gitea-mirror/trivy
1
0
Fork 0
mirror of https://github.com/aquasecurity/trivy.git synced 2025-12-22 23:26:39 -08:00
Code Issues Packages Projects Releases Wiki Activity

fix(cli): inconsistent behavior across CLI flags, environment variables, and config files (#5843)

Browse Source 
Signed-off-by: knqyf263 <knqyf263@gmail.com>
This commit is contained in:
Teppei Fukuda
2024-02-01 07:25:30 +04:00
committed by GitHub
parent 5924c021da
commit 59e54334d1
43 changed files with 1736 additions and 1447 deletions
Download Patch File Download Diff File Expand all files Collapse all files

211
integration/standalone_tar_test.go
View File

@@ -3,6 +3,7 @@
package integration
import (
"github.com/aquasecurity/trivy/pkg/types"
"os"
"path/filepath"
"strings"
@@ -17,28 +18,28 @@ func TestTar(t *testing.T) {
IgnoreUnfixed bool
Severity []string
IgnoreIDs []string
Format string
Format types.Format
Input string
SkipDirs []string
SkipFiles []string
}
tests := []struct {
name string
testArgs args
golden string
name string
args args
golden string
}{
{
name: "alpine 3.9",
testArgs: args{
Format: "json",
args: args{
Format: types.FormatJSON,
Input: "testdata/fixtures/images/alpine-39.tar.gz",
},
golden: "testdata/alpine-39.json.golden",
},
{
name: "alpine 3.9 with skip dirs",
testArgs: args{
Format: "json",
args: args{
Format: types.FormatJSON,
Input: "testdata/fixtures/images/alpine-39.tar.gz",
SkipDirs: []string{
"/etc",
@@ -48,8 +49,8 @@ func TestTar(t *testing.T) {
},
{
name: "alpine 3.9 with skip files",
testArgs: args{
Format: "json",
args: args{
Format: types.FormatJSON,
Input: "testdata/fixtures/images/alpine-39.tar.gz",
SkipFiles: []string{
"/etc",
@@ -132,224 +133,224 @@ func TestTar(t *testing.T) {
},
{
name: "alpine 3.9 with high and critical severity",
testArgs: args{
args: args{
IgnoreUnfixed: true,
Severity: []string{
"HIGH",
"CRITICAL",
},
Format: "json",
Format: types.FormatJSON,
Input: "testdata/fixtures/images/alpine-39.tar.gz",
},
golden: "testdata/alpine-39-high-critical.json.golden",
},
{
name: "alpine 3.9 with .trivyignore",
testArgs: args{
args: args{
IgnoreUnfixed: false,
IgnoreIDs: []string{
"CVE-2019-1549",
"CVE-2019-14697",
},
Format: "json",
Format: types.FormatJSON,
Input: "testdata/fixtures/images/alpine-39.tar.gz",
},
golden: "testdata/alpine-39-ignore-cveids.json.golden",
},
{
name: "alpine 3.10",
testArgs: args{
Format: "json",
args: args{
Format: types.FormatJSON,
Input: "testdata/fixtures/images/alpine-310.tar.gz",
},
golden: "testdata/alpine-310.json.golden",
},
{
name: "alpine distroless",
testArgs: args{
Format: "json",
args: args{
Format: types.FormatJSON,
Input: "testdata/fixtures/images/alpine-distroless.tar.gz",
},
golden: "testdata/alpine-distroless.json.golden",
},
{
name: "amazon linux 1",
testArgs: args{
Format: "json",
args: args{
Format: types.FormatJSON,
Input: "testdata/fixtures/images/amazon-1.tar.gz",
},
golden: "testdata/amazon-1.json.golden",
},
{
name: "amazon linux 2",
testArgs: args{
Format: "json",
args: args{
Format: types.FormatJSON,
Input: "testdata/fixtures/images/amazon-2.tar.gz",
},
golden: "testdata/amazon-2.json.golden",
},
{
name: "debian buster/10",
testArgs: args{
Format: "json",
args: args{
Format: types.FormatJSON,
Input: "testdata/fixtures/images/debian-buster.tar.gz",
},
golden: "testdata/debian-buster.json.golden",
},
{
name: "debian buster/10 with --ignore-unfixed option",
testArgs: args{
args: args{
IgnoreUnfixed: true,
Format: "json",
Format: types.FormatJSON,
Input: "testdata/fixtures/images/debian-buster.tar.gz",
},
golden: "testdata/debian-buster-ignore-unfixed.json.golden",
},
{
name: "debian stretch/9",
testArgs: args{
Format: "json",
args: args{
Format: types.FormatJSON,
Input: "testdata/fixtures/images/debian-stretch.tar.gz",
},
golden: "testdata/debian-stretch.json.golden",
},
{
name: "ubuntu 18.04",
testArgs: args{
Format: "json",
args: args{
Format: types.FormatJSON,
Input: "testdata/fixtures/images/ubuntu-1804.tar.gz",
},
golden: "testdata/ubuntu-1804.json.golden",
},
{
name: "ubuntu 18.04 with --ignore-unfixed option",
testArgs: args{
args: args{
IgnoreUnfixed: true,
Format: "json",
Format: types.FormatJSON,
Input: "testdata/fixtures/images/ubuntu-1804.tar.gz",
},
golden: "testdata/ubuntu-1804-ignore-unfixed.json.golden",
},
{
name: "centos 7",
testArgs: args{
Format: "json",
args: args{
Format: types.FormatJSON,
Input: "testdata/fixtures/images/centos-7.tar.gz",
},
golden: "testdata/centos-7.json.golden",
},
{
name: "centos 7with --ignore-unfixed option",
testArgs: args{
args: args{
IgnoreUnfixed: true,
Format: "json",
Format: types.FormatJSON,
Input: "testdata/fixtures/images/centos-7.tar.gz",
},
golden: "testdata/centos-7-ignore-unfixed.json.golden",
},
{
name: "centos 7 with medium severity",
testArgs: args{
args: args{
IgnoreUnfixed: true,
Severity: []string{"MEDIUM"},
Format: "json",
Format: types.FormatJSON,
Input: "testdata/fixtures/images/centos-7.tar.gz",
},
golden: "testdata/centos-7-medium.json.golden",
},
{
name: "centos 6",
testArgs: args{
Format: "json",
args: args{
Format: types.FormatJSON,
Input: "testdata/fixtures/images/centos-6.tar.gz",
},
golden: "testdata/centos-6.json.golden",
},
{
name: "ubi 7",
testArgs: args{
Format: "json",
args: args{
Format: types.FormatJSON,
Input: "testdata/fixtures/images/ubi-7.tar.gz",
},
golden: "testdata/ubi-7.json.golden",
},
{
name: "almalinux 8",
testArgs: args{
Format: "json",
args: args{
Format: types.FormatJSON,
Input: "testdata/fixtures/images/almalinux-8.tar.gz",
},
golden: "testdata/almalinux-8.json.golden",
},
{
name: "rocky linux 8",
testArgs: args{
Format: "json",
args: args{
Format: types.FormatJSON,
Input: "testdata/fixtures/images/rockylinux-8.tar.gz",
},
golden: "testdata/rockylinux-8.json.golden",
},
{
name: "distroless base",
testArgs: args{
Format: "json",
args: args{
Format: types.FormatJSON,
Input: "testdata/fixtures/images/distroless-base.tar.gz",
},
golden: "testdata/distroless-base.json.golden",
},
{
name: "distroless python27",
testArgs: args{
Format: "json",
args: args{
Format: types.FormatJSON,
Input: "testdata/fixtures/images/distroless-python27.tar.gz",
},
golden: "testdata/distroless-python27.json.golden",
},
{
name: "oracle linux 8",
testArgs: args{
Format: "json",
args: args{
Format: types.FormatJSON,
Input: "testdata/fixtures/images/oraclelinux-8.tar.gz",
},
golden: "testdata/oraclelinux-8.json.golden",
},
{
name: "opensuse leap 15.1",
testArgs: args{
Format: "json",
args: args{
Format: types.FormatJSON,
Input: "testdata/fixtures/images/opensuse-leap-151.tar.gz",
},
golden: "testdata/opensuse-leap-151.json.golden",
},
{
name: "photon 3.0",
testArgs: args{
Format: "json",
args: args{
Format: types.FormatJSON,
Input: "testdata/fixtures/images/photon-30.tar.gz",
},
golden: "testdata/photon-30.json.golden",
},
{
name: "CBL-Mariner 1.0",
testArgs: args{
Format: "json",
args: args{
Format: types.FormatJSON,
Input: "testdata/fixtures/images/mariner-1.0.tar.gz",
},
golden: "testdata/mariner-1.0.json.golden",
},
{
name: "busybox with Cargo.lock integration",
testArgs: args{
Format: "json",
args: args{
Format: types.FormatJSON,
Input: "testdata/fixtures/images/busybox-with-lockfile.tar.gz",
},
golden: "testdata/busybox-with-lockfile.json.golden",
},
{
name: "fluentd with RubyGems",
testArgs: args{
args: args{
IgnoreUnfixed: true,
Format: "json",
Format: types.FormatJSON,
Input: "testdata/fixtures/images/fluentd-multiple-lockfiles.tar.gz",
},
golden: "testdata/fluentd-gems.json.golden",
@@ -370,55 +371,40 @@ func TestTar(t *testing.T) {
"image",
"-q",
"--format",
tt.testArgs.Format,
string(tt.args.Format),
"--skip-update",
}
if tt.testArgs.IgnoreUnfixed {
if tt.args.IgnoreUnfixed {
osArgs = append(osArgs, "--ignore-unfixed")
}
if len(tt.testArgs.Severity) != 0 {
osArgs = append(osArgs, "--severity", strings.Join(tt.testArgs.Severity, ","))
if len(tt.args.Severity) != 0 {
osArgs = append(osArgs, "--severity", strings.Join(tt.args.Severity, ","))
}
if len(tt.testArgs.IgnoreIDs) != 0 {
if len(tt.args.IgnoreIDs) != 0 {
trivyIgnore := ".trivyignore"
err := os.WriteFile(trivyIgnore, []byte(strings.Join(tt.testArgs.IgnoreIDs, "\n")), 0444)
err := os.WriteFile(trivyIgnore, []byte(strings.Join(tt.args.IgnoreIDs, "\n")), 0444)
assert.NoError(t, err, "failed to write .trivyignore")
defer os.Remove(trivyIgnore)
}
if tt.testArgs.Input != "" {
osArgs = append(osArgs, "--input", tt.testArgs.Input)
if tt.args.Input != "" {
osArgs = append(osArgs, "--input", tt.args.Input)
}
if len(tt.testArgs.SkipFiles) != 0 {
for _, skipFile := range tt.testArgs.SkipFiles {
if len(tt.args.SkipFiles) != 0 {
for _, skipFile := range tt.args.SkipFiles {
osArgs = append(osArgs, "--skip-files", skipFile)
}
}
if len(tt.testArgs.SkipDirs) != 0 {
for _, skipDir := range tt.testArgs.SkipDirs {
if len(tt.args.SkipDirs) != 0 {
for _, skipDir := range tt.args.SkipDirs {
osArgs = append(osArgs, "--skip-dirs", skipDir)
}
}
// Set up the output file
outputFile := filepath.Join(t.TempDir(), "output.json")
if *update {
outputFile = tt.golden
}
osArgs = append(osArgs, []string{
"--output",
outputFile,
}...)
// Run Trivy
err := execute(osArgs)
require.NoError(t, err)
// Compare want and got
compareReports(t, tt.golden, outputFile, nil)
runTest(t, osArgs, tt.golden, "", tt.args.Format, runOptions{})
})
}
}
@@ -479,8 +465,6 @@ func TestTarWithEnv(t *testing.T) {
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
osArgs := []string{"image"}
t.Setenv("TRIVY_FORMAT", tt.testArgs.Format)
t.Setenv("TRIVY_CACHE_DIR", cacheDir)
t.Setenv("TRIVY_QUIET", "true")
@@ -493,27 +477,15 @@ func TestTarWithEnv(t *testing.T) {
t.Setenv("TRIVY_SEVERITY", strings.Join(tt.testArgs.Severity, ","))
}
if tt.testArgs.Input != "" {
osArgs = append(osArgs, "--input", tt.testArgs.Input)
t.Setenv("TRIVY_INPUT", tt.testArgs.Input)
}
if len(tt.testArgs.SkipDirs) != 0 {
t.Setenv("TRIVY_SKIP_DIRS", strings.Join(tt.testArgs.SkipDirs, ","))
}
// Set up the output file
outputFile := filepath.Join(t.TempDir(), "output.json")
osArgs = append(osArgs, []string{
"--output",
outputFile,
}...)
// Run Trivy
err := execute(osArgs)
require.NoError(t, err)
// Compare want and got
compareReports(t, tt.golden, outputFile, nil)
runTest(t, []string{"image"}, tt.golden, "", types.FormatJSON, runOptions{})
})
}
}
@@ -531,13 +503,13 @@ func TestTarWithConfigFile(t *testing.T) {
configFile: `quiet: true
format: json
severity:
- HIGH
- CRITICAL
- HIGH
- CRITICAL
vulnerability:
type:
- os
type:
- os
cache:
dir: /should/be/overwritten
dir: /should/be/overwritten
`,
golden: "testdata/alpine-39-high-critical.json.golden",
},
@@ -547,9 +519,9 @@ cache:
configFile: `quiet: true
format: json
vulnerability:
ignore-unfixed: true
ignore-unfixed: true
cache:
dir: /should/be/overwritten
dir: /should/be/overwritten
`,
golden: "testdata/debian-buster-ignore-unfixed.json.golden",
},
@@ -563,10 +535,7 @@ cache:
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
tmpDir := t.TempDir()
outputFile := filepath.Join(tmpDir, "output.json")
configPath := filepath.Join(tmpDir, "trivy.yaml")
configPath := filepath.Join(t.TempDir(), "trivy.yaml")
err := os.WriteFile(configPath, []byte(tt.configFile), 0600)
require.NoError(t, err)
@@ -579,16 +548,10 @@ cache:
configPath,
"--input",
tt.input,
"--output",
outputFile,
}
// Run Trivy
err = execute(osArgs)
require.NoError(t, err)
// Compare want and got
compareReports(t, tt.golden, outputFile, nil)
runTest(t, osArgs, tt.golden, "", types.FormatJSON, runOptions{})
})
}
}