chore: improve message output sbom with gh #145

krol3 · 2022-07-19T20:11:50Z

Improve the output with sbom and gh to show error in case of missing the github-pat.

simar7 · 2022-07-19T22:52:29Z

test/data/image-sarif.test

-                "text": "Vulnerability CVE-2016-5385\nSeverity: HIGH\nPackage: guzzlehttp/guzzle\nFixed Version: 5.3.1, 6.2.1, 4.2.4\nLink: [CVE-2016-5385](https://avd.aquasec.com/nvd/cve-2016-5385)\nPHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an \"httpoxy\" issue.",
-                "markdown": "**Vulnerability CVE-2016-5385**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|HIGH|guzzlehttp/guzzle|5.3.1, 6.2.1, 4.2.4|[CVE-2016-5385](https://avd.aquasec.com/nvd/cve-2016-5385)|\n\nPHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an \"httpoxy\" issue."
+                "text": "Vulnerability CVE-2016-5385\nSeverity: HIGH\nPackage: guzzlehttp/guzzle\nFixed Version: 4.2.4, 5.3.1, 6.2.1\nLink: [CVE-2016-5385](https://avd.aquasec.com/nvd/cve-2016-5385)\nPHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an \"httpoxy\" issue.",
+                "markdown": "**Vulnerability CVE-2016-5385**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|HIGH|guzzlehttp/guzzle|4.2.4, 5.3.1, 6.2.1|[CVE-2016-5385](https://avd.aquasec.com/nvd/cve-2016-5385)|\n\nPHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an \"httpoxy\" issue."


I think we need to find a better solution here. SARIF outputs (and JSON based outputs in general) have no ordering and as a result keep changing over time, resulting in unnecessary test failures.

Could you look into maybe changing the test target to not be something with lots of vulnerabilities (like what we have today with knqyf263/vuln-image:1.2.3) but rather something that does not have a lot (or any vulnerabilities)? Could be a small repo/fs golden test directory we could test against.

In this we don't actually care for what is in the output (content/vulnerabilities), but rather we care about the structure of the output (SARIF test should produce a SARIF, etc.)

One idea I have for this is to use images that are no longer actively supported in terms of security updates, like alpine:3.10. They aren't failsafe in terms of the above problem but are an easier target to move to rather than creating the golden artifacts from scratch.

@simar7 done!

simar7 · 2022-07-29T22:10:45Z

entrypoint.sh

+trivyConfig=$(echo $trivyConfig | tr -d '\r')
+if [ $trivyConfig ]; then
+   echo "Running Trivy with trivy.yaml config from: " $trivyConfig
+   trivy --config $trivyConfig ${scanType} $ARGS ${artifactRef}
+   returnCode=$?
+else
+   echo "Running trivy with options: trivy ${scanType} ${ARGS}" "${artifactRef}"
+   echo "Global options: " "${GLOBAL_ARGS}"
+   trivy $GLOBAL_ARGS ${scanType} $ARGS ${artifactRef}
+   returnCode=$?
+fi


Not sure what happened here but this wasn't rebased correctly. See current master branch for details. https://github.com/aquasecurity/trivy-action/blob/master/entrypoint.sh#L167

krol3 requested a review from simar7 July 19, 2022 20:11

simar7 reviewed Jul 19, 2022

View reviewed changes

krol3 requested a review from simar7 July 27, 2022 19:15

simar7 reviewed Jul 29, 2022

View reviewed changes

krol3 force-pushed the sbom-gh branch from c32abb3 to 7de4b70 Compare July 30, 2022 22:38

fix: merge with master- entrypoint

8e0f99e

krol3 force-pushed the sbom-gh branch from 7de4b70 to 8e0f99e Compare July 30, 2022 22:45

chore: gitignore .vscode

0d6f213

krol3 requested a review from simar7 July 30, 2022 22:50

simar7 approved these changes Aug 2, 2022

View reviewed changes

simar7 merged commit 0d7cf2d into aquasecurity:master Aug 2, 2022

krol3 deleted the sbom-gh branch August 2, 2022 22:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: improve message output sbom with gh #145

chore: improve message output sbom with gh #145

krol3 commented Jul 19, 2022

simar7 Jul 19, 2022

simar7 Jul 22, 2022

krol3 Jul 27, 2022

simar7 Jul 29, 2022

chore: improve message output sbom with gh #145

chore: improve message output sbom with gh #145

Conversation

krol3 commented Jul 19, 2022

simar7 Jul 19, 2022

Choose a reason for hiding this comment

simar7 Jul 22, 2022

Choose a reason for hiding this comment

krol3 Jul 27, 2022

Choose a reason for hiding this comment

simar7 Jul 29, 2022

Choose a reason for hiding this comment