Skip to content

Commit

Permalink
osv: account for event objects that have multiple streams
Browse files Browse the repository at this point in the history 
It was discovered that some OSV documents can order minor releases in
the same affected.ranges object. This meant that only ever counted the
last range in a vulnerability. This change gathers range information for
the affected product and creates a vulnerability per range.

Signed-off-by: crozzy <joseph.crosland@gmail.com>
  • Loading branch information
@crozzy
crozzy committed Oct 18, 2024
1 parent b037b25 commit d9b0770
Show file tree
Hide file tree
Showing 2 changed files with 377 additions and 59 deletions.
133 changes: 81 additions & 52 deletions updater/osv/osv.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -484,6 +484,11 @@ func newECS(u string) ecs {
}
}

type rangeVer struct {
rng *claircore.Range
fixedInVersion string
}

func (e *ecs) Insert(ctx context.Context, skipped *stats, name string, a *advisory) (err error) {
if a.GitOnly() {
return nil
Expand Down Expand Up @@ -533,15 +538,14 @@ func (e *ecs) Insert(ctx context.Context, skipped *stats, name string, a *adviso
}
b.WriteString(ref.URL)
}

proto.Links = b.String()
for i := range a.Affected {
af := &a.Affected[i]
v := e.NewVulnerability()
(*v) = proto
for _, r := range af.Ranges {
vers := []*rangeVer{}
switch r.Type {
case `SEMVER`:
v.Range = &claircore.Range{}
case `ECOSYSTEM`:
b.Reset()
case `GIT`:
Expand All @@ -554,24 +558,40 @@ func (e *ecs) Insert(ctx context.Context, skipped *stats, name string, a *adviso
}
// This does some heavy assumptions about valid inputs.
ranges := make(url.Values)
for _, ev := range r.Events {
vs := &rangeVer{rng: &claircore.Range{}}
var seenIntroduced bool
for ie := range r.Events {
ev := r.Events[ie]
var err error
switch r.Type {
case `SEMVER`:
var ver *semver.Version
switch {
case ev.Introduced == "0": // -Inf
v.Range.Lower.Kind = `semver`
case ev.Introduced != "" && seenIntroduced:
vs = &rangeVer{rng: &claircore.Range{}}
fallthrough
case ev.Introduced != "":
ver, err = semver.NewVersion(ev.Introduced)
if err == nil {
v.Range.Lower = claircore.FromSemver(ver)
seenIntroduced = true
switch {
case ev.Introduced == "0": // -Inf
vs.rng.Lower.Kind = `semver`
default:
ver, err = semver.NewVersion(ev.Introduced)
if err == nil {
vs.rng.Lower = claircore.FromSemver(ver)
}
}
// Is this the last event? If so append the range and
// implicitly terminate.
if ie == len(r.Events)-1 {
vers = append(vers, vs)
}
continue
case ev.Fixed != "": // less than
ver, err = semver.NewVersion(ev.Fixed)
if err == nil {
v.Range.Upper = claircore.FromSemver(ver)
v.FixedInVersion = ver.Original()
vs.rng.Upper = claircore.FromSemver(ver)
vs.fixedInVersion = ver.Original()
}
case ev.LastAffected != "" && len(af.Versions) != 0: // less than equal to
// TODO(hank) Should be able to convert this to a "less than."
Expand All @@ -586,11 +606,11 @@ func (e *ecs) Insert(ctx context.Context, skipped *stats, name string, a *adviso
ver, err = semver.NewVersion(ev.LastAffected)
if err == nil {
nv := ver.IncPatch()
v.Range.Upper = claircore.FromSemver(&nv)
vs.rng.Upper = claircore.FromSemver(&nv)
}
case ev.Limit == "*": // +Inf
v.Range.Upper.Kind = `semver`
v.Range.Upper.V[0] = 65535
vs.rng.Upper.Kind = `semver`
vs.rng.Upper.V[0] = 65535
case ev.Limit != "": // Something arbitrary
zlog.Info(ctx).
Str("which", "limit").
Expand All @@ -616,7 +636,7 @@ func (e *ecs) Insert(ctx context.Context, skipped *stats, name string, a *adviso
case ev.Introduced == "0": // -Inf
case ev.Introduced != "":
case ev.Fixed != "":
v.FixedInVersion = ev.Fixed
vs.fixedInVersion = ev.Fixed
case ev.LastAffected != "":
case ev.Limit == "*": // +Inf
case ev.Limit != "":
Expand All @@ -626,49 +646,58 @@ func (e *ecs) Insert(ctx context.Context, skipped *stats, name string, a *adviso
if err != nil {
zlog.Warn(ctx).Err(err).Msg("event version error")
}
vers = append(vers, vs)
}
if len(ranges) > 0 {
switch af.Package.Ecosystem {
case ecosystemMaven, ecosystemPyPI, ecosystemRubyGems:
v.FixedInVersion = ranges.Encode()
// Now we need to cycle through the ranges and create the vulnerabilities.
for _, ve := range vers {
v := e.NewVulnerability()
(*v) = proto
v.Range = ve.rng
v.FixedInVersion = ve.fixedInVersion
if len(ranges) > 0 {
switch af.Package.Ecosystem {
case ecosystemMaven, ecosystemPyPI, ecosystemRubyGems:
v.FixedInVersion = ranges.Encode()
}
}
}

if r := v.Range; r != nil {
// We have an implicit +Inf range if there's a single event,
// this should catch it?
if r.Upper.Kind == "" {
r.Upper.Kind = r.Lower.Kind
r.Upper.V[0] = 65535
if r := v.Range; r != nil {
// We have an implicit +Inf range if there's a single event,
// this should catch it?
if r.Upper.Kind == "" {
r.Upper.Kind = r.Lower.Kind
r.Upper.V[0] = 65535
}
if r.Lower.Compare(&r.Upper) == 1 {
e.RemoveVulnerability(v)
skipped.Ignored = append(skipped.Ignored, fmt.Sprintf("%s(%s,%s)", a.ID, r.Lower.String(), r.Upper.String()))
continue
}
}
var vs string
switch r.Type {
case `ECOSYSTEM`:
vs = b.String()
}
if r.Lower.Compare(&r.Upper) == 1 {
e.RemoveVulnerability(v)
skipped.Ignored = append(skipped.Ignored, fmt.Sprintf("%s(%s,%s)", a.ID, r.Lower.String(), r.Upper.String()))
continue
pkgName := af.Package.PURL
switch af.Package.Ecosystem {
case ecosystemGo, ecosystemMaven, ecosystemNPM, ecosystemPyPI, ecosystemRubyGems:
pkgName = af.Package.Name
}
pkg, novel := e.LookupPackage(pkgName, vs)
v.Package = pkg
switch af.Package.Ecosystem {
case ecosystemGo, ecosystemMaven, ecosystemNPM, ecosystemPyPI, ecosystemRubyGems:
v.Package.Kind = claircore.BINARY
}
if novel {
pkg.RepositoryHint = af.Package.Ecosystem
}
if repo := e.LookupRepository(name); repo != nil {
v.Repo = repo
}
}
var vs string
switch r.Type {
case `ECOSYSTEM`:
vs = b.String()
}
pkgName := af.Package.PURL
switch af.Package.Ecosystem {
case ecosystemGo, ecosystemMaven, ecosystemNPM, ecosystemPyPI, ecosystemRubyGems:
pkgName = af.Package.Name
}
pkg, novel := e.LookupPackage(pkgName, vs)
v.Package = pkg
switch af.Package.Ecosystem {
case ecosystemGo, ecosystemMaven, ecosystemNPM, ecosystemPyPI, ecosystemRubyGems:
v.Package.Kind = claircore.BINARY
}
if novel {
pkg.RepositoryHint = af.Package.Ecosystem
}
if repo := e.LookupRepository(name); repo != nil {
v.Repo = repo
}

}
}
return nil
Expand Down
Loading

0 comments on commit d9b0770

Please sign in to comment.