Skip to content

formatters/trivy:fix - find correct line of dependency#882

Merged
matheusalcantarazup merged 3 commits into
ZupIT:mainfrom
ne0z:bugfix/trivy-line-issue
Dec 21, 2021
Merged

formatters/trivy:fix - find correct line of dependency#882
matheusalcantarazup merged 3 commits into
ZupIT:mainfrom
ne0z:bugfix/trivy-line-issue

Conversation

@ne0z

@ne0z ne0z commented Dec 17, 2021

Copy link
Copy Markdown
Contributor

Signed-off-by: Danang Heriyadi [email protected]

- What I did
Tried to solve #881 bug by adding some code to find where the correct line. I am not sure it's effective or not. But it's work. In my code, I define the start line from 0, is that correct?

- How to verify it

$ git clone https://github.com/sqreen/go-dvwa.git
$ cd go-dvwa
$ horusec generate
$ horusec start -p $(pwd)

Check Horusec report on the go.sum file it will show as below:

==================================================================================

Language: Generic
Severity: UNKNOWN
Line: 73
Column: 0
SecurityTool: Trivy
Confidence: MEDIUM
File: /home/danang/Project/Horusec/go-dvwa/go.sum
Code: github.com/gin-gonic/gin
Details: Installed Version: "1.3.0", Update to Version: "v1.6.0" for fix this issue.
Type: Vulnerability
ReferenceHash: 305e9fe32192f87c2ae313293102c8715fbbbf7e65ff76aa428a9f31c9aca02f

==================================================================================

Language: Generic
Severity: UNKNOWN
Line: 223
Column: 0
SecurityTool: Trivy
Confidence: MEDIUM
File: /home/danang/Project/Horusec/go-dvwa/go.sum
Code: github.com/labstack/echo/v4
Details: Installed Version: "4.1.17", Update to Version: "v4.1.18-0.20201215153152-4422e3b66b9f" for fix this issue.
Type: Vulnerability
ReferenceHash: 9638f420ede278f73f221370043c730b64c2c3dd7dae3ac441425aebe83bba63

==================================================================================

Language: Generic
Severity: UNKNOWN
Line: 309
Column: 0
SecurityTool: Trivy
Confidence: MEDIUM
File: /home/danang/Project/Horusec/go-dvwa/go.sum
Code: github.com/satori/go.uuid
Details: Installed Version: "1.2.0", Update to Version: "v1.2.1-0.20181016170032-d91630c85102" for fix this issue.
Type: Vulnerability
ReferenceHash: da0698507f527a58779a52c478955f4defc6c320bf430840d942ea10a6423c7e

==================================================================================

- Description for the changelog

@ne0z ne0z changed the title Add some logic to find where the correct line that should be pinpointed Add some logic on the Trivy Formatter to find where the correct line that should be pinpointed Dec 17, 2021
matheusalcantarazup
matheusalcantarazup suggested changes Dec 17, 2021
View reviewed changes

@matheusalcantarazup matheusalcantarazup left a comment •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank very much for your contribution @ne0z
Can you also please change your PR and commit title to follow our patterns?
formatters/trivy:fix - find correct line of dependency

Comment thread internal/services/formatters/generic/trivy/formatter.go Outdated
@wiliansilvazup wiliansilvazup added the kind/improvement This issue is not a Bug nor a Feature label Dec 17, 2021
@wiliansilvazup wiliansilvazup linked an issue Dec 17, 2021 that may be closed by this pull request
Horusec Trivy Scan results on go.sum always return line 0 #881
Closed
@ne0z ne0z changed the title Add some logic on the Trivy Formatter to find where the correct line that should be pinpointed formatters/trivy:fix - find correct line of dependency Dec 20, 2021
matheusalcantarazup
matheusalcantarazup suggested changes Dec 20, 2021
View reviewed changes
Comment thread internal/utils/file/file.go Outdated
@matheusalcantarazup
matheusalcantarazup merged commit b1a96b2 into ZupIT:main Dec 21, 2021
@matheusalcantarazup

matheusalcantarazup commented Dec 21, 2021

Copy link
Copy Markdown
Contributor

Thanks very much for your contribution @ne0z

nathanmartinszup added a commit that referenced this pull request Jan 18, 2022
@nathanmartinszup
trivy:bugfix - adding func to avoid hash changes in trivy formatter
43a4f0b 
Since the pull request #882 some
changes were made in the line and code of the trivy formatter,
and this data influences directly the hash generation.
This pr will avoid this hash change by using the same data as
before, but for the users the data will be showed with the fixes
made in the pull request 882, leading to no braking changes
and keeping the fixes.

Signed-off-by: Nathan Martins <[email protected]>
@nathanmartinszup nathanmartinszup mentioned this pull request Jan 18, 2022
Merged
nathanmartinszup added a commit that referenced this pull request Jan 18, 2022
@nathanmartinszup
trivy:bugfix - adding func to avoid hash changes in trivy formatter
25d831b 
Since the pull request #882 some
changes were made in the line and code of the trivy formatter,
and this data influences directly the hash generation.
This pr will avoid this hash change by using the same data as
before, but for the users the data will be showed with the fixes
made in the pull request 882, leading to no braking changes
and keeping the fixes.

Signed-off-by: Nathan Martins <[email protected]>
nathanmartinszup added a commit that referenced this pull request Jan 18, 2022
@nathanmartinszup
trivy:bugfix - adding func to avoid hash changes in trivy formatter
0193de4 
Since the pull request #882 some
changes were made in the line and code of the trivy formatter,
and this data influences directly the hash generation.
This pr will avoid this hash change by using the same data as
before, but for the users the data will be showed with the fixes
made in the pull request 882, leading to no braking changes
and keeping the fixes.

Signed-off-by: Nathan Martins <[email protected]>
nathanmartinszup added a commit that referenced this pull request Jan 20, 2022
@nathanmartinszup
trivy:bugfix - adding func to avoid hash changes in trivy formatter (#…
0a2ecee 
…929)

Since the pull request #882 some
changes were made in the line and code of the trivy formatter,
and this data influences directly the hash generation.
This pr will avoid this hash change by using the same data as
before, but for the users the data will be showed with the fixes
made in the pull request 882, leading to no braking changes
and keeping the fixes.

Signed-off-by: Nathan Martins <[email protected]>
matheusalcantarazup pushed a commit that referenced this pull request Jan 21, 2022
@nathanmartinszup @matheusalcantarazup
trivy:bugfix - adding func to avoid hash changes in trivy formatter (#…
d39db25 
…929)

Since the pull request #882 some
changes were made in the line and code of the trivy formatter,
and this data influences directly the hash generation.
This pr will avoid this hash change by using the same data as
before, but for the users the data will be showed with the fixes
made in the pull request 882, leading to no braking changes
and keeping the fixes.

Signed-off-by: Nathan Martins <[email protected]>
(cherry picked from commit 0a2ecee)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@iancardosozup iancardosozup Awaiting requested review from iancardosozup
@lucasbrunozup lucasbrunozup Awaiting requested review from lucasbrunozup
@wiliansilvazup wiliansilvazup Awaiting requested review from wiliansilvazup
2 more reviewers
@nathanmartinszup nathanmartinszup nathanmartinszup approved these changes
@matheusalcantarazup matheusalcantarazup matheusalcantarazup approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

kind/improvement This issue is not a Bug nor a Feature

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Horusec Trivy Scan results on go.sum always return line 0

4 participants

@ne0z @matheusalcantarazup @nathanmartinszup @wiliansilvazup