forked from aquasecurity/trivy
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(cyclonedx): Add initial support for loading external VEX files f…
…rom SBOM references (aquasecurity#8254)
- Loading branch information
1 parent
43577d8
commit 8291af1
Showing
8 changed files
with
357 additions
and
14 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| # VEX SBOM Reference | ||
|
|
||
| !!! warning "EXPERIMENTAL" | ||
| This feature might change without preserving backwards compatibility. | ||
|
|
||
| ## Using externally referenced VEX documents | ||
|
|
||
| Trivy can discover and download VEX documents referenced in the `externalReferences` of a scanned CycloneDX SBOM. This | ||
| requires the references to be of type `exploitability-statement`. | ||
|
|
||
| To be picked up by Trivy, following top level content needs to be part of a CycloneDx SBOM to dynamically resolve a | ||
| remotely hosted file VEX file at the location `https://vex.example.com`: | ||
|
|
||
| ``` | ||
| "externalReferences": [ | ||
| { | ||
| "type": "exploitability-statement", | ||
| "url": "https://vex.example.com/vex" | ||
| } | ||
| ] | ||
| ``` | ||
|
|
||
| This can also be used to dynamically retrieve VEX files stored on GitHub with an `externalReference` such as: | ||
|
|
||
| ``` | ||
| "externalReferences": [ | ||
| { | ||
| "type": "exploitability-statement", | ||
| "url": "https://raw.githubusercontent.com/aquasecurity/trivy/refs/heads/main/.vex/trivy.openvex.json" | ||
| } | ||
| ] | ||
| ``` | ||
|
|
||
| This is not enabled by default at the moment, but can be used when scanning a CycloneDx SBOM and explicitly specifying | ||
| `--vex sbom-ref`. | ||
|
|
||
| ```shell | ||
| $ trivy sbom trivy.cdx.json --vex sbom-ref | ||
| 2025-01-19T13:29:31+01:00 INFO [vex] Retrieving external VEX document from host vex.example.com type="externalReference" | ||
| 2025-01-19T13:29:31+01:00 INFO Some vulnerabilities have been ignored/suppressed. Use the "--show-suppressed" flag to display them. | ||
| ``` | ||
|
|
||
| All the referenced VEX files are retrieved via HTTP/HTTPS and used in the same way as if they were explicitly specified | ||
| via a [file reference](./file.md). |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,114 @@ | ||
| package vex | ||
|
|
||
| import ( | ||
| "bytes" | ||
| "fmt" | ||
| "io" | ||
| "net/http" | ||
| "net/url" | ||
|
|
||
| "golang.org/x/xerrors" | ||
|
|
||
| "github.com/aquasecurity/trivy/pkg/fanal/artifact" | ||
| "github.com/aquasecurity/trivy/pkg/log" | ||
| "github.com/aquasecurity/trivy/pkg/sbom/core" | ||
| "github.com/aquasecurity/trivy/pkg/types" | ||
| ) | ||
|
|
||
| type SBOMReferenceSet struct { | ||
| VEXes []VEX | ||
| } | ||
|
|
||
| func NewSBOMReferenceSet(report *types.Report) (*SBOMReferenceSet, error) { | ||
|
|
||
| if report.ArtifactType != artifact.TypeCycloneDX { | ||
| return nil, xerrors.Errorf("externalReferences can only be used when scanning CycloneDX SBOMs: %w", report.ArtifactType) | ||
| } | ||
|
|
||
| var externalRefs = report.BOM.ExternalReferences() | ||
| urls := parseToURLs(externalRefs) | ||
|
|
||
| v, err := retrieveExternalVEXDocuments(urls, report) | ||
| if err != nil { | ||
| return nil, xerrors.Errorf("failed to fetch external VEX documents: %w", err) | ||
| } else if v == nil { | ||
| return nil, nil | ||
| } | ||
|
|
||
| return &SBOMReferenceSet{VEXes: v}, nil | ||
| } | ||
|
|
||
| func parseToURLs(refs []core.ExternalReference) []url.URL { | ||
| var urls []url.URL | ||
| for _, ref := range refs { | ||
| if ref.Type == core.ExternalReferenceVEX { | ||
| val, err := url.Parse(ref.URL) | ||
| // do not concern ourselves with relative URLs at this point | ||
| if err != nil || (val.Scheme != "https" && val.Scheme != "http") { | ||
| continue | ||
| } | ||
| urls = append(urls, *val) | ||
| } | ||
| } | ||
| return urls | ||
| } | ||
|
|
||
| func retrieveExternalVEXDocuments(refs []url.URL, report *types.Report) ([]VEX, error) { | ||
|
|
||
| logger := log.WithPrefix("vex").With(log.String("type", "external_reference")) | ||
|
|
||
| var docs []VEX | ||
| for _, ref := range refs { | ||
| doc, err := retrieveExternalVEXDocument(ref, report) | ||
| if err != nil { | ||
| return nil, xerrors.Errorf("failed to retrieve external VEX document: %w", err) | ||
| } | ||
| docs = append(docs, doc) | ||
| } | ||
| logger.Debug("Retrieved external VEX documents", "count", len(docs)) | ||
|
|
||
| if len(docs) == 0 { | ||
| logger.Info("No external VEX documents found") | ||
| return nil, nil | ||
| } | ||
| return docs, nil | ||
|
|
||
| } | ||
|
|
||
| func retrieveExternalVEXDocument(vexUrl url.URL, report *types.Report) (VEX, error) { | ||
|
|
||
| logger := log.WithPrefix("vex").With(log.String("type", "external_reference")) | ||
|
|
||
| logger.Info(fmt.Sprintf("Retrieving external VEX document from host %s", vexUrl.Host)) | ||
|
|
||
| res, err := http.Get(vexUrl.String()) | ||
| if err != nil { | ||
| return nil, xerrors.Errorf("unable to fetch file via HTTP: %w", err) | ||
| } | ||
| defer res.Body.Close() | ||
|
|
||
| if res.StatusCode != http.StatusOK { | ||
| return nil, xerrors.Errorf("did not receive 2xx status code: %w", res.StatusCode) | ||
| } | ||
|
|
||
| val, err := io.ReadAll(res.Body) | ||
| if err != nil { | ||
| return nil, xerrors.Errorf("unable to read response into memory: %w", err) | ||
| } | ||
|
|
||
| if v, err := decodeVEX(bytes.NewReader(val), vexUrl.String(), report); err != nil { | ||
| return nil, xerrors.Errorf("unable to load VEX from external reference: %w", err) | ||
| } else { | ||
| return v, nil | ||
| } | ||
| } | ||
|
|
||
| func (set *SBOMReferenceSet) NotAffected(vuln types.DetectedVulnerability, product, subComponent *core.Component) (types.ModifiedFinding, bool) { | ||
|
|
||
| for _, vex := range set.VEXes { | ||
| if m, notAffected := vex.NotAffected(vuln, product, subComponent); notAffected { | ||
| return m, notAffected | ||
| } | ||
| } | ||
| return types.ModifiedFinding{}, false | ||
| } |
Oops, something went wrong.