fix: Change extraction exceptions to logged warnings (#2408)

* fixes #1748

Currently, when files can't be extracted because a tool is not installed, we throw an exception and halt the scan.  This is great for getting attention but terrible if you're scanning a large system and maybe just don't care about scanning those files.  It also causes a problem in the issue linked above when attempting to run cve-bin-tool on a system outside of the ones we actually support.

This PR switches us to logging a message and allowing the scan to proceed.

Author: terriko

cve_bin_tool/extractor.py

@@ -28,13 +28,7 @@
     run_coroutine,
 )
 
-from .error_handler import (
-    ErrorHandler,
-    ErrorMode,
-    ExtractionFailed,
-    ExtractionToolNotFound,
-    UnknownArchiveType,
-)
+from .error_handler import ErrorHandler, ErrorMode, ExtractionFailed, UnknownArchiveType
 from .log import LOGGER
 
 # Run rpmfile in a thread
@@ -107,7 +101,9 @@ async def extract_file_rpm(self, filename, extraction_path):
         else:
             if not await aio_inpath("7z"):
                 with ErrorHandler(mode=self.error_mode, logger=self.logger):
-                    raise ExtractionToolNotFound("7z is required to extract rpm files")
+                    # ExtractionToolNotFound
+                    self.logger.error(f"No extraction tool found for {filename}")
+                    self.logger.error("rpm2cpio or 7z can be used to extract rpm files")
             else:
                 stdout, stderr, _ = await aio_run_command(["7z", "x", filename])
                 if stderr or not stdout:
@@ -152,7 +148,9 @@ async def extract_file_zst(self, filename: str, extraction_path: str) -> int:
                     if stderr:
                         return 1
                 else:
-                    raise ExtractionToolNotFound(
+                    # ExtractionToolNotFound
+                    self.logger.error(f"No extraction tool found for {filename}")
+                    self.logger.error(
                         "tar or 7zip-zstd is required to extract tar.zstd files"
                     )
         return e.exit_code
@@ -205,9 +203,9 @@ async def extract_file_deb(self, filename, extraction_path):
         if is_ar:
             if not await aio_inpath("ar"):
                 with ErrorHandler(mode=self.error_mode, logger=self.logger):
-                    raise ExtractionToolNotFound(
-                        "'ar' is required to extract deb files"
-                    )
+                    # ExtractionToolNotFound
+                    self.logger.error(f"No extraction tool found for {filename}")
+                    self.logger.error("'ar' is required to extract deb files")
             else:
                 stdout, stderr, _ = await aio_run_command(["ar", "x", filename])
                 if stderr:
@@ -264,9 +262,9 @@ async def extract_file_cab(self, filename, extraction_path):
         if sys.platform.startswith("linux"):
             if not await aio_inpath("cabextract"):
                 with ErrorHandler(mode=self.error_mode, logger=self.logger):
-                    raise ExtractionToolNotFound(
-                        "'cabextract' is required to extract cab files"
-                    )
+                    # ExtractionToolNotFound
+                    self.logger.error(f"No extraction tool found for {filename}")
+                    self.logger.error("'cabextract' is required to extract cab files")
             else:
                 stdout, stderr, _ = await aio_run_command(
                     ["cabextract", "-d", extraction_path, filename]
@@ -276,9 +274,9 @@ async def extract_file_cab(self, filename, extraction_path):
         else:
             if not await aio_inpath("Expand"):
                 with ErrorHandler(mode=self.error_mode, logger=self.logger):
-                    raise ExtractionToolNotFound(
-                        "'Expand' is required to extract cab files"
-                    )
+                    # ExtractionToolNotFound
+                    self.logger.error(f"No extraction tool found for {filename}")
+                    self.logger.error("'Expand' is required to extract cab files")
             else:
                 stdout, stderr, _ = await aio_run_command(
                     ["Expand", filename, "-R -F:*", extraction_path]

test/test_extractor.py

@@ -27,7 +27,6 @@
 import pytest
 from pytest_mock import MockerFixture
 
-from cve_bin_tool.error_handler import ERROR_CODES, ExtractionToolNotFound
 from cve_bin_tool.extractor import Extractor
 from cve_bin_tool.util import inpath
 
@@ -285,11 +284,14 @@ async def test_extract_file_deb_no_tool(
                 coroutine(mocker.Mock(return_value=False)),
             )
 
-        with pytest.raises(SystemExit) as e:
-            async for _ in self.extract_files(
-                [f"test{extension}" for extension in extension_list]
-            ):
-                assert e.value.args[0] == ERROR_CODES[ExtractionToolNotFound]
+        # will not extract file, but also won't raise an exception
+        # we could also check log messages?
+        async for extracted_path in self.extract_files(
+            [f"test{extension}" for extension in extension_list]
+        ):
+            assert not (
+                Path(extracted_path) / "usr" / "bin" / "cve_bin_tool_deb_test"
+            ).is_file()
 
 
 class TestExtractFileIpk(TestExtractorBase):
@@ -349,11 +351,12 @@ async def test_extract_file_cab_no_cabextract(
                 coroutine(mocker.Mock(return_value=False)),
             )
 
-        with pytest.raises(SystemExit) as e:
-            async for _ in self.extract_files(
-                [f"test{extension}" for extension in extension_list]
-            ):
-                assert e.value.args[0] == ERROR_CODES[ExtractionToolNotFound]
+        # will not raise exception but also will not extract file
+        # could also check log messages here?
+        async for extracted_path in self.extract_files(
+            [f"test{extension}" for extension in extension_list]
+        ):
+            assert not (Path(extracted_path) / "usr" / "bin" / "python3.8").is_file()
 
 
 class TestExtractFileZip(TestExtractorBase):