Fix: Inspector reports should link to CVEs (#6557) #6562
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
achave11-ucsc
force-pushed
the
issues/achave11-ucsc/6557-link-CVEs
branch
3 times, most recently
from
1a818a8
to
255666c
Compare
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## develop #6562 +/- ##
========================================
Coverage 85.38% 85.38%
========================================
Files 155 155
Lines 20754 20754
========================================
Hits 17720 17720
Misses 3034 3034
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
dsotirho-ucsc
requested changes
Sep 12, 2024
scripts/export_inspector_findings.py
Outdated
Comment on lines
198
to
199
| findings_vuln_sorted = {vuln: findings[vuln] for vuln in sorted(findings)} | ||
| for vulnerability, summaries in sorted(findings_vuln_sorted.items(), |
There was a problem hiding this comment.
This double sorting doesn't work since the second sort jumbles up the first sort's results. Also, the current sorting is flawed in that it would sort ['CVE-2024-500', 'CVE-2024-2000', 'CVE-2024-90'] alphanumerically (2000, 500, 90) instead of numerically (90, 500, 2000).
Consider that findings_sort() is already doing a secondary sort by returning a tuple (score, vulnerability_name). This could be modified to sort by (score, int(vulnerability_number)) to achieve a secondary sort using the numeric part of the vulnerability.
Here's a proof of concept:
Index: scripts/export_inspector_findings.py
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
diff --git a/scripts/export_inspector_findings.py b/scripts/export_inspector_findings.py
--- a/scripts/export_inspector_findings.py (revision 255666ceff1d07ea89e2943e57fe6b30e9bfdd48)
+++ b/scripts/export_inspector_findings.py (date 1726158979848)
@@ -10,6 +10,9 @@
import json
import logging
import sys
+from typing import (
+ Any,
+)
from furl import (
furl,
@@ -173,13 +176,17 @@
cols = list(chars) + [a + b for a in chars for b in chars]
return cols[col - 1]
- def findings_sort(self, item: tuple[str, list[SummaryType]]) -> tuple[int, str]:
+ def findings_sort(self, item: tuple[str, list[SummaryType]]) -> tuple[int, tuple[Any, ...]]:
score = 0
weights = {'HIGH': 1, 'CRITICAL': 10}
for summary in item[1]:
count = len(summary['resources'])
score += count * weights.get(summary['severity'], 0)
- return score, item[0]
+ name_parts = item[0].split('-')
+ if len(name_parts) == 3 and name_parts[0] == 'CVE':
+ return score, (int(name_parts[1]), int(name_parts[2]))
+ else:
+ return score, (item[0],)
def write_to_csv(self,
findings: dict[str, list[SummaryType]],
@@ -195,10 +202,11 @@
lookup = dict(zip(titles, range(len(titles))))
rows = [titles]
- findings_vuln_sorted = {vuln: findings[vuln] for vuln in sorted(findings)}
- for vulnerability, summaries in sorted(findings_vuln_sorted.items(),
+ for vulnerability, summaries in sorted(findings.items(),
key=self.findings_sort,
reverse=True):
+ # FIXME: Delete this debug print
+ print(vulnerability, [s['severity'] for s in summaries])
# A mapping of column index to abbreviated severity value
column_values = {
lookup[key]: summary['severity'][0:1]
achave11-ucsc
force-pushed
the
issues/achave11-ucsc/6557-link-CVEs
branch
from
255666c
to
3481d61
Compare
achave11-ucsc
force-pushed
the
issues/achave11-ucsc/6557-link-CVEs
branch
3 times, most recently
from
4fc72d1
to
8c8fcc0
Compare
dsotirho-ucsc
requested changes
Sep 18, 2024
There was a problem hiding this comment.
Consider storing the URL in the summary dictionary instead of creating a separate vulnerability_links dictionary.
Since the script groups findings by vulnerability, and there is one URL provided per finding, it is possible that one vulnerability will have more than one unique URL. In this case I think it makes sense to use the most common URL for a given vulnerability rather than the first (or last) URL encountered. The patch below uses this approach.
Index: scripts/export_inspector_findings.py
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
diff --git a/scripts/export_inspector_findings.py b/scripts/export_inspector_findings.py
--- a/scripts/export_inspector_findings.py (revision 8c8fcc00e7961fd3899e8943e25b9d7a7a66c3a4)
+++ b/scripts/export_inspector_findings.py (date 1726699545451)
@@ -3,6 +3,7 @@
vulnerability.
"""
from collections import (
+ Counter,
defaultdict,
)
import csv
@@ -11,10 +12,6 @@
import logging
import sys
-from furl import (
- furl,
-)
-
from azul.args import (
AzulArgumentHelpFormatter,
)
@@ -119,13 +116,11 @@
if self.args.json:
self.dump_to_json(findings)
parsed_findings = defaultdict(list)
- vulnerability_links = defaultdict(furl)
for finding in findings:
- vulnerability, source_url, summary = self.parse_finding(finding)
- vulnerability_links[vulnerability].url = source_url
+ vulnerability, summary = self.parse_finding(finding)
parsed_findings[vulnerability].append(summary)
log.info('Found %i unique vulnerabilities', len(parsed_findings))
- self.write_to_csv(parsed_findings, vulnerability_links)
+ self.write_to_csv(parsed_findings)
log.info('Done.')
def dump_to_json(self, findings: JSONs) -> None:
@@ -134,7 +129,7 @@
with open(output_file_name, 'w') as f:
json.dump({'findings': findings}, f, default=str, indent=4)
- def parse_finding(self, finding: JSON) -> tuple[str, str, SummaryType]:
+ def parse_finding(self, finding: JSON) -> tuple[str, SummaryType]:
severity = finding['severity']
# The vulnerabilityId is usually a substring of the finding title (e.g.
# "CVE-2023-44487" vs"CVE-2023-44487 - google.golang.org/grpc,
@@ -145,9 +140,9 @@
assert len(finding['resources']) == 1, finding
resource = finding['resources'][0]
resource_type = resource['type']
- source_url = finding['packageVulnerabilityDetails']['sourceUrl']
summary = {
'severity': severity,
+ 'source_url': finding['packageVulnerabilityDetails']['sourceUrl'],
'resource_type': resource_type,
'resources': set(),
}
@@ -165,7 +160,7 @@
self.instances.add(instance)
else:
assert False, resource
- return vulnerability, source_url, summary
+ return vulnerability, summary
def column_alpha(self, col: int) -> str:
assert col > 0, col
@@ -188,9 +183,7 @@
finding_name = finding_name.replace(id, padded_id)
return score, finding_name
- def write_to_csv(self,
- findings: dict[str, list[SummaryType]],
- vulnerability_links: dict[str, furl]) -> None:
+ def write_to_csv(self, findings: dict[str, list[SummaryType]]) -> None:
titles = [
'Vulnerability',
'Severity',
@@ -214,7 +207,11 @@
row_num = len(rows) + 1
col_range = f'C{row_num}:{last_col}{row_num}'
severity_formula = f'=(COUNTIF({col_range},"C")*10)+(COUNTIF({col_range},"H"))'
- url = vulnerability_links[vulnerability].url
+ urls = Counter([summary['source_url'] for summary in summaries])
+ if len(urls.keys()) > 1:
+ log.warning('More than one URL found for %s, using most common', vulnerability)
+ log.warning(dict(urls.most_common()))
+ url = urls.most_common(1)[0][0]
vulnerability_hyperlink = f'=HYPERLINK("{url}","{vulnerability}")'
row = [vulnerability_hyperlink, severity_formula]
for column_index in range(len(row), len(titles) + 1):
scripts/export_inspector_findings.py
Outdated
| @@ -169,12 +176,21 @@ def column_alpha(self, col: int) -> str: | |||
| def findings_sort(self, item: tuple[str, list[SummaryType]]) -> tuple[int, str]: | |||
| score = 0 | |||
| weights = {'HIGH': 1, 'CRITICAL': 10} | |||
| for summary in item[1]: | |||
| finding_name, summaries = item | |||
There was a problem hiding this comment.
Suggested change
| finding_name, summaries = item | |
| vulnerability, summaries = item |
scripts/export_inspector_findings.py
Outdated
| if finding_name.startswith('CVE-'): | ||
| # Best secondary-sorting effort on CVE findings, vulnerability names | ||
| # not prefixed with 'CVE' may reflect an inaccurate secondary order. | ||
| id = finding_name.rsplit('-', 1)[1] |
There was a problem hiding this comment.
Suggested change
| id = finding_name.rsplit('-', 1)[1] | |
| id = finding_name.split('-')[-1] |
achave11-ucsc
force-pushed
the
issues/achave11-ucsc/6557-link-CVEs
branch
from
8c8fcc0
to
7c057cf
Compare
dsotirho-ucsc
requested changes
Sep 20, 2024
scripts/export_inspector_findings.py
Outdated
| # Best secondary-sorting effort on CVE findings, vulnerability names | ||
| # not prefixed with 'CVE' may reflect an inaccurate secondary order. | ||
| id = vulnerability.split('-')[-1] | ||
| padded_id = '000000'[:abs(6 - len(id))] + id |
There was a problem hiding this comment.
Suggested change
| padded_id = '000000'[:abs(6 - len(id))] + id | |
| padded_id = f'{id:0>6}' |
With abs:
>>> for id in ['1234', '12345', '123456', '1234567', '12345678']:
... print('000000'[:abs(6 - len(id))] + id)
001234
012345
123456
01234567
0012345678
With max:
>>> for id in ['1234', '12345', '123456', '1234567', '12345678']:
... print('000000'[:max(0, 6 - len(id))] + id)
001234
012345
123456
1234567
12345678
With f-string:
>>> for id in ['1234', '12345', '123456', '1234567', '12345678']:
... print(f'{id:0>6}')
001234
012345
123456
1234567
12345678
Also, (not needed if you use the f-string approach, but) remember a string can be multiplied by a number:
>>> '0' * 5
'00000'
There was a problem hiding this comment.
Good call on the f-string approach.
Thus far I've only seen 5 digits as part of the CVE ID which comes after the year, which is why I added six 0's (one extra for good measure).
scripts/export_inspector_findings.py
Outdated
| if vulnerability.startswith('CVE-'): | ||
| # Best secondary-sorting effort on CVE findings, vulnerability names | ||
| # not prefixed with 'CVE' may reflect an inaccurate secondary order. | ||
| id = vulnerability.split('-')[-1] |
There was a problem hiding this comment.
Suggested change
| id = vulnerability.split('-')[-1] | |
| prefix, _, id = vulnerability.rpartition('-') |
There was a problem hiding this comment.
Reverted to my original approach, I think it's more deliberate in intend.
scripts/export_inspector_findings.py
Outdated
| # not prefixed with 'CVE' may reflect an inaccurate secondary order. | ||
| id = vulnerability.split('-')[-1] | ||
| padded_id = '000000'[:abs(6 - len(id))] + id | ||
| vulnerability = vulnerability.replace(id, padded_id) |
There was a problem hiding this comment.
Suggested change
| vulnerability = vulnerability.replace(id, padded_id) | |
| vulnerability = '-'.join([prefix, padded_id]) |
There was a problem hiding this comment.
This doesn't quite work, since it omits "year" aspect of the CVE name which also needs to be considered for the secondary sort.
achave11-ucsc
force-pushed
the
issues/achave11-ucsc/6557-link-CVEs
branch
from
7c057cf
to
e2e5569
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Connected issues: #6557
Checklist
Author
developissues/<GitHub handle of author>/<issue#>-<slug>1 when the issue title describes a problem, the corresponding PR
title is
Fix:followed by the issue titleAuthor (partiality)
ptag to titles of partial commitspartialor completely resolves all connected issuespartiallabelAuthor (chains)
baseor this PR is not chained to another PRchainedor is not chained to another PRAuthor (reindex, API changes)
rtag to commit title or the changes introduced by this PR will not require reindexing of any deploymentreindex:devor the changes introduced by it will not require reindexing ofdevreindex:anvildevor the changes introduced by it will not require reindexing ofanvildevreindex:anvilprodor the changes introduced by it will not require reindexing ofanvilprodreindex:prodor the changes introduced by it will not require reindexing ofprodreindex:partialand its description documents the specific reindexing procedure fordev,anvildev,anvilprodandprodor requires a full reindex or carries none of the labelsreindex:dev,reindex:anvildev,reindex:anvilprodandreindex:prodAPIor this PR does not modify a REST APIa(A) tag to commit title for backwards (in)compatible changes or this PR does not modify a REST APIapp.pyor this PR does not modify a REST APIAuthor (upgrading deployments)
make docker_images.jsonand committed the resulting changes or this PR does not modifyazul_docker_images, or any other variables referenced in the definition of that variableutag to commit title or this PR does not require upgrading deploymentsupgradeor does not require upgrading deploymentsdeploy:sharedor does not modifydocker_images.json, and does not require deploying thesharedcomponent for any other reasondeploy:gitlabor does not require deploying thegitlabcomponentdeploy:runneror does not require deploying therunnerimageAuthor (hotfixes)
Ftag to main commit title or this PR does not include permanent fix for a temporary hotfixanvilprodandprod) have temporary hotfixes for any of the issues connected to this PRAuthor (before every review)
develop, squashed old fixupsmake requirements_updateor this PR does not modifyrequirements*.txt,common.mk,MakefileandDockerfileRtag to commit title or this PR does not modifyrequirements*.txtreqsor does not modifyrequirements*.txtmake integration_testpasses in personal deployment or this PR does not modify functionality that could affect the IT outcomePeer reviewer (after approval)
System administrator (after approval)
demoorno demono demono sandboxN reviewslabel is accurateOperator (before pushing merge the commit)
reindex:…labels andrcommit title tagno demodevelop_select dev.shared && CI_COMMIT_REF_NAME=develop make -C terraform/shared apply_keep_unusedor this PR is not labeleddeploy:shared_select dev.gitlab && CI_COMMIT_REF_NAME=develop make -C terraform/gitlab applyor this PR is not labeleddeploy:gitlab_select anvildev.shared && CI_COMMIT_REF_NAME=develop make -C terraform/shared apply_keep_unusedor this PR is not labeleddeploy:shared_select anvildev.gitlab && CI_COMMIT_REF_NAME=develop make -C terraform/gitlab applyor this PR is not labeleddeploy:gitlabdeploy:gitlabdeploy:gitlabSystem administrator
dev.gitlabare complete or this PR is not labeleddeploy:gitlabanvildev.gitlabare complete or this PR is not labeleddeploy:gitlabOperator (before pushing merge the commit)
_select dev.gitlab && make -C terraform/gitlab/runneror this PR is not labeleddeploy:runner_select anvildev.gitlab && make -C terraform/gitlab/runneror this PR is not labeleddeploy:runnersandboxlabel or PR is labeledno sandboxdevor PR is labeledno sandboxanvildevor PR is labeledno sandboxsandboxdeployment or PR is labeledno sandboxanvilboxdeployment or PR is labeledno sandboxsandboxdeployment or PR is labeledno sandboxanvilboxdeployment or PR is labeledno sandboxsandboxor this PR does not remove catalogs or otherwise causes unreferenced indices indevanvilboxor this PR does not remove catalogs or otherwise causes unreferenced indices inanvildevsandboxor this PR is not labeledreindex:devanvilboxor this PR is not labeledreindex:anvildevsandboxor this PR is not labeledreindex:devanvilboxor this PR is not labeledreindex:anvildevpif the PR is also labeledpartialOperator (chain shortening)
developor this PR is not labeledbasechainedlabel from the blocked PR or this PR is not labeledbasebasebaselabel from this PR or this PR is not labeledbaseOperator (after pushing the merge commit)
devanvildevdevdevanvildevanvildev_select dev.shared && make -C terraform/shared applyor this PR is not labeleddeploy:shared_select anvildev.shared && make -C terraform/shared applyor this PR is not labeleddeploy:shareddevanvildevOperator (reindex)
devor this PR is neither labeledreindex:partialnorreindex:devanvildevor this PR is neither labeledreindex:partialnorreindex:anvildevdevor this PR is neither labeledreindex:partialnorreindex:devanvildevor this PR is neither labeledreindex:partialnorreindex:anvildevdevor this PR is neither labeledreindex:partialnorreindex:devanvildevor this PR is neither labeledreindex:partialnorreindex:anvildevdevor this PR does not require reindexingdevanvildevor this PR does not require reindexinganvildevdevor this PR does not require reindexingdevanvildevor this PR does not require reindexinganvildevdevor this PR does not require reindexingdevanvildevor this PR does not require reindexinganvildevOperator
deploy:shared,deploy:gitlab,deploy:runner,API,reindex:partial,reindex:anvilprodandreindex:prodlabels to the next promotion PRs or this PR carries none of these labelsdeploy:shared,deploy:gitlab,deploy:runner,API,reindex:partial,reindex:anvilprodandreindex:prodlabels, from the description of this PR to that of the next promotion PRs or this PR carries none of these labelsShorthand for review comments
Lline is too longWline wrapping is wrongQbad quotesFother formatting problem