Skip to content

Commit 007e01a

Browse files
cuixqLy-Joey
cuixq
and
Ly-Joey
authored
refactor: remove unsafe plugin warning (#2721)
The `transitivedependency/pomxml` enricher is enabled by default but may not be run, however there will still be warning on this which is a bit confusing so this PR removes the warning message and probably do that in enricher itself instead. --------- Co-authored-by: Joey L <joeylauy@google.com>
1 parent 10db0bb commit 007e01a

19 files changed

Lines changed: 3947 additions & 3269 deletions

‎cmd/osv-scanner/__snapshots__/main_test.snap‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,6 @@ built at: n/a
6161
Scanning dir ./testdata/locks-one-with-nested
6262
Scanned <rootdir>/testdata/locks-one-with-nested/nested/composer.lock file and found 1 package
6363
Scanned <rootdir>/testdata/locks-one-with-nested/yarn.lock file and found 1 package
64-
Warning: plugin transitivedependency/pomxml can be risky when run on untrusted artifacts. Please ensure you trust the source code and artifacts before proceeding.
6564

6665
No issues found
6766

@@ -75,7 +74,6 @@ Warning: `scan` exists as both a subcommand of OSV-Scanner and as a file on the
7574
[Test_run_SubCommands/with_no_subcommand - 1]
7675
Scanning dir ./testdata/locks-many/composer.lock
7776
Scanned <rootdir>/testdata/locks-many/composer.lock file and found 1 package
78-
Warning: plugin transitivedependency/pomxml can be risky when run on untrusted artifacts. Please ensure you trust the source code and artifacts before proceeding.
7977

8078
No issues found
8179

@@ -88,7 +86,6 @@ No issues found
8886
[Test_run_SubCommands/with_scan_subcommand - 1]
8987
Scanning dir ./testdata/locks-many/composer.lock
9088
Scanned <rootdir>/testdata/locks-many/composer.lock file and found 1 package
91-
Warning: plugin transitivedependency/pomxml can be risky when run on untrusted artifacts. Please ensure you trust the source code and artifacts before proceeding.
9289

9390
No issues found
9491

‎cmd/osv-scanner/fix/__snapshots__/command_test.snap‎

Lines changed: 68 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -5260,16 +5260,16 @@ unsupported strategy "force" - must be one of: in-place, relax, override
52605260

52615261
[TestCommand/fix_non-interactive_in-place_package-lock.json - 1]
52625262
Guided remediation (the fix command) can be risky when run on untrusted projects. It may trigger the package manager to execute scripts or follow external registries specified in the project. Please ensure you trust the source code and artifacts before proceeding.
5263-
Found 15 vulnerabilities matching the filter
5264-
Can fix 8/15 matching vulnerabilities by changing 5 dependencies
5263+
Found 16 vulnerabilities matching the filter
5264+
Can fix 8/16 matching vulnerabilities by changing 5 dependencies
52655265
UPGRADED-PACKAGE: minimatch,3.1.2,3.1.5
52665266
UPGRADED-PACKAGE: brace-expansion,1.1.11,1.1.14
5267-
UPGRADED-PACKAGE: ajv,6.12.6,6.14.0
5267+
UPGRADED-PACKAGE: ajv,6.12.6,6.15.0
52685268
UPGRADED-PACKAGE: concat-stream,1.5.0,1.6.1
52695269
UPGRADED-PACKAGE: hosted-git-info,2.1.4,2.8.9
52705270
FIXED-VULN-IDS: GHSA-23c5-xmqv-rm74,GHSA-2g4f-4pwh-qvx6,GHSA-3ppc-4f35-3m26,GHSA-43f8-2h32-f4cj,GHSA-7r86-cg39-jmmj,GHSA-f886-m6hf-6m8v,GHSA-g74r-ffvr-5q9f,GHSA-v6h2-p8h4-qcjw
5271-
REMAINING-VULNS: 7
5272-
UNFIXABLE-VULNS: 7
5271+
REMAINING-VULNS: 8
5272+
UNFIXABLE-VULNS: 8
52735273

52745274
---
52755275

@@ -5293,9 +5293,9 @@ UNFIXABLE-VULNS: 7
52935293
}
52945294
},
52955295
"node_modules/ajv": {
5296-
"version": "6.14.0",
5297-
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
5298-
"integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
5296+
"version": "6.15.0",
5297+
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
5298+
"integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
52995299
"dependencies": {
53005300
"fast-deep-equal": "^3.1.1",
53015301
"fast-json-stable-stringify": "^2.0.0",
@@ -6229,9 +6229,9 @@ UNFIXABLE-VULNS: 7
62296229
},
62306230
"dependencies": {
62316231
"ajv": {
6232-
"version": "6.14.0",
6233-
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
6234-
"integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
6232+
"version": "6.15.0",
6233+
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
6234+
"integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
62356235
"requires": {
62366236
"fast-deep-equal": "^3.1.1",
62376237
"fast-json-stable-stringify": "^2.0.0",
@@ -7148,6 +7148,16 @@ UNFIXABLE-VULNS: 7
71487148
"version": "1.1.11"
71497149
}
71507150
]
7151+
},
7152+
{
7153+
"id": "GHSA-w5hq-g745-h8pq",
7154+
"packages": [
7155+
{
7156+
"name": "uuid",
7157+
"version": "3.4.0"
7158+
}
7159+
],
7160+
"unactionable": true
71517161
}
71527162
],
71537163
"patches": [
@@ -7225,7 +7235,7 @@ UNFIXABLE-VULNS: 7
72257235
{
72267236
"name": "ajv",
72277237
"versionFrom": "6.12.6",
7228-
"versionTo": "6.14.0",
7238+
"versionTo": "6.15.0",
72297239
"transitive": true
72307240
}
72317241
],
@@ -7309,9 +7319,9 @@ Guided remediation (the fix command) can be risky when run on untrusted projects
73097319
}
73107320
},
73117321
"node_modules/ajv": {
7312-
"version": "6.14.0",
7313-
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
7314-
"integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
7322+
"version": "6.15.0",
7323+
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
7324+
"integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
73157325
"dependencies": {
73167326
"fast-deep-equal": "^3.1.1",
73177327
"fast-json-stable-stringify": "^2.0.0",
@@ -8245,9 +8255,9 @@ Guided remediation (the fix command) can be risky when run on untrusted projects
82458255
},
82468256
"dependencies": {
82478257
"ajv": {
8248-
"version": "6.14.0",
8249-
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
8250-
"integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
8258+
"version": "6.15.0",
8259+
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
8260+
"integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
82518261
"requires": {
82528262
"fast-deep-equal": "^3.1.1",
82538263
"fast-json-stable-stringify": "^2.0.0",
@@ -9437,6 +9447,16 @@ Guided remediation (the fix command) can be risky when run on untrusted projects
94379447
}
94389448
],
94399449
"unactionable": true
9450+
},
9451+
{
9452+
"id": "GHSA-w5hq-g745-h8pq",
9453+
"packages": [
9454+
{
9455+
"name": "uuid",
9456+
"version": "3.4.0"
9457+
}
9458+
],
9459+
"unactionable": true
94409460
}
94419461
],
94429462
"patches": [
@@ -9575,12 +9595,12 @@ UNFIXABLE-VULNS: 0
95759595

95769596
[TestCommand/fix_non-interactive_relax_package.json - 1]
95779597
Guided remediation (the fix command) can be risky when run on untrusted projects. It may trigger the package manager to execute scripts or follow external registries specified in the project. Please ensure you trust the source code and artifacts before proceeding.
9578-
Found 7 vulnerabilities matching the filter
9579-
Can fix 3/7 matching vulnerabilities by changing 1 dependencies
9598+
Found 8 vulnerabilities matching the filter
9599+
Can fix 3/8 matching vulnerabilities by changing 1 dependencies
95809600
UPGRADED-PACKAGE: npm-registry-client,6.2.0,^7.5.0
95819601
FIXED-VULN-IDS: GHSA-43f8-2h32-f4cj,GHSA-c2qf-rxjj-qqgw,GHSA-c6rq-rjc2-86v2
9582-
REMAINING-VULNS: 4
9583-
UNFIXABLE-VULNS: 4
9602+
REMAINING-VULNS: 5
9603+
UNFIXABLE-VULNS: 5
95849604

95859605
---
95869606

@@ -9608,16 +9628,16 @@ UNFIXABLE-VULNS: 4
96089628

96099629
[TestCommand/fix_non_interactive_in_place_package_lock_json_with_native_data_source - 1]
96109630
Guided remediation (the fix command) can be risky when run on untrusted projects. It may trigger the package manager to execute scripts or follow external registries specified in the project. Please ensure you trust the source code and artifacts before proceeding.
9611-
Found 15 vulnerabilities matching the filter
9612-
Can fix 8/15 matching vulnerabilities by changing 5 dependencies
9631+
Found 16 vulnerabilities matching the filter
9632+
Can fix 8/16 matching vulnerabilities by changing 5 dependencies
96139633
UPGRADED-PACKAGE: minimatch,3.1.2,3.1.5
96149634
UPGRADED-PACKAGE: brace-expansion,1.1.11,1.1.14
9615-
UPGRADED-PACKAGE: ajv,6.12.6,6.14.0
9635+
UPGRADED-PACKAGE: ajv,6.12.6,6.15.0
96169636
UPGRADED-PACKAGE: concat-stream,1.5.0,1.6.1
96179637
UPGRADED-PACKAGE: hosted-git-info,2.1.4,2.8.9
96189638
FIXED-VULN-IDS: GHSA-23c5-xmqv-rm74,GHSA-2g4f-4pwh-qvx6,GHSA-3ppc-4f35-3m26,GHSA-43f8-2h32-f4cj,GHSA-7r86-cg39-jmmj,GHSA-f886-m6hf-6m8v,GHSA-g74r-ffvr-5q9f,GHSA-v6h2-p8h4-qcjw
9619-
REMAINING-VULNS: 7
9620-
UNFIXABLE-VULNS: 7
9639+
REMAINING-VULNS: 8
9640+
UNFIXABLE-VULNS: 8
96219641

96229642
---
96239643

@@ -9641,9 +9661,9 @@ UNFIXABLE-VULNS: 7
96419661
}
96429662
},
96439663
"node_modules/ajv": {
9644-
"version": "6.14.0",
9645-
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
9646-
"integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
9664+
"version": "6.15.0",
9665+
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
9666+
"integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
96479667
"dependencies": {
96489668
"fast-deep-equal": "^3.1.1",
96499669
"fast-json-stable-stringify": "^2.0.0",
@@ -10577,9 +10597,9 @@ UNFIXABLE-VULNS: 7
1057710597
},
1057810598
"dependencies": {
1057910599
"ajv": {
10580-
"version": "6.14.0",
10581-
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
10582-
"integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
10600+
"version": "6.15.0",
10601+
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
10602+
"integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
1058310603
"requires": {
1058410604
"fast-deep-equal": "^3.1.1",
1058510605
"fast-json-stable-stringify": "^2.0.0",
@@ -11427,16 +11447,16 @@ manifest or lockfile is required
1142711447

1142811448
[TestCommand_OfflineDatabase/fix_non_interactive_in_place_package_lock_json_with_offline_vulns - 1]
1142911449
Guided remediation (the fix command) can be risky when run on untrusted projects. It may trigger the package manager to execute scripts or follow external registries specified in the project. Please ensure you trust the source code and artifacts before proceeding.
11430-
Found 15 vulnerabilities matching the filter
11431-
Can fix 8/15 matching vulnerabilities by changing 5 dependencies
11450+
Found 16 vulnerabilities matching the filter
11451+
Can fix 8/16 matching vulnerabilities by changing 5 dependencies
1143211452
UPGRADED-PACKAGE: minimatch,3.1.2,3.1.5
1143311453
UPGRADED-PACKAGE: brace-expansion,1.1.11,1.1.14
11434-
UPGRADED-PACKAGE: ajv,6.12.6,6.14.0
11454+
UPGRADED-PACKAGE: ajv,6.12.6,6.15.0
1143511455
UPGRADED-PACKAGE: concat-stream,1.5.0,1.6.1
1143611456
UPGRADED-PACKAGE: hosted-git-info,2.1.4,2.8.9
1143711457
FIXED-VULN-IDS: GHSA-23c5-xmqv-rm74,GHSA-2g4f-4pwh-qvx6,GHSA-3ppc-4f35-3m26,GHSA-43f8-2h32-f4cj,GHSA-7r86-cg39-jmmj,GHSA-f886-m6hf-6m8v,GHSA-g74r-ffvr-5q9f,GHSA-v6h2-p8h4-qcjw
11438-
REMAINING-VULNS: 7
11439-
UNFIXABLE-VULNS: 7
11458+
REMAINING-VULNS: 8
11459+
UNFIXABLE-VULNS: 8
1144011460

1144111461
---
1144211462

@@ -11460,9 +11480,9 @@ UNFIXABLE-VULNS: 7
1146011480
}
1146111481
},
1146211482
"node_modules/ajv": {
11463-
"version": "6.14.0",
11464-
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
11465-
"integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
11483+
"version": "6.15.0",
11484+
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
11485+
"integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
1146611486
"dependencies": {
1146711487
"fast-deep-equal": "^3.1.1",
1146811488
"fast-json-stable-stringify": "^2.0.0",
@@ -12396,9 +12416,9 @@ UNFIXABLE-VULNS: 7
1239612416
},
1239712417
"dependencies": {
1239812418
"ajv": {
12399-
"version": "6.14.0",
12400-
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
12401-
"integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
12419+
"version": "6.15.0",
12420+
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
12421+
"integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
1240212422
"requires": {
1240312423
"fast-deep-equal": "^3.1.1",
1240412424
"fast-json-stable-stringify": "^2.0.0",
@@ -13170,12 +13190,12 @@ UNFIXABLE-VULNS: 7
1317013190

1317113191
[TestCommand_OfflineDatabase/fix_non_interactive_relax_package_json_with_offline_vulns - 1]
1317213192
Guided remediation (the fix command) can be risky when run on untrusted projects. It may trigger the package manager to execute scripts or follow external registries specified in the project. Please ensure you trust the source code and artifacts before proceeding.
13173-
Found 7 vulnerabilities matching the filter
13174-
Can fix 3/7 matching vulnerabilities by changing 1 dependencies
13193+
Found 8 vulnerabilities matching the filter
13194+
Can fix 3/8 matching vulnerabilities by changing 1 dependencies
1317513195
UPGRADED-PACKAGE: npm-registry-client,6.2.0,^7.5.0
1317613196
FIXED-VULN-IDS: GHSA-43f8-2h32-f4cj,GHSA-c2qf-rxjj-qqgw,GHSA-c6rq-rjc2-86v2
13177-
REMAINING-VULNS: 4
13178-
UNFIXABLE-VULNS: 4
13197+
REMAINING-VULNS: 5
13198+
UNFIXABLE-VULNS: 5
1317913199

1318013200
---
1318113201

‎cmd/osv-scanner/scan/__snapshots__/command_test.snap‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
Scanning dir ./testdata/locks-one-with-nested
44
Scanned <rootdir>/testdata/locks-one-with-nested/nested/composer.lock file and found 1 package
55
Scanned <rootdir>/testdata/locks-one-with-nested/yarn.lock file and found 1 package
6-
Warning: plugin transitivedependency/pomxml can be risky when run on untrusted artifacts. Please ensure you trust the source code and artifacts before proceeding.
76

87
No issues found
98

@@ -39,7 +38,6 @@ OPTIONS:
3938
[TestCommand_SubCommands/with_no_subcommand - 1]
4039
Scanning dir ./testdata/locks-many/composer.lock
4140
Scanned <rootdir>/testdata/locks-many/composer.lock file and found 1 package
42-
Warning: plugin transitivedependency/pomxml can be risky when run on untrusted artifacts. Please ensure you trust the source code and artifacts before proceeding.
4341

4442
No issues found
4543

@@ -52,7 +50,6 @@ No issues found
5250
[TestCommand_SubCommands/with_scan_subcommand - 1]
5351
Scanning dir ./testdata/locks-many/composer.lock
5452
Scanned <rootdir>/testdata/locks-many/composer.lock file and found 1 package
55-
Warning: plugin transitivedependency/pomxml can be risky when run on untrusted artifacts. Please ensure you trust the source code and artifacts before proceeding.
5653

5754
No issues found
5855

0 commit comments

Comments
 (0)