Skip to content

Commit cdde93c

Browse files
afdeskafdesk
authored
test(go): add integration tests for gomod (#1989)
1 parent c44aa53 commit cdde93c

File tree

11 files changed

+1612
-1
lines changed

11 files changed

+1612
-1
lines changed

‎integration/fs_test.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,14 @@ func TestFilesystem(t *testing.T) {
3030
args args
3131
golden string
3232
}{
33+
{
34+
name: "gomod",
35+
args: args{
36+
securityChecks: "vuln",
37+
input: "testdata/fixtures/fs/gomod",
38+
},
39+
golden: "testdata/gomod.json.golden",
40+
},
3341
{
3442
name: "nodejs",
3543
args: args{

‎integration/testdata/alpine-distroless.json.golden

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,31 @@
7979
{
8080
"Target": "usr/bin/git-lfs",
8181
"Class": "lang-pkgs",
82-
"Type": "gobinary"
82+
"Type": "gobinary",
83+
"Vulnerabilities": [
84+
{
85+
"VulnerabilityID": "CVE-2021-38561",
86+
"PkgName": "golang.org/x/text",
87+
"InstalledVersion": "v0.3.5",
88+
"FixedVersion": "0.3.7",
89+
"Layer": {
90+
"DiffID": "sha256:89da7cc836da4b53ab1ceb572576458c005e7e444b8bb79abda196668a2f0c92"
91+
},
92+
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-38561",
93+
"DataSource": {
94+
"ID": "go-vulndb",
95+
"Name": "The Go Vulnerability Database",
96+
"URL": "https://github.com/golang/vulndb"
97+
},
98+
"Description": "Due to improper index calculation, an incorrectly formatted language tag can cause Parse\nto panic via an out of bounds read. If Parse is used to process untrusted user inputs,\nthis may be used as a vector for a denial of service attack.\n",
99+
"Severity": "UNKNOWN",
100+
"References": [
101+
"https://go-review.googlesource.com/c/text/+/340830",
102+
"https://go.googlesource.com/text/+/383b2e75a7a4198c42f8f87833eefb772868a56f",
103+
"https://pkg.go.dev/vuln/GO-2021-0113"
104+
]
105+
}
106+
]
83107
}
84108
]
85109
}

‎integration/testdata/fixtures/db/go-vulndb.yaml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
- bucket: go::The Go Vulnerability Database
2+
pairs:
3+
- bucket: golang.org/x/text
4+
pairs:
5+
- key: CVE-2021-38561
6+
value:
7+
PatchedVersions:
8+
- "0.3.7"
9+
VulnerableVersions:
10+
- ">= 0, < 0.3.7"
11+
- bucket: go::GitLab Advisory Database Community
12+
pairs:
13+
- bucket: github.com/docker/distribution
14+
pairs:
15+
- key: GMS-2022-20
16+
value:
17+
PatchedVersions:
18+
- "v2.8.0"
19+
VulnerableVersions:
20+
- "< v2.8.0"
21+
- bucket: github.com/open-policy-agent/opa
22+
pairs:
23+
- key: CVE-2022-23628
24+
value:
25+
PatchedVersions:
26+
- "0.37.0"
27+
VulnerableVersions:
28+
- ">= 0.33.1, < 0.37.0"

‎integration/testdata/fixtures/db/vulnerability.yaml

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1137,3 +1137,45 @@
11371137
ubuntu: 2
11381138
LastModifiedDate: 2022-04-12T21:15:00Z
11391139
PublishedDate: 2022-04-12T18:15:00Z
1140+
- key: GMS-2022-20
1141+
value:
1142+
Title: OCI Manifest Type Confusion Issue
1143+
Description: "### Impact\n\nSystems that rely on digest equivalence for image attestations may be vulnerable to type confusion."
1144+
Severity: UNKNOWN
1145+
References:
1146+
- https://github.com/advisories/GHSA-qq97-vm5h-rrhg
1147+
- https://github.com/distribution/distribution/commit/b59a6f827947f9e0e67df0cfb571046de4733586
1148+
- https://github.com/distribution/distribution/security/advisories/GHSA-qq97-vm5h-rrhg
1149+
- https://github.com/opencontainers/image-spec/pull/411
1150+
- key: CVE-2022-23628
1151+
value:
1152+
Title: Incorrect Calculation
1153+
Description: "OPA is an open source, general-purpose policy engine. Under certain conditions, pretty-printing an abstract syntax tree (AST) that contains synthetic nodes could change the logic of some statements by reordering array literals. Example of policies impacted are those that parse and compare web paths. **All of these** three conditions have to be met to create an adverse effect: 1. An AST of Rego had to be **created programmatically** such that it ends up containing terms without a location (such as wildcard variables). 2. The AST had to be **pretty-printed** using the `github.com/open-policy-agent/opa/format` package. 3. The result of the pretty-printing had to be **parsed and evaluated again** via an OPA instance using the bundles, or the Golang packages. If any of these three conditions are not met, you are not affected. Notably, all three would be true if using **optimized bundles**, i.e. bundles created with `opa build -O=1` or higher. In that case, the optimizer would fulfil condition (1.), the result of that would be pretty-printed when writing the bundle to disk, fulfilling (2.). When the bundle was then used, we'd satisfy (3.). As a workaround users may disable optimization when creating bundles."
1154+
Severity: MEDIUM
1155+
CweIDs:
1156+
- CWE-682
1157+
VendorSeverity:
1158+
nvd: 2
1159+
CVSS:
1160+
nvd:
1161+
V2Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
1162+
V3Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1163+
V2Score: 4.3
1164+
V3Score: 5.3
1165+
References:
1166+
- https://github.com/advisories/GHSA-hcw3-j74m-qc58
1167+
- https://github.com/open-policy-agent/opa/commit/932e4ffc37a590ace79e9b75ca4340288c220239
1168+
- https://github.com/open-policy-agent/opa/commit/bfd984ddf93ef2c4963a08d4fdadae0bcf1a3717
1169+
- https://github.com/open-policy-agent/opa/pull/3851
1170+
- https://github.com/open-policy-agent/opa/security/advisories/GHSA-hcw3-j74m-qc58
1171+
- https://nvd.nist.gov/vuln/detail/CVE-2022-23628
1172+
PublishedDate: '2022-02-09T22:15:00Z'
1173+
LastModifiedDate: '2022-02-17T02:37:00Z'
1174+
- key: CVE-2021-38561
1175+
value:
1176+
Description: "Due to improper index calculation, an incorrectly formatted language tag can cause Parse\nto panic via an out of bounds read. If Parse is used to process untrusted user inputs,\nthis may be used as a vector for a denial of service attack.\n"
1177+
Severity: UNKNOWN
1178+
References:
1179+
- https://go-review.googlesource.com/c/text/+/340830
1180+
- https://go.googlesource.com/text/+/383b2e75a7a4198c42f8f87833eefb772868a56f
1181+
- https://pkg.go.dev/vuln/GO-2021-0113

‎integration/testdata/fixtures/fs/gomod/go.mod

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
module github.com/testdata/testdata
2+
3+
go 1.17
4+
5+
require (
6+
github.com/open-policy-agent/opa v0.35.0
7+
golang.org/x/net v0.0.0-20211111083644-e5c967477495
8+
golang.org/x/sys v0.0.0-20211205182925-97ca703d548d
9+
)
10+
11+
require (
12+
github.com/docker/distribution v2.7.1+incompatible // indirect
13+
github.com/docker/docker v20.10.11+incompatible // indirect
14+
github.com/docker/go-connections v0.4.0 // indirect
15+
github.com/docker/go-units v0.4.0 // indirect
16+
go.opencensus.io v0.23.0 // indirect
17+
go4.org/intern v0.0.0-20211027215823-ae77deb06f29 // indirect
18+
go4.org/unsafe/assume-no-moving-gc v0.0.0-20211027215541-db492cf91b37 // indirect
19+
golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0 // indirect
20+
golang.org/x/text v0.3.6 // indirect
21+
golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect
22+
google.golang.org/genproto v0.0.0-20210602131652-f16073e35f0c // indirect
23+
google.golang.org/grpc v1.38.0 // indirect
24+
google.golang.org/protobuf v1.27.1 // indirect
25+
gopkg.in/yaml.v2 v2.4.0 // indirect
26+
gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
27+
)

0 commit comments

Comments
 (0)