Skip to content

Commit e05db16

Browse files
dmurray-laceworkdmurray-lacework
authored
fix: vuln host scan-pkg-manifest fail_on_severity (#1242)
Signed-off-by: Darren Murray <[email protected]>
1 parent dfecd16 commit e05db16

File tree

2 files changed

+99
-3
lines changed

2 files changed

+99
-3
lines changed

‎cli/cmd/vuln_host_scan_package_manifest.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@ To generate a package-manifest from the local host and scan it automatically:
134134
return errors.Wrap(err, "unable to request an on-demand host vulnerability scan")
135135
}
136136

137-
if err := buildVulnHostScanPkgManifestReports(response); err != nil {
137+
if err := buildVulnHostScanPkgManifestReports(&response); err != nil {
138138
return err
139139
}
140140

@@ -160,7 +160,7 @@ To generate a package-manifest from the local host and scan it automatically:
160160
)
161161

162162
// Build the cli output for vuln host scan-package-manifest
163-
func buildVulnHostScanPkgManifestReports(response api.VulnerabilitySoftwarePackagesResponse) error {
163+
func buildVulnHostScanPkgManifestReports(response *api.VulnerabilitySoftwarePackagesResponse) error {
164164
response.Data = filterHostScanPackagesVulnDetails(response.Data)
165165

166166
if cli.JSONOutput() {
@@ -176,7 +176,7 @@ func buildVulnHostScanPkgManifestReports(response api.VulnerabilitySoftwarePacka
176176
return nil
177177
}
178178

179-
func hostScanPackagesVulnToTable(scan api.VulnerabilitySoftwarePackagesResponse) string {
179+
func hostScanPackagesVulnToTable(scan *api.VulnerabilitySoftwarePackagesResponse) string {
180180
var (
181181
mainBldr = &strings.Builder{}
182182
rows [][]string

‎cli/cmd/vuln_host_scan_package_manifest_test.go‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
package cmd
22

33
import (
4+
"encoding/json"
5+
"log"
46
"testing"
57

68
"github.com/lacework/go-sdk/api"
@@ -25,6 +27,39 @@ func TestFilterHostScanPackagesVulnDetailsFixable(t *testing.T) {
2527
assert.Equal(t, res[0].FixInfo.EvalStatus, "VULNERABLE")
2628
}
2729

30+
func TestHostScanPackagesFailOnSeverity(t *testing.T) {
31+
vulCmdState.FailOnSeverity = "critical"
32+
defer func() {
33+
vulCmdState.FailOnSeverity = ""
34+
}()
35+
response, err := mockVulnSoftwarePackagesResponse()
36+
if err != nil {
37+
log.Fatal("unable to unmarshall VulnerabilitySoftwarePackagesResponse")
38+
}
39+
var expectedCount int32 = 1
40+
var expectedTotal int32 = 3
41+
42+
err = buildVulnHostScanPkgManifestReports(&response)
43+
assessmentCounts := response.VulnerabilityCounts()
44+
vulnPolicy := NewVulnerabilityPolicyError(
45+
&assessmentCounts,
46+
vulCmdState.FailOnSeverity,
47+
vulCmdState.FailOnFixable,
48+
)
49+
nonCompliant := vulnPolicy.NonCompliant()
50+
51+
assert.NoError(t, err)
52+
assert.Equal(t, assessmentCounts.Critical, expectedCount)
53+
assert.Equal(t, assessmentCounts.Total, expectedTotal)
54+
assert.True(t, nonCompliant)
55+
}
56+
57+
func mockVulnSoftwarePackagesResponse() (api.VulnerabilitySoftwarePackagesResponse, error) {
58+
var mock api.VulnerabilitySoftwarePackagesResponse
59+
err := json.Unmarshal([]byte(mockVulnSoftwareResponse), &mock)
60+
return mock, err
61+
}
62+
2863
var mockVulnPackages = []api.VulnerabilitySoftwarePackage{{FixInfo: fixInfo{
2964
EvalStatus: "VULNERABLE",
3065
FixAvailable: 1,
@@ -56,3 +91,64 @@ type fixInfo struct {
5691
MaxPrefixMatchingLenScore int `json:"maxPrefixMatchingLenScore"`
5792
VersionInstalled string `json:"versionInstalled"`
5893
}
94+
95+
var mockVulnSoftwareResponse = `
96+
{"data":[
97+
{"osPkgInfo": {"namespace":"amzn:2","os":"amzn","osVer":"2","pkg":"python-babel","pkgVer":"0:0.9.6-8.amzn2.0.1","versionFormat":"rpm"},
98+
"vulnId":"ALAS2-2023-2010","severity":"Critical","featureKey":
99+
{"affectedRange": {"end":{"inclusive":false,"value":"0.9.6-8.amzn2.0.2"},"fixVersion":"0.9.6-8.amzn2.0.2",
100+
"start":{"inclusive":false,"value":"#MINV#"}},
101+
"name":"python-babel","namespace":"amzn:2"},
102+
"cveProps":{
103+
"cveBatchId":"E61EE2ABF4A948E6A4E236F243B016DE",
104+
"description":"Example Description",
105+
"link":"https://alas.aws.amazon.com/AL2/ALAS-2023-2010.html",
106+
"metadata":{"nvd":{"cvssv2":{"publisheddatetime":"","score":0,"vectors":""},
107+
"cvssv3":{"exploitabilityscore":0,"impactscore":0,"score":0,"vectors":""}}}},
108+
"fixInfo":{"compareResult":1,"evalStatus":"VULNERABLE","fixAvailable":1,"fixedVersion":"0:0.9.6-8.amzn2.0.2",
109+
"fixedVersionComparisonInfos":[{"currFixVer":"0.9.6-8.amzn2.0.2","isCurrFixVerGreaterThanOtherFixVer":"0","otherFixVer":"0.9.6-8.amzn2.0.2"}],
110+
"fixedVersionComparisonScore":0,"maxPrefixMatchingLenScore":18,"versionInstalled":"0:0.9.6-8.amzn2.0.1"},
111+
"summary":{"evalCreatedTime":"Thu, 20 Apr 2023 06:33:25 -0700","evalStatus":"MATCH_VULN","numFixableVuln":1,
112+
"numFixableVulnBySeverity":{"1":0,"2":0,"3":0,"4":1,"5":0},"numTotal":1,"numVuln":1,"numVulnBySeverity":{"1":0,"2":0,"3":0,"4":1,"5":0}},
113+
"props":{"evalAlgo":"1001"}},
114+
{"osPkgInfo":{"namespace":"amzn:2","os":"amzn","osVer":"2","pkg":"dbus","pkgVer":"1:1.10.24-7.amzn2.0.2","versionFormat":"rpm"},
115+
"vulnId":"ALAS2-2023-2006","severity":"High","featureKey":
116+
{"affectedRange":{"end":{"inclusive":false,"value":"1:1.10.24-7.amzn2.0.3"},
117+
"fixVersion":"1:1.10.24-7.amzn2.0.3","start":{"inclusive":false,"value":"#MINV#"}},"name":"dbus","namespace":"amzn:2"},
118+
"cveProps":{"cveBatchId":"E61EE2ABF4A948E6A4E236F243B016DE","description":"Example Description",
119+
"link":"https://alas.aws.amazon.com/AL2/ALAS-2023-2006.html","metadata":{"nvd":{"cvssv2":{"publisheddatetime":"","score":0,"vectors":""},"cvssv3":{"exploitabilityscore":0,"impactscore":0,"score":0,"vectors":""}}}},
120+
"fixInfo":{"compareResult":1,"evalStatus":"VULNERABLE","fixAvailable":1,"fixedVersion":"1:1.10.24-7.amzn2.0.3",
121+
"fixedVersionComparisonInfos":[{"currFixVer":"1:1.10.24-7.amzn2.0.3","isCurrFixVerGreaterThanOtherFixVer":"0","otherFixVer":"1:1.10.24-7.amzn2.0.3"}],
122+
"fixedVersionComparisonScore":0,"maxPrefixMatchingLenScore":20,"versionInstalled":"1:1.10.24-7.amzn2.0.2"},
123+
"summary":{"evalCreatedTime":"Thu, 20 Apr 2023 06:33:25 -0700","evalStatus":"MATCH_VULN","numFixableVuln":1,
124+
"numFixableVulnBySeverity":{"1":0,"2":0,"3":0,"4":1,"5":0},"numTotal":2,"numVuln":1,
125+
"numVulnBySeverity":{"1":0,"2":0,"3":0,"4":1,"5":0}},
126+
"props":{"evalAlgo":"1001"}},
127+
{"osPkgInfo":{"namespace":"amzn:2","os":"amzn","osVer":"2","pkg":"dbus","pkgVer":"1:1.10.24-7.amzn2.0.2","versionFormat":"rpm"},
128+
"vulnId":"ALAS2-2023-2006","severity":"Critical","featureKey":
129+
{"affectedRange":{"end":{"inclusive":false,"value":"1:1.10.24-7.amzn2.0.3"},
130+
"fixVersion":"1:1.10.24-7.amzn2.0.3","start":{"inclusive":false,"value":"#MINV#"}},"name":"dbus","namespace":"amzn:2"},
131+
"cveProps":{"cveBatchId":"E61EE2ABF4A948E6A4E236F243B016DE","description":"Example Description",
132+
"link":"https://alas.aws.amazon.com/AL2/ALAS-2023-2006.html","metadata":{"nvd":{"cvssv2":{"publisheddatetime":"","score":0,"vectors":""},"cvssv3":{"exploitabilityscore":0,"impactscore":0,"score":0,"vectors":""}}}},
133+
"fixInfo":{"compareResult":1,"evalStatus":"GOOD","fixAvailable":1,"fixedVersion":"1:1.10.24-7.amzn2.0.3",
134+
"fixedVersionComparisonInfos":[{"currFixVer":"1:1.10.24-7.amzn2.0.3","isCurrFixVerGreaterThanOtherFixVer":"0","otherFixVer":"1:1.10.24-7.amzn2.0.3"}],
135+
"fixedVersionComparisonScore":0,"maxPrefixMatchingLenScore":20,"versionInstalled":"1:1.10.24-7.amzn2.0.2"},
136+
"summary":{"evalCreatedTime":"Thu, 20 Apr 2023 06:33:25 -0700","evalStatus":"MATCH_VULN","numFixableVuln":1,
137+
"numFixableVulnBySeverity":{"1":0,"2":0,"3":0,"4":1,"5":0},"numTotal":2,"numVuln":1,
138+
"numVulnBySeverity":{"1":0,"2":0,"3":0,"4":1,"5":0}},
139+
"props":{"evalAlgo":"1001"}},
140+
{"osPkgInfo":{"namespace":"amzn:2","os":"amzn","osVer":"2","pkg":"vim-data","pkgVer":"2:9.0.1367-1.amzn2.0.1","versionFormat":"rpm"},
141+
"vulnId":"ALAS2-2023-2005","severity":"Medium","featureKey":
142+
{"affectedRange":{"end":{"inclusive":false,"value":"2:9.0.1403-1.amzn2.0.1"},
143+
"fixVersion":"2:9.0.1403-1.amzn2.0.1","start":{"inclusive":false,"value":"#MINV#"}},
144+
"name":"vim-data","namespace":"amzn:2"},"cveProps":{"cveBatchId":"E61EE2ABF4A948E6A4E236F243B016DE",
145+
"description":"Example Description.","link":"https://alas.aws.amazon.com/AL2/ALAS-2023-2005.html",
146+
"metadata":{"nvd":{"cvssv2":{"publisheddatetime":"","score":0,"vectors":""},"cvssv3":{"exploitabilityscore":0,"impactscore":0,"score":0,"vectors":""}}}},
147+
"fixInfo":{"compareResult":1,"evalStatus":"VULNERABLE","fixAvailable":1,"fixedVersion":"2:9.0.1403-1.amzn2.0.1",
148+
"fixedVersionComparisonInfos":[{"currFixVer":"2:9.0.1403-1.amzn2.0.1","isCurrFixVerGreaterThanOtherFixVer":"0","otherFixVer":"2:9.0.1403-1.amzn2.0.1"}],
149+
"fixedVersionComparisonScore":0,"maxPrefixMatchingLenScore":7,"versionInstalled":"2:9.0.1367-1.amzn2.0.1"},
150+
"summary":{"evalCreatedTime":"Thu, 20 Apr 2023 06:33:25 -0700","evalStatus":"MATCH_VULN","numFixableVuln":1,
151+
"numFixableVulnBySeverity":{"1":0,"2":0,"3":0,"4":1,"5":0},"numTotal":12,"numVuln":1,
152+
"numVulnBySeverity":{"1":0,"2":0,"3":0,"4":1,"5":0}},
153+
"props":{"evalAlgo":"1001"}}]}
154+
`

0 commit comments

Comments
 (0)