Feature: Added exceptions flag in scan image cmd #1568

VaibhavMalik4187 · 2023-12-31T14:52:35Z

Overview

This commit introduces the "exceptions" flag in the scan image command. Users can pass a list of vulnerabilities they ignore while scanning an image using this flag.

Fixes: #1564

How to Test

kubescape scan image <imageName>
kubescape scan image <imageName> -E <comma separated list of exceptions, e.g: CVE-2023-6879,CVE-2023-45853>

Screenshots

VaibhavMalik4187 · 2023-12-31T15:12:13Z

@dwertent @matthyx could you please review this PR whenever you have some spare time? Thanks!

matthyx · 2024-01-01T16:56:17Z

Looks good @VaibhavMalik4187 do you think we can add a test covering this new feature?

VaibhavMalik4187 · 2024-01-01T17:27:38Z

Looks good @VaibhavMalik4187 do you think we can add a test covering this new feature?

Thanks for the approval @matthyx. Yes, I'll add a test soon.

VaibhavMalik4187 · 2024-01-02T12:26:08Z

Looks good @VaibhavMalik4187 do you think we can add a test covering this new feature?

Thanks for the approval @matthyx. Yes, I'll add a test soon.

@matthyx I've added a few tests.

matthyx · 2024-01-03T14:50:30Z

waiting for @dwertent to confirm this is what we want

dwertent · 2024-01-09T13:55:11Z

Hi @VaibhavMalik4187 Thank you for contributing this PR.
I am still debating how we want the exception support to work.
My initial idea was, to have an object similar to the configurationScanning exceptions file.
e.g.

[
    {
        "metadata": {    
                "name": "exclude-allowed-hostPath-control",
        },
        "kind": "VulnerabilitiesIgnorePolicy",
        "targets": [
            {
                "designatorType": "Attributes",
                "attributes": {
                    "imageTag": ".*",
                    "registry": "docker.io"
                }
            }
        ],
        "vulnerabilities": [
                "CVE-0000", 
                "CVE-11111"
        ]
    }
]

This will allow us to properly support CICDs as well as scan images from the CLI.

Thoughts?

/cc: @slashben @yossi77

VaibhavMalik4187 · 2024-01-09T20:08:51Z

Hi @VaibhavMalik4187 Thank you for contributing this PR. I am still debating how we want the exception support to work. My initial idea was, to have an object similar to the configurationScanning exceptions file. e.g.
[
    {
        "metadata": {    
                "name": "exclude-allowed-hostPath-control",
        },
        "kind": "VulnerabilitiesIgnorePolicy",
        "targets": [
            {
                "designatorType": "Attributes",
                "attributes": {
                    "imageTag": ".*",
                    "registry": "docker.io"
                }
            }
        ],
        "vulnerabilities": [
                "CVE-0000", 
                "CVE-11111"
        ]
    }
]
This will allow us to properly support CICDs as well as scan images from the CLI.

Thoughts?

/cc: @slashben @yossi77

Hi @dwertent, thanks for the feedback. I agree that having a consistent exception format for both configuration scanning and vulnerability scanning would be beneficial for CI/CD integration and CLI usage. I'm open to aligning my PR with the proposed object structure.

dwertent · 2024-01-10T09:17:02Z

@VaibhavMalik4187 Great, let's do it 🥇

The attributes should support:

registry
organization
imageName
imageTag

e.g. quay.io/kubescape/kubescape-cli:v3.0.0

registry - quay.io
organization - kubescape
imageName - kubescape-cli
imageTag - v3.0.0

We should support regex as well.

Also, we should exclude based on severities as well.
The final object should look like this:

[
    {
        "metadata": {    
                "name": "exclude-allowed-hostPath-control",
        },
        "kind": "VulnerabilitiesIgnorePolicy",
        "targets": [
            {
                "designatorType": "Attributes",
                "attributes": {
                    "imageName": "nginx",
                    "registry": "docker.io" 
                }
            }
        ],
        "vulnerabilities": [
                "CVE-0000",    // not case sensitive
                "CVE-11111"
        ],
        "severities": [
           "low"   // not case sensitive
         ]
    }
]

What do you think?

VaibhavMalik4187 · 2024-01-10T16:43:02Z

@VaibhavMalik4187 Great, let's do it 🥇

The attributes should support:

1. `registry`

2. `organization`

3. `imageName`

4. `imageTag`

e.g. quay.io/kubescape/kubescape-cli:v3.0.0

1. `registry` - `quay.io`

2. `organization` - `kubescape`

3. `imageName` - `kubescape-cli`

4. `imageTag` - `v3.0.0`

We should support regex as well.

Also, we should exclude based on severities as well. The final object should look like this:

[
    {
        "metadata": {    
                "name": "exclude-allowed-hostPath-control",
        },
        "kind": "VulnerabilitiesIgnorePolicy",
        "targets": [
            {
                "designatorType": "Attributes",
                "attributes": {
                    "imageName": "nginx",
                    "registry": "docker.io" 
                }
            }
        ],
        "vulnerabilities": [
                "CVE-0000",    // not case sensitive
                "CVE-11111"
        ],
        "severities": [
           "low"   // not case sensitive
         ]
    }
]

What do you think?

I'm not very sure about the regex part. Where do you intend to use regex? Could you please elaborate a bit more? In the exceptions object fields?

VaibhavMalik4187 · 2024-01-16T16:15:12Z

@dwertent @matthyx I've added some commits to try to align my PR with the ideas suggested in the conversation above. Could you please review this PR once again? Thanks!

VaibhavMalik4187 · 2024-01-18T18:52:08Z

@matthyx @dwertent ...

dwertent · 2024-01-21T11:29:12Z

@VaibhavMalik4187 We are currently very busy with some features.
We will review this PR shortly :)
Thank you for contributing!

VaibhavMalik4187 · 2024-01-22T07:30:49Z

@VaibhavMalik4187 We are currently very busy with some features. We will review this PR shortly :) Thank you for contributing!

@dwertent,Thanks for the update.

VaibhavMalik4187 · 2024-01-25T19:38:43Z

@matthyx @dwertent any updates?

VaibhavMalik4187 · 2024-02-03T13:42:41Z

@craigbox @slashben could you please take a look?

dwertent

Hi @VaibhavMalik4187,

Appreciate your contribution! Currently, our team is immersed in prioritizing other features, causing a delay in reviewing your Pull Request (PR). Upon my initial review, I've observed that the unit tests comprehensively cover the entire image scan command.

However, there's a potential concern with testing in diverse environments, given that mock data might not precisely replicate real-world scenarios. To address this, I recommend focusing the unit tests specifically on a function designed to handle exceptions. Essentially, consider implementing a function like the following:

func ignoreVulnerabilities(imageVulnerabilities, exceptions) imageVulnerabilities {
    // Implement logic to filter out vulnerabilities based on exceptions
    // Return the list without the ignored vulnerabilities
}

Please accompany this with thorough unit tests incorporating various scenarios, such as those involving regular expressions (regex). Verify that the function effectively handles different types of mock vulnerabilities and exceptions.

Feel free to update the PR with this refined approach, ensuring the unit tests validate the functionality in a diverse set of circumstances. Thanks for your efforts, and let me know if you have any questions or need further clarification.

dwertent · 2024-02-05T09:42:25Z

cmd/scan/image.go

@@ -69,6 +75,8 @@ func getImageCmd(ks meta.IKubescape, scanInfo *cautils.ScanInfo) *cobra.Command
 		},
 	}

+	// The exceptions flag
+	cmd.PersistentFlags().StringVarP(&exceptions, "exceptions", "E", "", "Path to the exceptions file")


Can you please remove the short flag E

VaibhavMalik4187 · 2024-02-06T12:24:26Z

Hi @VaibhavMalik4187,

Appreciate your contribution! Currently, our team is immersed in prioritizing other features, causing a delay in reviewing your Pull Request (PR). Upon my initial review, I've observed that the unit tests comprehensively cover the entire image scan command.

However, there's a potential concern with testing in diverse environments, given that mock data might not precisely replicate real-world scenarios. To address this, I recommend focusing the unit tests specifically on a function designed to handle exceptions. Essentially, consider implementing a function like the following:
func ignoreVulnerabilities(imageVulnerabilities, exceptions) imageVulnerabilities {
    // Implement logic to filter out vulnerabilities based on exceptions
    // Return the list without the ignored vulnerabilities
}
Please accompany this with thorough unit tests incorporating various scenarios, such as those involving regular expressions (regex). Verify that the function effectively handles different types of mock vulnerabilities and exceptions.

Feel free to update the PR with this refined approach, ensuring the unit tests validate the functionality in a diverse set of circumstances. Thanks for your efforts, and let me know if you have any questions or need further clarification.

@dwertent, thank you very much for reviewing the code. I'll update it shortly to ensure that the tests can replicate real-world scenarios and verify that the code functions as intended. I appreciate these suggestions.

This commit introduces the "exceptions" flag in the scan image command. Users can pass a list of vulnerabilities they ignore while scanning an image using this flag. Also added tests for the same. Fixes: kubescape#1564 Signed-off-by: VaibhavMalik4187 <vaibhavmalik2018@gmail.com>

Added initial commit to start loading image exceptions from json files. Currently, it supports vulnerability exceptions using their CVE-IDs. Signed-off-by: VaibhavMalik4187 <vaibhavmalik2018@gmail.com>

This commit add relevant functions to support severity exceptions during image scan. Signed-off-by: VaibhavMalik4187 <vaibhavmalik2018@gmail.com>

This commit introduces the ability to specify targets in image exceptions. Each target will have the following 4 attributes: 1. Registry 2. Organization 3. ImageName 4. ImageTag These attributes will be used to match against the canonical image name of the image to be scanned. The vulnerabilites and the severities specified in the VulnerabilitiesIgnorePolicy object will be considered only if the image to be scanned matches the targets specified for that policy. Regular expressions can also be used to specify the image attributes. Signed-off-by: VaibhavMalik4187 <vaibhavmalik2018@gmail.com>

Signed-off-by: VaibhavMalik4187 <vaibhavmalik2018@gmail.com>

VaibhavMalik4187 · 2024-02-08T17:22:49Z

@dwertent I've refactored the code and added more comprehensive tests. Could you please have another look at this PR whenever you have some spare time? Thanks!

dwertent · 2024-02-08T18:59:55Z

Thank you!
I will look into it

VaibhavMalik4187 force-pushed the feature-exceptions branch from 81c0b2a to bf8ddbe Compare December 31, 2023 14:53

VaibhavMalik4187 force-pushed the feature-exceptions branch 2 times, most recently from 87a704c to 590b535 Compare January 2, 2024 12:25

VaibhavMalik4187 force-pushed the feature-exceptions branch from 590b535 to a79a704 Compare January 3, 2024 06:53

matthyx previously approved these changes Jan 3, 2024

View reviewed changes

matthyx requested a review from dwertent January 3, 2024 14:50

VaibhavMalik4187 force-pushed the feature-exceptions branch from a79a704 to 3045482 Compare January 9, 2024 08:06

VaibhavMalik4187 requested a review from matthyx January 9, 2024 08:26

dwertent mentioned this pull request Jan 10, 2024

Allow Kubescape image scan to have an allowed exception/CVE list #1564

Open

VaibhavMalik4187 dismissed matthyx’s stale review via ff27b64 January 13, 2024 10:42

VaibhavMalik4187 force-pushed the feature-exceptions branch from 3045482 to ff27b64 Compare January 13, 2024 10:42

VaibhavMalik4187 marked this pull request as draft January 13, 2024 10:42

VaibhavMalik4187 force-pushed the feature-exceptions branch 5 times, most recently from 881b380 to 91a97c2 Compare January 16, 2024 16:05

VaibhavMalik4187 marked this pull request as ready for review January 16, 2024 16:07

VaibhavMalik4187 force-pushed the feature-exceptions branch from 91a97c2 to 96534d6 Compare January 16, 2024 16:14

VaibhavMalik4187 force-pushed the feature-exceptions branch from 96534d6 to 6724ec0 Compare January 18, 2024 08:22

VaibhavMalik4187 force-pushed the feature-exceptions branch from 6724ec0 to ca689af Compare January 18, 2024 18:24

dwertent requested changes Feb 5, 2024

View reviewed changes

VaibhavMalik4187 added 5 commits February 8, 2024 22:24

WIP: Load image exceptions from file

a1a78b7

Added initial commit to start loading image exceptions from json files. Currently, it supports vulnerability exceptions using their CVE-IDs. Signed-off-by: VaibhavMalik4187 <vaibhavmalik2018@gmail.com>

Added support for severity exceptions in imagescan

e6f5bf3

This commit add relevant functions to support severity exceptions during image scan. Signed-off-by: VaibhavMalik4187 <vaibhavmalik2018@gmail.com>

Added tests and improvements for image exceptions

8c5a583

Signed-off-by: VaibhavMalik4187 <vaibhavmalik2018@gmail.com>

VaibhavMalik4187 force-pushed the feature-exceptions branch from ca689af to 8c5a583 Compare February 8, 2024 16:54

matthyx requested a review from dwertent April 30, 2024 13:25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature: Added exceptions flag in scan image cmd #1568

Feature: Added exceptions flag in scan image cmd #1568

VaibhavMalik4187 commented Dec 31, 2023

VaibhavMalik4187 commented Dec 31, 2023

matthyx commented Jan 1, 2024

VaibhavMalik4187 commented Jan 1, 2024

VaibhavMalik4187 commented Jan 2, 2024

matthyx commented Jan 3, 2024

dwertent commented Jan 9, 2024 •

edited

VaibhavMalik4187 commented Jan 9, 2024

dwertent commented Jan 10, 2024 •

edited

VaibhavMalik4187 commented Jan 10, 2024 •

edited

VaibhavMalik4187 commented Jan 16, 2024

VaibhavMalik4187 commented Jan 18, 2024

dwertent commented Jan 21, 2024

VaibhavMalik4187 commented Jan 22, 2024

VaibhavMalik4187 commented Jan 25, 2024

VaibhavMalik4187 commented Feb 3, 2024

dwertent left a comment

dwertent Feb 5, 2024

VaibhavMalik4187 Feb 6, 2024

VaibhavMalik4187 commented Feb 6, 2024

VaibhavMalik4187 commented Feb 8, 2024

dwertent commented Feb 8, 2024

Feature: Added exceptions flag in scan image cmd #1568

Are you sure you want to change the base?

Feature: Added exceptions flag in scan image cmd #1568

Conversation

VaibhavMalik4187 commented Dec 31, 2023

Overview

How to Test

Screenshots

VaibhavMalik4187 commented Dec 31, 2023

matthyx commented Jan 1, 2024

VaibhavMalik4187 commented Jan 1, 2024

VaibhavMalik4187 commented Jan 2, 2024

matthyx commented Jan 3, 2024

dwertent commented Jan 9, 2024 • edited

VaibhavMalik4187 commented Jan 9, 2024

dwertent commented Jan 10, 2024 • edited

VaibhavMalik4187 commented Jan 10, 2024 • edited

VaibhavMalik4187 commented Jan 16, 2024

VaibhavMalik4187 commented Jan 18, 2024

dwertent commented Jan 21, 2024

VaibhavMalik4187 commented Jan 22, 2024

VaibhavMalik4187 commented Jan 25, 2024

VaibhavMalik4187 commented Feb 3, 2024

dwertent left a comment

Choose a reason for hiding this comment

dwertent Feb 5, 2024

Choose a reason for hiding this comment

VaibhavMalik4187 Feb 6, 2024

Choose a reason for hiding this comment

VaibhavMalik4187 commented Feb 6, 2024

VaibhavMalik4187 commented Feb 8, 2024

dwertent commented Feb 8, 2024

dwertent commented Jan 9, 2024 •

edited

dwertent commented Jan 10, 2024 •

edited

VaibhavMalik4187 commented Jan 10, 2024 •

edited