Skip to content

Commit 07cbeff

Browse files
AppleGamer22AppleGamer22
authored
Maximum severity rating for each Group object in JSON output (#805)
- Addresses issue #495. - I'm happy to add tests for the `MaxSeverity` function if this is required for this issue. --------- Signed-off-by: Omri Bornstein <[email protected]>
1 parent ce4c65d commit 07cbeff

File tree

8 files changed

+70
-36
lines changed

8 files changed

+70
-36
lines changed

‎internal/ci/__snapshots__/vulnerability_result_diff_test.snap

+14-7
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,8 @@
108108
"ids": [
109109
"GO-2021-0053"
110110
],
111-
"aliases": null
111+
"aliases": null,
112+
"max_severity": ""
112113
}
113114
]
114115
}
@@ -243,7 +244,8 @@
243244
"aliases": [
244245
"CVE-2021-3121",
245246
"GHSA-c3h9-896r-86jm"
246-
]
247+
],
248+
"max_severity": "8.6"
247249
}
248250
]
249251
}
@@ -378,7 +380,8 @@
378380
"aliases": [
379381
"CVE-2021-3121",
380382
"GHSA-c3h9-896r-86jm"
381-
]
383+
],
384+
"max_severity": ""
382385
}
383386
]
384387
}
@@ -537,7 +540,8 @@
537540
"aliases": [
538541
"CVE-2021-3121",
539542
"GHSA-c3h9-896r-86jm"
540-
]
543+
],
544+
"max_severity": "8.6"
541545
}
542546
]
543547
}
@@ -745,7 +749,8 @@
745749
"GHSA-m5pq-gvj9-9vr8",
746750
"RUSTSEC-2022-0013"
747751
],
748-
"aliases": null
752+
"aliases": null,
753+
"max_severity": ""
749754
}
750755
]
751756
}
@@ -880,7 +885,8 @@
880885
"aliases": [
881886
"CVE-2021-3121",
882887
"GHSA-c3h9-896r-86jm"
883-
]
888+
],
889+
"max_severity": ""
884890
}
885891
]
886892
}
@@ -1088,7 +1094,8 @@
10881094
"GHSA-m5pq-gvj9-9vr8",
10891095
"RUSTSEC-2022-0013"
10901096
],
1091-
"aliases": null
1097+
"aliases": null,
1098+
"max_severity": ""
10921099
}
10931100
]
10941101
}

‎internal/ci/vulnerability_result_diff.go

+4
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package ci
33
import (
44
"slices"
55

6+
"github.com/google/osv-scanner/internal/output"
67
"github.com/google/osv-scanner/pkg/grouper"
78
"github.com/google/osv-scanner/pkg/models"
89
)
@@ -55,6 +56,9 @@ func DiffVulnerabilityResults(oldRes, newRes models.VulnerabilityResults) models
5556
}
5657
// Rebuild the groups lost in the previous step
5758
groups := grouper.Group(grouper.ConvertVulnerabilityToIDAliases(resultPV.Vulnerabilities))
59+
for i, group := range groups {
60+
groups[i].MaxSeverity = output.MaxSeverity(group, *resultPV)
61+
}
5862
resultPV.Groups = groups
5963
}
6064
if len(resultPS.Packages) == 0 {

‎internal/output/githubannotation.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ func createSourceRemediationTable(source models.PackageSource, groupFixedVersion
2828
remediationTable.AppendRow(table.Row{
2929
pv.Package.Name,
3030
strings.Join(vulnIDs, "\n"),
31-
MaxSeverity(group, pv),
31+
group.MaxSeverity,
3232
pv.Package.Version,
3333
strings.Join(fixedVersions, "\n")})
3434
}

‎internal/output/table.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,7 @@ func tableBuilderInner(vulnResult *models.VulnerabilityResults, addStyling bool,
121121
}
122122

123123
outputRow = append(outputRow, strings.Join(links, "\n"))
124-
outputRow = append(outputRow, MaxSeverity(group, pkg))
124+
outputRow = append(outputRow, group.MaxSeverity)
125125

126126
if pkg.Package.Ecosystem == "" && pkg.Package.Commit != "" {
127127
pkgCommitStr := results.PkgToString(pkg.Package)

‎internal/sourceanalysis/__snapshots__/go_test.snap

+12-6
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,8 @@
162162
"GO-2021-0053": {
163163
"called": false
164164
}
165-
}
165+
},
166+
"max_severity": ""
166167
}
167168
]
168169
},
@@ -314,7 +315,8 @@
314315
"GO-2023-1558": {
315316
"called": true
316317
}
317-
}
318+
},
319+
"max_severity": ""
318320
}
319321
]
320322
},
@@ -467,7 +469,8 @@
467469
"GO-2023-1572": {
468470
"called": false
469471
}
470-
}
472+
},
473+
"max_severity": ""
471474
}
472475
]
473476
}
@@ -621,7 +624,8 @@
621624
"GHSA-c3h9-896r-86jm",
622625
"GO-2021-0053"
623626
],
624-
"aliases": null
627+
"aliases": null,
628+
"max_severity": ""
625629
}
626630
]
627631
},
@@ -757,7 +761,8 @@
757761
"GHSA-2h6c-j3gf-xp9r",
758762
"GO-2023-1558"
759763
],
760-
"aliases": null
764+
"aliases": null,
765+
"max_severity": ""
761766
}
762767
]
763768
},
@@ -892,7 +897,8 @@
892897
"GHSA-qgc7-mgm3-q253",
893898
"GO-2023-1572"
894899
],
895-
"aliases": null
900+
"aliases": null,
901+
"max_severity": ""
896902
}
897903
]
898904
}

‎pkg/models/results.go

+1
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,7 @@ type GroupInfo struct {
111111
Aliases []string `json:"aliases"`
112112
// Map of Vulnerability IDs to AnalysisInfo
113113
ExperimentalAnalysis map[string]AnalysisInfo `json:"experimentalAnalysis,omitempty"`
114+
MaxSeverity string `json:"max_severity"`
114115
}
115116

116117
// IsCalled returns true if any analysis performed determines that the vulnerability is being called

‎pkg/osvscanner/__snapshots__/osvscanner_internal_test.snap

+24-12
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,8 @@
166166
"aliases": [
167167
"GHSA-mc8h-8q98-g5hr",
168168
"RUSTSEC-2023-0018"
169-
]
169+
],
170+
"max_severity": ""
170171
}
171172
]
172173
},
@@ -414,7 +415,8 @@
414415
"aliases": [
415416
"GHSA-wcg3-cvx6-7396",
416417
"RUSTSEC-2020-0071"
417-
]
418+
],
419+
"max_severity": ""
418420
}
419421
]
420422
}
@@ -889,15 +891,17 @@
889891
"aliases": [
890892
"GHSA-fxg5-wq6x-vr4w",
891893
"GO-2023-1495"
892-
]
894+
],
895+
"max_severity": ""
893896
},
894897
{
895898
"ids": [
896899
"GO-2022-1144"
897900
],
898901
"aliases": [
899902
"GO-2022-1144"
900-
]
903+
],
904+
"max_severity": ""
901905
},
902906
{
903907
"ids": [
@@ -907,7 +911,8 @@
907911
"aliases": [
908912
"GHSA-vvpx-j8f3-3w6h",
909913
"GO-2023-1571"
910-
]
914+
],
915+
"max_severity": ""
911916
}
912917
]
913918
}
@@ -1051,15 +1056,17 @@
10511056
],
10521057
"aliases": [
10531058
"GHSA-mrrw-grhq-86gf"
1054-
]
1059+
],
1060+
"max_severity": ""
10551061
},
10561062
{
10571063
"ids": [
10581064
"RUSTSEC-2023-0015"
10591065
],
10601066
"aliases": [
10611067
"RUSTSEC-2023-0015"
1062-
]
1068+
],
1069+
"max_severity": ""
10631070
}
10641071
]
10651072
},
@@ -1209,7 +1216,8 @@
12091216
"aliases": [
12101217
"GHSA-mc8h-8q98-g5hr",
12111218
"RUSTSEC-2023-0018"
1212-
]
1219+
],
1220+
"max_severity": ""
12131221
}
12141222
]
12151223
},
@@ -1457,7 +1465,8 @@
14571465
"aliases": [
14581466
"GHSA-wcg3-cvx6-7396",
14591467
"RUSTSEC-2020-0071"
1460-
]
1468+
],
1469+
"max_severity": ""
14611470
}
14621471
]
14631472
}
@@ -1682,7 +1691,8 @@
16821691
"aliases": [
16831692
"GHSA-vvpx-j8f3-3w6h",
16841693
"GO-2023-1571"
1685-
]
1694+
],
1695+
"max_severity": ""
16861696
}
16871697
]
16881698
}
@@ -1767,7 +1777,8 @@
17671777
],
17681778
"aliases": [
17691779
"GHSA-mrrw-grhq-86gf"
1770-
]
1780+
],
1781+
"max_severity": ""
17711782
}
17721783
]
17731784
},
@@ -2015,7 +2026,8 @@
20152026
"aliases": [
20162027
"GHSA-wcg3-cvx6-7396",
20172028
"RUSTSEC-2020-0071"
2018-
]
2029+
],
2030+
"max_severity": ""
20192031
}
20202032
]
20212033
}

‎pkg/osvscanner/vulnerability_result.go

+13-9
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import (
44
"sort"
55
"strings"
66

7+
"github.com/google/osv-scanner/internal/output"
78
"github.com/google/osv-scanner/internal/sourceanalysis"
89
"github.com/google/osv-scanner/pkg/grouper"
910
"github.com/google/osv-scanner/pkg/models"
@@ -22,7 +23,7 @@ func buildVulnerabilityResults(
2223
licensesResp [][]models.License,
2324
actions ScannerActions,
2425
) models.VulnerabilityResults {
25-
output := models.VulnerabilityResults{
26+
results := models.VulnerabilityResults{
2627
Results: []models.PackageSource{},
2728
}
2829
groupedBySource := map[models.SourceInfo][]models.PackageVulns{}
@@ -57,6 +58,9 @@ func buildVulnerabilityResults(
5758
includePackage = true
5859
pkg.Vulnerabilities = vulnsResp.Results[i].Vulns
5960
pkg.Groups = grouper.Group(grouper.ConvertVulnerabilityToIDAliases(pkg.Vulnerabilities))
61+
for i, group := range pkg.Groups {
62+
pkg.Groups[i].MaxSeverity = output.MaxSeverity(group, pkg)
63+
}
6064
}
6165
if len(actions.ScanLicensesAllowlist) > 0 {
6266
pkg.Licenses = licensesResp[i]
@@ -83,28 +87,28 @@ func buildVulnerabilityResults(
8387

8488
for source, packages := range groupedBySource {
8589
sourceanalysis.Run(r, source, packages, actions.CallAnalysisStates)
86-
output.Results = append(output.Results, models.PackageSource{
90+
results.Results = append(results.Results, models.PackageSource{
8791
Source: source,
8892
Packages: packages,
8993
})
9094
}
9195

92-
sort.Slice(output.Results, func(i, j int) bool {
93-
if output.Results[i].Source.Path == output.Results[j].Source.Path {
94-
return output.Results[i].Source.Type < output.Results[j].Source.Type
96+
sort.Slice(results.Results, func(i, j int) bool {
97+
if results.Results[i].Source.Path == results.Results[j].Source.Path {
98+
return results.Results[i].Source.Type < results.Results[j].Source.Type
9599
}
96100

97-
return output.Results[i].Source.Path < output.Results[j].Source.Path
101+
return results.Results[i].Source.Path < results.Results[j].Source.Path
98102
})
99103

100104
if len(actions.ScanLicensesAllowlist) > 0 || actions.ScanLicensesSummary {
101-
output.ExperimentalAnalysisConfig.Licenses.Summary = actions.ScanLicensesSummary
105+
results.ExperimentalAnalysisConfig.Licenses.Summary = actions.ScanLicensesSummary
102106
allowlist := make([]models.License, len(actions.ScanLicensesAllowlist))
103107
for i, l := range actions.ScanLicensesAllowlist {
104108
allowlist[i] = models.License(l)
105109
}
106-
output.ExperimentalAnalysisConfig.Licenses.Allowlist = allowlist
110+
results.ExperimentalAnalysisConfig.Licenses.Allowlist = allowlist
107111
}
108112

109-
return output
113+
return results
110114
}

0 commit comments

Comments
 (0)