Skip to content

Commit ff51614

Browse files
jacek-rzrzjacek-rzrz
committed
fix: respect NONE severity threshold
When severity threshold is set to `none`, download should be allowed regardless of the issues discovered.
1 parent 1e2896c commit ff51614

4 files changed

Lines changed: 106 additions & 24 deletions

File tree

‎core/src/main/java/io/snyk/plugins/artifactory/model/ValidationSettings.java‎

Lines changed: 32 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -3,43 +3,64 @@
33
import io.snyk.plugins.artifactory.configuration.ConfigurationModule;
44
import io.snyk.sdk.model.Severity;
55

6+
import java.util.Optional;
7+
68
import static io.snyk.plugins.artifactory.configuration.PluginConfiguration.SCANNER_LICENSE_THRESHOLD;
79
import static io.snyk.plugins.artifactory.configuration.PluginConfiguration.SCANNER_VULNERABILITY_THRESHOLD;
810

911
public class ValidationSettings {
1012

11-
private final Severity vulnSeverityThreshold;
13+
private final Optional<Severity> vulnSeverityThreshold;
1214

13-
private final Severity licenseSeverityThreshold;
15+
private final Optional<Severity> licenseSeverityThreshold;
1416

1517
public ValidationSettings() {
16-
this(Severity.HIGH, Severity.HIGH);
18+
this(Optional.of(Severity.HIGH), Optional.of(Severity.HIGH));
1719
}
1820

19-
private ValidationSettings(Severity vulnSeverityThreshold, Severity licenseSeverityThreshold) {
21+
private ValidationSettings(Optional<Severity> vulnSeverityThreshold, Optional<Severity> licenseSeverityThreshold) {
2022
this.vulnSeverityThreshold = vulnSeverityThreshold;
2123
this.licenseSeverityThreshold = licenseSeverityThreshold;
2224
}
2325

24-
public ValidationSettings withVulnSeverityThreshold(Severity threshold) {
26+
public ValidationSettings withVulnSeverityThreshold(Optional<Severity> threshold) {
2527
return new ValidationSettings(threshold, licenseSeverityThreshold);
2628
}
2729

28-
public ValidationSettings withLicenseSeverityThreshold(Severity threshold) {
30+
public ValidationSettings withLicenseSeverityThreshold(Optional<Severity> threshold) {
2931
return new ValidationSettings(vulnSeverityThreshold, threshold);
3032
}
3133

32-
public Severity getVulnSeverityThreshold() {
34+
public Optional<Severity> getVulnSeverityThreshold() {
3335
return vulnSeverityThreshold;
3436
}
3537

36-
public Severity getLicenseSeverityThreshold() {
38+
public Optional<Severity> getLicenseSeverityThreshold() {
3739
return licenseSeverityThreshold;
3840
}
3941

4042
public static ValidationSettings from(ConfigurationModule config) {
41-
return new ValidationSettings()
42-
.withVulnSeverityThreshold(Severity.of(config.getPropertyOrDefault(SCANNER_VULNERABILITY_THRESHOLD)))
43-
.withLicenseSeverityThreshold(Severity.of(config.getPropertyOrDefault(SCANNER_LICENSE_THRESHOLD)));
43+
return from(
44+
config.getPropertyOrDefault(SCANNER_VULNERABILITY_THRESHOLD),
45+
config.getPropertyOrDefault(SCANNER_LICENSE_THRESHOLD)
46+
);
47+
}
48+
49+
public static ValidationSettings from(String vulnThreshold, String licenseThreshold) {
50+
return new ValidationSettings(
51+
parseSeverity(vulnThreshold),
52+
parseSeverity(licenseThreshold)
53+
);
54+
}
55+
56+
private static Optional<Severity> parseSeverity(String severityStr) {
57+
if ("none".equalsIgnoreCase(severityStr)) {
58+
return Optional.empty();
59+
}
60+
Severity severity = Severity.of(severityStr);
61+
if (severity == null) {
62+
throw new IllegalArgumentException("Invalid severity threshold: " + severityStr);
63+
}
64+
return Optional.of(severity);
4465
}
4566
}

‎core/src/main/java/io/snyk/plugins/artifactory/scanner/PackageValidator.java‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@
88
import org.slf4j.Logger;
99
import org.slf4j.LoggerFactory;
1010

11+
import java.util.Optional;
12+
1113
import static java.lang.String.format;
1214

1315
public class PackageValidator {
@@ -45,8 +47,13 @@ private void validateLicenseIssues(MonitoredArtifact artifact) {
4547
);
4648
}
4749

48-
private void validateIssues(IssueSummary summary, Severity threshold, boolean ignoreIssues, String issueType, MonitoredArtifact artifact) {
49-
int countAboveThreshold = summary.getCountAtOrAbove(threshold);
50+
private void validateIssues(IssueSummary summary, Optional<Severity> threshold, boolean ignoreIssues, String issueType, MonitoredArtifact artifact) {
51+
if(threshold.isEmpty()) {
52+
LOG.debug("No severity threshold set for {}", issueType);
53+
return;
54+
}
55+
56+
int countAboveThreshold = summary.getCountAtOrAbove(threshold.get());
5057
if (countAboveThreshold == 0) {
5158
LOG.debug("No {} with severity {} or higher: {}", issueType, threshold, artifact.getPath());
5259
return;

‎core/src/test/java/io/snyk/plugins/artifactory/model/ValidationSettingsTest.java‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
package io.snyk.plugins.artifactory.model;
2+
3+
import io.snyk.sdk.model.Severity;
4+
import org.junit.jupiter.api.Test;
5+
6+
import static org.assertj.core.api.AssertionsForClassTypes.assertThat;
7+
import static org.assertj.core.api.AssertionsForClassTypes.assertThatThrownBy;
8+
9+
class ValidationSettingsTest {
10+
11+
@Test
12+
void from_whenValidThresholds() {
13+
ValidationSettings settings = ValidationSettings.from("high", "low");
14+
15+
assertThat(settings.getVulnSeverityThreshold()).contains(Severity.HIGH);
16+
assertThat(settings.getLicenseSeverityThreshold()).contains(Severity.LOW);
17+
}
18+
19+
@Test
20+
void from_whenInvalidThresholds() {
21+
assertThatThrownBy(() -> ValidationSettings.from("danger", "low"))
22+
.hasMessageContaining("danger");
23+
}
24+
25+
@Test
26+
void from_whenNoThresholds() {
27+
ValidationSettings settings = ValidationSettings.from("none", "none");
28+
29+
assertThat(settings.getVulnSeverityThreshold()).isEmpty();
30+
assertThat(settings.getLicenseSeverityThreshold()).isEmpty();
31+
}
32+
33+
34+
}

‎core/src/test/java/io/snyk/plugins/artifactory/scanner/PackageValidatorTest.java‎

Lines changed: 31 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
import org.junit.jupiter.api.Test;
77

88
import java.net.URI;
9+
import java.util.Optional;
910
import java.util.stream.Stream;
1011

1112
import static org.assertj.core.api.AssertionsForClassTypes.assertThatCode;
@@ -16,8 +17,8 @@ class PackageValidatorTest {
1617
@Test
1718
void validate_severityBelowThreshold_allowed() {
1819
ValidationSettings settings = new ValidationSettings()
19-
.withVulnSeverityThreshold(Severity.MEDIUM)
20-
.withLicenseSeverityThreshold(Severity.CRITICAL);
20+
.withVulnSeverityThreshold(Optional.of(Severity.MEDIUM))
21+
.withLicenseSeverityThreshold(Optional.of(Severity.CRITICAL));
2122
PackageValidator validator = new PackageValidator(settings);
2223
MonitoredArtifact artifact = new MonitoredArtifact("",
2324
new TestResult(
@@ -34,8 +35,8 @@ void validate_severityBelowThreshold_allowed() {
3435
@Test
3536
void validate_vulnIssueAboveThreshold_forbidden() {
3637
ValidationSettings settings = new ValidationSettings()
37-
.withVulnSeverityThreshold(Severity.HIGH)
38-
.withLicenseSeverityThreshold(Severity.LOW);
38+
.withVulnSeverityThreshold(Optional.of(Severity.HIGH))
39+
.withLicenseSeverityThreshold(Optional.of(Severity.LOW));
3940
PackageValidator validator = new PackageValidator(settings);
4041
MonitoredArtifact artifact = new MonitoredArtifact("",
4142
new TestResult(
@@ -52,8 +53,8 @@ void validate_vulnIssueAboveThreshold_forbidden() {
5253
@Test
5354
void validate_vulnIssuesIgnored_allowed() {
5455
ValidationSettings settings = new ValidationSettings()
55-
.withVulnSeverityThreshold(Severity.HIGH)
56-
.withLicenseSeverityThreshold(Severity.LOW);
56+
.withVulnSeverityThreshold(Optional.of(Severity.HIGH))
57+
.withLicenseSeverityThreshold(Optional.of(Severity.LOW));
5758
PackageValidator validator = new PackageValidator(settings);
5859
MonitoredArtifact artifact = new MonitoredArtifact("",
5960
new TestResult(
@@ -70,8 +71,8 @@ void validate_vulnIssuesIgnored_allowed() {
7071
@Test
7172
void validate_licenseIssueAboveThreshold_forbidden() {
7273
ValidationSettings settings = new ValidationSettings()
73-
.withVulnSeverityThreshold(Severity.LOW)
74-
.withLicenseSeverityThreshold(Severity.MEDIUM);
74+
.withVulnSeverityThreshold(Optional.of(Severity.LOW))
75+
.withLicenseSeverityThreshold(Optional.of(Severity.MEDIUM));
7576
PackageValidator validator = new PackageValidator(settings);
7677
MonitoredArtifact artifact = new MonitoredArtifact("",
7778
new TestResult(
@@ -85,11 +86,30 @@ void validate_licenseIssueAboveThreshold_forbidden() {
8586
assertThatThrownBy(() -> validator.validate(artifact)).isExactlyInstanceOf(CancelException.class);
8687
}
8788

89+
90+
@Test
91+
void validate_thresholdNone_allowed() {
92+
ValidationSettings settings = new ValidationSettings()
93+
.withVulnSeverityThreshold(Optional.empty())
94+
.withLicenseSeverityThreshold(Optional.empty());
95+
PackageValidator validator = new PackageValidator(settings);
96+
MonitoredArtifact artifact = new MonitoredArtifact("",
97+
new TestResult(
98+
IssueSummary.from(Stream.of(Severity.CRITICAL)),
99+
IssueSummary.from(Stream.of(Severity.CRITICAL)),
100+
URI.create("https://snyk.io/package/version")
101+
),
102+
new Ignores()
103+
);
104+
105+
assertThatCode(() -> validator.validate(artifact)).doesNotThrowAnyException();
106+
}
107+
88108
@Test
89109
void validate_licenseIssuesIgnored_allowed() {
90110
ValidationSettings settings = new ValidationSettings()
91-
.withVulnSeverityThreshold(Severity.LOW)
92-
.withLicenseSeverityThreshold(Severity.MEDIUM);
111+
.withVulnSeverityThreshold(Optional.of(Severity.LOW))
112+
.withLicenseSeverityThreshold(Optional.of(Severity.MEDIUM));
93113
PackageValidator validator = new PackageValidator(settings);
94114
MonitoredArtifact artifact = new MonitoredArtifact("",
95115
new TestResult(
@@ -106,7 +126,7 @@ void validate_licenseIssuesIgnored_allowed() {
106126
@Test
107127
void validate_includesSnykDetailsUrlInCancelException() {
108128
ValidationSettings settings = new ValidationSettings()
109-
.withVulnSeverityThreshold(Severity.LOW);
129+
.withVulnSeverityThreshold(Optional.of(Severity.LOW));
110130
PackageValidator validator = new PackageValidator(settings);
111131
MonitoredArtifact artifact = new MonitoredArtifact("",
112132
new TestResult(

0 commit comments

Comments
 (0)