Stage/vuls
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,529 Commits 6 Branches 121 Tags
master
Commit Graph

102 Commits

Author SHA1 Message Date
MaineK00n
1333f3ac94 fix(scanner/suse): skip new line in zyper -q lu (#1986) 2024-07-04 16:22:13 +09:00
MaineK00n
436341a4a5 feat: update EOL and Windows KB list (#1971) 
* feat(os): update EOL

* feat(scanner/windows): update kb list
 2024-06-18 16:13:59 +09:00
dependabot[bot]
1e82e04991 chore(deps): bump github.com/aquasecurity/trivy from 0.51.4 to 0.52.1 (#1961) 
* chore(deps): bump github.com/aquasecurity/trivy from 0.51.4 to 0.52.1

Bumps [github.com/aquasecurity/trivy](https://github.com/aquasecurity/trivy) from 0.51.4 to 0.52.1.
- [Release notes](https://github.com/aquasecurity/trivy/releases)
- [Changelog](https://github.com/aquasecurity/trivy/blob/v0.52.1/CHANGELOG.md)
- [Commits](https://github.com/aquasecurity/trivy/compare/v0.51.4...v0.52.1)

---
updated-dependencies:
- dependency-name: github.com/aquasecurity/trivy
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* test: update integration commit hash

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>
 2024-06-13 17:16:17 +09:00
MaineK00n
e1fab805af fix(debian,ubuntu): collect running kernel source package (#1935) 2024-06-06 21:20:16 +09:00
MaineK00n
5af1a22733 fix(redhat-based): collect running kernel packages (#1950) 2024-06-06 10:28:40 +09:00
dependabot[bot]
9107d1b1bc chore(deps): bump github.com/aquasecurity/trivy from 0.51.1 to 0.51.2 (#1928) 
* ---
updated-dependencies:
- dependency-name: github.com/aquasecurity/trivy
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore(deps): go mod tidy

* chore(deps): follow type name change

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Shunichi Shinohara <shino.shun@gmail.com>
 2024-05-23 05:13:59 +09:00
MaineK00n
61c39637f2 feat(scanner/redhat): each package has modularitylabel (#1381) 2024-05-16 02:54:02 +09:00
dependabot[bot]
f1c384812a chore(deps): bump github.com/aquasecurity/trivy from 0.50.1 to 0.51.1 (#1912) 
Bumps [github.com/aquasecurity/trivy](https://github.com/aquasecurity/trivy) from 0.50.1 to 0.51.1.
- [Release notes](https://github.com/aquasecurity/trivy/releases)
- [Changelog](https://github.com/aquasecurity/trivy/blob/main/goreleaser.yml)
- [Commits](https://github.com/aquasecurity/trivy/compare/v0.50.1...v0.51.1)

---
updated-dependencies:
- dependency-name: github.com/aquasecurity/trivy
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-05-15 22:37:12 +09:00
Shunichi Shinohara
8f4025120d (fix) Exclude dev dependencies from npm's package-lock.json and Fix Java DB download endpoint (#1893) 
* (fix) Exclude dev dependencies from npm's package-lock.json

* chore(integration) update

* choir(integration) add lib scan names to makefile

* fix(javadb) add schema version only once
 2024-04-17 17:23:57 +09:00
dependabot[bot]
5d5dcd5f41 chore(deps): bump github.com/aquasecurity/trivy from 0.49.1 to 0.50.1 (#1885) 
* chore(deps): bump github.com/aquasecurity/trivy from 0.49.1 to 0.50.1

Bumps [github.com/aquasecurity/trivy](https://github.com/aquasecurity/trivy) from 0.49.1 to 0.50.1.
- [Release notes](https://github.com/aquasecurity/trivy/releases)
- [Changelog](https://github.com/aquasecurity/trivy/blob/main/goreleaser.yml)
- [Commits](https://github.com/aquasecurity/trivy/compare/v0.49.1...v0.50.1)

---
updated-dependencies:
- dependency-name: github.com/aquasecurity/trivy
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* refactor(cmd/report): use trivy default for trivy-java-db-repository default value

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>
 2024-03-28 13:09:49 +09:00
MaineK00n
e1df74cbc1 fix(amazon): use major version for checking eol, security advisories (#1873) 2024-03-18 16:13:54 +09:00
MaineK00n
b8320c05d2 fix(scanner): output all results even if all fail (#1866) 2024-03-07 22:07:32 +09:00
tk007
be7b9114cc feat(PackageURL):add package URL for library scan result (#1862) 
* add: package url in model.Library

* feat(trivy-to-vuls): add purl for library scan result

* feat(scanner/library): add purl for lockfile scan result

* fix: model.Library test

* fix: trivy-to-vuls test data

* fix: panic case to generate purl

* fix: add blank line

* fix: trivy-to-vuls for using Trivy version 0.49.0 or earlier

* fix: remove comment

* fix: remove print

* fix: testcase for Package.Identifier does not exist version

* fix: add blank line

* fix: expected libs

* fix: PackageURL -> PURL

* fix: blank line
 2024-03-07 16:21:15 +09:00
Shunichi Shinohara
351cf4f712 Update trivy from 0.35.0 to 0.49.1 (#1806) 
* Update trivy 0.35.0->0.48.0

- Specify oras-go 1.2.4 in indirect dependencies

  docker/docker changes a part of its API at 24.0
  - registry: return concrete service type · moby/moby@7b3acdf
    - 7b3acdff5d (diff-8325eae896b1149bf92c826d07fc29005b1b102000b766ffa5a238d791e0849bR18-R21)

  oras-go 1.2.3 uses 23.0.1 and trivy transitively depends on docker/docker 24.y.z.
  There is a build error between oras-go and docker/dockr.

- Update disabled analyzers
- Update language scanners, enable all of them

* move javadb init to scan.go

* Add options for java db init()

* Update scanner/base.go

* Remove unused codes

* Add some lock file names

* Typo fix

* Remove space character (0x20)

* Add java-db options for integration scan

* Minor fomartting fix

* minor fix

* conda is NOT supported by Trivy for library scan

* Configure trivy log in report command too

* Init trivy in scanner

* Use trivy's jar.go and replace client which does almost nothing

* mv jar.go

* Add sha1 hash to result and add filepath for report phase

* Undo added 'vuls scan' options

* Update oras-go to 1.2.4

* Move Java DB related config items to report side

* Add java db search in detect phase

* filter top level jar only

* Update trivy to 0.49.1

* go mod tidy

* Update to newer interface

* Refine lock file list, h/t MaineK00n

* Avoid else clauses if possible, h/t MaineK00n

* Avoid missing word for find and lang types, h/t MaineK00n

* Add missing ecosystems, h/t MaineK00n

* Add comments why to use custom jar analyzer, h/t MaineK00n

* Misc

* Misc

* Misc

* Include go-dep-parser's pares.go for modification

* Move digest field from LibraryScanner to Library

* Use inner jars sha1 for each

* Add Seek to file head before handling zip file entry

* Leave Digest feild empty for entries from pom.xml

* Don't import python/pkg (don't look into package.json)

* Make privete where private is sufficient

* Remove duplicate after Java DB lookup

* misc

* go mod tidy

* Comment out ruby/gemspec

* misc

* Comment out python/packaging

* misc

* Use custom jar

* Update scanner/trivy/jar/parse.go

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

* Update scanner/trivy/jar/parse.go

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

* Update scanner/trivy/jar/parse.go

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

* Update scanner/trivy/jar/parse.go

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

* Update scanner/trivy/jar/parse.go

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

* Update scanner/trivy/jar/jar.go

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

* Update detector/library.go

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

* Update models/library.go

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

* Update scanner/base.go

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

* Update scanner/trivy/jar/parse.go

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

* Update scanner/trivy/jar/parse.go

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

* Missing changes in name change

* Update models/github.go

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

* Update models/library.go

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

* Update models/library.go

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

* Update models/library.go

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

* Update scanner/base.go

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

* Update scanner/base.go

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

* Update scanner/trivy/jar/jar.go

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

* Don't import fanal/types at github.go

* Rewrite code around java db initialization

* Add comment

* refactor

* Close java db client

* rename

* Let LibraryScanner have java db client

* Update detector/library.go

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

* Update detector/library.go

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

* Update detector/library.go

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

* Update detector/library.go

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

* inline variable

* misc

* Fix typo

---------

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>
 2024-02-28 14:25:58 +09:00
MaineK00n
b9ebcf351b fix(scanner/windows): support when default shell is powershell (#1844) 2024-02-02 15:42:43 +09:00
MaineK00n
ea84385c42 fix(scanner/macos): remove unnecessary error check (#1836) 2024-01-31 05:33:47 +09:00
MaineK00n
8e497bb938 fix(scanner/redhat): do not make cache when offline of redhat fast (#1814) 2023-12-17 05:21:34 +09:00
hiroka-wada
b2c91175b3 fix(scanner/redhat): make cache before detect dnf modules (#1812) 
Co-authored-by: wadahiroka <wadahiroka@192.168.0.4>
 2023-12-15 16:16:13 +09:00
MaineK00n
ef29afbf94 feat(scanner/windows): remove unnecessary cab (#1793) 2023-11-20 12:01:03 +09:00
Sinclair
bced16fa9c fix(scanner): parsing apt cache policy for nvidia-container-toolkit (#1786) 
* fix(scanner): parsing apt cache policy for nvidia-container-toolkit

* fix testcase
 2023-11-13 13:49:17 +09:00
MaineK00n
323f0aea3d feat(windows): add Windows 11 23H2 (#1751) 2023-11-07 09:27:39 +09:00
MaineK00n
b9db5411cd feat(scanner): revert lsof command for futurevuls users (#1770) 2023-10-20 12:07:20 +09:00
MaineK00n
a1c1f4ce60 fix(scanner): change lsof cmd that should succeed without password (#1769) 2023-10-20 11:48:04 +09:00
Kota Kanbe
57264e1765 fix(scan): fix nil poiter in needs-restarting (#1767) 2023-10-17 17:58:21 +09:00
orangekame3
73da85210a chore: remove rand.Seed() (#1756) 
Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>
 2023-10-12 14:17:34 +09:00
Eng Zer Jun
c1854a3a7b refactor: remove redundant len check (#1743) 
`len` returns 0 if the slice is nil. From the Go specification [1]:

  "1. For a nil slice, the number of iterations is 0."

Therefore, an additional `len(v) != 0` check for before the loop is
unnecessary.

[1]: https://go.dev/ref/spec#For_range

Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
 2023-09-26 18:00:05 +09:00
MaineK00n
1832b4ee3a feat(macos): support macOS (#1712) 2023-09-25 16:51:09 +09:00
MaineK00n
4a28722e4a fix(scanner): fix socket file name length of SSH ControlPath (#1714) 2023-09-22 17:31:26 +09:00
hiroka-wada
f6509a5376 feat(config): Auto-upgrade Windows config.toml from v1 to v2 (#1726) 
* add: README.md

* add: commands(discover,add-server,add-cpe)

* add: implements(discover,add-server,add-cpe)

* fix: changed os.Exit(1) in main.go to return an error

* fix: lint error

* delete: trivy-to-vuls stdIn

* fix: Incomprehesible error logs

* fix: according to review

* add: function converts old config to latest one

* delete: add-server

* fix: lint error

* fix

* fix: remote scan error in Windows

* fix: lint error

* fix

* fix: lint error

* fix: lint error

* add: scanner/scanner.go test normalizeHomeDirForWindows()

* fix

* fix

* fix

* fix: remove pointless assignment

* fix

---------

Co-authored-by: 和田皓翔 <wadahiroka@192.168.0.4>
Co-authored-by: 和田皓翔 <wadahiroka@192.168.0.10>
Co-authored-by: 和田皓翔 <wadahiroka@192.168.0.6>
 2023-09-21 16:48:35 +09:00
sadayuki-matsuno
f9276a7ea8 feat(windows) export DetectKBsFromKernelVersion (#1703) 2023-07-13 10:14:49 +09:00
MaineK00n
457a3a9627 feat(scanner/windows): update release info (#1696) 2023-06-29 14:05:10 +09:00
MaineK00n
4253550c99 chore(scanner): do not show logs when lsof: no Internet files located (#1688) 2023-06-23 16:08:49 +09:00
Wagde Zabit
b2c5b79672 feat(os): support debian 12 (#1676) 
* feat(os): support debian 12

* chore(scanner/debian): remove unneeded warn log

---------

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>
 2023-05-13 01:04:31 +09:00
Wagde Zabit
333eae06ea fix order in identifying amazon linux version (#1652) 2023-04-21 10:35:19 +09:00
MaineK00n
fb904f0543 refactor(reporter): refactoring TelegramWriter, GoogleChatWriter (#1628) 
* style: remove unnecessary line break

* style: use regexp.MatchString instead of regexp.Match

* refactor(reporter): refactoring TelegramWriter, GoogleChatWriter
 2023-04-20 11:53:31 +09:00
MaineK00n
d4d33fc81d fix(scanner/dpkg): Fix false-negative in Debian and Ubuntu (#1646) 
* fix(scanner/dpkg): fix dpkg-query and not remove src pkgs

* refactor(gost): remove unnecesary field and fix typo

* refactor(detector/debian): detect using only SrcPackage
 2023-04-20 11:42:53 +09:00
MaineK00n
ac8290119d fix(configtest): amazon linux 2022, 2023 require dnf-utils (#1635) 2023-04-10 10:16:03 +09:00
MaineK00n
abdb081af7 feat(scanner): skip ssh config validation if G option is unknown option (#1632) 2023-04-04 18:50:17 +09:00
kurita0
e506125017 feat(wp): support csh, no sudo scan (#1523) 
Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>
 2023-03-28 21:07:10 +09:00
MaineK00n
8ccaa8c3ef fix(scanner/windows): support installationType Domain Controller (#1627) 2023-03-28 21:04:17 +09:00
MaineK00n
947d668452 feat(windows): support Windows (#1581) 
* chore(deps): mod update

* fix(scanner): do not attach tty because there is no need to enter ssh password

* feat(windows): support Windows
 2023-03-28 19:00:33 +09:00
MaineK00n
6682232b5c feat(os): support Amazon Linux 2023 (#1621) 2023-03-16 17:31:57 +09:00
kl-sinclair
ca64d7fc31 feat(report): Include dependencies into scan result and cyclondex for supply chain security on Integration with GitHub Security Alerts (#1584) 
* feat(report): Enhance scan result and cyclondex for supply chain security on Integration with GitHub Security Alerts

* derive ecosystem/version from dependency graph

* fix vars name && fetch manifest info on GSA && arrange ghpkgToPURL structure

* fix miscs

* typo in error message

* fix ecosystem equally to trivy

* miscs

* refactoring

* recursive dependency graph pagination

* change var name && update comments

* omit map type of ghpkgToPURL in signatures

* fix vars name

* goimports

* make fmt

* fix comment

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>
 2023-01-20 15:32:36 +09:00
Kota Kanbe
f6cd4d9223 feat(libscan): support conan.lock C/C++ (#1572) 2022-12-20 11:22:36 +09:00
Kota Kanbe
03c59866d4 feat(libscan): support gradle.lockfile (#1568) 
* feat(libscan): support gradle.lockfile

* add gradle.lockfile to integration test

* fix readme

* chore: update integration

* find *gradle.lockfile

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>
 2022-12-20 08:52:45 +09:00
Kota Kanbe
1d97e91341 fix(libscan): delete map that keeps all file contents detected by FindLock to save memory (#1556) 
* fix(libscan): delete Map that keeps all files detected by FindLock to save memory

* continue analyzing libs if err occurred

* FindLockDirs

* fix

* fix
 2022-11-10 10:19:15 +09:00
dependabot[bot]
6eb4c5a5fe chore(deps): bump github.com/aquasecurity/trivy from 0.31.3 to 0.32.1 (#1538) 
* chore(deps): bump github.com/aquasecurity/trivy from 0.31.3 to 0.32.1

Bumps [github.com/aquasecurity/trivy](https://github.com/aquasecurity/trivy) from 0.31.3 to 0.32.1.
- [Release notes](https://github.com/aquasecurity/trivy/releases)
- [Changelog](https://github.com/aquasecurity/trivy/blob/main/goreleaser.yml)
- [Commits](https://github.com/aquasecurity/trivy/compare/v0.31.3...v0.32.1)

---
updated-dependencies:
- dependency-name: github.com/aquasecurity/trivy
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore(deps): bump github.com/aquasecurity/trivy 0.32.1 to 0.33.0

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>
 2022-10-27 01:24:06 +09:00
Kota Kanbe
f7299b9dba fix(scan): detect AL2 even when empty /etc/redhat-release (#1536) 2022-09-29 11:12:30 +09:00
MaineK00n
2a00339da1 fix(lockfiles): fix privileges in lockfile scan (#1512) 
* fix(lockfiles): fix privileges in lockfile scan

* style(fmt): add space in comment line
 2022-09-02 18:18:00 +09:00
kidokidofire
2d959b3af8 Fix func to get EC2 instance ID by IMDSv2. (#1522) 
Co-authored-by: kido3160 <s.kido.fy@future.co.jp>
 2022-08-25 14:31:48 +09:00