vulnerability

Documentation

Index

• Constants
• func GetDomain(image string) string
• func GetRepository(image string) (repository string)
• func RegisterContainerRegistry(registryType string, registry ContainerRegistry)
• type ACR
  • func (a *ACR) ScanImage(image string) ([]output.ACRResponse, error)
• type ContainerRegistry
• type ECR
  • func (e *ECR) GetImageScanResult(ctx context.Context, client *ecr.ECR, image string, imageDetails ImageDetails) (*ecr.DescribeImageScanFindingsOutput, error)
  • func (e *ECR) ScanImage(ctx context.Context, image string) (*ecr.DescribeImageScanFindingsOutput, error)
  • func (e *ECR) StartImageScan(ctx context.Context, client *ecr.ECR, image string, imageDetails ImageDetails) error
• type Engine
• type EngineInput
• type EngineOutput
• type GCR
  • func (g *GCR) ScanImage(image string) (result []*grafeaspb.Occurrence, err error)
• type Harbor
  • func (h *Harbor) ScanImage(image string) (result map[string]interface{}, err error)
• type ImageDetails
  • func GetImageDetails(image string, imageDetails ImageDetails) ImageDetails
• type ServerCaller
• type VulEngine
  • func NewVulEngine() (*VulEngine, error)
  • func (v *VulEngine) FetchVulnerabilities(resourceConfigs output.AllResourceConfigs, options map[string]interface{}) output.AllResourceConfigs
  • func (v *VulEngine) ReportVulnerability(engineInput EngineInput, options map[string]interface{}) EngineOutput

Constants

const (
	//VulnerabilityCVSSSource hold type of cvss source
	VulnerabilityCVSSSource = "nvd"
)

Functions

func GetDomain

func GetDomain(image string) string

GetDomain get image domain from image name

func GetRepository

func GetRepository(image string) (repository string)

GetRepository finds repository from image name

func RegisterContainerRegistry

func RegisterContainerRegistry(registryType string, registry ContainerRegistry)

RegisterContainerRegistry register the container registry for vulnerability scanning

Types

type ACR

type ACR struct {
	// contains filtered or unexported fields
}

ACR acr container registry

func (*ACR) ScanImage

func (a *ACR) ScanImage(image string) ([]output.ACRResponse, error)

ScanImage - get the image scan result from ACR registry

type ContainerRegistry

type ContainerRegistry interface {
	// contains filtered or unexported methods
}

ContainerRegistry vulnerability Container Registry

type ECR

type ECR struct {
	// contains filtered or unexported fields
}

ECR ecr container registry

func (*ECR) GetImageScanResult

func (e *ECR) GetImageScanResult(ctx context.Context, client *ecr.ECR, image string, imageDetails ImageDetails) (*ecr.DescribeImageScanFindingsOutput, error)

GetImageScanResult get the scan result from ECR

func (*ECR) ScanImage

func (e *ECR) ScanImage(ctx context.Context, image string) (*ecr.DescribeImageScanFindingsOutput, error)

ScanImage calles aws ecr api to get image scan details

func (*ECR) StartImageScan

func (e *ECR) StartImageScan(ctx context.Context, client *ecr.ECR, image string, imageDetails ImageDetails) error

StartImageScan starts the scan of provided image

type Engine

type Engine interface {
	FetchVulnerabilities(output.AllResourceConfigs, map[string]interface{}) output.AllResourceConfigs
	ReportVulnerability(EngineInput, map[string]interface{}) EngineOutput
}

Engine engine that holds methods for vulnerability operation

type EngineInput

type EngineInput struct {
	InputData *output.AllResourceConfigs
}

EngineInput holds input for vulnerability engine

type EngineOutput

type EngineOutput struct {
	XMLName                 xml.Name `json:"-" yaml:"-" xml:"results"`
	*results.ViolationStore `json:"results" yaml:"results" xml:"results"`
}

EngineOutput Contains data output from the engine

type GCR

type GCR struct {
	// contains filtered or unexported fields
}

GCR gcr container registry

func (*GCR) ScanImage

func (g *GCR) ScanImage(image string) (result []*grafeaspb.Occurrence, err error)

ScanImage get the image scan result from GCR registry

type Harbor

type Harbor struct {
	// contains filtered or unexported fields
}

Harbor Harbor container registry

func (*Harbor) ScanImage

func (h *Harbor) ScanImage(image string) (result map[string]interface{}, err error)

ScanImage get the image scan result from harbor registry

type ImageDetails

type ImageDetails struct {
	Tag        string `json:"tag"`
	Digest     string `json:"digest"`
	Name       string `json:"name"`
	Repository string `json:"repository"`
	Registry   string `json:"registry"`
}

ImageDetails will hold details about the image being scanned for vulnerabilities.

func GetImageDetails

func GetImageDetails(image string, imageDetails ImageDetails) ImageDetails

GetImageDetails finds image component from image name

type ServerCaller

type ServerCaller interface {
	Do(req *http.Request) (*http.Response, error)
}

ServerCaller interface with client methods

type VulEngine

type VulEngine struct {
	// contains filtered or unexported fields
}

VulEngine Implements the vulnerability engine interface

func NewVulEngine

func NewVulEngine() (*VulEngine, error)

NewVulEngine returns a new vulnerability engine

func (*VulEngine) FetchVulnerabilities

func (v *VulEngine) FetchVulnerabilities(resourceConfigs output.AllResourceConfigs, options map[string]interface{}) output.AllResourceConfigs

FetchVulnerabilities fetch vulnerabilities for images found in IaC files

func (*VulEngine) ReportVulnerability

func (v *VulEngine) ReportVulnerability(engineInput EngineInput, options map[string]interface{}) EngineOutput

ReportVulnerability Add a vulnerability for a given resource in scan summary