Repository navigation
feat(scan): scope reachability analysis to chosen advisories - #1640
Draft
Martin Torp (mtorp) wants to merge 1 commit into
Draft
Martin Torp (mtorp) wants to merge 1 commit into
Martin Torp (mtorp) wants to merge 1 commit into
Conversation
`--reach-advisories` on `socket scan create --reach` and `socket scan reach` takes GHSA and CVE IDs. CVE IDs are converted to GHSA IDs through the GitHub API, the same way `socket fix --id` does, and an ID that cannot be resolved fails the command. The GHSA IDs go to Coana as `--ghsas`, which only analyzes those advisories and gives every other one unknown reachability.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
socket scan create --reachandsocket scan reachget a--reach-advisoriesflag that limits reachability analysis to a set of advisories. It takes GHSA and CVE IDs, comma-separated or repeated. Every advisory outside the list gets unknown reachability, and it costs no analysis time.How it works:
resolveReachAdvisories(new,src/commands/scan/reach-advisories.mts) normalizes the IDs and converts CVE IDs to GHSA IDs with the same GitHub lookupsocket fix --iduses. Socket-mode vulnerabilities in Coana only carry GHSA IDs, so the conversion has to happen here. An ID that is malformed or has no GHSA fails the command with anInputError. Dropping it silently would quietly leave that advisory unanalyzed.--ghsas. Nothing is passed when the flag is not used.scan create, the flag counts as a reach flag, so it needs--reachlike the others.handle-fix.mtstoutils/cve-to-ghsa.mtsso both commands share them.Depends on coana-tech/coana-package-manager#2627. The pinned Coana does not know
--ghsasyet, so this should merge together with a Coana bump that includes it. Until then the flag only works with--reach-versionpointing at a Coana build that has it.Tests: unit tests for the ID resolution and for the
--ghsasforwarding, plus updated--helpsnapshots. The Coana PR has a full-cycle test for the analysis side. I have not run the two together against the real API.Expected reviewer effort: High-level design decisions