upstream/harbor
1
0
Fork 0
mirror of https://github.com/goharbor/harbor synced 2025-04-21 17:51:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove validation for item in CVE whitelist

Browse Source 
To contain various vulnerabilities in the CVE whitelist, this commit
removes the validation.
Fixes #9242

Signed-off-by: Daniel Jiang <jiangd@vmware.com>
This commit is contained in:
Daniel Jiang 2019-10-17 00:54:37 +08:00
parent 8d65bd6da7
commit 1a9cebd5e8
3 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/core/api/sys_cve_whitelist_test.go
View File

@ -115,6 +115,7 @@ func TestSysCVEWhitelistAPIPut(t *testing.T) {
ExpiresAt: &s, ExpiresAt: &s,
Items: []models.CVEWhitelistItem{ Items: []models.CVEWhitelistItem{
{CVEID: "CVE-2019-12310"}, {CVEID: "CVE-2019-12310"},
{CVEID: "RHSA-2019:2237"},
}, },
}, },
credential: sysAdmin, credential: sysAdmin,

10
src/pkg/scan/whitelist/validator.go
View File

@ -17,7 +17,6 @@ package whitelist
import ( import (
"fmt" "fmt"
"github.com/goharbor/harbor/src/common/models" "github.com/goharbor/harbor/src/common/models"
"regexp"
) )
type invalidErr struct { type invalidErr struct {
@ -46,11 +45,12 @@ const cveIDPattern = `^CVE-\d{4}-\d+$`
// Validate help validates the CVE whitelist, to ensure the CVE ID is valid and there's no duplication // Validate help validates the CVE whitelist, to ensure the CVE ID is valid and there's no duplication
func Validate(wl models.CVEWhitelist) error { func Validate(wl models.CVEWhitelist) error {
m := map[string]struct{}{} m := map[string]struct{}{}
re := regexp.MustCompile(cveIDPattern) // re := regexp.MustCompile(cveIDPattern)
for _, it := range wl.Items { for _, it := range wl.Items {
if !re.MatchString(it.CVEID) { // Bypass the cve format checking
return &invalidErr{fmt.Sprintf("invalid CVE ID: %s", it.CVEID)} // if !re.MatchString(it.CVEID) {
} // return &invalidErr{fmt.Sprintf("invalid CVE ID: %s", it.CVEID)}
// }
if _, ok := m[it.CVEID]; ok { if _, ok := m[it.CVEID]; ok {
return &invalidErr{fmt.Sprintf("duplicate CVE ID in whitelist: %s", it.CVEID)} return &invalidErr{fmt.Sprintf("duplicate CVE ID in whitelist: %s", it.CVEID)}
} }

1
src/pkg/scan/whitelist/validator_test.go
View File

@ -67,6 +67,7 @@ func TestValidate(t *testing.T) {
l: models.CVEWhitelist{ l: models.CVEWhitelist{
Items: []models.CVEWhitelistItem{ Items: []models.CVEWhitelistItem{
{CVEID: "breakit"}, {CVEID: "breakit"},
{CVEID: "breakit"},
}, },
}, },
noError: false, noError: false,