snyk-docker-plugin
Version:
Snyk CLI docker plugin
339 lines • 13.3 kB
JavaScript
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.buildResponse = void 0;
const dep_graph_1 = require("@snyk/dep-graph");
// Module that provides functions to collect and build response after all
// analyses' are done.
const dockerfile_1 = require("./dockerfile");
const utils_1 = require("./utils");
const version_1 = require("./version");
async function buildResponse(depsAnalysis, dockerfileAnalysis, excludeBaseImageVulns, names, ociDistributionMetadata, options) {
var _a, _b, _c;
const deps = depsAnalysis.depTree.dependencies;
const dockerfilePkgs = collectDockerfilePkgs(dockerfileAnalysis, deps);
const finalDeps = excludeBaseImageDeps(deps, dockerfilePkgs, excludeBaseImageVulns);
/** WARNING! Mutates the depTree.dependencies! */
annotateLayerIds(finalDeps, dockerfilePkgs);
// Apply the filtered dependencies back to the depTree
depsAnalysis.depTree.dependencies = finalDeps;
/** This must be called after all final changes to the DependencyTree. */
const depGraph = await dep_graph_1.legacy.depTreeToGraph(depsAnalysis.depTree, depsAnalysis.packageFormat);
const additionalFacts = [];
const hashes = depsAnalysis.binaries;
if (hashes && hashes.length > 0) {
const keyBinariesHashesFact = {
type: "keyBinariesHashes",
data: hashes,
};
additionalFacts.push(keyBinariesHashesFact);
}
if (dockerfileAnalysis !== undefined) {
const dockerfileAnalysisFact = {
type: "dockerfileAnalysis",
data: dockerfileAnalysis,
};
additionalFacts.push(dockerfileAnalysisFact);
}
if (depsAnalysis.imageId) {
const imageIdFact = {
type: "imageId",
data: depsAnalysis.imageId,
};
additionalFacts.push(imageIdFact);
}
if (depsAnalysis.imageLayers && depsAnalysis.imageLayers.length > 0) {
const imageLayersFact = {
type: "imageLayers",
data: depsAnalysis.imageLayers,
};
additionalFacts.push(imageLayersFact);
}
if (depsAnalysis.imageLabels) {
const imageLabels = {
type: "imageLabels",
data: depsAnalysis.imageLabels,
};
additionalFacts.push(imageLabels);
}
if (depsAnalysis.containerConfig) {
const containerConfigFact = {
type: "containerConfig",
data: {
...(depsAnalysis.containerConfig.User !== undefined && {
user: depsAnalysis.containerConfig.User,
}),
...(depsAnalysis.containerConfig.ExposedPorts !== undefined && {
exposedPorts: depsAnalysis.containerConfig.ExposedPorts
? Object.keys(depsAnalysis.containerConfig.ExposedPorts)
: null,
}),
...(depsAnalysis.containerConfig.Env !== undefined && {
env: depsAnalysis.containerConfig.Env,
}),
...(depsAnalysis.containerConfig.Entrypoint !== undefined && {
entrypoint: depsAnalysis.containerConfig.Entrypoint,
}),
...(depsAnalysis.containerConfig.Cmd !== undefined && {
cmd: depsAnalysis.containerConfig.Cmd,
}),
...(depsAnalysis.containerConfig.Volumes !== undefined && {
volumes: depsAnalysis.containerConfig.Volumes
? Object.keys(depsAnalysis.containerConfig.Volumes)
: null,
}),
...(depsAnalysis.containerConfig.WorkingDir !== undefined && {
workingDir: depsAnalysis.containerConfig.WorkingDir,
}),
...(depsAnalysis.containerConfig.StopSignal !== undefined && {
stopSignal: depsAnalysis.containerConfig.StopSignal,
}),
...(depsAnalysis.containerConfig.ArgsEscaped !== undefined && {
argsEscaped: depsAnalysis.containerConfig.ArgsEscaped,
}),
},
};
additionalFacts.push(containerConfigFact);
}
if (depsAnalysis.history && depsAnalysis.history.length > 0) {
const historyFact = {
type: "history",
data: depsAnalysis.history.map((entry) => ({
...(entry.created !== undefined && { created: entry.created }),
...(entry.author !== undefined && { author: entry.author }),
...(entry.created_by !== undefined && { createdBy: entry.created_by }),
...(entry.comment !== undefined && { comment: entry.comment }),
...(entry.empty_layer !== undefined && {
emptyLayer: entry.empty_layer,
}),
})),
};
additionalFacts.push(historyFact);
}
if (depsAnalysis.imageCreationTime) {
const imageCreationTimeFact = {
type: "imageCreationTime",
data: depsAnalysis.imageCreationTime,
};
additionalFacts.push(imageCreationTimeFact);
}
if (depsAnalysis.rootFsLayers &&
Array.isArray(depsAnalysis.rootFsLayers) &&
depsAnalysis.rootFsLayers.length > 0) {
const rootFsFact = {
type: "rootFs",
data: depsAnalysis.rootFsLayers,
};
additionalFacts.push(rootFsFact);
}
if (depsAnalysis.depTree.targetOS.prettyName) {
const imageOsReleasePrettyNameFact = {
type: "imageOsReleasePrettyName",
data: depsAnalysis.depTree.targetOS.prettyName,
};
additionalFacts.push(imageOsReleasePrettyNameFact);
}
const manifestFiles = depsAnalysis.manifestFiles.length > 0
? depsAnalysis.manifestFiles
: undefined;
if (manifestFiles) {
const imageManifestFilesFact = {
type: "imageManifestFiles",
data: manifestFiles,
};
additionalFacts.push(imageManifestFilesFact);
}
const autoDetectedPackages = (_a = depsAnalysis.autoDetectedUserInstructions) === null || _a === void 0 ? void 0 : _a.dockerfilePackages;
const autoDetectedLayers = (_b = depsAnalysis.autoDetectedUserInstructions) === null || _b === void 0 ? void 0 : _b.dockerfileLayers;
if (autoDetectedPackages &&
Object.keys(autoDetectedPackages).length > 0 &&
autoDetectedLayers &&
Object.keys(autoDetectedLayers).length > 0) {
const autoDetectedPackagesWithChildren = getUserInstructionDeps(autoDetectedPackages, deps);
const autoDetectedUserInstructionsFact = {
type: "autoDetectedUserInstructions",
data: {
dockerfileLayers: autoDetectedLayers,
dockerfilePackages: autoDetectedPackagesWithChildren,
},
};
additionalFacts.push(autoDetectedUserInstructionsFact);
}
const applicationDependenciesScanResults = (depsAnalysis.applicationDependenciesScanResults || []).map((appDepsScanResult) => {
if (depsAnalysis.imageId) {
const imageIdFact = {
type: "imageId",
data: depsAnalysis.imageId,
};
appDepsScanResult.facts.push(imageIdFact);
}
if (names && names.length > 0) {
const imageNamesFact = {
type: "imageNames",
data: { names },
};
appDepsScanResult.facts.push(imageNamesFact);
}
if (ociDistributionMetadata) {
const metadataFact = {
type: "ociDistributionMetadata",
data: ociDistributionMetadata,
};
appDepsScanResult.facts.push(metadataFact);
}
const appPluginVersionFact = {
type: "pluginVersion",
data: version_1.PLUGIN_VERSION,
};
appDepsScanResult.facts.push(appPluginVersionFact);
return {
...appDepsScanResult,
target: {
image: depGraph.rootPkg.name,
},
...(options &&
options["target-reference"] && {
targetReference: options["target-reference"],
}),
};
});
const args = depsAnalysis.platform !== undefined
? { platform: depsAnalysis.platform }
: undefined;
const depGraphFact = {
type: "depGraph",
data: depGraph,
};
if (names) {
if (names.length > 0) {
const imageNameInfo = { names };
const imageNamesFact = {
type: "imageNames",
data: imageNameInfo,
};
additionalFacts.push(imageNamesFact);
}
}
if (ociDistributionMetadata) {
const metadataFact = {
type: "ociDistributionMetadata",
data: ociDistributionMetadata,
};
additionalFacts.push(metadataFact);
}
if (depsAnalysis.platform) {
const platformFact = {
type: "platform",
data: depsAnalysis.platform,
};
additionalFacts.push(platformFact);
}
const pluginVersionFact = {
type: "pluginVersion",
data: version_1.PLUGIN_VERSION,
};
additionalFacts.push(pluginVersionFact);
if ((options === null || options === void 0 ? void 0 : options.parameterWarnings) && options.parameterWarnings.length > 0) {
const pluginWarningsFact = {
type: "pluginWarnings",
data: {
parameterChecks: options.parameterWarnings,
},
};
additionalFacts.push(pluginWarningsFact);
}
const scanResults = [
{
facts: [depGraphFact, ...additionalFacts],
target: {
image: depGraph.rootPkg.name,
},
identity: {
type: depGraph.pkgManager.name,
args,
},
...(options &&
options["target-reference"] && {
targetReference: (_c = options["target-reference"]) !== null && _c !== void 0 ? _c : depGraph.rootPkg.name,
}),
},
...applicationDependenciesScanResults,
];
const truncatedScanResults = scanResults.map((result) => ({
...result,
facts: (0, utils_1.truncateAdditionalFacts)(result.facts || []),
}));
return {
scanResults: truncatedScanResults,
};
}
exports.buildResponse = buildResponse;
function collectDockerfilePkgs(dockerAnalysis, deps) {
if (!dockerAnalysis) {
return;
}
return getUserInstructionDeps(dockerAnalysis.dockerfilePackages, deps);
}
// Iterate over the dependencies list; if one is introduced by the dockerfile,
// flatten its dependencies and append them to the list of dockerfile
// packages. This gives us a reference of all transitive deps installed via
// the dockerfile, and the instruction that installed it.
function getUserInstructionDeps(dockerfilePackages, dependencies) {
for (const dependencyName in dependencies) {
if (dependencies.hasOwnProperty(dependencyName)) {
const sourceOrName = dependencyName.split("/")[0];
const dockerfilePackage = dockerfilePackages[sourceOrName];
if (dockerfilePackage) {
for (const dep of collectDeps(dependencies[dependencyName])) {
dockerfilePackages[dep.split("/")[0]] = { ...dockerfilePackage };
}
}
}
}
return dockerfilePackages;
}
function collectDeps(pkg) {
// ES5 doesn't have Object.values, so replace with Object.keys() and map()
return pkg.dependencies
? Object.keys(pkg.dependencies)
.map((name) => pkg.dependencies[name])
.reduce((allDeps, pkg) => {
return [...allDeps, ...collectDeps(pkg)];
}, Object.keys(pkg.dependencies))
: [];
}
// Skip processing if option disabled or dockerfilePkgs is undefined. We
// can't exclude anything in that case, because we can't tell which deps are
// from dockerfile and which from base image.
function excludeBaseImageDeps(deps, dockerfilePkgs, excludeBaseImageVulns) {
if (!excludeBaseImageVulns || !dockerfilePkgs) {
return deps;
}
return extractDockerfileDeps(deps, dockerfilePkgs);
}
function extractDockerfileDeps(allDeps, dockerfilePkgs) {
return Object.keys(allDeps)
.filter((depName) => dockerfilePkgs[depName])
.reduce((extractedDeps, depName) => {
extractedDeps[depName] = allDeps[depName];
return extractedDeps;
}, {});
}
function annotateLayerIds(deps, dockerfilePkgs) {
if (!dockerfilePkgs) {
return;
}
for (const dep of Object.keys(deps)) {
const pkg = deps[dep];
const dockerfilePkg = dockerfilePkgs[dep];
if (dockerfilePkg) {
pkg.labels = {
...(pkg.labels || {}),
dockerLayerId: (0, dockerfile_1.instructionDigest)(dockerfilePkg.instruction),
};
}
if (pkg.dependencies) {
annotateLayerIds(pkg.dependencies, dockerfilePkgs);
}
}
}
//# sourceMappingURL=response-builder.js.map