Skip to content

Commit d17fb75

Browse files
joshuaostrom-cbjoshuaostrom-cb
authored
Merge pull request #867 from coinbase/golang_1_21
Version bumping GoLang & GoSec
2 parents e927762 + 0ec9d56 commit d17fb75

9 files changed

Lines changed: 51 additions & 45 deletions

File tree

‎Dockerfile‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -78,16 +78,16 @@ RUN cd /home \
7878
### Golang
7979
# required for sift and gosec
8080

81-
ENV GOLANG_VERSION 1.20.2
82-
ENV GOLANG_DOWNLOAD_SHA256 4eaea32f59cde4dc635fbc42161031d13e1c780b87097f4b4234cfce671f1768
81+
ENV GOLANG_VERSION 1.21.1
82+
ENV GOLANG_DOWNLOAD_SHA256 b3075ae1ce5dab85f89bc7905d1632de23ca196bd8336afd93fa97434cfa55ae
8383

8484
ENV GOLANG_TARBALL_FILE go$GOLANG_VERSION.linux-amd64.tar.gz
8585
ENV GOLANG_DOWNLOAD_URL https://golang.org/dl/${GOLANG_TARBALL_FILE}
8686

87-
ENV GOSEC_VERSION 2.15.0
87+
ENV GOSEC_VERSION 2.17.0
8888
ENV GOSEC_TARBALL_FILE gosec_${GOSEC_VERSION}_linux_amd64.tar.gz
8989
ENV GOSEC_DOWNLOAD_URL https://github.com/securego/gosec/releases/download/v${GOSEC_VERSION}/${GOSEC_TARBALL_FILE}
90-
ENV GOSEC_DOWNLOAD_SHA256 2312388e9ce0dcfed23893ffd2b719f9de5b1d262c84f4e3c8e2e2cb0d1785d2
90+
ENV GOSEC_DOWNLOAD_SHA256 e268c49e3382d43a1bd1a24d15f5c0e249841cd2a6befc53b5d7986f07a97d2f
9191
ENV GO111MODULE on
9292

9393
RUN curl -fsSL "$GOLANG_DOWNLOAD_URL" -o golang.tar.gz \

‎Gemfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,15 @@ source 'https://rubygems.org'
22

33
ruby '3.2.1'
44

5-
gem 'activemodel', '~> 6.1.7.3'
6-
gem 'activesupport', '~> 6.1.7.3'
5+
gem 'activemodel', '~> 6.1.7.5'
6+
gem 'activesupport', '~> 6.1.7.5'
77
gem 'bugsnag', '~> 6.19.0'
88
gem 'bundler', '= 2.4.8'
99
gem 'cocoapods', '~> 1.12.0'
1010
gem 'deepsort', '~> 0.4.5'
1111
gem 'faraday', '~> 1.3'
1212
gem 'github-linguist', '~> 7.13.0'
13-
gem 'nokogiri', '~> 1.13.6'
13+
gem 'nokogiri', '~> 1.14.3'
1414
gem 'parser', '~> 3.1.3'
1515
gem 'rgl', '~> 0.5.9'
1616
gem 'rubyzip', '~> 2.3.2'

‎Gemfile.lock‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@ GEM
33
specs:
44
CFPropertyList (3.0.6)
55
rexml
6-
activemodel (6.1.7.3)
7-
activesupport (= 6.1.7.3)
8-
activesupport (6.1.7.3)
6+
activemodel (6.1.7.6)
7+
activesupport (= 6.1.7.6)
8+
activesupport (6.1.7.6)
99
concurrent-ruby (~> 1.0, >= 1.0.2)
1010
i18n (>= 1.6, < 2)
1111
minitest (>= 5.1)
@@ -92,21 +92,21 @@ GEM
9292
rugged (>= 0.25.1)
9393
hashdiff (1.0.1)
9494
httpclient (2.8.3)
95-
i18n (1.12.0)
95+
i18n (1.14.1)
9696
concurrent-ruby (~> 1.0)
9797
json (2.6.3)
9898
json-schema (3.0.0)
9999
addressable (>= 2.8)
100100
method_source (1.0.0)
101101
mini_mime (1.0.2)
102-
mini_portile2 (2.8.0)
103-
minitest (5.18.0)
102+
mini_portile2 (2.8.4)
103+
minitest (5.20.0)
104104
molinillo (0.8.0)
105105
multipart-post (2.1.1)
106106
nanaimo (0.3.0)
107107
nap (1.1.0)
108108
netrc (0.11.0)
109-
nokogiri (1.13.10)
109+
nokogiri (1.14.5)
110110
mini_portile2 (~> 2.8.0)
111111
racc (~> 1.4)
112112
pairing_heap (1.0.0)
@@ -121,7 +121,7 @@ GEM
121121
byebug (~> 11.0)
122122
pry (>= 0.13, < 0.15)
123123
public_suffix (4.0.7)
124-
racc (1.6.1)
124+
racc (1.7.1)
125125
rainbow (3.0.0)
126126
regexp_parser (1.8.2)
127127
rexml (3.2.5)
@@ -187,14 +187,14 @@ GEM
187187
colored2 (~> 3.1)
188188
nanaimo (~> 0.3.0)
189189
rexml (~> 3.2.4)
190-
zeitwerk (2.6.7)
190+
zeitwerk (2.6.12)
191191

192192
PLATFORMS
193193
ruby
194194

195195
DEPENDENCIES
196-
activemodel (~> 6.1.7.3)
197-
activesupport (~> 6.1.7.3)
196+
activemodel (~> 6.1.7.5)
197+
activesupport (~> 6.1.7.5)
198198
brakeman (= 5.4.1)
199199
bugsnag (~> 6.19.0)
200200
bundler (= 2.4.8)
@@ -204,7 +204,7 @@ DEPENDENCIES
204204
faraday (~> 1.3)
205205
github-linguist (~> 7.13.0)
206206
json-schema (~> 3.0)
207-
nokogiri (~> 1.13.6)
207+
nokogiri (~> 1.14.3)
208208
parser (~> 3.1.3)
209209
pry (~> 0.14)
210210
pry-byebug (~> 3.10)

‎lib/salus/scanners/base.rb‎

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -532,19 +532,6 @@ def build_options(prefix:, suffix:, separator:, args:, join_by: ',', config_over
532532
join_by: join_by,
533533
regex: type_value
534534
)
535-
# In new versions of gosec, nosec-tag matches the exact string
536-
# For example, In previous versions;
537-
# - running the command `gosec -nosec-tag=falsepositive .`
538-
# would match all occurrences of /* #falsepositive */ in go files
539-
# In current versions:
540-
# - running the command `gosec -nosec-tag=falsepositive .`
541-
# would match only match /* falsepositive */ in go files
542-
# - you would have to modify your string to match #falsepositive
543-
# running the command `gosec -nosec-tag=#falsepositive .`
544-
# would match all occurrences of /* #falsepositive */ in go files
545-
# To prevent salus functionality from changing, this line adds a pound
546-
# sign to alternative nosec string
547-
result = "-nosec-tag=##{config_value} " if result.include? "-nosec-tag="
548535
result
549536
else
550537
warning = "Could not interpolate config for #{keyword} "\

‎salus.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,3 +28,9 @@ scanner_configs:
2828
- spec/fixtures/gosec/multifolder_goapp
2929
- spec/fixtures/gosec/recursive_vulnerable_goapp
3030
- spec/fixtures/gosec/multi_goapps
31+
RubyVersionScanner:
32+
warn:
33+
min_version: '3.0.0'
34+
max_version: '3.1.0'
35+
error:
36+
min_version: '3.0.0'

‎spec/fixtures/npm_audit/success_with_exceptions/salus-sarif.yaml‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,4 +20,14 @@ scanner_configs:
2020
advisory_id: "1091018",
2121
changed_by: "joshua.ostrom",
2222
notes: "See https://www.npmjs.com/advisories/48. We're not vulnerable to this because this is a regex dos and we have nothing that puts user input into it. The impact is also minimal.",
23-
}
23+
}
24+
- {
25+
advisory_id: "1091686",
26+
changed_by: "joshua.ostrom",
27+
notes: "False positive",
28+
}
29+
- {
30+
advisory_id: "1091710",
31+
changed_by: "joshua.ostrom",
32+
notes: "False positive",
33+
}

‎spec/lib/salus/scanners/yarn_audit_spec.rb‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@
7171

7272
expect(scanner.report.to_h.fetch(:passed)).to eq(false)
7373
vulns = JSON.parse(scanner.report.to_h[:info][:stdout]).sort { |a, b| a["ID"] <=> b["ID"] }
74-
expect(vulns.size).to eq(17)
74+
expect(vulns.size).to eq(18)
7575

7676
vulns.each do |vul|
7777
["Package", "Patched in", "Dependency of", "More info", "Severity", "Title"].each do |attr|
@@ -81,22 +81,24 @@
8181
expect(vul["ID"]).to be_kind_of(Integer)
8282
end
8383

84-
id_vuls = vulns.find { |v| v['ID'] == 1_091_360 }
84+
id_vuls = vulns.find { |v| v['ID'] == 1_091_832 }
85+
8586
# vul has 1 dependency of
86-
expected_vul = { "Package" => "trim-newlines",
87-
"Patched in" => ">=3.0.1",
88-
"Dependency of" => "gulp-cssmin",
89-
"More info" => "https://www.npmjs.com/advisories/1091360",
87+
expected_vul = { "Package" => "lodash",
88+
"Patched in" => ">=4.17.21",
89+
"Dependency of" => "gulp-modify-file",
90+
"More info" => "https://www.npmjs.com/advisories/1091832",
9091
"Severity" => "high",
91-
"Title" => "Uncontrolled Resource Consumption in trim-newlines",
92-
"ID" => 1_091_360 }
92+
"Title" => "Command Injection in lodash",
93+
"ID" => 1_091_832 }
94+
9395
expect(id_vuls).to eq(expected_vul)
9496

9597
id_vuls_w_paths = scanner.instance_variable_get(:@vulns_w_paths)
96-
.find { |v| v['ID'] == 1_091_360 }
98+
.find { |v| v['ID'] == 1_091_832 }
9799

98-
expected_vul['Path'] = "gulp-cssmin > gulp-util > "\
99-
"dateformat > meow > trim-newlines"
100+
expected_vul['Path'] = "gulp-modify-file > gulp > "\
101+
"vinyl-fs > glob-watcher > gaze > globule > lodash"
100102
expect(id_vuls_w_paths).to eq(expected_vul)
101103
end
102104

‎spec/lib/sarif/cargo_audit_sarif_spec.rb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434
"title": { "text": "MultiDecoder::read() drops uninitialized memory of"\
3535
" arbitrary type on panic in client code" },
3636
"severity": { "text": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" },
37-
"cwe": { "text": "[\"CVE-2019-15552\"]" },
37+
"cwe": { "text": "[\"CVE-2019-15552\", \"GHSA-rpcm-whqc-jfw8\"]" },
3838
"patched_versions": { "text": "[\">=0.1.25\"]" },
3939
"unaffected_versions": { "text": "[\"<0.1.14\"]" } },
4040
help_url: "https://github.com/sile/libflate/issues/35",

‎spec/lib/sarif/npm_audit_sarif_spec.rb‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,7 @@
165165
report = Salus::Report.new(project_name: "Neon Genesis")
166166
report.add_scan_report(scanner.report, required: false)
167167
report_object = JSON.parse(report.to_sarif)['runs'][0]
168+
168169
expect(report_object['results'].length).to eq(0)
169170
expect(report_object['invocations'][0]['executionSuccessful']).to eq(true)
170171
end

0 commit comments

Comments
 (0)