Class: Homebrew::Vulns::Scanner Private

Inherits:
Object
  • Object
show all
Defined in:
vulns/scanner.rb

This class is part of a private API. This class may only be used in the Homebrew/brew repository. Third parties should avoid using this class if possible, as it may be removed or changed without warning.

Defined Under Namespace

Classes: Finding, Results

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(formulae, ignore_patches: true, min_severity: nil, fix_type: nil) ⇒ void

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

  • formulae (Array<Formula>)
  • ignore_patches (Boolean) (defaults to: true)
  • min_severity (Symbol, nil) (defaults to: nil)
  • fix_type (Symbol, nil) (defaults to: nil) 


103
104
105
106
107
108
 
# File 'vulns/scanner.rb', line 103

def initialize(formulae, ignore_patches: true, min_severity: nil, fix_type: nil)
  @formulae = formulae
  @ignore_patches = ignore_patches
  @min_severity_level = T.let(min_severity ? SEVERITY_LEVELS.fetch(min_severity) : 0, Integer)
  @fix_type = fix_type
end

Class Method Details

.resolved_ids(serialized_patches) ⇒ Array<String>

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



47
48
49
50
51
52
53
 
# File 'vulns/scanner.rb', line 47

def self.resolved_ids(serialized_patches)
  serialized_patches
    .flat_map { |p| Array(p["resolves"]) }
    .select { |r| r.is_a?(Hash) && r["type"] == "security" }
    .map { |r| r["id"].to_s.upcase }
    .uniq
end

.source_from_sbom(prefix) ⇒ Array<([String, nil], [String, nil])>?

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
 
# File 'vulns/scanner.rb', line 27

def self.source_from_sbom(prefix)
  file = prefix/SBOM::FILENAME
  return unless file.file?

  data = JSON.parse(file.read)
  src = Array(data["packages"]).find { |p| p["SPDXID"].to_s.match?(SBOM_SRC_SPDXID) }
  return if src.nil?

  url = src["downloadLocation"]
  url = nil if url == "NOASSERTION"
  version = src["versionInfo"]
  version = nil if version == "NOASSERTION"
  return if url.nil? && version.nil?

  [url, version]
rescue JSON::ParserError
  nil
end

.target_repo_url(source_url, head_url, homepage) ⇒ String?

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



16
17
18
19
20
21
 
# File 'vulns/scanner.rb', line 16

def self.target_repo_url(source_url, head_url, homepage)
  url = Identify.repo_url(source_url, head_url, homepage)
  url ||= source_url if Identify.tag(source_url)
  url ||= head_url
  url
end

Instance Method Details

#build_target(formula) ⇒ Target?

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:

  • (Target, nil) 


171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
 
# File 'vulns/scanner.rb', line 171

def build_target(formula)
  stable = formula.stable
  stable_url = stable&.url
  head_url = formula.head&.url
  homepage = formula.homepage

  stable_repo_url = self.class.target_repo_url(stable_url, head_url, homepage)
  stable_tag = Identify.tag(stable_url) || stable&.specs&.[](:tag) || stable&.version&.to_s

  if (prefix = formula.any_installed_prefix)
    installed_pkg_version = formula.any_installed_version
    installed_version = installed_pkg_version&.version.to_s
    current_recipe_applies = installed_pkg_version == formula.pkg_version

    if (sbom = self.class.source_from_sbom(prefix))
      sbom_url, sbom_version = sbom
      repo_url = self.class.target_repo_url(sbom_url, head_url, homepage)
      tag = Identify.tag(sbom_url) || sbom_version || installed_version.presence
      if repo_url && tag
        return Target.new(repo_url:, tag:, version: installed_version,
                          from_installed_sbom: true, current_recipe_applies:)
      end
    end

    return if stable_repo_url.nil? || stable_tag.nil?

    return Target.new(repo_url: stable_repo_url, tag: stable_tag, version: installed_version,
                      from_installed_sbom: false, current_recipe_applies:)
  end

  return if stable_repo_url.nil? || stable_tag.nil?

  Target.new(repo_url: stable_repo_url, tag: stable_tag, version: formula.version.to_s,
             from_installed_sbom: false, current_recipe_applies: true)
end

#fetch_vulnerabilities(ids) ⇒ Array<Vulnerability>

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



216
217
218
219
220
221
222
223
 
# File 'vulns/scanner.rb', line 216

def fetch_vulnerabilities(ids)
  records = ids.each_slice(MAX_VULN_FETCH_THREADS).flat_map do |slice|
    slice
      .map { |v| Thread.new { OSV.vulnerability(v.fetch("id")) } }
      .map { |t| T.cast(t.value, T::Hash[String, T.untyped]) }
  end
  Vulnerability.from_osv_list(records)
end

#partition_patched(formula, target, vulns) ⇒ Array<(Array<Vulnerability>, Array<Vulnerability>)>

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
 
# File 'vulns/scanner.rb', line 229

def partition_patched(formula, target, vulns)
  return [vulns, []] unless @ignore_patches
  # The current formula's `serialized_patches` reflects the recipe on
  # disk. If the scanned keg was built from an older recipe it may lack a
  # patch the recipe has since gained, so its `resolves` must not
  # suppress findings.
  return [vulns, []] unless target.current_recipe_applies

  resolved = self.class.resolved_ids(formula.serialized_patches)
  return [vulns, []] if resolved.empty?

  patched, open = vulns.partition do |v|
    v.identifiers.any? { |id| resolved.include?(id.to_s.upcase) }
  end
  [open, patched]
end

#scan ⇒ Results

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
 
# File 'vulns/scanner.rb', line 115

def scan
  queryable, skipped_formulae = @formulae.partition { |f| target_for(f) }
  skipped_formulae = skipped_formulae.map(&:full_name)
  outdated_without_sbom = queryable.select { |f| stale_target?(f) }.map(&:name)
  return Results.new(findings: [], checked: 0, skipped_formulae:, outdated_without_sbom:) if queryable.empty?

  targets = queryable.map { |f| T.must(target_for(f)) }
  batch = OSV.query_batch(targets.map { |t| { ecosystem: "GIT", name: t.repo_url, version: t.tag } })

  findings = queryable.each_with_index.filter_map do |formula, index|
    target = targets.fetch(index)
    ids = batch.fetch(index)
    next if ids.empty?

    vulns = fetch_vulnerabilities(ids)
            .select { |v| v.affects_version?(target.tag) }
            .select { |v| v.severity_level >= @min_severity_level }
    case @fix_type
    when :released
      vulns = vulns.select { |v| v.released_fix_available?(target.tag, target.repo_url) }
    when :patch
      vulns = vulns.select { |v| v.patch_fix_available?(target.tag, target.repo_url) }
    when :any
      vulns = vulns.select { |v| v.fix_available?(target.tag, target.repo_url) }
    when :none
      vulns = vulns.reject { |v| v.fix_available?(target.tag, target.repo_url) }
    when :unreleased
      vulns = vulns.reject { |v| v.released_fix_available?(target.tag, target.repo_url) }
    end
    next if vulns.empty?

    open, patched = partition_patched(formula, target, vulns)
    next if open.empty? && patched.empty?

    Finding.new(
      name:     formula.name,
      version:  target.version,
      tag:      target.tag,
      repo_url: target.repo_url,
      open:,
      patched:,
    )
  end

  Results.new(findings:, checked: queryable.size, skipped_formulae:, outdated_without_sbom:)
end

#stale_target?(formula) ⇒ Boolean

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:

  • (Boolean) 


208
209
210
211
212
213
 
# File 'vulns/scanner.rb', line 208

def stale_target?(formula)
  target = target_for(formula)
  return false if target.nil? || target.from_installed_sbom

  !target.current_recipe_applies
end

#target_for(formula) ⇒ Target?

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:

  • (Target, nil) 


163
164
165
166
167
168
 
# File 'vulns/scanner.rb', line 163

def target_for(formula)
  @targets ||= T.let({}, T.nilable(T::Hash[String, T.nilable(Target)]))
  @targets.fetch(formula.full_name) do
    @targets[formula.full_name] = build_target(formula)
  end
end