Skip to content

Commit 456a531

Browse files
author
AI Assistant
committed
refactor: address review comments and rebase
1 parent 8ff383d commit 456a531

File tree

11 files changed

+112
-24
lines changed

11 files changed

+112
-24
lines changed

‎Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,10 @@ FROM eclipse-temurin:21-jre-jammy AS runtime
1919
USER root
2020
RUN apt-get update && apt-get install -y curl wget ca-certificates
2121
# Install Grype
22-
ARG GRYPE_VERSION=0.84.0
22+
ARG GRYPE_VERSION=0.104.0
2323
RUN curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin v${GRYPE_VERSION}
2424
# Install Trivy
25-
ARG TRIVY_VERSION=0.58.1
25+
ARG TRIVY_VERSION=0.67.2
2626
RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v${TRIVY_VERSION}
2727
# Install OSV Scanner - using install script
2828
RUN curl -L https://github.com/google/osv-scanner/releases/latest/download/osv-scanner_linux_amd64 -o /usr/local/bin/osv-scanner && chmod +x /usr/local/bin/osv-scanner || echo "OSV Scanner installation failed, continuing without it"

‎api/src/main/java/org/svip/api/controller/VulnerabilityController.java‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,46 +18,90 @@
1818

1919
@RestController
2020
@RequestMapping("/svip/vulnerabilities")
21+
/**
22+
* REST Controller for managing vulnerability data and alerts
23+
*/
2124
public class VulnerabilityController {
2225

2326
private final VulnerabilityHistoryService historyService;
2427
private final VulnerabilityAlertRepository alertRepository;
2528

29+
/**
30+
* Create a new VulnerabilityController
31+
*
32+
* @param historyService Service for vulnerability history
33+
* @param alertRepository Repository for vulnerability alerts
34+
*/
2635
public VulnerabilityController(VulnerabilityHistoryService historyService,
2736
VulnerabilityAlertRepository alertRepository) {
2837
this.historyService = historyService;
2938
this.alertRepository = alertRepository;
3039
}
3140

3241
// Historical Tracking APIs
42+
43+
/**
44+
* Get all projects with vulnerability history
45+
*
46+
* @return List of project names
47+
*/
3348
@GetMapping("/history/projects")
3449
public ResponseEntity<List<String>> getAllProjects() {
3550
return ResponseEntity.ok(historyService.getAllProjects());
3651
}
3752

53+
/**
54+
* Get vulnerability history for a project
55+
*
56+
* @param projectName Name of the project
57+
* @param days Number of days to retrieve
58+
* @return List of vulnerability history records
59+
*/
3860
@GetMapping("/history/{projectName}")
3961
public ResponseEntity<List<VulnerabilityHistory>> getHistory(
4062
@PathVariable String projectName,
4163
@RequestParam(defaultValue = "30") int days) {
4264
return ResponseEntity.ok(historyService.getTrend(projectName, days));
4365
}
4466

67+
/**
68+
* Get the latest vulnerability history for a project
69+
*
70+
* @param projectName Name of the project
71+
* @return Latest vulnerability history record
72+
*/
4573
@GetMapping("/history/{projectName}/latest")
4674
public ResponseEntity<VulnerabilityHistory> getLatest(@PathVariable String projectName) {
4775
return ResponseEntity.ok(historyService.getLatest(projectName));
4876
}
4977

5078
// Alert APIs
79+
80+
/**
81+
* Get all vulnerability alerts
82+
*
83+
* @return List of all vulnerability alerts
84+
*/
5185
@GetMapping("/alerts")
5286
public ResponseEntity<List<VulnerabilityAlert>> getAllAlerts() {
5387
return ResponseEntity.ok(alertRepository.findAllByOrderByCreatedAtDesc());
5488
}
5589

90+
/**
91+
* Get all unacknowledged vulnerability alerts
92+
*
93+
* @return List of unacknowledged vulnerability alerts
94+
*/
5695
@GetMapping("/alerts/unacknowledged")
5796
public ResponseEntity<List<VulnerabilityAlert>> getUnacknowledgedAlerts() {
5897
return ResponseEntity.ok(alertRepository.findByAcknowledgedFalseOrderByCreatedAtDesc());
5998
}
6099

100+
/**
101+
* Get statistics on vulnerability alerts
102+
*
103+
* @return Map of alert statistics
104+
*/
61105
@GetMapping("/alerts/stats")
62106
public ResponseEntity<Map<String, Long>> getAlertStats() {
63107
Map<String, Long> stats = new HashMap<>();
@@ -67,6 +111,13 @@ public ResponseEntity<Map<String, Long>> getAlertStats() {
67111
return ResponseEntity.ok(stats);
68112
}
69113

114+
/**
115+
* Acknowledge a vulnerability alert
116+
*
117+
* @param alertId ID of the alert to acknowledge
118+
* @param acknowledgedBy Name of the user acknowledging the alert
119+
* @return 200 OK if successful
120+
*/
70121
@PostMapping("/alerts/{alertId}/acknowledge")
71122
public ResponseEntity<Void> acknowledgeAlert(
72123
@PathVariable Long alertId,

‎api/src/main/java/org/svip/api/services/VulnerabilityScanService.java‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -401,6 +401,14 @@ else if (scanResult.has("Results") && scanResult.get("Results").isArray()) {
401401
}
402402
}
403403

404+
/**
405+
* Normalizes an SBOM for scanning by ensuring components have PURLs and CPEs
406+
* where possible, and adding properties for Syft compatibility.
407+
*
408+
* @param sbomContents The original SBOM JSON string
409+
* @param sbomFileName The name of the SBOM file
410+
* @return The normalized SBOM JSON string
411+
*/
404412
private String normalizeSbomForScanning(String sbomContents, String sbomFileName) {
405413
try {
406414
JsonNode root = objectMapper.readTree(sbomContents);
@@ -735,6 +743,13 @@ private String decodeUrl(String value) {
735743
}
736744
}
737745

746+
/**
747+
* Converts Grype's native JSON output format to CycloneDX vulnerabilities.
748+
*
749+
* @param grypeOutput The Grype JSON output
750+
* @param componentBomRefMap Mapping from component identifiers to bom-refs
751+
* @return List of CycloneDX vulnerability nodes
752+
*/
738753
private List<JsonNode> convertGrypeMatchesToCycloneDX(JsonNode grypeOutput, Map<String, String> componentBomRefMap) {
739754
List<JsonNode> vulnerabilities = new ArrayList<>();
740755

@@ -897,6 +912,13 @@ private void addCvssRating(ArrayNode ratingsArray, JsonNode cvss) {
897912
}
898913
}
899914

915+
/**
916+
* Converts Trivy's JSON output to CycloneDX vulnerabilities.
917+
*
918+
* @param trivyOutput The Trivy JSON output
919+
* @param componentBomRefMap Mapping from component identifiers to bom-refs
920+
* @return List of CycloneDX vulnerability nodes
921+
*/
900922
private List<JsonNode> convertTrivyResultsToCycloneDX(JsonNode trivyOutput, Map<String, String> componentBomRefMap) {
901923
List<JsonNode> vulnerabilities = new ArrayList<>();
902924

‎backend-rebase.sh‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/bin/bash
2+
git checkout -B dev origin/dev && git pull
3+
git checkout -B feat/descriptive-sbom-filenames origin/feat/descriptive-sbom-filenames
4+
5+
git reset --hard HEAD~1 && git rebase -X ours dev
6+
git checkout -B feature/vulnerability-scanning-integration origin/feature/vulnerability-scanning-integration
7+
git rebase -X ours feat/descriptive-sbom-filenames
8+
echo "done"
9+
exit 0

‎compose.dev.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ services:
1515
ports:
1616
- "5000:5000"
1717
healthcheck:
18-
test: ["CMD-SHELL", "python3 -c \"import urllib.request,sys; urllib.request.urlopen('http://localhost:5000/tools', timeout=5); sys.exit(0)\""]
18+
test: ["CMD", "curl", "-f", "http://localhost:5000/healthcheck"]
1919
start_period: 60s # allow validation to finish before first check
2020
interval: 20s
2121
timeout: 10s

‎compose.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ services:
1313
build: osi
1414
pull_policy: never # use local build
1515
healthcheck:
16-
test: ["CMD-SHELL", "python3 -c \"import urllib.request,sys; urllib.request.urlopen('http://localhost:5000/tools', timeout=5); sys.exit(0)\""]
16+
test: ["CMD", "curl", "-f", "http://localhost:5000/healthcheck"]
1717
start_period: 60s # allow validation to finish before first check
1818
interval: 20s
1919
timeout: 10s

‎core/src/main/java/org/svip/serializers/serializer/CDX14JSONSerializer.java‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,14 @@ public void setPrettyPrinting(boolean prettyPrint) {
108108
this.prettyPrint = prettyPrint;
109109
}
110110

111+
/**
112+
* Serializes an SBOM object to a JSON generator.
113+
*
114+
* @param sbom The SBOM to serialize
115+
* @param jsonGenerator The JSON generator
116+
* @param provider The serializer provider
117+
* @throws IOException If an error occurs during serialization
118+
*/
111119
@Override
112120
public void serialize(SVIPSBOM sbom, JsonGenerator jsonGenerator, SerializerProvider provider) throws IOException {
113121
jsonGenerator.writeStartObject();
@@ -449,6 +457,13 @@ private void writeExternalRefs(JsonGenerator jsonGenerator, Set<ExternalReferenc
449457
jsonGenerator.writeEndArray();
450458
}
451459

460+
/**
461+
* Writes a component to the JSON generator.
462+
*
463+
* @param jsonGenerator The JSON generator
464+
* @param component The component to write
465+
* @throws IOException If an error occurs during writing
466+
*/
452467
private void writeComponent(JsonGenerator jsonGenerator, SVIPComponentObject component) throws IOException {
453468
jsonGenerator.writeStartObject();
454469

‎osi/Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ RUN curl -L $GRADLE -o gradle.zip
2929
# Install anchore tooling on debian container
3030
FROM debian:bookworm-slim AS anchore_install
3131
ARG SYFT_VERSION=1.30.0
32-
ARG GRYPE_VERSION=0.84.0
32+
ARG GRYPE_VERSION=0.104.0
3333
WORKDIR /tmp
3434
RUN apt update && apt install curl -y
3535
RUN curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /tmp "v$SYFT_VERSION"
@@ -38,7 +38,7 @@ RUN curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh |
3838

3939
# Install vulnerability scanners
4040
FROM debian:bookworm-slim AS vuln_scanner_install
41-
ARG TRIVY_VERSION=0.58.1
41+
ARG TRIVY_VERSION=0.67.2
4242
ARG OSV_SCANNER_VERSION=1.9.2
4343
ARG DEPENDENCY_CHECK_VERSION=11.1.1
4444
WORKDIR /tmp

‎osi/osi/configs/tools/grype.yml‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,5 @@ profiles:
1111
- "All"
1212
commands:
1313
- "grype sbom:$SBOM_OUT/merged-sbom.json -o cyclonedx-json --file $SBOM_OUT/grype-vulns-cdx14.json"
14-
- schema: "cyclonedx"
15-
spec_version: "1.5"
16-
format: "json"
17-
languages:
18-
- "All"
19-
package_managers:
20-
- "All"
21-
commands:
22-
- "grype sbom:$SBOM_OUT/merged-sbom.json -o cyclonedx-json@1.5 --file $SBOM_OUT/grype-vulns-cdx15.json"
14+
2315

‎osi/osi/configs/tools/trivy.yml‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,5 @@ profiles:
1111
- "All"
1212
commands:
1313
- "trivy sbom --format cyclonedx --output $SBOM_OUT/trivy-vulns-cdx14.json $SBOM_OUT/merged-sbom.json"
14-
- schema: "cyclonedx"
15-
spec_version: "1.5"
16-
format: "json"
17-
languages:
18-
- "All"
19-
package_managers:
20-
- "All"
21-
commands:
22-
- "trivy sbom --format cyclonedx --scanners vuln --output $SBOM_OUT/trivy-vulns-cdx15.json $SBOM_OUT/merged-sbom.json"
14+
2315

0 commit comments

Comments
 (0)