feat: add vulnerabilities into cdx output when using folder hashing command #133
Conversation
WalkthroughThe changes introduce vulnerability data into the CycloneDX output generated by the Changes
Sequence Diagram(s)sequenceDiagram
participant Presenter as ScannerHFHPresenter
participant Client as Scanner Client
participant CycloneDx as CycloneDx
Presenter->>Client: get_vulnerabilities_json(request)
Client-->>Presenter: vulnerabilities_data
Presenter->>CycloneDx: append_vulnerabilities(cdx_dict, vulnerabilities_data, purl)
CycloneDx-->>Presenter: updated_cdx_dict
Presenter-->>Presenter: Return CycloneDX JSON with vulnerabilities
Suggested reviewers
Poem
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (5)
CHANGELOG.md(1 hunks)src/scanoss/__init__.py(1 hunks)src/scanoss/cyclonedx.py(1 hunks)src/scanoss/scanners/scanner_hfh.py(2 hunks)src/scanoss/scanossgrpc.py(1 hunks)
🧰 Additional context used
🧬 Code Graph Analysis (2)
src/scanoss/scanossgrpc.py (1)
src/scanoss/scanossbase.py (1)
print_debug(58-63)
src/scanoss/scanners/scanner_hfh.py (2)
src/scanoss/scanossgrpc.py (2)
get_dependencies(248-255)get_vulnerabilities_json(314-342)src/scanoss/cyclonedx.py (1)
append_vulnerabilities(290-357)
🪛 GitHub Actions: Lint
src/scanoss/cyclonedx.py
[error] 290-290: Ruff: Too many branches (14 > 12) in function 'append_vulnerabilities'. (PLR0912)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: build
🔇 Additional comments (6)
src/scanoss/__init__.py (1)
25-25: LGTM! Version bump is appropriate.The version increment to 1.28.0 correctly reflects the addition of vulnerability data to CycloneDX output as a new feature.
CHANGELOG.md (1)
12-14: LGTM! Changelog entry is well-formatted.The entry accurately documents the new vulnerability functionality and follows the established changelog format.
src/scanoss/scanossgrpc.py (1)
329-329: LGTM! Debug message correction is accurate.The updated debug message correctly describes the vulnerability data being sent, fixing the misleading reference to "crypto data."
src/scanoss/scanners/scanner_hfh.py (3)
196-199: LGTM! Well-structured vulnerability request creation.The vulnerability request structure correctly mirrors the dependency request pattern and uses the appropriate purl and version data from the best match component.
202-202: LGTM! Proper integration of vulnerability retrieval.The call to
get_vulnerabilities_jsonis correctly placed after dependency retrieval and follows the established error handling pattern.
213-215: LGTM! Conditional vulnerability appending is well-implemented.The vulnerability data is properly appended to the CycloneDX output only when present, maintaining defensive programming practices and avoiding unnecessary processing.
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
src/scanoss/cyclonedx.py (1)
321-369: Excellent implementation that resolves the complexity issue.The method properly handles vulnerability deduplication, uses the helper methods effectively, and maintains clean separation of concerns. The implementation successfully addresses the complexity threshold violation mentioned in past reviews.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
src/scanoss/cyclonedx.py(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: build
- GitHub Check: build
🔇 Additional comments (1)
src/scanoss/cyclonedx.py (1)
290-302: Good refactoring that addresses the complexity issue.The method correctly normalizes vulnerability IDs and CVEs from different field names, and handles CPE entries appropriately by preferring CVE values when available.
| def _create_vulnerability_entry(self, vuln_id: str, vuln: dict, vuln_cve: str, purl: str) -> dict: | ||
| """ | ||
| Create a new vulnerability entry for CycloneDX format. | ||
| """ | ||
| vuln_source = vuln.get('source', '').lower() | ||
| return { | ||
| 'id': vuln_id, | ||
| 'source': { | ||
| 'name': 'NVD' if vuln_source == 'nvd' else 'GitHub Advisories', | ||
| 'url': f'https://nvd.nist.gov/vuln/detail/{vuln_cve}' | ||
| if vuln_source == 'nvd' | ||
| else f'https://github.com/advisories/{vuln_id}' | ||
| }, | ||
| 'ratings': [{'severity': self._sev_lookup(vuln.get('severity', 'unknown').lower())}], | ||
| 'affects': [{'ref': purl}] | ||
| } |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Potential URL malformation for NVD vulnerabilities.
The method creates proper vulnerability entries, but there's a potential issue with URL construction when vuln_source is 'nvd' but vuln_cve is empty, which would result in a malformed URL.
Consider adding validation to ensure proper URL construction:
def _create_vulnerability_entry(self, vuln_id: str, vuln: dict, vuln_cve: str, purl: str) -> dict:
"""
Create a new vulnerability entry for CycloneDX format.
"""
vuln_source = vuln.get('source', '').lower()
+
+ # Construct URL based on source and available data
+ if vuln_source == 'nvd' and vuln_cve:
+ url = f'https://nvd.nist.gov/vuln/detail/{vuln_cve}'
+ elif vuln_source == 'nvd':
+ url = f'https://nvd.nist.gov/vuln/detail/{vuln_id}'
+ else:
+ url = f'https://github.com/advisories/{vuln_id}'
+
return {
'id': vuln_id,
'source': {
'name': 'NVD' if vuln_source == 'nvd' else 'GitHub Advisories',
- 'url': f'https://nvd.nist.gov/vuln/detail/{vuln_cve}'
- if vuln_source == 'nvd'
- else f'https://github.com/advisories/{vuln_id}'
+ 'url': url
},
'ratings': [{'severity': self._sev_lookup(vuln.get('severity', 'unknown').lower())}],
'affects': [{'ref': purl}]
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| def _create_vulnerability_entry(self, vuln_id: str, vuln: dict, vuln_cve: str, purl: str) -> dict: | |
| """ | |
| Create a new vulnerability entry for CycloneDX format. | |
| """ | |
| vuln_source = vuln.get('source', '').lower() | |
| return { | |
| 'id': vuln_id, | |
| 'source': { | |
| 'name': 'NVD' if vuln_source == 'nvd' else 'GitHub Advisories', | |
| 'url': f'https://nvd.nist.gov/vuln/detail/{vuln_cve}' | |
| if vuln_source == 'nvd' | |
| else f'https://github.com/advisories/{vuln_id}' | |
| }, | |
| 'ratings': [{'severity': self._sev_lookup(vuln.get('severity', 'unknown').lower())}], | |
| 'affects': [{'ref': purl}] | |
| } | |
| def _create_vulnerability_entry(self, vuln_id: str, vuln: dict, vuln_cve: str, purl: str) -> dict: | |
| """ | |
| Create a new vulnerability entry for CycloneDX format. | |
| """ | |
| vuln_source = vuln.get('source', '').lower() | |
| # Construct URL based on source and available data | |
| if vuln_source == 'nvd' and vuln_cve: | |
| url = f'https://nvd.nist.gov/vuln/detail/{vuln_cve}' | |
| elif vuln_source == 'nvd': | |
| url = f'https://nvd.nist.gov/vuln/detail/{vuln_id}' | |
| else: | |
| url = f'https://github.com/advisories/{vuln_id}' | |
| return { | |
| 'id': vuln_id, | |
| 'source': { | |
| 'name': 'NVD' if vuln_source == 'nvd' else 'GitHub Advisories', | |
| 'url': url | |
| }, | |
| 'ratings': [ | |
| { | |
| 'severity': self._sev_lookup( | |
| vuln.get('severity', 'unknown').lower() | |
| ) | |
| } | |
| ], | |
| 'affects': [{'ref': purl}] | |
| } |
🤖 Prompt for AI Agents
In src/scanoss/cyclonedx.py around lines 304 to 319, the URL for NVD
vulnerabilities is constructed using vuln_cve without checking if vuln_cve is
empty, which can lead to malformed URLs. Add validation to check if vuln_cve is
non-empty before including it in the URL; if vuln_cve is empty, avoid appending
it or provide a fallback URL to ensure the URL is always valid.
Summary by CodeRabbit
New Features
Chores
Style