owasp-depscan 5.1.2__py3-none-any.whl → 5.1.4__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.

This version of owasp-depscan might be problematic. Click here for more details.

Files changed (9) hide show
  1. depscan/cli.py +1 -0
  2. depscan/lib/logger.py +8 -3
  3. depscan/lib/normalize.py +4 -5
  4. {owasp_depscan-5.1.2.dist-info → owasp_depscan-5.1.4.dist-info}/METADATA +33 -2
  5. {owasp_depscan-5.1.2.dist-info → owasp_depscan-5.1.4.dist-info}/RECORD +9 -9
  6. {owasp_depscan-5.1.2.dist-info → owasp_depscan-5.1.4.dist-info}/LICENSE +0 -0
  7. {owasp_depscan-5.1.2.dist-info → owasp_depscan-5.1.4.dist-info}/WHEEL +0 -0
  8. {owasp_depscan-5.1.2.dist-info → owasp_depscan-5.1.4.dist-info}/entry_points.txt +0 -0
  9. {owasp_depscan-5.1.2.dist-info → owasp_depscan-5.1.4.dist-info}/top_level.txt +0 -0
depscan/cli.py CHANGED
@@ -536,6 +536,7 @@ def download_rafs_based_image():
536
536
  nydus_download_command,
537
537
  check=True,
538
538
  stdout=subprocess.DEVNULL,
539
+ stderr=subprocess.DEVNULL,
539
540
  )
540
541
  if os.path.exists(os.path.join(data_dir, "vdb.tar")):
541
542
  rafs_image_downloaded = True
depscan/lib/logger.py CHANGED
@@ -57,11 +57,16 @@ logging.basicConfig(
57
57
  ],
58
58
  )
59
59
  LOG = logging.getLogger(__name__)
60
- for _ in ("httpx", "oras"):
61
- logging.getLogger(_).disabled = True
62
60
 
63
61
  # Set logging level
64
- if os.getenv("SCAN_DEBUG_MODE") == "debug" or os.getenv("AT_DEBUG_MODE") == "debug":
62
+ if (
63
+ os.getenv("SCAN_DEBUG_MODE") == "debug"
64
+ or os.getenv("AT_DEBUG_MODE") == "debug"
65
+ ):
65
66
  LOG.setLevel(logging.DEBUG)
66
67
 
67
68
  DEBUG = logging.DEBUG
69
+
70
+ for log_name, log_obj in logging.Logger.manager.loggerDict.items():
71
+ if log_name != __name__:
72
+ log_obj.disabled = True
depscan/lib/normalize.py CHANGED
@@ -54,11 +54,10 @@ def create_pkg_variations(pkg_dict):
54
54
  if purl_obj:
55
55
  pkg_type = purl_obj.get("type")
56
56
  qualifiers = purl_obj.get("qualifiers", {})
57
- namespace = purl_obj.get("namespace")
58
- # npm is known for packages with no group
59
- # To reduce false positives we retain such empty groups here
60
- if pkg_type in ("npm",) and namespace is None:
61
- vendor_aliases.add("")
57
+ # npm is resulting in false positives
58
+ # Let's disable aliasing for now. See #194, #195, #196
59
+ if pkg_type in ("npm",):
60
+ return pkg_list
62
61
  if qualifiers and qualifiers.get("distro_name"):
63
62
  os_distro_name = qualifiers.get("distro_name")
64
63
  name_aliases.add(f"""{os_distro_name}/{name}""")
{owasp_depscan-5.1.2.dist-info → owasp_depscan-5.1.4.dist-info}/METADATA RENAMED
@@ -1,6 +1,6 @@
1
1
  Metadata-Version: 2.1
2
2
  Name: owasp-depscan
3
- Version: 5.1.2
3
+ Version: 5.1.4
4
4
  Summary: Fully open-source security audit for project dependencies based on known vulnerabilities and advisories.
5
5
  Author-email: Team AppThreat <cloud@appthreat.com>
6
6
  License: MIT
@@ -20,7 +20,7 @@ Classifier: Topic :: Utilities
20
20
  Requires-Python: >=3.8
21
21
  Description-Content-Type: text/markdown
22
22
  License-File: LICENSE
23
- Requires-Dist: appthreat-vulnerability-db >=5.5.6
23
+ Requires-Dist: appthreat-vulnerability-db >=5.5.7
24
24
  Requires-Dist: defusedxml
25
25
  Requires-Dist: oras
26
26
  Requires-Dist: PyYAML
@@ -46,6 +46,37 @@ OWASP dep-scan is a next-generation security and risk audit tool based on known
46
46
  [![release](https://github.com/owasp-dep-scan/dep-scan/actions/workflows/pythonpublish.yml/badge.svg)](https://github.com/owasp-dep-scan/dep-scan/actions/workflows/pythonpublish.yml)
47
47
  [![Discord](https://img.shields.io/badge/-Discord-lime?style=for-the-badge&logo=discord&logoColor=white&color=black)](https://discord.gg/pF4BYWEJcS)
48
48
 
49
+ ## Contents
50
+ - [Features](#features)
51
+ - [Vulnerability Data sources](#vulnerability-data-sources)
52
+ - [Linux distros](#linux-distros)
53
+ - [Usage](#usage)
54
+ - [OCI Artifacts via ORAS cli](#oci-artifacts-via-oras-cli)
55
+ - [Single binary executables](#single-binary-executables)
56
+ - [Server mode](#server-mode)
57
+ - [Scanning projects locally (Python version)](#scanning-projects-locally-python-version)
58
+ - [Scanning containers locally (Python version)](#scanning-containers-locally-python-version)
59
+ - [Scanning projects locally (Docker container)](#scanning-projects-locally-docker-container)
60
+ - [Supported languages and package format](#supported-languages-and-package-format)
61
+ - [Reachability analysis](#reachability-analysis)
62
+ - [Example analysis for a Java project](#example-analysis-for-a-java-project)
63
+ - [Example analysis for a JavaScript project](#example-analysis-for-a-javascript-project)
64
+ - [Customization through environment variables](#customization-through-environment-variables)
65
+ - [GitHub Security Advisory](#github-security-advisory)
66
+ - [Suggest mode](#suggest-mode)
67
+ - [Package Risk audit](#package-risk-audit)
68
+ - [Automatic adjustment](#automatic-adjustment)
69
+ - [Configuring weights](#configuring-weights)
70
+ - [Live OS scan](#live-os-scan)
71
+ - [License scan](#license-scan)
72
+ - [Kubernetes and Cloud apps](#kubernetes-and-cloud-apps)
73
+ - [PDF reports](#pdf-reports)
74
+ - [Custom reports](#custom-reports)
75
+ - [Performance tuning](#performance-tuning)
76
+ - [Use nydus to speed up the initial vdb download](#use-nydus-to-speed-up-the-initial-vdb-download)
77
+ - [Discord support](#discord-support)
78
+ - [License](#license)
79
+
49
80
  ## Features
50
81
 
51
82
  - Scan most application code - local repos, Linux container images, Kubernetes manifests, and OS - to identify known CVEs with prioritization
{owasp_depscan-5.1.2.dist-info → owasp_depscan-5.1.4.dist-info}/RECORD RENAMED
@@ -1,5 +1,5 @@
1
1
  depscan/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
2
- depscan/cli.py,sha256=2zLfxkcGL_3FbRHRS25rENmu1Ir_WmxZPPCLZ2O21TI,40511
2
+ depscan/cli.py,sha256=ZduD_INndyYC_Gte4aKV2jTQcEqKSM7YGe_SXhTANtA,40558
3
3
  depscan/lib/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
4
4
  depscan/lib/analysis.py,sha256=GdrQbZRorQcTf4_8lC5C11phbI1iIJUNx9FhqgF4agc,50988
5
5
  depscan/lib/audit.py,sha256=6GmHOkhDYY1LCIRd-wUSrSISh6_IFR5PhOopPJIQTeE,1318
@@ -9,8 +9,8 @@ depscan/lib/csaf.py,sha256=KzolHW_gkt8ZDn4n8sUlwb1d4G6vdvCu8h5wO4DNnJ4,91834
9
9
  depscan/lib/explainer.py,sha256=yRCEroeNCSj_bUQXqwUkLHV3l7eSJvTYoms9T1CDgGk,9282
10
10
  depscan/lib/github.py,sha256=h6e_12xLwspXJbt_7lW6vuHaqgJQgyFSRCLrfUndCH4,1697
11
11
  depscan/lib/license.py,sha256=y4-WZuD2MOunKaLd2EJGcSYP6s3Lp_dgssdzhcl9eEM,2332
12
- depscan/lib/logger.py,sha256=UKsx_sKuSvkoR7Co4WwUzWe56Aidv0cNFQJM7lXU018,1576
13
- depscan/lib/normalize.py,sha256=LRVjbqXfyLakbSfyHvjBSuX7g23u9MfukJmu2otvi1Y,10736
12
+ depscan/lib/logger.py,sha256=SOXvhlhNkBgIdzpXK7bisgniI5YtGnOWgREXS5vuKw4,1649
13
+ depscan/lib/normalize.py,sha256=iZZylivfc15lQo4_yU0d_8CWlOFUnAIa512PSH46yrQ,10643
14
14
  depscan/lib/pkg_query.py,sha256=Hlf3LypsL7EF309HevcfhdjAOPDZbN1XRQOmjQpnxlI,20082
15
15
  depscan/lib/utils.py,sha256=fAG6eTRqEvmmbPOsMBdgQzaKo4KWAYdijRgn-_MX6t8,14428
16
16
  vendor/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -63,9 +63,9 @@ vendor/choosealicense.com/_licenses/vim.txt,sha256=d5GQjXB328L8EBkhKgxcjk344D3K7
63
63
  vendor/choosealicense.com/_licenses/wtfpl.txt,sha256=BxXeubkvQm32MDmlZsBcbzJzBpR5kWgw0JxSR9d7f3k,948
64
64
  vendor/choosealicense.com/_licenses/zlib.txt,sha256=e6dfCeLhxD3NCnIkY4cVIagRaWdRvencjNhHZ1APvpc,1678
65
65
  vendor/spdx/json/licenses.json,sha256=_Vz_aACEg-giVk08ZBQLqB5Z3AnSWZmdD9I22ID3QNs,275192
66
- owasp_depscan-5.1.2.dist-info/LICENSE,sha256=oQnCbnZtJ_NLDdOLc-rVY1D1N0RNWLHPpYXcc77xzSo,1073
67
- owasp_depscan-5.1.2.dist-info/METADATA,sha256=dekkyDni671pV0rjKppOjMXT7LJXs4O9jWvIhRLqmWc,25287
68
- owasp_depscan-5.1.2.dist-info/WHEEL,sha256=oiQVh_5PnQM0E3gPdiz09WCNmwiHDMaGer_elqB3coM,92
69
- owasp_depscan-5.1.2.dist-info/entry_points.txt,sha256=FxQKHFWZTfKU2eBxHPFRxwhSNexntYygYhquykS8zxA,69
70
- owasp_depscan-5.1.2.dist-info/top_level.txt,sha256=qbHOZvNU2dXANv946hMdP2vOi0ESQB5t2ZY5ktKtXvQ,15
71
- owasp_depscan-5.1.2.dist-info/RECORD,,
66
+ owasp_depscan-5.1.4.dist-info/LICENSE,sha256=oQnCbnZtJ_NLDdOLc-rVY1D1N0RNWLHPpYXcc77xzSo,1073
67
+ owasp_depscan-5.1.4.dist-info/METADATA,sha256=fkt5Pgvpz3_3hjWZiXjhwKioYCFEvELw0n6ScOvhKS4,26928
68
+ owasp_depscan-5.1.4.dist-info/WHEEL,sha256=oiQVh_5PnQM0E3gPdiz09WCNmwiHDMaGer_elqB3coM,92
69
+ owasp_depscan-5.1.4.dist-info/entry_points.txt,sha256=FxQKHFWZTfKU2eBxHPFRxwhSNexntYygYhquykS8zxA,69
70
+ owasp_depscan-5.1.4.dist-info/top_level.txt,sha256=qbHOZvNU2dXANv946hMdP2vOi0ESQB5t2ZY5ktKtXvQ,15
71
+ owasp_depscan-5.1.4.dist-info/RECORD,,