Stage/vuls
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

(fix) Exclude dev dependencies from npm's package-lock.json and Fix Java DB download endpoint (#1893)

Browse Source 
* (fix) Exclude dev dependencies from npm's package-lock.json

* chore(integration) update

* choir(integration) add lib scan names to makefile

* fix(javadb) add schema version only once
This commit is contained in:
Shunichi Shinohara
2024-04-17 17:23:57 +09:00
committed by GitHub
parent cfbe47bd99
commit 8f4025120d
4 changed files with 11 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
GNUmakefile
View File

@@ -90,7 +90,7 @@ NOW=$(shell date '+%Y-%m-%dT%H-%M-%S%z')
NOW_JSON_DIR := '${BASE_DIR}/$(NOW)'
ONE_SEC_AFTER=$(shell date -d '+1 second' '+%Y-%m-%dT%H-%M-%S%z')
ONE_SEC_AFTER_JSON_DIR := '${BASE_DIR}/$(ONE_SEC_AFTER)'
LIBS := 'bundler' 'dart' 'elixir' 'pip' 'pipenv' 'poetry' 'composer' 'npm' 'yarn' 'pnpm' 'cargo' 'gomod' 'gosum' 'gobinary' 'jar' 'jar-wrong-name-log4j-core' 'war' 'pom' 'gradle' 'nuget-lock' 'nuget-config' 'dotnet-deps' 'dotnet-package-props' 'conan' 'swift-cocoapods' 'swift-swift' 'rust-binary'
LIBS := 'bundler' 'dart' 'elixir' 'pip' 'pipenv' 'poetry' 'composer' 'npm-v1' 'npm-v2' 'npm-v3' 'yarn' 'pnpm' 'cargo' 'gomod' 'gosum' 'gobinary' 'jar' 'jar-wrong-name-log4j-core' 'war' 'pom' 'gradle' 'nuget-lock' 'nuget-config' 'dotnet-deps' 'dotnet-package-props' 'conan' 'swift-cocoapods' 'swift-swift' 'rust-binary'
diff:
# git clone git@github.com:vulsio/vulsctl.git

6
detector/javadb/javadb.go
View File

@@ -7,7 +7,6 @@ package javadb
import (
"context"
"errors"
"fmt"
"os"
"path/filepath"
"time"
@@ -40,12 +39,11 @@ func UpdateJavaDB(trivyOpts config.TrivyOpts, noProgress bool) error {
if (meta.Version != db.SchemaVersion || meta.NextUpdate.Before(time.Now().UTC())) && !trivyOpts.TrivySkipJavaDBUpdate {
// Download DB
repo := fmt.Sprintf("%s:%d", trivyOpts.TrivyJavaDBRepository, db.SchemaVersion)
logging.Log.Infof("Trivy Java DB Repository: %s", repo)
logging.Log.Infof("Trivy Java DB Repository: %s", trivyOpts.TrivyJavaDBRepository)
logging.Log.Info("Downloading Trivy Java DB...")
var a *oci.Artifact
if a, err = oci.NewArtifact(repo, noProgress, types.RegistryOptions{}); err != nil {
if a, err = oci.NewArtifact(trivyOpts.TrivyJavaDBRepository, noProgress, types.RegistryOptions{}); err != nil {
return xerrors.Errorf("Failed to new oci artifact. err: %w", err)
}
if err = a.Download(context.Background(), dbDir, oci.DownloadOption{MediaType: "application/vnd.aquasec.trivy.javadb.layer.v1.tar+gzip"}); err != nil {

2
integration

Submodule integration updated: b91ccaadfb...c9493b9402

7
scanner/library.go
View File

@@ -4,12 +4,19 @@ import (
ftypes "github.com/aquasecurity/trivy/pkg/fanal/types"
"github.com/aquasecurity/trivy/pkg/purl"
"github.com/aquasecurity/trivy/pkg/types"
"github.com/samber/lo"
"github.com/future-architect/vuls/logging"
"github.com/future-architect/vuls/models"
)
func convertLibWithScanner(apps []ftypes.Application) ([]models.LibraryScanner, error) {
for i := range apps {
apps[i].Libraries = lo.Filter(apps[i].Libraries, func(lib ftypes.Package, index int) bool {
return !lib.Dev
})
}
scanners := make([]models.LibraryScanner, 0, len(apps))
for _, app := range apps {
libs := make([]models.Library, 0, len(app.Libraries))