Skip to content

Commit 24be1d4

Browse files
giovanni-bozzanoHayley Denbraver
giovanni-bozzano
and
Hayley Denbraver
authored
Add option to include severity in table output (#409)
Add an optional `--include-severity` flag to include a severity column when using table or markdown output, when severity is present in the OSV schema. --------- Co-authored-by: Hayley Denbraver <[email protected]>
1 parent e70f192 commit 24be1d4

File tree

5 files changed

+67
-31
lines changed

5 files changed

+67
-31
lines changed

‎cmd/osv-scanner/main_test.go

+29-29
Original file line numberDiff line numberDiff line change
@@ -144,18 +144,18 @@ func TestRun(t *testing.T) {
144144
wantStdout: `
145145
Scanning dir ./fixtures/sbom-insecure/postgres-stretch.cdx.xml
146146
Scanned %%/fixtures/sbom-insecure/postgres-stretch.cdx.xml as CycloneDX SBOM and found 136 packages
147-
+-------------------------------------+-----------+---------+------------------------------------+-------------------------------------------------+
148-
| OSV URL (ID IN BOLD) | ECOSYSTEM | PACKAGE | VERSION | SOURCE |
149-
+-------------------------------------+-----------+---------+------------------------------------+-------------------------------------------------+
150-
| https://osv.dev/GHSA-v95c-p5hm-xq8f | Go | runc | v1.0.1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
151-
| https://osv.dev/GO-2022-0274 | | | | |
152-
| https://osv.dev/GHSA-f3fp-gc8g-vw66 | Go | runc | v1.0.1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
153-
| https://osv.dev/GHSA-g2j6-57v7-gm8c | Go | runc | v1.0.1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
154-
| https://osv.dev/GHSA-m8cg-xc2p-r3fc | Go | runc | v1.0.1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
155-
| https://osv.dev/GHSA-vpvm-3wq2-2wvm | Go | runc | v1.0.1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
156-
| https://osv.dev/GHSA-p782-xgp4-8hr8 | Go | sys | v0.0.0-20210817142637-7d9622a276b7 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
157-
| https://osv.dev/GO-2022-0493 | | | | |
158-
+-------------------------------------+-----------+---------+------------------------------------+-------------------------------------------------+
147+
+-------------------------------------+------+-----------+---------+------------------------------------+-------------------------------------------------+
148+
| OSV URL | CVSS | ECOSYSTEM | PACKAGE | VERSION | SOURCE |
149+
+-------------------------------------+------+-----------+---------+------------------------------------+-------------------------------------------------+
150+
| https://osv.dev/GHSA-v95c-p5hm-xq8f | 6 | Go | runc | v1.0.1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
151+
| https://osv.dev/GO-2022-0274 | | | | | |
152+
| https://osv.dev/GHSA-f3fp-gc8g-vw66 | 5.9 | Go | runc | v1.0.1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
153+
| https://osv.dev/GHSA-g2j6-57v7-gm8c | 6.1 | Go | runc | v1.0.1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
154+
| https://osv.dev/GHSA-m8cg-xc2p-r3fc | 2.5 | Go | runc | v1.0.1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
155+
| https://osv.dev/GHSA-vpvm-3wq2-2wvm | 7 | Go | runc | v1.0.1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
156+
| https://osv.dev/GHSA-p782-xgp4-8hr8 | 5.3 | Go | sys | v0.0.0-20210817142637-7d9622a276b7 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
157+
| https://osv.dev/GO-2022-0493 | | | | | |
158+
+-------------------------------------+------+-----------+---------+------------------------------------+-------------------------------------------------+
159159
`,
160160
wantStderr: "",
161161
},
@@ -379,11 +379,11 @@ func TestRun_LockfileWithExplicitParseAs(t *testing.T) {
379379
Scanned %%/fixtures/locks-insecure/my-package-lock.json file as a package-lock.json and found 1 packages
380380
Scanning dir ./fixtures/locks-insecure
381381
Scanned %%/fixtures/locks-insecure/composer.lock file and found 0 packages
382-
+-------------------------------------+-----------+-----------+---------+----------------------------------------------+
383-
| OSV URL (ID IN BOLD) | ECOSYSTEM | PACKAGE | VERSION | SOURCE |
384-
+-------------------------------------+-----------+-----------+---------+----------------------------------------------+
385-
| https://osv.dev/GHSA-whgm-jr23-g3j9 | npm | ansi-html | 0.0.1 | fixtures/locks-insecure/my-package-lock.json |
386-
+-------------------------------------+-----------+-----------+---------+----------------------------------------------+
382+
+-------------------------------------+------+-----------+-----------+---------+----------------------------------------------+
383+
| OSV URL | CVSS | ECOSYSTEM | PACKAGE | VERSION | SOURCE |
384+
+-------------------------------------+------+-----------+-----------+---------+----------------------------------------------+
385+
| https://osv.dev/GHSA-whgm-jr23-g3j9 | 7.5 | npm | ansi-html | 0.0.1 | fixtures/locks-insecure/my-package-lock.json |
386+
+-------------------------------------+------+-----------+-----------+---------+----------------------------------------------+
387387
`,
388388
wantStderr: "",
389389
},
@@ -402,12 +402,12 @@ func TestRun_LockfileWithExplicitParseAs(t *testing.T) {
402402
Scanned %%/fixtures/locks-insecure/my-yarn.lock file as a yarn.lock and found 1 packages
403403
Scanning dir ./fixtures/locks-insecure
404404
Scanned %%/fixtures/locks-insecure/composer.lock file and found 0 packages
405-
+-------------------------------------+-----------+-----------+---------+----------------------------------------------+
406-
| OSV URL (ID IN BOLD) | ECOSYSTEM | PACKAGE | VERSION | SOURCE |
407-
+-------------------------------------+-----------+-----------+---------+----------------------------------------------+
408-
| https://osv.dev/GHSA-whgm-jr23-g3j9 | npm | ansi-html | 0.0.1 | fixtures/locks-insecure/my-package-lock.json |
409-
| https://osv.dev/GHSA-whgm-jr23-g3j9 | npm | ansi-html | 0.0.1 | fixtures/locks-insecure/my-yarn.lock |
410-
+-------------------------------------+-----------+-----------+---------+----------------------------------------------+
405+
+-------------------------------------+------+-----------+-----------+---------+----------------------------------------------+
406+
| OSV URL | CVSS | ECOSYSTEM | PACKAGE | VERSION | SOURCE |
407+
+-------------------------------------+------+-----------+-----------+---------+----------------------------------------------+
408+
| https://osv.dev/GHSA-whgm-jr23-g3j9 | 7.5 | npm | ansi-html | 0.0.1 | fixtures/locks-insecure/my-package-lock.json |
409+
| https://osv.dev/GHSA-whgm-jr23-g3j9 | 7.5 | npm | ansi-html | 0.0.1 | fixtures/locks-insecure/my-yarn.lock |
410+
+-------------------------------------+------+-----------+-----------+---------+----------------------------------------------+
411411
`,
412412
wantStderr: "",
413413
},
@@ -425,12 +425,12 @@ func TestRun_LockfileWithExplicitParseAs(t *testing.T) {
425425
Scanned %%/fixtures/locks-insecure/my-package-lock.json file as a package-lock.json and found 1 packages
426426
Scanning dir ./fixtures/locks-insecure
427427
Scanned %%/fixtures/locks-insecure/composer.lock file and found 0 packages
428-
+-------------------------------------+-----------+-----------+---------+----------------------------------------------+
429-
| OSV URL (ID IN BOLD) | ECOSYSTEM | PACKAGE | VERSION | SOURCE |
430-
+-------------------------------------+-----------+-----------+---------+----------------------------------------------+
431-
| https://osv.dev/GHSA-whgm-jr23-g3j9 | npm | ansi-html | 0.0.1 | fixtures/locks-insecure/my-package-lock.json |
432-
| https://osv.dev/GHSA-whgm-jr23-g3j9 | npm | ansi-html | 0.0.1 | fixtures/locks-insecure/my-yarn.lock |
433-
+-------------------------------------+-----------+-----------+---------+----------------------------------------------+
428+
+-------------------------------------+------+-----------+-----------+---------+----------------------------------------------+
429+
| OSV URL | CVSS | ECOSYSTEM | PACKAGE | VERSION | SOURCE |
430+
+-------------------------------------+------+-----------+-----------+---------+----------------------------------------------+
431+
| https://osv.dev/GHSA-whgm-jr23-g3j9 | 7.5 | npm | ansi-html | 0.0.1 | fixtures/locks-insecure/my-package-lock.json |
432+
| https://osv.dev/GHSA-whgm-jr23-g3j9 | 7.5 | npm | ansi-html | 0.0.1 | fixtures/locks-insecure/my-yarn.lock |
433+
+-------------------------------------+------+-----------+-----------+---------+----------------------------------------------+
434434
`,
435435
wantStderr: "",
436436
},

‎go.mod

+2
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ require (
77
github.com/CycloneDX/cyclonedx-go v0.7.1
88
github.com/go-git/go-billy/v5 v5.4.1
99
github.com/go-git/go-git/v5 v5.7.0
10+
github.com/goark/go-cvss v1.6.6
1011
github.com/google/go-cmp v0.5.9
1112
github.com/jedib0t/go-pretty/v6 v6.4.6
1213
github.com/kr/pretty v0.3.1
@@ -31,6 +32,7 @@ require (
3132
github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
3233
github.com/emirpasic/gods v1.18.1 // indirect
3334
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
35+
github.com/goark/errs v1.1.0 // indirect
3436
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
3537
github.com/imdario/mergo v0.3.15 // indirect
3638
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect

‎go.sum

+4
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,10 @@ github.com/go-git/go-billy/v5 v5.4.1/go.mod h1:vjbugF6Fz7JIflbVpl1hJsGjSHNltrSw4
3535
github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20230305113008-0c11038e723f h1:Pz0DHeFij3XFhoBRGUDPzSJ+w2UcK5/0JvF8DRI58r8=
3636
github.com/go-git/go-git/v5 v5.7.0 h1:t9AudWVLmqzlo+4bqdf7GY+46SUuRsx59SboFxkq2aE=
3737
github.com/go-git/go-git/v5 v5.7.0/go.mod h1:coJHKEOk5kUClpsNlXrUvPrDxY3w3gjHvhcZd8Fodw8=
38+
github.com/goark/errs v1.1.0 h1:FKnyw4LVyRADIjM8Nj0Up6r0/y5cfADvZAd1E+tthXE=
39+
github.com/goark/errs v1.1.0/go.mod h1:TtaPEoadm2mzqzfXdkkfpN2xuniCFm2q4JH+c1qzaqw=
40+
github.com/goark/go-cvss v1.6.6 h1:WJFuIWqmAw1Ilb9USv0vuX+nYzOWJp8lIujseJ/y3sU=
41+
github.com/goark/go-cvss v1.6.6/go.mod h1:H3qbfUSUlV7XtA3EwWNunvXz6OySwWHOuO+R6ZPMQPI=
3842
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
3943
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
4044
github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=

‎internal/output/markdowntable.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ import (
1212
func PrintMarkdownTableResults(vulnResult *models.VulnerabilityResults, outputWriter io.Writer) {
1313
outputTable := table.NewWriter()
1414
outputTable.SetOutputMirror(outputWriter)
15-
outputTable.AppendHeader(table.Row{"OSV URL", "Ecosystem", "Package", "Version", "Source"})
15+
outputTable.AppendHeader(table.Row{"OSV URL", "CVSS", "Ecosystem", "Package", "Version", "Source"})
1616

1717
outputTable = tableBuilder(outputTable, vulnResult, false)
1818

‎internal/output/table.go

+31-1
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,15 @@
11
package output
22

33
import (
4+
"fmt"
45
"io"
56
"os"
67
"path/filepath"
78
"strings"
89

10+
v2_metric "github.com/goark/go-cvss/v2/metric"
11+
v3_metric "github.com/goark/go-cvss/v3/metric"
12+
913
"github.com/google/osv-scanner/pkg/models"
1014
"github.com/google/osv-scanner/pkg/osv"
1115

@@ -18,7 +22,7 @@ import (
1822
func PrintTableResults(vulnResult *models.VulnerabilityResults, outputWriter io.Writer) {
1923
outputTable := table.NewWriter()
2024
outputTable.SetOutputMirror(outputWriter)
21-
outputTable.AppendHeader(table.Row{"OSV URL (ID In Bold)", "Ecosystem", "Package", "Version", "Source"})
25+
outputTable.AppendHeader(table.Row{"OSV URL", "CVSS", "Ecosystem", "Package", "Version", "Source"})
2226
width, _, err := term.GetSize(int(os.Stdout.Fd()))
2327
isTerminal := false
2428
if err == nil { // If output is a terminal, set max length to width and add styling
@@ -100,6 +104,32 @@ func tableBuilderInner(vulnResult *models.VulnerabilityResults, addStyling bool,
100104

101105
outputRow = append(outputRow, strings.Join(links, "\n"))
102106

107+
var outputSeverities []string
108+
for _, vulnID := range group.IDs {
109+
var severities []models.Severity
110+
for _, vuln := range pkg.Vulnerabilities {
111+
if vuln.ID == vulnID {
112+
severities = vuln.Severity
113+
}
114+
}
115+
for _, severity := range severities {
116+
var outputSeverity string
117+
switch severity.Type {
118+
case models.SeverityCVSSV2:
119+
numericSeverity, _ := v2_metric.NewBase().Decode(severity.Score)
120+
outputSeverity = fmt.Sprintf("%v", numericSeverity.Score())
121+
case models.SeverityCVSSV3:
122+
numericSeverity, _ := v3_metric.NewBase().Decode(severity.Score)
123+
outputSeverity = fmt.Sprintf("%v", numericSeverity.Score())
124+
default:
125+
outputSeverity = severity.Score
126+
}
127+
128+
outputSeverities = append(outputSeverities, outputSeverity)
129+
}
130+
}
131+
outputRow = append(outputRow, strings.Join(outputSeverities, ",\n"))
132+
103133
if pkg.Package.Ecosystem == "GIT" {
104134
outputRow = append(outputRow, "GIT", pkg.Package.Version, pkg.Package.Version)
105135
shouldMerge = true

0 commit comments

Comments
 (0)