From d20c4dc1b697fea4293090f3e0f0136d589d70c8 Mon Sep 17 00:00:00 2001 From: James Hebden Date: Wed, 11 Oct 2023 16:15:11 +1100 Subject: [PATCH] ignore options checked before scan, fail on invalid ignore states, ignore states comma-separated Signed-off-by: James Hebden --- cmd/grype/cli/commands/root.go | 34 +++++++++++----------- cmd/grype/cli/options/grype.go | 6 ++-- internal/stringutil/string_helpers.go | 11 +++++++ internal/stringutil/string_helpers_test.go | 34 ++++++++++++++++++++++ 4 files changed, 65 insertions(+), 20 deletions(-) diff --git a/cmd/grype/cli/commands/root.go b/cmd/grype/cli/commands/root.go index 1bc440be5d1..edc4fb7a584 100644 --- a/cmd/grype/cli/commands/root.go +++ b/cmd/grype/cli/commands/root.go @@ -115,6 +115,23 @@ func runGrype(app clio.Application, opts *options.Grype, userInput string) (errs var s *sbom.SBOM var pkgContext pkg.Context + if opts.OnlyFixed { + opts.Ignore = append(opts.Ignore, ignoreNonFixedMatches...) + } + + if opts.OnlyNotFixed { + opts.Ignore = append(opts.Ignore, ignoreFixedMatches...) + } + + for _, ignoreState := range stringutil.SplitCommaSeparatedString(opts.IgnoreStates) { + switch grypeDb.FixState(ignoreState) { + case grypeDb.UnknownFixState, grypeDb.FixedState, grypeDb.NotFixedState, grypeDb.WontFixState: + opts.Ignore = append(opts.Ignore, match.IgnoreRule{FixState: ignoreState}) + default: + return fmt.Errorf("unknown fix state %s was supplied for --ignore-states", ignoreState) + } + } + err = parallel( func() error { checkForAppUpdate(app.ID(), opts) @@ -147,23 +164,6 @@ func runGrype(app clio.Application, opts *options.Grype, userInput string) (errs defer dbCloser.Close() } - if opts.OnlyFixed { - opts.Ignore = append(opts.Ignore, ignoreNonFixedMatches...) - } - - if opts.OnlyNotFixed { - opts.Ignore = append(opts.Ignore, ignoreFixedMatches...) - } - - for _, ignoreState := range opts.IgnoreStates { - switch grypeDb.FixState(ignoreState) { - case grypeDb.UnknownFixState, grypeDb.FixedState, grypeDb.NotFixedState, grypeDb.WontFixState: - opts.Ignore = append(opts.Ignore, match.IgnoreRule{FixState: ignoreState}) - default: - log.Warnf("ignoring unknown fix state %s for --ignore-states", ignoreState) - } - } - if err = applyVexRules(opts); err != nil { return fmt.Errorf("applying vex rules: %w", err) } diff --git a/cmd/grype/cli/options/grype.go b/cmd/grype/cli/options/grype.go index d75c0935c79..8219d77c369 100644 --- a/cmd/grype/cli/options/grype.go +++ b/cmd/grype/cli/options/grype.go @@ -19,7 +19,7 @@ type Grype struct { CheckForAppUpdate bool `yaml:"check-for-app-update" json:"check-for-app-update" mapstructure:"check-for-app-update"` // whether to check for an application update on start up or not OnlyFixed bool `yaml:"only-fixed" json:"only-fixed" mapstructure:"only-fixed"` // only fail if detected vulns have a fix OnlyNotFixed bool `yaml:"only-notfixed" json:"only-notfixed" mapstructure:"only-notfixed"` // only fail if detected vulns don't have a fix - IgnoreStates []string `yaml:"ignore-states" json:"ignore-wontfix" mapstructure:"ignore-wontfix"` // ignore detections for vulnerabilities matching these fix states + IgnoreStates string `yaml:"ignore-states" json:"ignore-wontfix" mapstructure:"ignore-wontfix"` // ignore detections for vulnerabilities matching these comma-separated fix states Platform string `yaml:"platform" json:"platform" mapstructure:"platform"` // --platform, override the target platform for a container image Search search `yaml:"search" json:"search" mapstructure:"search"` Ignore []match.IgnoreRule `yaml:"ignore" json:"ignore" mapstructure:"ignore"` @@ -104,9 +104,9 @@ func (o *Grype) AddFlags(flags clio.FlagSet) { "ignore matches for vulnerabilities that are fixed", ) - flags.StringArrayVarP(&o.IgnoreStates, + flags.StringVarP(&o.IgnoreStates, "ignore-states", "", - fmt.Sprintf("ignore matches for vulnerabilities with specified fix states, options=%v", vulnerability.AllFixStates()), + fmt.Sprintf("ignore matches for vulnerabilities with specified comma separated fix states, options=%v", vulnerability.AllFixStates()), ) flags.BoolVarP(&o.ByCVE, diff --git a/internal/stringutil/string_helpers.go b/internal/stringutil/string_helpers.go index 1ff56e35c54..25d21f02c5c 100644 --- a/internal/stringutil/string_helpers.go +++ b/internal/stringutil/string_helpers.go @@ -23,3 +23,14 @@ func HasAnyOfPrefixes(input string, prefixes ...string) bool { return false } + +// SplitCommaSeparatedString returns a slice of strings separated from the input string by commas +func SplitCommaSeparatedString(input string) []string { + output := make([]string, 0) + for _, inputItem := range strings.Split(input, ",") { + if len(inputItem) > 0 { + output = append(output, inputItem) + } + } + return output +} diff --git a/internal/stringutil/string_helpers_test.go b/internal/stringutil/string_helpers_test.go index b5171686801..89baa28f9b1 100644 --- a/internal/stringutil/string_helpers_test.go +++ b/internal/stringutil/string_helpers_test.go @@ -120,3 +120,37 @@ func TestHasAnyOfPrefixes(t *testing.T) { }) } } + +func TestSplitCommaSeparatedString(t *testing.T) { + tests := []struct { + input string + expected []string + }{ + { + input: "testing", + expected: []string{"testing"}, + }, + { + input: "", + expected: []string{}, + }, + { + input: "testing1,testing2", + expected: []string{"testing1", "testing2"}, + }, + { + input: "testing1,,testing2,testing3", + expected: []string{"testing1", "testing2", "testing3"}, + }, + { + input: "testing1,testing2,,", + expected: []string{"testing1", "testing2"}, + }, + } + + for _, test := range tests { + t.Run(test.input, func(t *testing.T) { + assert.Equal(t, test.expected, SplitCommaSeparatedString(test.input)) + }) + } +}