admin/aquasecurity-trivy
1
0
Fork 0
mirror of https://github.com/aquasecurity/trivy.git synced 2026-01-31 13:53:14 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(python): add dependency locations for Pipfile.lock (#3614)

Browse Source
This commit is contained in:
DmitriyLewen
2023-02-20 10:51:42 +03:00
committed by GitHub
parent 9badef27ac
commit b7bfb9a207
7 changed files with 559 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/docs/vulnerability/detection/language.md
View File

@@ -6,7 +6,7 @@
|----------|--------------------------------------------------------------------------------------------|:---------:|:----------:|:---------------:|:---------------:|------------------|:------------------------:|
| Ruby | Gemfile.lock | - | - | ✅ | ✅ | included | - |
| | gemspec | ✅ | ✅ | - | - | included | - |
| Python | Pipfile.lock | - | - | ✅ | ✅ | excluded | - |
| Python | Pipfile.lock | - | - | ✅ | ✅ | excluded | ✅ |
| | poetry.lock | - | - | ✅ | ✅ | excluded | - |
| | requirements.txt | - | - | ✅ | ✅ | included | - |
| | egg package[^1] | ✅ | ✅ | - | - | excluded | - |

4
go.mod
View File

@@ -9,7 +9,7 @@ require (
github.com/alicebob/miniredis/v2 v2.23.0
github.com/aquasecurity/bolt-fixtures v0.0.0-20200903104109-d34e7f983986
github.com/aquasecurity/defsec v0.82.9
github.com/aquasecurity/go-dep-parser v0.0.0-20230130190635-5e31092b0621
github.com/aquasecurity/go-dep-parser v0.0.0-20230219131432-590b1dfb6edd
github.com/aquasecurity/go-gem-version v0.0.0-20201115065557-8eed6fe000ce
github.com/aquasecurity/go-npm-version v0.0.0-20201110091526-0b796d180798
github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46
@@ -61,7 +61,7 @@ require (
github.com/open-policy-agent/opa v0.44.1-0.20220927105354-00e835a7cc15
github.com/owenrumney/go-sarif/v2 v2.1.2
github.com/package-url/packageurl-go v0.1.1-0.20220428063043-89078438f170
github.com/samber/lo v1.36.0
github.com/samber/lo v1.37.0
github.com/secure-systems-lab/go-securesystemslib v0.4.0
github.com/sigstore/rekor v1.0.1
github.com/sosedoff/gitkit v0.3.0

9
go.sum
View File

@@ -180,8 +180,8 @@ github.com/aquasecurity/bolt-fixtures v0.0.0-20200903104109-d34e7f983986 h1:2a30
github.com/aquasecurity/bolt-fixtures v0.0.0-20200903104109-d34e7f983986/go.mod h1:NT+jyeCzXk6vXR5MTkdn4z64TgGfE5HMLC8qfj5unl8=
github.com/aquasecurity/defsec v0.82.9 h1:bThdD+Mr/6ZYPDTX0f24GY9wF4hoVJ5KF/L0WnhjEwQ=
github.com/aquasecurity/defsec v0.82.9/go.mod h1:f/acz2sBQzfTcnaPxSjVnkRhCQ9hUbC6qwQCaHQwrFc=
github.com/aquasecurity/go-dep-parser v0.0.0-20230130190635-5e31092b0621 h1:y8e5XlnOJd2kdKOB2TDNM+84yHkkkIjVCxHhePxXy+4=
github.com/aquasecurity/go-dep-parser v0.0.0-20230130190635-5e31092b0621/go.mod h1:E5p/rvZrFOz2Py3WtBopQjC1d7AqU54D2FqjjEFHEkk=
github.com/aquasecurity/go-dep-parser v0.0.0-20230219131432-590b1dfb6edd h1:H9IR14rR3+Z13ZH7ay9bs2hHBL7WAqdEJLLr8nhx/Rs=
github.com/aquasecurity/go-dep-parser v0.0.0-20230219131432-590b1dfb6edd/go.mod h1:4dZHU2Ntsh9EopNVdTKf8UjSGDNTMVoyB5B34RjD75g=
github.com/aquasecurity/go-gem-version v0.0.0-20201115065557-8eed6fe000ce h1:QgBRgJvtEOBtUXilDb1MLi1p1MWoyFDXAu5DEUl5nwM=
github.com/aquasecurity/go-gem-version v0.0.0-20201115065557-8eed6fe000ce/go.mod h1:HXgVzOPvXhVGLJs4ZKO817idqr/xhwsTcj17CLYY74s=
github.com/aquasecurity/go-mock-aws v0.0.0-20220726154943-99847deb62b0 h1:tihCUjLWkF0b1SAjAKcFltUs3SpsqGrLtI+Frye0D10=
@@ -1396,8 +1396,8 @@ github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
github.com/safchain/ethtool v0.0.0-20190326074333-42ed695e3de8/go.mod h1:Z0q5wiBQGYcxhMZ6gUqHn6pYNLypFAvaL3UvgZLR0U4=
github.com/samber/lo v1.36.0 h1:4LaOxH1mHnbDGhTVE0i1z8v/lWaQW8AIfOD3HU4mSaw=
github.com/samber/lo v1.36.0/go.mod h1:HLeWcJRRyLKp3+/XBJvOrerCQn9mhdKMHyd7IRlgeQ8=
github.com/samber/lo v1.37.0 h1:XjVcB8g6tgUp8rsPsJ2CvhClfImrpL04YpQHXeHPhRw=
github.com/samber/lo v1.37.0/go.mod h1:9vaz2O4o8oOnK23pd2TrXufcbdbJIa3b6cstBWKpopA=
github.com/saracen/walker v0.0.0-20191201085201-324a081bae7e h1:NO86zOn5ScSKW8wRbMaSIcjDZUFpWdCQQnexRqZ9h9A=
github.com/saracen/walker v0.0.0-20191201085201-324a081bae7e/go.mod h1:G0Z6yVPru183i2MuRJx1DcR4dgIZtLcTdaaE/pC1BJU=
github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
@@ -1500,7 +1500,6 @@ github.com/testcontainers/testcontainers-go v0.17.0 h1:UdKSw2DJXinlS6ijbFb4VHpQz
github.com/testcontainers/testcontainers-go v0.17.0/go.mod h1:n5trpHrB68IUelEqGNC8VipaCo6jOGusU44kIK11XRs=
github.com/tetratelabs/wazero v1.0.0-pre.8 h1:Ir82PWj79WCppH+9ny73eGY2qv+oCnE3VwMY92cBSyI=
github.com/tetratelabs/wazero v1.0.0-pre.8/go.mod h1:u8wrFmpdrykiFK0DFPiFm5a4+0RzsdmXYVtijBKqUVo=
github.com/thoas/go-funk v0.9.1 h1:O549iLZqPpTUQ10ykd26sZhzD+rmR5pWhuElrhbC20M=
github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
github.com/tidwall/pretty v1.2.0 h1:RWIZEg2iJ8/g6fDDYzMpobmaoGh5OLl4AXtGUGPcqCs=
github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=

9
integration/fs_test.go
View File

@@ -99,6 +99,15 @@ func TestFilesystem(t *testing.T) {
},
golden: "testdata/pip.json.golden",
},
{
name: "pipenv",
args: args{
scanner: types.VulnerabilityScanner,
listAllPkgs: true,
input: "testdata/fixtures/fs/pipenv",
},
golden: "testdata/pipenv.json.golden",
},
{
name: "pom",
args: args{

29
integration/testdata/fixtures/fs/pipenv/Pipfile.lock generated vendored Normal file
View File

@@ -0,0 +1,29 @@
{
"_meta": {
"hash": {
"sha256": "06bf5e1462f5cf5abd8c226d9db597827c8fde5c6bbb0e9c87c2977720130c56"
},
"pipfile-spec": 6,
"requires": {
"python_version": "3.10"
},
"sources": [
{
"name": "pypi",
"url": "https://pypi.org/simple",
"verify_ssl": true
}
]
},
"default": {
"werkzeug": {
"hashes": [
"sha256:1e0dedc2acb1f46827daa2e399c1485c8fa17c0d8e70b6b875b4e7f54bf408d2",
"sha256:b353856d37dec59d6511359f97f6a4b2468442e454bd1c98298ddce53cac1f04"
],
"index": "pypi",
"version": "==0.11.1"
}
},
"develop": {}
}

129
integration/testdata/pipenv.json.golden vendored Normal file
View File

@@ -0,0 +1,129 @@
{
"SchemaVersion": 2,
"ArtifactName": "testdata/fixtures/fs/pipenv",
"ArtifactType": "filesystem",
"Metadata": {
"ImageConfig": {
"architecture": "",
"created": "0001-01-01T00:00:00Z",
"os": "",
"rootfs": {
"type": "",
"diff_ids": null
},
"config": {}
}
},
"Results": [
{
"Target": "Pipfile.lock",
"Class": "lang-pkgs",
"Type": "pipenv",
"Packages": [
{
"Name": "werkzeug",
"Version": "0.11.1",
"Layer": {},
"Locations": [
{
"StartLine": 19,
"EndLine": 26
}
]
}
],
"Vulnerabilities": [
{
"VulnerabilityID": "CVE-2019-14806",
"PkgName": "werkzeug",
"InstalledVersion": "0.11.1",
"FixedVersion": "0.15.3",
"Layer": {},
"SeveritySource": "ghsa",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-14806",
"DataSource": {
"ID": "ghsa",
"Name": "GitHub Security Advisory Pip",
"URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
},
"Title": "python-werkzeug: insufficient debugger PIN randomness vulnerability",
"Description": "Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.",
"Severity": "HIGH",
"CweIDs": [
"CWE-331"
],
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"V2Score": 5,
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"V3Score": 7.5
}
},
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00034.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00047.html",
"https://access.redhat.com/security/cve/CVE-2019-14806",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14806",
"https://github.com/advisories/GHSA-gq9m-qvpx-68hc",
"https://github.com/pallets/werkzeug/blob/7fef41b120327d3912fbe12fb64f1951496fcf3e/src/werkzeug/debug/__init__.py#L168",
"https://github.com/pallets/werkzeug/commit/00bc43b1672e662e5e3b8cecd79e67fc968fa246",
"https://nvd.nist.gov/vuln/detail/CVE-2019-14806",
"https://palletsprojects.com/blog/werkzeug-0-15-3-released/",
"https://ubuntu.com/security/notices/USN-4655-1"
],
"PublishedDate": "2019-08-09T15:15:00Z",
"LastModifiedDate": "2019-09-11T00:15:00Z"
},
{
"VulnerabilityID": "CVE-2020-28724",
"PkgName": "werkzeug",
"InstalledVersion": "0.11.1",
"FixedVersion": "0.11.6",
"Layer": {},
"SeveritySource": "ghsa",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2020-28724",
"DataSource": {
"ID": "ghsa",
"Name": "GitHub Security Advisory Pip",
"URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
},
"Title": "python-werkzeug: open redirect via double slash in the URL",
"Description": "Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.",
"Severity": "MEDIUM",
"CweIDs": [
"CWE-601"
],
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"V2Score": 5.8,
"V3Score": 6.1
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"V3Score": 5.4
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2020-28724",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28724",
"https://github.com/advisories/GHSA-3p3h-qghp-hvh2",
"https://github.com/pallets/flask/issues/1639",
"https://github.com/pallets/werkzeug/issues/822",
"https://github.com/pallets/werkzeug/pull/890/files",
"https://nvd.nist.gov/vuln/detail/CVE-2020-28724",
"https://ubuntu.com/security/notices/USN-4655-1"
],
"PublishedDate": "2020-11-18T15:15:00Z",
"LastModifiedDate": "2020-12-01T16:05:00Z"
}
]
}
]
}

440
pkg/fanal/test/integration/testdata/goldens/vuln-image1.2.3.expectedlibs.golden vendored
View File

@@ -1008,276 +1008,606 @@
{
"Name": "amqp",
"Version": "2.4.2",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 19,
"EndLine": 25
}
]
},
{
"Name": "autopep8",
"Version": "1.4.3",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 26,
"EndLine": 31
}
]
},
{
"Name": "babel",
"Version": "2.6.0",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 32,
"EndLine": 38
}
]
},
{
"Name": "billiard",
"Version": "3.6.0.0",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 39,
"EndLine": 44
}
]
},
{
"Name": "boto3",
"Version": "1.9.130",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 45,
"EndLine": 52
}
]
},
{
"Name": "botocore",
"Version": "1.12.130",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 53,
"EndLine": 59
}
]
},
{
"Name": "celery",
"Version": "4.3.0",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 60,
"EndLine": 70
}
]
},
{
"Name": "certifi",
"Version": "2019.3.9",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 71,
"EndLine": 77
}
]
},
{
"Name": "chardet",
"Version": "3.0.4",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 78,
"EndLine": 84
}
]
},
{
"Name": "decorator",
"Version": "4.4.0",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 85,
"EndLine": 91
}
]
},
{
"Name": "django",
"Version": "2.0.9",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 92,
"EndLine": 99
}
]
},
{
"Name": "django-celery-beat",
"Version": "1.4.0",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 100,
"EndLine": 107
}
]
},
{
"Name": "django-cors-headers",
"Version": "2.5.2",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 108,
"EndLine": 115
}
]
},
{
"Name": "django-extensions",
"Version": "2.1.6",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 116,
"EndLine": 123
}
]
},
{
"Name": "django-postgres-extra",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 124,
"EndLine": 128
}
]
},
{
"Name": "django-redis-cache",
"Version": "2.0.0",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 129,
"EndLine": 135
}
]
},
{
"Name": "django-silk",
"Version": "3.0.1",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 136,
"EndLine": 143
}
]
},
{
"Name": "django-timezone-field",
"Version": "3.0",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 144,
"EndLine": 150
}
]
},
{
"Name": "djangorestframework",
"Version": "3.9.2",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 151,
"EndLine": 158
}
]
},
{
"Name": "djangorestframework-jwt",
"Version": "1.11.0",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 159,
"EndLine": 166
}
]
},
{
"Name": "docutils",
"Version": "0.14",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 167,
"EndLine": 174
}
]
},
{
"Name": "flower",
"Version": "0.9.3",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 175,
"EndLine": 181
}
]
},
{
"Name": "gprof2dot",
"Version": "2016.10.13",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 182,
"EndLine": 187
}
]
},
{
"Name": "gunicorn",
"Version": "19.9.0",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 188,
"EndLine": 195
}
]
},
{
"Name": "hiredis",
"Version": "1.0.0",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 196,
"EndLine": 229
}
]
},
{
"Name": "httplib2",
"Version": "0.12.1",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 230,
"EndLine": 235
}
]
},
{
"Name": "idna",
"Version": "2.8",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 236,
"EndLine": 242
}
]
},
{
"Name": "jinja2",
"Version": "2.10.1",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 243,
"EndLine": 249
}
]
},
{
"Name": "jmespath",
"Version": "0.9.4",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 250,
"EndLine": 256
}
]
},
{
"Name": "kombu",
"Version": "4.5.0",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 257,
"EndLine": 263
}
]
},
{
"Name": "markupsafe",
"Version": "1.1.1",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 264,
"EndLine": 296
}
]
},
{
"Name": "oauth2",
"Version": "1.9.0.post1",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 297,
"EndLine": 304
}
]
},
{
"Name": "psycopg2-binary",
"Version": "2.8.1",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 305,
"EndLine": 338
}
]
},
{
"Name": "py",
"Version": "1.8.0",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 339,
"EndLine": 345
}
]
},
{
"Name": "pycodestyle",
"Version": "2.5.0",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 346,
"EndLine": 352
}
]
},
{
"Name": "pycurl",
"Version": "7.43.0.2",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 353,
"EndLine": 365
}
]
},
{
"Name": "pygments",
"Version": "2.3.1",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 366,
"EndLine": 372
}
]
},
{
"Name": "pyjwt",
"Version": "1.7.1",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 373,
"EndLine": 379
}
]
},
{
"Name": "python-crontab",
"Version": "2.3.6",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 380,
"EndLine": 385
}
]
},
{
"Name": "python-dateutil",
"Version": "2.8.0",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 386,
"EndLine": 393
}
]
},
{
"Name": "python-http-client",
"Version": "3.1.0",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 394,
"EndLine": 399
}
]
},
{
"Name": "pytz",
"Version": "2019.1",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 400,
"EndLine": 406
}
]
},
{
"Name": "pyyaml",
"Version": "5.1",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 407,
"EndLine": 423
}
]
},
{
"Name": "redis",
"Version": "3.2.1",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 424,
"EndLine": 430
}
]
},
{
"Name": "requests",
"Version": "2.21.0",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 431,
"EndLine": 438
}
]
},
{
"Name": "retry",
"Version": "0.9.2",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 439,
"EndLine": 446
}
]
},
{
"Name": "s3transfer",
"Version": "0.2.0",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 447,
"EndLine": 453
}
]
},
{
"Name": "sendgrid",
"Version": "6.0.4",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 454,
"EndLine": 461
}
]
},
{
"Name": "sentry-sdk",
"Version": "0.7.10",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 462,
"EndLine": 469
}
]
},
{
"Name": "six",
"Version": "1.12.0",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 470,
"EndLine": 476
}
]
},
{
"Name": "sqlparse",
"Version": "0.3.0",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 477,
"EndLine": 483
}
]
},
{
"Name": "tornado",
"Version": "5.1.1",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 484,
"EndLine": 495
}
]
},
{
"Name": "urllib3",
"Version": "1.24.1",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 496,
"EndLine": 503
}
]
},
{
"Name": "vine",
"Version": "1.3.0",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 504,
"EndLine": 510
}
]
},
{
"Name": "xmltodict",
"Version": "0.12.0",
"Layer": {}
"Layer": {},
"Locations": [
{
"StartLine": 511,
"EndLine": 518
}
]
}
]
}