Support for CSAF-based Vulnerability Analyser #1894

oxisto · 2025-10-18T15:24:52Z

Description

This adds a new vulnerability analyser based on the information found in a CSAF document.

Addressed Issue

Addresses DependencyTrack/dependency-track#2353

Additional Details

Checklist

I have read and understand the contributing guidelines
~~- [ ] This PR fixes a defect, and I have provided tests to verify that the fix is effective~~
This PR implements an enhancement, and I have provided tests to verify that it works as intended
This PR introduces changes to the database model, and I have updated the migration changelog accordingly
~~- [ ] This PR introduces new or alters existing behavior, and I have updated the documentation accordingly~~

Signed-off-by: Christian Banse <oxisto@aybaze.com>

owasp-dt-bot · 2025-10-18T15:25:14Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Copilot

Pull Request Overview

Adds a CSAF-based vulnerability analyzer, including a new scanner, config, persistence for advisories, and protobuf updates to carry CSAF scan results and confidence scores.

Introduces CsafScannerProcessor and supplier, wired into the scanning pipeline
Adds Advisory entity/table and repositories for CSAF document storage and access
Extends protobuf API with SCANNER_CSAF and per-vulnerability matching confidence; adds dependencies for CSAF matching

Reviewed Changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
vulnerability-analyzer/src/main/resources/application.properties	Enables CSAF scanner, configures partitions/threshold, disables OSS Index, and disables config caching
vulnerability-analyzer/src/main/java/org/dependencytrack/vulnanalyzer/processor/scanner/csaf/CsafScannerProcessorSupplier.java	Supplies the new CSAF scanner processor and identifies scanner
vulnerability-analyzer/src/main/java/org/dependencytrack/vulnanalyzer/processor/scanner/csaf/CsafScannerProcessor.java	Implements CSAF matching against stored advisories and emits CycloneDX BOM vulnerabilities with confidence
vulnerability-analyzer/src/main/java/org/dependencytrack/vulnanalyzer/config/CsafScannerConfig.java	Provides runtime-dynamic config for CSAF scanner enablement and threshold
vulnerability-analyzer/pom.xml	Adds CSAF matching and pbandk runtime dependencies
proto/src/main/proto/org/dependencytrack/vulnanalysis/v1/vuln_analysis.proto	Adds SCANNER_CSAF and matching_confidence map to ScannerResult
proto/src/main/proto/org/dependencytrack/mirror/v1/csaf_data.proto	Defines mirror API message for CSAF documents
pom.xml	Manages csaf-matching-jvm version in dependencyManagement
docker-compose.yml	Adds pgAdmin service for local Postgres administration (dev)
commons-persistence/src/main/resources/schema.sql	Creates ADVISORY table for persisted CSAF documents
commons-persistence/src/main/java/org/dependencytrack/persistence/repository/ComponentRepository.java	Panache repository for Component
commons-persistence/src/main/java/org/dependencytrack/persistence/repository/AdvisoryRepository.java	Panache repository for Advisory
commons-persistence/src/main/java/org/dependencytrack/persistence/model/Vulnerability.java	Adds CSAF as a vulnerability Source
commons-persistence/src/main/java/org/dependencytrack/persistence/model/Advisory.java	JPA entity mapping for the ADVISORY table

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-10-18T15:29:25Z

...bility-analyzer/src/main/java/org/dependencytrack/vulnanalyzer/config/CsafScannerConfig.java

+            @ConfigProperty(name = "dtrack.scanner.csaf.enabled") final Provider<Optional<Boolean>> enabledProvider,
+            @ConfigProperty(name = "dtrack.scanner.csaf.threshold") final Provider<Optional<Integer>> thresholdProvider


Configuration key mismatch: the application.properties uses scanner.csaf.enabled and scanner.csaf.threshold, but this class reads dtrack.scanner.csaf.enabled and dtrack.scanner.csaf.threshold, causing the scanner to appear disabled. Align the keys, e.g. change to scanner.csaf.enabled and scanner.csaf.threshold to match the properties.

Suggested change

@ConfigProperty(name = "dtrack.scanner.csaf.enabled") final Provider<Optional<Boolean>> enabledProvider,

@ConfigProperty(name = "dtrack.scanner.csaf.threshold") final Provider<Optional<Integer>> thresholdProvider

@ConfigProperty(name = "scanner.csaf.enabled") final Provider<Optional<Boolean>> enabledProvider,

@ConfigProperty(name = "scanner.csaf.threshold") final Provider<Optional<Integer>> thresholdProvider

Copilot · 2025-10-18T15:29:25Z

vulnerability-analyzer/src/main/resources/application.properties

+scanner.csaf.enabled=true
+scanner.csaf.topic-partitions=2
+scanner.csaf.threshold=80


These keys are not read by CsafScannerConfig, which expects dtrack.scanner.csaf.enabled/threshold. Either rewrite these to dtrack.scanner.csaf.enabled and dtrack.scanner.csaf.threshold or update CsafScannerConfig to use scanner.csaf.* so the feature can be enabled as intended.

Suggested change

scanner.csaf.enabled=true

scanner.csaf.topic-partitions=2

scanner.csaf.threshold=80

dtrack.scanner.csaf.enabled=true

scanner.csaf.topic-partitions=2

dtrack.scanner.csaf.threshold=80

Copilot · 2025-10-18T15:29:26Z

.../main/java/org/dependencytrack/vulnanalyzer/processor/scanner/csaf/CsafScannerProcessor.java

+        if (!config.enabled().orElse(false)) {
+            return;
+        }


Dropping the record when the scanner is disabled causes the pipeline to lose messages (no ScannerResult is forwarded). Forward an explicit result (e.g., with an empty BOM and a 'skipped/disabled' status) to ensure downstream processors/consumers receive a consistent outcome.

Copilot · 2025-10-18T15:29:26Z

.../main/java/org/dependencytrack/vulnanalyzer/processor/scanner/csaf/CsafScannerProcessor.java

+        }
+
+        // Otherwise, we will use the index of the vulnerability
+        return prefix + "-VULNERABILITY" + vulnIndex;


Missing hyphen before the index yields IDs like '...-VULNERABILITY12'. Use '-VULNERABILITY-' to ensure consistent formatting: return prefix + "-VULNERABILITY-" + vulnIndex;

Suggested change

return prefix + "-VULNERABILITY" + vulnIndex;

return prefix + "-VULNERABILITY-" + vulnIndex;

Copilot · 2025-10-18T15:29:26Z

.../main/java/org/dependencytrack/vulnanalyzer/processor/scanner/csaf/CsafScannerProcessor.java

+        return "CSAF-" + Hex.encodeHexString(
+                digest.digest(
+                        doc.getPublisher().getNamespace().toString().getBytes()
+                )).substring(0, 8) + "-" + doc.getTracking().getId();


Use a deterministic charset when converting strings to bytes to avoid platform-dependent behavior. Replace getBytes() with getBytes(StandardCharsets.UTF_8) and import java.nio.charset.StandardCharsets.

Copilot · 2025-10-18T15:29:27Z

.../main/java/org/dependencytrack/vulnanalyzer/processor/scanner/csaf/CsafScannerProcessor.java

+    @Transactional
+    private ScannerResult analyzeComponent(ScanTask value) {
+        var component = value.getComponent();
+
+        // Retrieve some more information about the component from the database
+        var componentEntity = QuarkusTransaction.joiningExisting().call(() -> componentRepository.find("uuid = :uuid", Map.of("uuid", UUID.fromString(component.getUuid())))
+                .firstResultOptional()
+                .orElseGet(() ->{
+                    // If the component is not found for some reason, we can at least fill CPE and PURL
+                    var entity = new org.dependencytrack.persistence.model.Component();
+                    entity.setPurl(component.getPurl());
+                    entity.setCpe(component.getCpe());
+                    return entity;
+                }));
+
+        return internalAnalyzeComponent(component, createProtobomNode(componentEntity));
+    }


Mixing @transactional with QuarkusTransaction.joiningExisting() is redundant; inside a transactional method you can query via componentRepository directly. Simplify by removing the QuarkusTransaction wrapper here (or drop @transactional and manage the transaction explicitly, but avoid both).

Copilot · 2025-10-18T15:29:27Z

.../main/java/org/dependencytrack/vulnanalyzer/processor/scanner/csaf/CsafScannerProcessor.java

+
+        return new Node(
+                Long.toString(component.getId()),
+                Node.NodeType.Companion.fromValue(0),


Avoid magic numbers for enum values. Use a named constant (e.g., Node.NodeType.) or a helper that conveys the intended default type instead of fromValue(0).

Suggested change

Node.NodeType.Companion.fromValue(0),

Node.NodeType.UNSPECIFIED,

Copilot · 2025-10-18T15:29:28Z

.../main/java/org/dependencytrack/vulnanalyzer/processor/scanner/csaf/CsafScannerProcessor.java

+        if (!config.enabled().orElse(false)) {
+            parsedDocs = List.of();
+        } else {
+            LOGGER.info("Creating csaf scanner processor once?");


[nitpick] The log message reads like a leftover debug note. Consider rephrasing to a clear, actionable message (or drop to DEBUG) without the question mark.

Suggested change

LOGGER.info("Creating csaf scanner processor once?");

LOGGER.info("Initializing CSAF scanner processor.");

Copilot · 2025-10-18T15:29:28Z

vulnerability-analyzer/src/main/resources/application.properties

 quarkus.container-image.registry=ghcr.io
 quarkus.container-image.group=dependencytrack
+
+# Caching of config properties is contra-productive since we want an immediate


Corrected spelling of 'contra-productive' to 'counterproductive'.

Suggested change

# Caching of config properties is contra-productive since we want an immediate

# Caching of config properties is counterproductive since we want an immediate

Copilot · 2025-10-18T15:29:28Z

.../main/java/org/dependencytrack/vulnanalyzer/processor/scanner/csaf/CsafScannerProcessor.java

+     * This function tries to compute a unique ID of a {@link Csaf.Document} so we can set
+     * it as a primary key for an {@link Advisory}.
+     * We use the prefix "CSAF" plus a truncated hash of the publisher namespace and the tracking ID.
+     *


The Javadoc says the hash includes both the publisher namespace and the tracking ID, but the implementation hashes only the namespace and appends the tracking ID as plain text. Update the comment to match the implementation or adjust the code to include both in the hash.

Signed-off-by: Christian Banse <christian.banse@aisec.fraunhofer.de>

Signed-off-by: Christian Banse <oxisto@aybaze.com>

maxmeyer · 2025-12-16T10:39:05Z

@oxisto Is there any progress on this? :-)

oxisto · 2025-12-16T11:01:38Z

@oxisto Is there any progress on this? :-)

I am currently on vacation, I will progress this in January

lawid and others added 30 commits July 11, 2025 10:21

Add CSAF mirroring task

3c20890

Inject executor service, add csaf dependency

03c9778

Add mirror task interface, enable compiling

68bc93a

Add base classes for csaf scanner

a0e044c

Retrieve csaf vulns

44ed60e

Add sample mirroring

985bec1

Switch to jvm libs, use matching shim

babb05c

Create protobom transfer object

51da70a

Formatting

4577eee

Triggering works

703e4c5

Cleanup

8f56a7d

Filling more vulnerability information

7c14db2

Added transactional to prepare for database query

c9b2ca1

Actually loading CSAF providers from database

b541f6f

Persisting real CSAF documents through mirror task

836a2e0

Separate csaf sources and documents

2fc7bc5

Bumped version and checkstyle

12de8af

Added discovery of sources from aggregator

46f81a7

Discovery of providers from aggregator should work now

c526b3a

Trying to set lastFetched, but does not work

1f6d1c9

Last fetched as instant

8cc3fa5

Updated lastFetched

2c443d6

Compute ID using hash of publisher namespace

b6aa085

ID renaming

387eca4

ID rename and set last fetched for aggregator

37c3f76

Merging existing documents with the same ID

5da1254

Prepare test

8987895

Add CREATE sql

879dc62

Move psql default counter to ALTER stmt

8c8d2b4

Update schema to generated liquibase migration

e7d63c8

oxisto and others added 21 commits July 11, 2025 10:21

Aggregator domain/url

0ba7df1

Fix

aefc5ff

Added domain to SQL

cbd1ff6

Add doc retrieval

df30652

Instantiate documents (inefficiently) and try matching components

9f00b32

Properly use kotlin json decoder

63dfcce

Provide hardcoded sample match from scanner

7ccb6f5

Pass protobom node to csaf-matching-jvm

c3b0a39

Using 0.3.2

b53f750

Include pbandk runtime

a4d410b

Fix style

a1925dd

Mirror vulnerabilities from manually added documents

dd7419d

Setting necessary properties for matching

e885098

Feeding more information into the matcher

9bd0de9

Checkstyle

3a7e9a2

Merge remote-tracking branch 'origin/main' into csaf

e83a85b

Added nullable=false

edacb1d

Actually using config values from the database now

3b570fe

Services needs to be enabled

9c7828a

Merge remote-tracking branch 'origin/main' into csaf

d16ba7f

Migrating to Advisory struct

3d9d35c

Signed-off-by: Christian Banse <oxisto@aybaze.com>

Copilot AI review requested due to automatic review settings October 18, 2025 15:24

oxisto mentioned this pull request Oct 18, 2025

Support for CSAF DependencyTrack/hyades-apiserver#1462

Merged

5 tasks

Copilot AI reviewed Oct 18, 2025

View reviewed changes

oxisto and others added 3 commits October 19, 2025 17:11

Slightly better logic to fetch documents

44a9b07

Adding vendor information to protobom

b6a3785

Signed-off-by: Christian Banse <christian.banse@aisec.fraunhofer.de>

Matching confidence as int

08ac26d

Signed-off-by: Christian Banse <oxisto@aybaze.com>

		@ConfigProperty(name = "dtrack.scanner.csaf.enabled") final Provider<Optional<Boolean>> enabledProvider,
		@ConfigProperty(name = "dtrack.scanner.csaf.threshold") final Provider<Optional<Integer>> thresholdProvider

	return prefix + "-VULNERABILITY" + vulnIndex;
	return prefix + "-VULNERABILITY-" + vulnIndex;

	Node.NodeType.Companion.fromValue(0),
	Node.NodeType.UNSPECIFIED,

	LOGGER.info("Creating csaf scanner processor once?");
	LOGGER.info("Initializing CSAF scanner processor.");

	# Caching of config properties is contra-productive since we want an immediate
	# Caching of config properties is counterproductive since we want an immediate

Uh oh!

Support for CSAF-based Vulnerability Analyser #1894

Are you sure you want to change the base?

Support for CSAF-based Vulnerability Analyser #1894

Uh oh!

Conversation

oxisto commented Oct 18, 2025

Description

Addressed Issue

Additional Details

Checklist

Uh oh!

owasp-dt-bot commented Oct 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Oct 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 18, 2025

Choose a reason for hiding this comment

Uh oh!

maxmeyer commented Dec 16, 2025

Uh oh!

oxisto commented Dec 16, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

owasp-dt-bot commented Oct 18, 2025 •

edited

Loading