Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 54b4f56

Browse files
agatakrajewskaagatakrajewska
committed
fix: update filter(), ignore when expiry invalid
IGNR-1093 Fix to align handling for invalid ignore expiry across Snyk product lines.
1 parent 972efe2 commit 54b4f56

File tree

7 files changed

+284
-9
lines changed

7 files changed

+284
-9
lines changed

‎package-lock.json‎

Lines changed: 7 additions & 8 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,7 @@
126126
"snyk-nodejs-plugin": "1.4.4",
127127
"snyk-nuget-plugin": "2.7.15",
128128
"snyk-php-plugin": "1.12.1",
129-
"snyk-policy": "4.1.4",
129+
"snyk-policy": "4.1.5",
130130
"snyk-python-plugin": "2.7.0",
131131
"snyk-resolve-deps": "4.8.0",
132132
"snyk-sbt-plugin": "2.18.1",

‎test/fixtures/snyk-ignores-invalid-expiry/.snyk‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
2+
version: v1.19.0
3+
# ignores vulnerabilities until expiry date; change duration by modifying expiry date
4+
ignore:
5+
'npm:hawk:20160119':
6+
- 'sqlite > sqlite3 > node-pre-gyp > request > hawk':
7+
reason: hawk got bumped
8+
expires: 'is a random string'
9+
'npm:is-my-json-valid:20160118':
10+
- 'sqlite > sqlite3 > node-pre-gyp > request > har-validator > is-my-json-valid':
11+
reason: dev tool
12+
expires: '2000-03-01'
13+
'npm:tar:20151103':
14+
- 'sqlite > sqlite3 > node-pre-gyp > tar-pack > tar':
15+
reason: none given
16+
expires: '2000-03-01 14:30:04.137Z'

‎test/fixtures/snyk-ignores-invalid-expiry/vulns.json‎

Lines changed: 220 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,220 @@
1+
{
2+
"ok": false,
3+
"vulnerabilities": [
4+
{
5+
"title": "Regular Expression Denial of Service",
6+
"credit": [
7+
"Adam Baldwin"
8+
],
9+
"creationTime": "2016-01-19T23:24:51.834Z",
10+
"modificationTime": "2016-01-19T23:24:51.834Z",
11+
"publicationTime": "2016-01-19T21:51:35.396Z",
12+
"description": "## Overview\nA [Regular expression Denial of Service (ReDoS)](https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS) vulnerability exists in `hawk` package, affecting version 4.1.0 and below.\n\n\"The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression to enter these extreme situations and then hang for a very long time.\" [1](https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS)\n\n## References\n- https://github.com/hueniverse/hawk/issues/168\n- https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS\n",
13+
"semver": {
14+
"vulnerable": "<=3.1.2 || >= 4.0.0 <4.1.1",
15+
"unaffected": ">3.1.2 < 4.0.0 || >=4.1.1"
16+
},
17+
"CVSSv3": "",
18+
"severity": "low",
19+
"identifiers": {
20+
"CWE": [
21+
"CWE-400"
22+
],
23+
"CVE": [],
24+
"NSP": 77
25+
},
26+
"patches": [
27+
{
28+
"urls": [
29+
"https://raw.githubusercontent.com/Snyk/vulndb/snapshots/master/patches/npm/hawk/20160119/hawk_20160119_0_0_0833f99ba64558525995a7e21d4093da1f3e15fa.patch"
30+
],
31+
"version": "<4.1.1 >=4.0.0",
32+
"modificationTime": "2016-01-20T12:51:35.396Z",
33+
"comments": [],
34+
"id": "patch:npm:hawk:20160119:0"
35+
},
36+
{
37+
"urls": [
38+
"https://raw.githubusercontent.com/Snyk/vulndb/snapshots/master/patches/npm/hawk/20160119/hawk_20160119_0_1_0833f99ba64558525995a7e21d4093da1f3e15fa.patch"
39+
],
40+
"version": "<4.0.0 >=3.0.0",
41+
"modificationTime": "2016-01-20T12:51:35.396Z",
42+
"comments": [],
43+
"id": "patch:npm:hawk:20160119:1"
44+
}
45+
],
46+
"moduleName": "hawk",
47+
"id": "npm:hawk:20160119",
48+
"from": [
49+
"[email protected]",
50+
"[email protected]",
51+
"[email protected]",
52+
"[email protected]",
53+
"[email protected]",
54+
"[email protected]"
55+
],
56+
"upgradePath": [
57+
false,
58+
"[email protected]",
59+
"[email protected]",
60+
"[email protected]",
61+
"[email protected]",
62+
"[email protected]"
63+
],
64+
"version": "3.1.0",
65+
"name": "hawk",
66+
"__filename": "/Users/remy/Sites/snyk-tests/ignore/node_modules/sqlite/node_modules/sqlite3/node_modules/node-pre-gyp/node_modules/request/node_modules/hawk/package.json",
67+
"bundled": [
68+
"[email protected]",
69+
"[email protected]",
70+
"[email protected]",
71+
"[email protected]"
72+
]
73+
},
74+
{
75+
"title": "Regular Expression Denial of Service",
76+
"credit": [
77+
"Adam Baldwin"
78+
],
79+
"creationTime": "2016-01-18T12:28:12.885Z",
80+
"modificationTime": "2016-01-18T12:28:12.885Z",
81+
"publicationTime": "2016-01-18T04:29:55.903Z",
82+
"description": "## Overview\nA [Regular expression Denial of Service (ReDoS)](https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS) vulnerability exists in `utc-millisec` validator of `is-my-json-valid` package, affecting version 2.12.3 and below.\n\n\"The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression to enter these extreme situations and then hang for a very long time.\" [1](https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS)\n\n## References\n- https://nodesecurity.io/advisories/76\n- https://github.com/mafintosh/is-my-json-valid/commit/eca4beb21e61877d76fdf6bea771f72f39544d9b\n- https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS\n\n\n",
83+
"semver": {
84+
"vulnerable": "<=2.12.3",
85+
"unaffected": ">=2.12.4"
86+
},
87+
"CVSSv3": "",
88+
"severity": "low",
89+
"identifiers": {
90+
"CWE": [
91+
"CWE-400"
92+
],
93+
"CVE": [],
94+
"NSP": 76
95+
},
96+
"patches": [
97+
{
98+
"urls": [
99+
"https://raw.githubusercontent.com/Snyk/vulndb/snapshots/master/patches/npm/is-my-json-valid/20160118/imjv_20160118_0_0_eca4beb21e61877d76fdf6bea771f72f39544d9b.patch"
100+
],
101+
"version": "<=2.12.3 >=2.0.3",
102+
"modificationTime": "2016-01-21T12:51:35.396Z",
103+
"comments": [],
104+
"id": "patch:npm:is-my-json-valid:20160118:0"
105+
},
106+
{
107+
"urls": [
108+
"https://raw.githubusercontent.com/Snyk/vulndb/snapshots/master/patches/npm/is-my-json-valid/20160118/imjv_20160118_0_1_eca4beb21e61877d76fdf6bea771f72f39544d9b.patch"
109+
],
110+
"version": "<2.0.3 >=1.3.4",
111+
"modificationTime": "2016-01-21T12:51:35.396Z",
112+
"comments": [],
113+
"id": "patch:npm:is-my-json-valid:20160118:1"
114+
}
115+
],
116+
"moduleName": "is-my-json-valid",
117+
"id": "npm:is-my-json-valid:20160118",
118+
"from": [
119+
"[email protected]",
120+
"[email protected]",
121+
"[email protected]",
122+
"[email protected]",
123+
"[email protected]",
124+
"[email protected]",
125+
"[email protected]"
126+
],
127+
"upgradePath": [
128+
false,
129+
"[email protected]",
130+
"[email protected]",
131+
"[email protected]",
132+
"[email protected]",
133+
"[email protected]",
134+
"[email protected]"
135+
],
136+
"version": "2.12.2",
137+
"name": "is-my-json-valid",
138+
"__filename": "/Users/remy/Sites/snyk-tests/ignore/node_modules/sqlite/node_modules/sqlite3/node_modules/node-pre-gyp/node_modules/request/node_modules/har-validator/node_modules/is-my-json-valid/package.json",
139+
"bundled": [
140+
"[email protected]",
141+
"[email protected]",
142+
"[email protected]",
143+
"[email protected]"
144+
]
145+
},
146+
{
147+
"title": "Symlink Arbitrary File Overwrite",
148+
"credit": [
149+
"Tim Cuthbertson"
150+
],
151+
"creationTime": "2015-11-06T02:09:36.182Z",
152+
"modificationTime": "2015-11-06T02:09:36.182Z",
153+
"publicationTime": "2015-11-03T07:15:12.900Z",
154+
"description": "## Overview\nThe [`tar`](https://www.npmjs.com/package/tar) module prior to version 2.0.0 does not properly normalize symbolic links pointing to targets outside the extraction root. As a result, packages may hold symbolic links to parent and sibling directories and overwrite those files when the package is extracted.\n\n## Remediation\nUpgrade to version 2.0.0 or greater. \n\n## References\n- https://nodesecurity.io/advisories/57\n- https://github.com/npm/node-tar/commit/a5337a6cd58a2d800fc03b3781a25751cf459f28\n- https://github.com/npm/npm/releases/tag/v2.7.5\n",
155+
"semver": {
156+
"vulnerable": "<2.0.0",
157+
"unaffected": ">=2.0.0"
158+
},
159+
"CVSSv3": "",
160+
"severity": "high",
161+
"identifiers": {
162+
"CWE": [],
163+
"CVE": [],
164+
"NSP": 57
165+
},
166+
"patches": [
167+
{
168+
"urls": [
169+
"https://raw.githubusercontent.com/Snyk/vulndb/snapshots/master/patches/npm/tar/20151103/tar_20151103_0_0_a5337a6cd58a2d800fc03b3781a25751cf459f28_snyk.patch"
170+
],
171+
"version": "<2.0.0 >=0.1.13",
172+
"modificationTime": "2015-11-17T09:29:10.000Z",
173+
"comments": [
174+
"https://github.com/npm/node-tar/commit/a5337a6cd58a2d800fc03b3781a25751cf459f28.patch"
175+
],
176+
"id": "patch:npm:tar:20151103:0"
177+
},
178+
{
179+
"urls": [
180+
"https://raw.githubusercontent.com/Snyk/vulndb/snapshots/master/patches/npm/tar/20151103/tar_20151103_0_1_a5337a6cd58a2d800fc03b3781a25751cf459f28_snyk.patch"
181+
],
182+
"version": "<0.1.13 >0.0.1",
183+
"modificationTime": "2015-11-17T09:29:10.000Z",
184+
"comments": [
185+
"https://github.com/npm/node-tar/commit/a5337a6cd58a2d800fc03b3781a25751cf459f28.patch"
186+
],
187+
"id": "patch:npm:tar:20151103:1"
188+
}
189+
],
190+
"moduleName": "tar",
191+
"id": "npm:tar:20151103",
192+
"from": [
193+
"[email protected]",
194+
"[email protected]",
195+
"[email protected]",
196+
"[email protected]",
197+
"[email protected]",
198+
"[email protected]"
199+
],
200+
"upgradePath": [
201+
false,
202+
"[email protected]",
203+
"[email protected]",
204+
"[email protected]",
205+
"[email protected]",
206+
"[email protected]"
207+
],
208+
"version": "0.1.20",
209+
"name": "tar",
210+
"__filename": "/Users/remy/Sites/snyk-tests/ignore/node_modules/sqlite/node_modules/sqlite3/node_modules/node-pre-gyp/node_modules/tar-pack/node_modules/tar/package.json",
211+
"bundled": [
212+
"[email protected]",
213+
"[email protected]",
214+
"[email protected]",
215+
"[email protected]"
216+
]
217+
}
218+
],
219+
"dependencyCount": 108
220+
}

‎test/jest/unit/iac/process-results/fixtures/policy-ignore-invalid-expiry.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
2+
version: v1.19.0
3+
# ignores vulnerabilities until expiry date; change duration by modifying expiry date
4+
ignore:
5+
SNYK-CC-K8S-1:
6+
- 'k8s.yaml > *':
7+
reason: None Given
8+
created: 2021071613:09:08.459Z
9+
patch: {}

‎test/jest/unit/iac/process-results/policy.spec.ts‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,4 +138,12 @@ describe('filtering ignored issues', () => {
138138
expect(filtered).toEqual(fixture);
139139
expect(ignoreCount).toEqual(0);
140140
});
141+
142+
it('filters ignored issues when ignore policy expiry date is invalid', async () => {
143+
const { fixture, filtered, ignoreCount } = await filterFixture(
144+
'policy-ignore-invalid-expiry.yml',
145+
);
146+
assertK8sPolicyPruned(fixture, filtered);
147+
expect(ignoreCount).toEqual(1);
148+
});
141149
});

‎test/jest/unit/policy.spec.ts‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
import * as policy from 'snyk-policy';
2+
import * as fs from 'fs';
3+
import { getFixturePath } from '../util/getFixturePath';
4+
5+
it('blah', async () => {
6+
const loadedPolicy = await policy.load(
7+
getFixturePath('snyk-ignores-invalid-expiry'),
8+
);
9+
const vulns = JSON.parse(
10+
fs.readFileSync(
11+
'test/fixtures/snyk-ignores-invalid-expiry/vulns.json',
12+
'utf-8',
13+
),
14+
);
15+
16+
expect(vulns.vulnerabilities).toHaveLength(3);
17+
18+
// should not keep all vulns, because all of the ignores have invalid expiry date
19+
const result = loadedPolicy.filter(vulns);
20+
expect(result.ok).toBe(false);
21+
expect(result.vulnerabilities).toHaveLength(2);
22+
expect(result.filtered.ignore).toHaveLength(1);
23+
});

0 commit comments

Comments
 (0)