|
| 1 | +package gitlabreport |
| 2 | + |
| 3 | +import ( |
| 4 | + "fmt" |
| 5 | + "strings" |
| 6 | + |
| 7 | + "github.com/CycloneDX/cyclonedx-go" |
| 8 | + "github.com/jfrog/jfrog-cli-security/utils/formats" |
| 9 | + "github.com/jfrog/jfrog-cli-security/utils/formats/cdxutils" |
| 10 | + "github.com/jfrog/jfrog-cli-security/utils/jasutils" |
| 11 | + "github.com/jfrog/jfrog-cli-security/utils/results" |
| 12 | + "github.com/jfrog/jfrog-cli-security/utils/results/conversion" |
| 13 | + "github.com/jfrog/jfrog-client-go/utils/log" |
| 14 | +) |
| 15 | + |
| 16 | +// GitLab documents native "Reachable" (Yes / Not Found / Not Available) from CycloneDX |
| 17 | +// component properties, not from gl-dependency-scanning-report.json details. |
| 18 | +// See: https://docs.gitlab.com/development/sec/cyclonedx_property_taxonomy/ |
| 19 | +const ( |
| 20 | + gitlabMetaSchemaVersionProp = "gitlab:meta:schema_version" |
| 21 | + gitlabDependencyScanningInputFilePath = "gitlab:dependency_scanning:input_file:path" |
| 22 | + gitlabDependencyScanningReachability = "gitlab:dependency_scanning_component:reachability" |
| 23 | + gitlabReachabilityInUse = "in_use" |
| 24 | + gitlabReachabilityNotFound = "not_found" |
| 25 | +) |
| 26 | + |
| 27 | +// reachRank orders contextual-analysis outcomes for merging multiple findings on one dependency. |
| 28 | +type reachRank int |
| 29 | + |
| 30 | +const ( |
| 31 | + reachNone reachRank = iota |
| 32 | + reachNotFound |
| 33 | + reachInUse |
| 34 | +) |
| 35 | + |
| 36 | +// EnrichCycloneDXBOMForGitLabReachability adds GitLab CycloneDX properties so the Security UI |
| 37 | +// "Reachable" field reflects JFrog contextual analysis: Applicable → in_use, other assessed → not_found, |
| 38 | +// no applicability data → omitted (shows as "Not Available"). |
| 39 | +func EnrichCycloneDXBOMForGitLabReachability(bom *cyclonedx.BOM, scanResults *results.SecurityCommandResults) { |
| 40 | + if bom == nil || scanResults == nil { |
| 41 | + return |
| 42 | + } |
| 43 | + if bom.Metadata == nil { |
| 44 | + bom.Metadata = &cyclonedx.Metadata{} |
| 45 | + } |
| 46 | + bom.Metadata.Properties = cdxutils.AppendProperties(bom.Metadata.Properties, cyclonedx.Property{ |
| 47 | + Name: gitlabMetaSchemaVersionProp, |
| 48 | + Value: "1", |
| 49 | + }) |
| 50 | + |
| 51 | + convertor := conversion.NewCommandResultsConvertor(conversion.ResultConvertParams{ |
| 52 | + IncludeVulnerabilities: true, |
| 53 | + HasViolationContext: scanResults.HasViolationContext(), |
| 54 | + }) |
| 55 | + simpleJSON, err := convertor.ConvertToSimpleJson(scanResults) |
| 56 | + if err != nil { |
| 57 | + log.Warn(fmt.Sprintf("GitLab reachability: skipping CycloneDX enrichment, simple JSON conversion failed: %v", err)) |
| 58 | + return |
| 59 | + } |
| 60 | + |
| 61 | + depInfo := make(map[string]*depReachInfo) |
| 62 | + for i := range simpleJSON.Vulnerabilities { |
| 63 | + mergeRowReachability(depInfo, &simpleJSON.Vulnerabilities[i]) |
| 64 | + } |
| 65 | + for i := range simpleJSON.SecurityViolations { |
| 66 | + mergeRowReachability(depInfo, &simpleJSON.SecurityViolations[i]) |
| 67 | + } |
| 68 | + |
| 69 | + // When the whole scan uses one lockfile (typical), set it on metadata too so GitLab can |
| 70 | + // correlate SBOM reachability with dependency-scanning findings (per taxonomy). |
| 71 | + if f := uniqueInputFileFromDepInfo(depInfo); f != "" { |
| 72 | + bom.Metadata.Properties = cdxutils.AppendProperties(bom.Metadata.Properties, cyclonedx.Property{ |
| 73 | + Name: gitlabDependencyScanningInputFilePath, |
| 74 | + Value: f, |
| 75 | + }) |
| 76 | + } |
| 77 | + |
| 78 | + if bom.Metadata.Component != nil { |
| 79 | + walkComponentTree(bom.Metadata.Component, depInfo) |
| 80 | + } |
| 81 | + walkComponentSlice(bom.Components, depInfo) |
| 82 | +} |
| 83 | + |
| 84 | +type depReachInfo struct { |
| 85 | + rank reachRank |
| 86 | + inputFile string |
| 87 | +} |
| 88 | + |
| 89 | +// uniqueInputFileFromDepInfo returns the single lock/manifest file shared by all assessed dependencies, |
| 90 | +// or empty if there are zero or more than one (multiple lockfiles: do not guess metadata-level path). |
| 91 | +func uniqueInputFileFromDepInfo(depInfo map[string]*depReachInfo) string { |
| 92 | + seen := make(map[string]struct{}) |
| 93 | + for _, info := range depInfo { |
| 94 | + if info == nil || info.rank <= reachNone { |
| 95 | + continue |
| 96 | + } |
| 97 | + if f := strings.TrimSpace(info.inputFile); f != "" { |
| 98 | + seen[f] = struct{}{} |
| 99 | + } |
| 100 | + } |
| 101 | + if len(seen) == 1 { |
| 102 | + for f := range seen { |
| 103 | + return f |
| 104 | + } |
| 105 | + } |
| 106 | + return "" |
| 107 | +} |
| 108 | + |
| 109 | +func mergeRowReachability(depInfo map[string]*depReachInfo, v *formats.VulnerabilityOrViolationRow) { |
| 110 | + r, ok := gitlabReachabilityRankForRow(v) |
| 111 | + if !ok { |
| 112 | + return |
| 113 | + } |
| 114 | + name := strings.TrimSpace(v.ImpactedDependencyName) |
| 115 | + if name == "" { |
| 116 | + return |
| 117 | + } |
| 118 | + key := dependencyReachabilityKey(name, strings.TrimSpace(v.ImpactedDependencyVersion)) |
| 119 | + inFile := rowPreferredInputFile(v) |
| 120 | + cur := depInfo[key] |
| 121 | + if cur == nil { |
| 122 | + cur = &depReachInfo{} |
| 123 | + depInfo[key] = cur |
| 124 | + } |
| 125 | + if r > cur.rank { |
| 126 | + cur.rank = r |
| 127 | + if inFile != "" { |
| 128 | + cur.inputFile = inFile |
| 129 | + } |
| 130 | + } else if r == cur.rank && cur.inputFile == "" && inFile != "" { |
| 131 | + cur.inputFile = inFile |
| 132 | + } |
| 133 | +} |
| 134 | + |
| 135 | +func rowPreferredInputFile(v *formats.VulnerabilityOrViolationRow) string { |
| 136 | + for _, comp := range v.Components { |
| 137 | + if comp.PreferredLocation != nil { |
| 138 | + if f := strings.TrimSpace(comp.PreferredLocation.File); f != "" { |
| 139 | + return f |
| 140 | + } |
| 141 | + } |
| 142 | + for _, ev := range comp.Evidences { |
| 143 | + if f := strings.TrimSpace(ev.File); f != "" { |
| 144 | + return f |
| 145 | + } |
| 146 | + } |
| 147 | + } |
| 148 | + return strings.TrimSpace(manifestFileForTechnology(v.Technology)) |
| 149 | +} |
| 150 | + |
| 151 | +func dependencyReachabilityKey(name, version string) string { |
| 152 | + return name + "\x00" + version |
| 153 | +} |
| 154 | + |
| 155 | +func gitlabReachabilityRankForRow(v *formats.VulnerabilityOrViolationRow) (reachRank, bool) { |
| 156 | + switch rowFinalApplicabilityStatus(v) { |
| 157 | + case jasutils.NotScanned: |
| 158 | + return reachNone, false |
| 159 | + case jasutils.Applicable: |
| 160 | + return reachInUse, true |
| 161 | + default: |
| 162 | + return reachNotFound, true |
| 163 | + } |
| 164 | +} |
| 165 | + |
| 166 | +func walkComponentSlice(list *[]cyclonedx.Component, depInfo map[string]*depReachInfo) { |
| 167 | + if list == nil { |
| 168 | + return |
| 169 | + } |
| 170 | + for i := range *list { |
| 171 | + walkComponentTree(&(*list)[i], depInfo) |
| 172 | + } |
| 173 | +} |
| 174 | + |
| 175 | +func walkComponentTree(c *cyclonedx.Component, depInfo map[string]*depReachInfo) { |
| 176 | + if c == nil { |
| 177 | + return |
| 178 | + } |
| 179 | + if idx := strings.Index(c.PackageURL, "?"); idx != -1 { |
| 180 | + c.PackageURL = c.PackageURL[:idx] |
| 181 | + } |
| 182 | + if info := bestReachInfoForComponent(c, depInfo); info != nil && info.rank > reachNone { |
| 183 | + if info.inputFile != "" { |
| 184 | + c.Properties = cdxutils.AppendProperties(c.Properties, cyclonedx.Property{ |
| 185 | + Name: gitlabDependencyScanningInputFilePath, |
| 186 | + Value: info.inputFile, |
| 187 | + }) |
| 188 | + } |
| 189 | + val := gitlabReachabilityNotFound |
| 190 | + if info.rank == reachInUse { |
| 191 | + val = gitlabReachabilityInUse |
| 192 | + } |
| 193 | + c.Properties = cdxutils.AppendProperties(c.Properties, cyclonedx.Property{ |
| 194 | + Name: gitlabDependencyScanningReachability, |
| 195 | + Value: val, |
| 196 | + }) |
| 197 | + } |
| 198 | + walkComponentSlice(c.Components, depInfo) |
| 199 | +} |
| 200 | + |
| 201 | +func bestReachInfoForComponent(c *cyclonedx.Component, depInfo map[string]*depReachInfo) *depReachInfo { |
| 202 | + var best *depReachInfo |
| 203 | + for _, key := range componentDependencyMatchKeys(c) { |
| 204 | + if cur := depInfo[key]; cur != nil && (best == nil || cur.rank > best.rank) { |
| 205 | + best = cur |
| 206 | + } |
| 207 | + } |
| 208 | + return best |
| 209 | +} |
| 210 | + |
| 211 | +func componentDependencyMatchKeys(c *cyclonedx.Component) []string { |
| 212 | + name := strings.TrimSpace(c.Name) |
| 213 | + ver := strings.TrimSpace(c.Version) |
| 214 | + if name == "" { |
| 215 | + return nil |
| 216 | + } |
| 217 | + var keys []string |
| 218 | + if g := strings.TrimSpace(c.Group); g != "" { |
| 219 | + keys = append(keys, dependencyReachabilityKey(g+":"+name, ver)) |
| 220 | + } |
| 221 | + keys = append(keys, dependencyReachabilityKey(name, ver)) |
| 222 | + return keys |
| 223 | +} |
0 commit comments