[download]: https://img.shields.io/github/downloads/aquasecurity/postee/total?logo=github
[release-img]: https://img.shields.io/github/release/aquasecurity/postee.png?logo=github
[release]: https://github.com/aquasecurity/postee/releases
[docker-pull]: https://img.shields.io/docker/pulls/aquasec/postee?logo=docker&label=docker%20pulls%20%2F%20postee
[go-doc-img]: https://godoc.org/github.com/aquasecurity/postee?status.svg
[report-card-img]: https://goreportcard.com/badge/github.com/aquasecurity/postee
[report-card]: https://goreportcard.com/report/github.com/aquasecurity/postee
[license-img]: https://img.shields.io/badge/License-mit-blue.svg
[license]: https://github.com/aquasecurity/postee/blob/master/LICENSE
Postee is a simple message routing application that receives input messages through a webhook interface, and can take enforce actions using predefined outputs via integrations.
Watch a quick demo of how you can use Postee:
[](https://www.youtube.com/watch?v=HZ5Z8jAVH8w)
Primary use of Postee is to act as a message relay and notification service that integrates with a variety of third-party services. Postee can also be used for sending vulnerability scan results or audit alerts from Aqua Platform to collaboration systems.
In addition, Postee can also be used to enforce pre-defined behaviours that can orchestrate actions based on input messages as triggers.
## Status
Although we are trying to keep new releases backward compatible with previous versions, this project is still incubating,
and some APIs and code structures may change.
## Documentation
The official [Documentation] provides detailed installation, configuration, troubleshooting, and quick start guides.
---
Postee is an [Aqua Security](https://aquasec.com) open source project.
Learn about our [Open Source Work and Portfolio].
Join the community, and talk to us about any matter in [GitHub Discussions] or [Slack].
[Documentation]: https://aquasecurity.github.io/postee/latest
[Open Source Work and Portfolio]: https://www.aquasec.com/products/open-source-projects/
[Slack]: https://slack.aquasec.com/
[GitHub Discussions]: https://github.com/aquasecurity/postee/discussions
## Release
1. Bump version of [helm chart](https://github.com/aquasecurity/postee/blob/main/deploy/helm/postee/Chart.yaml).
1. (By repository admin) Create a new tag. Postee and helm charts are automatically released by github actions.
1. (By repository admin) Run [publish-docs workflow](https://github.com/aquasecurity/postee/blob/main/.github/workflows/publish-docs.yml), if document has been updated.
================================================
FILE: actions/aws_securityhub.go
================================================
package actions
import (
"context"
"encoding/json"
"fmt"
"log"
"strings"
"github.com/aquasecurity/postee/v2/formatting"
"github.com/aquasecurity/postee/v2/layout"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/config"
"github.com/aws/aws-sdk-go-v2/service/securityhub"
"github.com/aws/aws-sdk-go-v2/service/securityhub/types"
)
type securityHubAPI interface {
BatchImportFindings(ctx context.Context, params *securityhub.BatchImportFindingsInput, optFns ...func(*securityhub.Options)) (*securityhub.BatchImportFindingsOutput, error)
}
type Finding struct {
SchemaVersion string `json:"SchemaVersion,omitempty"`
ID string `json:"Id,omitempty"`
ProductArn string `json:"ProductArn,omitempty"`
GeneratorID string `json:"GeneratorId,omitempty"`
AwsAccountID string `json:"AwsAccountId,omitempty"`
Types []string `json:"Types,omitempty"`
CreatedAt string `json:"CreatedAt,omitempty"`
UpdatedAt string `json:"UpdatedAt,omitempty"`
Severity struct {
Label string `json:"Label,omitempty"`
} `json:"Severity,omitempty"`
Title string `json:"Title,omitempty"`
Description string `json:"Description,omitempty"`
Remediation struct {
Recommendation struct {
Text string `json:"Text,omitempty"`
URL string `json:"Url,omitempty"`
} `json:"Recommendation,omitempty"`
} `json:"Remediation,omitempty"`
ProductFields struct {
ProductName string `json:"Product Name,omitempty"`
} `json:"ProductFields,omitempty"`
Resources []struct {
Type string `json:"Type,omitempty"`
ID string `json:"Id,omitempty"`
Partition string `json:"Partition,omitempty"`
Region string `json:"Region,omitempty"`
Details struct {
Container struct {
ImageName string `json:"ImageName,omitempty"`
} `json:"Container,omitempty"`
Other struct {
CVEID string `json:"CVE ID,omitempty"`
CVETitle string `json:"CVE Title,omitempty"`
PkgName string `json:"PkgName,omitempty"`
InstalledPackage string `json:"Installed Package,omitempty"`
PatchedPackage string `json:"Patched Package,omitempty"`
NvdCvssScoreV3 string `json:"NvdCvssScoreV3,omitempty"`
NvdCvssVectorV3 string `json:"NvdCvssVectorV3,omitempty"`
NvdCvssScoreV2 string `json:"NvdCvssScoreV2,omitempty"`
NvdCvssVectorV2 string `json:"NvdCvssVectorV2,omitempty"`
} `json:"Other,omitempty"`
} `json:"Details,omitempty"`
} `json:"Resources,omitempty"`
RecordState string `json:"RecordState,omitempty"`
}
type Report struct {
Findings []Finding
}
type AWSSecurityHubClient struct {
client securityHubAPI
Name string
}
func (sh AWSSecurityHubClient) GetName() string {
return sh.Name
}
func (sh *AWSSecurityHubClient) Init() error {
// Load the Shared AWS Configuration (~/.aws/config)
cfg, err := config.LoadDefaultConfig(context.TODO())
if err != nil {
return fmt.Errorf("failed to load AWS config: %w", err)
}
sh.client = securityhub.NewFromConfig(cfg)
if sh.client == nil {
return fmt.Errorf("failed to create AWS Security Hub client")
}
return nil
}
func (sh AWSSecurityHubClient) Send(m map[string]string) error {
var r Report
if err := json.Unmarshal([]byte(m["description"]), &r); err != nil {
return fmt.Errorf("AWS Security Hub unmarshalling failed: %w", err)
}
if len(r.Findings) <= 0 {
return fmt.Errorf("trivy AWS sent no findings to Postee, skipping sending")
}
var awsfindings []types.AwsSecurityFinding
for _, f := range r.Findings {
af := types.AwsSecurityFinding{
AwsAccountId: aws.String(f.AwsAccountID),
CreatedAt: aws.String(f.CreatedAt),
Description: aws.String(f.Description),
GeneratorId: aws.String(f.GeneratorID),
Id: aws.String(f.ID),
ProductArn: aws.String(f.ProductArn),
SchemaVersion: aws.String(f.SchemaVersion),
Title: aws.String(f.Title),
UpdatedAt: aws.String(f.UpdatedAt),
Types: f.Types,
}
af.Resources = append(af.Resources, []types.Resource{
{
Id: aws.String(f.ID),
Type: aws.String(strings.Join(f.Types, " ")),
},
}...)
af.Remediation = &types.Remediation{
Recommendation: &types.Recommendation{
Text: aws.String(f.Remediation.Recommendation.Text),
Url: aws.String(f.Remediation.Recommendation.URL),
},
}
af.Severity = &types.Severity{
Label: types.SeverityLabel(f.Severity.Label),
}
awsfindings = append(awsfindings, af)
}
var successCount, failedCount int
awsFindingChunks := chunkBy(awsfindings, 100)
log.Printf("sending %d findings in %d chunk(s) to AWS Security Hub", len(awsfindings), len(awsFindingChunks))
for _, awsfindingChunk := range awsFindingChunks {
output, err := sh.client.BatchImportFindings(context.TODO(), &securityhub.BatchImportFindingsInput{
Findings: awsfindingChunk,
})
if err != nil {
return fmt.Errorf("upload to AWS Security Hub failed: %w", err)
}
if len(output.FailedFindings) > 0 {
failedCount += len(output.FailedFindings)
log.Printf("%d findings failed to be reported...", len(output.FailedFindings))
for _, ff := range output.FailedFindings {
log.Printf("Failed finding details: ID: %s , ErrorCode: %s, ErrorMessage: %s\n", *ff.Id, *ff.ErrorCode, *ff.ErrorMessage)
}
}
successCount += int(output.SuccessCount)
}
log.Printf("successfully sent: %d findings to AWS Security Hub", successCount)
return nil
}
func (sh AWSSecurityHubClient) Terminate() error {
return nil
}
func (sh AWSSecurityHubClient) GetLayoutProvider() layout.LayoutProvider {
// Todo: This is MOCK. Because Formatting isn't need for Webhook
// todo: The App should work with `return nil`
return new(formatting.HtmlProvider)
}
func chunkBy[T any](items []T, chunkSize int) (chunks [][]T) {
for chunkSize < len(items) {
items, chunks = items[chunkSize:], append(chunks, items[0:chunkSize:chunkSize])
}
return append(chunks, items)
}
================================================
FILE: actions/aws_securityhub_test.go
================================================
package actions
import (
"context"
"fmt"
"testing"
"github.com/aws/aws-sdk-go-v2/aws"
"github.com/aws/aws-sdk-go-v2/service/securityhub"
"github.com/aws/aws-sdk-go-v2/service/securityhub/types"
"github.com/aws/smithy-go/middleware"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
const GoodFindings = `{
"Findings": [
{
"SchemaVersion": "2018-10-08",
"Id": "alpine:3.10 (alpine 3.10.9)/CVE-2021-36159",
"ProductArn": "arn:aws:securityhub:eu-west-2::product/aquasecurity/aquasecurity",
"GeneratorId": "Trivy/CVE-2021-36159",
"AwsAccountId": "000000",
"Types": [
"Software and Configuration Checks/Vulnerabilities/CVE"
],
"CreatedAt": "2022-08-05T22:29:18.549914-07:00",
"UpdatedAt": "2022-08-10T22:29:18.549938-07:00",
"Severity": {
"Label": "CRITICAL"
},
"Title": "Trivy found a vulnerability to CVE-2021-36159 in container alpine:3.10 (alpine 3.10.9)",
"Description": "libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric strings for the FTP and HTTP protocols. The FTP passive mode implementation allows an out-of-bounds read because strtol is used to parse the relevant numbers into address bytes. It does not check if the line ends prematurely. If it does, the for-loop condition checks for the '\\0' terminator one byte too late.",
"Remediation": {
"Recommendation": {
"Text": "More information on this vulnerability is provided in the hyperlink",
"Url": "https://avd.aquasec.com/nvd/cve-2021-36159"
}
},
"ProductFields": {
"Product Name": "Trivy"
},
"Resources": [
{
"Type": "Container",
"Id": "alpine:3.10 (alpine 3.10.9)",
"Partition": "aws",
"Region": "",
"Details": {
"Container": {
"ImageName": "alpine:3.10 (alpine 3.10.9)"
},
"Other": {
"CVE ID": "CVE-2021-36159",
"CVE Title": "",
"PkgName": "apk-tools",
"Installed Package": "2.10.6-r0",
"Patched Package": "2.10.7-r0",
"NvdCvssScoreV3": "9.1",
"NvdCvssVectorV3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"NvdCvssScoreV2": "6.4",
"NvdCvssVectorV2": "AV:N/AC:L/Au:N/C:P/I:N/A:P"
}
}
}
],
"RecordState": "ACTIVE"
},
{
"SchemaVersion": "2018-10-08",
"Id": "alpine:3.10 (alpine 3.10.9)/CVE-2021-36159",
"ProductArn": "arn:aws:securityhub:eu-west-2::product/aquasecurity/aquasecurity",
"GeneratorId": "Trivy/CVE-2021-36159",
"AwsAccountId": "000000",
"Types": [
"Software and Configuration Checks/Vulnerabilities/CVE"
],
"CreatedAt": "2022-08-05T22:29:18.549914-07:00",
"UpdatedAt": "2022-08-10T22:29:18.549938-07:00",
"Severity": {
"Label": "CRITICAL"
},
"Title": "Trivy found a vulnerability to CVE-2021-36159 in container alpine:3.10 (alpine 3.10.9)",
"Description": "libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric strings for the FTP and HTTP protocols. The FTP passive mode implementation allows an out-of-bounds read because strtol is used to parse the relevant numbers into address bytes. It does not check if the line ends prematurely. If it does, the for-loop condition checks for the '\\0' terminator one byte too late.",
"Remediation": {
"Recommendation": {
"Text": "More information on this vulnerability is provided in the hyperlink",
"Url": "https://avd.aquasec.com/nvd/cve-2021-36159"
}
},
"ProductFields": {
"Product Name": "Trivy"
},
"Resources": [
{
"Type": "Container",
"Id": "alpine:3.10 (alpine 3.10.9)",
"Partition": "aws",
"Region": "",
"Details": {
"Container": {
"ImageName": "alpine:3.10 (alpine 3.10.9)"
},
"Other": {
"CVE ID": "CVE-2021-36159",
"CVE Title": "",
"PkgName": "apk-tools",
"Installed Package": "2.10.6-r0",
"Patched Package": "2.10.7-r0",
"NvdCvssScoreV3": "9.1",
"NvdCvssVectorV3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"NvdCvssScoreV2": "6.4",
"NvdCvssVectorV2": "AV:N/AC:L/Au:N/C:P/I:N/A:P"
}
}
}
],
"RecordState": "ACTIVE"
}
]
}`
type mockAWSSHClient struct {
securityHubAPI
batchImportFindingsFunc func(ctx context.Context, params *securityhub.BatchImportFindingsInput, optFns ...func(*securityhub.Options)) (*securityhub.BatchImportFindingsOutput, error)
}
func (mc mockAWSSHClient) BatchImportFindings(ctx context.Context, params *securityhub.BatchImportFindingsInput, optFns ...func(*securityhub.Options)) (*securityhub.BatchImportFindingsOutput, error) {
if mc.batchImportFindingsFunc != nil {
return mc.batchImportFindingsFunc(ctx, params, optFns...)
}
return &securityhub.BatchImportFindingsOutput{}, nil
}
func TestAWSSecurityHubClient_Send(t *testing.T) {
t.Run("happy path, multiple findings", func(t *testing.T) {
ac := AWSSecurityHubClient{
client: &mockAWSSHClient{
batchImportFindingsFunc: func(ctx context.Context, params *securityhub.BatchImportFindingsInput, optFns ...func(*securityhub.Options)) (*securityhub.BatchImportFindingsOutput, error) {
t.Helper()
assert.Equal(t, 2, len(params.Findings))
return &securityhub.BatchImportFindingsOutput{
SuccessCount: 2,
}, nil
},
},
}
require.NoError(t, ac.Send(map[string]string{
"description": GoodFindings,
}), t.Name())
})
t.Run("happy path, no findings", func(t *testing.T) {
ac := AWSSecurityHubClient{
client: &mockAWSSHClient{
batchImportFindingsFunc: func(ctx context.Context, params *securityhub.BatchImportFindingsInput, optFns ...func(*securityhub.Options)) (*securityhub.BatchImportFindingsOutput, error) {
t.Helper()
assert.Fail(t, "this method should not have been called")
return nil, nil
},
},
}
require.Equal(t, "trivy AWS sent no findings to Postee, skipping sending", ac.Send(map[string]string{
"description": `{"Findings":[]}`,
}).Error(), t.Name())
})
t.Run("sad path, bad incoming event from trivy", func(t *testing.T) {
require.Equal(t, "AWS Security Hub unmarshalling failed: invalid character 'i' looking for beginning of value", AWSSecurityHubClient{}.Send(map[string]string{
"description": "invalid json",
}).Error())
})
t.Run("sad path, aws security hub fails has an error", func(t *testing.T) {
ac := AWSSecurityHubClient{
client: &mockAWSSHClient{
batchImportFindingsFunc: func(ctx context.Context, params *securityhub.BatchImportFindingsInput, optFns ...func(*securityhub.Options)) (*securityhub.BatchImportFindingsOutput, error) {
t.Helper()
return &securityhub.BatchImportFindingsOutput{}, fmt.Errorf("internal server error")
},
},
}
require.Equal(t, "upload to AWS Security Hub failed: internal server error", ac.Send(map[string]string{
"description": GoodFindings,
}).Error(), t.Name())
})
t.Run("sad path, aws security hub fails to ingest some findings", func(t *testing.T) {
ac := AWSSecurityHubClient{
client: &mockAWSSHClient{
batchImportFindingsFunc: func(ctx context.Context, params *securityhub.BatchImportFindingsInput, optFns ...func(*securityhub.Options)) (*securityhub.BatchImportFindingsOutput, error) {
t.Helper()
return &securityhub.BatchImportFindingsOutput{
FailedCount: 1,
SuccessCount: 1,
FailedFindings: []types.ImportFindingsError{
{
ErrorCode: aws.String("123"),
ErrorMessage: aws.String("bad bad"),
Id: aws.String("001"),
},
},
ResultMetadata: middleware.Metadata{},
}, nil
},
},
}
require.NoError(t, ac.Send(map[string]string{
"description": GoodFindings,
}), t.Name())
})
}
================================================
FILE: actions/dependencytrack.go
================================================
package actions
import (
"context"
"encoding/base64"
"encoding/json"
"fmt"
"log"
"strings"
dtrack "github.com/DependencyTrack/client-go"
"github.com/aquasecurity/postee/v2/formatting"
"github.com/aquasecurity/postee/v2/layout"
)
type DependencyTrackAction struct {
Name string
Url string
APIKey string
}
func (dta *DependencyTrackAction) GetName() string {
return dta.Name
}
func (dta *DependencyTrackAction) Init() error {
log.Printf("Starting Dependency Track action %s, for sending to %s", dta.Name, dta.Url)
return nil
}
func (dta *DependencyTrackAction) Send(content map[string]string) error {
project, ok := content["title"]
if !ok && project == "" {
return fmt.Errorf("title key not found")
}
projectAndVersion := strings.SplitN(project, ":", 2)
if len(projectAndVersion) != 2 {
return fmt.Errorf("title key has wrong format")
}
bom, err := json.Marshal(json.RawMessage(content["description"]))
if err != nil {
return fmt.Errorf("description key has wrong format: %w", err)
}
client, err := dtrack.NewClient(dta.Url, dtrack.WithAPIKey(dta.APIKey))
if err != nil {
return fmt.Errorf("failed to create dependency track client: %w", err)
}
ctx := context.Background()
_, err = client.BOM.Upload(ctx, dtrack.BOMUploadRequest{
ProjectName: projectAndVersion[0],
ProjectVersion: projectAndVersion[1],
AutoCreate: true,
BOM: base64.StdEncoding.EncodeToString(bom),
})
if err != nil {
return fmt.Errorf("failed to upload BOM: %w", err)
}
log.Printf("successfully sent: %q to Dependency Track", dta.Name)
return nil
}
func (dta *DependencyTrackAction) Terminate() error {
log.Printf("Dependency Track action %s terminated.", dta.Name)
return nil
}
func (dta *DependencyTrackAction) GetLayoutProvider() layout.LayoutProvider {
return new(formatting.HtmlProvider)
}
================================================
FILE: actions/dependencytrack_test.go
================================================
package actions
import (
"net/http"
"net/http/httptest"
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func TestDependencyTrackAction_Send(t *testing.T) {
bomJSON := `{
"$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
"bomFormat": "CycloneDX",
"specVersion": "1.4",
"serialNumber": "urn:uuid:78f7eeb2-25fd-45ce-9ece-63cf0ca9b1af",
"version": 1,
"metadata": {
"timestamp": "2023-07-26T07:42:41+00:00",
"tools": [
{
"vendor": "aquasecurity",
"name": "trivy",
"version": "0.43.1"
}
],
"component": {
"bom-ref": "pkg:oci/busybox@sha256:caa382c432891547782ce7140fb3b7304613d3b0438834dce1cad68896ab110a?repository_url=index.docker.io%2Flibrary%2Fbusybox\u0026arch=arm64",
"type": "container",
"name": "busybox:latest",
"purl": "pkg:oci/busybox@sha256:caa382c432891547782ce7140fb3b7304613d3b0438834dce1cad68896ab110a?repository_url=index.docker.io%2Flibrary%2Fbusybox\u0026arch=arm64",
"properties": [
{
"name": "aquasecurity:trivy:DiffID",
"value": "sha256:57d0c5e3b21e4fdac106cfee383d702b92cd433e6e45588153228670b616bc59"
},
{
"name": "aquasecurity:trivy:ImageID",
"value": "sha256:d38589532d9756ff743d2149a143bfad79833261ff18c24b22088183a651ff65"
},
{
"name": "aquasecurity:trivy:RepoDigest",
"value": "busybox@sha256:caa382c432891547782ce7140fb3b7304613d3b0438834dce1cad68896ab110a"
},
{
"name": "aquasecurity:trivy:RepoTag",
"value": "busybox:latest"
},
{
"name": "aquasecurity:trivy:SchemaVersion",
"value": "2"
}
]
}
},
"components": [],
"dependencies": [
{
"ref": "pkg:oci/busybox@sha256:caa382c432891547782ce7140fb3b7304613d3b0438834dce1cad68896ab110a?repository_url=index.docker.io%2Flibrary%2Fbusybox\u0026arch=arm64",
"dependsOn": []
}
],
"vulnerabilities": []
}`
type fields struct {
Name string
Url string
APIKey string
}
type args struct {
content map[string]string
}
tests := []struct {
name string
fields fields
args args
wantErr string
errMsg string
handlerFunc http.HandlerFunc
}{
{
name: "valid content JSON BOM",
fields: fields{
Name: "test",
APIKey: "key",
},
args: args{
content: map[string]string{
"title": "test-project:test-version",
"description": bomJSON,
},
},
handlerFunc: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusOK)
_, err := w.Write([]byte(`{"token":"6026693d-b182-4569-8ba1-0b2c0cc509be"}`))
if err != nil {
panic(err)
}
}),
},
{
name: "not found title",
fields: fields{
Name: "test",
APIKey: "key",
},
args: args{
content: map[string]string{
"description": bomJSON,
},
},
wantErr: "title key not found",
},
{
name: "invalid title format",
fields: fields{
Name: "test",
APIKey: "key",
},
args: args{
content: map[string]string{
"title": "invalid",
"description": bomJSON,
},
},
wantErr: "title key has wrong format",
},
{
name: "invalid description format",
fields: fields{
Name: "test",
APIKey: "key",
},
args: args{
content: map[string]string{
"title": "test-project:test-version",
"description": "invalid",
},
},
wantErr: "description key has wrong format: json: error calling MarshalJSON for type json.RawMessage: invalid character 'i' looking for beginning of value",
handlerFunc: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusOK)
}),
},
{
name: "failed to upload BOM",
fields: fields{
Name: "test",
APIKey: "invalid",
},
args: args{
content: map[string]string{
"title": "test-project:test-version",
"description": bomJSON,
},
},
wantErr: "failed to upload BOM: api error (status: 401)",
handlerFunc: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusUnauthorized)
}),
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
ts := httptest.NewServer(tt.handlerFunc)
defer ts.Close()
url := tt.fields.Url
if url == "" {
url = ts.URL
}
dta := &DependencyTrackAction{
Name: tt.fields.Name,
Url: url,
APIKey: tt.fields.APIKey,
}
err := dta.Send(tt.args.content)
if tt.wantErr != "" {
require.Error(t, err)
assert.Contains(t, err.Error(), tt.wantErr)
} else {
assert.NoError(t, err, tt.name)
}
})
}
}
================================================
FILE: actions/docker.go
================================================
package actions
import (
"bytes"
"context"
"encoding/json"
"fmt"
"log"
"strings"
"github.com/tidwall/gjson"
"github.com/aquasecurity/postee/v2/layout"
"github.com/docker/docker/api/types"
"github.com/docker/docker/api/types/container"
"github.com/docker/docker/api/types/mount"
"github.com/docker/docker/client"
"github.com/docker/docker/pkg/stdcopy"
"github.com/google/uuid"
)
type DockerClient struct {
client client.APIClient
uuidNew func() uuid.UUID
Name string
ImageName string
Cmd []string
Volumes map[string]string
Network string
Env []string
}
func (d DockerClient) GetName() string {
return d.Name
}
func (d *DockerClient) Init() error {
var err error
d.client, err = client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
if err != nil {
return fmt.Errorf("failed to initialize docker action: %w", err)
}
d.uuidNew = uuid.New
log.Println("docker action successfully initialized")
return nil
}
func (d DockerClient) Send(m map[string]string) error {
ctx := context.Background()
parsedCmd := d.parseCmd(m)
r, err := d.client.ImagePull(ctx, d.ImageName, types.ImagePullOptions{})
if err != nil {
return fmt.Errorf("docker action failed to pull docker image: %w", err)
}
defer r.Close()
var hc container.HostConfig
if len(d.Volumes) > 0 {
for src, dst := range d.Volumes {
hc.Mounts = append(hc.Mounts, mount.Mount{Type: mount.TypeBind, Source: src, Target: dst})
}
}
if len(d.Network) > 0 {
hc.NetworkMode = container.NetworkMode(d.Network)
}
env := append(d.Env, fmt.Sprintf(`POSTEE_EVENT="%s"`, m["description"]))
ctrName := fmt.Sprintf("postee-%s-%s", d.GetName(), d.uuidNew())
_, err = d.client.ContainerCreate(ctx, &container.Config{
Image: d.ImageName,
Cmd: parsedCmd,
Env: env,
}, &hc, nil, nil, ctrName)
if err != nil {
return fmt.Errorf("docker action failed to create docker container: %w", err)
}
defer func() {
_ = d.client.ContainerRemove(ctx, ctrName, types.ContainerRemoveOptions{Force: true})
}()
if err := d.client.ContainerStart(ctx, ctrName, types.ContainerStartOptions{}); err != nil {
return fmt.Errorf("docker action failed to start container: %w", err)
}
statusCh, errCh := d.client.ContainerWait(ctx, ctrName, container.WaitConditionNotRunning)
select {
case err := <-errCh:
if err != nil {
return fmt.Errorf("docker action failed running container: %w", err)
}
case <-statusCh:
}
out, err := d.client.ContainerLogs(ctx, ctrName, types.ContainerLogsOptions{
ShowStdout: true})
if err != nil {
return fmt.Errorf("docker action unable to fetch container logs: %w", err)
}
var buf bytes.Buffer
_, _ = stdcopy.StdCopy(&buf, &buf, out)
log.Println("docker action ran successfully, container logs: ", buf.String())
return nil
}
func (d DockerClient) Terminate() error {
if err := d.client.Close(); err != nil {
return fmt.Errorf("docker action unable to terminate: %w", err)
}
log.Println("docker action terminated successfully")
return nil
}
func (d DockerClient) GetLayoutProvider() layout.LayoutProvider {
return nil
}
func (d DockerClient) parseCmd(input map[string]string) (parsedCmds []string) {
for _, c := range d.Cmd {
var calcVal string
if strings.HasPrefix(c, regoInputPrefix) {
if ok := json.Valid([]byte(input["description"])); ok { // input is json
calcVal = gjson.Get(input["description"], strings.TrimPrefix(c, regoInputPrefix+".")).String()
} else {
calcVal = input["description"] // input is a string
}
} else {
calcVal = c // no rego to parse
}
parsedCmds = append(parsedCmds, calcVal)
}
return
}
================================================
FILE: actions/docker_test.go
================================================
package actions
import (
"context"
"fmt"
"io"
"net/http"
"strings"
"testing"
"github.com/docker/docker/api/types"
containertypes "github.com/docker/docker/api/types/container"
"github.com/docker/docker/api/types/mount"
networktypes "github.com/docker/docker/api/types/network"
"github.com/docker/docker/client"
"github.com/google/uuid"
specs "github.com/opencontainers/image-spec/specs-go/v1"
"github.com/stretchr/testify/assert"
)
type mockDockerClient struct {
client.APIClient
imagePull func(ctx context.Context, ref string, options types.ImagePullOptions) (io.ReadCloser, error)
containerCreate func(ctx context.Context, config *containertypes.Config, hostConfig *containertypes.HostConfig, networkingConfig *networktypes.NetworkingConfig, platform *specs.Platform, containerName string) (containertypes.ContainerCreateCreatedBody, error)
containerStart func(ctx context.Context, container string, options types.ContainerStartOptions) error
containerWait func(ctx context.Context, container string, condition containertypes.WaitCondition) (<-chan containertypes.ContainerWaitOKBody, <-chan error)
containerLogs func(ctx context.Context, container string, options types.ContainerLogsOptions) (io.ReadCloser, error)
containerRemove func(ctx context.Context, container string, options types.ContainerRemoveOptions) error
}
func (m mockDockerClient) ImagePull(ctx context.Context, ref string, options types.ImagePullOptions) (io.ReadCloser, error) {
if m.imagePull != nil {
return m.imagePull(ctx, ref, options)
}
return io.NopCloser(strings.NewReader(`pulling image foo bar`)), nil
}
func (m mockDockerClient) ContainerCreate(ctx context.Context, config *containertypes.Config, hostConfig *containertypes.HostConfig, networkingConfig *networktypes.NetworkingConfig, platform *specs.Platform, containerName string) (containertypes.ContainerCreateCreatedBody, error) {
if m.containerCreate != nil {
return m.containerCreate(ctx, config, hostConfig, networkingConfig, platform, containerName)
}
return containertypes.ContainerCreateCreatedBody{
ID: "foo-bar-123",
}, nil
}
func (m mockDockerClient) ContainerStart(ctx context.Context, container string, options types.ContainerStartOptions) error {
if m.containerStart != nil {
return m.containerStart(ctx, container, options)
}
return nil
}
func (m mockDockerClient) ContainerWait(ctx context.Context, container string, condition containertypes.WaitCondition) (<-chan containertypes.ContainerWaitOKBody, <-chan error) {
if m.containerWait != nil {
return m.containerWait(ctx, container, condition)
}
resultC := make(chan containertypes.ContainerWaitOKBody)
errC := make(chan error)
go func() {
resultC <- containertypes.ContainerWaitOKBody{
Error: nil,
StatusCode: http.StatusOK,
}
errC <- nil
}()
return resultC, errC
}
func (m mockDockerClient) ContainerLogs(ctx context.Context, container string, options types.ContainerLogsOptions) (io.ReadCloser, error) {
if m.containerLogs != nil {
return m.containerLogs(ctx, container, options)
}
return io.NopCloser(strings.NewReader("the logs of joy")), nil
}
func (m mockDockerClient) ContainerRemove(ctx context.Context, container string, options types.ContainerRemoveOptions) error {
if m.containerRemove != nil {
return m.containerRemove(ctx, container, options)
}
return nil
}
type mockUUID struct {
}
func (mockUUID) New() uuid.UUID {
return uuid.MustParse("1471d64a-6c64-4527-bbd8-7bc772678db8")
}
func TestDocketClient_Send(t *testing.T) {
testCases := []struct {
name string
inputEvent string
inputDockerCmd []string
imagePullFunc func(context.Context, string, types.ImagePullOptions) (io.ReadCloser, error)
containerCreateFunc func(ctx context.Context, config *containertypes.Config, hostConfig *containertypes.HostConfig, networkingConfig *networktypes.NetworkingConfig, platform *specs.Platform, containerName string) (containertypes.ContainerCreateCreatedBody, error)
containerRemoveFunc func(ctx context.Context, container string, options types.ContainerRemoveOptions) error
containerWaitFunc func(ctx context.Context, container string, condition containertypes.WaitCondition) (<-chan containertypes.ContainerWaitOKBody, <-chan error)
containerStartFunc func(ctx context.Context, container string, options types.ContainerStartOptions) error
containerLogsFunc func(ctx context.Context, container string, options types.ContainerLogsOptions) (io.ReadCloser, error)
expectedError string
expectedLogs string
}{
{
name: "happy path, string input event",
inputEvent: `foo bar baz`,
expectedLogs: "the logs of joy",
containerCreateFunc: func(ctx context.Context, config *containertypes.Config, hostConfig *containertypes.HostConfig, networkingConfig *networktypes.NetworkingConfig, platform *specs.Platform, containerName string) (containertypes.ContainerCreateCreatedBody, error) {
assert.Equal(t, containertypes.Config{
Image: "docker.io/library/alpine",
Cmd: []string{"echo", "hello world"},
Env: []string{"FOO=bar", `POSTEE_EVENT="foo bar baz"`},
}, *config)
assert.Equal(t, containertypes.HostConfig{
Mounts: []mount.Mount{{Type: mount.TypeBind, Source: "foo-src", Target: "bar-dst"}}, NetworkMode: "host",
}, *hostConfig)
assert.Contains(t, containerName, "postee-my-docker-action")
return containertypes.ContainerCreateCreatedBody{
ID: "foo-bar-123",
}, nil
},
containerRemoveFunc: func(ctx context.Context, container string, options types.ContainerRemoveOptions) error {
assert.Equal(t, "postee-my-docker-action-1471d64a-6c64-4527-bbd8-7bc772678db8", container)
return nil
},
},
{
name: "happy path, relative json input event",
inputEvent: `{"hostname":"foo.host"}`,
inputDockerCmd: []string{"kubectl", "delete", "pod", "event.input.hostname"},
expectedLogs: "the logs of joy",
containerCreateFunc: func(ctx context.Context, config *containertypes.Config, hostConfig *containertypes.HostConfig, networkingConfig *networktypes.NetworkingConfig, platform *specs.Platform, containerName string) (containertypes.ContainerCreateCreatedBody, error) {
assert.Equal(t, containertypes.Config{
Image: "docker.io/library/alpine",
Cmd: []string{"kubectl", "delete", "pod", "foo.host"},
Env: []string{"FOO=bar", `POSTEE_EVENT="{"hostname":"foo.host"}"`},
}, *config)
assert.Equal(t, containertypes.HostConfig{
Mounts: []mount.Mount{{Type: mount.TypeBind, Source: "foo-src", Target: "bar-dst"}}, NetworkMode: "host",
}, *hostConfig)
assert.Contains(t, containerName, "postee-my-docker-action")
return containertypes.ContainerCreateCreatedBody{
ID: "foo-bar-123",
}, nil
},
containerRemoveFunc: func(ctx context.Context, container string, options types.ContainerRemoveOptions) error {
assert.Equal(t, "postee-my-docker-action-1471d64a-6c64-4527-bbd8-7bc772678db8", container)
return nil
},
},
{
name: "sad path, ImagePull returns an error",
imagePullFunc: func(ctx context.Context, s string, options types.ImagePullOptions) (io.ReadCloser, error) {
return nil, fmt.Errorf("failed to pull image")
},
expectedError: "docker action failed to pull docker image: failed to pull image",
},
{
name: "sad path, ContainerCreate returns an error",
containerCreateFunc: func(ctx context.Context, config *containertypes.Config, hostConfig *containertypes.HostConfig, networkingConfig *networktypes.NetworkingConfig, platform *specs.Platform, containerName string) (containertypes.ContainerCreateCreatedBody, error) {
return containertypes.ContainerCreateCreatedBody{}, fmt.Errorf("container creation failed")
},
expectedError: "docker action failed to create docker container: container creation failed",
},
{
name: "sad path, ContainerStart returns an error",
containerStartFunc: func(ctx context.Context, container string, options types.ContainerStartOptions) error {
return fmt.Errorf("failed to start")
},
expectedError: "docker action failed to start container: failed to start",
},
{
name: "sad path, ContainerWait returns an error",
containerWaitFunc: func(ctx context.Context, container string, condition containertypes.WaitCondition) (<-chan containertypes.ContainerWaitOKBody, <-chan error) {
errC := make(chan error)
go func() {
errC <- fmt.Errorf("failed to wait")
}()
return nil, errC
},
expectedError: "docker action failed running container: failed to wait",
},
{
name: "sad path, ContainerLogs returns an error",
containerLogsFunc: func(ctx context.Context, container string, options types.ContainerLogsOptions) (io.ReadCloser, error) {
return nil, fmt.Errorf("failed to get logs")
},
expectedError: "docker action unable to fetch container logs: failed to get logs",
},
}
for _, tc := range testCases {
t.Run(tc.name, func(t *testing.T) {
dc := DockerClient{
Name: "my-docker-action",
ImageName: "docker.io/library/alpine",
Env: []string{"FOO=bar"},
Network: "host",
Volumes: map[string]string{
"foo-src": "bar-dst",
},
client: &mockDockerClient{
imagePull: tc.imagePullFunc,
containerCreate: tc.containerCreateFunc,
containerRemove: tc.containerRemoveFunc,
containerWait: tc.containerWaitFunc,
containerStart: tc.containerStartFunc,
containerLogs: tc.containerLogsFunc,
},
uuidNew: mockUUID{}.New,
}
switch {
case tc.inputDockerCmd != nil:
dc.Cmd = tc.inputDockerCmd
default:
dc.Cmd = []string{"echo", "hello world"}
}
err := dc.Send(map[string]string{"description": tc.inputEvent})
if tc.expectedError != "" {
assert.Equal(t, tc.expectedError, err.Error(), tc.name)
} else {
assert.NoError(t, err, tc.name)
}
})
}
}
================================================
FILE: actions/email.go
================================================
package actions
import (
"crypto/tls"
"errors"
"fmt"
"log"
"net"
"net/smtp"
"strconv"
"strings"
"github.com/aquasecurity/postee/v2/formatting"
"github.com/aquasecurity/postee/v2/layout"
)
var (
errThereIsNoRecipient = errors.New("there is no recipient")
lookupMXFunc = net.LookupMX
)
type EmailAction struct {
Name string
User string
Password string
Host string
Port int
Sender string
Recipients []string
ClientHostName string
UseMX bool
sendFunc func(addr string, a smtp.Auth, from string, to []string, msg []byte) error
}
func (email *EmailAction) GetName() string {
return email.Name
}
func (email *EmailAction) Init() error {
log.Printf("Starting Email action %q...", email.Name)
if email.Sender == "" {
email.Sender = email.User
}
if email.ClientHostName != "" {
log.Printf("Action %q uses a custom client name %q instead of `localhost`", email.Name, email.ClientHostName)
email.sendFunc = email.sendEmailWithCustomClient
} else {
email.sendFunc = smtp.SendMail
}
return nil
}
func (email *EmailAction) Terminate() error {
log.Printf("Email action terminated\n")
return nil
}
func (email *EmailAction) GetLayoutProvider() layout.LayoutProvider {
return new(formatting.HtmlProvider)
}
func (email *EmailAction) Send(content map[string]string) error {
subject := content["title"]
body := content["description"]
port := strconv.Itoa(email.Port)
recipients := getHandledRecipients(email.Recipients, &content, email.Name)
if len(recipients) == 0 {
return errThereIsNoRecipient
}
msg := fmt.Sprintf(
"To: %s\r\n"+
"From: %s\r\n"+
"Subject: %s\r\n"+
"Content-Type: text/html; charset=UTF-8\r\n\r\n%s\r\n",
strings.Join(recipients, ","), email.Sender, subject, body)
if email.UseMX {
email.sendViaMxServers(port, msg, recipients)
return nil
}
var auth smtp.Auth
if len(email.Password) > 0 && len(email.User) > 0 {
auth = smtp.PlainAuth("", email.User, email.Password, email.Host)
}
err := email.sendFunc(email.Host+":"+port, auth, email.Sender, recipients, []byte(msg))
if err != nil {
log.Println("SendMail Error:", err)
log.Printf("From: %q, to %v via %q", email.Sender, email.Recipients, email.Host)
return err
}
log.Println("Email was sent successfully!")
return nil
}
// sendEmailWithCustomClient replaces smtp.SendMail() in cases
// where it is necessary to establish a custom client host name instead of "localhost",
// while keeping the remaining behavior unchanged.
func (email EmailAction) sendEmailWithCustomClient(addr string, a smtp.Auth, from string, to []string, msg []byte) error {
log.Printf("Sending an email via Custom client for action %q", email.Name)
c, err := smtp.Dial(addr)
if err != nil {
return err
}
defer c.Close()
if err := c.Hello(email.ClientHostName); err != nil {
return err
}
if ok, _ := c.Extension("STARTTLS"); ok {
config := &tls.Config{ServerName: email.Host}
if err = c.StartTLS(config); err != nil {
return err
}
}
if a != nil {
if err = c.Auth(a); err != nil {
return err
}
}
if err = c.Mail(from); err != nil {
return err
}
for _, addr := range to {
if err = c.Rcpt(addr); err != nil {
return err
}
}
w, err := c.Data()
if err != nil {
return err
}
_, err = w.Write(msg)
if err != nil {
return err
}
err = w.Close()
if err != nil {
return err
}
return c.Quit()
}
func (email EmailAction) sendViaMxServers(port string, msg string, recipients []string) {
for _, rcpt := range recipients {
at := strings.LastIndex(rcpt, "@")
if at < 0 {
log.Printf("%q isn't email", rcpt)
continue
}
host := rcpt[at+1:]
mxs, err := lookupMXFunc(host)
if err != nil {
log.Println("error looking up mx host: ", err)
continue
}
for _, mx := range mxs {
if err := email.sendFunc(mx.Host+":"+port, nil, email.Sender, recipients, []byte(msg)); err != nil {
log.Printf("SendMail error to %q via %q", rcpt, mx.Host)
log.Println("error: ", err)
continue
}
log.Printf("The message to %q was sent successful via %q!", rcpt, mx.Host)
break
}
}
}
================================================
FILE: actions/email_test.go
================================================
package actions
import (
"fmt"
"net"
"net/smtp"
"testing"
"github.com/stretchr/testify/assert"
)
func mockSend(errToReturn error, emailSent *int) (func(string, smtp.Auth, string, []string, []byte) error, *emailRecorder) {
r := new(emailRecorder)
return func(addr string, a smtp.Auth, from string, to []string, msg []byte) error {
*r = emailRecorder{addr, a, from, to, msg}
if errToReturn == nil {
*emailSent++
}
return errToReturn
}, r
}
type emailRecorder struct {
addr string
auth smtp.Auth
from string
to []string
msg []byte
}
func TestEmailAction_Send(t *testing.T) {
testCases := []struct {
name string
lookupMXFunc func(name string) ([]*net.MX, error)
emailAction *EmailAction
expectedMessage string
sendError error
expectedError error
expectedSentEmails int
}{
{
name: "happy path, with auth, server supports auth",
expectedMessage: fmt.Sprintf("To: anything@fubar.com\r\n" +
"From: sender@mailer.com\r\n" +
"Subject: email subject\r\n" +
"Content-Type: text/html; charset=UTF-8\r\n" +
"\r\n" +
"foo bar baz body\r\n"),
expectedSentEmails: 1,
},
{
name: "happy path, use multiple mx servers, no auth",
lookupMXFunc: func(name string) ([]*net.MX, error) {
return []*net.MX{
{
Host: "127.0.0.1",
},
{
Host: "128.0.0.1",
},
}, nil
},
expectedMessage: fmt.Sprintf("To: anything@fubar.com\r\n" +
"From: sender@mailer.com\r\n" +
"Subject: email subject\r\n" +
"Content-Type: text/html; charset=UTF-8\r\n" +
"\r\n" +
"foo bar baz body\r\n"),
expectedSentEmails: 1,
},
{
name: "sad path, no recipients",
emailAction: &EmailAction{Recipients: []string{}},
expectedError: errThereIsNoRecipient,
},
{
name: "sad path, client uses AUTH, smtp server does not support AUTH",
sendError: fmt.Errorf("smtp: server doesn't support AUTH"),
expectedError: fmt.Errorf("smtp: server doesn't support AUTH"),
expectedMessage: "",
expectedSentEmails: 0,
},
{
name: "sad path, use mx server, invalid recipient,",
emailAction: &EmailAction{
Name: "my-email",
User: "user",
Password: "pass",
Host: "127.0.0.1",
Port: 587,
Sender: "sender@mailer.com",
Recipients: []string{"invalid recipient"},
UseMX: true,
},
expectedSentEmails: 0,
},
{
name: "sad path, no mx server available",
lookupMXFunc: func(name string) ([]*net.MX, error) {
return []*net.MX{}, fmt.Errorf("no such host")
},
expectedSentEmails: 0,
},
{
name: "sad path, use mx servers, error sending email",
lookupMXFunc: func(name string) ([]*net.MX, error) {
return []*net.MX{
{
Host: "127.0.0.1",
},
}, nil
},
expectedMessage: fmt.Sprintf("To: anything@fubar.com\r\n" +
"From: sender@mailer.com\r\n" +
"Subject: email subject\r\n" +
"Content-Type: text/html; charset=UTF-8\r\n" +
"\r\n" +
"foo bar baz body\r\n"),
sendError: fmt.Errorf("internal server error"),
expectedSentEmails: 0,
},
}
for _, tc := range testCases {
t.Run(tc.name, func(t *testing.T) {
var eo EmailAction
if tc.emailAction != nil {
eo = *tc.emailAction
} else {
eo = EmailAction{
Name: "my-email",
User: "user",
Password: "pass",
Host: "127.0.0.1",
Port: 587,
Sender: "sender@mailer.com",
Recipients: []string{"anything@fubar.com"},
}
}
var emailsSent int
f, r := mockSend(tc.sendError, &emailsSent)
eo.sendFunc = f
if tc.lookupMXFunc != nil {
oldLookupMXFunc := lookupMXFunc
lookupMXFunc = tc.lookupMXFunc
defer func() {
lookupMXFunc = oldLookupMXFunc
}()
eo.UseMX = true
}
err := eo.Send(map[string]string{"description": "foo bar baz body", "title": "email subject"})
switch {
case tc.expectedError != nil:
assert.Equal(t, tc.expectedError, err, tc.name)
assert.Equal(t, tc.expectedSentEmails, emailsSent, tc.name)
default:
assert.NoError(t, err, tc.name)
assert.Equal(t, tc.expectedSentEmails, emailsSent, tc.name)
assert.Equal(t, tc.expectedMessage, string(r.msg), tc.name)
}
})
}
}
================================================
FILE: actions/example/exec/defectdojo-curl-upload-scan.sh
================================================
#!/usr/bin/env sh
# this shell script is meant to be executed by a Aquasec/Postee "exec"
# action, the event data is passed in through environment variable
# POSTEE_EVENT
#
# Requirements on JSON format
# ---------------------------
# - JSON dictionary with "defectdojo" as top-level key
# - "defectdojo" dictionary holds at least 2 keys
# - "scan", containing the report
# - "metadata", containing key/value pairs
#
# Required parameter
# ------------------
# - DEFECTDOJO_URL - Defectdojo URL, base URL, script appends path for v2
# - DEFECTDOJO_API_TOKEN
# - POSTEE_EVENT - variable containing the JSON content from template stage
TEMP_PREFIX="/tmp/dd-scan-"
if [ -z "$DEFECTDOJO_API_TOKEN" ]; then
echo "ERROR: could not find environment variable DEFECTDOJO_API_TOKEN"
exit 1
fi
if [ -z "$DEFECTDOJO_URL" ]; then
echo "could not find environment variable DEFECTDOJO_URL"
exit 1
fi
if [ -z "$POSTEE_EVENT" ]; then
echo "could not read any input data from POSTEE_EVENT"
exit 1
fi
# shellcheck disable=SC2317 # used in signal trap for EXIT
_cleanup() {
rm -f "${TEMP_PREFIX}*"
}
trap _cleanup EXIT
# write a temporary file with content received from POSTEE_EVENT
TMP_FILE="$(mktemp ${TEMP_PREFIX}XXXXXX)"
_validate_json()
{
if echo "$POSTEE_EVENT" | jq '.defectdojo.scan' | grep 'null' 1>/dev/null; then
echo "ERROR => JSON, unexpected structure \"defectdojo\""
return 1
fi
}
if ! _validate_json; then
exit 1
fi
echo "$POSTEE_EVENT" | jq '.defectdojo.scan' | tee "$TMP_FILE"
# Initialize the command string
COMMAND="curl -X POST -H \"Authorization: Token $DEFECTDOJO_API_TOKEN\""
# extract all key/value pairs from metadata key
# convert the resulting dictionary into multiline
# string => $key=$value, can further be consumed
# in a FOR loop generating a FORM entry per row
FORM_ENTRIES=$(echo "$POSTEE_EVENT" | jq '.defectdojo.metadata | keys_unsorted[] as $k | "\($k)=\( .[$k])"')
# to be able to ignore whitespaces in values,
# separator for FOR loops is configured to
# a newline character, remove unset IFS
OLD_IFS="$IFS"
# shellcheck disable=SC3003
IFS=$'\n'
for entry in $FORM_ENTRIES; do
COMMAND="$COMMAND -F $entry"
done
IFS="$OLD_IFS"
DD_IMPORT_URL="${DEFECTDOJO_URL}/api/v2/import-scan/"
# add URL and final JSON payload (trivy report)
COMMAND="$COMMAND -F \"file=@${TMP_FILE}\" ${DD_IMPORT_URL}"
if ! eval "$COMMAND"; then
echo "ERROR: failed to send scan-report to ${DD_IMPORT_URL}"
exit 1
fi
echo "SUCCESS: send scan-report to ${DD_IMPORT_URL}"
exit 0
================================================
FILE: actions/exec.go
================================================
package actions
import (
"fmt"
"log"
"os"
"os/exec"
"strings"
"github.com/aquasecurity/postee/v2/formatting"
"github.com/aquasecurity/postee/v2/layout"
)
type execCmd = func(string, ...string) *exec.Cmd
type ExecClient struct {
ExecCmd execCmd
Name string
Env []string
InputFile string
ExecScript string
Action []byte
}
func (e *ExecClient) GetName() string {
return e.Name
}
func (e *ExecClient) Init() error {
e.ExecCmd = exec.Command
return nil
}
func (e *ExecClient) Send(m map[string]string) error {
envVars := os.Environ()
envVars = append(envVars, e.Env...)
envVars = append(envVars, fmt.Sprintf("POSTEE_EVENT=%s", m["description"]))
var cmd *exec.Cmd
if len(e.InputFile) > 0 {
cmd = e.ExecCmd("/bin/sh", e.InputFile)
cmd.Env = append(cmd.Env, envVars...)
}
if len(e.ExecScript) > 0 {
cmd = e.ExecCmd("/bin/sh")
cmd.Env = append(cmd.Env, envVars...)
cmd.Stdin = strings.NewReader(e.ExecScript)
}
var err error
if e.Action, err = cmd.CombinedOutput(); err != nil {
return fmt.Errorf("error while executing script: %w, output: %s", err, string(e.Action))
}
log.Println("execution output: ", "len: ", len(e.Action), "out: ", string(e.Action))
return nil
}
func (e *ExecClient) Terminate() error {
log.Printf("Exec action %s terminated\n", e.GetName())
return nil
}
func (e *ExecClient) GetLayoutProvider() layout.LayoutProvider {
// Todo: This is MOCK. Because Formatting isn't need for Webhook
// todo: The App should work with `return nil`
return new(formatting.HtmlProvider)
}
================================================
FILE: actions/exec_test.go
================================================
package actions
import (
"fmt"
"io/ioutil"
"os"
"os/exec"
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func fakeExecCmdFailure(command string, args ...string) *exec.Cmd {
cs := []string{"-test.run=TestShellProcessFail", "--", command}
cs = append(cs, args...)
cmd := exec.Command(os.Args[0], cs...)
cmd.Env = []string{"GO_TEST_PROCESS=1"}
return cmd
}
func TestShellProcessFail(t *testing.T) {
if os.Getenv("GO_TEST_PROCESS") != "1" {
return
}
fmt.Fprint(os.Stderr, "failure")
os.Exit(1)
}
func TestExecClient_Init(t *testing.T) {
ec := ExecClient{}
require.NoError(t, ec.Init())
}
func TestExecClient_GetName(t *testing.T) {
ec := ExecClient{Name: "my-exec-action"}
require.NoError(t, ec.Init())
require.Equal(t, "my-exec-action", ec.GetName())
}
func TestExecClient_Send(t *testing.T) {
t.Run("happy path", func(t *testing.T) {
f, err := ioutil.TempFile("", "TestExecClient_Send-*")
require.NoError(t, err)
defer func() { os.RemoveAll(f.Name()) }()
_, _ = f.WriteString(`#!/bin/sh
echo "foo"
echo $POSTEE_EVENT
echo $INPUT_ENV`)
ec := ExecClient{
ExecCmd: exec.Command,
InputFile: f.Name(),
Env: []string{"INPUT_ENV=input foo env var"},
}
require.NoError(t, ec.Send(map[string]string{
"description": "foo bar baz env variable",
}))
assert.Equal(t, `foo
foo bar baz env variable
input foo env var
`, string(ec.Action))
assert.Equal(t, ec.Env, []string{"INPUT_ENV=input foo env var"})
})
t.Run("sad path - exec fails", func(t *testing.T) {
ec := ExecClient{
ExecScript: `#!/bin/sh
echo "foo bar baz"`,
ExecCmd: fakeExecCmdFailure,
}
require.EqualError(t, ec.Send(map[string]string{
"description": "foo bar baz",
}), "error while executing script: exit status 1, output: failure")
})
}
================================================
FILE: actions/goldens/validbody.txt
================================================
foo bar baz body
================================================
FILE: actions/http.go
================================================
package actions
import (
"encoding/base64"
"encoding/json"
"fmt"
"io"
"log"
"net/http"
"net/url"
"os"
"regexp"
"strings"
"github.com/aquasecurity/postee/v2/layout"
"github.com/tidwall/gjson"
)
var (
regoInputRegex = fmt.Sprintf(`(%s).*(.*)`, regoInputPrefix)
)
type HTTPClient struct {
Name string
Client http.Client
URL *url.URL
Method string
BodyFile string
BodyContent string
Headers map[string][]string
}
func (hc *HTTPClient) GetName() string {
return hc.Name
}
func (hc *HTTPClient) Init() error {
return nil
}
func (hc HTTPClient) Send(m map[string]string) error {
// encode headers as base64 to conform HTTP spec
// https://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2
pe := base64.StdEncoding.EncodeToString([]byte(m["description"]))
req, err := http.NewRequest(hc.Method, hc.URL.String(), nil)
if err != nil {
return fmt.Errorf("unable to initialize http request err: %w", err)
}
req.Header.Add("Postee-Event", pe) // preserve and transmit postee header
for k, vals := range hc.Headers {
for _, val := range vals {
req.Header.Add(k, val)
}
}
if len(hc.BodyFile) > 0 {
bf, err := os.Open(hc.BodyFile)
if err != nil {
return fmt.Errorf("unable to read body file: %s, err: %w", hc.BodyFile, err)
}
req.Body = bf
}
if len(hc.BodyContent) > 0 {
req.Body = io.NopCloser(strings.NewReader(parseBody(m, hc.BodyContent)))
}
resp, err := hc.Client.Do(req)
if err != nil {
log.Println("error during HTTP Client execution: ", err.Error())
return err
}
defer resp.Body.Close()
b, err := io.ReadAll(resp.Body)
if err != nil {
return fmt.Errorf("unable to read HTTP response: %w", err)
}
if resp.StatusCode < 200 || resp.StatusCode > 299 {
return fmt.Errorf("http status NOT OK: HTTP %d %s, response: %s", resp.StatusCode, http.StatusText(resp.StatusCode), string(b))
}
log.Printf("http %s execution to url %s successful", hc.Method, hc.URL)
return nil
}
func parseBody(inputEvent map[string]string, bodyContent string) string {
re := regexp.MustCompile(regoInputRegex)
subs := re.FindAllString(bodyContent, -1)
if subs == nil {
return bodyContent
}
for _, sub := range subs {
if ok := json.Valid([]byte(inputEvent["description"])); ok {
bodyContent = strings.Replace(bodyContent, sub, gjson.Get(inputEvent["description"], strings.TrimPrefix(sub, "event.input.")).String(), 1)
} else {
bodyContent = strings.Replace(bodyContent, "event.input", inputEvent["description"], 1)
}
}
return bodyContent
}
func (hc HTTPClient) Terminate() error {
log.Printf("HTTP action terminated\n")
return nil
}
func (hc HTTPClient) GetLayoutProvider() layout.LayoutProvider {
return nil
}
================================================
FILE: actions/http_test.go
================================================
package actions
import (
"io/ioutil"
"net/http"
"net/http/httptest"
"net/url"
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
func TestHTTPClient_Init(t *testing.T) {
ec := HTTPClient{}
require.NoError(t, ec.Init())
}
func TestHTTPClient_GetName(t *testing.T) {
ec := HTTPClient{Name: "my-http-action"}
require.NoError(t, ec.Init())
require.Equal(t, "my-http-action", ec.GetName())
}
func TestHTTPClient_Send(t *testing.T) {
testCases := []struct {
name string
method string
inputEvent string
bodyFile string
bodyContent string
testServerFunc http.HandlerFunc
expectedError string
}{
{
name: "happy path method get",
method: http.MethodGet,
testServerFunc: func(w http.ResponseWriter, r *http.Request) {
assert.Equal(t, []string{"bar", "baz"}, r.Header.Values("fookey"))
assert.Empty(t, r.Header.Get("Postee-Event")) // no event sent
},
},
{
name: "happy path method post with body file, string input event",
method: http.MethodPost,
bodyFile: "goldens/validbody.txt",
inputEvent: "foo bar baz header",
testServerFunc: func(w http.ResponseWriter, r *http.Request) {
assert.Equal(t, []string{"bar", "baz"}, r.Header.Values("fookey"))
assert.Equal(t, "Zm9vIGJhciBiYXogaGVhZGVy", r.Header.Get("Postee-Event"))
b, _ := ioutil.ReadAll(r.Body)
assert.Equal(t, "foo bar baz body", string(b))
},
},
{
name: "happy path method post with body content, string input event",
method: http.MethodPost,
bodyContent: "foo bar baz body",
inputEvent: "foo bar baz header",
testServerFunc: func(w http.ResponseWriter, r *http.Request) {
assert.Equal(t, []string{"bar", "baz"}, r.Header.Values("fookey"))
assert.Equal(t, "Zm9vIGJhciBiYXogaGVhZGVy", r.Header.Get("Postee-Event"))
b, _ := ioutil.ReadAll(r.Body)
assert.Equal(t, "foo bar baz body", string(b))
},
},
{
name: "happy path method post, json input event",
method: http.MethodPost,
bodyFile: "goldens/validbody.txt",
inputEvent: `{
"argsNum": 2
}`,
testServerFunc: func(w http.ResponseWriter, r *http.Request) {
assert.Equal(t, []string{"bar", "baz"}, r.Header.Values("fookey"))
assert.Equal(t, "ewoJImFyZ3NOdW0iOiAyCn0=", r.Header.Get("Postee-Event"))
b, _ := ioutil.ReadAll(r.Body)
assert.Equal(t, "foo bar baz body", string(b))
},
},
{
name: "happy path method post, with relative body content, json input event",
method: http.MethodPost,
bodyContent: `argsNum: event.input.argsNum
eventID: event.input.eventID`,
inputEvent: `{
"argsNum": 2,
"eventID": "TRC-2"
}`,
testServerFunc: func(w http.ResponseWriter, r *http.Request) {
assert.Equal(t, []string{"bar", "baz"}, r.Header.Values("fookey"))
assert.Equal(t, "ewoJImFyZ3NOdW0iOiAyLAoJImV2ZW50SUQiOiAiVFJDLTIiCn0=", r.Header.Get("Postee-Event"))
b, _ := ioutil.ReadAll(r.Body)
assert.Equal(t, `argsNum: 2
eventID: TRC-2`, string(b))
},
},
{
name: "happy path method post, with relative body content, string input event",
method: http.MethodPost,
bodyContent: `event1: event.input
event1: event.input`,
inputEvent: `"argsNum": 2, "eventID": "TRC-2"`,
testServerFunc: func(w http.ResponseWriter, r *http.Request) {
assert.Equal(t, []string{"bar", "baz"}, r.Header.Values("fookey"))
assert.Equal(t, "ImFyZ3NOdW0iOiAyLCAiZXZlbnRJRCI6ICJUUkMtMiI=", r.Header.Get("Postee-Event"))
b, _ := ioutil.ReadAll(r.Body)
assert.Equal(t, `event1: "argsNum": 2, "eventID": "TRC-2"
event1: "argsNum": 2, "eventID": "TRC-2"`, string(b))
},
},
{
name: "sad path method get - server unavailable",
method: http.MethodGet,
testServerFunc: func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusInternalServerError)
_, _ = w.Write([]byte("internal server error"))
},
expectedError: "http status NOT OK: HTTP 500 Internal Server Error, response: internal server error",
},
{
name: "sad path method get - bad url",
method: http.MethodGet,
expectedError: `Get "path-to-nowhere": unsupported protocol scheme ""`,
},
{
name: "sad path, body file not found",
method: http.MethodPost,
bodyFile: "invalid.txt",
expectedError: "unable to read body file: invalid.txt, err: open invalid.txt: no such file or directory",
},
}
for _, tc := range testCases {
t.Run(tc.name, func(t *testing.T) {
var testUrl *url.URL
if tc.testServerFunc != nil {
ts := httptest.NewServer(tc.testServerFunc)
testUrl, _ = url.Parse(ts.URL)
} else {
testUrl, _ = url.Parse("path-to-nowhere")
}
ec := HTTPClient{
URL: testUrl,
Method: tc.method,
Headers: map[string][]string{"fookey": {"bar", "baz"}},
BodyFile: tc.bodyFile,
BodyContent: tc.bodyContent,
}
switch {
case tc.expectedError != "":
require.EqualError(t, ec.Send(map[string]string{"description": "foo bar baz header"}), tc.expectedError, tc.name)
default:
require.NoError(t, ec.Send(map[string]string{"description": tc.inputEvent}), tc.name)
}
})
}
}
================================================
FILE: actions/jira.go
================================================
package actions
import (
"crypto/tls"
"errors"
"fmt"
"io/ioutil"
"log"
"strconv"
"github.com/aquasecurity/postee/v2/formatting"
"github.com/aquasecurity/postee/v2/layout"
"net/http"
"net/url"
"os"
"strings"
"github.com/aquasecurity/go-jira"
)
const (
defaultIssueType = "Task"
defaultIssuePriority = "High"
defaultSprintPlugin = "com.pyxis.greenhopper.jira:gh-sprint"
NotConfiguredSprintId = -1
)
type JiraAPI struct {
Name string
Url string
User string
Password string
Token string
TlsVerify bool
Issuetype string
ProjectKey string
Priority string
Assignee []string
Description string
Summary string
SprintName string
SprintId int
FixVersions []string
AffectsVersions []string
Labels []string
Unknowns map[string]string
BoardName string
boardId int
boardType string
}
func (ctx *JiraAPI) GetName() string {
return ctx.Name
}
func (ctx *JiraAPI) fetchBoardId(boardName string) {
client, err := createClient(ctx)
if err != nil {
log.Printf("unable to create Jira client: %s, please check your credentials.", err)
return
}
boardlist, _, err := client.Board.GetAllBoards(&jira.BoardListOptions{ProjectKeyOrID: ctx.ProjectKey})
if err != nil {
log.Printf("failed to get boards from Jira API GetAllBoards with ProjectID %s. %s", ctx.ProjectKey, err)
return
}
var matches int
for _, board := range boardlist.Values {
if board.Name == boardName {
ctx.boardId = board.ID
ctx.boardType = board.Type
matches++
}
}
if matches > 1 {
log.Printf("found more than one boards with name %q, working with board id %d", boardName, ctx.boardId)
} else if matches == 0 {
log.Printf("no boards found with name %s when getting all boards for User", boardName)
return
} else {
log.Printf("using board ID %d with Name %q", ctx.boardId, boardName)
}
}
func (ctx *JiraAPI) fetchSprintId(client *jira.Client) {
sprints, _, err := client.Board.GetAllSprintsWithOptions(ctx.boardId, &jira.GetAllSprintsOptions{State: "active"})
if err != nil {
log.Printf("failed to get active sprint for board ID %d from Jira API. %s", ctx.boardId, err)
return
}
if len(sprints.Values) > 1 {
ctx.SprintId = len(sprints.Values) - 1
log.Printf("Found more than one active sprint, using sprint id %d as the active sprint", ctx.SprintId)
} else if len(sprints.Values) == 1 {
if sprints.Values[0].ID != ctx.SprintId {
ctx.SprintId = sprints.Values[0].ID
log.Printf("using sprint id %d as the active sprint", ctx.SprintId)
}
} else {
log.Printf("no active sprints exist in board ID %d Name %s", ctx.boardId, ctx.ProjectKey)
}
}
func (ctx *JiraAPI) Terminate() error {
log.Printf("Jira action terminated\n")
return nil
}
func (ctx *JiraAPI) Init() error {
if ctx.BoardName == "" {
ctx.BoardName = fmt.Sprintf("%s board", ctx.ProjectKey)
}
ctx.fetchBoardId(ctx.BoardName)
log.Printf("Starting Jira action %q....", ctx.Name)
if len(ctx.Password) == 0 {
ctx.Password = os.Getenv("JIRA_PASSWORD")
}
return nil
}
func (jira *JiraAPI) GetLayoutProvider() layout.LayoutProvider {
return new(formatting.JiraLayoutProvider)
}
func (ctx *JiraAPI) buildTransportClient() (*http.Client, error) {
if ctx.Token != "" {
if !isServerJira(ctx.Url) {
return nil, errors.New("Jira Cloud can't work with PAT")
}
if ctx.Password != "" {
log.Printf("Found both Password and PAT, using PAT to authenticate.")
}
tp := jira.BearerTokenAuthTransport{
Token: ctx.Token,
}
if !ctx.TlsVerify {
tp.Transport = &http.Transport{
TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
}
}
return tp.Client(), nil
} else {
tp := jira.BasicAuthTransport{
Username: ctx.User,
Password: ctx.Password,
}
if !ctx.TlsVerify {
tp.Transport = &http.Transport{
TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
}
}
return tp.Client(), nil
}
}
var createClient = func(ctx *JiraAPI) (*jira.Client, error) {
tpClient, err := ctx.buildTransportClient()
if err != nil {
return nil, fmt.Errorf("unable to create new JIRA client. %w", err)
}
client, err := jira.NewClient(tpClient, ctx.Url)
if err != nil {
return client, fmt.Errorf("unable to create new JIRA client. %w", err)
}
return client, nil
}
func (ctx *JiraAPI) Send(content map[string]string) error {
client, err := createClient(ctx)
if err != nil {
log.Printf("unable to create Jira client: %s", err)
return err
}
if ctx.boardType == "scrum" {
ctx.fetchSprintId(client)
}
metaProject, err := createMetaProject(client, ctx.ProjectKey)
if err != nil {
return fmt.Errorf("Failed to create meta project: %w", err)
}
ctx.Issuetype, err = getIssueType(ctx, metaProject)
if err != nil {
return fmt.Errorf("Failed to get issuetype: %w", err)
}
metaIssueType, err := createMetaIssueType(metaProject, ctx.Issuetype)
if err != nil {
return fmt.Errorf("Failed to create meta issue type: %w", err)
}
ctx.Summary = content["title"]
ctx.Description = content["description"]
type Version struct {
Name string `json:"name"`
}
fieldsConfig, err := createFieldsConfig(ctx, client, &content)
if err != nil {
return fmt.Errorf("Failed to create fields config: %w", err)
}
issue, err := InitIssue(client, metaProject, metaIssueType, fieldsConfig, isServerJira(ctx.Url))
if err != nil {
log.Printf("Failed to init issue: %s\n", err)
return err
}
if len(ctx.Labels) > 0 {
for _, l := range ctx.Labels {
issue.Fields.Labels = append(issue.Fields.Labels, l)
}
}
if len(ctx.FixVersions) > 0 {
for _, v := range ctx.FixVersions {
issue.Fields.FixVersions = append(issue.Fields.FixVersions, &jira.FixVersion{
Name: v,
})
}
}
if len(ctx.AffectsVersions) > 0 {
affectsVersions := []*Version{}
for _, v := range ctx.AffectsVersions {
affectsVersions = append(affectsVersions, &Version{
Name: v,
})
}
issue.Fields.Unknowns["versions"] = affectsVersions
log.Printf("added %d affected versions into Versions field", len(ctx.AffectsVersions))
}
i, err := ctx.openIssue(client, issue)
if err != nil {
log.Printf("Failed to open jira issue, %s\n", err)
return err
}
log.Printf("Created new jira issue %s", i.ID)
return nil
}
func (ctx *JiraAPI) openIssue(client *jira.Client, issue *jira.Issue) (*jira.Issue, error) {
i, res, err := client.Issue.Create(issue)
defer res.Body.Close()
resp, _ := ioutil.ReadAll(res.Body)
if err != nil {
return nil, errors.New(string(resp))
}
return i, nil
}
func createMetaProject(c *jira.Client, project string) (*jira.MetaProject, error) {
meta, _, err := c.Issue.GetCreateMeta(project)
if err != nil {
return nil, fmt.Errorf("failed to get create meta : %w", err)
}
// get right project
metaProject := meta.GetProjectWithKey(project)
if metaProject == nil {
return nil, fmt.Errorf("could not find project with key %s", project)
}
return metaProject, nil
}
func getIssueType(ctx *JiraAPI, metaProject *jira.MetaProject) (string, error) {
if ctx.Issuetype != "" {
if validateIssueType(ctx.Issuetype, metaProject) { // check IssueType from context
return ctx.Issuetype, nil
} else {
return "", fmt.Errorf("project %q doesn't have issueType %q", metaProject.Name, ctx.Issuetype)
}
} else {
if validateIssueType(defaultIssueType, metaProject) { // check default Issue Type
return defaultIssueType, nil
}
if len(metaProject.IssueTypes) > 0 { // use 1st issueType from REST API
return metaProject.IssueTypes[0].Name, nil
} else {
return "", fmt.Errorf("project %q doesn't have issueTypes", metaProject.Name)
}
}
}
func validateIssueType(issueType string, metaProject *jira.MetaProject) bool {
for _, it := range metaProject.IssueTypes { // get issueTypes list from REST API
if issueType == it.Name {
return true
}
}
return false
}
var getIssuePriority = func(ctx *JiraAPI, client *jira.Client) (string, error) {
issuePriorityList, _, err := client.Priority.GetList()
if err != nil {
return "", err
}
if ctx.Priority != "" {
if validateIssuePriority(ctx.Priority, issuePriorityList) { // check Priority from context
return ctx.Priority, nil
} else {
return "", fmt.Errorf("project doesn't have issue priority %q", ctx.Priority)
}
} else {
if validateIssuePriority(defaultIssuePriority, issuePriorityList) { // check default Priority
return defaultIssuePriority, nil
} else {
if len(issuePriorityList) > 0 {
return issuePriorityList[0].Name, nil // use 1st priority from REST API
} else {
return "", fmt.Errorf("project doesn't have issue priorities")
}
}
}
}
func validateIssuePriority(priority string, priorityList []jira.Priority) bool {
for _, p := range priorityList {
if priority == p.Name {
return true
}
}
return false
}
func createFieldsConfig(ctx *JiraAPI, client *jira.Client, content *map[string]string) (map[string]string, error) {
fields, _, err := client.Field.GetList()
if err != nil {
return nil, err
}
assignee := ctx.User
if len(ctx.Assignee) > 0 {
assignees := getHandledRecipients(ctx.Assignee, content, ctx.Name)
if len(assignees) > 0 {
assignee = assignees[0]
}
}
ctx.Priority, err = getIssuePriority(ctx, client)
if err != nil {
return nil, fmt.Errorf("failed to get issue priority: %w", err)
}
fieldsConfig := make(map[string]string)
for _, field := range fields {
switch field.ID {
case "issuetype":
fieldsConfig[field.Name] = ctx.Issuetype
case "project":
fieldsConfig[field.Name] = ctx.ProjectKey
case "priority":
fieldsConfig[field.Name] = ctx.Priority
case "assignee":
fieldsConfig[field.Name] = assignee
case "description":
fieldsConfig[field.Name] = ctx.Description
case "summary":
fieldsConfig[field.Name] = ctx.Summary
default:
// Sprint is jira custom field. We found field.Name for sprint by plugin name.
// "com.pyxis.greenhopper.jira:gh-sprint" is custom field that come bundled with Jira.
// https://support.atlassian.com/jira-cloud-administration/docs/import-data-from-json
if ctx.SprintId > 0 && field.Schema.Custom == defaultSprintPlugin {
fieldsConfig[field.Name] = strconv.Itoa(ctx.SprintId)
}
}
}
//Add all custom fields that are unknown to fieldsConfig. Unknown are fields that are custom User defined in jira.
for k, v := range ctx.Unknowns {
fieldsConfig[k] = v
}
if len(ctx.Unknowns) > 0 {
log.Printf("added %d custom fields to issue.", len(ctx.Unknowns))
}
return fieldsConfig, nil
}
func createMetaIssueType(metaProject *jira.MetaProject, issueType string) (*jira.MetaIssueType, error) {
metaIssuetype := metaProject.GetIssueTypeWithName(issueType)
if metaIssuetype == nil {
return nil, fmt.Errorf("could not find issuetype %s", issueType)
}
return metaIssuetype, nil
}
func InitIssue(c *jira.Client, metaProject *jira.MetaProject, metaIssuetype *jira.MetaIssueType, fieldsConfig map[string]string, useSrvApi bool) (*jira.Issue, error) {
issue := new(jira.Issue)
issueFields := new(jira.IssueFields)
issueFields.Unknowns = make(map[string]interface{})
// map the field names the User presented to jira's internal key
allFields, _ := metaIssuetype.GetAllFields()
for key, value := range fieldsConfig {
jiraKey, found := allFields[key]
if !found {
return nil, fmt.Errorf("key %s is not found in the list of fields", key)
}
valueType, err := metaIssuetype.Fields.String(jiraKey + "/schema/type")
if err != nil {
return nil, err
}
switch strings.ToLower(valueType) {
case "array":
// split value (string) into slice by delimiter
elements := strings.Split(value, ",")
elemType, err := metaIssuetype.Fields.String(jiraKey + "/schema/items")
if err != nil {
return nil, err
}
switch elemType {
case "component":
issueFields.Unknowns[jiraKey] = []jira.Component{{Name: value}}
case "option":
optionsMap := make([]map[string]string, 0)
for _, element := range elements {
optionsMap = append(optionsMap, map[string]string{"value": element})
}
issueFields.Unknowns[jiraKey] = optionsMap
default:
if key == "Sprint" {
num, err := strconv.Atoi(value)
if err != nil {
return nil, fmt.Errorf("Failed convert 'Sprint' value(string) to int: %w\n", err)
}
issueFields.Unknowns[jiraKey] = num // Due to Jira REST API behavior, needed to specify not a slice but a number.
} else {
issueFields.Unknowns[jiraKey] = []string{value}
}
}
case "number":
val, err := strconv.Atoi(value)
if err != nil {
return nil, fmt.Errorf("Failed convert '%s' value(string) to int: %w\n", key, err)
}
issueFields.Unknowns[jiraKey] = val
// TODO: Handle Cascading Select List
//case "option-with-child":
// type CustomField struct {
// Value string `json:"value"`
// }
// type CustomFieldCascading struct {
// Value string `json:"value"`
// Child CustomField `json:"child"`
// }
//
// a := CustomFieldCascading{ Value: "1", Child: CustomField{Value: "a"}}
case "string":
issueFields.Unknowns[jiraKey] = value
case "date":
issueFields.Unknowns[jiraKey] = value
case "datetime":
issueFields.Unknowns[jiraKey] = value
case "any":
// Treat any as string
issueFields.Unknowns[jiraKey] = value
case "project":
issueFields.Unknowns[jiraKey] = jira.Project{
Name: metaProject.Name,
ID: metaProject.Id,
}
case "priority":
issueFields.Unknowns[jiraKey] = jira.Priority{Name: value}
case "user":
var users []jira.User
var resp *jira.Response
var err error
if useSrvApi {
users, resp, err = findUserOnJiraServer(c, value)
} else {
users, resp, err = c.User.Find(value)
}
if err != nil {
log.Printf("Get Jira User info error: %v", err)
continue
}
if resp.StatusCode != http.StatusOK {
log.Printf("http response failed: %q", resp.Status)
continue
}
if len(users) == 0 {
log.Printf("There is no user for %q", value)
continue
}
issueFields.Unknowns[jiraKey] = users[0]
case "issuetype":
issueFields.Unknowns[jiraKey] = jira.IssueType{
Name: value,
}
case "option":
issueFields.Unknowns[jiraKey] = jira.Option{
Value: value,
}
default:
return nil, fmt.Errorf("Unknown issue type encountered: %s for %s", valueType, key)
}
}
issue.Fields = issueFields
return issue, nil
}
func findUserOnJiraServer(c *jira.Client, email string) ([]jira.User, *jira.Response, error) {
req, _ := c.NewRequest("GET", fmt.Sprintf("/rest/api/2/user/search?username=%s", email), nil)
users := []jira.User{}
resp, err := c.Do(req, &users)
if err != nil {
log.Printf("%v", err)
return nil, resp, err
}
return users, resp, nil
}
func isServerJira(rawUrl string) bool {
jiraUrl, err := url.Parse(rawUrl)
if err == nil {
return !strings.HasSuffix(jiraUrl.Host, "atlassian.net")
}
return false
}
================================================
FILE: actions/jira_test.go
================================================
package actions
import (
"encoding/json"
"fmt"
"net/http"
"net/http/httptest"
"os"
"reflect"
"testing"
"github.com/aquasecurity/go-jira"
"github.com/aquasecurity/postee/v2/formatting"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
var metaIssuetype = &jira.MetaIssueType{Name: "Task", Fields: map[string]interface{}{
"issuetype": map[string]interface{}{
"name": "Issue Type",
"schema": map[string]interface{}{
"type": "issuetype",
},
},
"project": map[string]interface{}{
"name": "Project",
"schema": map[string]interface{}{
"type": "project",
},
},
"priority": map[string]interface{}{
"name": "Priority",
"schema": map[string]interface{}{
"type": "priority",
},
},
"description": map[string]interface{}{
"name": "Description",
"schema": map[string]interface{}{
"type": "string",
},
},
"summary": map[string]interface{}{
"name": "Summary",
"schema": map[string]interface{}{
"type": "string",
},
},
"assignee": map[string]interface{}{
"name": "Assignee",
"schema": map[string]interface{}{
"type": "user",
},
},
"customfield_10020": map[string]interface{}{
"name": "Sprint",
"schema": map[string]interface{}{
"type": "array",
"items": "json",
},
},
"customfield_10021": map[string]interface{}{
"name": "Flagged",
"schema": map[string]interface{}{
"type": "array",
"items": "option",
},
},
"components": map[string]interface{}{
"name": "Components",
"schema": map[string]interface{}{
"type": "array",
"items": "component",
},
},
"versions": map[string]interface{}{
"name": "Affects versions",
"schema": map[string]interface{}{
"type": "array",
"items": "version",
},
},
"customfield_10015": map[string]interface{}{
"name": "Start date",
"schema": map[string]interface{}{
"type": "date",
},
},
"customfield_10009": map[string]interface{}{
"name": "Actual end",
"schema": map[string]interface{}{
"type": "datetime",
},
},
"customfield_10001": map[string]interface{}{
"name": "Team",
"schema": map[string]interface{}{
"type": "any",
},
},
"customfield_10004": map[string]interface{}{
"name": "Impact",
"schema": map[string]interface{}{
"type": "option",
},
},
"timespent": map[string]interface{}{
"name": "Time Spent",
"schema": map[string]interface{}{
"type": "number",
},
},
"customfield_10052": map[string]interface{}{
"name": "No schema type",
"schema": map[string]interface{}{},
},
"customfield_10053": map[string]interface{}{
"name": "No schema items",
"schema": map[string]interface{}{
"type": "array",
},
},
"customfield_10054": map[string]interface{}{
"name": "Bad Type",
"schema": map[string]interface{}{
"type": "badType",
},
},
}}
var fieldList = &[]jira.Field{
{ID: "issuetype", Name: "Issue Type"},
{ID: "project", Name: "Project"},
{ID: "priority", Name: "Priority"},
{ID: "description", Name: "Description"},
{ID: "summary", Name: "Summary"},
}
func TestJiraAPI_GetName(t *testing.T) {
t.Run("happy path", func(t *testing.T) {
jiraApi := &JiraAPI{Name: "testName"}
name := jiraApi.GetName()
assert.Equal(t, jiraApi.Name, name)
})
}
func TestJiraAPI_FetchBoardId(t *testing.T) {
tests := []struct {
name string
boardName string
boardList *jira.BoardsList
wantJiraApi *JiraAPI
wantError string
}{
{
name: "happy path (0 boards found)",
boardName: "board0",
boardList: &jira.BoardsList{Values: []jira.Board{{Name: "board1"}, {Name: "board2"}}},
wantJiraApi: &JiraAPI{BoardName: "board0"},
},
{
name: "happy path (1 board found)",
boardName: "board1",
boardList: &jira.BoardsList{Values: []jira.Board{{Name: "board1", ID: 1, Type: "Scrum"}, {Name: "board2", ID: 2, Type: "Scrum"}}},
wantJiraApi: &JiraAPI{boardId: 1, BoardName: "board1", boardType: "Scrum"},
},
{
name: "happy path (2 boards found)",
boardName: "board2",
boardList: &jira.BoardsList{Values: []jira.Board{{Name: "board2", ID: 1, Type: "Scrum"}, {Name: "board2", ID: 2, Type: "Scrum"}}},
wantJiraApi: &JiraAPI{boardId: 2, BoardName: "board2", boardType: "Scrum"},
},
{
name: "sad path (Failed to create client)",
boardName: "board3",
wantJiraApi: &JiraAPI{BoardName: "board3"},
wantError: "Failed to create client",
},
{
name: "sad path (Failed to get boardList)",
boardName: "board4",
wantJiraApi: &JiraAPI{BoardName: "board4"},
wantError: "Failed to get boardList",
},
}
oldCreateClient := createClient
defer func() { createClient = oldCreateClient }()
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
ts := httptest.NewServer(http.HandlerFunc(buildHttpHandler(test.boardList, test.wantError)))
defer ts.Close()
createClient = func(ctx *JiraAPI) (*jira.Client, error) {
if test.wantError == "Failed to create client" {
return nil, fmt.Errorf(test.wantError)
} else {
return jira.NewClient(ts.Client(), ts.URL)
}
}
jiraApi := &JiraAPI{BoardName: test.boardName}
jiraApi.fetchBoardId(test.boardName)
assert.Equal(t, test.wantJiraApi, jiraApi)
})
}
}
func TestJiraAPI_FetchSprintId(t *testing.T) {
tests := []struct {
name string
sprints *jira.SprintsList
wantSprintId int
}{
{
name: "happy path (2 sprints found)",
sprints: &jira.SprintsList{Values: []jira.Sprint{{Name: "sprint0"}, {Name: "sprint1"}}},
wantSprintId: 1,
},
{
name: "happy path (1 sprint found)",
sprints: &jira.SprintsList{Values: []jira.Sprint{{Name: "sprint32", ID: 32}}},
wantSprintId: 32,
},
{
name: "happy path (0 sprints found)",
sprints: &jira.SprintsList{Values: []jira.Sprint{}},
wantSprintId: NotConfiguredSprintId,
},
{
name: "sad path (Failed to get all sprints)",
wantSprintId: NotConfiguredSprintId,
},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
ts := httptest.NewServer(http.HandlerFunc(buildHttpHandler(test.sprints, "")))
defer ts.Close()
jiraApi := &JiraAPI{SprintId: -1}
client, err := jira.NewClient(ts.Client(), ts.URL)
if err != nil {
t.Fatalf("can't create jiraClient %v", err)
}
jiraApi.fetchSprintId(client)
assert.Equal(t, test.wantSprintId, jiraApi.SprintId)
})
}
}
func TestJiraAPI_InitIssue(t *testing.T) {
metaProject := &jira.MetaProject{
Id: "project ID",
Name: "project name",
}
tests := []struct {
name string
useSrvApi bool
httpStatus int
user []*jira.User
fieldsConfig map[string]string
wantIssueFields *jira.IssueFields
wantError string
}{
{
name: "happy path",
useSrvApi: true,
httpStatus: http.StatusOK,
user: []*jira.User{{Name: "User"}},
fieldsConfig: map[string]string{
"Issue Type": "Task",
"Project": "Project",
"Priority": "High",
"Description": "Description",
"Summary": "Summary",
"Assignee": "Assignee",
"Sprint": "1",
"Flagged": "Flagged",
"Components": "Components",
"Affects versions": "1.0.1",
"Start date": "01.01.2022",
"Actual end": "01.01.2222",
"Team": "Team",
"Impact": "Impact",
"Time Spent": "10",
},
wantIssueFields: &jira.IssueFields{Unknowns: map[string]interface{}{
"issuetype": jira.IssueType{Name: "Task"},
"project": jira.Project{
Name: "project name",
ID: "project ID",
},
"priority": jira.Priority{Name: "High"},
"assignee": jira.User{Name: "User"},
"description": "Description",
"summary": "Summary",
"customfield_10020": 1,
"customfield_10021": []map[string]string{{"value": "Flagged"}},
"components": []jira.Component{{Name: "Components"}},
"versions": []string{"1.0.1"},
"customfield_10015": "01.01.2022",
"customfield_10009": "01.01.2222",
"customfield_10001": "Team",
"customfield_10004": jira.Option{Value: "Impact"},
"timespent": 10,
}},
},
{
name: "happy path (useSrvApi = false)",
useSrvApi: false,
httpStatus: http.StatusOK,
user: []*jira.User{{Name: "User"}},
fieldsConfig: map[string]string{
"Assignee": "Assignee",
},
wantIssueFields: &jira.IssueFields{Unknowns: map[string]interface{}{
"assignee": jira.User{Name: "User"},
}},
},
{
name: "happy path (find user returns error)",
httpStatus: http.StatusOK,
fieldsConfig: map[string]string{
"Assignee": "Assignee",
},
wantIssueFields: &jira.IssueFields{Unknowns: map[string]interface{}{}},
},
{
name: "happy path (users not found)",
httpStatus: http.StatusOK,
user: []*jira.User{},
fieldsConfig: map[string]string{
"Assignee": "Assignee",
},
wantIssueFields: &jira.IssueFields{Unknowns: map[string]interface{}{}},
},
{
name: "sad path (bad field in fieldsConfig)",
fieldsConfig: map[string]string{"Bad-field": "bad-field"},
wantError: "key Bad-field is not found in the list of fields",
},
{
name: "sad path (field doesn't have schema/type)",
fieldsConfig: map[string]string{"No schema type": "No schema type"},
wantError: "\"customfield_10052/schema/type\" is not set",
},
{
name: "sad path (field doesn't have schema/items)",
fieldsConfig: map[string]string{"No schema items": "No schema items"},
wantError: "\"customfield_10053/schema/items\" is not set",
},
{
name: "sad path (sprint is not a number)",
fieldsConfig: map[string]string{"Sprint": "one"},
wantError: "strconv.Atoi: parsing \"one\": invalid syntax",
},
{
name: "sad path (number field is not a number)",
fieldsConfig: map[string]string{"Time Spent": "two"},
wantError: "strconv.Atoi: parsing \"two\": invalid syntax",
},
{
name: "sad path (bad field type)",
fieldsConfig: map[string]string{"Bad Type": "Bad Type"},
wantError: "Unknown issue type encountered",
},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
ts := httptest.NewServer(http.HandlerFunc(buildHttpHandler(test.user, test.wantError)))
defer ts.Close()
jiraClient, err := jira.NewClient(ts.Client(), ts.URL)
if err != nil {
t.Fatalf("can't create jiraClient %v", err)
}
issue, err := InitIssue(jiraClient, metaProject, metaIssuetype, test.fieldsConfig, test.useSrvApi)
if test.wantError != "" {
require.NotNil(t, err)
assert.Contains(t, err.Error(), test.wantError)
} else {
assert.Equal(t, test.wantIssueFields, issue.Fields)
}
})
}
}
func TestJiraAPI_GetLayoutProvider(t *testing.T) {
t.Run("happy path", func(t *testing.T) {
jiraApi := &JiraAPI{}
wantLayoutProviderType := new(formatting.JiraLayoutProvider)
LayoutProvider := jiraApi.GetLayoutProvider()
assert.Equal(t, reflect.TypeOf(wantLayoutProviderType), reflect.TypeOf(LayoutProvider))
})
}
func TestJiraAPI_BuildTransportClient(t *testing.T) {
tests := []struct {
name string
jiraApi *JiraAPI
wantTransport interface{}
wantError string
}{
{
name: "happy path bearer auth",
jiraApi: &JiraAPI{Token: "token", Password: "password"},
wantTransport: &jira.BearerTokenAuthTransport{},
},
{
name: "happy path bearer auth",
jiraApi: &JiraAPI{User: "User", Password: "Password"},
wantTransport: &jira.BasicAuthTransport{},
},
{
name: "sad path bearer auth for server jira",
jiraApi: &JiraAPI{Token: "token", Url: "https://johndoe.atlassian.net"},
wantError: "Jira Cloud can't work with PAT",
},
{
name: "sad path bearer auth with bad url",
jiraApi: &JiraAPI{Token: "token", Url: "https:// johndoe.atlassian.net"},
wantError: "Jira Cloud can't work with PAT",
},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
client, err := test.jiraApi.buildTransportClient()
if test.wantError != "" {
require.NotNil(t, err)
assert.Contains(t, err.Error(), test.wantError)
} else {
assert.Equal(t, reflect.TypeOf(test.wantTransport), reflect.TypeOf(client.Transport))
}
})
}
}
func TestJiraApi_createClient(t *testing.T) {
tests := []struct {
name string
jiraApi *JiraAPI
wantError string
}{
{
name: "happy path",
jiraApi: &JiraAPI{},
},
{
name: "sad path (using PAT for cloud jira)",
jiraApi: &JiraAPI{Token: "token", Url: "https://johndoe.atlassian.net"},
wantError: "Jira Cloud can't work with PAT",
},
{
name: "sad path (bad url)",
jiraApi: &JiraAPI{Url: "https://johndoe .atlassian.net"},
wantError: "unable to create new JIRA client",
},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
_, err := createClient(test.jiraApi)
if test.wantError != "" {
require.NotNil(t, err)
assert.Contains(t, err.Error(), test.wantError)
} else {
require.Nil(t, err)
}
})
}
}
func TestJiraAPI_Send(t *testing.T) {
tests := []struct {
name string
jiraApi *JiraAPI
createMetaInfo *jira.CreateMetaInfo
fieldList *[]jira.Field
priorityList *[]jira.Priority
issue *jira.Issue
serverInfo *jira.JiraServerInfo
content map[string]string
wantError string
}{
{
name: "happy path",
jiraApi: &JiraAPI{
ProjectKey: "project",
User: "user",
boardType: "scrum",
Labels: []string{"label1", "label2"},
FixVersions: []string{"fix1", "fix2"},
AffectsVersions: []string{"affect1", "affect2"},
},
createMetaInfo: &jira.CreateMetaInfo{Projects: []*jira.MetaProject{{Key: "project", IssueTypes: []*jira.MetaIssueType{metaIssuetype}}}},
fieldList: fieldList,
priorityList: &[]jira.Priority{{Name: "High"}},
issue: &jira.Issue{},
serverInfo: &jira.JiraServerInfo{VersionNumbers: []int{8, 3, 0}},
content: map[string]string{"title": "title_content", "description": "description_content"},
},
{
name: "sad path (Failed to create client)",
wantError: "Failed to create client",
},
{
name: "sad path (Failed to create meta project)",
jiraApi: &JiraAPI{},
wantError: "Failed to create meta project",
},
{
name: "sad path (Failed to get issuetype)",
jiraApi: &JiraAPI{Issuetype: "bogusIssueType", ProjectKey: "project"},
serverInfo: &jira.JiraServerInfo{VersionNumbers: []int{8, 3, 0}},
createMetaInfo: &jira.CreateMetaInfo{Projects: []*jira.MetaProject{{Key: "project", IssueTypes: []*jira.MetaIssueType{metaIssuetype}}}},
wantError: "Failed to get issuetype",
},
{
name: "sad path (Failed to create fields config)",
jiraApi: &JiraAPI{ProjectKey: "project"},
serverInfo: &jira.JiraServerInfo{VersionNumbers: []int{8, 3, 0}},
createMetaInfo: &jira.CreateMetaInfo{Projects: []*jira.MetaProject{{Key: "project", IssueTypes: []*jira.MetaIssueType{metaIssuetype}}}},
wantError: "Failed to create fields config",
},
{
name: "sad path (Failed to init issue)",
jiraApi: &JiraAPI{ProjectKey: "project", Unknowns: map[string]string{"bad field": "bad field"}},
serverInfo: &jira.JiraServerInfo{VersionNumbers: []int{8, 3, 0}},
createMetaInfo: &jira.CreateMetaInfo{Projects: []*jira.MetaProject{{Key: "project", IssueTypes: []*jira.MetaIssueType{metaIssuetype}}}},
fieldList: fieldList,
priorityList: &[]jira.Priority{{Name: "High"}},
wantError: "key bad field is not found in the list of fields",
},
{
name: "sad path (Failed to open issue)",
jiraApi: &JiraAPI{ProjectKey: "project"},
serverInfo: &jira.JiraServerInfo{VersionNumbers: []int{8, 3, 0}},
createMetaInfo: &jira.CreateMetaInfo{Projects: []*jira.MetaProject{{Key: "project", IssueTypes: []*jira.MetaIssueType{metaIssuetype}}}},
fieldList: fieldList,
priorityList: &[]jira.Priority{{Name: "High"}},
wantError: "Failed to open issue",
},
}
oldCreateClient := createClient
defer func() { createClient = oldCreateClient }()
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
mux := http.NewServeMux()
mux.HandleFunc("/rest/api/2/issue/createmeta/", buildHttpHandler(test.createMetaInfo, test.wantError))
mux.HandleFunc("/rest/api/2/field", buildHttpHandler(test.fieldList, test.wantError))
mux.HandleFunc("/rest/api/2/priority", buildHttpHandler(test.priorityList, test.wantError))
mux.HandleFunc("/rest/api/2/issue", buildHttpHandler(test.issue, test.wantError))
mux.HandleFunc("/rest/api/2/serverInfo", buildHttpHandler(test.serverInfo, test.wantError))
ts := httptest.NewServer(mux)
defer ts.Close()
createClient = func(ctx *JiraAPI) (*jira.Client, error) {
if test.wantError == "Failed to create client" {
return nil, fmt.Errorf(test.wantError)
} else {
return jira.NewClient(ts.Client(), ts.URL)
}
}
err := test.jiraApi.Send(test.content)
if test.wantError != "" {
require.NotNil(t, err)
assert.Contains(t, err.Error(), test.wantError)
} else {
require.NoError(t, err)
}
})
}
}
func TestJiraAPI_OpenIssue(t *testing.T) {
tests := []struct {
name string
issue *jira.Issue
wantError string
}{
{
name: "Happy path",
issue: &jira.Issue{ID: "issue1"},
},
{
name: "sad path",
wantError: "open issue error",
},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
ts := httptest.NewServer(http.HandlerFunc(buildHttpHandler(test.issue, test.wantError)))
defer ts.Close()
jiraApi := &JiraAPI{}
jiraClient, err := jira.NewClient(ts.Client(), ts.URL)
if err != nil {
t.Fatalf("can't create jiraClient %v", err)
}
issue, err := jiraApi.openIssue(jiraClient, test.issue)
if test.wantError != "" {
require.NotNil(t, err)
assert.Contains(t, err.Error(), test.wantError)
} else {
assert.Equal(t, test.issue, issue)
}
})
}
}
func TestJiraAPI_CreateMetaProject(t *testing.T) {
tests := []struct {
name string
metaInfo *jira.CreateMetaInfo
wantMetaProjectKey string
wantError string
}{
{
name: "happy path",
metaInfo: &jira.CreateMetaInfo{
Projects: []*jira.MetaProject{
{Key: "test"},
{Key: "debug"},
},
},
wantMetaProjectKey: "debug",
},
{
name: "sad path (jira return error)",
wantError: "failed to get create meta",
},
{
name: "sad path (project not found)",
metaInfo: &jira.CreateMetaInfo{
Projects: []*jira.MetaProject{
{Key: "test"},
{Key: "debug"},
},
},
wantMetaProjectKey: "non-existent-project",
wantError: "could not find project with key non-existent-project",
},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
mux := http.NewServeMux()
mux.HandleFunc("/rest/api/2/issue/createmeta/", buildHttpHandler(test.metaInfo, test.wantError))
mux.HandleFunc("/rest/api/2/serverInfo", buildHttpHandler(&jira.JiraServerInfo{VersionNumbers: []int{8, 4, 0}}, test.wantError))
ts := httptest.NewServer(mux)
defer ts.Close()
jiraClient, err := jira.NewClient(ts.Client(), ts.URL)
if err != nil {
t.Fatalf("can't create jiraClient %v", err)
}
metaProject, err := createMetaProject(jiraClient, test.wantMetaProjectKey)
if test.wantError != "" {
require.NotNil(t, err)
assert.Contains(t, err.Error(), test.wantError)
} else {
require.Equal(t, test.wantMetaProjectKey, metaProject.Key)
}
})
}
}
func TestJiraAPI_CreateIssueType(t *testing.T) {
tests := []struct {
name string
jiraAPI *JiraAPI
metaProject *jira.MetaProject
wantIssueType string
wantError string
}{
{
name: "happy path (empty issueType, jira has 'Task' field)",
jiraAPI: &JiraAPI{},
metaProject: &jira.MetaProject{IssueTypes: []*jira.MetaIssueType{{Name: "Task"}, {Name: "Bug"}}},
wantIssueType: "Task",
},
{
name: "happy path (empty issueType, jira doesn't have 'Task' field)",
jiraAPI: &JiraAPI{},
metaProject: &jira.MetaProject{IssueTypes: []*jira.MetaIssueType{{Name: "Story"}, {Name: "Bug"}}},
wantIssueType: "Story",
},
{
name: "happy path (fill issueType, jira has 'Bug' field)",
jiraAPI: &JiraAPI{Issuetype: "Bug"},
metaProject: &jira.MetaProject{IssueTypes: []*jira.MetaIssueType{{Name: "Task"}, {Name: "Bug"}}},
wantIssueType: "Bug",
},
{
name: "bad path (fill issueType, jira doesn't have 'Bug' field)",
jiraAPI: &JiraAPI{Issuetype: "Bug"},
metaProject: &jira.MetaProject{IssueTypes: []*jira.MetaIssueType{{Name: "Task"}, {Name: "Story"}}},
wantError: "project \"\" doesn't have issueType \"Bug\"",
},
{
name: "bad path (metaIssueType has empty IssueTypes)",
jiraAPI: &JiraAPI{Priority: ""},
metaProject: &jira.MetaProject{IssueTypes: []*jira.MetaIssueType{}},
wantError: "project \"\" doesn't have issueTypes",
},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
issueType, err := getIssueType(test.jiraAPI, test.metaProject)
if test.wantError != "" {
require.NotNil(t, err)
assert.Contains(t, err.Error(), test.wantError)
} else {
require.Equal(t, test.wantIssueType, issueType)
}
})
}
}
func TestJiraAPI_GetIssuePriority(t *testing.T) {
tests := []struct {
name string
jiraAPI *JiraAPI
priorities []*jira.Priority
wantPriority string
wantError string
}{
{
name: "happy path (empty priority, jira has 'High' field)",
jiraAPI: &JiraAPI{Priority: ""},
priorities: []*jira.Priority{{Name: "Highest"}, {Name: "High"}, {Name: "Medium"}},
wantPriority: "High",
},
{
name: "happy path (empty priority, jira doesn't have 'High' field)",
jiraAPI: &JiraAPI{Priority: ""},
priorities: []*jira.Priority{{Name: "Highest"}, {Name: "Low"}, {Name: "Medium"}},
wantPriority: "Highest",
},
{
name: "happy path (fill priority, jira has 'Medium' field)",
jiraAPI: &JiraAPI{Priority: "Medium"},
priorities: []*jira.Priority{{Name: "Highest"}, {Name: "High"}, {Name: "Medium"}},
wantPriority: "Medium",
},
{
name: "bad path (fill priority, jira doesn't have 'Medium' field)",
jiraAPI: &JiraAPI{Priority: "Medium"},
priorities: []*jira.Priority{{Name: "Highest"}, {Name: "High"}, {Name: "Low"}},
wantError: "project doesn't have issue priority \"Medium\"",
},
{
name: "bad path (jira returns empty priorities)",
jiraAPI: &JiraAPI{Priority: ""},
priorities: []*jira.Priority{},
wantError: "project doesn't have issue priorities",
},
{
name: "bad path (jira returns error)",
jiraAPI: &JiraAPI{Priority: ""},
wantError: "json: cannot unmarshal object into Go value of type []jira.Priority",
},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
ts := httptest.NewServer(http.HandlerFunc(buildHttpHandler(test.priorities, test.wantError)))
defer ts.Close()
jiraClient, err := jira.NewClient(ts.Client(), ts.URL)
if err != nil {
t.Fatalf("can't create jiraClient %v", err)
}
priority, err := getIssuePriority(test.jiraAPI, jiraClient)
if test.wantError != "" {
require.NotNil(t, err)
assert.Contains(t, err.Error(), test.wantError)
} else {
require.Equal(t, test.wantPriority, priority)
}
})
}
}
func TestJiraAPI_CreateFieldsConfig(t *testing.T) {
tests := []struct {
name string
fields []*jira.Field
jiraApi *JiraAPI
content *map[string]string
wantFieldsConfig map[string]string
wantError string
}{
{
name: "happy path (default field names)",
fields: []*jira.Field{
{ID: "issuetype", Name: "Issue Type"},
{ID: "project", Name: "Project"},
{ID: "priority", Name: "Priority"},
{ID: "assignee", Name: "Assignee"},
{ID: "description", Name: "Description"},
{ID: "summary", Name: "Summary"},
},
jiraApi: &JiraAPI{
User: "User",
Issuetype: "Task",
ProjectKey: "Project",
Priority: "High",
Description: "Description",
Summary: "Summary",
},
content: &map[string]string{},
wantFieldsConfig: map[string]string{
"Issue Type": "Task",
"Project": "Project",
"Priority": "High",
"Assignee": "User",
"Description": "Description",
"Summary": "Summary",
},
},
{
name: "happy path (custom field names)",
fields: []*jira.Field{
{ID: "issuetype", Name: "Custom Issue Type"},
{ID: "project", Name: "Custom Project"},
{ID: "priority", Name: "Custom Priority"},
{ID: "assignee", Name: "Custom Assignee"},
{ID: "description", Name: "Custom Description"},
{ID: "summary", Name: "Custom Summary"},
{ID: "customfield_10020", Name: "Custom Sprint", Schema: jira.FieldSchema{Custom: defaultSprintPlugin}},
},
jiraApi: &JiraAPI{
User: "User",
Issuetype: "Task",
ProjectKey: "Project",
Priority: "High",
Description: "Description",
Summary: "Summary",
SprintId: 432,
Assignee: []string{"Assignee"},
},
content: &map[string]string{"owners": "owners"},
wantFieldsConfig: map[string]string{
"Custom Issue Type": "Task",
"Custom Project": "Project",
"Custom Priority": "High",
"Custom Assignee": "Assignee",
"Custom Description": "Description",
"Custom Summary": "Summary",
"Custom Sprint": "432",
},
},
{
name: "happy path (custom fields)",
fields: []*jira.Field{
{ID: "issuetype", Name: "Issue Type"},
{ID: "project", Name: "Project"},
{ID: "priority", Name: "Priority"},
{ID: "assignee", Name: "Assignee"},
{ID: "description", Name: "Description"},
{ID: "summary", Name: "Summary"},
},
jiraApi: &JiraAPI{
User: "User",
Issuetype: "Task",
ProjectKey: "Project",
Priority: "High",
Description: "Description",
Summary: "Summary",
Unknowns: map[string]string{"Custom field": "Custom field value"},
},
content: &map[string]string{},
wantFieldsConfig: map[string]string{
"Issue Type": "Task",
"Project": "Project",
"Priority": "High",
"Assignee": "User",
"Description": "Description",
"Summary": "Summary",
"Custom field": "Custom field value",
},
},
{
name: "sad path (filed.GetList() return error)",
wantError: "json: cannot unmarshal string into Go value of type []jira.Field",
},
{
name: "sad path (createIssuePriority return error)",
fields: []*jira.Field{},
jiraApi: &JiraAPI{},
wantError: "project doesn't have issue priorities",
},
}
oldGetIssuePriority := getIssuePriority
defer func() { getIssuePriority = oldGetIssuePriority }()
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
ts := httptest.NewServer(http.HandlerFunc(buildHttpHandler(test.fields, test.wantError)))
defer ts.Close()
jiraClient, err := jira.NewClient(ts.Client(), ts.URL)
if err != nil {
t.Fatalf("can't create jiraClient %v", err)
}
getIssuePriority = func(ctx *JiraAPI, client *jira.Client) (string, error) {
if test.wantError != "" {
return "", fmt.Errorf(test.wantError)
} else {
return test.jiraApi.Priority, nil
}
}
fieldsConfig, err := createFieldsConfig(test.jiraApi, jiraClient, test.content)
if test.wantError != "" {
require.NotNil(t, err)
assert.Contains(t, err.Error(), test.wantError)
} else {
assert.Equal(t, test.wantFieldsConfig, fieldsConfig)
}
})
}
}
func TestJiraAPI_CreateMetaIssueType(t *testing.T) {
tests := []struct {
name string
metaProject *jira.MetaProject
issueType string
wantMetaIssueType *jira.MetaIssueType
wantError string
}{
{
name: "happy path",
metaProject: &jira.MetaProject{IssueTypes: []*jira.MetaIssueType{{Name: "Task"}, {Name: "Bug"}}},
wantMetaIssueType: &jira.MetaIssueType{Name: "Task"},
},
{
name: "sad path",
metaProject: &jira.MetaProject{IssueTypes: []*jira.MetaIssueType{{Name: "SubTask"}, {Name: "Bug"}}},
wantError: "could not find issuetype",
},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
metaIssueType, err := createMetaIssueType(test.metaProject, defaultIssueType)
if test.wantError != "" {
require.NotNil(t, err)
assert.Contains(t, err.Error(), test.wantError)
} else {
assert.Equal(t, test.wantMetaIssueType, metaIssueType)
}
})
}
}
func TestJiraAPI_Init(t *testing.T) {
tests := []struct {
name string
jiraApi *JiraAPI
envPassword string
wantJiraApi *JiraAPI
}{
{
name: "happy path",
jiraApi: &JiraAPI{BoardName: "board0", ProjectKey: "project", Password: "password"},
wantJiraApi: &JiraAPI{BoardName: "board0", ProjectKey: "project", Password: "password"},
},
{
name: "happy path (empty BoardName)",
jiraApi: &JiraAPI{ProjectKey: "project", Password: "password"},
wantJiraApi: &JiraAPI{BoardName: "project board", ProjectKey: "project", Password: "password"},
},
{
name: "happy path(empty password)",
jiraApi: &JiraAPI{BoardName: "board0", ProjectKey: "project"},
envPassword: "test_password",
wantJiraApi: &JiraAPI{BoardName: "board0", ProjectKey: "project", Password: "test_password"},
},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
if test.envPassword != "" {
savedJiraPassword := os.Getenv("JIRA_PASSWORD")
_ = os.Setenv("JIRA_PASSWORD", test.envPassword)
defer func() {
_ = os.Setenv("JIRA_PASSWORD", savedJiraPassword)
}()
}
_ = test.jiraApi.Init()
assert.Equal(t, test.wantJiraApi, test.jiraApi)
})
}
}
func buildHttpHandler(successResponse interface{}, errorResponse string) func(w http.ResponseWriter, r *http.Request) {
if !reflect.ValueOf(successResponse).IsNil() { // successResponse always has type therefore != nil (https://go.dev/doc/faq#nil_error)
return func(w http.ResponseWriter, r *http.Request) {
fieldListJson, _ := json.Marshal(successResponse)
_, _ = w.Write(fieldListJson)
}
} else {
return func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusNotFound)
if errorResponse != "" {
_, _ = w.Write([]byte(errorResponse))
}
}
}
}
================================================
FILE: actions/kubernetes.go
================================================
package actions
import (
"context"
"encoding/json"
"fmt"
"log"
"os"
"strings"
"github.com/aquasecurity/postee/v2/layout"
"github.com/tidwall/gjson"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/client-go/kubernetes"
"k8s.io/client-go/tools/clientcmd"
"k8s.io/client-go/util/retry"
)
const (
regoInputPrefix = "event.input"
KubernetesLabelKey = "labels"
KubernetesAnnotationKey = "annotations"
)
func IsK8s() bool {
_, ok := os.LookupEnv("KUBERNETES_SERVICE_HOST")
return ok
}
func updateMap(old map[string]string, new map[string]string) map[string]string {
newMap := make(map[string]string)
for k, v := range old {
newMap[k] = v
}
for k, v := range new {
newMap[k] = v
}
return newMap
}
type KubernetesClient struct {
clientset kubernetes.Interface
Name string
KubeNamespace string
KubeConfigFile string
KubeLabelSelector string
KubeActions map[string]map[string]string
}
func (k KubernetesClient) GetName() string {
return k.Name
}
func (k *KubernetesClient) Init() error {
config, err := clientcmd.BuildConfigFromFlags("", k.KubeConfigFile)
if err != nil {
log.Println("unable to initialize kubernetes config: ", err)
return err
}
k.clientset, err = kubernetes.NewForConfig(config)
if err != nil {
log.Println("unable to initialize kubernetes client: ", err)
return err
}
return nil
}
func jsonOrString(input map[string]string, filter string) string {
var ret string
if json.Valid([]byte(input["description"])) { // input is json
ret = gjson.Get(input["description"], filter).String()
} else {
ret = input["description"] // input is a string
}
return ret
}
func (k KubernetesClient) prepareInputs(input map[string]string) (string, map[string]map[string]string) {
retAction := make(map[string]map[string]string)
var retLabelSelector string
retLabelSelector = k.KubeLabelSelector
if strings.Contains(k.KubeLabelSelector, regoInputPrefix) {
retLabelSelector = jsonOrString(input, strings.TrimPrefix(k.KubeLabelSelector, regoInputPrefix+"."))
}
for key, m := range k.KubeActions {
for id, val := range m {
var calcVal string
if strings.HasPrefix(val, regoInputPrefix) {
calcVal = jsonOrString(input, strings.TrimPrefix(val, regoInputPrefix+"."))
} else {
calcVal = val // no rego to parse
}
if _, ok := retAction[key][id]; !ok && len(retAction[key]) == 0 {
retAction[key] = map[string]string{id: calcVal}
} else {
retAction[key][id] = calcVal
}
}
}
return retLabelSelector, retAction
}
func (k KubernetesClient) Send(m map[string]string) error {
ctx := context.Background()
labelSelector, actions := k.prepareInputs(m)
// TODO: Allow configuring of resource {pod, ds, ...}
pods, _ := k.clientset.CoreV1().Pods(k.KubeNamespace).List(ctx, metav1.ListOptions{
LabelSelector: labelSelector,
})
for _, pod := range pods.Items {
if len(actions[KubernetesLabelKey]) > 0 {
retryErr := retry.RetryOnConflict(retry.DefaultRetry, func() error {
pod, err := k.clientset.CoreV1().Pods(pod.GetNamespace()).Get(ctx, pod.Name, metav1.GetOptions{})
if err != nil {
return fmt.Errorf("failed to get updated pod for labeling: %s, err: %w", pod.Name, err)
}
labels := updateMap(pod.GetLabels(), actions[KubernetesLabelKey])
pod.SetLabels(labels)
_, err = k.clientset.CoreV1().Pods(pod.GetNamespace()).Update(ctx, pod, metav1.UpdateOptions{})
if err != nil {
log.Println("failed to apply labels to pod:", pod.Name, "err:", err.Error(), "retrying...")
return err
} else {
log.Println("labels applied successfully to pod:", pod.Name)
}
return nil
})
if retryErr != nil {
log.Println("failed to apply labels to pod:", pod.Name, "err:", retryErr)
}
}
if len(actions[KubernetesAnnotationKey]) > 0 {
retryErr := retry.RetryOnConflict(retry.DefaultRetry, func() error {
pod, err := k.clientset.CoreV1().Pods(pod.GetNamespace()).Get(ctx, pod.Name, metav1.GetOptions{})
if err != nil {
return fmt.Errorf("failed to get updated pod for annotating: %s, err: %w", pod.Name, err)
}
annotations := updateMap(pod.GetAnnotations(), actions[KubernetesAnnotationKey])
pod.SetAnnotations(annotations)
_, err = k.clientset.CoreV1().Pods(pod.GetNamespace()).Update(ctx, pod, metav1.UpdateOptions{})
if err != nil {
log.Println("failed to apply annotation to pod:", pod.Name, "err:", err.Error(), "retrying...")
return err
} else {
log.Println("annotations applied successfully to pod:", pod.Name)
}
return nil
})
if retryErr != nil {
log.Println("failed to apply annotations to pod:", pod.Name, "err:", retryErr)
}
}
}
return nil
}
func (k KubernetesClient) Terminate() error {
log.Printf("Kubernetes output terminated\n")
return nil
}
func (k KubernetesClient) GetLayoutProvider() layout.LayoutProvider {
return nil
}
================================================
FILE: actions/kubernetes_test.go
================================================
package actions
import (
"context"
"fmt"
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
v1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/client-go/kubernetes/fake"
fake2 "k8s.io/client-go/kubernetes/typed/core/v1/fake"
k8stesting "k8s.io/client-go/testing"
)
func TestKubernetesClientSend_Labels(t *testing.T) {
testCases := []struct {
name string
inputEvent string
reactorFunc func(k8stesting.Action) (bool, runtime.Object, error)
inputActions map[string]map[string]string
inputLabelSelector string
expectedLabels map[string]string
}{
{
name: "happy path, labels are added",
inputEvent: `{"SigMetadata":{"ID":"TRC-2"}}`,
inputActions: map[string]map[string]string{
"labels": {"foo": "bar"},
},
inputLabelSelector: "app=nginx",
expectedLabels: map[string]string{
"app": "nginx",
"foo": "bar",
},
},
{
name: "happy path, relative label selector and labels are added",
inputEvent: `{"SigMetadata":{"ID":"TRC-2", "Hostname":"nginx"}}`,
inputActions: map[string]map[string]string{
"labels": {"foo": "bar"},
},
inputLabelSelector: "app=event.input.SigMetadata.Hostname",
expectedLabels: map[string]string{
"app": "nginx",
"foo": "bar",
},
},
{
name: "happy path, json input event, relative input labels are added",
inputEvent: `{"SigMetadata":{"ID":"TRC-2", "Hostname":"foo.com"}}`,
inputActions: map[string]map[string]string{
"labels": {
"foo": "event.input.SigMetadata.ID",
"hostname": "event.input.SigMetadata.Hostname",
},
},
inputLabelSelector: "app=nginx",
expectedLabels: map[string]string{
"app": "nginx",
"foo": "TRC-2",
"hostname": "foo.com",
},
},
{
name: "happy path, string input event, relative input labels are added",
inputEvent: `foo bar baz`,
inputActions: map[string]map[string]string{
"labels": {"foo": "event.input"},
},
inputLabelSelector: "app=nginx",
expectedLabels: map[string]string{
"app": "nginx",
"foo": "foo bar baz",
},
},
{
name: "sad path, unable to add label",
inputEvent: `{"SigMetadata":{"ID":"TRC-2"}}`,
inputLabelSelector: "app=nginx",
reactorFunc: func(action k8stesting.Action) (handled bool, ret runtime.Object, err error) {
return true, nil, fmt.Errorf("failed to update label")
},
expectedLabels: map[string]string{
"app": "nginx",
},
},
{
name: "sad path, no matching label selector and no labels are added",
inputEvent: `{"SigMetadata":{"ID":"TRC-2"}}`,
inputActions: map[string]map[string]string{
"labels": {"foo": "bar"},
},
inputLabelSelector: "app=doesntexist",
expectedLabels: map[string]string{
"app": "nginx",
},
},
}
for _, tc := range testCases {
t.Run(tc.name, func(t *testing.T) {
k := KubernetesClient{
clientset: fake.NewSimpleClientset(),
KubeNamespace: "testing",
KubeActions: tc.inputActions,
KubeLabelSelector: tc.inputLabelSelector,
}
if tc.reactorFunc != nil {
k.clientset.CoreV1().(*fake2.FakeCoreV1).Fake.PrependReactor("update", "pods", func(action k8stesting.Action) (handled bool, ret runtime.Object, err error) {
return true, nil, fmt.Errorf("failed to update label")
})
}
pod := &v1.Pod{
TypeMeta: metav1.TypeMeta{
Kind: "Pod",
APIVersion: "v1",
},
ObjectMeta: metav1.ObjectMeta{
Name: "test-pod",
Namespace: "testing",
Labels: map[string]string{"app": "nginx"},
},
}
_, err := k.clientset.CoreV1().Pods("testing").Create(context.TODO(), pod, metav1.CreateOptions{})
require.NoError(t, err, tc.name)
require.NoError(t, k.Send(map[string]string{"description": tc.inputEvent}), tc.name)
pods, _ := k.clientset.CoreV1().Pods("testing").Get(context.TODO(), "test-pod", metav1.GetOptions{})
assert.Equal(t, tc.expectedLabels, pods.Labels, tc.name)
})
}
}
func TestKubernetesClientSend_Annotations(t *testing.T) {
testCases := []struct {
name string
inputEvent string
reactorFunc func(k8stesting.Action) (bool, runtime.Object, error)
inputActions map[string]map[string]string
expectedAnnotations map[string]string
}{
{
name: "happy path, labels are added",
inputEvent: `{"SigMetadata":{"ID":"TRC-2"}}`,
inputActions: map[string]map[string]string{
"annotations": {"foo": "bar"},
},
expectedAnnotations: map[string]string{
"app": "nginx",
"foo": "bar",
},
},
{
name: "happy path, json input event, relative input annotations are added",
inputEvent: `{"SigMetadata":{"ID":"TRC-2"}}`,
inputActions: map[string]map[string]string{
"annotations": {"foo": "event.input.SigMetadata.ID"},
},
expectedAnnotations: map[string]string{
"app": "nginx",
"foo": "TRC-2",
},
},
{
name: "happy path, string input event, relative input annotations are added",
inputEvent: `foo bar baz`,
inputActions: map[string]map[string]string{
"annotations": {"foo": "event.input"},
},
expectedAnnotations: map[string]string{
"app": "nginx",
"foo": "foo bar baz",
},
},
{
name: "sad path, unable to add annotations",
inputEvent: `{"SigMetadata":{"ID":"TRC-2"}}`,
reactorFunc: func(action k8stesting.Action) (handled bool, ret runtime.Object, err error) {
return true, nil, fmt.Errorf("failed to update label")
},
expectedAnnotations: map[string]string{
"app": "nginx",
},
},
}
for _, tc := range testCases {
t.Run(tc.name, func(t *testing.T) {
k := KubernetesClient{
clientset: fake.NewSimpleClientset(),
KubeNamespace: "testing",
KubeActions: tc.inputActions,
}
if tc.reactorFunc != nil {
k.clientset.CoreV1().(*fake2.FakeCoreV1).Fake.PrependReactor("update", "pods", func(action k8stesting.Action) (handled bool, ret runtime.Object, err error) {
return true, nil, fmt.Errorf("failed to update annotation")
})
}
pod := &v1.Pod{
TypeMeta: metav1.TypeMeta{
Kind: "Pod",
APIVersion: "v1",
},
ObjectMeta: metav1.ObjectMeta{
Name: "test-pod",
Namespace: "testing",
Annotations: map[string]string{"app": "nginx"},
},
}
_, err := k.clientset.CoreV1().Pods("testing").Create(context.TODO(), pod, metav1.CreateOptions{})
require.NoError(t, err, tc.name)
require.NoError(t, k.Send(map[string]string{"description": tc.inputEvent}), tc.name)
pods, _ := k.clientset.CoreV1().Pods("testing").Get(context.TODO(), "test-pod", metav1.GetOptions{})
assert.Equal(t, tc.expectedAnnotations, pods.Annotations, tc.name)
})
}
}
================================================
FILE: actions/message.go
================================================
package actions
import (
"bytes"
"log"
"net/url"
"strings"
"github.com/aquasecurity/postee/v2/layout"
)
const posteeDocsUrl = "https://aquasecurity.github.io/postee/settings/"
func buildShortMessage(server, urls string, provider layout.LayoutProvider) string {
var builder bytes.Buffer
if len(server) > 0 && len(urls) > 0 {
builder.WriteString(provider.P("This message is too long to display here. Please visit the link to read the content."))
links := strings.Split(urls, "\n")
for _, link := range links {
linkTitle, err := url.QueryUnescape(link)
if err != nil {
log.Printf("Query unescape error: %s", err)
}
builder.WriteString(provider.P(provider.A(link, linkTitle)))
}
} else if len(server) == 0 {
builder.WriteString(provider.P("Please configure Aqua server url to get link to entire scan results."))
builder.WriteString(provider.P(provider.A(posteeDocsUrl, "Postee settings")))
} else {
builder.WriteString(provider.P("Unable to create link to entire scan results. Input message doesn't contain 'registry' and 'image' fields or they are empty"))
}
return builder.String()
}
================================================
FILE: actions/message_test.go
================================================
package actions
import (
"testing"
"github.com/aquasecurity/postee/v2/layout"
"github.com/aquasecurity/postee/v2/formatting"
"github.com/stretchr/testify/assert"
)
func Test_buildShortMessage(t *testing.T) {
testCases := []struct {
name string
provider layout.LayoutProvider
inputServer string
inputUrls string
want string
}{
{
name: "happy path with slack provider",
provider: new(formatting.SlackMrkdwnProvider),
inputServer: "foo.com",
inputUrls: "foo1.com",
want: `{"type":"section","text":{"type":"mrkdwn","text":"This message is too long to display here. Please visit the link to read the content."}},{"type":"section","text":{"type":"mrkdwn","text":"\u003cfoo1.com|foo1.com\u003e"}},`,
},
{
name: "happy path with teams/html provider",
inputServer: "foo.com",
inputUrls: "foo1.com",
provider: new(formatting.HtmlProvider),
want: `This message is too long to display here. Please visit the link to read the content.
`, }, { name: "no configured aqua server", inputUrls: "foo1.com", provider: new(formatting.HtmlProvider), want: `Please configure Aqua server url to get link to entire scan results.
`, }, { name: "no configured urls", inputServer: "foo.com", provider: new(formatting.HtmlProvider), want: `Unable to create link to entire scan results. Input message doesn't contain 'registry' and 'image' fields or they are empty
`, }, } for _, tc := range testCases { t.Run(tc.name, func(t *testing.T) { got := buildShortMessage(tc.inputServer, tc.inputUrls, tc.provider) assert.Equal(t, tc.want, got, tc.name) }) } } ================================================ FILE: actions/nexusiq.go ================================================ package actions import ( "encoding/base64" "encoding/json" "fmt" "io" "io/ioutil" "log" "net/http" "regexp" "strings" "time" "github.com/aquasecurity/postee/v2/formatting" "github.com/aquasecurity/postee/v2/layout" ) var notAllowed = regexp.MustCompile(`[\.:\/]`) func sanitizedAppName(appName string) string { return notAllowed.ReplaceAllString(appName, "_") } type NexusIqAction struct { Name string Url string User string Password string OrganizationId string } func (nexus *NexusIqAction) GetName() string { return nexus.Name } func (nexus *NexusIqAction) Init() error { log.Printf("Starting Nexus IQ action %q, for sending to %q", nexus.Name, nexus.Url) return nil } func (nexus *NexusIqAction) auth() string { return base64.StdEncoding.EncodeToString([]byte(nexus.User + ":" + nexus.Password)) } func (nexus *NexusIqAction) execute(method string, url string, payload string, headers map[string]string) (map[string]interface{}, error) { client := http.DefaultClient client.Timeout = time.Second * 120 var reader io.Reader if payload != "" { reader = strings.NewReader(payload) } req, err := http.NewRequest(method, url, reader) if err != nil { return nil, err } for name, value := range headers { req.Header.Add(name, value) } req.Header.Add("Authorization", "Basic "+nexus.auth()) resp, err := client.Do(req) if err != nil { return nil, err } defer resp.Body.Close() body, err := ioutil.ReadAll(resp.Body) if err != nil { return nil, err } if resp.StatusCode < 200 || resp.StatusCode > 299 { msg := "received incorrect response status: %d. Body: %s" return nil, fmt.Errorf(msg, resp.StatusCode, body) } r := make(map[string]interface{}) err = json.Unmarshal(body, &r) if err != nil { return nil, err } return r, nil } func (nexus *NexusIqAction) getAppByNameAndOrg(organizationId string, appName string) (string, error) { sanitizedAppName := sanitizedAppName(appName) url := fmt.Sprintf("%s/api/v2/applications/organization/%s", nexus.Url, organizationId) r, err := nexus.execute("GET", url, "", map[string]string{"Content-Type": "application/json"}) if err != nil { return "", fmt.Errorf("error fetching application: %w", err) } applications := r["applications"].([]interface{}) for _, item := range applications { app := item.(map[string]interface{}) if app["publicId"].(string) == sanitizedAppName { return app["id"].(string), nil } } return "", nil } func (nexus *NexusIqAction) createApp(organizationId string, appName string) (string, error) { sanitizedAppName := sanitizedAppName(appName) payload := map[string]string{ "publicId": sanitizedAppName, "name": sanitizedAppName, "organizationId": organizationId, } b, err := json.Marshal(payload) if err != nil { return "", err } url := fmt.Sprintf("%s/api/v2/applications", nexus.Url) r, err := nexus.execute("POST", url, string(b), map[string]string{"Content-Type": "application/json"}) if err != nil { return "", fmt.Errorf("error creating application: %w", err) } return r["id"].(string), nil } func (nexus *NexusIqAction) createOrGetApp(appName string) (string, error) { app, err := nexus.getAppByNameAndOrg(nexus.OrganizationId, appName) if err != nil { return "", err } if app == "" { app, err = nexus.createApp(nexus.OrganizationId, appName) if err != nil { return "", err } } return app, nil } func (nexus *NexusIqAction) registerBom(appId string, bom string) error { url := fmt.Sprintf("%s/api/v2/scan/applications/%s/sources/cyclone", nexus.Url, appId) _, err := nexus.execute("POST", url, bom, map[string]string{"Content-Type": "application/xml"}) if err != nil { return fmt.Errorf("error registering bom: %w", err) } return nil } func (nexus *NexusIqAction) Send(content map[string]string) error { appId, err := nexus.createOrGetApp(content["title"]) if err != nil { return err } data := content["description"] err = nexus.registerBom(appId, data) if err != nil { return err } return nil } func (nexus *NexusIqAction) Terminate() error { log.Printf("Nexus IQ action %q terminated.", nexus.Name) return nil } func (nexus *NexusIqAction) GetLayoutProvider() layout.LayoutProvider { /*TODO come up with smaller interface that doesn't include GetLayoutProvider()*/ return new(formatting.HtmlProvider) } ================================================ FILE: actions/nexusiq_test.go ================================================ package actions import ( "fmt" "io" "io/ioutil" "net/http" "net/http/httptest" "testing" "github.com/gorilla/mux" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) const createdAppId = "cd8fd2f4f289445b8975092e7d3045ba" func TestSanitizedAppName(t *testing.T) { testCases := []struct { name string image string application string }{{ name: "Dot", image: "alpine-3.7", application: "alpine-3_7", }, { name: "Both dot and colon", image: "all-in-one:3.5.19223", application: "all-in-one_3_5_19223", }, { name: "Slash", image: "bpdockerlab/pii-data:1_0", application: "bpdockerlab_pii-data_1_0", }} for _, tc := range testCases { t.Run(tc.name, func(t *testing.T) { appName := sanitizedAppName(tc.image) assert.Equal(t, tc.application, appName) }) } } func TestNexusiq_Init(t *testing.T) { nx := NexusIqAction{} require.NoError(t, nx.Init()) } func TestNexusiq_GetName(t *testing.T) { nx := NexusIqAction{Name: "my-nexusiq"} require.NoError(t, nx.Init()) require.Equal(t, "my-nexusiq", nx.GetName()) } func TestNexusiq_Send(t *testing.T) { organizationId := "9beee80c6fc148dfa51e8b0359ee4d4e" applicationsJson := fmt.Sprintf(` { "applications": [ { "id": "4bb67dcfc86344e3a483832f8c496419", "publicId": "alpine-3_7", "name": "MySecondApplication", "organizationId": "%s", "contactUserName": "NewAppContact" } ] } `, organizationId) createAppPld := fmt.Sprintf(`{"name":"nginx-1_7_1","organizationId":"%s","publicId":"nginx-1_7_1"}`, organizationId) testCases := []struct { name string image string applications string expctdCreateAppPld string expctdAppId string }{{ name: "Existing application", image: "alpine-3.7", applications: applicationsJson, expctdAppId: "4bb67dcfc86344e3a483832f8c496419", }, { name: "New application", image: "nginx-1.7.1", applications: applicationsJson, expctdCreateAppPld: createAppPld, expctdAppId: createdAppId, }, } b, err := ioutil.ReadFile("testdata/nexus-iq-sbom.xml") if err != nil { t.Fatal("unable to read test data %w", err) } for _, tc := range testCases { t.Run(tc.name, func(t *testing.T) { input := map[string]string{ "title": tc.image, "description": string(b), } ts := configureHttp(t, tc.applications, tc.expctdCreateAppPld, tc.expctdAppId) nx := NexusIqAction{Name: "my-nexusiq", Url: ts.URL, User: "admin", Password: "admin", OrganizationId: "9beee80c6fc148dfa51e8b0359ee4d4e"} require.NoError(t, nx.Send(input)) defer ts.Close() }) } } func configureHttp(t *testing.T, applicationsJson, expctdCreateAppPld, expctdAppId string) *httptest.Server { router := mux.NewRouter() //get applications router.HandleFunc("/api/v2/applications/organization/{organization:[a-z0-9]+}", func(w http.ResponseWriter, r *http.Request) { assert.Equal(t, "GET", r.Method) _, _ = w.Write([]byte(applicationsJson)) }) //create application router.HandleFunc("/api/v2/applications", func(w http.ResponseWriter, r *http.Request) { body, err := io.ReadAll(r.Body) require.NoError(t, err) assert.Equal(t, "POST", r.Method) assert.Equal(t, expctdCreateAppPld, string(body)) _, _ = w.Write([]byte(fmt.Sprintf(`{"id":"%s"}`, createdAppId))) }) //register bom router.HandleFunc("/api/v2/scan/applications/{app:[a-z0-9]+}/sources/cyclone", func(w http.ResponseWriter, r *http.Request) { vars := mux.Vars(r) assert.Equal(t, "POST", r.Method) assert.Equal(t, expctdAppId, vars["app"]) _, _ = w.Write([]byte("{}")) }) return httptest.NewServer(router) } ================================================ FILE: actions/opsgenie.go ================================================ package actions import ( "context" "encoding/json" "fmt" "log" "strings" "github.com/opsgenie/opsgenie-go-sdk-v2/alert" "github.com/opsgenie/opsgenie-go-sdk-v2/client" "github.com/aquasecurity/postee/v2/formatting" "github.com/aquasecurity/postee/v2/layout" ) const defaultPriority = alert.P3 type OpsGenieAction struct { Name string User string APIKey string Responders []string VisibleTo []string Tags []string Alias string Entity string PrioritySource string priority alert.Priority client *alert.Client } func (ops *OpsGenieAction) GetName() string { return ops.Name } func (ops *OpsGenieAction) Init() (err error) { ops.client, err = alert.NewClient(&client.Config{ ApiKey: ops.APIKey, }) if err != nil { return } if ops.PrioritySource != "" { ops.priority = alert.Priority(ops.PrioritySource) } else { ops.priority = defaultPriority } log.Printf("Starting OpsGenie action %q....", ops.Name) return nil } func getUserResponders(users []string) []alert.Responder { if len(users) == 0 { return nil } responders := []alert.Responder{} for _, user := range users { responder := alert.Responder{Type: alert.UserResponder, Username: user} responders = append(responders, responder) } return responders } func (ops *OpsGenieAction) convertResultToOpsGenie(title string, content map[string]interface{}) *alert.CreateAlertRequest { description := "" if content["description"] != nil { description = fmt.Sprint(content["description"]) } alias := ops.Alias if content["alias"] != nil { alias = fmt.Sprint(content["alias"]) } entity := ops.Entity if content["entity"] != nil { entity = fmt.Sprint(content["entity"]) } priority := ops.priority if content["priority"] != nil { priority = alert.Priority(fmt.Sprint(content["priority"])) } tags := ops.Tags if content["tags"] != nil { switch content["tags"].(type) { case []string: tags = append(tags, content["tags"].([]string)...) case string: tags = append(tags, strings.Split(content["tags"].(string), ",")...) } } return &alert.CreateAlertRequest{ Message: title, Description: description, Alias: alias, Entity: entity, Priority: priority, Tags: tags, Responders: getUserResponders(ops.Responders), VisibleTo: getUserResponders(ops.VisibleTo), } } func (ops *OpsGenieAction) Send(input map[string]string) error { data := map[string]interface{}{} if err := json.Unmarshal([]byte(input["description"]), &data); err != nil { return err } r := ops.convertResultToOpsGenie(input["title"], data) r.User = ops.User alertResult, err := ops.client.Create(context.Background(), r) if err != nil { return err } log.Printf("Sending to %q was successful: %s", ops.Name, alertResult.Result) return nil } func (*OpsGenieAction) Terminate() error { log.Println("Terminating OpsGenie Action") return nil } func (ops *OpsGenieAction) GetLayoutProvider() layout.LayoutProvider { /*TODO come up with smaller interface that doesn't include GetLayoutProvider()*/ return new(formatting.SlackMrkdwnProvider) } ================================================ FILE: actions/opsgenie_test.go ================================================ package actions import ( "testing" "github.com/opsgenie/opsgenie-go-sdk-v2/alert" "github.com/stretchr/testify/assert" ) func TestGetUserResponders(t *testing.T) { tests := []struct { name string users []string responders []alert.Responder }{ { name: "good way", users: []string{"user1", "user2"}, responders: []alert.Responder{ {Type: alert.UserResponder, Username: "user1"}, {Type: alert.UserResponder, Username: "user2"}, }, }, { name: "without users", }, } for _, test := range tests { t.Run(test.name, func(t *testing.T) { got := getUserResponders(test.users) assert.Equal(t, test.responders, got) }) } } func TestConvertResultToOpsGenie(t *testing.T) { tests := []struct { name string title string data map[string]interface{} result *alert.CreateAlertRequest }{ { name: "good way", title: "all-in-one:3.5.19223", data: map[string]interface{}{ "description": "all-in-one:3.5.19223 vulnerability scan report", "alias": "all-in-one:3.5.19223", "entity": "entity", "priority": "P4", "tags": []string{"tag1", "tag2"}, }, result: &alert.CreateAlertRequest{ Message: "all-in-one:3.5.19223", Priority: alert.P4, Description: "all-in-one:3.5.19223 vulnerability scan report", Alias: "all-in-one:3.5.19223", Entity: "entity", Tags: []string{"tag1", "tag2"}, }, }, { name: "only title", title: "all-in-one:3.5.19223", data: map[string]interface{}{}, result: &alert.CreateAlertRequest{ Message: "all-in-one:3.5.19223", Priority: alert.P3, }, }, { name: "good way with tags as string", title: "all-in-one:3.5.19223", data: map[string]interface{}{ "description": "all-in-one:3.5.19223 vulnerability scan report", "alias": "all-in-one:3.5.19223", "entity": "entity", "priority": "P4", "tags": "tag1,tag2", }, result: &alert.CreateAlertRequest{ Message: "all-in-one:3.5.19223", Priority: alert.P4, Description: "all-in-one:3.5.19223 vulnerability scan report", Alias: "all-in-one:3.5.19223", Entity: "entity", Tags: []string{"tag1", "tag2"}, }, }, } for _, test := range tests { t.Run(test.name, func(t *testing.T) { ops := &OpsGenieAction{ APIKey: "anyAPIkey", } err := ops.Init() assert.NoError(t, err) r := ops.convertResultToOpsGenie(test.title, test.data) assert.Equal(t, test.result, r) }) } } ================================================ FILE: actions/pagerduty.go ================================================ package actions import ( "context" "fmt" "log" "time" "github.com/PagerDuty/go-pagerduty" "github.com/aquasecurity/postee/v2/formatting" "github.com/aquasecurity/postee/v2/layout" ) type Clock interface { Now() time.Time } type realClock struct{} func (rc *realClock) Now() time.Time { return time.Now() } type PagerdutyClient struct { client *pagerduty.Client clock Clock Name string AuthToken string RoutingKey string } func (p *PagerdutyClient) GetName() string { return p.Name } func (p *PagerdutyClient) Init() error { if len(p.AuthToken) <= 0 { return fmt.Errorf("pagerduty auth token is required to send events") } if len(p.RoutingKey) <= 0 { return fmt.Errorf("pagerduty routing key is required to send events") } p.client = pagerduty.NewClient(p.AuthToken) p.clock = &realClock{} return nil } func (p *PagerdutyClient) Send(m map[string]string) error { ctx := context.Background() resp, err := p.client.ManageEventWithContext(ctx, &pagerduty.V2Event{ RoutingKey: p.RoutingKey, Action: "trigger", Payload: &pagerduty.V2Payload{ Summary: m["title"], // required Source: "postee", Severity: "critical", Timestamp: p.clock.Now().Format(time.RFC3339), Details: m["description"], // required }, }) if err != nil { return fmt.Errorf("failed to send event to pagerduty: %w", err) } log.Printf("successfully sent event to pagerduty, response msg: %s, status: %s", resp.Message, resp.Status) return nil } func (p *PagerdutyClient) Terminate() error { return nil } func (p *PagerdutyClient) GetLayoutProvider() layout.LayoutProvider { /*TODO come up with smaller interface that doesn't include GetLayoutProvider()*/ return new(formatting.HtmlProvider) } ================================================ FILE: actions/pagerduty_test.go ================================================ package actions import ( "fmt" "io" "net/http" "net/http/httptest" "testing" "time" "github.com/stretchr/testify/require" "github.com/PagerDuty/go-pagerduty" "github.com/stretchr/testify/assert" ) type fakeClock struct{} func (fc *fakeClock) Now() time.Time { t, _ := time.Parse(time.RFC3339, "2022-09-22T22:07:55-07:00") return t } func TestPagerdutyClient_Init(t *testing.T) { t.Run("happy path", func(t *testing.T) { require.NoError(t, (&PagerdutyClient{ Name: "my-pagerduty", AuthToken: "123456", RoutingKey: "foobarbaz", }).Init()) }) t.Run("sad path, no auth token", func(t *testing.T) { assert.Equal(t, "pagerduty auth token is required to send events", (&PagerdutyClient{ Name: "my-pagerduty", RoutingKey: "foobarbaz", }).Init().Error()) }) t.Run("sad path, no routing key", func(t *testing.T) { assert.Equal(t, "pagerduty routing key is required to send events", (&PagerdutyClient{ Name: "my-pagerduty", AuthToken: "123456", }).Init().Error()) }) } func TestPagerdutyClient_Send(t *testing.T) { testCases := []struct { name string handlerFunc http.HandlerFunc expectedError string pagerdutyClient PagerdutyClient inputEvent map[string]string }{ { name: "happy path", handlerFunc: func(writer http.ResponseWriter, request *http.Request) { b, _ := io.ReadAll(request.Body) assert.JSONEq(t, `{"routing_key":"123456","event_action":"trigger","payload":{"summary":"my fancy title","source":"postee","severity":"critical","timestamp":"2022-09-22T22:07:55-07:00","custom_details":"foo bar baz details"}}`, string(b)) _, _ = fmt.Fprint(writer, `{"status": "ok", "dedup_key": "yes", "message": "ok"}`) }, pagerdutyClient: PagerdutyClient{ Name: "my-pagerduty", AuthToken: "foo-bar-baz", RoutingKey: "123456", }, inputEvent: map[string]string{ "description": "foo bar baz details", "title": "my fancy title", }, }, { name: "sad path, pagerduty api returns an error", handlerFunc: func(writer http.ResponseWriter, request *http.Request) { writer.WriteHeader(http.StatusInternalServerError) }, pagerdutyClient: PagerdutyClient{ Name: "my-pagerduty", AuthToken: "foo-bar-baz", RoutingKey: "123456", }, inputEvent: map[string]string{ "description": "foo bar baz details", "title": "my fancy title", }, expectedError: "failed to send event to pagerduty: HTTP response with status code 500 does not contain Content-Type: application/json", }, } for _, tc := range testCases { t.Run(tc.name, func(t *testing.T) { ts := httptest.NewServer(tc.handlerFunc) defer ts.Close() tc.pagerdutyClient.client = pagerduty.NewClient(tc.pagerdutyClient.AuthToken, pagerduty.WithV2EventsAPIEndpoint(ts.URL)) tc.pagerdutyClient.clock = &fakeClock{} err := tc.pagerdutyClient.Send(tc.inputEvent) switch { case tc.expectedError != "": assert.Equal(t, tc.expectedError, err.Error(), tc.name) default: assert.NoError(t, err, tc.name) } }) } } ================================================ FILE: actions/plugin.go ================================================ package actions import ( "fmt" "log" "strings" "github.com/aquasecurity/postee/v2/layout" ) const ( ApplicationScopeOwner = "<%application_scope_owner%>" ) type Action interface { GetName() string Init() error Send(map[string]string) error Terminate() error GetLayoutProvider() layout.LayoutProvider } func getHandledRecipients(recipients []string, content *map[string]string, outputName string) []string { var result []string for _, r := range recipients { if r == ApplicationScopeOwner { owners, err := getAppScopeOwners(content) if err != nil { log.Printf("get application scope owners error for %q: %v", outputName, err) continue } result = append(result, owners...) } else { result = append(result, r) } } return result } func getAppScopeOwners(content *map[string]string) ([]string, error) { ownersIn, ok := (*content)["owners"] if !ok { return nil, fmt.Errorf("recipients field contains %q, but received a webhook without this data", ApplicationScopeOwner) } return strings.Split(ownersIn, ";"), nil } ================================================ FILE: actions/servicenow.go ================================================ package actions import ( "encoding/json" "log" "strconv" "time" "github.com/aquasecurity/postee/v2/formatting" "github.com/aquasecurity/postee/v2/layout" servicenow "github.com/aquasecurity/postee/v2/servicenow" ) type ServiceNowAction struct { Name string User string Password string Instance string Table string layoutProvider layout.LayoutProvider } func (sn *ServiceNowAction) GetName() string { return sn.Name } func (sn *ServiceNowAction) Init() error { log.Printf("Starting ServiceNow action %q....", sn.Name) log.Printf("Your ServiceNow Table is %q on '%s.%s'", sn.Table, sn.Instance, servicenow.BaseServer) sn.layoutProvider = new(formatting.HtmlProvider) return nil } func (sn *ServiceNowAction) Send(content map[string]string) error { log.Printf("Sending via ServiceNow %q", sn.Name) // parse date date := "" if i, err := strconv.ParseInt(content["date"], 10, 64); err == nil { date = time.Unix(i, 0).Format("2006-01-02 15:04:05") } // parse severity severity := 3 // default ServiceNow value if s, err := strconv.Atoi(content["severity"]); err == nil { severity = s } d := &servicenow.ServiceNowData{ Opened: date, ShortDescription: content["title"], Caller: sn.User, Category: content["category"], Impact: severity, Urgency: severity, Subcategory: content["subcategory"], AssignedTo: content["assignedTo"], AssignmentGroup: content["assignedGroup"], WorkNotes: "[code]" + content["description"] + "[/code]", Description: content["summary"], } body, err := json.Marshal(d) if err != nil { log.Println("ServiceNow Error:", err) return err } err = servicenow.InsertRecordToTable(sn.User, sn.Password, sn.Instance, sn.Table, body) if err != nil { log.Println("ServiceNow Error:", err) return err } log.Printf("Sending via ServiceNow %q was successful!", sn.Name) return nil } func (sn *ServiceNowAction) Terminate() error { log.Printf("ServiceNow action %q terminated", sn.Name) return nil } func (sn *ServiceNowAction) GetLayoutProvider() layout.LayoutProvider { return sn.layoutProvider } ================================================ FILE: actions/slack.go ================================================ package actions import ( "bytes" "encoding/json" "errors" "log" "strings" "github.com/aquasecurity/postee/v2/data" "github.com/aquasecurity/postee/v2/formatting" "github.com/aquasecurity/postee/v2/layout" slackAPI "github.com/aquasecurity/postee/v2/slack" ) const ( slackBlockLimit = 49 ) type SlackAction struct { Name string AquaServer string Url string slackLayout layout.LayoutProvider } func (slack *SlackAction) GetName() string { return slack.Name } func (slack *SlackAction) Init() error { slack.slackLayout = new(formatting.SlackMrkdwnProvider) log.Printf("Starting Slack action %q....", slack.Name) return nil } func clearSlackText(text string) string { s := strings.ReplaceAll(text, "&", "&") s = strings.ReplaceAll(s, "<", "<") s = strings.ReplaceAll(s, ">", ">") return s } func buildSlackBlock(title string, data []byte) []byte { var content bytes.Buffer content.WriteByte('{') content.WriteString("\"blocks\":") content.WriteByte('[') content.WriteString(title) content.Write(data) content.WriteByte(']') content.WriteByte('}') return content.Bytes() } func (slack *SlackAction) Send(input map[string]string) error { log.Printf("Sending via Slack %q", slack.Name) title := clearSlackText(slack.slackLayout.TitleH2(input["title"])) var body string if strings.HasSuffix(input["description"], ",") { body = strings.TrimSuffix(input["description"], ",") } else { body = input["description"] } body = clearSlackText(body) if !strings.HasPrefix(body, "[") { body = "[" + body + "]" } if !json.Valid([]byte(body)) { return errors.New("wrong template selected, choose a correct template") } rawBlock := make([]data.SlackBlock, 0) err := json.Unmarshal([]byte(body), &rawBlock) if err != nil { log.Printf("Unmarshal slack sending error: %v", err) return err } length := len(rawBlock) if length >= slackBlockLimit { message := buildShortMessage(slack.AquaServer, input["url"], slack.slackLayout) if err := slackAPI.SendToUrl(slack.Url, buildSlackBlock(title, []byte(message))); err != nil { return err } log.Printf("Sending via Slack %q was successful!", slack.Name) } else { for n := 0; n < length; { d := length - n if d >= 49 { d = 49 } cutData, _ := json.Marshal(rawBlock[n : n+d]) cutData = cutData[1 : len(cutData)-1] if err := slackAPI.SendToUrl(slack.Url, buildSlackBlock(title, cutData)); err != nil { log.Printf("Sending to %q was finished with error: %v", slack.Name, err) return err } else { log.Printf("Sending [%d/%d part] to %q was successful!", int(n/49)+1, int(length/49)+1, slack.Name) } n += d } } return nil } func (slack *SlackAction) Terminate() error { log.Printf("Slack output %q terminated", slack.Name) return nil } func (slack *SlackAction) GetLayoutProvider() layout.LayoutProvider { return slack.slackLayout } ================================================ FILE: actions/splunk.go ================================================ package actions import ( "bytes" "crypto/tls" "encoding/json" "errors" "fmt" "io/ioutil" "log" "net" "net/http" "strings" "time" "github.com/aquasecurity/postee/v2/data" "github.com/aquasecurity/postee/v2/formatting" "github.com/aquasecurity/postee/v2/layout" ) const defaultSizeLimit = 10000 type SplunkAction struct { Name string Url string Token string EventLimit int TlsVerify bool splunkLayout layout.LayoutProvider } func (splunk *SplunkAction) GetName() string { return splunk.Name } func (splunk *SplunkAction) Init() error { splunk.splunkLayout = new(formatting.HtmlProvider) log.Printf("Starting Splunk action %q....", splunk.Name) return nil } func (splunk *SplunkAction) Send(d map[string]string) error { log.Printf("Sending a message to %q", splunk.Name) if splunk.EventLimit == 0 { splunk.EventLimit = defaultSizeLimit } if splunk.EventLimit < defaultSizeLimit { log.Printf("[WARNING] %q has a short limit %d (default %d)", splunk.Name, splunk.EventLimit, defaultSizeLimit) } if !strings.HasSuffix(splunk.Url, "/") { splunk.Url += "/" } scanInfo := new(data.ScanImageInfo) body := []byte(d["description"]) if !json.Valid([]byte(body)) { return errors.New("wrong template selected, choose a correct template") } err := json.Unmarshal(body, scanInfo) if err != nil { log.Printf("sending to %q error: %v", splunk.Name, err) return err } eventFormat := "{\"sourcetype\": \"_json\", \"event\": " constLimit := len(eventFormat) - 1 var fields []byte for { fields, err = json.Marshal(scanInfo) if err != nil { log.Printf("sending to %q error: %v", splunk.Name, err) return err } if len(fields) < splunk.EventLimit-constLimit { break } switch { case len(scanInfo.Resources) > 0: scanInfo.Resources = nil continue case len(scanInfo.Malwares) > 0: scanInfo.Malwares = nil continue case len(scanInfo.SensitiveData) > 0: scanInfo.SensitiveData = nil continue default: msg := fmt.Sprintf("Scan result for %q is large for %q , its size if %d (limit %d)", scanInfo.Image, splunk.Name, len(fields), splunk.EventLimit) log.Print(msg) return errors.New(msg) } } var buff bytes.Buffer buff.WriteString(eventFormat) buff.Write(fields) buff.WriteByte('}') req, err := http.NewRequest("POST", splunk.Url+"services/collector", &buff) if err != nil { return err } req.Header.Add("Authorization", "Splunk "+splunk.Token) client := http.Client{ // default transport with tls config added Transport: &http.Transport{ Proxy: http.ProxyFromEnvironment, DialContext: (&net.Dialer{ Timeout: 30 * time.Second, KeepAlive: 30 * time.Second, }).DialContext, ForceAttemptHTTP2: true, MaxIdleConns: 100, IdleConnTimeout: 90 * time.Second, TLSHandshakeTimeout: 10 * time.Second, ExpectContinueTimeout: 1 * time.Second, TLSClientConfig: &tls.Config{InsecureSkipVerify: splunk.TlsVerify}, }, } resp, err := client.Do(req) if err != nil { return err } if resp.StatusCode != http.StatusOK { defer resp.Body.Close() b, _ := ioutil.ReadAll(resp.Body) log.Printf("Splunk sending error: failed response status %q. Body: %q", resp.Status, string(b)) return errors.New("failed response status for Splunk sending") } log.Printf("Sending a message to %q was successful!", splunk.Name) return nil } func (splunk *SplunkAction) Terminate() error { log.Printf("Splunk action %q terminated", splunk.Name) return nil } func (splunk *SplunkAction) GetLayoutProvider() layout.LayoutProvider { return splunk.splunkLayout } ================================================ FILE: actions/stdout.go ================================================ package actions import ( "fmt" "os" "github.com/aquasecurity/postee/v2/formatting" "github.com/aquasecurity/postee/v2/layout" ) type StdoutAction struct { Name string } func (stdout StdoutAction) GetName() string { return stdout.Name } func (stdout StdoutAction) Init() error { return nil } func (stdout StdoutAction) Send(data map[string]string) error { _, err := fmt.Fprintf(os.Stdout, "%s", data["description"]) return err } func (stdout StdoutAction) Terminate() error { return nil } func (stdout StdoutAction) GetLayoutProvider() layout.LayoutProvider { return &formatting.HtmlProvider{} } ================================================ FILE: actions/teams.go ================================================ package actions import ( "encoding/json" "log" "github.com/aquasecurity/postee/v2/formatting" "github.com/aquasecurity/postee/v2/layout" "github.com/aquasecurity/postee/v2/utils" msteams "github.com/aquasecurity/postee/v2/teams" ) const ( teamsSizeLimit = 18000 // 28 KB is an approximate limit for MS Teams ) type TeamsAction struct { Name string AquaServer string teamsLayout layout.LayoutProvider Webhook string } func (teams *TeamsAction) GetName() string { return teams.Name } func (teams *TeamsAction) Init() error { log.Printf("Starting MS Teams action %q....", teams.Name) teams.teamsLayout = new(formatting.HtmlProvider) return nil } func (teams *TeamsAction) Send(input map[string]string) error { log.Printf("Sending to MS Teams via %q...", teams.Name) utils.Debug("Title for %q: %q\n", teams.Name, input["title"]) utils.Debug("Url(s) for %q: %q\n", teams.Name, input["url"]) utils.Debug("Webhook for %q: %q\n", teams.Name, teams.Webhook) utils.Debug("Length of Description for %q: %d/%d\n", teams.Name, len(input["description"]), teamsSizeLimit) var body string if len(input["description"]) > teamsSizeLimit { utils.Debug("MS Team action will send SHORT message\n") body = buildShortMessage(teams.AquaServer, input["url"], teams.teamsLayout) } else { utils.Debug("MS Team action will send LONG message\n") body = input["description"] } utils.Debug("Message is: %q\n", body) escaped, err := escapeJSON(body) if err != nil { log.Printf("Error while escaping payload: %v", err) return err } err = msteams.CreateMessageByWebhook(teams.Webhook, teams.teamsLayout.TitleH2(input["title"])+escaped) if err != nil { log.Printf("TeamsAction Send Error: %v", err) return err } log.Printf("Sending to MS Teams via %q was successful!", teams.Name) return nil } func (teams *TeamsAction) Terminate() error { log.Printf("MS Teams action %q terminated", teams.Name) return nil } func (teams *TeamsAction) GetLayoutProvider() layout.LayoutProvider { return teams.teamsLayout } func escapeJSON(s string) (string, error) { b, err := json.Marshal(s) if err != nil { panic(err) } // Trim the beginning and trailing " character return string(b[1 : len(b)-1]), nil } ================================================ FILE: actions/testdata/nexus-iq-sbom.xml ================================================Image name: Demo mock image1
Registry: registry1
Image is non-compliant
| CRITICAL | HIGH | MEDIUM | LOW | NEGLIGIBLE |
|---|---|---|---|---|
| 0 | 1 | 3 | 4 | 5 |
%s
\n", p) } func (html *HtmlProvider) TitleH1(title string) string { return fmt.Sprintf("| Header1 | Header2 |
|---|---|
| Field1 | Field2 |
Lorem Ipsum
\n", "Lorem Ipsum", }, } tagsTesting(tests, t, new(HtmlProvider)) } ================================================ FILE: formatting/jiraprovider.go ================================================ package formatting import ( "bytes" "fmt" "strings" ) type JiraLayoutProvider struct{} func (jira *JiraLayoutProvider) P(p string) string { return fmt.Sprintf("%s\n", p) } func (jira *JiraLayoutProvider) TitleH1(title string) string { return fmt.Sprintf("h1. %s\n", title) } func (jira *JiraLayoutProvider) TitleH2(title string) string { return fmt.Sprintf("h2. %s\n", title) } func (jira *JiraLayoutProvider) TitleH3(title string) string { return fmt.Sprintf("h3. %s\n", title) } func (jira *JiraLayoutProvider) ColourText(text, color string) string { return fmt.Sprintf("{color:%s}%s{color}", color, text) } func (jira *JiraLayoutProvider) Table(rows [][]string) string { if len(rows) == 0 { return "" } var builder bytes.Buffer for i, row := range rows { if i == 0 { fmt.Fprintf(&builder, "||%s||\n", strings.Join(row, "||")) } else { fmt.Fprintf(&builder, "|%s|\n", strings.Join(row, "|")) } } builder.WriteString("\n") return builder.String() } func (jira *JiraLayoutProvider) A(url, title string) string { return fmt.Sprintf("[%s|%s]", title, url) } ================================================ FILE: formatting/jiraprovider_test.go ================================================ package formatting import "testing" func TestJiraLayoutProvider_Tags(t *testing.T) { tests := []tagsTest{ { "Lorem Ipsum", "red", "url", "{color:red}Lorem Ipsum{color}", "h1. Lorem Ipsum\n", "h2. Lorem Ipsum\n", "h3. Lorem Ipsum\n", "Lorem Ipsum\n", "[Lorem Ipsum|url]", }, } tagsTesting(tests, t, new(JiraLayoutProvider)) } func TestJiraLayoutProvider_Table(t *testing.T) { var tests = []tableTest{ { source: [][]string{ {"Header1", "Header2"}, {"Field1", "Field2"}, }, result: `||Header1||Header2|| |Field1|Field2| `, }, { source: nil, result: "", }, } tableTesting(tests, t, new(JiraLayoutProvider)) } ================================================ FILE: formatting/markup_test.go ================================================ package formatting import ( "testing" "github.com/aquasecurity/postee/v2/layout" ) type tagsTest struct { source string color string link string colourText, h1, h2, h3, p, a string } type tableTest struct { source [][]string result string } func tagsTesting(tests []tagsTest, t *testing.T, provider layout.LayoutProvider) { for _, test := range tests { if c := provider.ColourText(test.source, test.color); c != test.colourText { t.Errorf("Wrong colorur text\nWaited: %q\n Result: %q", test.colourText, c) } if h1 := provider.TitleH1(test.source); h1 != test.h1 { t.Errorf("Wrong H1 formatting for %q\nWaited: %q\n Result: %q", test.source, test.h1, h1) } if h2 := provider.TitleH2(test.source); h2 != test.h2 { t.Errorf("Wrong H2 formatting for %q\nWaited: %q\n Result: %q", test.source, test.h2, h2) } if h3 := provider.TitleH3(test.source); h3 != test.h3 { t.Errorf("Wrong H3 formatting for %q\nWaited: %q\n Result: %q", test.source, test.h3, h3) } if p := provider.P(test.source); p != test.p { t.Errorf("Wrong P formatting for %q\nWaited: %q\n Result: %q", test.source, test.p, p) } if a := provider.A(test.link, test.source); a != test.a { t.Errorf("Wrong P formatting for link %q (%q)\nWaited: %q\n Result: %q", test.link, test.source, test.a, a) } } } func tableTesting(tests []tableTest, t *testing.T, provider layout.LayoutProvider) { for _, test := range tests { if got := provider.Table(test.source); got != test.result { t.Errorf("Error: html.Table(test.Source)\nResult: %s\nWaited: %s\n", got, test.result) } } } ================================================ FILE: formatting/slackmrkdwnprovider.go ================================================ package formatting import ( "bytes" "encoding/json" "fmt" "log" "github.com/aquasecurity/postee/v2/data" ) func getMrkdwnText(text string) string { block := &data.SlackBlock{ TypeField: "section", TextField: &data.SlackTextBlock{ TypeField: "mrkdwn", TextField: text, }, } result, err := json.Marshal(block) if err != nil { log.Printf("SlackMrkdwnProvider Error: %v", err) return "" } result = append(result, ',') return string(result) } type SlackMrkdwnProvider struct{} func (mrkdwn *SlackMrkdwnProvider) TitleH1(title string) string { return getMrkdwnText(fmt.Sprintf("*%s*", title)) } func (mrkdwn *SlackMrkdwnProvider) TitleH2(title string) string { return getMrkdwnText(fmt.Sprintf("*%s*", title)) } func (mrkdwn *SlackMrkdwnProvider) TitleH3(title string) string { return mrkdwn.TitleH2(title) } func (mrkdwn *SlackMrkdwnProvider) ColourText(text, color string) string { return fmt.Sprintf("*%s*", text) } func (mrkdwn *SlackMrkdwnProvider) Table(rows [][]string) string { if len(rows) == 0 { return "" } var builder bytes.Buffer fields := &data.SlackBlock{ TypeField: "section", } if len(rows) == 2 && len(rows[0]) == 5 { fields.Fields = make([]data.SlackTextBlock, 2*len(rows[0])) for i, r := range rows { for j, f := range r { if i == 0 { fields.Fields[j*2] = data.SlackTextBlock{ TypeField: "mrkdwn", TextField: fmt.Sprintf("*%s*", f), } } else { fields.Fields[j*2+1] = data.SlackTextBlock{ TypeField: "mrkdwn", TextField: f, } } } } } else { totalRows := len(rows) for line, r := range rows { if line%5 == 0 { if fields.Fields != nil { block, err := json.Marshal(fields) if err != nil { log.Printf("SlackMrkdwnProvider Error: %v", err) return "" } builder.Write(block) builder.WriteByte(',') } fields = new(data.SlackBlock) fields.TypeField = "section" current := 5 if (totalRows - line) < 5 { current = totalRows - line } fields.Fields = make([]data.SlackTextBlock, current*2) } var cell1, cell2 bytes.Buffer for j, f := range r { bold := "" if line == 0 { bold = "*" } switch j { case 0: fmt.Fprintf(&cell1, "%s%s%s", bold, f, bold) case 1: if rows[0][0] == "#" { fmt.Fprintf(&cell1, " %s%s%s", bold, f, bold) } else { fmt.Fprintf(&cell2, "%s%s%s", bold, f, bold) if len(r) > 2 { fmt.Fprint(&cell2, " / ") } } default: if j > 2 { cell2.WriteString(" / ") } fmt.Fprintf(&cell2, "%s%s%s", bold, f, bold) } } fields.Fields[(line%5)*2] = data.SlackTextBlock{ TypeField: "mrkdwn", TextField: cell1.String(), } fields.Fields[(line%5)*2+1] = data.SlackTextBlock{ TypeField: "mrkdwn", TextField: cell2.String(), } } } result, err := json.Marshal(fields) if err != nil { log.Printf("SlackMrkdwnProvider Error: %v", err) return "" } builder.Write(result) builder.WriteByte(',') return builder.String() } func (mrkdwn *SlackMrkdwnProvider) P(p string) string { return getMrkdwnText(p) } func (mrkdwn *SlackMrkdwnProvider) A(url, title string) string { return fmt.Sprintf("<%s|%s>", url, title) } ================================================ FILE: formatting/slackmrkdwnprovider_test.go ================================================ package formatting import "testing" func TestSlackMrkdwn(t *testing.T) { tests := []tagsTest{ { "Lorem Ipsum", "red", "url", "*Lorem Ipsum*", "{\"type\":\"section\",\"text\":{\"type\":\"mrkdwn\",\"text\":\"*Lorem Ipsum*\"}},", "{\"type\":\"section\",\"text\":{\"type\":\"mrkdwn\",\"text\":\"*Lorem Ipsum*\"}},", "{\"type\":\"section\",\"text\":{\"type\":\"mrkdwn\",\"text\":\"*Lorem Ipsum*\"}},", "{\"type\":\"section\",\"text\":{\"type\":\"mrkdwn\",\"text\":\"Lorem Ipsum\"}},", "%sName: %s
Category: %s
Severity: %s
Data: %s
Resourse policy name: %s
Resourse policy application scopes: %s
` summary_tpl =`Category: %s Severity: %s` table_tpl:=`Insight ID: %s
Description: %s
Impact: %s
Severity: %s
Found Date: %s
Last Scan: %s
URL: %s
Resourse ID: %s
Resourse Name: %s
ARN: %s
Extra Info: %s
Resourse policy name: %s
Resourse policy application scopes: %s
` summary_tpl =`Insight ID: %s Description: %s Impact: %s Severity: %s Found Date: %s Last Scan: %s URL: %s` vlnrb_tpl = `Vulnerabilities
%s ` sensitive_data_tpl = `Sensitive data
%s ` #Extra % is required in width:100% table_tpl:=`Name: %s
Registry: %s
Malware found: %s
Sensitive data found: %s
Resourse policy name: %s
Resourse policy application scopes: %s
%s ` summary_tpl =`Name: %s Registry: %s %s %s vulnerabilities: * critical: %d, * high: %d, * medium: %d, * low: %d, * negligible: %d %s` vlnrb_tpl = `See more: %s
`,[href, text]), #link server_url == "") ]) } result_date = input.scan_started.seconds result_category = "Serverless functions Scanning" if { report_type == "function" }else = "Security - VM Scan results" if { report_type == "vm" }else = "Security Image Scan results" result_subcategory = "Security incident" result_assigned_to := by_flag(input.application_scope_owners[0], "", count(input.application_scope_owners) == 1) result_assigned_group := by_flag(input.application_scope[0], "", count(input.application_scope) == 1) result_severity := 1 if { input.vulnerability_summary.critical > 0 } else = 2 if { input.vulnerability_summary.high > 0 } else = 3 result_summary := summary{ summary = sprintf(summary_tpl,[ input.image, input.registry, by_flag( "Malware found: Yes", "Malware found: No", input.scan_options.scan_malware #reflects current logic ), by_flag( "Sensitive data found: Yes", "Sensitive data found: No", input.scan_options.scan_sensitive_data #reflects current logic ), vulnerability_summary_critical, vulnerability_summary_high, vulnerability_summary_medium, vulnerability_summary_low, vulnerability_summary_negligible, by_flag( "", sprintf(`See more: %s`,[text]), #link server_url == ""), ]) } ================================================ FILE: rego-templates/tracee-html.rego ================================================ package postee.tracee.html #Example of handling tracee event title:=sprintf("Tracee Detection - %s", [input.SigMetadata.Name]) tpl :=`Rule Description: %s
Detection: %s
MITRE Details: %s
Severity: %v
` result:= res { res:= sprintf(tpl, [ input.SigMetadata.Description, input.Context.processName, input.SigMetadata.Properties, input.SigMetadata.Properties.Severity ]) } ================================================ FILE: rego-templates/tracee-slack.rego ================================================ package postee.tracee.slack #Example of handling tracee event title:=sprintf("Tracee Detection - %s", [input.SigMetadata.Name]) result:= res { res:= [ { "type":"section", "text": {"type":"mrkdwn","text": sprintf("*Rule Description:* %s", [input.SigMetadata.Description])}}, { "type":"section", "text": {"type":"mrkdwn","text": sprintf("*Detection:* %s", [input.Context.processName])}}, { "type":"section", "text": {"type":"mrkdwn","text": sprintf("*MITRE Details:* %v", [input.SigMetadata.Properties])}}, { "type":"section", "text": {"type":"mrkdwn","text": sprintf("*Severity:* %v", [input.SigMetadata.Properties.Severity])}} ] } ================================================ FILE: rego-templates/trivy-jira.rego ================================================ package postee.trivy.jira ############################################# Common functions ############################################ with_default(obj, prop, default_value) = default_value { not obj[prop] } with_default(obj, prop, default_value) = obj[prop] { obj[prop] } #import common.by_flag ################################################ Templates ################################################ #main template to render message tpl:=` h1. Image name: %s %s %s %s %s %s ` vlnrb_tpl = ` h4. %s severity vulnerabilities %s ` #Extra % is required in width:100% table_tpl := ` %s ` cell_tpl := `| %s ` header_tpl := `|| %s ` row_tpl := ` | %s ` colored_text_tpl := "{color:%s}%s{color}" ########################################################################################################### ############################################## Html rendering ############################################# render_table_headers(headers) = row { count(headers) > 0 ths := [th | header := headers[_] th := sprintf(header_tpl, [header]) ] row := sprintf(row_tpl, [concat("", ths)]) } render_table_headers(headers) = "" { #if headers not specified return empty results count(headers) == 0 } render_table(headers, content_array) = s { rows := [tr | cells := content_array[_] tds := [td | ctext := cells[_] td := to_cell(ctext) ] tr = sprintf(row_tpl, [concat("", tds)]) ] s := sprintf(table_tpl, [concat("", array.concat([render_table_headers(headers)], rows))]) } ## why I added it? to_cell(txt) = c { c := sprintf(cell_tpl, [txt]) } to_colored_text(color, txt) = spn { spn := sprintf(colored_text_tpl, [color, txt]) } ####################################### Template specific functions ####################################### to_severity_color(color, level) = spn { spn := to_colored_text(color, format_int(with_default(input.Metadata.vulnerability_summary, level, 0), 10)) } cnt_by_severity(severity) = cnt { vln_list := [r | some i, j item := input.Results[i] item.Vulnerabilities[j].Severity == severity r := item.Vulnerabilities[j] ] cnt := count(vln_list) } # 2 dimension array for vulnerabilities summary severities_stats := [ ["critical", to_severity_color("#c00000", "critical")], ["high", to_severity_color("#e0443d", "high")], ["medium", to_severity_color("#f79421", "medium")], ["low", to_severity_color("#e1c930", "low")], ["unknown", to_severity_color("green", "unknown")], ] vlnrb_headers := ["Layer", "Title","Vulnerability ID", "Resource name", "Path", "Installed version", "Fix version", "Url"] render_vlnrb(severity, list) = sprintf(vlnrb_tpl, [severity, render_table(vlnrb_headers, list)]) { count(list) > 0 } render_vlnrb(severity, list) = "" { #returns empty string if list of vulnerabilities is passed count(list) == 0 } # builds 2-dimension array for vulnerability table vln_list(severity) = vlnrb { some i, j vlnrb := [r | item := input.Results[i] target := item.Target vlnname := item.Vulnerabilities[j].VulnerabilityID title := item.Vulnerabilities[j].Title fxvrsn := with_default(item.Vulnerabilities[j], "FixedVersion", "none") resource_name = with_default(item.Vulnerabilities[j], "PkgName", "none") resource_path = with_default(item.Vulnerabilities[j], "PkgPath", "none") resource_version = with_default(item.Vulnerabilities[j], "InstalledVersion", "none") primaryurl = with_default(item.Vulnerabilities[j], "PrimaryURL", "none") references = with_default(item.Vulnerabilities[j], "References", "none") item.Vulnerabilities[j].Severity == severity # only items with severity matched r := [target, title, vlnname, resource_name, resource_path, resource_version, fxvrsn, primaryurl] ] } ########################################################################################################### title = sprintf("%s vulnerability scan report", [input.ArtifactName]) aggregation_pkg := "postee.vuls.slack.trivy.aggregation" result = msg { msg := sprintf(tpl, [ input.ArtifactName, render_vlnrb("Critical", vln_list("CRITICAL")), render_vlnrb("High", vln_list("HIGH")), render_vlnrb("Medium", vln_list("MEDIUM")), render_vlnrb("Low", vln_list("LOW")), render_vlnrb("Unknown", vln_list("UNKNOWN")) ]) } ================================================ FILE: rego-templates/trivy-operator-dependency-track.rego ================================================ package postee.trivyoperator.dependencytrack title:=sprintf("%s:%s", [input.report.artifact.repository, input.report.artifact.tag]) result:=input.report.components ================================================ FILE: rego-templates/trivy-operator-jira.rego ================================================ package postee.trivyoperator.jira import data.postee.with_default ################################################ Templates ################################################ # main template to render message tpl:=` h1. Image: %s in namespace %s %s %s %s %s %s %s ` sum_tpl := ` h4. Summary totals: |critical: %s|high: %s|medium: %s|low: %s|unknown: %s| ` vlnrb_tpl = ` h4. %s severity vulnerabilities %s ` #Extra % is required in width:100% table_tpl := ` %s ` cell_tpl := `| %s ` header_tpl := `|| %s ` row_tpl_head := ` %s ||` row_tpl := ` %s |` colored_text_tpl := "{color:%s}%s{color}" ############################################## Html rendering ############################################# render_table_headers(headers) = row { count(headers) > 0 ths := [th | header := headers[_] th := sprintf(header_tpl, [header]) ] row := sprintf(row_tpl_head, [concat("", ths)]) } render_table_headers(headers) = "" { #if headers not specified return empty results count(headers) == 0 } render_table(headers, content_array) = s { rows := [tr | cells := content_array[_] tds := [td | ctext := cells[_] td := to_cell(ctext) ] tr = sprintf(row_tpl, [concat("", tds)]) ] s := sprintf(table_tpl, [concat("", array.concat([render_table_headers(headers)], rows))]) } ## why I added it? to_cell(txt) = c { c := sprintf(cell_tpl, [txt]) } to_colored_text(color, txt) = spn { spn := sprintf(colored_text_tpl, [color, txt]) } ####################################### Template specific functions ####################################### to_severity_color(color, level) = spn { spn := to_colored_text(color, format_int(with_default(input.report.summary,level, 0), 10)) } render_image_name := sprintf("%s:%s", [ with_default(input.report.artifact,"repository","unknown"), with_default(input.report.artifact,"tag","unknown") ]) render_summary := sprintf(sum_tpl,[ to_severity_color("#c00000", "criticalCount"), to_severity_color("#e0443d", "highCount"), to_severity_color("#f79421", "mediumCount"), to_severity_color("#e1c930", "lowCount"), to_severity_color("#505f79", "unknownCount") ]) vlnrb_headers := ["ID","Title", "Resource", "Installed version", "Fixed version", "Url"] render_vlnrb(severity, list) = sprintf(vlnrb_tpl, [severity, render_table(vlnrb_headers, list)]) { count(list) > 0 } render_vlnrb(severity, list) = "" { #returns empty string if list of vulnerabilities is passed count(list) == 0 } # builds 2-dimension array for vulnerability table vln_list(severity) = vlnrb { some j vlnrb := [r | item := input.report.vulnerabilities[j] vlnname := item.vulnerabilityID title := item.title fxvrsn := with_default(item, "fixedVersion", "none") resource = with_default(item, "resource", "none") resource_version = with_default(item, "installedVersion", "none") primaryurl = with_default(item, "primaryLink", "none") item.severity == severity # only items with severity matched r := [vlnname, title, resource, resource_version, fxvrsn, primaryurl] ] } ########################################################################################################### title = sprintf("Vulnerability issue with image %s in namespace %s", [render_image_name, with_default(input.metadata,"namespace","unknown")]) result = msg { msg := sprintf(tpl, [ render_image_name, with_default(input.metadata,"namespace","unknown"), render_summary, render_vlnrb("Critical", vln_list("CRITICAL")), render_vlnrb("High", vln_list("HIGH")), render_vlnrb("Medium", vln_list("MEDIUM")), render_vlnrb("Low", vln_list("LOW")), render_vlnrb("Unknown", vln_list("UNKNOWN")) ]) } ================================================ FILE: rego-templates/trivy-operator-slack.rego ================================================ package postee.trivyoperator.slack import data.postee.flat_array #converts [[{...},{...}], [{...},{...}]] to [{...},{...},{...},{...}] import data.postee.with_default ############################################# Common functions ############################################ # render_sections split collection of cells provided to chunks of 5 rows each and wraps every chunk with section element render_sections(rows, caption, headers) = result { count(rows) > 0 # only if some vulnerabilities are found rows_and_header := array.concat(headers, rows) a := flat_array([s | # code below converts 2 dimension array like [[row1, row2, ... row5], ....] group_size := 10 #it's 5 but every row is represented by 2 items num_chunks := ceil(count(rows_and_header) / group_size) - 1 indices := {b | b := numbers.range(0, num_chunks)[_] * group_size} some k fields := [array.slice(rows_and_header, i, i + group_size) | i := indices[_]][k] # builds markdown section based on slice s := with_caption(fields, caption, k) ]) result := array.concat(a, [{"type": "divider"}]) } render_sections(rows, caption, headers) = [] { #do not render section if provided collection is empty count(rows) == 0 } with_caption(fields, caption, position) = s { position == 0 s := [ { "type": "section", "text": { "type": "mrkdwn", "text": caption, }, }, { "type": "section", "fields": fields, }, ] } with_caption(fields, caption, position) = s { position > 0 s := [ { "type": "section", "fields": fields, }, ] } ########################################################################################################### vln_list(severity) = l { # builds list of rows for section for the given severity some i vlnrb := [r | item := input.report.vulnerabilities[i] vlnname := item.vulnerabilityID fxvrsn := with_default(item, "fixedVersion", "none") resource_name = with_default(item, "resource", "none") resource_version = with_default(item, "installedVersion", "none") url = with_default(item, "primaryLink","") item.severity == severity # only items with severity matched r := [ {"type": "mrkdwn", "text": sprintf("<%s|%s>",[url,vlnname])}, {"type": "mrkdwn", "text": concat(" / ", [resource_name, resource_version, fxvrsn])}, ] ] caption := sprintf("*%s severity vulnerabilities*", [severity]) #TODO make first char uppercase headers := [ {"type": "mrkdwn", "text": "*Vulnerability ID*"}, {"type": "mrkdwn", "text": "*Resource / Version / Fixed version*"}, ] # split rows and wrap slices with markdown section l := render_sections(flat_array(vlnrb), caption, headers) } image_name := sprintf("%s:%s", [ with_default(input.report.artifact,"repository","unknown"), with_default(input.report.artifact,"tag","unknown") ]) ########################################################################################################### postee := with_default(input, "postee", {}) title = sprintf("Vulnerability scan report %s", [image_name]) # title is result = res { header := [ { "type": "header", "text": { "type": "plain_text", "text": sprintf("Vulnerability issue with image:%s in namespace %s",[image_name, with_default(input.metadata,"namespace","unknown")]), }, } ] summary := [ { "type": "divider" }, { "type": "context", "elements": [ {"type": "mrkdwn", "text": "*Summary totals:*"}, ], }, { "type": "context", "elements": [ {"type": "mrkdwn", "text": sprintf("Critical: *%d*", [input.report.summary.criticalCount])}, {"type": "mrkdwn", "text": sprintf("High: *%d*", [input.report.summary.highCount])}, {"type": "mrkdwn", "text": sprintf("Medium: *%d*", [input.report.summary.mediumCount])}, {"type": "mrkdwn", "text": sprintf("Low: *%d*", [input.report.summary.lowCount])}, {"type": "mrkdwn", "text": sprintf("Unknown: *%d*", [input.report.summary.unknownCount])}, ], }, { "type": "divider" } ] res := flat_array([ header, summary, vln_list("CRITICAL"), vln_list("HIGH"), vln_list("MEDIUM"), vln_list("LOW"), vln_list("UNKNOWN") ]) } ================================================ FILE: rego-templates/trivy-vulns-slack.rego ================================================ package postee.vuls.trivy.slack import data.postee.by_flag import data.postee.duplicate import data.postee.flat_array #converts [[{...},{...}], [{...},{...}]] to [{...},{...},{...},{...}] import data.postee.with_default ############################################# Common functions ############################################ # TODO support generic property check_failed(item) = false { not item.failed } check_failed(item) { item.failed } ########################################################################################################### # render_sections split collection of cells provided to chunks of 5 rows each and wraps every chunk with section element render_sections(rows, caption, headers) = a { count(rows) > 0 # only if some vulnerabilities are found rows_and_header := array.concat(headers, rows) a := flat_array([s | # code below converts 2 dimension array like [[row1, row2, ... row5], ....] group_size := 10 #it's 5 but every row is represented by 2 items num_chunks := ceil(count(rows) / group_size) - 1 indices := {b | b := numbers.range(0, num_chunks)[_] * group_size} some k fields := [array.slice(rows_and_header, i, i + group_size) | i := indices[_]][k] # builds markdown section based on slice s := with_caption(fields, caption, k) ]) } render_sections(rows, caption, headers) = [] { #do not render section if provided collection is empty count(rows) == 0 } with_caption(fields, caption, position) = s { position == 0 s := [ { "type": "section", "text": { "type": "mrkdwn", "text": caption, }, }, { "type": "section", "fields": fields, }, ] } with_caption(fields, caption, position) = s { position > 0 s := [ { "type": "section", "fields": fields, }, ] } ########################################################################################################### vln_list(severity) = l { # builds list of rows for section for the given severity vlnrb := [r | some i, j item := input.Results[i] vlnname := item.Vulnerabilities[j].VulnerabilityID fxvrsn := with_default(item.Vulnerabilities[j], "FixedVersion", "none") resource_name = with_default(item.Vulnerabilities[j], "PkgName", "none") resource_version = with_default(item.Vulnerabilities[j], "InstalledVersion", "none") item.Vulnerabilities[j].Severity == severity r := [ {"type": "mrkdwn", "text": vlnname}, {"type": "mrkdwn", "text": concat(" / ", [resource_name, resource_version, fxvrsn])}, ] ] caption := sprintf("*%s severity vulnerabilities*", [severity]) #TODO make first char uppercase headers := [ {"type": "mrkdwn", "text": "*Vulnerability ID*"}, {"type": "mrkdwn", "text": "*Resource name / Installed version / Fix version*"}, ] # split rows and wrap slices with markdown section l := render_sections(flat_array(vlnrb), caption, headers) } cnt_by_severity(severity) = cnt { vln_list := [r | some i, j item := input.Results[i] item.Vulnerabilities[j].Severity == severity r := item.Vulnerabilities[j] ] cnt := count(vln_list) } ########################################################################################################### postee := with_default(input, "postee", {}) aqua_server := with_default(postee, "AquaServer", "") title = sprintf("Vulnerability scan report", []) # title is aggregation_pkg := "postee.vuls.slack.trivy.aggregation" result = res { severities := ["CRITICAL", "HIGH", "MEDIUM", "LOW", "UNKNOWN"] headers := [ {"type": "section", "text": {"type": "mrkdwn", "text": sprintf("Artifact name: %s", [input.ArtifactName])}}, {"type": "section", "text": {"type": "mrkdwn", "text": sprintf("Type: %s", [input.ArtifactType])}}, { "type": "section", "text": { "type": "mrkdwn", "text": "*Found vulnerabilities*", }, }, ] summary:= [ { "type": "section", "text": { "type": "mrkdwn", "text": "*Found vulnerabilities*", }, }, ] res := flat_array([ headers, vln_list("CRITICAL"), vln_list("HIGH"), vln_list("MEDIUM"), vln_list("LOW"), vln_list("UNKNOWN"), summary, [{ "type": "section", "fields": [ {"type": "mrkdwn", "text": "Critical"}, {"type": "mrkdwn", "text": sprintf("*%d*", [cnt_by_severity("CRITICAL")])}, {"type": "mrkdwn", "text": "High"}, {"type": "mrkdwn", "text": sprintf("*%d*", [cnt_by_severity("HIGH")])}, {"type": "mrkdwn", "text": "Medium"}, {"type": "mrkdwn", "text": sprintf("*%d*", [cnt_by_severity("MEDIUM")])}, {"type": "mrkdwn", "text": "Low"}, {"type": "mrkdwn", "text": sprintf("*%d*", [cnt_by_severity("LOW")])}, {"type": "mrkdwn", "text": "Unknown"}, {"type": "mrkdwn", "text": sprintf("*%d*", [cnt_by_severity("UNKNOWN")])}, ], }], ]) } ================================================ FILE: rego-templates/trivy-vuls-slack-aggregation.rego ================================================ package postee.vuls.slack.trivy.aggregation import data.postee.flat_array title := "Vulnerability scan report" url := urlsResult { urls := [ scan | item:=input[i].PrimaryURL scan:=[item] ] urlsResult:= concat("\n", flat_array(urls)) } result := res { scans := [ scan | item:=input[i].Description #collection is expected scan:=array.concat([{"type":"section","text":{"type":"mrkdwn","text": input[i].title}}], item) ] res:= flat_array(scans) } ================================================ FILE: rego-templates/vuls-cyclonedx.rego ================================================ package postee.vuls.cyclondx import data.postee.with_default bom_tpl:=`Image name: %s
Registry: %s
%s
%s
%s
%sSee more: %s
`,[href, text]), #link aqua_server == "") ]) } ================================================ FILE: rego-templates/vuls-opsgenie.rego ================================================ package postee.vuls.opsgenie title = input.image result= { "description":sprintf("%s vulnerability scan report", [input.image]), "alias":input.image } ================================================ FILE: rego-templates/vuls-slack-aggregation.rego ================================================ package postee.vuls.slack.aggregation import data.postee.flat_array title := "Vulnerability scan report" url := urlsResult { urls := [ scan | item:=input[i].url scan:=[item] ] urlsResult:= concat("\n", flat_array(urls)) } result := res { scans := [ scan | item:=input[i].description #collection is expected scan:=array.concat([{"type":"section","text":{"type":"mrkdwn","text": input[i].title}}], item) ] res:= flat_array(scans) } ================================================ FILE: rego-templates/vuls-slack.rego ================================================ package postee.vuls.slack import data.postee.by_flag import data.postee.flat_array #converts [[{...},{...}], [{...},{...}]] to [{...},{...},{...},{...}] import data.postee.duplicate import data.postee.with_default ############################################# Common functions ############################################ # TODO support generic property check_failed(item) = false { not item.failed } check_failed(item) = true { item.failed } ########################################################################################################### # render_sections split collection of cells provided to chunks of 5 rows each and wraps every chunk with section element render_sections(rows, caption) = a { count(rows) > 0 # only if some vulnerabilities are found a:=flat_array([ s | # code below converts 2 dimension array like [[row1, row2, ... row5], ....] group_size := 10 #it's 5 but every row is represented by 2 items num_chunks := ceil(count(rows) / group_size) - 1 indices := { b | b := numbers.range(0, num_chunks)[_] * group_size } fields:=[array.slice(rows, i, i + group_size) | i := indices[_]][_] # builds markdown section based on slice s := [ { "type": "section", "text": { "type": "mrkdwn", "text": caption } }, { "type": "section", "fields":fields } ] ]) } render_sections(rows, caption) = [] { #do not render section if provided collection is empty count(rows) == 0 } ########################################################################################################### vln_list(severity) = l { # builds list of rows for section for the given severity vlnrb := [r | some i, j item := input.resources[i] resource := item.resource vlnname := item.vulnerabilities[j].name fxvrsn := with_default(item.vulnerabilities[j],"fix_version", "none") resource_name = with_default(resource, "name", "none") resource_version = with_default(resource, "version", "none") item.vulnerabilities[j].aqua_severity == severity r := [ {"type": "mrkdwn", "text": vlnname}, {"type": "mrkdwn", "text": concat("/", [resource_name, resource_version, fxvrsn])} ] ] caption := sprintf("*%s severity vulnerabilities*", [severity]) #TODO make first char uppercase headers := [ {"type": "mrkdwn", "text": "*Vulnerability ID*"}, {"type": "mrkdwn", "text": "*Resource name / Installed version / Fix version*"} ] rows := array.concat(headers, flat_array(vlnrb)) # split rows and wrap slices with markdown section l := render_sections(rows, caption) } malware_list := l { mlwr := [r | item := input.malware[i] r := [ {"type": "mrkdwn", "text": sprintf("%d %s", [i+1, item.malware])}, {"type": "mrkdwn", "text": concat("/", [item.hash, item.path])} ] ] headers := [ {"type": "mrkdwn", "text": "*# Malware*"}, {"type": "mrkdwn", "text": "*Hash / Path*"} ] rows := array.concat(headers, flat_array(mlwr)) # split rows and wrap slices with markdown section l := render_sections(rows, "Malware") } ########################################################################################################### postee := with_default(input, "postee", {}) aqua_server := with_default(postee, "AquaServer", "") title = sprintf("%s vulnerability scan report", [input.image]) # title is string href:=sprintf("%s%s/%s", [aqua_server, urlquery.encode(input.registry), urlquery.encode(input.image)]) text:=sprintf("%s%s/%s", [aqua_server, input.registry, input.image]) url := by_flag("", href, aqua_server == "") aggregation_pkg := "postee.vuls.slack.aggregation" result = res { severities := ["critical", "high", "medium", "low", "negligible"] checks_performed:= flat_array([check | item := input.image_assurance_results.checks_performed[i] check:= [ {"type": "mrkdwn", "text": sprintf("%d %s", [i+1, item.control])}, {"type": "mrkdwn", "text": concat(" / ", [item.policy_name, by_flag("FAIL", "PASS", check_failed(item))])} ] ]) severity_stats:= flat_array([gr | severity := severities[_] gr:= [ {"type": "mrkdwn", "text": sprintf("*%s*", [upper(severity)])}, {"type": "mrkdwn", "text": sprintf("*%d*", [input.vulnerability_summary[severity]])}, ] ]) headers := [{"type":"section","text":{"type":"mrkdwn","text":sprintf("Image name: %s", [input.image])}}, {"type":"section","text":{"type":"mrkdwn","text":sprintf("Registry: %s", [input.registry])}}, {"type":"section","text":{"type":"mrkdwn","text": by_flag( "Image is non-compliant", "Image is compliant", with_default(input.image_assurance_results, "disallowed", false) )}}, {"type":"section","text":{"type":"mrkdwn","text": by_flag( "Malware found: Yes", "Malware found: No", input.scan_options.scan_malware #reflects current logic )}}, {"type":"section","text":{"type":"mrkdwn","text": by_flag( "Sensitive data found: Yes", "Sensitive data found: No", input.scan_options.scan_sensitive_data #reflects current logic )}}, { "type": "section", "fields": severity_stats }, { "type": "section", "text": { "type": "mrkdwn", "text": "*Assurance controls*" } }, { "type": "section", "fields": array.concat( [{ "type": "mrkdwn", "text": "*#* *Control*" }, { "type": "mrkdwn", "text": "*Policy Name* / *Status*" }], checks_performed) }, { "type": "section", "text": { "type": "mrkdwn", "text": "*Found vulnerabilities*" } } ] urlText :=sprintf("See more: \u003c%s|%s\u003e", [href, text]) footers := by_flag( "", [{ "type": "section", "text": { "type": "mrkdwn", "text": urlText } }], aqua_server == "") res := flat_array([ headers, vln_list("critical"), vln_list("high"), vln_list("medium"), vln_list("low"), vln_list("negligible"), malware_list, footers ]) } ================================================ FILE: regoservice/aggregation_test.go ================================================ package regoservice import ( "io/ioutil" "os" "testing" ) var ( regoWithAggregation = ` package rego1 title:="Audit event received" result:=sprintf("Audit event received from %s", [input.user]) aggregation_pkg:="rego1.aggr" ` aggregationRego = ` package rego1.aggr import data.postee.flat_array title := "Vulnerability scan report" result := res { scans := [ scan | item:=input[i].description scan:=[sprintf("{
"user": "demo"
}Name: test
Category: Test
Severity: 3
Data:
| host | ubuntu |
| rule | Test-Default-Policy |
| level | block |
| action | test malware delete |
| hostid | host |
| hostip | 10.100.102.19 |
| reason | Malware detection |
| result | 2 |
| tactic | Defense Evasion, Execution, Privilege Escalation, Initial Access |
| control | Malware scanning Control |
| malware | Eicar-Test-Signature |
| subtype | malware protection |
| category | malware |
| resource | /home/usr/tmp/malware/eicar.test |
| severity | 4 |
| rule_type | host.runtime.policy (Test) |
| technique | Execution Guardrails, Exploit Public Facing Application, Client Execution, Privilege Escalation, Remote Services |
| k8s_cluster | Cluster-Test |
| malware_type | Virus |
| resource_digest | 0000 |
| malware_scan_type | file |
Resourse policy name: test
Resourse policy application scopes: ["scope1", "scope2"]
================================================ FILE: regoservice/testdata/goldens/servicenow-insight.golden ================================================Insight ID: aqua-3006
Description: Workloads or images containing login data
Impact: Attackers with access to this workload or image might be able to use the login data to gain initial access to other resources
Severity: medium
Found Date: 2022-08-25T09:02:28.991Z
Last Scan: 2022-08-25T08:59:42.314673Z
URL:
Resourse ID: 6131180
Resourse Name: shayyo/sensitive_data:latest
ARN:
Extra Info: {"Image": "sensitive_data:latest", "Registry": "Docker Hub", "RegistryDomain": "docker.io"}
Sensitive data
| File Type | File Path | Image |
|---|---|---|
| RSA PRIVATE KEY | /private-key.pem | shayyo/sensitive_data:latest |
Resourse policy name: insights_login data
Resourse policy application scopes: ["scope1", "scope2"]
================================================ FILE: regoservice/testdata/goldens/servicenow.golden ================================================Name: all-in-one:3.5.19223
Registry: Aqua
Malware found: Yes
Sensitive data found: Yes
| critical | 1 |
| high | 1 |
| medium | 1 |
| low | 1 |
| negligible | 1 |
| # | Control | Policy Name | Status |
|---|---|---|---|
| 1 | malware | Default | PASS |
| 2 | license | Default | PASS |
| 3 | max_severity | Default | PASS |
| Vulnerability ID | Resource name | Installed version | Fix version |
|---|---|---|---|
| CVE-2018-1000517 | busybox | 1.28.4-r3 | 1.29.0 |
| Vulnerability ID | Resource name | Installed version | Fix version |
|---|---|---|---|
| CVE-2021-33560 | libgcrypt | 1.8.3-r0 | 1.8.8 |
| Vulnerability ID | Resource name | Installed version | Fix version |
|---|---|---|---|
| CVE-2019-12904 | libgcrypt | 1.8.3-r0 | 1.8.3-r1 |
| Vulnerability ID | Resource name | Installed version | Fix version |
|---|---|---|---|
| CVE-2018-20679 | busybox | 1.28.4-r3 | 1.30.0 |
| Vulnerability ID | Resource name | Installed version | Fix version |
|---|---|---|---|
| CVE-2019-5747 | busybox | 1.28.4-r3 | none |
Resourse policy name:
Resourse policy application scopes: ["group"]
================================================ FILE: regoservice/testdata/goldens/trivy-jira.golden ================================================ h1. Image name: pom.xml h4. Critical severity vulnerabilities | || Layer || Title || Vulnerability ID || Resource name || Path || Installed version || Fix version || Url | | pom.xml | log4j: deserialization of untrusted data in SocketServer | CVE-2019-17571 | log4j:log4j | none | 1.2.17 | 2.0-alpha1 | https://avd.aquasec.com/nvd/cve-2019-17571 | | pom.xml | log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender | CVE-2022-23305 | log4j:log4j | none | 1.2.17 | none | https://avd.aquasec.com/nvd/cve-2022-23305 h4. High severity vulnerabilities | || Layer || Title || Vulnerability ID || Resource name || Path || Installed version || Fix version || Url | | pom.xml | Remote code execution in Log4j 1.x when application is configured to use JMSAppender | CVE-2021-4104 | log4j:log4j | none | 1.2.17 | none | https://avd.aquasec.com/nvd/cve-2021-4104 | | pom.xml | log4j: Unsafe deserialization flaw in Chainsaw log viewer | CVE-2022-23307 | log4j:log4j | none | 1.2.17 | none | https://avd.aquasec.com/nvd/cve-2022-23307 h4. Medium severity vulnerabilities | || Layer || Title || Vulnerability ID || Resource name || Path || Installed version || Fix version || Url | | pom.xml | log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink | CVE-2022-23302 | log4j:log4j | none | 1.2.17 | none | https://avd.aquasec.com/nvd/cve-2022-23302 h4. Low severity vulnerabilities | || Layer || Title || Vulnerability ID || Resource name || Path || Installed version || Fix version || Url | | pom.xml | log4j: improper validation of certificate with host mismatch in SMTP appender | CVE-2020-9488 | log4j:log4j | none | 1.2.17 | 2.12.3, 2.13.2 | https://avd.aquasec.com/nvd/cve-2020-9488 h4. Unknown severity vulnerabilities | || Layer || Title || Vulnerability ID || Resource name || Path || Installed version || Fix version || Url | | pom.xml | DoS via hashmap logging | CVE-2023-26464 | log4j:log4j | none | 1.2.17 | 2.0 | https://avd.aquasec.com/nvd/cve-2023-26464 ================================================ FILE: regoservice/testdata/goldens/trivy-operator-jira.golden ================================================ h1. Image: library/nginx:1.16 in namespace default h4. Summary totals: |critical: {color:#c00000}2{color}|high: {color:#e0443d}0{color}|medium: {color:#f79421}0{color}|low: {color:#e1c930}0{color}|unknown: {color:#505f79}0{color}| h4. Critical severity vulnerabilities || ID || Title || Resource || Installed version || Fixed version || Url || | CVE-2019-20367 | | libbsd0 | 0.9.1-2 | 0.9.1-2+deb10u1 | https://avd.aquasec.com/nvd/cve-2019-20367 | h4. High severity vulnerabilities || ID || Title || Resource || Installed version || Fixed version || Url || | CVE-2018-25009 | libwebp: out-of-bounds read in WebPMuxCreateInternal | libwebp6 | 0.6.1-2 | | https://avd.aquasec.com/nvd/cve-2018-25009 | h4. Medium severity vulnerabilities || ID || Title || Resource || Installed version || Fixed version || Url || | CVE-2018-25010 | libwebp: out-of-bounds read in WebPMuxCreateInternal | libwebp3 | 0.6.1-2 | | https://avd.aquasec.com/nvd/cve-2018-25009 | h4. Low severity vulnerabilities || ID || Title || Resource || Installed version || Fixed version || Url || | CVE-2018-25011 | libwebp: out-of-bounds read in WebPMuxCreateInternal | libwebp4 | 0.6.1-2 | | https://avd.aquasec.com/nvd/cve-2018-25009 | h4. Unknown severity vulnerabilities || ID || Title || Resource || Installed version || Fixed version || Url || | CVE-2018-25012 | libwebp: out-of-bounds read in WebPMuxCreateInternal | libwebp5 | 0.6.1-2 | | https://avd.aquasec.com/nvd/cve-2018-25009 | ================================================ FILE: regoservice/testdata/goldens/trivy-operator-slack.golden ================================================ [{"text":{"text":"Vulnerability issue with image:library/nginx:1.16 in namespace default","type":"plain_text"},"type":"header"},{"type":"divider"},{"elements":[{"text":"*Summary totals:*","type":"mrkdwn"}],"type":"context"},{"elements":[{"text":"Critical: *2*","type":"mrkdwn"},{"text":"High: *0*","type":"mrkdwn"},{"text":"Medium: *0*","type":"mrkdwn"},{"text":"Low: *0*","type":"mrkdwn"},{"text":"Unknown: *0*","type":"mrkdwn"}],"type":"context"},{"type":"divider"},{"text":{"text":"*CRITICAL severity vulnerabilities*","type":"mrkdwn"},"type":"section"},{"fields":[{"text":"*Vulnerability ID*","type":"mrkdwn"},{"text":"*Resource / Version / Fixed version*","type":"mrkdwn"},{"text":"\u003chttps://avd.aquasec.com/nvd/cve-2019-20367|CVE-2019-20367\u003e","type":"mrkdwn"},{"text":"libbsd0 / 0.9.1-2 / 0.9.1-2+deb10u1","type":"mrkdwn"}],"type":"section"},{"type":"divider"},{"text":{"text":"*HIGH severity vulnerabilities*","type":"mrkdwn"},"type":"section"},{"fields":[{"text":"*Vulnerability ID*","type":"mrkdwn"},{"text":"*Resource / Version / Fixed version*","type":"mrkdwn"},{"text":"\u003chttps://avd.aquasec.com/nvd/cve-2018-25009|CVE-2018-25009\u003e","type":"mrkdwn"},{"text":"libwebp6 / 0.6.1-2 / ","type":"mrkdwn"}],"type":"section"},{"type":"divider"},{"text":{"text":"*MEDIUM severity vulnerabilities*","type":"mrkdwn"},"type":"section"},{"fields":[{"text":"*Vulnerability ID*","type":"mrkdwn"},{"text":"*Resource / Version / Fixed version*","type":"mrkdwn"},{"text":"\u003chttps://avd.aquasec.com/nvd/cve-2018-25009|CVE-2018-25010\u003e","type":"mrkdwn"},{"text":"libwebp3 / 0.6.1-2 / ","type":"mrkdwn"}],"type":"section"},{"type":"divider"},{"text":{"text":"*LOW severity vulnerabilities*","type":"mrkdwn"},"type":"section"},{"fields":[{"text":"*Vulnerability ID*","type":"mrkdwn"},{"text":"*Resource / Version / Fixed version*","type":"mrkdwn"},{"text":"\u003chttps://avd.aquasec.com/nvd/cve-2018-25009|CVE-2018-25011\u003e","type":"mrkdwn"},{"text":"libwebp4 / 0.6.1-2 / ","type":"mrkdwn"}],"type":"section"},{"type":"divider"},{"text":{"text":"*UNKNOWN severity vulnerabilities*","type":"mrkdwn"},"type":"section"},{"fields":[{"text":"*Vulnerability ID*","type":"mrkdwn"},{"text":"*Resource / Version / Fixed version*","type":"mrkdwn"},{"text":"\u003chttps://avd.aquasec.com/nvd/cve-2018-25009|CVE-2018-25012\u003e","type":"mrkdwn"},{"text":"libwebp5 / 0.6.1-2 / ","type":"mrkdwn"}],"type":"section"},{"type":"divider"}] ================================================ FILE: regoservice/testdata/goldens/trivy-vulns-slack.golden ================================================ [{"text":{"text":"Artifact name: pom.xml","type":"mrkdwn"},"type":"section"},{"text":{"text":"Type: filesystem","type":"mrkdwn"},"type":"section"},{"text":{"text":"*Found vulnerabilities*","type":"mrkdwn"},"type":"section"},{"text":{"text":"*CRITICAL severity vulnerabilities*","type":"mrkdwn"},"type":"section"},{"fields":[{"text":"*Vulnerability ID*","type":"mrkdwn"},{"text":"*Resource name / Installed version / Fix version*","type":"mrkdwn"},{"text":"CVE-2019-17571","type":"mrkdwn"},{"text":"log4j:log4j / 1.2.17 / 2.0-alpha1","type":"mrkdwn"},{"text":"CVE-2022-23305","type":"mrkdwn"},{"text":"log4j:log4j / 1.2.17 / none","type":"mrkdwn"}],"type":"section"},{"text":{"text":"*HIGH severity vulnerabilities*","type":"mrkdwn"},"type":"section"},{"fields":[{"text":"*Vulnerability ID*","type":"mrkdwn"},{"text":"*Resource name / Installed version / Fix version*","type":"mrkdwn"},{"text":"CVE-2021-4104","type":"mrkdwn"},{"text":"log4j:log4j / 1.2.17 / none","type":"mrkdwn"},{"text":"CVE-2022-23307","type":"mrkdwn"},{"text":"log4j:log4j / 1.2.17 / none","type":"mrkdwn"}],"type":"section"},{"text":{"text":"*MEDIUM severity vulnerabilities*","type":"mrkdwn"},"type":"section"},{"fields":[{"text":"*Vulnerability ID*","type":"mrkdwn"},{"text":"*Resource name / Installed version / Fix version*","type":"mrkdwn"},{"text":"CVE-2022-23302","type":"mrkdwn"},{"text":"log4j:log4j / 1.2.17 / none","type":"mrkdwn"}],"type":"section"},{"text":{"text":"*LOW severity vulnerabilities*","type":"mrkdwn"},"type":"section"},{"fields":[{"text":"*Vulnerability ID*","type":"mrkdwn"},{"text":"*Resource name / Installed version / Fix version*","type":"mrkdwn"},{"text":"CVE-2020-9488","type":"mrkdwn"},{"text":"log4j:log4j / 1.2.17 / 2.12.3, 2.13.2","type":"mrkdwn"}],"type":"section"},{"text":{"text":"*UNKNOWN severity vulnerabilities*","type":"mrkdwn"},"type":"section"},{"fields":[{"text":"*Vulnerability ID*","type":"mrkdwn"},{"text":"*Resource name / Installed version / Fix version*","type":"mrkdwn"},{"text":"CVE-2023-26464","type":"mrkdwn"},{"text":"log4j:log4j / 1.2.17 / 2.0","type":"mrkdwn"}],"type":"section"},{"text":{"text":"*Found vulnerabilities*","type":"mrkdwn"},"type":"section"},{"fields":[{"text":"Critical","type":"mrkdwn"},{"text":"*2*","type":"mrkdwn"},{"text":"High","type":"mrkdwn"},{"text":"*2*","type":"mrkdwn"},{"text":"Medium","type":"mrkdwn"},{"text":"*1*","type":"mrkdwn"},{"text":"Low","type":"mrkdwn"},{"text":"*1*","type":"mrkdwn"},{"text":"Unknown","type":"mrkdwn"},{"text":"*1*","type":"mrkdwn"}],"type":"section"}] ================================================ FILE: regoservice/testdata/goldens/vuls-cyclonedx.golden ================================================Image name: all-in-one:3.5.19223
Registry: Aqua
Image is compliant
Malware found: Yes
Sensitive data found: Yes
| critical | 1 |
| high | 1 |
| medium | 1 |
| low | 1 |
| negligible | 1 |
| # | Control | Policy Name | Status |
|---|---|---|---|
| 1 | malware | Default | PASS |
| 2 | license | Default | PASS |
| 3 | max_severity | Default | PASS |
| Vulnerability ID | Resource name | Installed version | Fix version |
|---|---|---|---|
| CVE-2018-1000517 | busybox | 1.28.4-r3 | 1.29.0 |
| Vulnerability ID | Resource name | Installed version | Fix version |
|---|---|---|---|
| CVE-2021-33560 | libgcrypt | 1.8.3-r0 | 1.8.8 |
| Vulnerability ID | Resource name | Installed version | Fix version |
|---|---|---|---|
| CVE-2019-12904 | libgcrypt | 1.8.3-r0 | 1.8.3-r1 |
| Vulnerability ID | Resource name | Installed version | Fix version |
|---|---|---|---|
| CVE-2018-20679 | busybox | 1.28.4-r3 | 1.30.0 |
| Vulnerability ID | Resource name | Installed version | Fix version |
|---|---|---|---|
| CVE-2019-5747 | busybox | 1.28.4-r3 | none |