gitea-mirror/trivy
1
0
Fork 0
mirror of https://github.com/aquasecurity/trivy.git synced 2025-12-22 23:26:39 -08:00
Code Issues Packages Projects Releases Wiki Activity

fix(config): rename include-successes with include-non-failures (#1107)

Browse Source
This commit is contained in:
Teppei Fukuda
2021-07-11 16:55:13 +03:00
committed by GitHub
parent e6f7e556e8
commit d9883e4442
8 changed files with 73 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
pkg/commands/app.go
View File

@@ -252,11 +252,11 @@ var (
EnvVars: []string{"TRIVY_POLICY_NAMESPACES"}, EnvVars: []string{"TRIVY_POLICY_NAMESPACES"},
} }
includeSuccesses = cli.BoolFlag{ includeNonFailures = cli.BoolFlag{
Name: "include-successes", Name: "include-non-failures",
Usage: "include successes of misconfigurations", Usage: "include successes and exceptions",
Value: false, Value: false,
EnvVars: []string{"TRIVY_INCLUDE_SUCCESSES"}, EnvVars: []string{"TRIVY_INCLUDE_NON_FAILURES"},
} }
traceFlag = cli.BoolFlag{ traceFlag = cli.BoolFlag{
@@ -297,8 +297,6 @@ var (
&cacheBackendFlag, &cacheBackendFlag,
stringSliceFlag(skipFiles), stringSliceFlag(skipFiles),
stringSliceFlag(skipDirs), stringSliceFlag(skipDirs),
stringSliceFlag(configPolicy),
stringSliceFlag(policyNamespaces),
} }
// deprecated options // deprecated options
@@ -477,7 +475,7 @@ func NewFilesystemCommand() *cli.Command {
stringSliceFlag(skipFiles), stringSliceFlag(skipFiles),
stringSliceFlag(skipDirs), stringSliceFlag(skipDirs),
stringSliceFlag(configPolicy), stringSliceFlag(configPolicy),
&policyNamespaces, stringSliceFlag(policyNamespaces),
}, },
} }
} }
@@ -613,7 +611,7 @@ func NewConfigCommand() *cli.Command {
stringSliceFlag(configPolicyAlias), stringSliceFlag(configPolicyAlias),
stringSliceFlag(filePatterns), stringSliceFlag(filePatterns),
stringSliceFlag(policyNamespaces), stringSliceFlag(policyNamespaces),
&includeSuccesses, &includeNonFailures,
&traceFlag, &traceFlag,
}, },
} }

16
pkg/commands/artifact/run.go
View File

@@ -75,13 +75,13 @@ func runWithTimeout(ctx context.Context, opt Option, initializeScanner Initializ
} }
if err = pkgReport.Write(report, pkgReport.Option{ if err = pkgReport.Write(report, pkgReport.Option{
Format: opt.Format, Format: opt.Format,
Output: opt.Output, Output: opt.Output,
Severities: opt.Severities, Severities: opt.Severities,
OutputTemplate: opt.Template, OutputTemplate: opt.Template,
Light: opt.Light, Light: opt.Light,
IncludeSuccesses: opt.IncludeSuccesses, IncludeNonFailures: opt.IncludeNonFailures,
Trace: opt.Trace, Trace: opt.Trace,
}); err != nil { }); err != nil {
return xerrors.Errorf("unable to write results: %w", err) return xerrors.Errorf("unable to write results: %w", err)
} }
@@ -193,7 +193,7 @@ func filter(ctx context.Context, opt Option, report pkgReport.Report) (pkgReport
for i := range results { for i := range results {
resultClient.FillVulnerabilityInfo(results[i].Vulnerabilities, results[i].Type) resultClient.FillVulnerabilityInfo(results[i].Vulnerabilities, results[i].Type)
vulns, misconfSummary, misconfs, err := resultClient.Filter(ctx, results[i].Vulnerabilities, results[i].Misconfigurations, vulns, misconfSummary, misconfs, err := resultClient.Filter(ctx, results[i].Vulnerabilities, results[i].Misconfigurations,
opt.Severities, opt.IgnoreUnfixed, opt.IncludeSuccesses, opt.IgnoreFile, opt.IgnorePolicy) opt.Severities, opt.IgnoreUnfixed, opt.IncludeNonFailures, opt.IgnoreFile, opt.IgnorePolicy)
if err != nil { if err != nil {
return pkgReport.Report{}, xerrors.Errorf("unable to filter vulnerabilities: %w", err) return pkgReport.Report{}, xerrors.Errorf("unable to filter vulnerabilities: %w", err)
} }

16
pkg/commands/client/run.go
View File

@@ -71,7 +71,7 @@ func runWithTimeout(ctx context.Context, opt Option) error {
results := report.Results results := report.Results
for i := range results { for i := range results {
vulns, misconfSummary, misconfs, err := resultClient.Filter(ctx, results[i].Vulnerabilities, results[i].Misconfigurations, vulns, misconfSummary, misconfs, err := resultClient.Filter(ctx, results[i].Vulnerabilities, results[i].Misconfigurations,
opt.Severities, opt.IgnoreUnfixed, opt.IncludeSuccesses, opt.IgnoreFile, opt.IgnorePolicy) opt.Severities, opt.IgnoreUnfixed, opt.IncludeNonFailures, opt.IgnoreFile, opt.IgnorePolicy)
if err != nil { if err != nil {
return xerrors.Errorf("filter error: %w", err) return xerrors.Errorf("filter error: %w", err)
} }
@@ -81,13 +81,13 @@ func runWithTimeout(ctx context.Context, opt Option) error {
} }
if err = pkgReport.Write(report, pkgReport.Option{ if err = pkgReport.Write(report, pkgReport.Option{
Format: opt.Format, Format: opt.Format,
Output: opt.Output, Output: opt.Output,
Severities: opt.Severities, Severities: opt.Severities,
OutputTemplate: opt.Template, OutputTemplate: opt.Template,
Light: false, Light: false,
IncludeSuccesses: opt.IncludeSuccesses, IncludeNonFailures: opt.IncludeNonFailures,
Trace: opt.Trace, Trace: opt.Trace,
}); err != nil { }); err != nil {
return xerrors.Errorf("unable to write results: %w", err) return xerrors.Errorf("unable to write results: %w", err)
} }

22
pkg/commands/option/config.go
View File

@@ -6,10 +6,10 @@ import (
// ConfigOption holds the options for config scanning // ConfigOption holds the options for config scanning
type ConfigOption struct { type ConfigOption struct {
FilePatterns []string FilePatterns []string
IncludeSuccesses bool IncludeNonFailures bool
SkipPolicyUpdate bool SkipPolicyUpdate bool
Trace bool Trace bool
// Rego // Rego
PolicyPaths []string PolicyPaths []string
@@ -20,12 +20,12 @@ type ConfigOption struct {
// NewConfigOption is the factory method to return config scanning options // NewConfigOption is the factory method to return config scanning options
func NewConfigOption(c *cli.Context) ConfigOption { func NewConfigOption(c *cli.Context) ConfigOption {
return ConfigOption{ return ConfigOption{
IncludeSuccesses: c.Bool("include-successes"), IncludeNonFailures: c.Bool("include-non-failures"),
SkipPolicyUpdate: c.Bool("skip-policy-update"), SkipPolicyUpdate: c.Bool("skip-policy-update"),
Trace: c.Bool("trace"), Trace: c.Bool("trace"),
FilePatterns: c.StringSlice("file-patterns"), FilePatterns: c.StringSlice("file-patterns"),
PolicyPaths: c.StringSlice("config-policy"), PolicyPaths: c.StringSlice("config-policy"),
DataPaths: c.StringSlice("config-data"), DataPaths: c.StringSlice("config-data"),
PolicyNamespaces: c.StringSlice("policy-namespaces"), PolicyNamespaces: c.StringSlice("policy-namespaces"),
} }
} }

30
pkg/report/table.go
View File

@@ -24,8 +24,8 @@ type TableWriter struct {
Light bool Light bool
// For misconfigurations // For misconfigurations
IncludeSuccesses bool IncludeNonFailures bool
Trace bool Trace bool
} }
// Write writes the result on standard output // Write writes the result on standard output
@@ -125,7 +125,7 @@ func (tw TableWriter) writeMisconfigurations(table *tablewriter.Table, misconfs
tablewriter.ALIGN_CENTER, tablewriter.ALIGN_CENTER, tablewriter.ALIGN_LEFT} tablewriter.ALIGN_CENTER, tablewriter.ALIGN_CENTER, tablewriter.ALIGN_LEFT}
header := []string{"Type", "Misconf ID", "Check", "Severity", "Status", "Message"} header := []string{"Type", "Misconf ID", "Check", "Severity", "Status", "Message"}
if !tw.IncludeSuccesses { if !tw.IncludeNonFailures {
// Remove status // Remove status
statusPos := 4 statusPos := 4
alignment = append(alignment[:statusPos], alignment[statusPos+1:]...) alignment = append(alignment[:statusPos], alignment[statusPos+1:]...)
@@ -185,20 +185,24 @@ func (tw TableWriter) setMisconfRows(table *tablewriter.Table, misconfs []types.
} }
} }
var row []string severity := misconf.Severity
status := string(misconf.Status)
if tw.Output == os.Stdout { if tw.Output == os.Stdout {
if misconf.Status == types.StatusPassed { switch misconf.Status {
row = []string{misconf.Type, misconf.ID, misconf.Title, color.New(color.FgGreen).Sprint(misconf.Severity), case types.StatusPassed:
color.New(color.FgGreen).Sprint(misconf.Status), misconf.Message} severity = color.New(color.FgGreen).Sprint(misconf.Severity)
} else { status = color.New(color.FgGreen).Sprint(misconf.Status)
row = []string{misconf.Type, misconf.ID, misconf.Title, dbTypes.ColorizeSeverity(misconf.Severity), case types.StatusException:
color.New(color.FgRed).Sprint(misconf.Status), misconf.Message} severity = color.New(color.FgMagenta).Sprint(misconf.Severity)
status = color.New(color.FgMagenta).Sprint(misconf.Status)
case types.StatusFailure:
severity = dbTypes.ColorizeSeverity(severity)
status = color.New(color.FgRed).Sprint(misconf.Status)
} }
} else {
row = []string{misconf.Type, misconf.ID, misconf.Title, misconf.Severity, string(misconf.Status), misconf.Message}
} }
if !tw.IncludeSuccesses { row := []string{misconf.Type, misconf.ID, misconf.Title, severity, status, misconf.Message}
if !tw.IncludeNonFailures {
// Remove status // Remove status
row = append(row[:4], row[5:]...) row = append(row[:4], row[5:]...)
} }

22
pkg/report/table_test.go
View File

@@ -13,11 +13,11 @@ import (
func TestReportWriter_Table(t *testing.T) { func TestReportWriter_Table(t *testing.T) {
testCases := []struct { testCases := []struct {
name string name string
results report.Results results report.Results
expectedOutput string expectedOutput string
light bool light bool
includeSuccesses bool includeNonFailures bool
}{ }{
{ {
name: "happy path full", name: "happy path full",
@@ -169,8 +169,8 @@ func TestReportWriter_Table(t *testing.T) {
`, `,
}, },
{ {
name: "happy path misconfigurations with successes", name: "happy path misconfigurations with successes",
includeSuccesses: true, includeNonFailures: true,
results: report.Results{ results: report.Results{
{ {
Target: "test", Target: "test",
@@ -216,10 +216,10 @@ func TestReportWriter_Table(t *testing.T) {
t.Run(tc.name, func(t *testing.T) { t.Run(tc.name, func(t *testing.T) {
tableWritten := bytes.Buffer{} tableWritten := bytes.Buffer{}
err := report.Write(report.Report{Results: tc.results}, report.Option{ err := report.Write(report.Report{Results: tc.results}, report.Option{
Format: "table", Format: "table",
Output: &tableWritten, Output: &tableWritten,
Light: tc.light, Light: tc.light,
IncludeSuccesses: tc.includeSuccesses, IncludeNonFailures: tc.includeNonFailures,
}) })
assert.NoError(t, err) assert.NoError(t, err)
assert.Equal(t, tc.expectedOutput, tableWritten.String(), tc.name) assert.Equal(t, tc.expectedOutput, tableWritten.String(), tc.name)

14
pkg/report/writer.go
View File

@@ -88,8 +88,8 @@ type Option struct {
Light bool Light bool
// For misconfigurations // For misconfigurations
IncludeSuccesses bool IncludeNonFailures bool
Trace bool Trace bool
} }
// Write writes the result to output, format as passed in argument // Write writes the result to output, format as passed in argument
@@ -98,11 +98,11 @@ func Write(report Report, option Option) error {
switch option.Format { switch option.Format {
case "table": case "table":
writer = &TableWriter{ writer = &TableWriter{
Output: option.Output, Output: option.Output,
Severities: option.Severities, Severities: option.Severities,
Light: option.Light, Light: option.Light,
IncludeSuccesses: option.IncludeSuccesses, IncludeNonFailures: option.IncludeNonFailures,
Trace: option.Trace, Trace: option.Trace,
} }
case "json": case "json":
writer = &JSONWriter{Output: option.Output} writer = &JSONWriter{Output: option.Output}

9
pkg/result/result.go
View File

@@ -140,12 +140,12 @@ func (c Client) getPrimaryURL(vulnID string, refs []string, source string) strin
// Filter filter out the vulnerabilities // Filter filter out the vulnerabilities
func (c Client) Filter(ctx context.Context, vulns []types.DetectedVulnerability, misconfs []types.DetectedMisconfiguration, func (c Client) Filter(ctx context.Context, vulns []types.DetectedVulnerability, misconfs []types.DetectedMisconfiguration,
severities []dbTypes.Severity, ignoreUnfixed, includeSuccesses bool, ignoreFile, policyFile string) ( severities []dbTypes.Severity, ignoreUnfixed, includeNonFailures bool, ignoreFile, policyFile string) (
[]types.DetectedVulnerability, *report.MisconfSummary, []types.DetectedMisconfiguration, error) { []types.DetectedVulnerability, *report.MisconfSummary, []types.DetectedMisconfiguration, error) {
ignoredIDs := getIgnoredIDs(ignoreFile) ignoredIDs := getIgnoredIDs(ignoreFile)
filteredVulns := filterVulnerabilities(vulns, severities, ignoreUnfixed, ignoredIDs) filteredVulns := filterVulnerabilities(vulns, severities, ignoreUnfixed, ignoredIDs)
misconfSummary, filteredMisconfs := filterMisconfigurations(misconfs, severities, includeSuccesses, ignoredIDs) misconfSummary, filteredMisconfs := filterMisconfigurations(misconfs, severities, includeNonFailures, ignoredIDs)
if policyFile != "" { if policyFile != "" {
var err error var err error
@@ -192,7 +192,7 @@ func filterVulnerabilities(vulns []types.DetectedVulnerability, severities []dbT
} }
func filterMisconfigurations(misconfs []types.DetectedMisconfiguration, severities []dbTypes.Severity, func filterMisconfigurations(misconfs []types.DetectedMisconfiguration, severities []dbTypes.Severity,
includeSuccesses bool, ignoredIDs []string) (*report.MisconfSummary, []types.DetectedMisconfiguration) { includeNonFailures bool, ignoredIDs []string) (*report.MisconfSummary, []types.DetectedMisconfiguration) {
var filtered []types.DetectedMisconfiguration var filtered []types.DetectedMisconfiguration
summary := new(report.MisconfSummary) summary := new(report.MisconfSummary)
@@ -204,9 +204,10 @@ func filterMisconfigurations(misconfs []types.DetectedMisconfiguration, severiti
continue continue
} }
// Count successes, failures, and exceptions
summarize(misconf.Status, summary) summarize(misconf.Status, summary)
if misconf.Status != types.StatusFailure && !includeSuccesses { if misconf.Status != types.StatusFailure && !includeNonFailures {
continue continue
} }
filtered = append(filtered, misconf) filtered = append(filtered, misconf)