Skip to content

Commit

Permalink
Merge branch 'main' of github.com:sartography/github-actions-library
Browse files Browse the repository at this point in the history 
# Conflicts:
#	wait-for-ecr-scan-and-get-sarif/aws_scan_findings_to_sarif.py
  • Loading branch information
@burnettk
burnettk committed Aug 15, 2024
2 parents 72e5ae6 + 10ac219 commit d3a21d9
Show file tree
Hide file tree
Showing 2 changed files with 24 additions and 18 deletions.
34 changes: 20 additions & 14 deletions wait-for-ecr-scan-and-get-sarif/aws_scan_findings_to_sarif.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,13 @@ def convert_to_sarif(ecr_response):

def process_findings(findings, is_enhanced=False):
for finding in findings:
# make sure severity is an accepted value
# aws likes to use things lke "untriaged"
severity = finding["severity"]
severity_for_level = severity
if severity_for_level.lower() not in ["none", "note", "warning", "error"]:
severity_for_level = "none"

if is_enhanced:
vulnerability_id = finding["packageVulnerabilityDetails"][
"vulnerabilityId"
Expand All @@ -35,24 +42,25 @@ def process_findings(findings, is_enhanced=False):
base_score = None
if len(cvss) > 0:
base_score = cvss[0]["baseScore"]

rule = {
"id": vulnerability_id,
"name": "OsPackageVulnerability",
"shortDescription": {"text": finding["description"]},
"fullDescription": {"text": finding["description"]},
"defaultConfiguration": {"level": finding["severity"].lower()},
"defaultConfiguration": {"level": severity_for_level},
"helpUri": source_url,
"help": {
"text": f"Vulnerability {vulnerability_id}\nSeverity: {finding['severity']}\nPackage: {vulnerable_packages[0]['name']}\nFixed Version: \nLink: [{vulnerability_id}]({source_url})",
"markdown": f"**Vulnerability {vulnerability_id}**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|{finding['severity']}|{vulnerable_packages[0]['name']}||[{vulnerability_id}]({source_url})\n\n{finding['description']}",
"text": f"Vulnerability {vulnerability_id}\nSeverity: {severity}\nPackage: {vulnerable_packages[0]['name']}\nFixed Version: \nLink: [{vulnerability_id}]({source_url})",
"markdown": f"**Vulnerability {vulnerability_id}**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|{severity}|{vulnerable_packages[0]['name']}||[{vulnerability_id}]({source_url})\n\n{finding['description']}",
},
"properties": {
"precision": "very-high",
"security-severity": base_score,
"tags": [
"vulnerability",
"security",
finding["severity"],
severity,
],
},
}
Expand All @@ -61,9 +69,9 @@ def process_findings(findings, is_enhanced=False):
"ruleIndex": len(
sarif_report["runs"][0]["tool"]["driver"]["rules"]
),
"level": finding["severity"].lower(),
"level": severity.lower(),
"message": {
"text": f"Package: {vulnerable_packages[0]['name']}\nInstalled Version: {vulnerable_packages[0]['version']}\nVulnerability {vulnerability_id}\nSeverity: {finding['severity']}\nFixed Version: \nLink: [{vulnerability_id}]({source_url})"
"text": f"Package: {vulnerable_packages[0]['name']}\nInstalled Version: {vulnerable_packages[0]['version']}\nVulnerability {vulnerability_id}\nSeverity: {severity}\nFixed Version: \nLink: [{vulnerability_id}]({source_url})"
},
"locations": [
{
Expand Down Expand Up @@ -91,26 +99,26 @@ def process_findings(findings, is_enhanced=False):
"name": "OsPackageVulnerability",
"shortDescription": {"text": finding["description"]},
"fullDescription": {"text": finding["description"]},
"defaultConfiguration": {"level": finding["severity"].lower()},
"defaultConfiguration": {"level": severity.lower()},
"helpUri": finding["uri"],
"help": {
"text": f"Vulnerability {finding['name']}\nSeverity: {finding['severity']}\nPackage: {finding['attributes'][1]['value']}\nFixed Version: \nLink: [{finding['name']}]({finding['uri']})",
"markdown": f"**Vulnerability {finding['name']}**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|{finding['severity']}|{finding['attributes'][1]['value']}||[{finding['name']}]({finding['uri']})\n\n{finding['description']}",
"text": f"Vulnerability {finding['name']}\nSeverity: {severity}\nPackage: {finding['attributes'][1]['value']}\nFixed Version: \nLink: [{finding['name']}]({finding['uri']})",
"markdown": f"**Vulnerability {finding['name']}**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|{severity}|{finding['attributes'][1]['value']}||[{finding['name']}]({finding['uri']})\n\n{finding['description']}",
},
"properties": {
"precision": "very-high",
"security-severity": finding["attributes"][3]["value"],
"tags": ["vulnerability", "security", finding["severity"]],
"tags": ["vulnerability", "security", severity],
},
}
result = {
"ruleId": finding["name"],
"ruleIndex": len(
sarif_report["runs"][0]["tool"]["driver"]["rules"]
),
"level": finding["severity"].lower(),
"level": severity.lower(),
"message": {
"text": f"Package: {finding['attributes'][1]['value']}\nInstalled Version: {finding['attributes'][0]['value']}\nVulnerability {finding['name']}\nSeverity: {finding['severity']}\nFixed Version: \nLink: [{finding['name']}]({finding['uri']})"
"text": f"Package: {finding['attributes'][1]['value']}\nInstalled Version: {finding['attributes'][0]['value']}\nVulnerability {finding['name']}\nSeverity: {severity}\nFixed Version: \nLink: [{finding['name']}]({finding['uri']})"
},
"locations": [
{
Expand Down Expand Up @@ -153,12 +161,10 @@ def process_findings(findings, is_enhanced=False):


def main():

def load_sarif_schema(schema_path):
with open(schema_path, "r") as f:
return json.load(f)


def validate_sarif(sarif_report, schema):
try:
jsonschema.validate(instance=sarif_report, schema=schema)
Expand Down
8 changes: 4 additions & 4 deletions wait-for-ecr-scan-and-get-sarif/tests/expected_ubuntu_unit_test_output.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -107,7 +107,7 @@
{
"ruleId": "CVE-2024-4603",
"ruleIndex": 0,
"level": "none",
"level": "untriaged",
"message": {
"text": "Package: libssl3t64\nInstalled Version: 3.0.13\nVulnerability CVE-2024-4603\nSeverity: UNTRIAGED\nFixed Version: \nLink: [CVE-2024-4603](https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-4603.html)"
},
Expand All @@ -134,7 +134,7 @@
{
"ruleId": "CVE-2024-5535",
"ruleIndex": 1,
"level": "none",
"level": "untriaged",
"message": {
"text": "Package: libssl3t64\nInstalled Version: 3.0.13\nVulnerability CVE-2024-5535\nSeverity: UNTRIAGED\nFixed Version: \nLink: [CVE-2024-5535](https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-5535.html)"
},
Expand All @@ -161,7 +161,7 @@
{
"ruleId": "CVE-2024-2511",
"ruleIndex": 2,
"level": "none",
"level": "untriaged",
"message": {
"text": "Package: libssl3t64\nInstalled Version: 3.0.13\nVulnerability CVE-2024-2511\nSeverity: UNTRIAGED\nFixed Version: \nLink: [CVE-2024-2511](https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-2511.html)"
},
Expand All @@ -188,7 +188,7 @@
{
"ruleId": "CVE-2024-4741",
"ruleIndex": 3,
"level": "none",
"level": "untriaged",
"message": {
"text": "Package: libssl3t64\nInstalled Version: 3.0.13\nVulnerability CVE-2024-4741\nSeverity: UNTRIAGED\nFixed Version: \nLink: [CVE-2024-4741](https://people.canonical.com/~ubuntu-security/cve/2024/CVE-2024-4741.html)"
},
Expand Down

0 comments on commit d3a21d9

Please sign in to comment.