Make vulnerabilities scanner less strict #669
Conversation
dnestoro
force-pushed
the
dnestoro/make-vulnerability-scanner-less-strict
branch
5 times, most recently
from
368d448 to
a389f25
Compare
dnestoro
requested review from
vjovanov,
matteoldani and
matneu
and removed request for
vjovanov
| return vulnerabilities.critical() > 0 || vulnerabilities.high() > 0; | ||
| } | ||
|
|
||
| public boolean isLessVulnerable(DockerImage other) { |
There was a problem hiding this comment.
I do agree that, in general, a critical vulnerability has more priority that any number of high ones. However, since we are not just comparing two different scenarios but doing an upgrade, how about introducing a sanity check that prevents us from introducing a container with 1 less critical and thousands more high-scored vulns without noticing it?
After all, if we decide on making such a tradeoff, we can always adapt the heuristic.
There was a problem hiding this comment.
I think the only solution that is correct in 100% cases is that we only accept a new image if it contains less critical and less high vulnerabilities. In all other combinations we can't determine programmatically if the image is acceptable candidate for update or not (we will still rely on a manual check of the image).
What do you think?
| if (numberOfHigh > 4 || numberOfCritical > 0) { | ||
| shouldFail = true; | ||
| // parse Grype output | ||
| ByteArrayInputStream inputStream = new ByteArrayInputStream(execOutput.toByteArray()); |
There was a problem hiding this comment.
The grype output is in json format. Can't we parse it using a json parse? It would make the vulns detection more reliable to output changes.
There was a problem hiding this comment.
I refactored that part ✔️
Please take a look again
dnestoro
force-pushed
the
dnestoro/make-vulnerability-scanner-less-strict
branch
from
a389f25 to
efa2077
Compare
What does this PR do?
Make vulnerabilities scanner less strict in order to accept slightly vulnerable images that are less vulnerable than the currently existing allowed images.
Fixes: #540