Skip to content

Commit 00def3e

Browse files
CatalinSnykCatalinSnyk
authored
chore: fix transitive dependencies being marked as directly upgradable (#582)
1 parent df590fb commit 00def3e

10 files changed

Lines changed: 536 additions & 142 deletions

File tree

‎internal/presenters/funcs.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -287,6 +287,7 @@ func getCliTemplateFuncMap(tmpl *template.Template) template.FuncMap {
287287
fnMap["colorBySeverity"] = renderInSeverityColor // 2-arg version from styles.go
288288
fnMap["renderGreen"] = renderGreen
289289
fnMap["renderGray"] = renderGray
290+
fnMap["renderCyan"] = renderCyan
290291
fnMap["bold"] = renderBold
291292
fnMap["tip"] = func(s string) string {
292293
return RenderTip(s + "\n")

‎internal/presenters/presenter_ufm_test.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1167,6 +1167,13 @@ func Test_UfmPresenter_HumanReadable(t *testing.T) {
11671167
}{
11681168
{
11691169
name: "cli",
1170+
expectedPath: "testdata/ufm/cli.human.readable",
1171+
testResultPath: "testdata/ufm/testresult_cli.json",
1172+
includeIgnores: false,
1173+
severityThreshold: "",
1174+
},
1175+
{
1176+
name: "webgoat",
11701177
expectedPath: "testdata/ufm/webgoat.ignore.human.readable",
11711178
testResultPath: "testdata/ufm/webgoat.ignore.testresult.json",
11721179
includeIgnores: true,

‎internal/presenters/styles.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,3 +35,8 @@ func renderGray(str string) string {
3535
style := lipgloss.NewStyle().Foreground(lipgloss.Color("8"))
3636
return style.Render(str)
3737
}
38+
39+
func renderCyan(str string) string {
40+
style := lipgloss.NewStyle().Foreground(lipgloss.Color("6"))
41+
return style.Render(str)
42+
}

‎internal/presenters/templates/ufm.human.tmpl‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -183,11 +183,12 @@ Tested {{ int $dependencyCount }} dependencies for known issues, found {{ len $o
183183
{{- define "issueRemediationDetails" }}
184184
{{- $issue := . }}
185185
{{- $componentName := getIssueMetadata $issue "component-name" }}
186+
{{- $componentVersion := getIssueMetadata $issue "component-version" }}
186187
{{- $severity := $issue.GetEffectiveSeverity }}
187188
{{- $title := colorBySeverity $severity ($issue.GetTitle | bold) }}
188189
{{- $severityBadge := colorBySeverity $severity (printf "[%s]" ($severity | toUpperCase)) }}
189190
{{- $url := printf "[https://security.snyk.io/vuln/%s]" $issue.GetID }}
190-
{{- $pkgDisplay := $componentName | bold }}
191+
{{- $pkgDisplay := printf "%s@%s" $componentName $componentVersion | bold }}
191192
{{- printf " ✗ %s %s %s in %s" $title $severityBadge $url $pkgDisplay }}
192193
{{- "\n" }}
193194

@@ -221,9 +222,9 @@ Tested {{ int $dependencyCount }} dependencies for known issues, found {{ len $o
221222
{{- end }}
222223
{{- if gt $pathCount 1 }}
223224
{{- if eq (sub $pathCount 1) 1 }}
224-
{{- printf " introduced by %s and %d other path\n" $pathStr (sub $pathCount 1) }}
225+
{{- printf " introduced by %s and %s other path\n" $pathStr (print (sub $pathCount 1) | renderCyan) }}
225226
{{- else }}
226-
{{- printf " introduced by %s and %d other paths\n" $pathStr (sub $pathCount 1) }}
227+
{{- printf " introduced by %s and %s other paths\n" $pathStr (print (sub $pathCount 1) | renderCyan) }}
227228
{{- end }}
228229
{{- else }}
229230
{{- printf " introduced by %s\n" $pathStr }}

‎internal/presenters/testdata/ufm/cli.human.readable‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
Testing (package.json) ...
2+
3+
Tested 552 dependencies for known issues, found 9 issues, 111 vulnerable paths.
4+
5+
Open Security issues: 9
6+
7+
✗ [LOW] Regular Expression Denial of Service (ReDoS)
8+
Finding ID: SNYK-JS-BRACEEXPANSION-9789073
9+
Info: https://snyk.io/vuln/SNYK-JS-BRACEEXPANSION-9789073
10+
Introduced by: brace-expansion
11+
Introduced through: snyk@1.0.0-monorepo > glob@7.2.3 > minimatch@3.1.2 > brace-expansion@1.1.11
12+
Reachability: No Path Found
13+
14+
✗ [MEDIUM] Arbitrary Code Injection
15+
Finding ID: SNYK-JS-COOKIE-13271683
16+
Info: https://snyk.io/vuln/SNYK-JS-COOKIE-13271683
17+
Introduced by: cookie
18+
Introduced through: snyk@1.0.0-monorepo > @sentry/node@7.34.0 > cookie@0.4.2
19+
Reachability: No Path Found
20+
21+
✗ [MEDIUM] Regular Expression Denial of Service (ReDoS)
22+
Finding ID: SNYK-JS-DEBUG-13283909
23+
Info: https://snyk.io/vuln/SNYK-JS-DEBUG-13283909
24+
Introduced by: debug
25+
Introduced through: snyk@1.0.0-monorepo > debug@4.3.4
26+
Reachability: No Path Found
27+
28+
✗ [MEDIUM] Alternate solution to CWE-1333 | Inefficient Regular Expression Complexity
29+
Finding ID: SNYK-JS-DEBUG-14214893
30+
Info: https://snyk.io/vuln/SNYK-JS-DEBUG-14214893
31+
Introduced by: debug
32+
Introduced through: snyk@1.0.0-monorepo > debug@4.3.4
33+
Reachability: No Path Found
34+
35+
✗ [MEDIUM] Open Redirect
36+
Finding ID: SNYK-JS-GOT-2932019
37+
Info: https://snyk.io/vuln/SNYK-JS-GOT-2932019
38+
Introduced by: got
39+
Introduced through: snyk@1.0.0-monorepo > snyk-nodejs-lockfile-parser@2.3.1 > @yarnpkg/core@4.4.1 > got@11.8.2
40+
Reachability: No Path Found
41+
42+
✗ [MEDIUM] Regular Expression Denial of Service (ReDoS)
43+
Finding ID: SNYK-JS-MARKED-2342073
44+
Info: https://snyk.io/vuln/SNYK-JS-MARKED-2342073
45+
Introduced by: marked
46+
Introduced through: snyk@1.0.0-monorepo > marked@4.0.1
47+
Reachability: Reachable
48+
49+
✗ [MEDIUM] Regular Expression Denial of Service (ReDoS)
50+
Finding ID: SNYK-JS-MARKED-2342082
51+
Info: https://snyk.io/vuln/SNYK-JS-MARKED-2342082
52+
Introduced by: marked
53+
Introduced through: snyk@1.0.0-monorepo > marked@4.0.1
54+
Reachability: Reachable
55+
56+
✗ [HIGH] Directory Traversal
57+
Finding ID: SNYK-JS-ASYNC-12239908
58+
Info: https://snyk.io/vuln/SNYK-JS-ASYNC-12239908
59+
Introduced by: async
60+
Introduced through: snyk@1.0.0-monorepo > snyk-config@5.2.0 > async@3.2.4
61+
Reachability: No Path Found
62+
63+
✗ [HIGH] Denial of Service (DoS)
64+
Finding ID: SNYK-JS-LODASH-12239302
65+
Info: https://snyk.io/vuln/SNYK-JS-LODASH-12239302
66+
Introduced by: lodash
67+
Introduced through: snyk@1.0.0-monorepo > snyk-nodejs-plugin@1.4.4 > lodash@4.17.21
68+
Reachability: No Path Found
69+
70+
Issues to fix by upgrading:
71+
72+
Upgrade @sentry/node@7.34.0 to @sentry/node@7.94.1 to fix
73+
✗ Arbitrary Code Injection [MEDIUM] [https://security.snyk.io/vuln/SNYK-JS-COOKIE-13271683] in cookie@0.4.2
74+
introduced by snyk@1.0.0-monorepo > @sentry/node@7.34.0 > cookie@0.4.2
75+
✗ Regular Expression Denial of Service (ReDoS) [MEDIUM] [https://security.snyk.io/vuln/SNYK-JS-DEBUG-13283909] in debug@4.3.4
76+
introduced by snyk@1.0.0-monorepo > debug@4.3.4 and 40 other paths
77+
✗ Alternate solution to CWE-1333 | Inefficient Regular Expression Complexity [MEDIUM] [https://security.snyk.io/vuln/SNYK-JS-DEBUG-14214893] in debug@4.3.4
78+
introduced by snyk@1.0.0-monorepo > debug@4.3.4 and 40 other paths
79+
80+
Upgrade @snyk/fix@1.0.0-monorepo to @snyk/fix@1.471.0 to fix
81+
✗ Regular Expression Denial of Service (ReDoS) [MEDIUM] [https://security.snyk.io/vuln/SNYK-JS-DEBUG-13283909] in debug@4.3.4
82+
introduced by snyk@1.0.0-monorepo > debug@4.3.4 and 40 other paths
83+
✗ Alternate solution to CWE-1333 | Inefficient Regular Expression Complexity [MEDIUM] [https://security.snyk.io/vuln/SNYK-JS-DEBUG-14214893] in debug@4.3.4
84+
introduced by snyk@1.0.0-monorepo > debug@4.3.4 and 40 other paths
85+
86+
Upgrade glob@7.2.3 to glob@9.0.0 to fix
87+
✗ Regular Expression Denial of Service (ReDoS) [LOW] [https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-9789073] in brace-expansion@1.1.11
88+
introduced by snyk@1.0.0-monorepo > glob@7.2.3 > minimatch@3.1.2 > brace-expansion@1.1.11 and 7 other paths
89+
90+
Upgrade marked@4.0.1 to marked@4.0.10 to fix
91+
✗ Regular Expression Denial of Service (ReDoS) [MEDIUM] [https://security.snyk.io/vuln/SNYK-JS-MARKED-2342073] in marked@4.0.1
92+
introduced by snyk@1.0.0-monorepo > marked@4.0.1
93+
✗ Regular Expression Denial of Service (ReDoS) [MEDIUM] [https://security.snyk.io/vuln/SNYK-JS-MARKED-2342082] in marked@4.0.1
94+
introduced by snyk@1.0.0-monorepo > marked@4.0.1
95+
96+
Upgrade rimraf@2.7.1 to rimraf@4.3.1 to fix
97+
✗ Regular Expression Denial of Service (ReDoS) [LOW] [https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-9789073] in brace-expansion@1.1.11
98+
introduced by snyk@1.0.0-monorepo > glob@7.2.3 > minimatch@3.1.2 > brace-expansion@1.1.11 and 7 other paths
99+
100+
Upgrade snyk-go-plugin@1.23.0 to snyk-go-plugin@1.24.0 to fix
101+
✗ Regular Expression Denial of Service (ReDoS) [LOW] [https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-9789073] in brace-expansion@1.1.11
102+
introduced by snyk@1.0.0-monorepo > glob@7.2.3 > minimatch@3.1.2 > brace-expansion@1.1.11 and 7 other paths
103+
104+
Upgrade snyk-resolve-deps@4.8.0 to snyk-resolve-deps@4.9.1 to fix
105+
✗ Regular Expression Denial of Service (ReDoS) [MEDIUM] [https://security.snyk.io/vuln/SNYK-JS-DEBUG-13283909] in debug@4.3.4
106+
introduced by snyk@1.0.0-monorepo > debug@4.3.4 and 40 other paths
107+
✗ Alternate solution to CWE-1333 | Inefficient Regular Expression Complexity [MEDIUM] [https://security.snyk.io/vuln/SNYK-JS-DEBUG-14214893] in debug@4.3.4
108+
introduced by snyk@1.0.0-monorepo > debug@4.3.4 and 40 other paths
109+
110+
Issues with no direct upgrade or patch:
111+
✗ Regular Expression Denial of Service (ReDoS) [LOW] [https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-9789073] in brace-expansion@1.1.11
112+
introduced by snyk@1.0.0-monorepo > glob@7.2.3 > minimatch@3.1.2 > brace-expansion@1.1.11 and 7 other paths
113+
This issue was fixed in: 1.1.12, 2.0.2, 3.0.1, 4.0.1
114+
115+
╭─────────────────────────────────────────────────────────╮
116+
│ Test Summary │
117+
│ │
118+
│ Organization: My Org │
119+
│ Test type: Software Composition Analysis │
120+
│ Project path: test-project │
121+
│ │
122+
│ Total security issues: 9 │
123+
│ Ignored: 0 [ 0 CRITICAL  0 HIGH  0 MEDIUM  0 LOW ] │
124+
│ Open : 9 [ 0 CRITICAL  2 HIGH  6 MEDIUM  1 LOW ] │
125+
╰─────────────────────────────────────────────────────────╯
126+
127+
128+
💡 Tip
129+
130+
To view ignored issues, use the --include-ignores option.
131+

0 commit comments

Comments
 (0)