mirror of https://github.com/apache/cassandra
Merge branch 'cassandra-4.1' into cassandra-5.0
* cassandra-4.1: Autogenerate toplevel .snyk file from owasp suppressions
This commit is contained in:
Mick Semb Wever
commit
1311766ad1
|
|
@ -112,4 +112,7 @@
|
|||
<antcall target="-run-owasp-scan" inheritrefs="true" inheritall="true"/>
|
||||
</target>
|
||||
|
||||
<target name="generate-snyk-file" unless="ant.gen-snyk.skip">
|
||||
<exec executable="python3" failonerror="true"><arg value="${basedir}/.build/generate-snyk-file"/></exec>
|
||||
</target>
|
||||
</project>
|
||||
|
|
|
|||
|
|
@ -42,6 +42,7 @@
|
|||
<fileset dir="." includesfile="${build.dir}/.ratinclude">
|
||||
<!-- Config files with not much creativity -->
|
||||
<exclude name=".asf.yaml"/>
|
||||
<exclude name=".snyk"/>
|
||||
<exclude name="**/cassandra*.yaml"/>
|
||||
<exclude NAME="doc/antora.yml"/>
|
||||
<exclude name="ide/**/*"/>
|
||||
|
|
|
|||
|
|
@ -0,0 +1,75 @@
|
|||
#!/usr/bin/env python3
|
||||
# -*- coding: utf-8 -*-
|
||||
#
|
||||
# Licensed to the Apache Software Foundation (ASF) under one
|
||||
# or more contributor license agreements. See the NOTICE file
|
||||
# distributed with this work for additional information
|
||||
# regarding copyright ownership. The ASF licenses this file
|
||||
# to you under the Apache License, Version 2.0 (the
|
||||
# "License"); you may not use this file except in compliance
|
||||
# with the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
"""
|
||||
Regenerates the toplevel .snyk file from the dependency-check-suppressions.xml found in this directory.
|
||||
"""
|
||||
|
||||
import re
|
||||
import os
|
||||
|
||||
|
||||
script_dir = os.path.dirname(os.path.abspath(__file__))
|
||||
with open(os.path.join(script_dir, "owasp/dependency-check-suppressions.xml"), "r", encoding="utf-8") as f:
|
||||
xml_lines = [line.strip() for line in f.readlines()]
|
||||
|
||||
snyk_data = {"ignore": {}}
|
||||
|
||||
# Parse XML (keeping track of comments)
|
||||
last_comment = None
|
||||
i = 0
|
||||
while i < len(xml_lines):
|
||||
# Detect XML comments (these contain the suppression reason)
|
||||
if xml_lines[i].startswith("<!--") and xml_lines[i].endswith("-->"):
|
||||
last_comment = xml_lines[i][4:-3].strip()
|
||||
|
||||
# Collect CVE suppressions
|
||||
if "<suppress>" in xml_lines[i]:
|
||||
cve_ids = []
|
||||
packages = ''
|
||||
i += 1
|
||||
while i < len(xml_lines):
|
||||
if xml_lines[i].startswith("<!--") and xml_lines[i].endswith("-->"):
|
||||
last_comment = xml_lines[i][4:-3].strip()
|
||||
if "<cve>" in xml_lines[i] and "</cve>" in xml_lines[i]:
|
||||
cve_ids.append(xml_lines[i].strip().replace("<cve>", "").replace("</cve>", "").strip())
|
||||
if "<packageUrl" in xml_lines[i] and "</packageUrl>" in xml_lines[i]:
|
||||
packages = re.sub(r'<packageUrl(?: regex="(?:true|false)")?>|</packageUrl>', '', xml_lines[i]).strip()
|
||||
if "</suppress>" in xml_lines[i]:
|
||||
break
|
||||
i += 1
|
||||
reason = f"{last_comment} -- {packages}" if last_comment else "Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml"
|
||||
|
||||
# Add suppressions
|
||||
for cve_id in cve_ids:
|
||||
snyk_data["ignore"][cve_id] = [{"reason": reason}]
|
||||
|
||||
last_comment = None
|
||||
else:
|
||||
i += 1
|
||||
|
||||
with open(os.path.join(script_dir, "../.snyk"), "w") as snyk_file:
|
||||
snyk_file.write("# Snyk (https://snyk.io) policy file, provides ignores for known false positives.\n")
|
||||
snyk_file.write("# This file is autogenerated from .build/dependency-check-suppressions.xml\n")
|
||||
snyk_file.write("version: v1.25.0\n")
|
||||
snyk_file.write(f"ignore:\n")
|
||||
for cve_id, ignores in snyk_data["ignore"].items():
|
||||
snyk_file.write(f" {cve_id}:\n")
|
||||
for ignore in ignores:
|
||||
snyk_file.write(f" - reason: {ignore['reason']}\n")
|
||||
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
# Snyk (https://snyk.io) policy file, provides ignores for known false positives.
|
||||
# This file is autogenerated from .build/dependency-check-suppressions.xml
|
||||
version: v1.25.0
|
||||
ignore:
|
||||
CVE-2022-1471:
|
||||
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
|
||||
CVE-2022-25857:
|
||||
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
|
||||
CVE-2022-38749:
|
||||
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
|
||||
CVE-2022-38750:
|
||||
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
|
||||
CVE-2022-38751:
|
||||
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
|
||||
CVE-2022-38752:
|
||||
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
|
||||
CVE-2022-41854:
|
||||
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17907 -- ^pkg:maven/org\.yaml/snakeyaml@.*$
|
||||
CVE-2023-44487:
|
||||
- reason: https://issues.apache.org/jira/browse/CASSANDRA-18943 -- ^pkg:maven/io\.netty/netty\-.*@.*$
|
||||
CVE-2022-42003:
|
||||
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17966 -- ^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$
|
||||
CVE-2022-42004:
|
||||
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17966 -- ^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$
|
||||
CVE-2023-35116:
|
||||
- reason: https://issues.apache.org/jira/browse/CASSANDRA-17966 -- ^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$
|
||||
CVE-2023-6378:
|
||||
- reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml
|
||||
CVE-2023-6481:
|
||||
- reason: Suppressed due to internal review, see project's .build/dependency-check-suppressions.xml
|
||||
CVE-2024-45772:
|
||||
- reason: https://issues.apache.org/jira/browse/CASSANDRA-20024 -- ^pkg:maven/org\.apache\.lucene/lucene\-.*@9.7.0$
|
||||
|
|
@ -22,6 +22,7 @@ Merged from 4.1:
|
|||
* Fix SimpleClient ability to release acquired capacity (CASSANDRA-20202)
|
||||
* Fix WaitQueue.Signal.awaitUninterruptibly may block forever if invoking thread is interrupted (CASSANDRA-20084)
|
||||
Merged from 4.0:
|
||||
* Include in source tree and build packages a Snyk policy file that lists known false positives (CASSANDRA-20319)
|
||||
* Update zstd-jni to 1.5.7-2 (CASSANDRA-20453)
|
||||
* Suppress CVE-2024-12801 (CASSANDRA-20412)
|
||||
* Suppress CVE-2024-12798 (CASSANDRA-20408)
|
||||
|
|
|
|||
|
|
@ -536,7 +536,7 @@
|
|||
</javac>
|
||||
</target>
|
||||
|
||||
<target depends="init,gen-cql3-grammar,generate-cql-html,generate-jflex-java"
|
||||
<target depends="init,gen-cql3-grammar,generate-cql-html,generate-jflex-java,generate-snyk-file"
|
||||
name="build-project">
|
||||
<echo message="${ant.project.name}: ${ant.file}"/>
|
||||
<!-- Order matters! -->
|
||||
|
|
@ -891,6 +891,7 @@
|
|||
<copy todir="${dist.dir}/">
|
||||
<fileset dir="${basedir}">
|
||||
<include name="*.txt" />
|
||||
<include name=".snyk" />
|
||||
</fileset>
|
||||
</copy>
|
||||
<copy todir="${dist.dir}/tools/bin">
|
||||
|
|
|
|||
|
|
@ -78,7 +78,7 @@ binary-indep: build install
|
|||
dh_testroot
|
||||
dh_installchangelogs
|
||||
dh_installinit -u'start 50 2 3 4 5 . stop 50 0 1 6 .'
|
||||
dh_installdocs README.asc CHANGES.txt NEWS.txt doc/cql3/CQL.css doc/cql3/CQL.html CASSANDRA-14092.txt
|
||||
dh_installdocs README.asc CHANGES.txt NEWS.txt doc/cql3/CQL.css doc/cql3/CQL.html CASSANDRA-14092.txt .snyk
|
||||
dh_installexamples tools/*.yaml
|
||||
dh_bash-completion
|
||||
dh_compress
|
||||
|
|
|
|||
|
|
@ -140,7 +140,7 @@ exit 0
|
|||
|
||||
%files
|
||||
%defattr(0644,root,root,0755)
|
||||
%doc CHANGES.txt LICENSE.txt README.asc NEWS.txt NOTICE.txt CASSANDRA-14092.txt
|
||||
%doc CHANGES.txt LICENSE.txt README.asc NEWS.txt NOTICE.txt CASSANDRA-14092.txt .snyk
|
||||
%attr(755,root,root) %{_bindir}/auditlogviewer
|
||||
%attr(755,root,root) %{_bindir}/jmxtool
|
||||
%attr(755,root,root) %{_bindir}/cassandra-stress
|
||||
|
|
|
|||
|
|
@ -143,7 +143,7 @@ exit 0
|
|||
|
||||
%files
|
||||
%defattr(0644,root,root,0755)
|
||||
%doc CHANGES.txt LICENSE.txt README.asc NEWS.txt NOTICE.txt CASSANDRA-14092.txt
|
||||
%doc CHANGES.txt LICENSE.txt README.asc NEWS.txt NOTICE.txt CASSANDRA-14092.txt .snyk
|
||||
%attr(755,root,root) %{_bindir}/auditlogviewer
|
||||
%attr(755,root,root) %{_bindir}/jmxtool
|
||||
%attr(755,root,root) %{_bindir}/cassandra-stress
|
||||
|
|
|
|||
Loading…
Reference in New Issue