feat: add vulnerability count to matched packages, enabled via flag --show-vuln-count (#507)

Signed-off-by: Rafael Mestre <rafael@herodevs.com>

Author: rlmestre

cmd/xeol/cli/commands/root.go

@@ -244,12 +244,13 @@ func runXeol(app clio.Application, opts *options.Xeol, userInput string) error {
 		}
 
 		if err := writer.Write(models.PresenterConfig{
-			Matches:   allMatches,
-			Packages:  packages,
-			Context:   pkgContext,
-			SBOM:      s,
-			AppConfig: opts,
-			DBStatus:  status,
+			Matches:       allMatches,
+			Packages:      packages,
+			Context:       pkgContext,
+			SBOM:          s,
+			AppConfig:     opts,
+			ShowVulnCount: opts.ShowVulnCount,
+			DBStatus:      status,
 		}); err != nil {
 			errs <- err
 		}

cmd/xeol/cli/options/xeol.go

@@ -33,6 +33,7 @@ type Xeol struct {
 	Registry               registry    `yaml:"registry" json:"registry" mapstructure:"registry"`
 	Name                   string      `yaml:"name" json:"name" mapstructure:"name"`
 	DefaultImagePullSource string      `yaml:"default-image-pull-source" json:"default-image-pull-source" mapstructure:"default-image-pull-source"`
+	ShowVulnCount          bool        `yaml:"show-vuln-count" json:"show-vuln-count" mapstructure:"show-vuln-count"`
 }
 
 var _ interface {
@@ -53,6 +54,7 @@ func DefaultXeol(id clio.Identification) *Xeol {
 		ProjectName:       project,
 		CommitHash:        commit,
 		ImagePath:         "Dockerfile",
+		ShowVulnCount:     false,
 	}
 	return config
 }
@@ -123,6 +125,11 @@ func (o *Xeol) AddFlags(flags clio.FlagSet) {
 		"platform", "",
 		"an optional platform specifier for container image sources (e.g. 'linux/arm64', 'linux/arm64/v8', 'arm64', 'linux')",
 	)
+
+	flags.BoolVarP(&o.ShowVulnCount,
+		"show-vuln-count", "",
+		"show the number of vulnerabilities found for each package (default is false)",
+	)
 }
 
 func (o *Xeol) parseLookaheadOption() (err error) {

test/integration/db_mock_test.go

@@ -19,6 +19,10 @@ func (s *mockStore) GetCyclesByCpe(cpe string) ([]xeolDB.Cycle, error) {
 	return s.backend[cpe], nil
 }
 
+func (s *mockStore) GetVulnCountByPurlAndVersion(purl string, version string) (int, error) {
+	return 0, nil
+}
+
 func (s *mockStore) GetAllProducts() (*[]xeolDB.Product, error) {
 	return nil, nil
 }

xeol/db/eol_provider.go

@@ -83,3 +83,17 @@ func (pr *EolProvider) GetByPackagePurl(p pkg.Package) ([]eol.Cycle, error) {
 
 	return cycles, nil
 }
+
+func (pr *EolProvider) GetVulnCount(p pkg.Package) (int, error) {
+	shortPurl, err := purl.ShortPurl(p)
+	if err != nil {
+		return 0, err
+	}
+
+	vulnCount, err := pr.reader.GetVulnCountByPurlAndVersion(shortPurl, p.Version)
+	if err != nil {
+		return 0, err
+	}
+
+	return vulnCount, nil
+}

xeol/db/v1/eol.go

@@ -36,6 +36,7 @@ type EolStore interface {
 type EolStoreReader interface {
 	GetCyclesByPurl(purl string) ([]Cycle, error)
 	GetCyclesByCpe(cpe string) ([]Cycle, error)
+	GetVulnCountByPurlAndVersion(purl string, version string) (int, error)
 	GetAllProducts() (*[]Product, error)
 }
 

xeol/db/v1/store/store.go

@@ -143,3 +143,14 @@ func (s *store) GetCyclesByPurl(purl string) ([]v1.Cycle, error) {
 	}
 	return cycles, nil
 }
+
+func (s *store) GetVulnCountByPurlAndVersion(purl string, version string) (int, error) {
+	var vulnCount int
+	if result := s.db.Table("vulns").
+		Select("vulns.issue_count").
+		Joins("JOIN purls ON vulns.product_id = purls.product_id").
+		Where("purls.purl = ? AND vulns.version = ?", purl, version).Find(&vulnCount); result.Error != nil {
+		return 0, result.Error
+	}
+	return vulnCount, nil
+}

xeol/eol/provider.go

@@ -13,6 +13,7 @@ type Provider interface {
 
 type ProviderByPackagePurl interface {
 	GetByPackagePurl(p pkg.Package) ([]Cycle, error)
+	GetVulnCount(p pkg.Package) (int, error)
 }
 
 type ProviderByDistroCpe interface {

xeol/match/fingerprint.go

@@ -13,6 +13,7 @@ type Fingerprint struct {
 	eolDate      string
 	eolBool      bool
 	lts          string
+	version      string
 }
 
 func (m Fingerprint) String() string {

xeol/match/match.go

@@ -11,8 +11,9 @@ var ErrCannotMerge = fmt.Errorf("unable to merge eol matches")
 
 // Match represents a finding in the eol matching process, pairing a single package and a single eol object.
 type Match struct {
-	Cycle   eol.Cycle
-	Package pkg.Package // The package used to search for a match.
+	Cycle     eol.Cycle
+	Package   pkg.Package // The package used to search for a match.
+	VulnCount int
 }
 
 // String is the string representation of select match fields.
@@ -32,6 +33,7 @@ func (m Match) Fingerprint() Fingerprint {
 		eolDate:      m.Cycle.Eol,
 		eolBool:      m.Cycle.EolBool,
 		lts:          m.Cycle.LTS,
+		version:      m.Package.Version,
 	}
 }
 

xeol/matcher/distro/matcher_test.go

@@ -29,6 +29,10 @@ func (s *mockStore) GetCyclesByCpe(cpe string) ([]xeolDB.Cycle, error) {
 	return s.backend[cpe], nil
 }
 
+func (s *mockStore) GetVulnCountByPurlAndVersion(purl string, version string) (int, error) {
+	return 0, nil
+}
+
 func (s *mockStore) GetAllProducts() (*[]xeolDB.Product, error) {
 	return nil, nil
 }