Skip to content

Commit ef70d20

Browse files
DmitriyLewenDmitriyLewen
authored
feat: add Package.resolved swift files support (#4932)
* add Package.resolved files analyzer * add Swift detector and integration test * refactor after go-dep-parser changes * bump go-dep-parser * remove replaces * use filePath for Required func * add ID field
1 parent ec5d8be commit ef70d20

File tree

16 files changed

+330
-6
lines changed

16 files changed

+330
-6
lines changed

‎.github/workflows/semantic-pr.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,7 @@ jobs:
7373
c\+\+
7474
elixir
7575
dart
76+
swift
7677
7778
os
7879
lang

‎go.mod‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ require (
1414
github.com/alicebob/miniredis/v2 v2.30.4
1515
github.com/aquasecurity/bolt-fixtures v0.0.0-20200903104109-d34e7f983986
1616
github.com/aquasecurity/defsec v0.91.1
17-
github.com/aquasecurity/go-dep-parser v0.0.0-20230816082938-c86bfd152132
17+
github.com/aquasecurity/go-dep-parser v0.0.0-20230823094455-40c1f85cc942
1818
github.com/aquasecurity/go-gem-version v0.0.0-20201115065557-8eed6fe000ce
1919
github.com/aquasecurity/go-npm-version v0.0.0-20201110091526-0b796d180798
2020
github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46
@@ -23,7 +23,7 @@ require (
2323
github.com/aquasecurity/table v1.8.0
2424
github.com/aquasecurity/testdocker v0.0.0-20230111101738-e741bda259da
2525
github.com/aquasecurity/tml v0.6.1
26-
github.com/aquasecurity/trivy-db v0.0.0-20230817085355-15ce04b6527c
26+
github.com/aquasecurity/trivy-db v0.0.0-20230823084507-315928e846ff
2727
github.com/aquasecurity/trivy-java-db v0.0.0-20230209231723-7cddb1406728
2828
github.com/aquasecurity/trivy-kubernetes v0.5.7-0.20230814115812-7afa52705226
2929
github.com/aws/aws-sdk-go v1.44.273

‎go.sum‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -325,8 +325,8 @@ github.com/aquasecurity/bolt-fixtures v0.0.0-20200903104109-d34e7f983986 h1:2a30
325325
github.com/aquasecurity/bolt-fixtures v0.0.0-20200903104109-d34e7f983986/go.mod h1:NT+jyeCzXk6vXR5MTkdn4z64TgGfE5HMLC8qfj5unl8=
326326
github.com/aquasecurity/defsec v0.91.1 h1:dBIPm6Tva9I+ZTQv+6t9wob3ZlMSu8NFqMJr4mgJC5A=
327327
github.com/aquasecurity/defsec v0.91.1/go.mod h1:l/srzxtuuyb6c6FlqUvMp3xw2ZbvuZ0l9972MNJM7V8=
328-
github.com/aquasecurity/go-dep-parser v0.0.0-20230816082938-c86bfd152132 h1:SiiJwsijT2zgXJLGAPc5xXYH6QAnZjfsegm6vi2h/qo=
329-
github.com/aquasecurity/go-dep-parser v0.0.0-20230816082938-c86bfd152132/go.mod h1:0+GvQF0gL4YEAAUPpNeLeGpFDxMvvIHLMd7vk9bpwko=
328+
github.com/aquasecurity/go-dep-parser v0.0.0-20230823094455-40c1f85cc942 h1:VGfeUtZyya9Vsl8enDurZ7pb/NDp2aJlL2rx2g4pR6A=
329+
github.com/aquasecurity/go-dep-parser v0.0.0-20230823094455-40c1f85cc942/go.mod h1:0+GvQF0gL4YEAAUPpNeLeGpFDxMvvIHLMd7vk9bpwko=
330330
github.com/aquasecurity/go-gem-version v0.0.0-20201115065557-8eed6fe000ce h1:QgBRgJvtEOBtUXilDb1MLi1p1MWoyFDXAu5DEUl5nwM=
331331
github.com/aquasecurity/go-gem-version v0.0.0-20201115065557-8eed6fe000ce/go.mod h1:HXgVzOPvXhVGLJs4ZKO817idqr/xhwsTcj17CLYY74s=
332332
github.com/aquasecurity/go-mock-aws v0.0.0-20230328195059-5bf52338aec3 h1:Vt9y1gZS5JGY3tsL9zc++Cg4ofX51CG7PaMyC5SXWPg=
@@ -345,8 +345,8 @@ github.com/aquasecurity/testdocker v0.0.0-20230111101738-e741bda259da h1:pj/adfN
345345
github.com/aquasecurity/testdocker v0.0.0-20230111101738-e741bda259da/go.mod h1:852lbQLpK2nCwlR4ZLYIccxYCfoQao6q9Nl6tjz54v8=
346346
github.com/aquasecurity/tml v0.6.1 h1:y2ZlGSfrhnn7t4ZJ/0rotuH+v5Jgv6BDDO5jB6A9gwo=
347347
github.com/aquasecurity/tml v0.6.1/go.mod h1:OnYMWY5lvI9ejU7yH9LCberWaaTBW7hBFsITiIMY2yY=
348-
github.com/aquasecurity/trivy-db v0.0.0-20230817085355-15ce04b6527c h1:vsWd8uL6C1MoeYhEaJFQU+Rcx93Qv1eFe6N1BO2LjUs=
349-
github.com/aquasecurity/trivy-db v0.0.0-20230817085355-15ce04b6527c/go.mod h1:iJSGMMclPEhkYeyiN9i+gzjV9jhEv+XfPzfVgFhfvTE=
348+
github.com/aquasecurity/trivy-db v0.0.0-20230823084507-315928e846ff h1:+MLnPm81Msu921N/lBrKd/NwwBrrzRoTgyMq0pIUhbs=
349+
github.com/aquasecurity/trivy-db v0.0.0-20230823084507-315928e846ff/go.mod h1:iJSGMMclPEhkYeyiN9i+gzjV9jhEv+XfPzfVgFhfvTE=
350350
github.com/aquasecurity/trivy-java-db v0.0.0-20230209231723-7cddb1406728 h1:0eS+V7SXHgqoT99tV1mtMW6HL4HdoB9qGLMCb1fZp8A=
351351
github.com/aquasecurity/trivy-java-db v0.0.0-20230209231723-7cddb1406728/go.mod h1:Ldya37FLi0e/5Cjq2T5Bty7cFkzUDwTcPeQua+2M8i8=
352352
github.com/aquasecurity/trivy-kubernetes v0.5.7-0.20230814115812-7afa52705226 h1:fL4BpAfnLFruHqkomRDAB7Lv8yv3zuKdg71mZk9y61c=

‎integration/repo_test.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -175,6 +175,15 @@ func TestRepository(t *testing.T) {
175175
},
176176
golden: "testdata/dotnet.json.golden",
177177
},
178+
{
179+
name: "swift",
180+
args: args{
181+
scanner: types.VulnerabilityScanner,
182+
listAllPkgs: true,
183+
input: "testdata/fixtures/repo/swift",
184+
},
185+
golden: "testdata/swift.json.golden",
186+
},
178187
{
179188
name: "cocoapods",
180189
args: args{

‎integration/testdata/fixtures/db/swift.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
- bucket: "swift::GitHub Security Advisory Swift"
2+
pairs:
3+
- bucket: github.com/apple/swift-nio
4+
pairs:
5+
- key: CVE-2022-3215
6+
value:
7+
PatchedVersions:
8+
- "2.29.1"
9+
- "2.39.1"
10+
- "2.42.0"
11+
VulnerableVersions:
12+
- "< 2.29.1"
13+
- ">= 2.39.0, < 2.39.1"
14+
- ">= 2.41.0, < 2.42.0"

‎integration/testdata/fixtures/db/vulnerability.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1290,6 +1290,24 @@
12901290
- https://github.com/advisories/GHSA-4rgh-jx4f-qfcq
12911291
PublishedDate: "2022-05-24T17:37:16Z"
12921292
LastModifiedDate: "2022-10-06T20:26:08Z"
1293+
- key: CVE-2022-3215
1294+
value:
1295+
Title: "SwiftNIO vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')"
1296+
Description: "`NIOHTTP1` and projects using it for generating HTTP responses, including SwiftNIO, can be subject to a HTTP Response Injection attack..."
1297+
Severity: MEDIUM
1298+
VendorSeverity:
1299+
ghsa: 2
1300+
CVSS:
1301+
ghsa:
1302+
V3Vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
1303+
V3Score: 5.3
1304+
References:
1305+
- https://github.com/apple/swift-nio/security/advisories/GHSA-7fj7-39wj-c64f
1306+
- https://nvd.nist.gov/vuln/detail/CVE-2022-3215
1307+
- https://github.com/apple/swift-nio/commit/a16e2f54a25b2af217044e5168997009a505930f
1308+
- https://github.com/advisories/GHSA-7fj7-39wj-c64f
1309+
PublishedDate: "2023-06-07T16:01:53Z"
1310+
LastModifiedDate: "2023-06-19T16:45:07Z"
12931311
- key: CVE-2022-24775
12941312
value:
12951313
Title: "Improper Input Validation in guzzlehttp/psr7"

‎integration/testdata/fixtures/repo/swift/Package.resolved‎

Lines changed: 25 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎integration/testdata/swift.json.golden‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
{
2+
"SchemaVersion": 2,
3+
"ArtifactName": "testdata/fixtures/repo/swift",
4+
"ArtifactType": "repository",
5+
"Metadata": {
6+
"ImageConfig": {
7+
"architecture": "",
8+
"created": "0001-01-01T00:00:00Z",
9+
"os": "",
10+
"rootfs": {
11+
"type": "",
12+
"diff_ids": null
13+
},
14+
"config": {}
15+
}
16+
},
17+
"Results": [
18+
{
19+
"Target": "Package.resolved",
20+
"Class": "lang-pkgs",
21+
"Type": "swift",
22+
"Packages": [
23+
{
24+
"ID": "github.com/apple/[email protected]",
25+
"Name": "github.com/apple/swift-atomics",
26+
"Version": "1.1.0",
27+
"Layer": {},
28+
"Locations": [
29+
{
30+
"StartLine": 4,
31+
"EndLine": 12
32+
}
33+
]
34+
},
35+
{
36+
"ID": "github.com/apple/[email protected]",
37+
"Name": "github.com/apple/swift-nio",
38+
"Version": "2.41.0",
39+
"Layer": {},
40+
"Locations": [
41+
{
42+
"StartLine": 13,
43+
"EndLine": 21
44+
}
45+
]
46+
}
47+
],
48+
"Vulnerabilities": [
49+
{
50+
"VulnerabilityID": "CVE-2022-3215",
51+
"PkgID": "github.com/apple/[email protected]",
52+
"PkgName": "github.com/apple/swift-nio",
53+
"InstalledVersion": "2.41.0",
54+
"FixedVersion": "2.29.1, 2.39.1, 2.42.0",
55+
"Status": "fixed",
56+
"Layer": {},
57+
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-3215",
58+
"Title": "SwiftNIO vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')",
59+
"Description": "`NIOHTTP1` and projects using it for generating HTTP responses, including SwiftNIO, can be subject to a HTTP Response Injection attack...",
60+
"Severity": "MEDIUM",
61+
"CVSS": {
62+
"ghsa": {
63+
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
64+
"V3Score": 5.3
65+
}
66+
},
67+
"References": [
68+
"https://github.com/apple/swift-nio/security/advisories/GHSA-7fj7-39wj-c64f",
69+
"https://nvd.nist.gov/vuln/detail/CVE-2022-3215",
70+
"https://github.com/apple/swift-nio/commit/a16e2f54a25b2af217044e5168997009a505930f",
71+
"https://github.com/advisories/GHSA-7fj7-39wj-c64f"
72+
],
73+
"PublishedDate": "2023-06-07T16:01:53Z",
74+
"LastModifiedDate": "2023-06-19T16:45:07Z"
75+
}
76+
]
77+
}
78+
]
79+
}

‎pkg/detector/library/driver.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,11 @@ func NewDriver(libType string) (Driver, bool) {
6060
// Only semver can be used for version ranges
6161
// https://docs.conan.io/en/latest/versioning/version_ranges.html
6262
comparer = compare.GenericComparer{}
63+
case ftypes.Swift:
64+
// Swift uses semver
65+
// https://www.swift.org/package-manager/#importing-dependencies
66+
ecosystem = vulnerability.Swift
67+
comparer = compare.GenericComparer{}
6368
case ftypes.Cocoapods:
6469
log.Logger.Warn("CocoaPods is supported for SBOM, not for vulnerability scanning")
6570
return Driver{}, false

‎pkg/fanal/analyzer/all/import.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ import (
3232
_ "github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/rust/binary"
3333
_ "github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/rust/cargo"
3434
_ "github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/swift/cocoapods"
35+
_ "github.com/aquasecurity/trivy/pkg/fanal/analyzer/language/swift/swift"
3536
_ "github.com/aquasecurity/trivy/pkg/fanal/analyzer/licensing"
3637
_ "github.com/aquasecurity/trivy/pkg/fanal/analyzer/os/alpine"
3738
_ "github.com/aquasecurity/trivy/pkg/fanal/analyzer/os/amazonlinux"

0 commit comments

Comments
 (0)