Skip to content

Commit e5999be

Browse files
sadayuki-matsunosadayuki-matsuno
authored
feat(libarary) add include dev dependencies (#2394)
* feat(libarary) add include dev dependencies * fix(test) mv Test_convertLibWithScanner to library_test.go
1 parent ce2855c commit e5999be

File tree

5 files changed

+132
-10
lines changed

5 files changed

+132
-10
lines changed

‎scanner/base.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -737,7 +737,7 @@ func (l *base) scanLibraries() (err error) {
737737
continue
738738
}
739739

740-
libraryScanners, err := AnalyzeLibrary(context.Background(), abspath, contents, filemode, l.ServerInfo.Mode.IsOffline())
740+
libraryScanners, err := AnalyzeLibrary(context.Background(), abspath, contents, filemode, l.ServerInfo.Mode.IsOffline(), false)
741741
if err != nil {
742742
return xerrors.Errorf("Failed to analyze library. err: %w, filepath: %s", err, abspath)
743743
}
@@ -747,7 +747,7 @@ func (l *base) scanLibraries() (err error) {
747747
}
748748

749749
// AnalyzeLibrary : detects library defined in artifact such as lockfile or jar
750-
func AnalyzeLibrary(ctx context.Context, path string, contents []byte, filemode os.FileMode, isOffline bool) (libraryScanners []models.LibraryScanner, err error) {
750+
func AnalyzeLibrary(ctx context.Context, path string, contents []byte, filemode os.FileMode, isOffline, includeDevDependencies bool) (libraryScanners []models.LibraryScanner, err error) {
751751
ag, err := fanal.NewAnalyzerGroup(fanal.AnalyzerOptions{
752752
Group: fanal.GroupBuiltin,
753753
DisabledAnalyzers: disabledAnalyzers,
@@ -806,7 +806,7 @@ func AnalyzeLibrary(ctx context.Context, path string, contents []byte, filemode
806806
}
807807
}
808808

809-
libscan, err := convertLibWithScanner(result.Applications)
809+
libscan, err := convertLibWithScanner(result.Applications, includeDevDependencies)
810810
if err != nil {
811811
return nil, xerrors.Errorf("Failed to convert libs. err: %w", err)
812812
}

‎scanner/library.go‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,13 @@ import (
1010
"github.com/future-architect/vuls/models"
1111
)
1212

13-
func convertLibWithScanner(apps []ftypes.Application) ([]models.LibraryScanner, error) {
14-
for i := range apps {
15-
apps[i].Packages = lo.Filter(apps[i].Packages, func(lib ftypes.Package, _ int) bool {
16-
return !lib.Dev
17-
})
13+
func convertLibWithScanner(apps []ftypes.Application, includeDevDependencies bool) ([]models.LibraryScanner, error) {
14+
if !includeDevDependencies {
15+
for i := range apps {
16+
apps[i].Packages = lo.Filter(apps[i].Packages, func(lib ftypes.Package, _ int) bool {
17+
return !lib.Dev
18+
})
19+
}
1820
}
1921

2022
scanners := make([]models.LibraryScanner, 0, len(apps))

‎scanner/library_test.go‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
package scanner
2+
3+
import (
4+
"reflect"
5+
"testing"
6+
7+
ftypes "github.com/aquasecurity/trivy/pkg/fanal/types"
8+
"github.com/future-architect/vuls/models"
9+
)
10+
11+
func Test_convertLibWithScanner(t *testing.T) {
12+
type args struct {
13+
apps []ftypes.Application
14+
includeDevDependencies bool
15+
}
16+
tests := []struct {
17+
name string
18+
args args
19+
want []models.LibraryScanner
20+
}{
21+
{
22+
name: "exclude dev dependencies",
23+
args: args{
24+
apps: []ftypes.Application{
25+
{
26+
Type: ftypes.Npm,
27+
FilePath: "package-lock.json",
28+
Packages: []ftypes.Package{
29+
{Name: "lodash", Version: "4.17.21", Dev: false},
30+
{Name: "jest", Version: "29.0.0", Dev: true},
31+
{Name: "express", Version: "4.18.0", Dev: false},
32+
},
33+
},
34+
},
35+
includeDevDependencies: false,
36+
},
37+
want: []models.LibraryScanner{
38+
{
39+
Type: ftypes.Npm,
40+
LockfilePath: "package-lock.json",
41+
Libs: []models.Library{
42+
{Name: "lodash", Version: "4.17.21", PURL: "pkg:npm/[email protected]"},
43+
{Name: "express", Version: "4.18.0", PURL: "pkg:npm/[email protected]"},
44+
},
45+
},
46+
},
47+
},
48+
{
49+
name: "include dev dependencies",
50+
args: args{
51+
apps: []ftypes.Application{
52+
{
53+
Type: ftypes.Npm,
54+
FilePath: "package-lock.json",
55+
Packages: []ftypes.Package{
56+
{Name: "lodash", Version: "4.17.21", Dev: false},
57+
{Name: "jest", Version: "29.0.0", Dev: true},
58+
{Name: "express", Version: "4.18.0", Dev: false},
59+
},
60+
},
61+
},
62+
includeDevDependencies: true,
63+
},
64+
want: []models.LibraryScanner{
65+
{
66+
Type: ftypes.Npm,
67+
LockfilePath: "package-lock.json",
68+
Libs: []models.Library{
69+
{Name: "lodash", Version: "4.17.21", PURL: "pkg:npm/[email protected]"},
70+
{Name: "jest", Version: "29.0.0", PURL: "pkg:npm/[email protected]"},
71+
{Name: "express", Version: "4.18.0", PURL: "pkg:npm/[email protected]"},
72+
},
73+
},
74+
},
75+
},
76+
{
77+
name: "all dev dependencies excluded",
78+
args: args{
79+
apps: []ftypes.Application{
80+
{
81+
Type: ftypes.Npm,
82+
FilePath: "package-lock.json",
83+
Packages: []ftypes.Package{
84+
{Name: "jest", Version: "29.0.0", Dev: true},
85+
{Name: "mocha", Version: "10.0.0", Dev: true},
86+
},
87+
},
88+
},
89+
includeDevDependencies: false,
90+
},
91+
want: []models.LibraryScanner{
92+
{
93+
Type: ftypes.Npm,
94+
LockfilePath: "package-lock.json",
95+
Libs: []models.Library{},
96+
},
97+
},
98+
},
99+
{
100+
name: "empty apps",
101+
args: args{
102+
apps: []ftypes.Application{},
103+
includeDevDependencies: false,
104+
},
105+
want: []models.LibraryScanner{},
106+
},
107+
}
108+
for _, tt := range tests {
109+
t.Run(tt.name, func(t *testing.T) {
110+
got, err := convertLibWithScanner(tt.args.apps, tt.args.includeDevDependencies)
111+
if err != nil {
112+
t.Errorf("convertLibWithScanner() error = %v", err)
113+
return
114+
}
115+
if !reflect.DeepEqual(got, tt.want) {
116+
t.Errorf("convertLibWithScanner() = %v, want %v", got, tt.want)
117+
}
118+
})
119+
}
120+
}

‎scanner/pseudo.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ func (o *pseudo) scanLibraries() (err error) {
131131
}
132132

133133
trivypath := o.cleanPath(abspath)
134-
libraryScanners, err := AnalyzeLibrary(context.Background(), trivypath, contents, filemode, o.getServerInfo().Mode.IsOffline())
134+
libraryScanners, err := AnalyzeLibrary(context.Background(), trivypath, contents, filemode, o.getServerInfo().Mode.IsOffline(), false)
135135
if err != nil {
136136
return xerrors.Errorf("Failed to analyze library. err: %w, filepath: %s", err, trivypath)
137137
}

‎scanner/windows.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5376,7 +5376,7 @@ func (w *windows) scanLibraries() (err error) {
53765376
}
53775377

53785378
trivypath := w.cleanPath(abspath)
5379-
libraryScanners, err := AnalyzeLibrary(context.Background(), trivypath, contents, filemode, w.ServerInfo.Mode.IsOffline())
5379+
libraryScanners, err := AnalyzeLibrary(context.Background(), trivypath, contents, filemode, w.ServerInfo.Mode.IsOffline(), false)
53805380
if err != nil {
53815381
return xerrors.Errorf("Failed to analyze library. err: %w, filepath: %s", err, trivypath)
53825382
}

0 commit comments

Comments
 (0)