diff --git a/api/proto/v1/issue.pb.go b/api/proto/v1/issue.pb.go index 02309adb4..35000726a 100644 --- a/api/proto/v1/issue.pb.go +++ b/api/proto/v1/issue.pb.go @@ -181,8 +181,8 @@ type Issue struct { CycloneDXSBOM *string `protobuf:"bytes,11,opt,name=cyclone_d_x_s_b_o_m,json=cycloneDXSBOM,proto3,oneof" json:"cyclone_d_x_s_b_o_m,omitempty"` // optional string that allows producers to communicate relevant code/request segments ContextSegment *string `protobuf:"bytes,12,opt,name=context_segment,json=contextSegment,proto3,oneof" json:"context_segment,omitempty"` - // optionally the related CWE - Cwe *string `protobuf:"bytes,13,opt,name=cwe,proto3,oneof" json:"cwe,omitempty"` + // optionally the related CWEs + Cwe []int32 `protobuf:"varint,13,rep,packed,name=cwe,proto3" json:"cwe,omitempty"` } func (x *Issue) Reset() { @@ -301,11 +301,11 @@ func (x *Issue) GetContextSegment() string { return "" } -func (x *Issue) GetCwe() string { - if x != nil && x.Cwe != nil { - return *x.Cwe +func (x *Issue) GetCwe() []int32 { + if x != nil { + return x.Cwe } - return "" + return nil } // Represents an issue that has been enriched with metadata from the enrichment service @@ -418,7 +418,7 @@ var file_api_proto_v1_issue_proto_rawDesc = []byte{ 0x73, 0x73, 0x75, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x11, 0x6f, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x2e, 0x64, 0x72, 0x61, 0x63, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, - 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xdf, + 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xd2, 0x03, 0x0a, 0x05, 0x49, 0x73, 0x73, 0x75, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, @@ -444,59 +444,58 @@ var file_api_proto_v1_issue_proto_rawDesc = []byte{ 0x53, 0x42, 0x4f, 0x4d, 0x88, 0x01, 0x01, 0x12, 0x2c, 0x0a, 0x0f, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x5f, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x09, 0x48, 0x01, 0x52, 0x0e, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x53, 0x65, 0x67, 0x6d, 0x65, - 0x6e, 0x74, 0x88, 0x01, 0x01, 0x12, 0x15, 0x0a, 0x03, 0x63, 0x77, 0x65, 0x18, 0x0d, 0x20, 0x01, - 0x28, 0x09, 0x48, 0x02, 0x52, 0x03, 0x63, 0x77, 0x65, 0x88, 0x01, 0x01, 0x42, 0x16, 0x0a, 0x14, - 0x5f, 0x63, 0x79, 0x63, 0x6c, 0x6f, 0x6e, 0x65, 0x5f, 0x64, 0x5f, 0x78, 0x5f, 0x73, 0x5f, 0x62, - 0x5f, 0x6f, 0x5f, 0x6d, 0x42, 0x12, 0x0a, 0x10, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, - 0x5f, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x42, 0x06, 0x0a, 0x04, 0x5f, 0x63, 0x77, 0x65, - 0x22, 0xa2, 0x03, 0x0a, 0x0d, 0x45, 0x6e, 0x72, 0x69, 0x63, 0x68, 0x65, 0x64, 0x49, 0x73, 0x73, - 0x75, 0x65, 0x12, 0x35, 0x0a, 0x09, 0x72, 0x61, 0x77, 0x5f, 0x69, 0x73, 0x73, 0x75, 0x65, 0x18, - 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6f, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x2e, - 0x64, 0x72, 0x61, 0x63, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x49, 0x73, 0x73, 0x75, 0x65, 0x52, - 0x08, 0x72, 0x61, 0x77, 0x49, 0x73, 0x73, 0x75, 0x65, 0x12, 0x39, 0x0a, 0x0a, 0x66, 0x69, 0x72, - 0x73, 0x74, 0x5f, 0x73, 0x65, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, - 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, - 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x66, 0x69, 0x72, 0x73, 0x74, - 0x53, 0x65, 0x65, 0x6e, 0x12, 0x14, 0x0a, 0x05, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x18, 0x03, 0x20, - 0x01, 0x28, 0x04, 0x52, 0x05, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x25, 0x0a, 0x0e, 0x66, 0x61, - 0x6c, 0x73, 0x65, 0x5f, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x69, 0x76, 0x65, 0x18, 0x04, 0x20, 0x01, - 0x28, 0x08, 0x52, 0x0d, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x50, 0x6f, 0x73, 0x69, 0x74, 0x69, 0x76, - 0x65, 0x12, 0x39, 0x0a, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, - 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, - 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, - 0x70, 0x52, 0x09, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x12, 0x0a, 0x04, - 0x68, 0x61, 0x73, 0x68, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x61, 0x73, 0x68, - 0x12, 0x53, 0x0a, 0x0b, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, - 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x31, 0x2e, 0x6f, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x2e, - 0x64, 0x72, 0x61, 0x63, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x72, 0x69, 0x63, 0x68, - 0x65, 0x64, 0x49, 0x73, 0x73, 0x75, 0x65, 0x2e, 0x41, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, - 0x6f, 0x6e, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0b, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, - 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x1a, 0x3e, 0x0a, 0x10, 0x41, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, - 0x69, 0x6f, 0x6e, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, - 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, - 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, - 0x65, 0x3a, 0x02, 0x38, 0x01, 0x2a, 0x96, 0x01, 0x0a, 0x0a, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x64, - 0x65, 0x6e, 0x63, 0x65, 0x12, 0x1a, 0x0a, 0x16, 0x43, 0x4f, 0x4e, 0x46, 0x49, 0x44, 0x45, 0x4e, - 0x43, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, - 0x12, 0x13, 0x0a, 0x0f, 0x43, 0x4f, 0x4e, 0x46, 0x49, 0x44, 0x45, 0x4e, 0x43, 0x45, 0x5f, 0x49, - 0x4e, 0x46, 0x4f, 0x10, 0x01, 0x12, 0x12, 0x0a, 0x0e, 0x43, 0x4f, 0x4e, 0x46, 0x49, 0x44, 0x45, - 0x4e, 0x43, 0x45, 0x5f, 0x4c, 0x4f, 0x57, 0x10, 0x02, 0x12, 0x15, 0x0a, 0x11, 0x43, 0x4f, 0x4e, - 0x46, 0x49, 0x44, 0x45, 0x4e, 0x43, 0x45, 0x5f, 0x4d, 0x45, 0x44, 0x49, 0x55, 0x4d, 0x10, 0x03, - 0x12, 0x13, 0x0a, 0x0f, 0x43, 0x4f, 0x4e, 0x46, 0x49, 0x44, 0x45, 0x4e, 0x43, 0x45, 0x5f, 0x48, - 0x49, 0x47, 0x48, 0x10, 0x04, 0x12, 0x17, 0x0a, 0x13, 0x43, 0x4f, 0x4e, 0x46, 0x49, 0x44, 0x45, - 0x4e, 0x43, 0x45, 0x5f, 0x43, 0x52, 0x49, 0x54, 0x49, 0x43, 0x41, 0x4c, 0x10, 0x05, 0x2a, 0x88, - 0x01, 0x0a, 0x08, 0x53, 0x65, 0x76, 0x65, 0x72, 0x69, 0x74, 0x79, 0x12, 0x18, 0x0a, 0x14, 0x53, - 0x45, 0x56, 0x45, 0x52, 0x49, 0x54, 0x59, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, - 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x11, 0x0a, 0x0d, 0x53, 0x45, 0x56, 0x45, 0x52, 0x49, 0x54, - 0x59, 0x5f, 0x49, 0x4e, 0x46, 0x4f, 0x10, 0x01, 0x12, 0x10, 0x0a, 0x0c, 0x53, 0x45, 0x56, 0x45, - 0x52, 0x49, 0x54, 0x59, 0x5f, 0x4c, 0x4f, 0x57, 0x10, 0x02, 0x12, 0x13, 0x0a, 0x0f, 0x53, 0x45, - 0x56, 0x45, 0x52, 0x49, 0x54, 0x59, 0x5f, 0x4d, 0x45, 0x44, 0x49, 0x55, 0x4d, 0x10, 0x03, 0x12, - 0x11, 0x0a, 0x0d, 0x53, 0x45, 0x56, 0x45, 0x52, 0x49, 0x54, 0x59, 0x5f, 0x48, 0x49, 0x47, 0x48, - 0x10, 0x04, 0x12, 0x15, 0x0a, 0x11, 0x53, 0x45, 0x56, 0x45, 0x52, 0x49, 0x54, 0x59, 0x5f, 0x43, - 0x52, 0x49, 0x54, 0x49, 0x43, 0x41, 0x4c, 0x10, 0x05, 0x42, 0x28, 0x5a, 0x26, 0x67, 0x69, 0x74, - 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x2f, - 0x64, 0x72, 0x61, 0x63, 0x6f, 0x6e, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, - 0x2f, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, + 0x6e, 0x74, 0x88, 0x01, 0x01, 0x12, 0x10, 0x0a, 0x03, 0x63, 0x77, 0x65, 0x18, 0x0d, 0x20, 0x03, + 0x28, 0x05, 0x52, 0x03, 0x63, 0x77, 0x65, 0x42, 0x16, 0x0a, 0x14, 0x5f, 0x63, 0x79, 0x63, 0x6c, + 0x6f, 0x6e, 0x65, 0x5f, 0x64, 0x5f, 0x78, 0x5f, 0x73, 0x5f, 0x62, 0x5f, 0x6f, 0x5f, 0x6d, 0x42, + 0x12, 0x0a, 0x10, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x5f, 0x73, 0x65, 0x67, 0x6d, + 0x65, 0x6e, 0x74, 0x22, 0xa2, 0x03, 0x0a, 0x0d, 0x45, 0x6e, 0x72, 0x69, 0x63, 0x68, 0x65, 0x64, + 0x49, 0x73, 0x73, 0x75, 0x65, 0x12, 0x35, 0x0a, 0x09, 0x72, 0x61, 0x77, 0x5f, 0x69, 0x73, 0x73, + 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6f, 0x63, 0x75, 0x72, 0x69, + 0x74, 0x79, 0x2e, 0x64, 0x72, 0x61, 0x63, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x49, 0x73, 0x73, + 0x75, 0x65, 0x52, 0x08, 0x72, 0x61, 0x77, 0x49, 0x73, 0x73, 0x75, 0x65, 0x12, 0x39, 0x0a, 0x0a, + 0x66, 0x69, 0x72, 0x73, 0x74, 0x5f, 0x73, 0x65, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, + 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, + 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x66, 0x69, + 0x72, 0x73, 0x74, 0x53, 0x65, 0x65, 0x6e, 0x12, 0x14, 0x0a, 0x05, 0x63, 0x6f, 0x75, 0x6e, 0x74, + 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x52, 0x05, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x25, 0x0a, + 0x0e, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x5f, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x69, 0x76, 0x65, 0x18, + 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x66, 0x61, 0x6c, 0x73, 0x65, 0x50, 0x6f, 0x73, 0x69, + 0x74, 0x69, 0x76, 0x65, 0x12, 0x39, 0x0a, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x5f, + 0x61, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, + 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, + 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, + 0x12, 0x0a, 0x04, 0x68, 0x61, 0x73, 0x68, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x68, + 0x61, 0x73, 0x68, 0x12, 0x53, 0x0a, 0x0b, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, + 0x6e, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x31, 0x2e, 0x6f, 0x63, 0x75, 0x72, 0x69, + 0x74, 0x79, 0x2e, 0x64, 0x72, 0x61, 0x63, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x72, + 0x69, 0x63, 0x68, 0x65, 0x64, 0x49, 0x73, 0x73, 0x75, 0x65, 0x2e, 0x41, 0x6e, 0x6e, 0x6f, 0x74, + 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0b, 0x61, 0x6e, 0x6e, + 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x1a, 0x3e, 0x0a, 0x10, 0x41, 0x6e, 0x6e, 0x6f, + 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, + 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, + 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, + 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x2a, 0x96, 0x01, 0x0a, 0x0a, 0x43, 0x6f, 0x6e, + 0x66, 0x69, 0x64, 0x65, 0x6e, 0x63, 0x65, 0x12, 0x1a, 0x0a, 0x16, 0x43, 0x4f, 0x4e, 0x46, 0x49, + 0x44, 0x45, 0x4e, 0x43, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, + 0x44, 0x10, 0x00, 0x12, 0x13, 0x0a, 0x0f, 0x43, 0x4f, 0x4e, 0x46, 0x49, 0x44, 0x45, 0x4e, 0x43, + 0x45, 0x5f, 0x49, 0x4e, 0x46, 0x4f, 0x10, 0x01, 0x12, 0x12, 0x0a, 0x0e, 0x43, 0x4f, 0x4e, 0x46, + 0x49, 0x44, 0x45, 0x4e, 0x43, 0x45, 0x5f, 0x4c, 0x4f, 0x57, 0x10, 0x02, 0x12, 0x15, 0x0a, 0x11, + 0x43, 0x4f, 0x4e, 0x46, 0x49, 0x44, 0x45, 0x4e, 0x43, 0x45, 0x5f, 0x4d, 0x45, 0x44, 0x49, 0x55, + 0x4d, 0x10, 0x03, 0x12, 0x13, 0x0a, 0x0f, 0x43, 0x4f, 0x4e, 0x46, 0x49, 0x44, 0x45, 0x4e, 0x43, + 0x45, 0x5f, 0x48, 0x49, 0x47, 0x48, 0x10, 0x04, 0x12, 0x17, 0x0a, 0x13, 0x43, 0x4f, 0x4e, 0x46, + 0x49, 0x44, 0x45, 0x4e, 0x43, 0x45, 0x5f, 0x43, 0x52, 0x49, 0x54, 0x49, 0x43, 0x41, 0x4c, 0x10, + 0x05, 0x2a, 0x88, 0x01, 0x0a, 0x08, 0x53, 0x65, 0x76, 0x65, 0x72, 0x69, 0x74, 0x79, 0x12, 0x18, + 0x0a, 0x14, 0x53, 0x45, 0x56, 0x45, 0x52, 0x49, 0x54, 0x59, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, + 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x11, 0x0a, 0x0d, 0x53, 0x45, 0x56, 0x45, + 0x52, 0x49, 0x54, 0x59, 0x5f, 0x49, 0x4e, 0x46, 0x4f, 0x10, 0x01, 0x12, 0x10, 0x0a, 0x0c, 0x53, + 0x45, 0x56, 0x45, 0x52, 0x49, 0x54, 0x59, 0x5f, 0x4c, 0x4f, 0x57, 0x10, 0x02, 0x12, 0x13, 0x0a, + 0x0f, 0x53, 0x45, 0x56, 0x45, 0x52, 0x49, 0x54, 0x59, 0x5f, 0x4d, 0x45, 0x44, 0x49, 0x55, 0x4d, + 0x10, 0x03, 0x12, 0x11, 0x0a, 0x0d, 0x53, 0x45, 0x56, 0x45, 0x52, 0x49, 0x54, 0x59, 0x5f, 0x48, + 0x49, 0x47, 0x48, 0x10, 0x04, 0x12, 0x15, 0x0a, 0x11, 0x53, 0x45, 0x56, 0x45, 0x52, 0x49, 0x54, + 0x59, 0x5f, 0x43, 0x52, 0x49, 0x54, 0x49, 0x43, 0x41, 0x4c, 0x10, 0x05, 0x42, 0x28, 0x5a, 0x26, + 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x63, 0x75, 0x72, 0x69, + 0x74, 0x79, 0x2f, 0x64, 0x72, 0x61, 0x63, 0x6f, 0x6e, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x70, 0x72, + 0x6f, 0x74, 0x6f, 0x2f, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, } var ( diff --git a/api/proto/v1/issue.proto b/api/proto/v1/issue.proto index 5bf12101c..29a0694cd 100644 --- a/api/proto/v1/issue.proto +++ b/api/proto/v1/issue.proto @@ -66,8 +66,8 @@ message Issue { // optional string that allows producers to communicate relevant code/request segments optional string context_segment = 12; - // optionally the related CWE - optional string cwe = 13; + // optionally the related CWEs + repeated int32 cwe = 13; } /* Represents an issue that has been enriched with metadata from the enrichment service */ diff --git a/components/producers/dependency-track/main.go b/components/producers/dependency-track/main.go index d460a28da..0427094e7 100644 --- a/components/producers/dependency-track/main.go +++ b/components/producers/dependency-track/main.go @@ -2,6 +2,7 @@ package main import ( + "encoding/json" "fmt" "log" @@ -43,16 +44,47 @@ func parseIssues(out *DependencyTrackOut) ([]*v1.Issue, error) { iss := v1.Issue{} target := element.Component.Purl iss.Target = target - cwe := fmt.Sprintf("%d", element.Vulnerability.CweID) + cwe := []int32{} + for _, c := range element.Vulnerability.Cwes { + cwe = append(cwe, int32(c.CweID)) + } iss.Type = element.Vulnerability.VulnID iss.Title = element.Vulnerability.Title - iss.Cvss = element.Vulnerability.CvssV3BaseScore - iss.Severity = v1.Severity(v1.Severity_value[fmt.Sprintf("SEVERITY_%s", element.Vulnerability.Severity)]) - iss.Cwe = &cwe + if element.Vulnerability.CvssV3BaseScore != 0 { + iss.Cvss = element.Vulnerability.CvssV3BaseScore + } + switch element.Vulnerability.Severity { + case "CRITICAL": + iss.Severity = v1.Severity_SEVERITY_CRITICAL + case "HIGH": + iss.Severity = v1.Severity_SEVERITY_HIGH + + case "MEDIUM": + iss.Severity = v1.Severity_SEVERITY_MEDIUM + case "LOW": + iss.Severity = v1.Severity_SEVERITY_LOW + case "INFO": + iss.Severity = v1.Severity_SEVERITY_INFO + case "UNASSIGNED": + iss.Severity = v1.Severity_SEVERITY_UNSPECIFIED + + } + iss.Cwe = cwe if len(element.Vulnerability.Aliases) > 0 { iss.Cve = element.Vulnerability.Aliases[0].CveID } iss.Description = fmt.Sprintf("%s\n%s", element.Vulnerability.Description, element.Vulnerability.Recommendation) + if len(element.Vulnerability.Aliases) > 0 { + iss.Description = fmt.Sprintf("%s\nVulnerability Aliases:", iss.Description) + for _, alias := range element.Vulnerability.Aliases { + serialised, err := json.Marshal(alias) + if err != nil { + log.Println("Error serialising vulnerability alias", alias, "skipping") + continue + } + iss.Description = fmt.Sprintf("%s\n%s", iss.Description, string(serialised)) + } + } issues = append(issues, &iss) } diff --git a/components/producers/dependency-track/main_test.go b/components/producers/dependency-track/main_test.go index 3f4888bc7..9a90ac48c 100644 --- a/components/producers/dependency-track/main_test.go +++ b/components/producers/dependency-track/main_test.go @@ -16,28 +16,28 @@ func TestParseIssues(t *testing.T) { issues, err := parseIssues(&results) assert.Nil(t, err) - cwe0 := "400" - cwe1 := "601" + cwe0 := []int32{400} + cwe1 := []int32{601, 918} expectedIssue := []*v1.Issue{ { Target: "pkg:maven/org.springframework/spring-core@6.1.2", Type: "SNYK-JAVA-ORGSPRINGFRAMEWORK-6183818", Title: "Uncontrolled Resource Consumption ('Resource Exhaustion')", Severity: 4, Cvss: 7.5, Confidence: 0, - Description: "## Overview\n[org.springframework:spring-core](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22spring-core%22) is a core package within the spring-framework that contains multiple classes and utilities.\n\nAffected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') via specially crafted HTTP requests. An attacker can cause a denial-of-service condition by sending malicious requests that exploit this issue. \r\n\r\n**Notes:**\r\n\r\nThis is only exploitable if the application uses Spring MVC and Spring Security 6.1.6+ or 6.2.1+ is on the classpath.\r\n\r\nTypically, Spring Boot applications need the 'org.springframework.boot:spring-boot-starter-web' and 'org.springframework.boot:spring-boot-starter-security' dependencies to meet all conditions.\n## Remediation\nUpgrade 'org.springframework:spring-core' to version 6.0.16, 6.1.3 or higher.\n## References\n- [Vulnerability Advisory](https://spring.io/security/cve-2024-22233/)\n\nUpgrade the package version to 6.0.16,6.1.3 to fix this vulnerability", + Description: "## Overview\n[org.springframework:spring-core](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22spring-core%22) is a core package within the spring-framework that contains multiple classes and utilities.\n\nAffected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') via specially crafted HTTP requests. An attacker can cause a denial-of-service condition by sending malicious requests that exploit this issue. \r\n\r\n**Notes:**\r\n\r\nThis is only exploitable if the application uses Spring MVC and Spring Security 6.1.6+ or 6.2.1+ is on the classpath.\r\n\r\nTypically, Spring Boot applications need the 'org.springframework.boot:spring-boot-starter-web' and 'org.springframework.boot:spring-boot-starter-security' dependencies to meet all conditions.\n## Remediation\nUpgrade 'org.springframework:spring-core' to version 6.0.16, 6.1.3 or higher.\n## References\n- [Vulnerability Advisory](https://spring.io/security/cve-2024-22233/)\n\nUpgrade the package version to 6.0.16,6.1.3 to fix this vulnerability\nVulnerability Aliases:\n{\"cveId\":\"CVE-2024-22233\",\"snykId\":\"SNYK-JAVA-ORGSPRINGFRAMEWORK-6183818\"}", Source: "", Cve: "CVE-2024-22233", Uuid: "", - Cwe: &cwe0, + Cwe: cwe0, }, { Target: "pkg:maven/org.springframework/spring-web@6.1.2", Type: "SNYK-JAVA-ORGSPRINGFRAMEWORK-6261586", Title: "Open Redirect", Severity: 4, Cvss: 7.1, Confidence: 0, - Description: "## Overview\n[org.springframework:spring-web](https://github.com/spring-projects/spring-framework) is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.\n\nAffected versions of this package are vulnerable to Open Redirect when 'UriComponentsBuilder' parses an externally provided URL, and the application subsequently uses that URL. If it contains hierarchical components such as path, query, and fragment it may evade validation.\n## Remediation\nUpgrade 'org.springframework:spring-web' to version 5.3.32, 6.0.17, 6.1.4 or higher.\n## References\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/120ea0a51c63171e624ca55dbd7cae627d53a042)\n- [Spring Advisory](https://spring.io/security/cve-2024-22243)\n\nUpgrade the package version to 5.3.32,6.0.17,6.1.4 to fix this vulnerability", + Description: "## Overview\n[org.springframework:spring-web](https://github.com/spring-projects/spring-framework) is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.\n\nAffected versions of this package are vulnerable to Open Redirect when 'UriComponentsBuilder' parses an externally provided URL, and the application subsequently uses that URL. If it contains hierarchical components such as path, query, and fragment it may evade validation.\n## Remediation\nUpgrade 'org.springframework:spring-web' to version 5.3.32, 6.0.17, 6.1.4 or higher.\n## References\n- [GitHub Commit](https://github.com/spring-projects/spring-framework/commit/120ea0a51c63171e624ca55dbd7cae627d53a042)\n- [Spring Advisory](https://spring.io/security/cve-2024-22243)\n\nUpgrade the package version to 5.3.32,6.0.17,6.1.4 to fix this vulnerability\nVulnerability Aliases:\n{\"cveId\":\"CVE-2024-22243\",\"snykId\":\"SNYK-JAVA-ORGSPRINGFRAMEWORK-6261586\"}", Source: "", Cve: "CVE-2024-22243", Uuid: "", - Cwe: &cwe1, + Cwe: cwe1, }, } assert.Equal(t, expectedIssue, issues)