Class: Homebrew::Vulns::Scanner Private

Inherits:
Object
  • Object
show all
Defined in:
vulns/scanner.rb

This class is part of a private API. This class may only be used in the Homebrew/brew repository. Third parties should avoid using this class if possible, as it may be removed or changed without warning.

Defined Under Namespace

Classes: Finding, Results

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(formulae, ignore_patches: true, min_severity: nil) ⇒ void

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

  • formulae (Array<Formula>)
  • ignore_patches (Boolean) (defaults to: true)
  • min_severity (Symbol, nil) (defaults to: nil) 


96
97
98
99
100
 
# File 'vulns/scanner.rb', line 96

def initialize(formulae, ignore_patches: true, min_severity: nil)
  @formulae = formulae
  @ignore_patches = ignore_patches
  @min_severity_level = T.let(min_severity ? SEVERITY_LEVELS.fetch(min_severity) : 0, Integer)
end

Class Method Details

.resolved_ids(serialized_patches) ⇒ Array<String>

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



47
48
49
50
51
52
53
 
# File 'vulns/scanner.rb', line 47

def self.resolved_ids(serialized_patches)
  serialized_patches
    .flat_map { |p| Array(p["resolves"]) }
    .select { |r| r.is_a?(Hash) && r["type"] == "security" }
    .map { |r| r["id"].to_s.upcase }
    .uniq
end

.source_from_sbom(prefix) ⇒ Array<([String, nil], [String, nil])>?

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
 
# File 'vulns/scanner.rb', line 27

def self.source_from_sbom(prefix)
  file = prefix/SBOM::FILENAME
  return unless file.file?

  data = JSON.parse(file.read)
  src = Array(data["packages"]).find { |p| p["SPDXID"].to_s.match?(SBOM_SRC_SPDXID) }
  return if src.nil?

  url = src["downloadLocation"]
  url = nil if url == "NOASSERTION"
  version = src["versionInfo"]
  version = nil if version == "NOASSERTION"
  return if url.nil? && version.nil?

  [url, version]
rescue JSON::ParserError
  nil
end

.target_repo_url(source_url, head_url, homepage) ⇒ String?

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



16
17
18
19
20
21
 
# File 'vulns/scanner.rb', line 16

def self.target_repo_url(source_url, head_url, homepage)
  url = Identify.repo_url(source_url, head_url, homepage)
  url ||= source_url if Identify.tag(source_url)
  url ||= head_url
  url
end

Instance Method Details

#build_target(formula) ⇒ Target?

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:

  • (Target, nil) 


152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
 
# File 'vulns/scanner.rb', line 152

def build_target(formula)
  stable = formula.stable
  stable_url = stable&.url
  head_url = formula.head&.url
  homepage = formula.homepage

  stable_repo_url = self.class.target_repo_url(stable_url, head_url, homepage)
  stable_tag = Identify.tag(stable_url) || stable&.specs&.[](:tag) || stable&.version&.to_s

  if (prefix = formula.any_installed_prefix)
    installed_pkg_version = formula.any_installed_version
    installed_version = installed_pkg_version&.version.to_s
    current_recipe_applies = installed_pkg_version == formula.pkg_version

    if (sbom = self.class.source_from_sbom(prefix))
      sbom_url, sbom_version = sbom
      repo_url = self.class.target_repo_url(sbom_url, head_url, homepage)
      tag = Identify.tag(sbom_url) || sbom_version || installed_version.presence
      if repo_url && tag
        return Target.new(repo_url:, tag:, version: installed_version,
                          from_installed_sbom: true, current_recipe_applies:)
      end
    end

    return if stable_repo_url.nil? || stable_tag.nil?

    return Target.new(repo_url: stable_repo_url, tag: stable_tag, version: installed_version,
                      from_installed_sbom: false, current_recipe_applies:)
  end

  return if stable_repo_url.nil? || stable_tag.nil?

  Target.new(repo_url: stable_repo_url, tag: stable_tag, version: formula.version.to_s,
             from_installed_sbom: false, current_recipe_applies: true)
end

#fetch_vulnerabilities(ids) ⇒ Array<Vulnerability>

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



197
198
199
200
201
202
203
204
 
# File 'vulns/scanner.rb', line 197

def fetch_vulnerabilities(ids)
  records = ids.each_slice(MAX_VULN_FETCH_THREADS).flat_map do |slice|
    slice
      .map { |v| Thread.new { OSV.vulnerability(v.fetch("id")) } }
      .map { |t| T.cast(t.value, T::Hash[String, T.untyped]) }
  end
  Vulnerability.from_osv_list(records)
end

#partition_patched(formula, target, vulns) ⇒ Array<(Array<Vulnerability>, Array<Vulnerability>)>

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
 
# File 'vulns/scanner.rb', line 210

def partition_patched(formula, target, vulns)
  return [vulns, []] unless @ignore_patches
  # The current formula's `serialized_patches` reflects the recipe on
  # disk. If the scanned keg was built from an older recipe it may lack a
  # patch the recipe has since gained, so its `resolves` must not
  # suppress findings.
  return [vulns, []] unless target.current_recipe_applies

  resolved = self.class.resolved_ids(formula.serialized_patches)
  return [vulns, []] if resolved.empty?

  patched, open = vulns.partition do |v|
    v.identifiers.any? { |id| resolved.include?(id.to_s.upcase) }
  end
  [open, patched]
end

#scan ⇒ Results

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
 
# File 'vulns/scanner.rb', line 107

def scan
  queryable, skipped = @formulae.partition { |f| target_for(f) }
  outdated_without_sbom = queryable.select { |f| stale_target?(f) }.map(&:name)
  if queryable.empty?
    return Results.new(findings: [], checked: 0, skipped: skipped.size, outdated_without_sbom:)
  end

  targets = queryable.map { |f| T.must(target_for(f)) }
  batch = OSV.query_batch(targets.map { |t| { ecosystem: "GIT", name: t.repo_url, version: t.tag } })

  findings = queryable.each_with_index.filter_map do |formula, index|
    target = targets.fetch(index)
    ids = batch.fetch(index)
    next if ids.empty?

    vulns = fetch_vulnerabilities(ids)
            .select { |v| v.affects_version?(target.tag) }
            .select { |v| v.severity_level >= @min_severity_level }
    next if vulns.empty?

    open, patched = partition_patched(formula, target, vulns)
    next if open.empty? && patched.empty?

    Finding.new(
      name:     formula.name,
      version:  target.version,
      tag:      target.tag,
      repo_url: target.repo_url,
      open:,
      patched:,
    )
  end

  Results.new(findings:, checked: queryable.size, skipped: skipped.size, outdated_without_sbom:)
end

#stale_target?(formula) ⇒ Boolean

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:

  • (Boolean) 


189
190
191
192
193
194
 
# File 'vulns/scanner.rb', line 189

def stale_target?(formula)
  target = target_for(formula)
  return false if target.nil? || target.from_installed_sbom

  !target.current_recipe_applies
end

#target_for(formula) ⇒ Target?

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:

  • (Target, nil) 


144
145
146
147
148
149
 
# File 'vulns/scanner.rb', line 144

def target_for(formula)
  @targets ||= T.let({}, T.nilable(T::Hash[String, T.nilable(Target)]))
  @targets.fetch(formula.full_name) do
    @targets[formula.full_name] = build_target(formula)
  end
end