fix:[PLG-564] CS-Group CVEs based on app/product in violation info #2222
Conversation
fix:[PLG-560] Cherrypick - CS and R7 Admin policy severity and MoreInfo link
ershad-paladin
requested review from
plyubich,
santhosh-challa,
arunpaladin,
akashpaladin and
kevin-paladin
|
| @@ -52,7 +52,7 @@ public PolicyResult execute(final Map<String, String> policyParam, Map<String, S | |||
| try { | |||
| JsonArray severityList = PacmanUtils.getVulnerabilitiesArray(severityToCheck, instanceId, esIndexUrl); | |||
| if (severityList != null && !severityList.isEmpty()) { | |||
| String severityDetails = PacmanUtils.getCrowdstrikeVulnerabilitiesDetails(severityList); | |||
| String severityDetails = PacmanUtils.getVulnerabilitiesDetails(severityList); | |||
There was a problem hiding this comment.
the location of the file is still in crowdstrike package, needs to be generic
| public static final String PRODUCT_NAME_VERSION = "product_name_version"; | ||
| public static final String PRODUCT_NAME_NORMALIZED = "product_name_normalized"; |
There was a problem hiding this comment.
what are examples of these two values?
There was a problem hiding this comment.
"product_name_normalized": "linux-hwe-6.5",
"product_name_version": "linux-hwe-6.5 6.5.0-28.29~22.04.1"
"product_name_normalized": "Chrome Enterprise",
"product_name_version": "Chrome Enterprise"
There was a problem hiding this comment.
@ershad-paladin you should keep the old rule file as is.
Instead, please create a generic rule file similar to https://github.com/PaladinCloud/CE/blob/master/jobs/pacman-awsrules/src/main/java/com/tmobile/cloud/awsrules/ec2/AssetTypeGroupedVulnerabilitiesRule.java
The only difference between these generic policies is your function "getVulnerabilitiesDetails". In r7 example CVEs are grouped with a single asset entry, whereas in CS CVEs are flattened.
Please revert your previous changes and start by duplicating the above policy and adopting it to CS mapper. CS will the first to use this kind of policy pattern.
Lastly, please adopt your CS mapper to extract only the bare minimum fields that are used by the policy and UI.
|
@coderabbitai review |
Actions PerformedReview triggered.
|
WalkthroughThe recent changes focus on updating vulnerability processing methods and constants within the Pacman project. Key modifications include replacing specific methods for vulnerability details with a generalized method, adding new constants for product details, updating method calls in the Changes
Tip New Features and ImprovementsReview SettingsIntroduced new personality profiles for code reviews. Users can now select between "Chill" and "Assertive" review tones to tailor feedback styles according to their preferences. The "Assertive" profile posts more comments and nitpicks the code more aggressively, while the "Chill" profile is more relaxed and posts fewer comments. AST-based InstructionsCodeRabbit offers customizing reviews based on the Abstract Syntax Tree (AST) pattern matching. Read more about AST-based instructions in the documentation. Community-driven AST-based RulesWe are kicking off a community-driven initiative to create and share AST-based rules. Users can now contribute their AST-based rules to detect security vulnerabilities, code smells, and anti-patterns. Please see the ast-grep-essentials repository for more information. New Static Analysis ToolsWe are continually expanding our support for static analysis tools. We have added support for Tone SettingsUsers can now customize CodeRabbit to review code in the style of their favorite characters or personalities. Here are some of our favorite examples:
Revamped Settings PageWe have redesigned the settings page for a more intuitive layout, enabling users to find and adjust settings quickly. This change was long overdue; it not only improves the user experience but also allows our development team to add more settings in the future with ease. Going forward, the changes to Miscellaneous
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (invoked as PR comments)
Additionally, you can add CodeRabbit Configration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Outside diff range and nitpick comments (1)
jobs/pacman-awsrules/src/main/java/com/tmobile/cloud/awsrules/utils/PacmanUtils.java (1)
Line range hint
186-186: Use TLS version 1.2 for better security.- sc = SSLContext.getInstance("SSL"); + sc = SSLContext.getInstance("TLSv1.2");This change ensures the use of a more secure version of TLS, mitigating risks associated with older versions.
Review Details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (4)
- jobs/pacman-awsrules/src/main/java/com/tmobile/cloud/awsrules/utils/PacmanUtils.java (1 hunks)
- jobs/pacman-awsrules/src/main/java/com/tmobile/cloud/constants/PacmanRuleConstants.java (1 hunks)
- jobs/pacman-awsrules/src/main/java/com/tmobile/cloud/crowdstrike/VulnerabilityAssessmentPolicy.java (1 hunks)
- jobs/pacman-rule-engine-2.0/src/main/java/com/tmobile/pacman/executor/PolicyExecutor.java (1 hunks)
Files skipped from review due to trivial changes (1)
- jobs/pacman-awsrules/src/main/java/com/tmobile/cloud/constants/PacmanRuleConstants.java
Additional comments not posted (2)
jobs/pacman-awsrules/src/main/java/com/tmobile/cloud/crowdstrike/VulnerabilityAssessmentPolicy.java (1)
55-55: Change in method call aligns with PR objectives to generalize vulnerability handling.jobs/pacman-rule-engine-2.0/src/main/java/com/tmobile/pacman/executor/PolicyExecutor.java (1)
148-148: Added debug logging statement enhances visibility into policy evaluation process.
| public static String getVulnerabilitiesDetails(JsonArray vulnerabilities) { | ||
| ObjectMapper objectMapper = new ObjectMapper(); | ||
| Map<String, VulnerabilityInfo> productVulnerablilities = new HashMap<>(); | ||
| for (int i = 0; i < vulnerabilities.size(); i++) { | ||
| JsonObject source = vulnerabilities.get(i).getAsJsonObject().get(PacmanRuleConstants.SOURCE) | ||
| .getAsJsonObject(); | ||
| String cveId = source.get(CVE_ID).getAsString(); | ||
| String cveUrl = NIST_VULN_DETAILS_URL + cveId; | ||
| CveDetails cveDetails = new CveDetails(cveId, cveUrl); | ||
| for (JsonElement appElement : source.get("apps").getAsJsonArray()) { | ||
| JsonObject app = appElement.getAsJsonObject(); | ||
| String productName = String.valueOf(app.get(PRODUCT_NAME_VERSION).getAsString()); | ||
| if (productVulnerablilities.containsKey(productName)) { | ||
| productVulnerablilities.get(productName).getCveList().add(cveDetails); | ||
| } else { | ||
| VulnerabilityInfo vulnerabilityinfo = new VulnerabilityInfo(); | ||
| vulnerabilityinfo.setTitle(productName); | ||
| vulnerabilityinfo.setVulnerabilityUrl(source.get(PacmanSdkConstants.VULNERABILITY_URL).getAsString() + "'" + app.get(PRODUCT_NAME_NORMALIZED).getAsString() + "'"); | ||
| List<CveDetails> cveDetailsList = new ArrayList<>(); | ||
| cveDetailsList.add(cveDetails); | ||
| vulnerabilityinfo.setCveList(cveDetailsList); | ||
| productVulnerablilities.put(productName, vulnerabilityinfo); | ||
| } | ||
| } | ||
| } | ||
| ObjectMapper objectMapper = new ObjectMapper(); | ||
| try { | ||
| return objectMapper.writeValueAsString(vulnerabilityList); | ||
| return objectMapper.writeValueAsString(productVulnerablilities.values()); |
There was a problem hiding this comment.
Refactor method to improve maintainability and reduce complexity.
public static String getVulnerabilitiesDetails(JsonArray vulnerabilities) {
ObjectMapper objectMapper = new ObjectMapper();
Map<String, VulnerabilityInfo> productVulnerabilities = new HashMap<>();
vulnerabilities.forEach(vuln -> {
JsonObject source = vuln.getAsJsonObject().get(PacmanRuleConstants.SOURCE).getAsJsonObject();
String cveId = source.get(CVE_ID).getAsString();
String cveUrl = NIST_VULN_DETAILS_URL + cveId;
CveDetails cveDetails = new CveDetails(cveId, cveUrl);
source.get("apps").getAsJsonArray().forEach(appElement -> {
JsonObject app = appElement.getAsJsonObject();
String productName = app.get(PRODUCT_NAME_VERSION).getAsString();
productVulnerabilities.computeIfAbsent(productName, k -> new VulnerabilityInfo(productName, source.get(PacmanSdkConstants.VULNERABILITY_URL).getAsString() + "'" + app.get(PRODUCT_NAME_NORMALIZED).getAsString() + "'"))
.getCveList().add(cveDetails);
});
});
try {
return objectMapper.writeValueAsString(productVulnerabilities.values());
} catch (JsonProcessingException e) {
throw new RuleExecutionFailedExeption(e.getMessage());
}
}This refactoring uses Java 8 features to streamline the method, making it more readable and maintainable.
Description
Problem
Solution
Fixes # (issue if any)
Type of change
Please delete options that are not relevant.
How Has This Been Tested?
Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also
list any relevant details for your test configuration
Checklist:
Other Information:
List any documentation updates that are needed for the Wiki
Summary by CodeRabbit
New Features
Enhancements
Improvements
Refactor