fluent-plugin-jfrog-siem 2.0.8 → 2.0.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d54b989518483df9f5df0a16bf1911fd57a0c2768e3bb7eeadfe566f023a0a54
-  data.tar.gz: fb9ebc429c302d9f3ae1b1003e32277f8fe6d49c490b316da5300f2b91346265
+  metadata.gz: 74c423ae40c052a7a8f53ff8f8d744ffcaa2032553f9c331866fdc1b186ce076
+  data.tar.gz: e7e096bda67598350f0502f91f0602542d616fb0406dfa1f1274a7b82ab0f0e0
 SHA512:
-  metadata.gz: d7be078791c0d2a802b7cbda86e3af7489147b70b1f36ae757b400b3c014fcfb61de2e1539b448010c3e95c71ae643c2c74184416a2a0f94f6be6ab29d370a6f
-  data.tar.gz: ee1a8bb8716fdd04bb96e11aa4b0f85965835e080a5d9f5524b694584f72c0635e3e1069f71250d868207e9cf54aefe820ed8bf3085994c434f6b066eadc8268
+  metadata.gz: ecc3e648b0a7f9d68262e0aed5a403c3c3ebc7ab345234f7156997079c37a3ed5548a33cac35f80be129bfd5cfae665672ed64db58ed197b2340af61a702d099
+  data.tar.gz: cc261ed12d53934671349002785cb037b064a4abac399bf7dca783568a4586da8dcb4c9d665e6cd885654aca0a6fe1f51a7f3aaaffbba04f6627a53bb0115d45

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    fluent-plugin-jfrog-siem (2.0.8)
+    fluent-plugin-jfrog-siem (2.0.9)
       concurrent-ruby-edge
       fluentd (>= 0.14.10, < 2)
       rest-client (~> 2.0)
@@ -86,6 +86,7 @@ GEM
 PLATFORMS
   arm64-darwin-23
   x86_64-darwin-20
+  x86_64-linux
 
 DEPENDENCIES
   bundler (~> 2.0)
@@ -97,4 +98,4 @@ DEPENDENCIES
   test-unit (~> 3.0)
 
 BUNDLED WITH
-   2.2.3
+   2.4.19

data/fluent-plugin-jfrog-siem.gemspec

@@ -3,7 +3,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
 Gem::Specification.new do |spec|
   spec.name    = "fluent-plugin-jfrog-siem"
-  spec.version = "2.0.8"
+  spec.version = "2.0.9"
   spec.authors = ["Mahitha Byreddy", "Ben Harosh"]
   spec.email   = ["partner-support@jfrog.com"]
 

data/lib/fluent/plugin/xray.rb

@@ -90,6 +90,7 @@ class Xray
     cve = []
     cvss_v2_list = []
     cvss_v3_list = []
+    cvss_v4_list = []
     policy_list = []
     rule_list = []
     impacted_artifact_url_list = []
@@ -105,20 +106,32 @@ class Xray
         if properties[index].key?('cvss_v3')
           cvss_v3_list.push(properties[index]['cvss_v3'])
         end
+        if properties[index].key?('cvss_v4')
+          cvss_v4_list.push(properties[index]['cvss_v4'])
+        end
       end
 
       detailResp_json["cve"] = cve.sort.reverse[0]
       cvss_v2 = cvss_v2_list.sort.reverse[0]
       cvss_v3 = cvss_v3_list.sort.reverse[0]
+      cvss_v4 = cvss_v4_list.sort.reverse[0]
+      # cvss_v4 is only a fallback so the reported score doesn't change for violations that also have v3/v2
       if !cvss_v3.nil?
         cvss = cvss_v3
       elsif !cvss_v2.nil?
         cvss = cvss_v2
+      elsif !cvss_v4.nil?
+        cvss = cvss_v4
+      end
+      if !cvss.nil?
+        cvss_score = cvss[0..2]
+        detailResp_json["cvss_score"] = cvss_score
+        # A score without a vector (e.g. "2.4") has no ':' to take the version from
+        cvss_version_part = cvss.split(':')[1]
+        if !cvss_version_part.nil?
+          detailResp_json["cvss_version"] = cvss_version_part[0..2]
+        end
       end
-      cvss_score = cvss[0..2]
-      cvss_version = cvss.split(':')[1][0..2]
-      detailResp_json["cvss_score"] = cvss_score
-      detailResp_json["cvss_version"] = cvss_version
     end
 
     if detailResp_json.key?('matched_policies')
@@ -135,7 +148,7 @@ class Xray
       detailResp_json['rules'] = rule_list
     end
 
-    detailResp_json['impacted_artifacts'].each do |impacted_artifact|
+    (detailResp_json['impacted_artifacts'] || []).each do |impacted_artifact|
       matchdata = impacted_artifact.match /default\/(?<repo_name>[^\/]*)\/(?<path>.*)/
       if matchdata
         impacted_artifact_url = matchdata['repo_name'] + ":" + matchdata['path'] + " "

data/spec/data_normalization_spec.rb

@@ -0,0 +1,300 @@
+# spec/data_normalization_spec.rb
+#
+# Tests for Xray#data_normalization covering JOBS-2850:
+#   When violation properties lack cvss_v2 / cvss_v3 (e.g. Security violations
+#   for issues with no CVSS score, or only a CVSS v4 score) the method must NOT
+#   raise NoMethodError on `cvss[0..2]`.
+#
+# Expected results before the fix:
+#   - Violations without CVSS v2/v3 data   → FAIL  (demonstrates the bug)
+#   - CVSS score without a vector          → FAIL
+#   - Missing impacted_artifacts           → FAIL
+#   - Security-with-CVSS v2/v3 tests       → PASS  (existing logic is correct)
+
+[
+  File.join(File.dirname(__FILE__), '..'),
+  File.join(File.dirname(__FILE__), '..', 'lib/fluent/plugin'),
+  File.join(File.dirname(__FILE__), '..', 'spec'),
+].each do |dir|
+  $LOAD_PATH.unshift(dir) unless $LOAD_PATH.include?(dir)
+end
+
+require 'spec_helper'
+
+RSpec.describe Xray, '#data_normalization' do
+  # Build an Xray instance with all dummy/nil params — we only need the method.
+  # Constructor signature: (jpd_url, username, api_key, token, wait_interval,
+  #                         batch_size, pos_file_path, router, tag)
+  subject(:xray) do
+    Xray.new(nil, nil, nil, nil, nil, nil, nil, nil, nil)
+  end
+
+  # ─────────────────────────────────────────────────────────────────────────
+  # JOBS-2850: License violation — properties have no cvss_v2 / cvss_v3
+  # ─────────────────────────────────────────────────────────────────────────
+  describe 'License violation without CVSS data' do
+    let(:license_violation) do
+      {
+        'issue_id'           => 'Apache-2.0',
+        'type'               => 'License',
+        'properties'         => [{ 'license' => 'Apache-2.0' }],
+        'impacted_artifacts' => ['default/maven-repo-1/com/example/foo/bar.jar']
+      }
+    end
+
+    it 'does not raise an error (regression for JOBS-2850)' do
+      # BUG: cvss is nil → cvss[0..2] raises NoMethodError undefined method '[]' for nil
+      expect { xray.data_normalization(license_violation) }.not_to raise_error
+    end
+
+    it 'returns a Hash' do
+      result = xray.data_normalization(license_violation)
+      expect(result).to be_a(Hash)
+    end
+
+    it 'does not set cvss_score when CVSS data is absent' do
+      result = xray.data_normalization(license_violation)
+      expect(result).not_to have_key('cvss_score')
+    end
+
+    it 'does not set cvss_version when CVSS data is absent' do
+      result = xray.data_normalization(license_violation)
+      expect(result).not_to have_key('cvss_version')
+    end
+  end
+
+  # ─────────────────────────────────────────────────────────────────────────
+  # JOBS-2850: Operational Risk violation — properties have no cvss_v2 / cvss_v3
+  # ─────────────────────────────────────────────────────────────────────────
+  describe 'Operational Risk violation without CVSS data' do
+    let(:op_risk_violation) do
+      {
+        'issue_id'           => 'EOL-component-1234',
+        'type'               => 'Operational Risk',
+        'properties'         => [{ 'end_of_life' => 'true' }],
+        'impacted_artifacts' => ['default/npm-repo/lodash/-/lodash-4.0.0.tgz']
+      }
+    end
+
+    it 'does not raise an error (regression for JOBS-2850)' do
+      # BUG: same as License — cvss stays nil, cvss[0..2] crashes
+      expect { xray.data_normalization(op_risk_violation) }.not_to raise_error
+    end
+
+    it 'returns a Hash' do
+      result = xray.data_normalization(op_risk_violation)
+      expect(result).to be_a(Hash)
+    end
+
+    it 'does not set cvss_score when CVSS data is absent' do
+      result = xray.data_normalization(op_risk_violation)
+      expect(result).not_to have_key('cvss_score')
+    end
+
+    it 'does not set cvss_version when CVSS data is absent' do
+      result = xray.data_normalization(op_risk_violation)
+      expect(result).not_to have_key('cvss_version')
+    end
+  end
+
+  # ─────────────────────────────────────────────────────────────────────────
+  # JOBS-2850: Security violation with a CVE but no CVSS data at all
+  # ─────────────────────────────────────────────────────────────────────────
+  describe 'Security violation with a CVE but without CVSS data' do
+    let(:security_violation_no_cvss) do
+      {
+        'issue_id'           => 'SIEMTEST-NOCVSS-1',
+        'type'               => 'Security',
+        'properties'         => [{ 'cve' => 'CVE-2099-28500' }],
+        'impacted_artifacts' => ['default/npm-siem-test/siem-mit-pkg/-/siem-mit-pkg-1.0.0.tgz']
+      }
+    end
+
+    it 'does not raise an error (regression for JOBS-2850)' do
+      expect { xray.data_normalization(security_violation_no_cvss) }.not_to raise_error
+    end
+
+    it 'still sets the cve' do
+      result = xray.data_normalization(security_violation_no_cvss)
+      expect(result['cve']).to eq('CVE-2099-28500')
+    end
+
+    it 'does not set cvss_score or cvss_version' do
+      result = xray.data_normalization(security_violation_no_cvss)
+      expect(result).not_to have_key('cvss_score')
+      expect(result).not_to have_key('cvss_version')
+    end
+  end
+
+  # ─────────────────────────────────────────────────────────────────────────
+  # JOBS-2850: Security violation with only a CVSS v4 score
+  # ─────────────────────────────────────────────────────────────────────────
+  describe 'Security violation with only CVSS v4 data' do
+    let(:security_violation_v4) do
+      {
+        'issue_id'           => 'XRAY-1073490',
+        'type'               => 'Security',
+        'properties'         => [
+          {
+            'cve'     => 'CVE-2026-84445',
+            'cwe'     => ['CWE-129', 'CWE-248'],
+            'cvss_v4' => '8.7/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
+          }
+        ],
+        'impacted_artifacts' => ['default/build-info/some-build']
+      }
+    end
+
+    it 'does not raise an error (regression for JOBS-2850)' do
+      expect { xray.data_normalization(security_violation_v4) }.not_to raise_error
+    end
+
+    it 'sets cvss_score from cvss_v4' do
+      result = xray.data_normalization(security_violation_v4)
+      expect(result['cvss_score']).to eq('8.7')
+    end
+
+    it 'sets cvss_version from cvss_v4' do
+      result = xray.data_normalization(security_violation_v4)
+      expect(result['cvss_version']).to eq('4.0')
+    end
+  end
+
+  # ─────────────────────────────────────────────────────────────────────────
+  # Security violation with both CVSS v3 and v4 — v3 is kept
+  # ─────────────────────────────────────────────────────────────────────────
+  describe 'Security violation with both CVSS v3 and v4 (v3 kept)' do
+    let(:security_violation_v3_v4) do
+      {
+        'issue_id'           => 'CVE-2024-5678',
+        'type'               => 'Security',
+        'properties'         => [
+          {
+            'cve'     => 'CVE-2024-5678',
+            'cvss_v3' => '7.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H',
+            'cvss_v4' => '8.7/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
+          }
+        ],
+        'impacted_artifacts' => ['default/maven-repo/some-lib/1.0/some-lib-1.0.jar']
+      }
+    end
+
+    it 'uses cvss_v3, not cvss_v4' do
+      result = xray.data_normalization(security_violation_v3_v4)
+      expect(result['cvss_score']).to eq('7.5')
+      expect(result['cvss_version']).to eq('3.1')
+    end
+  end
+
+  # ─────────────────────────────────────────────────────────────────────────
+  # Security violation with a CVSS score but no vector (e.g. custom issues)
+  # ─────────────────────────────────────────────────────────────────────────
+  describe 'Security violation with a CVSS score but no vector' do
+    let(:security_violation_score_only) do
+      {
+        'issue_id'           => 'CUSTOM-ISSUE-1',
+        'type'               => 'Security',
+        'properties'         => [{ 'cve' => 'CVE-2017-1000386', 'cvss_v2' => '2.4' }],
+        'impacted_artifacts' => ['default/maven-repo/aero/aero/0.2.3/aero-0.2.3.jar']
+      }
+    end
+
+    it 'does not raise an error' do
+      expect { xray.data_normalization(security_violation_score_only) }.not_to raise_error
+    end
+
+    it 'sets cvss_score' do
+      result = xray.data_normalization(security_violation_score_only)
+      expect(result['cvss_score']).to eq('2.4')
+    end
+
+    it 'does not set cvss_version' do
+      result = xray.data_normalization(security_violation_score_only)
+      expect(result).not_to have_key('cvss_version')
+    end
+  end
+
+  # ─────────────────────────────────────────────────────────────────────────
+  # Violation without impacted_artifacts (key absent or null)
+  # ─────────────────────────────────────────────────────────────────────────
+  describe 'Violation without impacted_artifacts' do
+    it 'does not raise an error when the key is absent' do
+      violation = { 'issue_id' => 'CVE-2099-28500', 'type' => 'Security', 'properties' => [{ 'cve' => 'CVE-2099-28500' }] }
+      expect { xray.data_normalization(violation) }.not_to raise_error
+    end
+
+    it 'sets an empty impacted_artifacts_url when the value is null' do
+      violation = { 'issue_id' => 'CVE-2099-28500', 'type' => 'Security', 'impacted_artifacts' => nil }
+      result = xray.data_normalization(violation)
+      expect(result['impacted_artifacts_url']).to eq([])
+    end
+  end
+
+  # ─────────────────────────────────────────────────────────────────────────
+  # Security violation WITH CVSS v3 only (existing behaviour must keep working)
+  # ─────────────────────────────────────────────────────────────────────────
+  describe 'Security violation with CVSS v3 data' do
+    let(:security_violation_v3) do
+      {
+        'issue_id'           => 'CVE-2021-44228',
+        'type'               => 'Security',
+        'properties'         => [
+          {
+            'cve'     => 'CVE-2021-44228',
+            'cvss_v3' => '9.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
+          }
+        ],
+        'impacted_artifacts' => ['default/maven-repo/log4j/core/2.14.1/log4j-core-2.14.1.jar']
+      }
+    end
+
+    it 'does not raise an error' do
+      expect { xray.data_normalization(security_violation_v3) }.not_to raise_error
+    end
+
+    it 'sets cvss_score to the leading numeric score (e.g. "9.8")' do
+      result = xray.data_normalization(security_violation_v3)
+      expect(result['cvss_score']).to eq('9.8')
+    end
+
+    it 'sets cvss_version to the CVSS major.minor version (e.g. "3.1")' do
+      result = xray.data_normalization(security_violation_v3)
+      expect(result['cvss_version']).to eq('3.1')
+    end
+  end
+
+  # ─────────────────────────────────────────────────────────────────────────
+  # Security violation WITH both CVSS v2 AND v3 — v3 must be preferred
+  # ─────────────────────────────────────────────────────────────────────────
+  describe 'Security violation with both CVSS v2 and v3 (v3 preferred)' do
+    let(:security_violation_both) do
+      {
+        'issue_id'           => 'CVE-2020-1234',
+        'type'               => 'Security',
+        'properties'         => [
+          {
+            'cve'     => 'CVE-2020-1234',
+            'cvss_v2' => '7.5/AV:N/AC:L/Au:N/C:P/I:P/A:P',
+            'cvss_v3' => '9.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
+          }
+        ],
+        'impacted_artifacts' => ['default/maven-repo/some-lib/1.0/some-lib-1.0.jar']
+      }
+    end
+
+    it 'does not raise an error' do
+      expect { xray.data_normalization(security_violation_both) }.not_to raise_error
+    end
+
+    it 'uses cvss_v3 score (not cvss_v2) when both are present' do
+      result = xray.data_normalization(security_violation_both)
+      # v3 score is 9.8; v2 score is 7.5 — the result must reflect v3
+      expect(result['cvss_score']).to eq('9.8')
+    end
+
+    it 'sets cvss_version from cvss_v3 when both are present' do
+      result = xray.data_normalization(security_violation_both)
+      expect(result['cvss_version']).to eq('3.1')
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-jfrog-siem
 version: !ruby/object:Gem::Version
-  version: 2.0.8
+  version: 2.0.9
 platform: ruby
 authors:
 - Mahitha Byreddy
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-11-07 00:00:00.000000000 Z
+date: 2026-10-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -163,7 +163,7 @@ files:
 - lib/fluent/plugin/test_violations.rb
 - lib/fluent/plugin/violations.json
 - lib/fluent/plugin/xray.rb
-- pkg/fluent-plugin-jfrog-siem-2.0.8.gem
+- spec/data_normalization_spec.rb
 - spec/position_file_spec.rb
 - spec/spec_helper.rb
 - spec/xray_spec.rb
@@ -188,12 +188,13 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.3
+rubygems_version: 3.4.19
 signing_key:
 specification_version: 4
 summary: JFrog SIEM fluent input plugin will send the SIEM events from JFrog Xray
   to Fluentd
 test_files:
+- spec/data_normalization_spec.rb
 - spec/position_file_spec.rb
 - spec/spec_helper.rb
 - spec/xray_spec.rb