Skip to content

Commit

Permalink
fix(output): correct unimportant vuln type (#1427)
Browse files Browse the repository at this point in the history
resolves #1419

- Print unimportant vulnerabilities as unimportant, not uncalled.
- Add an `IsGroupUnimportant()` function to identify if a vulnerability
is unimportant.
- Refactor the output result structure from `CalledVulns` and
`UncalledVulns` to `RegularVulns` and `HiddenVulns`.
- Add `VulnAnalysisType` to indicate if a vulnerability is regular,
unimportant, or uncalled. This can also be expanded in the future when
we have more reachability analysis.

Project scanning (Changed from "uncalled vulnerabilities" to
"unimportant vulnerabilities" for Debian package scanning):
<img width="1181" alt="Screenshot 2024-12-06 at 4 17 46 PM"
src="https://github.com/user-attachments/assets/a3f608ba-4bb3-4c9e-aae3-db67ac8936f2">
Contianer scanning (Added a "filtered vulnerabilities" table with a
filter reason):
<img width="1015" alt="Screenshot 2024-12-06 at 4 19 06 PM"
src="https://github.com/user-attachments/assets/9859305a-f073-46dc-9a64-bea27641f8fa">

---------

Signed-off-by: dependabot[bot] <[email protected]>
Signed-off-by: Emmanuel Ferdman <[email protected]>
Co-authored-by: Rex P <[email protected]>
Co-authored-by: Gareth Jones <[email protected]>
Co-authored-by: Xueqin Cui <[email protected]>
Co-authored-by: Michael Kedar <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Emmanuel Ferdman <[email protected]>
Co-authored-by: Ignacio Vazquez <[email protected]>
Co-authored-by: Rex P <[email protected]>
  • Loading branch information
9 people authored Dec 10, 2024
1 parent c693e2d commit 04ac265
Show file tree
Hide file tree
Showing 6 changed files with 726 additions and 584 deletions.
4 changes: 2 additions & 2 deletions cmd/osv-scanner/__snapshots__/main_test.snap
Original file line number Diff line number Diff line change
Expand Up @@ -1997,7 +1997,7 @@ Loaded Go local db from <tempdir>/osv-scanner/Go/all.zip
| https://osv.dev/GHSA-xr7r-f8xq-vfvv | 8.6 | Go | github.com/opencontainers/runc | v1.0.1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
| https://osv.dev/GHSA-p782-xgp4-8hr8 | 5.3 | Go | golang.org/x/sys | v0.0.0-20210817142637-7d9622a276b7 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
+-------------------------------------+------+-----------+--------------------------------+------------------------------------+-------------------------------------------------+
| Uncalled vulnerabilities | | | | | |
| Unimportant vulnerabilities | | | | | |
+-------------------------------------+------+-----------+--------------------------------+------------------------------------+-------------------------------------------------+
| https://osv.dev/CVE-2011-3374 | 3.7 | Debian | apt | 1.4.11 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
| https://osv.dev/CVE-2019-18276 | 7.8 | Debian | bash | 4.4-5 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
Expand Down Expand Up @@ -2195,7 +2195,7 @@ Loaded Go local db from <tempdir>/osv-scanner/Go/all.zip
| https://osv.dev/GHSA-xr7r-f8xq-vfvv | 8.6 | Go | github.com/opencontainers/runc | v1.0.1 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
| https://osv.dev/GHSA-p782-xgp4-8hr8 | 5.3 | Go | golang.org/x/sys | v0.0.0-20210817142637-7d9622a276b7 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
+-------------------------------------+------+-----------+--------------------------------+------------------------------------+-------------------------------------------------+
| Uncalled vulnerabilities | | | | | |
| Unimportant vulnerabilities | | | | | |
+-------------------------------------+------+-----------+--------------------------------+------------------------------------+-------------------------------------------------+
| https://osv.dev/CVE-2011-3374 | 3.7 | Debian | apt | 1.4.11 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
| https://osv.dev/CVE-2019-18276 | 7.8 | Debian | bash | 4.4-5 | fixtures/sbom-insecure/postgres-stretch.cdx.xml |
Expand Down
Loading

0 comments on commit 04ac265

Please sign in to comment.