Merge pull request #294 from snyk/chore/images

Chore/images

Author: Amir Moualem

src/scanner/image/index.ts

@@ -1,7 +1,11 @@
+import { unlink } from 'fs';
+import * as plugin from 'snyk-docker-plugin';
+
 import logger = require('../../common/logger');
 import { pull as skopeoCopy, getDestinationForImage } from './skopeo';
-import { unlink } from 'fs';
+import config = require('../../common/config');
 import { IPullableImage } from './types';
+import { IStaticAnalysisOptions, StaticAnalysisImageType, IScanResult } from '../types';
 
 export async function pullImages(images: IPullableImage[]): Promise<IPullableImage[]> {
   const pulledImages: IPullableImage[] = [];
@@ -32,3 +36,64 @@ export async function removePulledImages(images: IPullableImage[]): Promise<void
     }
   }
 }
+
+// Exported for testing
+export function removeTagFromImage(imageWithTag: string): string {
+  return imageWithTag.split('@')[0].split(':')[0];
+}
+
+// Exported for testing
+export function getImageTag(imageWithTag: string): string {
+  const imageParts: string[] = imageWithTag.split(':');
+  if (imageParts.length === 2) { // image@sha256:hash or image:tag
+    return imageParts[1];
+  }
+
+  return '';
+}
+
+// Exported for testing
+export function constructStaticAnalysisOptions(
+  fileSystemPath: string,
+): { staticAnalysisOptions: IStaticAnalysisOptions } {
+  return {
+    staticAnalysisOptions: {
+      imagePath: fileSystemPath,
+      imageType: StaticAnalysisImageType.DockerArchive,
+      tmpDirPath: config.IMAGE_STORAGE_ROOT,
+    },
+  };
+}
+
+export async function scanImages(images: IPullableImage[]): Promise<IScanResult[]> {
+  const scannedImages: IScanResult[] = [];
+
+  const dockerfile = undefined;
+
+  for (const {imageName, fileSystemPath} of images) {
+    try {
+      const options = constructStaticAnalysisOptions(fileSystemPath);
+
+      const result = await plugin.inspect(imageName, dockerfile, options);
+
+      if (!result || !result.package || !result.package.dependencies) {
+        throw Error('Unexpected empty result from docker-plugin');
+      }
+
+      result.imageMetadata = {
+        image: removeTagFromImage(imageName),
+        imageTag: getImageTag(imageName),
+      };
+
+      scannedImages.push({
+        image: removeTagFromImage(imageName),
+        imageWithTag: imageName,
+        pluginResult: result,
+      });
+    } catch (error) {
+      logger.warn({error, image: imageName}, 'failed to scan image');
+    }
+  }
+
+  return scannedImages;
+}

src/scanner/images/index.ts

@@ -1,6 +1,5 @@
 import logger = require('../common/logger');
-import { pullImages, removePulledImages, getImagesWithFileSystemPath } from './images';
-import { scanImages } from './image';
+import { pullImages, removePulledImages, getImagesWithFileSystemPath, scanImages } from './images';
 import { deleteWorkload, sendDepGraph } from '../transmitter';
 import { constructDeleteWorkloadPayload, constructDepGraph } from '../transmitter/payload';
 import { IWorkload, ILocalWorkloadLocator } from '../transmitter/types';

src/scanner/index.ts

@@ -1,15 +1,17 @@
 import * as tap from 'tap';
-import { getImagesWithFileSystemPath, pullImages } from '../../../src/scanner/images';
+
 import { IPullableImage } from '../../../src/scanner/images/types';
 import config = require('../../../src/common/config');
+import * as scannerImages from '../../../src/scanner/images';
+
 
 tap.test('getImagesWithFileSystemPath()', async (t) => {
   const noImages: string[] = [];
-  const noImagesResult = getImagesWithFileSystemPath(noImages);
+  const noImagesResult = scannerImages.getImagesWithFileSystemPath(noImages);
   t.same(noImagesResult, [], 'correctly maps an empty array');
 
   const image = ['nginx:latest'];
-  const imageResult = getImagesWithFileSystemPath(image);
+  const imageResult = scannerImages.getImagesWithFileSystemPath(image);
   t.same(imageResult.length, 1, 'expected 1 item');
 
   const resultWithExpectedPath = imageResult[0];
@@ -27,8 +29,8 @@ tap.test('getImagesWithFileSystemPath()', async (t) => {
 
   // Ensure that two consecutive calls do not return the same file system path
   const someImage = ['centos:latest'];
-  const firstCallResult = getImagesWithFileSystemPath(someImage)[0];
-  const secondCallResult = getImagesWithFileSystemPath(someImage)[0];
+  const firstCallResult = scannerImages.getImagesWithFileSystemPath(someImage)[0];
+  const secondCallResult = scannerImages.getImagesWithFileSystemPath(someImage)[0];
   t.ok(
     firstCallResult.fileSystemPath !== secondCallResult.fileSystemPath,
     'consecutive calls to the function with the same data return different file system paths',
@@ -37,6 +39,49 @@ tap.test('getImagesWithFileSystemPath()', async (t) => {
 
 tap.test('pullImages() skips on missing file system path', async (t) => {
   const badImage = [{imageName: 'nginx:latest'}];
-  const result = await pullImages(badImage as IPullableImage[]);
+  const result = await scannerImages.pullImages(badImage as IPullableImage[]);
   t.same(result, [], 'expect to skip images missing file system path');
 });
+
+tap.test('constructStaticAnalysisOptions() tests', async (t) => {
+  t.plan(1);
+
+  const somePath = '/var/tmp/file.tar';
+  const options = scannerImages.constructStaticAnalysisOptions(somePath);
+  const expectedResult = {
+    staticAnalysisOptions: {
+      imagePath: somePath,
+      imageType: 'docker-archive',
+      tmpDirPath: '/var/tmp',
+    },
+  };
+
+  t.deepEqual(options, expectedResult, 'returned options match expectations');
+});
+
+tap.test('getImageTag() tests', async (t) => {
+  t.plan(4);
+
+  const imageWithSha = 'nginx@sha256:1234567890abcdef';
+  const imageWithShaResult = scannerImages.getImageTag(imageWithSha);
+  t.same(imageWithShaResult, '1234567890abcdef', 'image sha is returned');
+
+  const imageWithTag = 'nginx:latest';
+  const imageWithTagResult = scannerImages.getImageTag(imageWithTag);
+  t.same(imageWithTagResult, 'latest', 'image tag is returned');
+
+  const imageWithoutTag = 'nginx';
+  const imageWithoutTagResult = scannerImages.getImageTag(imageWithoutTag);
+  t.same(imageWithoutTagResult, '', 'empty tag returned when no tag is specified');
+
+  const imageWithManySeparators = 'nginx@abc:tag@bad:reallybad';
+  const imageWithManySeparatorsResult = scannerImages.getImageTag(imageWithManySeparators);
+  t.same(imageWithManySeparatorsResult, '', 'empty tag is returned on malformed image name and tag');
+});
+
+tap.test('removeTagFromImage() tests', async (t) => {
+  t.plan(2);
+
+  t.same(scannerImages.removeTagFromImage('nginx:latest'), 'nginx', 'removed image:tag');
+  t.same(scannerImages.removeTagFromImage('nginx:@sha256:1234567890abcdef'), 'nginx', 'removed image@sha:hex');
+});