github-issue-tower-defence-management 1.148.5 → 1.148.7

package/src/domain/usecases/DailySecurityScanUseCase.ts

@@ -47,13 +47,88 @@ const isKevCatalog = (value: unknown): value is KevCatalog => {
   );
 };
 
+type ScannedVulnerablePackage = {
+  repositoryName: string;
+  ecosystem: string;
+  packageName: string;
+  packageVersion: string;
+  vulnerabilityId: string;
+  vulnerabilityIdentifiers: string[];
+  summary: string;
+};
+
+const parseScannerVulnerabilities = (
+  repositoryName: string,
+  scannerOutput: string,
+): ScannedVulnerablePackage[] => {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(scannerOutput);
+  } catch (error) {
+    console.error(
+      `Unparsable osv-scanner output for ${repositoryName}: ${String(error)}`,
+    );
+    return [];
+  }
+  const toRecord = (value: unknown): Record<string, unknown> =>
+    typeof value === 'object' && value !== null ? { ...value } : {};
+  const readArray = (value: unknown, key: string): unknown[] => {
+    const entry = toRecord(value)[key];
+    return Array.isArray(entry) ? entry : [];
+  };
+  const readString = (value: unknown, key: string): string => {
+    const entry = toRecord(value)[key];
+    return typeof entry === 'string' ? entry : '';
+  };
+  return readArray(parsed, 'results').flatMap((result) =>
+    readArray(result, 'packages').flatMap((scannedPackage) => {
+      const packageDetail = toRecord(scannedPackage).package;
+      return readArray(scannedPackage, 'vulnerabilities').map(
+        (vulnerability) => {
+          const vulnerabilityId = readString(vulnerability, 'id');
+          const aliases = readArray(vulnerability, 'aliases').filter(
+            (alias): alias is string => typeof alias === 'string',
+          );
+          return {
+            repositoryName,
+            ecosystem: readString(packageDetail, 'ecosystem'),
+            packageName: readString(packageDetail, 'name'),
+            packageVersion: readString(packageDetail, 'version'),
+            vulnerabilityId,
+            vulnerabilityIdentifiers: [vulnerabilityId, ...aliases],
+            summary: readString(vulnerability, 'summary'),
+          };
+        },
+      );
+    }),
+  );
+};
+
+const renderScannerFindings = (
+  today: string,
+  vulnerablePackages: ScannedVulnerablePackage[],
+): string =>
+  [
+    '## OSV-Scanner findings',
+    '',
+    `### ${today}`,
+    '',
+    ...vulnerablePackages.map(
+      (vulnerablePackage) =>
+        `- ${vulnerablePackage.ecosystem} ${vulnerablePackage.packageName} ${vulnerablePackage.packageVersion} ${vulnerablePackage.vulnerabilityIdentifiers.join(' ')} ${vulnerablePackage.summary}`,
+    ),
+  ].join('\n');
+
 const KEV_CATALOG_URL =
   'https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json';
 
 export class DailySecurityScanUseCase {
   constructor(
     readonly localCommandRunner: LocalCommandRunner,
-    readonly issueRepository: Pick<IssueRepository, 'createNewIssue'>,
+    readonly issueRepository: Pick<
+      IssueRepository,
+      'createNewIssue' | 'searchIssue' | 'createCommentByUrl'
+    >,
     readonly httpRepository: HttpRepository,
   ) {}
 
@@ -75,7 +150,7 @@ export class DailySecurityScanUseCase {
     const lastTargetDate = input.targetDates[input.targetDates.length - 1];
     const today = lastTargetDate.toISOString().slice(0, 10);
 
-    await this.scanRepositories(
+    const scannedVulnerablePackages = await this.scanRepositories(
       input.org,
       input.manager,
       today,
@@ -87,6 +162,7 @@ export class DailySecurityScanUseCase {
       input.manager,
       lastTargetDate,
       input.dailySecurityScan,
+      scannedVulnerablePackages,
     );
   };
 
@@ -95,15 +171,13 @@ export class DailySecurityScanUseCase {
     manager: Member['name'],
     today: string,
     config: DailySecurityScanConfig,
-  ): Promise<void> => {
+  ): Promise<ScannedVulnerablePackage[]> => {
     const { stdout: findOutput } = await this.localCommandRunner.runCommand(
       'find',
       [
         config.scanBaseDirectory,
-        '-mindepth',
-        '4',
         '-maxdepth',
-        '4',
+        '5',
         '-name',
         '.git',
         '-type',
@@ -116,6 +190,14 @@ export class DailySecurityScanUseCase {
       .filter((line) => line.length > 0)
       .map((gitDirectory) => gitDirectory.replace(/\/\.git$/, ''));
 
+    if (repositoryDirectories.length === 0) {
+      console.error(
+        `No repositories found in scan base directory: ${config.scanBaseDirectory}`,
+      );
+      return [];
+    }
+
+    const scannedVulnerablePackages: ScannedVulnerablePackage[] = [];
     for (const repositoryDirectory of repositoryDirectories) {
       const { stdout: remoteUrl, exitCode: remoteExitCode } =
         await this.localCommandRunner.runCommand('git', [
@@ -138,26 +220,62 @@ export class DailySecurityScanUseCase {
       const repositoryOrg = remoteMatch[1];
       const repositoryName = remoteMatch[2];
 
-      const { stdout: scanOutput, exitCode: scanExitCode } =
-        await this.localCommandRunner.runCommand('osv-scanner', [
-          'scan',
-          'source',
-          '-r',
-          repositoryDirectory,
-        ]);
+      const {
+        stdout: scanOutput,
+        stderr: scanStderr,
+        exitCode: scanExitCode,
+      } = await this.localCommandRunner.runCommand('osv-scanner', [
+        'scan',
+        'source',
+        '-r',
+        repositoryDirectory,
+        '--format',
+        'json',
+      ]);
+      if (scanExitCode === 0) {
+        continue;
+      }
       if (scanExitCode !== 1) {
+        console.error(
+          `osv-scanner failed with exit code ${scanExitCode} for ${repositoryDirectory}: ${scanStderr}`,
+        );
         continue;
       }
 
-      await this.issueRepository.createNewIssue(
-        repositoryOrg,
+      const vulnerablePackages = parseScannerVulnerabilities(
+        repositoryName,
+        scanOutput,
+      );
+      scannedVulnerablePackages.push(...vulnerablePackages);
+
+      const findingsBody = renderScannerFindings(today, vulnerablePackages);
+      const existingIssues = await this.issueRepository.searchIssue({
+        owner: repositoryOrg,
         repositoryName,
-        `Daily security scan findings: ${today}`,
-        `## OSV-Scanner findings\n\n\`\`\`\n${scanOutput}\n\`\`\``,
-        [manager],
-        [],
+        type: 'issue',
+        state: 'open',
+        title: 'Daily security scan findings',
+      });
+      const existingIssue = existingIssues.find(
+        (issue) => issue.title === 'Daily security scan findings',
       );
+      if (existingIssue) {
+        await this.issueRepository.createCommentByUrl(
+          existingIssue.url,
+          findingsBody,
+        );
+      } else {
+        await this.issueRepository.createNewIssue(
+          repositoryOrg,
+          repositoryName,
+          'Daily security scan findings',
+          findingsBody,
+          [manager],
+          [],
+        );
+      }
     }
+    return scannedVulnerablePackages;
   };
 
   private reportKevAdditions = async (
@@ -165,6 +283,7 @@ export class DailySecurityScanUseCase {
     manager: Member['name'],
     lastTargetDate: Date,
     config: DailySecurityScanConfig,
+    scannedVulnerablePackages: ScannedVulnerablePackage[],
   ): Promise<void> => {
     if (!config.enableKevNvdReport || !config.kevReportRepo) {
       return;
@@ -185,18 +304,15 @@ export class DailySecurityScanUseCase {
     const newKevEntries = parsedKev.vulnerabilities.filter(
       (vulnerability) => vulnerability.dateAdded >= yesterdayYmd,
     );
-    const usedKevEntries: KevVulnerability[] = [];
-    for (const vulnerability of newKevEntries) {
-      if (
-        await this.isProductPresentInScannedWorkspace(
-          config.scanBaseDirectory,
-          vulnerability.product,
-        )
-      ) {
-        usedKevEntries.push(vulnerability);
-      }
-    }
-    if (usedKevEntries.length === 0) {
+    const affectingKevEntries = newKevEntries
+      .map((vulnerability) => ({
+        vulnerability,
+        affectedPackages: scannedVulnerablePackages.filter((scannedPackage) =>
+          scannedPackage.vulnerabilityIdentifiers.includes(vulnerability.cveID),
+        ),
+      }))
+      .filter((entry) => entry.affectedPackages.length > 0);
+    if (affectingKevEntries.length === 0) {
       return;
     }
 
@@ -204,54 +320,19 @@ export class DailySecurityScanUseCase {
       org,
       config.kevReportRepo,
       `CISA KEV new additions since ${yesterdayYmd}`,
-      usedKevEntries
-        .map(
-          (vulnerability) =>
-            `- ${vulnerability.dateAdded} ${vulnerability.cveID} ${vulnerability.vulnerabilityName}`,
+      affectingKevEntries
+        .map((entry) =>
+          [
+            `- ${entry.vulnerability.dateAdded} ${entry.vulnerability.cveID} ${entry.vulnerability.vulnerabilityName}`,
+            ...entry.affectedPackages.map(
+              (affectedPackage) =>
+                `  - ${affectedPackage.repositoryName} ${affectedPackage.ecosystem} ${affectedPackage.packageName} ${affectedPackage.packageVersion}`,
+            ),
+          ].join('\n'),
         )
         .join('\n'),
       [manager],
       [],
     );
   };
-
-  private isProductPresentInScannedWorkspace = async (
-    scanBaseDirectory: string,
-    product: string,
-  ): Promise<boolean> => {
-    const { stdout: findOutput } = await this.localCommandRunner.runCommand(
-      'find',
-      [scanBaseDirectory, '-maxdepth', '3', '-name', '.git', '-type', 'd'],
-    );
-    const repositoryDirectories = findOutput
-      .split('\n')
-      .filter((line) => line.length > 0)
-      .map((gitDirectory) => gitDirectory.replace(/\/\.git$/, ''));
-
-    for (const repositoryDirectory of repositoryDirectories) {
-      const { stderr, exitCode } = await this.localCommandRunner.runCommand(
-        'git',
-        [
-          '-C',
-          repositoryDirectory,
-          'grep',
-          '-I',
-          '-i',
-          '-q',
-          '-F',
-          '-e',
-          product,
-        ],
-      );
-      if (exitCode === 0) {
-        return true;
-      }
-      if (exitCode !== 1) {
-        console.error(
-          `Failed to search ${repositoryDirectory} for ${product}: ${stderr}`,
-        );
-      }
-    }
-    return false;
-  };
 }

package/types/domain/usecases/DailySecurityScanUseCase.d.ts

@@ -10,9 +10,9 @@ export type DailySecurityScanConfig = {
 };
 export declare class DailySecurityScanUseCase {
     readonly localCommandRunner: LocalCommandRunner;
-    readonly issueRepository: Pick<IssueRepository, 'createNewIssue'>;
+    readonly issueRepository: Pick<IssueRepository, 'createNewIssue' | 'searchIssue' | 'createCommentByUrl'>;
     readonly httpRepository: HttpRepository;
-    constructor(localCommandRunner: LocalCommandRunner, issueRepository: Pick<IssueRepository, 'createNewIssue'>, httpRepository: HttpRepository);
+    constructor(localCommandRunner: LocalCommandRunner, issueRepository: Pick<IssueRepository, 'createNewIssue' | 'searchIssue' | 'createCommentByUrl'>, httpRepository: HttpRepository);
     run: (input: {
         targetDates: Date[];
         org: string;
@@ -21,6 +21,5 @@ export declare class DailySecurityScanUseCase {
     }) => Promise<void>;
     private scanRepositories;
     private reportKevAdditions;
-    private isProductPresentInScannedWorkspace;
 }
 //# sourceMappingURL=DailySecurityScanUseCase.d.ts.map

package/types/domain/usecases/DailySecurityScanUseCase.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DailySecurityScanUseCase.d.ts","sourceRoot":"","sources":["../../../src/domain/usecases/DailySecurityScanUseCase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,MAAM,MAAM,uBAAuB,GAAG;IACpC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AA0CF,qBAAa,wBAAwB;IAEjC,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB;IAC/C,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,gBAAgB,CAAC;IACjE,QAAQ,CAAC,cAAc,EAAE,cAAc;gBAF9B,kBAAkB,EAAE,kBAAkB,EACtC,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,gBAAgB,CAAC,EACxD,cAAc,EAAE,cAAc;IAGzC,GAAG,GAAU,OAAO;QAClB,WAAW,EAAE,IAAI,EAAE,CAAC;QACpB,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACxB,iBAAiB,EAAE,uBAAuB,CAAC;KAC5C,KAAG,OAAO,CAAC,IAAI,CAAC,CA0Bf;IAEF,OAAO,CAAC,gBAAgB,CAoEtB;IAEF,OAAO,CAAC,kBAAkB,CAqDxB;IAEF,OAAO,CAAC,kCAAkC,CAsCxC;CACH"}
+{"version":3,"file":"DailySecurityScanUseCase.d.ts","sourceRoot":"","sources":["../../../src/domain/usecases/DailySecurityScanUseCase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,MAAM,MAAM,uBAAuB,GAAG;IACpC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAkHF,qBAAa,wBAAwB;IAEjC,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB;IAC/C,QAAQ,CAAC,eAAe,EAAE,IAAI,CAC5B,eAAe,EACf,gBAAgB,GAAG,aAAa,GAAG,oBAAoB,CACxD;IACD,QAAQ,CAAC,cAAc,EAAE,cAAc;gBAL9B,kBAAkB,EAAE,kBAAkB,EACtC,eAAe,EAAE,IAAI,CAC5B,eAAe,EACf,gBAAgB,GAAG,aAAa,GAAG,oBAAoB,CACxD,EACQ,cAAc,EAAE,cAAc;IAGzC,GAAG,GAAU,OAAO;QAClB,WAAW,EAAE,IAAI,EAAE,CAAC;QACpB,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACxB,iBAAiB,EAAE,uBAAuB,CAAC;KAC5C,KAAG,OAAO,CAAC,IAAI,CAAC,CA2Bf;IAEF,OAAO,CAAC,gBAAgB,CA8GtB;IAEF,OAAO,CAAC,kBAAkB,CAwDxB;CACH"}