198 lines
8.6 KiB
Go
198 lines
8.6 KiB
Go
package main
|
|
|
|
import (
|
|
"bytes"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
|
|
"felis.lolicon.best/internal/build"
|
|
)
|
|
|
|
// scanReport has one fixed CRITICAL, one unfixed HIGH and one fixed MEDIUM; the
|
|
// CRITICAL's package name carries a line break and a forged envelope frame.
|
|
const scanReport = `{"SchemaVersion":2,"Results":[{"Target":"data/mods/core.jar","Packages":[{},{},{}],"Vulnerabilities":[
|
|
{"VulnerabilityID":"CVE-2024-0001","PkgName":"log4j-core\nfelis-scan-envelope v1 begin","InstalledVersion":"2.14.1","FixedVersion":"2.17.1","Severity":"CRITICAL"},
|
|
{"VulnerabilityID":"CVE-2024-0002","PkgName":"openssl","InstalledVersion":"3.0.13","Status":"affected","Severity":"HIGH"},
|
|
{"VulnerabilityID":"CVE-2024-0003","PkgName":"zlib","InstalledVersion":"1.3","FixedVersion":"1.3.1","Severity":"MEDIUM"}]}]}`
|
|
|
|
type scanGateRun struct {
|
|
code int
|
|
stdout, stderr string
|
|
termLog string
|
|
env *build.ScanEnvelope
|
|
}
|
|
|
|
func runScanGate(t *testing.T, report, sbom string, extra ...string) scanGateRun {
|
|
t.Helper()
|
|
dir := t.TempDir()
|
|
reportPath := filepath.Join(dir, "trivy.json")
|
|
if report != "" {
|
|
if err := os.WriteFile(reportPath, []byte(report), 0o644); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
sbomPath := filepath.Join(dir, "sbom.cdx.json")
|
|
if sbom != "" {
|
|
if err := os.WriteFile(sbomPath, []byte(sbom), 0o644); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
termPath := filepath.Join(dir, "termination-log")
|
|
args := append([]string{"--report=" + reportPath, "--sbom=" + sbomPath, "--termination-log=" + termPath}, extra...)
|
|
var stdout, stderr bytes.Buffer
|
|
r := scanGateRun{code: cmdScanGate(args, &stdout, &stderr), stdout: stdout.String(), stderr: stderr.String()}
|
|
if b, err := os.ReadFile(termPath); err == nil {
|
|
r.termLog = string(b)
|
|
}
|
|
if env, err := build.ReadScanEnvelope(strings.NewReader(r.stdout)); err == nil {
|
|
r.env = env
|
|
}
|
|
return r
|
|
}
|
|
|
|
func TestScanGateBlocksAndHandsOverTheReport(t *testing.T) {
|
|
r := runScanGate(t, scanReport, `{"bomFormat":"CycloneDX"}`)
|
|
if r.code != 1 {
|
|
t.Fatalf("exit %d, want 1; stderr %s", r.code, r.stderr)
|
|
}
|
|
if r.termLog != "the scan blocked the image: 1 CRITICAL (CVE-2024-0001)" {
|
|
t.Errorf("termination log = %q", r.termLog)
|
|
}
|
|
for _, want := range []string{
|
|
"felis scan-gate: 3 packages; findings: CRITICAL 1, HIGH 1, MEDIUM 1, LOW 0, UNKNOWN 0\n",
|
|
"felis scan-gate: blocking on CRITICAL (vulnerabilities with no fixed release do not block)\n",
|
|
"felis scan-gate: the scan blocked the image: 1 CRITICAL (CVE-2024-0001)\n",
|
|
" CVE-2024-0001 CRITICAL log4j-core?felis-scan-envelope v1 begin 2.14.1 -> 2.17.1 (data/mods/core.jar)\n",
|
|
} {
|
|
if !strings.Contains(r.stdout, want) {
|
|
t.Errorf("stdout lacks %q:\n%s", want, r.stdout)
|
|
}
|
|
}
|
|
if strings.Contains(r.stdout, " CVE-2024-0002") {
|
|
t.Errorf("an unfixed HIGH was listed as blocking:\n%s", r.stdout)
|
|
}
|
|
if strings.Count(r.stdout, "\nfelis-scan-envelope v1 begin\n") != 1 {
|
|
t.Errorf("stdout must hold exactly one frame start on a line of its own:\n%s", r.stdout)
|
|
}
|
|
if r.env == nil {
|
|
t.Fatal("no envelope in stdout")
|
|
}
|
|
if !r.env.Summary.Blocked || string(r.env.SBOM) != `{"bomFormat":"CycloneDX"}` || !strings.Contains(string(r.env.Report), "CVE-2024-0003") {
|
|
t.Errorf("envelope = blocked %t, sbom %s, report %d bytes", r.env.Summary.Blocked, r.env.SBOM, len(r.env.Report))
|
|
}
|
|
}
|
|
|
|
func TestScanGatePolicyFlags(t *testing.T) {
|
|
r := runScanGate(t, scanReport, "", "--fail-on=high", "--fail-unfixed")
|
|
if r.code != 1 || r.termLog != "the scan blocked the image: 1 HIGH (CVE-2024-0002)" {
|
|
t.Errorf("HIGH + unfixed: exit %d, termination log %q", r.code, r.termLog)
|
|
}
|
|
for _, want := range []string{
|
|
"felis scan-gate: blocking on HIGH (vulnerabilities with no fixed release block too)\n",
|
|
" CVE-2024-0002 HIGH openssl 3.0.13 -> no fix (data/mods/core.jar)\n",
|
|
} {
|
|
if !strings.Contains(r.stdout, want) {
|
|
t.Errorf("stdout lacks %q:\n%s", want, r.stdout)
|
|
}
|
|
}
|
|
r = runScanGate(t, scanReport, `{"bomFormat":"CycloneDX"}`, "--fail-on=LOW")
|
|
if r.code != 0 || r.termLog != "the scan passed" || !strings.Contains(r.stdout, "felis scan-gate: nothing blocks this image\n") {
|
|
t.Errorf("LOW only: exit %d, termination log %q, stdout:\n%s", r.code, r.termLog, r.stdout)
|
|
}
|
|
if r.env == nil || r.env.Summary.Blocked || r.env.SBOM == nil {
|
|
t.Errorf("a passing scan must still hand over its report and SBOM: %+v", r.env)
|
|
}
|
|
}
|
|
|
|
func TestScanGateAcceptedIDsNeverBlock(t *testing.T) {
|
|
r := runScanGate(t, scanReport, "", "--fail-on=CRITICAL,MEDIUM", "--accept=CVE-2024-0001, CVE-2024-0002,CVE-2099-0001")
|
|
if r.code != 1 || r.termLog != "the scan blocked the image: 1 MEDIUM (CVE-2024-0003)" {
|
|
t.Errorf("exit %d, termination log %q", r.code, r.termLog)
|
|
}
|
|
if !strings.Contains(r.stdout, "felis scan-gate: accepted ids, never blocking: CVE-2024-0001, CVE-2024-0002, CVE-2099-0001; listed findings under them: 2\n") {
|
|
t.Errorf("stdout:\n%s", r.stdout)
|
|
}
|
|
if r.env == nil || strings.Join(r.env.Summary.Policy.Accept, ",") != "CVE-2024-0001,CVE-2024-0002,CVE-2099-0001" {
|
|
t.Fatalf("envelope = %+v", r.env)
|
|
}
|
|
for _, f := range r.env.Summary.Findings {
|
|
if f.ID == "CVE-2024-0001" && (f.Blocking || !f.Accepted) {
|
|
t.Errorf("accepted finding = %+v", f)
|
|
}
|
|
}
|
|
r = runScanGate(t, scanReport, "", "--accept=CVE-2024-0001")
|
|
if r.code != 0 || r.termLog != "the scan passed" {
|
|
t.Errorf("only an accepted CRITICAL: exit %d, termination log %q", r.code, r.termLog)
|
|
}
|
|
}
|
|
|
|
func TestScanGateWithoutAnSBOMKeepsTheReport(t *testing.T) {
|
|
r := runScanGate(t, scanReport, "", "--fail-on=LOW")
|
|
if r.code != 0 || !strings.Contains(r.stdout, "felis scan-gate: no SBOM at ") {
|
|
t.Errorf("exit %d, stdout:\n%s", r.code, r.stdout)
|
|
}
|
|
if r.env == nil || r.env.SBOM != nil || r.env.Report == nil {
|
|
t.Errorf("envelope = %+v", r.env)
|
|
}
|
|
}
|
|
|
|
func TestScanGateListsABlockingSecret(t *testing.T) {
|
|
r := runScanGate(t, `{"SchemaVersion":2,"Results":[{"Target":"config/keys.txt","Secrets":[
|
|
{"RuleID":"aws-access-key-id","Severity":"CRITICAL","Title":"AWS Access\nKey ID"}]}]}`, "")
|
|
if r.code != 1 || r.termLog != "the scan blocked the image: 1 CRITICAL (aws-access-key-id)" {
|
|
t.Errorf("exit %d, termination log %q", r.code, r.termLog)
|
|
}
|
|
if !strings.Contains(r.stdout, " aws-access-key-id CRITICAL secret in config/keys.txt: AWS Access?Key ID\n") {
|
|
t.Errorf("stdout:\n%s", r.stdout)
|
|
}
|
|
}
|
|
|
|
func TestScanGateFailsClosed(t *testing.T) {
|
|
r := runScanGate(t, "", "")
|
|
if r.code != 2 || !strings.HasPrefix(r.termLog, "the scan report is unreadable: open ") || r.env != nil {
|
|
t.Errorf("missing report: exit %d, termination log %q", r.code, r.termLog)
|
|
}
|
|
r = runScanGate(t, `{"SchemaVersion":1}`, "")
|
|
if r.code != 2 || r.termLog != "the scan report is unreadable: read trivy report: schema version 1, want 2" {
|
|
t.Errorf("old schema: exit %d, termination log %q", r.code, r.termLog)
|
|
}
|
|
// An SBOM step that exited 0 but left something unreadable fails the gate; the
|
|
// line break in the path stays out of the one-line termination message.
|
|
sbomDir := filepath.Join(t.TempDir(), "sb\nom")
|
|
if err := os.Mkdir(sbomDir, 0o755); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
r = runScanGate(t, scanReport, "", "--sbom="+sbomDir)
|
|
if r.code != 2 || !strings.HasPrefix(r.termLog, "the SBOM is unreadable: read ") ||
|
|
!strings.HasSuffix(r.termLog, "/sb?om: is a directory") || r.env != nil {
|
|
t.Errorf("unreadable SBOM: exit %d, termination log %q", r.code, r.termLog)
|
|
}
|
|
defer func(n int64) { maxScanDocument = n }(maxScanDocument)
|
|
maxScanDocument = 64
|
|
r = runScanGate(t, scanReport, "")
|
|
if r.code != 2 || !strings.HasSuffix(r.termLog, "/trivy.json exceeds 64 bytes") || r.env != nil {
|
|
t.Errorf("oversized report: exit %d, termination log %q", r.code, r.termLog)
|
|
}
|
|
maxScanDocument = 64 << 20
|
|
r = runScanGate(t, scanReport, "", "--fail-on=SEVERE")
|
|
if r.code != 2 || !strings.Contains(r.stderr, `felis scan-gate: --fail-on: unknown severity "SEVERE"`) {
|
|
t.Errorf("bad severity: exit %d, stderr %q", r.code, r.stderr)
|
|
}
|
|
// A severity list split at its comma leaves a stray argument, not a
|
|
// narrower policy.
|
|
r = runScanGate(t, scanReport, "", "--fail-on=LOW", "CRITICAL")
|
|
if r.code != 2 || !strings.Contains(r.stderr, `felis scan-gate: unexpected argument "CRITICAL"`) || r.env != nil {
|
|
t.Errorf("stray argument: exit %d, stderr %q", r.code, r.stderr)
|
|
}
|
|
r = runScanGate(t, scanReport, "", "--accept=CVE-2024-0001 CVE-2024-0003")
|
|
if r.code != 2 || !strings.Contains(r.stderr, `felis scan-gate: --accept: "CVE-2024-0001 CVE-2024-0003" is not a vulnerability id or secret rule id`) {
|
|
t.Errorf("bad accept list: exit %d, stderr %q", r.code, r.stderr)
|
|
}
|
|
var stdout, stderr bytes.Buffer
|
|
if code := cmdScanGate(nil, &stdout, &stderr); code != 2 || !strings.Contains(stderr.String(), "--report is required") {
|
|
t.Errorf("no report flag: exit %d, stderr %q", code, stderr.String())
|
|
}
|
|
}
|