Class: Homebrew::Vulns::Scanner Private

Inherits:
Object
  • Object
show all
Defined in:
vulns/scanner.rb

This class is part of a private API. This class may only be used in the Homebrew/brew repository. Third parties should avoid using this class if possible, as it may be removed or changed without warning.

Defined Under Namespace

Classes: Finding, Results

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(formulae, ignore_patches: true, min_severity: nil, only_fixed: false, except_fixed: false) ⇒ void

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

  • formulae (Array<Formula>)
  • ignore_patches (Boolean) (defaults to: true)
  • min_severity (Symbol, nil) (defaults to: nil)
  • only_fixed (Boolean) (defaults to: false)
  • except_fixed (Boolean) (defaults to: false) 


97
98
99
100
101
102
103
 
# File 'vulns/scanner.rb', line 97

def initialize(formulae, ignore_patches: true, min_severity: nil, only_fixed: false, except_fixed: false)
  @formulae = formulae
  @ignore_patches = ignore_patches
  @min_severity_level = T.let(min_severity ? SEVERITY_LEVELS.fetch(min_severity) : 0, Integer)
  @only_fixed = only_fixed
  @except_fixed = except_fixed
end

Class Method Details

.resolved_ids(serialized_patches) ⇒ Array<String>

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



47
48
49
50
51
52
53
 
# File 'vulns/scanner.rb', line 47

def self.resolved_ids(serialized_patches)
  serialized_patches
    .flat_map { |p| Array(p["resolves"]) }
    .select { |r| r.is_a?(Hash) && r["type"] == "security" }
    .map { |r| r["id"].to_s.upcase }
    .uniq
end

.source_from_sbom(prefix) ⇒ Array<([String, nil], [String, nil])>?

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
 
# File 'vulns/scanner.rb', line 27

def self.source_from_sbom(prefix)
  file = prefix/SBOM::FILENAME
  return unless file.file?

  data = JSON.parse(file.read)
  src = Array(data["packages"]).find { |p| p["SPDXID"].to_s.match?(SBOM_SRC_SPDXID) }
  return if src.nil?

  url = src["downloadLocation"]
  url = nil if url == "NOASSERTION"
  version = src["versionInfo"]
  version = nil if version == "NOASSERTION"
  return if url.nil? && version.nil?

  [url, version]
rescue JSON::ParserError
  nil
end

.target_repo_url(source_url, head_url, homepage) ⇒ String?

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



16
17
18
19
20
21
 
# File 'vulns/scanner.rb', line 16

def self.target_repo_url(source_url, head_url, homepage)
  url = Identify.repo_url(source_url, head_url, homepage)
  url ||= source_url if Identify.tag(source_url)
  url ||= head_url
  url
end

Instance Method Details

#build_target(formula) ⇒ Target?

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:

  • (Target, nil) 


157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
 
# File 'vulns/scanner.rb', line 157

def build_target(formula)
  stable = formula.stable
  stable_url = stable&.url
  head_url = formula.head&.url
  homepage = formula.homepage

  stable_repo_url = self.class.target_repo_url(stable_url, head_url, homepage)
  stable_tag = Identify.tag(stable_url) || stable&.specs&.[](:tag) || stable&.version&.to_s

  if (prefix = formula.any_installed_prefix)
    installed_pkg_version = formula.any_installed_version
    installed_version = installed_pkg_version&.version.to_s
    current_recipe_applies = installed_pkg_version == formula.pkg_version

    if (sbom = self.class.source_from_sbom(prefix))
      sbom_url, sbom_version = sbom
      repo_url = self.class.target_repo_url(sbom_url, head_url, homepage)
      tag = Identify.tag(sbom_url) || sbom_version || installed_version.presence
      if repo_url && tag
        return Target.new(repo_url:, tag:, version: installed_version,
                          from_installed_sbom: true, current_recipe_applies:)
      end
    end

    return if stable_repo_url.nil? || stable_tag.nil?

    return Target.new(repo_url: stable_repo_url, tag: stable_tag, version: installed_version,
                      from_installed_sbom: false, current_recipe_applies:)
  end

  return if stable_repo_url.nil? || stable_tag.nil?

  Target.new(repo_url: stable_repo_url, tag: stable_tag, version: formula.version.to_s,
             from_installed_sbom: false, current_recipe_applies: true)
end

#fetch_vulnerabilities(ids) ⇒ Array<Vulnerability>

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



202
203
204
205
206
207
208
209
 
# File 'vulns/scanner.rb', line 202

def fetch_vulnerabilities(ids)
  records = ids.each_slice(MAX_VULN_FETCH_THREADS).flat_map do |slice|
    slice
      .map { |v| Thread.new { OSV.vulnerability(v.fetch("id")) } }
      .map { |t| T.cast(t.value, T::Hash[String, T.untyped]) }
  end
  Vulnerability.from_osv_list(records)
end

#partition_patched(formula, target, vulns) ⇒ Array<(Array<Vulnerability>, Array<Vulnerability>)>

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
 
# File 'vulns/scanner.rb', line 215

def partition_patched(formula, target, vulns)
  return [vulns, []] unless @ignore_patches
  # The current formula's `serialized_patches` reflects the recipe on
  # disk. If the scanned keg was built from an older recipe it may lack a
  # patch the recipe has since gained, so its `resolves` must not
  # suppress findings.
  return [vulns, []] unless target.current_recipe_applies

  resolved = self.class.resolved_ids(formula.serialized_patches)
  return [vulns, []] if resolved.empty?

  patched, open = vulns.partition do |v|
    v.identifiers.any? { |id| resolved.include?(id.to_s.upcase) }
  end
  [open, patched]
end

#scan ⇒ Results

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
 
# File 'vulns/scanner.rb', line 110

def scan
  queryable, skipped = @formulae.partition { |f| target_for(f) }
  outdated_without_sbom = queryable.select { |f| stale_target?(f) }.map(&:name)
  if queryable.empty?
    return Results.new(findings: [], checked: 0, skipped: skipped.size, outdated_without_sbom:)
  end

  targets = queryable.map { |f| T.must(target_for(f)) }
  batch = OSV.query_batch(targets.map { |t| { ecosystem: "GIT", name: t.repo_url, version: t.tag } })

  findings = queryable.each_with_index.filter_map do |formula, index|
    target = targets.fetch(index)
    ids = batch.fetch(index)
    next if ids.empty?

    vulns = fetch_vulnerabilities(ids)
            .select { |v| v.affects_version?(target.tag) }
            .select { |v| v.severity_level >= @min_severity_level }
    vulns = vulns.select { |v| v.fix_available?(target.tag, target.repo_url) } if @only_fixed
    vulns = vulns.reject { |v| v.fix_available?(target.tag, target.repo_url) } if @except_fixed
    next if vulns.empty?

    open, patched = partition_patched(formula, target, vulns)
    next if open.empty? && patched.empty?

    Finding.new(
      name:     formula.name,
      version:  target.version,
      tag:      target.tag,
      repo_url: target.repo_url,
      open:,
      patched:,
    )
  end

  Results.new(findings:, checked: queryable.size, skipped: skipped.size, outdated_without_sbom:)
end

#stale_target?(formula) ⇒ Boolean

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:

  • (Boolean) 


194
195
196
197
198
199
 
# File 'vulns/scanner.rb', line 194

def stale_target?(formula)
  target = target_for(formula)
  return false if target.nil? || target.from_installed_sbom

  !target.current_recipe_applies
end

#target_for(formula) ⇒ Target?

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:

  • (Target, nil) 


149
150
151
152
153
154
 
# File 'vulns/scanner.rb', line 149

def target_for(formula)
  @targets ||= T.let({}, T.nilable(T::Hash[String, T.nilable(Target)]))
  @targets.fetch(formula.full_name) do
    @targets[formula.full_name] = build_target(formula)
  end
end