.8.1 // indirect
github.com/pmezard/go-difflib v1.0.0 // indirect
github.com/posener/complete v1.2.3 // indirect
github.com/pquerna/cachecontrol v0.0.0-20180517163645-1555304b9b35 // indirect
github.com/prometheus/client_golang v1.4.0 // indirect
github.com/prometheus/client_model v0.2.0 // indirect
github.com/prometheus/common v0.9.1 // indirect
github.com/prometheus/procfs v0.0.8 // indirect
github.com/rboyer/safeio v0.2.1 // indirect
github.com/renier/xmlrpc v0.0.0-20170708154548-ce4a1a486c03 // indirect
github.com/ryanuber/columnize v2.1.0+incompatible // indirect
github.com/ryanuber/go-glob v1.0.0 // indirect
github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 // indirect
github.com/shirou/gopsutil/v3 v3.20.10 // indirect
github.com/sirupsen/logrus v1.4.2 // indirect
github.com/softlayer/softlayer-go v0.0.0-20180806151055-260589d94c7d // indirect
github.com/spf13/pflag v1.0.5 // indirect
github.com/stretchr/objx v0.1.1 // indirect
github.com/stretchr/testify v1.6.1 // indirect
github.com/tencentcloud/tencentcloud-sdk-go v3.0.83+incompatible // indirect
github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926 // indirect
github.com/vmware/govmomi v0.18.0 // indirect
go.opencensus.io v0.22.0 // indirect
golang.org/x/crypto v0.0.0-20200930160638-afb6bcd081ae // indirect
golang.org/x/net v0.0.0-20200930145003-4acb6c075d10 // indirect
golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45 // indirect
golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a // indirect
golang.org/x/sys v0.0.0-20201024232916-9f70ab9862d5 // indirect
golang.org/x/text v0.3.3 // indirect
golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e // indirect
google.golang.org/api v0.9.0 // indirect
google.golang.org/appengine v1.6.0 // indirect
google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55 // indirect
google.golang.org/grpc v1.25.1 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/resty.v1 v1.12.0 // indirect
gopkg.in/square/go-jose.v2 v2.5.1 // indirect
gopkg.in/yaml.v2 v2.2.8 // indirect
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c // indirect
k8s.io/api v0.16.9 // indirect
k8s.io/apimachinery v0.16.9 // indirect
k8s.io/client-go v0.16.9 // indirect
k8s.io/klog v1.0.0 // indirect
k8s.io/utils v0.0.0-20190801114015-581e00157fb1 // indirect
sigs.k8s.io/yaml v1.1.0 // indirect
)
Loading
Loading