Skip to content

Commit d3d948d

Browse files
Ashish-devtronAshish-devtron
authored
feat: Capability to block deployments in case of vulnerabilities only if FIXED IN VERSION available (#3796)
* block if fixed version available * check for policy in different apis. * minimise the if else check * minimise the if else check * Completed unit testcases * remove duplicate codes * remove duplicate codes * unit test cases
1 parent 782aac2 commit d3d948d

File tree

4 files changed

+349
-30
lines changed

4 files changed

+349
-30
lines changed

‎internal/sql/repository/security/CvePolicyControle.go‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -46,10 +46,11 @@ const (
4646
Inherit PolicyAction = iota
4747
Allow
4848
Block
49+
Blockiffixed
4950
)
5051

5152
func (d PolicyAction) String() string {
52-
return [...]string{"inherit", "allow", "block"}[d]
53+
return [...]string{"inherit", "allow", "block", "blockiffixed"}[d]
5354
}
5455

5556
// ------------------
@@ -246,23 +247,23 @@ func (impl *CvePolicyRepositoryImpl) GetBlockedCVEList(cves []*CveStore, cluster
246247
if err != nil {
247248
return nil, err
248249
}
249-
blockedCve := impl.enforceCvePolicy(cves, cvePolicy, severityPolicy)
250+
blockedCve := EnforceCvePolicy(cves, cvePolicy, severityPolicy)
250251
return blockedCve, nil
251252
}
252253

253-
func (impl *CvePolicyRepositoryImpl) enforceCvePolicy(cves []*CveStore, cvePolicy map[string]*CvePolicy, severityPolicy map[Severity]*CvePolicy) (blockedCVE []*CveStore) {
254+
func EnforceCvePolicy(cves []*CveStore, cvePolicy map[string]*CvePolicy, severityPolicy map[Severity]*CvePolicy) (blockedCVE []*CveStore) {
254255

255256
for _, cve := range cves {
256257
if policy, ok := cvePolicy[cve.Name]; ok {
257258
if policy.Action == Allow {
258259
continue
259-
} else {
260+
} else if (policy.Action == Block) || (policy.Action == Blockiffixed && cve.FixedVersion != "") {
260261
blockedCVE = append(blockedCVE, cve)
261262
}
262263
} else {
263264
if severityPolicy[cve.Severity] != nil && severityPolicy[cve.Severity].Action == Allow {
264265
continue
265-
} else {
266+
} else if severityPolicy[cve.Severity] != nil && (severityPolicy[cve.Severity].Action == Block || (severityPolicy[cve.Severity].Action == Blockiffixed && cve.FixedVersion != "")) {
266267
blockedCVE = append(blockedCVE, cve)
267268
}
268269
}
@@ -346,6 +347,7 @@ func (impl *CvePolicyRepositoryImpl) getHighestPolicy(allPolicies map[string][]*
346347
}
347348
return applicablePolicies
348349
}
350+
349351
func (impl *CvePolicyRepositoryImpl) getHighestPolicyS(allPolicies map[Severity][]*CvePolicy) map[Severity]*CvePolicy {
350352
applicablePolicies := make(map[Severity]*CvePolicy)
351353
for key, policies := range allPolicies {

‎internal/sql/repository/security/CvePolicyControle_test.go‎

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+
package security
2+
3+
import (
4+
"github.com/go-pg/pg"
5+
"reflect"
6+
"testing"
7+
)
8+
9+
func TestCvePolicyRepositoryImpl_enforceCvePolicy(t *testing.T) {
10+
type fields struct {
11+
dbConnection *pg.DB
12+
}
13+
type args struct {
14+
cves []*CveStore
15+
cvePolicy map[string]*CvePolicy
16+
severityPolicy map[Severity]*CvePolicy
17+
}
18+
tests := []struct {
19+
name string
20+
fields fields
21+
args args
22+
wantBlockedCVE []*CveStore
23+
}{
24+
// TODO: Add test cases.
25+
{
26+
name: "Test 1",
27+
args: args{
28+
cves: []*CveStore{
29+
{
30+
Name: "abc",
31+
},
32+
{
33+
Severity: Low,
34+
},
35+
},
36+
cvePolicy: map[string]*CvePolicy{
37+
"abc": {
38+
Action: Allow,
39+
},
40+
},
41+
severityPolicy: map[Severity]*CvePolicy{
42+
Low: {
43+
Action: Allow,
44+
},
45+
},
46+
},
47+
wantBlockedCVE: nil,
48+
},
49+
{
50+
name: "Test 2",
51+
args: args{
52+
cves: []*CveStore{
53+
{
54+
Name: "abc",
55+
},
56+
},
57+
cvePolicy: map[string]*CvePolicy{
58+
"abc": {
59+
Action: Block,
60+
},
61+
},
62+
severityPolicy: map[Severity]*CvePolicy{},
63+
},
64+
wantBlockedCVE: []*CveStore{
65+
{
66+
Name: "abc",
67+
},
68+
},
69+
},
70+
{
71+
name: "Test 3",
72+
args: args{
73+
cves: []*CveStore{
74+
{
75+
Severity: High,
76+
},
77+
},
78+
cvePolicy: map[string]*CvePolicy{},
79+
severityPolicy: map[Severity]*CvePolicy{
80+
High: {
81+
Action: Block,
82+
},
83+
},
84+
},
85+
wantBlockedCVE: []*CveStore{
86+
{
87+
Severity: High,
88+
},
89+
},
90+
},
91+
{
92+
name: "Test 4",
93+
args: args{
94+
cves: []*CveStore{
95+
{
96+
Name: "abc",
97+
FixedVersion: "1.0.0",
98+
},
99+
},
100+
cvePolicy: map[string]*CvePolicy{
101+
"abc": {
102+
Action: Blockiffixed,
103+
},
104+
},
105+
severityPolicy: map[Severity]*CvePolicy{},
106+
},
107+
wantBlockedCVE: []*CveStore{
108+
{
109+
Name: "abc",
110+
FixedVersion: "1.0.0",
111+
},
112+
},
113+
},
114+
{
115+
name: "Test 5",
116+
args: args{
117+
cves: []*CveStore{
118+
{
119+
Name: "abc",
120+
},
121+
},
122+
cvePolicy: map[string]*CvePolicy{
123+
"abc": {
124+
Action: Blockiffixed,
125+
},
126+
},
127+
severityPolicy: map[Severity]*CvePolicy{},
128+
},
129+
wantBlockedCVE: nil,
130+
},
131+
{
132+
name: "Test 6",
133+
args: args{
134+
cves: []*CveStore{
135+
{
136+
Severity: High,
137+
FixedVersion: "1.0.0",
138+
},
139+
},
140+
cvePolicy: map[string]*CvePolicy{},
141+
severityPolicy: map[Severity]*CvePolicy{
142+
High: {
143+
Action: Blockiffixed,
144+
},
145+
},
146+
},
147+
wantBlockedCVE: []*CveStore{
148+
{
149+
Severity: High,
150+
FixedVersion: "1.0.0",
151+
},
152+
},
153+
},
154+
{
155+
name: "Test 7",
156+
args: args{
157+
cves: []*CveStore{
158+
{
159+
Severity: High,
160+
},
161+
},
162+
cvePolicy: map[string]*CvePolicy{},
163+
severityPolicy: map[Severity]*CvePolicy{
164+
High: {
165+
Action: Blockiffixed,
166+
},
167+
},
168+
},
169+
wantBlockedCVE: nil,
170+
},
171+
}
172+
for _, tt := range tests {
173+
t.Run(tt.name, func(t *testing.T) {
174+
if gotBlockedCVE := EnforceCvePolicy(tt.args.cves, tt.args.cvePolicy, tt.args.severityPolicy); !reflect.DeepEqual(gotBlockedCVE, tt.wantBlockedCVE) {
175+
t.Errorf("EnforceCvePolicy() = %v, want %v", gotBlockedCVE, tt.wantBlockedCVE)
176+
}
177+
})
178+
}
179+
}

‎pkg/security/policyService.go‎

Lines changed: 6 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -250,7 +250,7 @@ func (impl *PolicyServiceImpl) VerifyImage(verifyImageRequest *VerifyImageReques
250250
scanResultsIdMap[scanResult.ImageScanExecutionHistoryId] = scanResult.ImageScanExecutionHistoryId
251251
}
252252
}
253-
blockedCves := impl.enforceCvePolicy(cveStores, cvePolicy, severityPolicy)
253+
blockedCves := security.EnforceCvePolicy(cveStores, cvePolicy, severityPolicy)
254254
impl.logger.Debugw("blocked cve for image", "image", image, "blocked", blockedCves)
255255
for _, cve := range blockedCves {
256256
vr := &VerifyImageResponse{
@@ -328,27 +328,6 @@ func (impl *PolicyServiceImpl) VerifyImage(verifyImageRequest *VerifyImageReques
328328
return imageBlockedCves, nil
329329
}
330330

331-
// image(cve), appId, envId
332-
func (impl *PolicyServiceImpl) enforceCvePolicy(cves []*security.CveStore, cvePolicy map[string]*security.CvePolicy, severityPolicy map[security.Severity]*security.CvePolicy) (blockedCVE []*security.CveStore) {
333-
334-
for _, cve := range cves {
335-
if policy, ok := cvePolicy[cve.Name]; ok {
336-
if policy.Action == security.Allow {
337-
continue
338-
} else {
339-
blockedCVE = append(blockedCVE, cve)
340-
}
341-
} else {
342-
if severityPolicy[cve.Severity] != nil && severityPolicy[cve.Severity].Action == security.Allow {
343-
continue
344-
} else {
345-
blockedCVE = append(blockedCVE, cve)
346-
}
347-
}
348-
}
349-
return blockedCVE
350-
}
351-
352331
func (impl *PolicyServiceImpl) GetApplicablePolicy(clusterId, envId, appId int, isAppstore bool) (map[string]*security.CvePolicy, map[security.Severity]*security.CvePolicy, error) {
353332

354333
var policyLevel security.PolicyLevel
@@ -441,6 +420,8 @@ func (impl *PolicyServiceImpl) parsePolicyAction(action string) (security.Policy
441420
policyAction = security.Block
442421
} else if action == "inherit" {
443422
policyAction = security.Inherit
423+
} else if action == "blockiffixed" {
424+
policyAction = security.Blockiffixed
444425
} else {
445426
return security.Inherit, fmt.Errorf("unsupported action %s", action)
446427
}
@@ -706,7 +687,7 @@ func (impl *PolicyServiceImpl) GetBlockedCVEList(cves []*security.CveStore, clus
706687
if err != nil {
707688
return nil, err
708689
}
709-
blockedCve := impl.enforceCvePolicy(cves, cvePolicy, severityPolicy)
690+
blockedCve := security.EnforceCvePolicy(cves, cvePolicy, severityPolicy)
710691
return blockedCve, nil
711692
}
712693

@@ -715,13 +696,13 @@ func (impl *PolicyServiceImpl) HasBlockedCVE(cves []*security.CveStore, cvePolic
715696
if policy, ok := cvePolicy[cve.Name]; ok {
716697
if policy.Action == security.Allow {
717698
continue
718-
} else {
699+
} else if (policy.Action == security.Block) || (policy.Action == security.Blockiffixed && cve.FixedVersion != "") {
719700
return true
720701
}
721702
} else {
722703
if severityPolicy[cve.Severity] != nil && severityPolicy[cve.Severity].Action == security.Allow {
723704
continue
724-
} else {
705+
} else if severityPolicy[cve.Severity] != nil && (severityPolicy[cve.Severity].Action == security.Block || (severityPolicy[cve.Severity].Action == security.Blockiffixed && cve.FixedVersion != "")) {
725706
return true
726707
}
727708
}

0 commit comments

Comments
 (0)