From f35a2ac1d044182b39dee74da16fbb4d7077776f Mon Sep 17 00:00:00 2001 From: Marlon Pina Tojal Date: Thu, 30 Nov 2023 09:53:57 +0100 Subject: [PATCH 1/4] trivy support Signed-off-by: Marlon Pina Tojal --- src/assets/img/trivy-logo.svg | 32 +++++++ src/i18n/locales/en.json | 2 + src/router/index.js | 11 +++ src/shared/common.js | 9 ++ src/views/administration/AdminMenu.vue | 5 + src/views/administration/Administration.vue | 3 +- .../analyzers/TrivyAnalyzer.vue | 92 +++++++++++++++++++ .../vulnerabilities/Vulnerability.vue | 2 + 8 files changed, 155 insertions(+), 1 deletion(-) create mode 100644 src/assets/img/trivy-logo.svg create mode 100644 src/views/administration/analyzers/TrivyAnalyzer.vue diff --git a/src/assets/img/trivy-logo.svg b/src/assets/img/trivy-logo.svg new file mode 100644 index 00000000..9ea7c643 --- /dev/null +++ b/src/assets/img/trivy-logo.svg @@ -0,0 +1,32 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/i18n/locales/en.json b/src/i18n/locales/en.json index c543d274..1f2149bb 100644 --- a/src/i18n/locales/en.json +++ b/src/i18n/locales/en.json @@ -546,6 +546,7 @@ "oss_index": "Sonatype OSS Index", "vulndb": "VulnDB", "snyk": "Snyk (Beta)", + "trivy": "Trivy", "vuln_sources": "Vulnerability Sources", "nvd": "NVD", "nvd_enable_mirroring_via_api": "Enable mirroring via API", @@ -631,6 +632,7 @@ "analyzer_snyk_how_to_api_version_help": "Where do I find available versions?", "analyzer_snyk_multiple_tokens_info": "Multiple tokens may be provided by separating them with semicolons, e.g. ", "analyzer_snyk_why_multiple_cvss": "Why are there multiple CVSS Scores for the same vulnerability?", + "analyzer_trivy_enable": "Enable Trivy analyzer", "vulnsource_alias_sync_enable": "Enable vulnerability alias synchronization", "vulnsource_alias_sync_enable_tooltip": "Alias data can help in identifying identical vulnerabilities across multiple databases. If the source provides this data, synchronize it with Dependency-Track's database.", "vulnsource_nvd_enable": "Enable National Vulnerability Database mirroring", diff --git a/src/router/index.js b/src/router/index.js index d1eacd33..eab59619 100644 --- a/src/router/index.js +++ b/src/router/index.js @@ -30,6 +30,7 @@ const InternalAnalyzer = () => import('@/views/administration/analyzers/Internal const OssIndexAnalyzer = () => import('@/views/administration/analyzers/OssIndexAnalyzer') const VulnDbAnalyzer = () => import('@/views/administration/analyzers/VulnDbAnalyzer') const SnykAnalyzer = () => import('@/views/administration/analyzers/SnykAnalyzer') +const TrivyAnalyzer = () => import('@/views/administration/analyzers/TrivyAnalyzer') const VulnSourceNvd = () => import('@/views/administration/vuln-sources/VulnSourceNvd') const VulnSourceGitHubAdvisories = () => import('@/views/administration/vuln-sources/VulnSourceGitHubAdvisories') @@ -348,6 +349,16 @@ function configRoutes() { permission: 'SYSTEM_CONFIGURATION' }, }, + { + path: 'analyzers/trivy', + component: TrivyAnalyzer, + meta: { + title: i18n.t('message.administration'), + i18n: 'message.administration', + sectionPath: '/admin', + permission: 'SYSTEM_CONFIGURATION' + }, + }, { path: 'vulnerabilitySources/nvd', alias: ['vulnerabilitySources'], diff --git a/src/shared/common.js b/src/shared/common.js index a6a29b08..1a247aa8 100644 --- a/src/shared/common.js +++ b/src/shared/common.js @@ -120,6 +120,8 @@ $common.formatAnalyzerLabel = function formatAnalyzerLabel(analyzer, vulnSource, analyzerUrl = "https://osv.dev/vulnerability/" + vulnId; } else if(vulnSource === "SNYK") { analyzerUrl = "https://security.snyk.io/vuln/" + vulnId; + } else if(vulnSource === "TRIVY") { + analyzerUrl = "https://avd.aquasec.com/nvd/" + vulnId; } break; case 'OSSINDEX_ANALYZER': @@ -134,6 +136,10 @@ $common.formatAnalyzerLabel = function formatAnalyzerLabel(analyzer, vulnSource, analyzerLabel = "Snyk"; analyzerUrl = "https://security.snyk.io/vuln/" + vulnId; break; + case 'TRIVY_ANALYZER': + analyzerLabel = "Trivy"; + analyzerUrl = "https://avd.aquasec.com/nvd/" + vulnId; + break; } if (analyzerUrl) { analyzerLabel = `${analyzerLabel} `; @@ -183,6 +189,9 @@ $common.resolveSourceVulnInfo = function resolveSourceVulnInfo(vulnSource, vulnI sourceInfo.name = "Global Security Database"; sourceInfo.url = "https://github.com/cloudsecurityalliance/gsd-database"; break; + case "TRIVY": + sourceInfo.name = "Trivy"; + sourceInfo.url = "https://avd.aquasec.com/nvd/" + vulnId; case "VULNDB": sourceInfo.name = "VulnDB"; sourceInfo.url = "https://vulndb.cyberriskanalytics.com/vulnerabilities/" + vulnId; diff --git a/src/views/administration/AdminMenu.vue b/src/views/administration/AdminMenu.vue index b9973395..6984c03b 100644 --- a/src/views/administration/AdminMenu.vue +++ b/src/views/administration/AdminMenu.vue @@ -109,6 +109,11 @@ import { ACCESS_MANAGEMENT, SYSTEM_CONFIGURATION } from "../../shared/permission component: "SnykAnalyzer", name: this.$t('admin.snyk'), route: "analyzers/snyk" + }, + { + component: "TrivyAnalyzer", + name: this.$t('admin.trivy'), + route: "analyzers/trivy" } ] }, diff --git a/src/views/administration/Administration.vue b/src/views/administration/Administration.vue index 52403f87..203765c8 100644 --- a/src/views/administration/Administration.vue +++ b/src/views/administration/Administration.vue @@ -30,6 +30,7 @@ import TaskScheduler from "./configuration/TaskScheduler.vue"; import InternalAnalyzer from "./analyzers/InternalAnalyzer"; import OssIndexAnalyzer from "./analyzers/OssIndexAnalyzer"; import SnykAnalyzer from "./analyzers/SnykAnalyzer"; +import TrivyAnalyzer from "./analyzers/TrivyAnalyzer"; import VulnDbAnalyzer from "./analyzers/VulnDbAnalyzer"; // Vulnerability sources import VulnSourceGitHubAdvisories from "./vuln-sources/VulnSourceGitHubAdvisories"; @@ -68,7 +69,7 @@ export default { EventBus, AdminMenu, General, BomFormats, Email, Jira, InternalComponents, TaskScheduler, Search, - InternalAnalyzer, OssIndexAnalyzer, VulnDbAnalyzer, SnykAnalyzer, + InternalAnalyzer, OssIndexAnalyzer, VulnDbAnalyzer, SnykAnalyzer, TrivyAnalyzer, VulnSourceNvd, VulnSourceGitHubAdvisories, VulnSourceOSVAdvisories, Cargo, Composer, Gem, GitHub, GoModules, Hex, Maven, Npm, Cpan, Nuget, Python, Alerts, Templates, diff --git a/src/views/administration/analyzers/TrivyAnalyzer.vue b/src/views/administration/analyzers/TrivyAnalyzer.vue new file mode 100644 index 00000000..084fb61c --- /dev/null +++ b/src/views/administration/analyzers/TrivyAnalyzer.vue @@ -0,0 +1,92 @@ + + + diff --git a/src/views/portfolio/vulnerabilities/Vulnerability.vue b/src/views/portfolio/vulnerabilities/Vulnerability.vue index 1a1d75c5..b8c43706 100644 --- a/src/views/portfolio/vulnerabilities/Vulnerability.vue +++ b/src/views/portfolio/vulnerabilities/Vulnerability.vue @@ -206,6 +206,8 @@ return "VulnDB (Risk Based Security)"; case 'SNYK': return "Snyk"; + case 'TRIVY': + return "Trivy"; default: return ""; } From 980111708fabb2e7bec5c616401378eb26d021d5 Mon Sep 17 00:00:00 2001 From: Marlon Pina Tojal Date: Sat, 2 Dec 2023 18:23:07 +0100 Subject: [PATCH 2/4] fix advisory link Signed-off-by: Marlon Pina Tojal --- src/shared/common.js | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/src/shared/common.js b/src/shared/common.js index 1a247aa8..a2fc0a2d 100644 --- a/src/shared/common.js +++ b/src/shared/common.js @@ -120,8 +120,6 @@ $common.formatAnalyzerLabel = function formatAnalyzerLabel(analyzer, vulnSource, analyzerUrl = "https://osv.dev/vulnerability/" + vulnId; } else if(vulnSource === "SNYK") { analyzerUrl = "https://security.snyk.io/vuln/" + vulnId; - } else if(vulnSource === "TRIVY") { - analyzerUrl = "https://avd.aquasec.com/nvd/" + vulnId; } break; case 'OSSINDEX_ANALYZER': @@ -138,7 +136,11 @@ $common.formatAnalyzerLabel = function formatAnalyzerLabel(analyzer, vulnSource, break; case 'TRIVY_ANALYZER': analyzerLabel = "Trivy"; + analyzerUrl = "https://avd.aquasec.com/nvd/" + vulnId; + if(vulnSource === "GITHUB") { + analyzerUrl = "https://github.com/advisories/" + vulnId; + } break; } if (analyzerUrl) { @@ -189,9 +191,6 @@ $common.resolveSourceVulnInfo = function resolveSourceVulnInfo(vulnSource, vulnI sourceInfo.name = "Global Security Database"; sourceInfo.url = "https://github.com/cloudsecurityalliance/gsd-database"; break; - case "TRIVY": - sourceInfo.name = "Trivy"; - sourceInfo.url = "https://avd.aquasec.com/nvd/" + vulnId; case "VULNDB": sourceInfo.name = "VulnDB"; sourceInfo.url = "https://vulndb.cyberriskanalytics.com/vulnerabilities/" + vulnId; From 9236df13fcde723d196fccd6651aca7f21278a8e Mon Sep 17 00:00:00 2001 From: Marlon Pina Tojal Date: Mon, 1 Jan 2024 21:24:03 +0100 Subject: [PATCH 3/4] change url for nist vulnerabilities Signed-off-by: Marlon Pina Tojal --- src/shared/common.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/shared/common.js b/src/shared/common.js index a2fc0a2d..5aa3348c 100644 --- a/src/shared/common.js +++ b/src/shared/common.js @@ -137,7 +137,7 @@ $common.formatAnalyzerLabel = function formatAnalyzerLabel(analyzer, vulnSource, case 'TRIVY_ANALYZER': analyzerLabel = "Trivy"; - analyzerUrl = "https://avd.aquasec.com/nvd/" + vulnId; + analyzerUrl = "https://nvd.nist.gov/vuln/detail/" + vulnId; if(vulnSource === "GITHUB") { analyzerUrl = "https://github.com/advisories/" + vulnId; } From 75874ef2daaf817d3bfb344eab0981779fb5f0fd Mon Sep 17 00:00:00 2001 From: Marlon Pina Tojal Date: Mon, 1 Jan 2024 22:03:05 +0100 Subject: [PATCH 4/4] add support for trivy configuration ignore unfixed Signed-off-by: Marlon Pina Tojal --- src/i18n/locales/en.json | 1 + src/views/administration/analyzers/TrivyAnalyzer.vue | 12 ++++++++++++ 2 files changed, 13 insertions(+) diff --git a/src/i18n/locales/en.json b/src/i18n/locales/en.json index 1f2149bb..76846229 100644 --- a/src/i18n/locales/en.json +++ b/src/i18n/locales/en.json @@ -633,6 +633,7 @@ "analyzer_snyk_multiple_tokens_info": "Multiple tokens may be provided by separating them with semicolons, e.g. ", "analyzer_snyk_why_multiple_cvss": "Why are there multiple CVSS Scores for the same vulnerability?", "analyzer_trivy_enable": "Enable Trivy analyzer", + "analyzer_trivy_ignore_unfixed": "Ignores vulnerabilities that were not fixed", "vulnsource_alias_sync_enable": "Enable vulnerability alias synchronization", "vulnsource_alias_sync_enable_tooltip": "Alias data can help in identifying identical vulnerabilities across multiple databases. If the source provides this data, synchronize it with Dependency-Track's database.", "vulnsource_nvd_enable": "Enable National Vulnerability Database mirroring", diff --git a/src/views/administration/analyzers/TrivyAnalyzer.vue b/src/views/administration/analyzers/TrivyAnalyzer.vue index 084fb61c..f6b488c8 100644 --- a/src/views/administration/analyzers/TrivyAnalyzer.vue +++ b/src/views/administration/analyzers/TrivyAnalyzer.vue @@ -29,6 +29,14 @@ v-model="apitoken" lazy="true" /> + + {{$t('admin.analyzer_trivy_ignore_unfixed')}}