@@ -23,13 +23,15 @@ func AttachFixedVersionsToVulnerabilities(xrayManager *xray.XrayServicesManager,
2323 return fmt .Errorf ("failed to get remediation options from Xray: %w" , err )
2424 }
2525 log .Verbose (fmt .Sprintf ("Remediation options received from Xray: %+v" , remediationOptions ))
26+ // Right now, we only support QuickestFixStrategy (fixing the actual component to a specific version)
27+ strategy := utils .QuickestFixStrategy
2628 for _ , vulnerability := range * bom .Vulnerabilities {
27- matchVulnerabilityToRemediationOptions (bom , & vulnerability , remediationOptions )
29+ matchVulnerabilityToRemediationOptions (bom , & vulnerability , remediationOptions , strategy )
2830 }
2931 return nil
3032}
3133
32- func matchVulnerabilityToRemediationOptions (bom * cyclonedx.BOM , vulnerability * cyclonedx.Vulnerability , remediationOptions utils.CveRemediationResponse ) {
34+ func matchVulnerabilityToRemediationOptions (bom * cyclonedx.BOM , vulnerability * cyclonedx.Vulnerability , remediationOptions utils.CveRemediationResponse , strategy utils. FixStrategy ) {
3335 if vulnerability .Affects == nil || len (* vulnerability .Affects ) == 0 {
3436 log .Debug ("No affected components found for vulnerability " + vulnerability .ID + ", skipping attaching fixed versions" )
3537 return
@@ -43,7 +45,7 @@ func matchVulnerabilityToRemediationOptions(bom *cyclonedx.BOM, vulnerability *c
4345 continue
4446 }
4547 // Convert remediation steps to fixed versions affected versions
46- for _ , step := range getAffectComponentCveRemediationStepsByFixedVersion (vulnerability .ID , * affectComponent , cveRemediationOptions ) {
48+ for _ , step := range getAffectComponentCveRemediationStepsByFixedVersion (vulnerability .ID , * affectComponent , cveRemediationOptions , strategy ) {
4749 cdxutils .AppendAffectedVersionsIfNotExists (& affect , cyclonedx.AffectedVersions {
4850 Version : step .UpgradeTo .Version ,
4951 Status : cyclonedx .VulnerabilityStatusNotAffected ,
@@ -56,13 +58,18 @@ func matchVulnerabilityToRemediationOptions(bom *cyclonedx.BOM, vulnerability *c
5658 }
5759}
5860
59- func getAffectComponentCveRemediationStepsByFixedVersion (cve string , component cyclonedx.Component , cveRemediationOptions []utils.Option ) (steps []utils.OptionStep ) {
61+ func getAffectComponentCveRemediationStepsByFixedVersion (cve string , component cyclonedx.Component , cveRemediationOptions []utils.Option , strategy utils. FixStrategy ) (steps []utils.OptionStep ) {
6062 for _ , cveRemediationOption := range cveRemediationOptions {
6163 if cveRemediationOption .Type != utils .InLock {
6264 // We only want InLock remediation type (forcing the actual component to a specific fix version)
6365 continue
6466 }
65- for _ , step := range cveRemediationOption .Steps {
67+ stepsMap , found := cveRemediationOption .Steps [strategy ]
68+ if ! found || len (stepsMap ) == 0 {
69+ log .Debug (fmt .Sprintf ("No remediation steps found for strategy '%d' for component '%s' in vulnerability '%s'" , strategy , component .Name , cve ))
70+ continue
71+ }
72+ for _ , step := range stepsMap {
6673 if step .StepType == utils .NoFixVersion {
6774 log .Debug (fmt .Sprintf ("No fix version available for component '%s' in vulnerability '%s'" , component .Name , cve ))
6875 continue
0 commit comments