feat: enable os vulns to have version range #317
Conversation
The Mariner distro feed will start including version ranges in the OVAL XML. Update models and grype-db transformer to be able to handle this in version 5. Signed-off-by: Will Murphy <[email protected]>
| constraint = common.CleanConstraint(constraint) | ||
| if len(constraint) == 0 { | ||
| func enforceConstraint(fixedVersion, vulnerableRange, format, vulnerabilityID string) string { | ||
| if len(vulnerableRange) > 0 && !strings.HasSuffix(vulnerabilityID, "ALASKERNEL") { |
There was a problem hiding this comment.
it looks like there is new special casing for ALASKERNEL, but I don't see how that relates to this (maybe I'm missing something)?
There was a problem hiding this comment.
ALASKERNEL generates it's own version range from a hard-coded lower bound for a given kernel:
this special casing is to avoid skipping that if vunnel ends up emitting a version range.
There was a problem hiding this comment.
Is there an existing test that covers this? if not, can you add a new test for this?
There was a problem hiding this comment.
These tests cover the behavior:
grype-db/pkg/process/v5/transformers/os/transform_test.go
Lines 780 to 880 in dcc9d3f
But they pass without the hard-coded prefix check, but that's because there's no vulnerable range on the test fixtures:
I think there's also no vulnerable range on the upstream data; it just felt like counting on a coincidence to leave out the ALASKERNEL- prefix check.
Then again, if upstream vunnel starts shipping version ranges on ALASKERNEL- vulnerabilities, why shouldn't grype-db believe vunnel? I think it might make sense to remove the check here.
If the ALAS provider starts emitting vulnerableRange for ALAS kernel vulnerabilities, there's no reason grype-db shouldn't respect them. Signed-off-by: Will Murphy <[email protected]>
The Mariner distro feed will start including version ranges in the OVAL XML. Update models and grype-db transformer to be able to handle this in version 5.
This is the other half of anchore/vunnel#585