Set vulnerability as rejected for empty snyk records to suppress it in apiserver #1621
Conversation
Coverage summary from CodacySee diff coverage on Codacy
Coverage variation details
Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: Diff coverage details
Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: See your quality gate settings Change summary preferencesCodacy stopped sending the deprecated coverage status on June 5th, 2024. Learn more |
| // Setting vulnerability rejected timestamp for records with empty data, to suppress them in apiserver. | ||
| var bomToBeSuppressed = Bom.newBuilder() | ||
| .addVulnerabilities(Vulnerability.newBuilder() | ||
| .setRejected(Timestamp.newBuilder().setSeconds(Instant.now().getEpochSecond()).build()).build()); |
There was a problem hiding this comment.
Is this a safe assumption to make here? The comment above reads:
[...] there is no way for us to differentiate between "no vulnerabilities" and "unable to correlate".
Also, a vulnerability record without ID and source doesn't make sense to be rejected. My understanding was that Snyk still returned the ID, but no content for it. But this makes me think they don't return it at all anymore?
There was a problem hiding this comment.
No they don't send any data i.e. "data": []
| @@ -151,7 +151,9 @@ void testNoResults() throws Exception { | |||
| assertThat(outputRecord.getValue().getStatus()).isEqualTo(ScanStatus.SCAN_STATUS_SUCCESSFUL); | |||
| assertThat(outputRecord.getValue().hasFailureReason()).isFalse(); | |||
| assertThat(outputRecord.getValue().getScanner()).isEqualTo(Scanner.SCANNER_SNYK); | |||
| assertThat(outputRecord.getValue().getBom().getVulnerabilitiesCount()).isZero(); | |||
| assertThat(outputRecord.getValue().getBom().getVulnerabilitiesList()).satisfiesExactlyInAnyOrder( | |||
| vulnerability -> assertThat(vulnerability.getRejected()).isNotNull() | |||
There was a problem hiding this comment.
If there are legitimately no results, the rejection status doesn't make sense.
|
Closing PR, no changes needed at Hyades end. |
Description
When SNYK sends records with empty data, they need to be reported to apiserver so that such component vulnerabilities can be suppressed.
Addressed Issue
Closes #1620
Checklist