Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

🐛 Fix junit output for vuln report #1518

Merged
merged 1 commit into from
Dec 17, 2024
Merged

🐛 Fix junit output for vuln report #1518

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 2 additions & 40 deletions cli/reporter/junit.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,11 +8,9 @@ import (
"fmt"
"strconv"

mapstructure "github.com/go-viper/mapstructure/v2"
"github.com/jstemmer/go-junit-report/v2/junit"
"go.mondoo.com/cnquery/v11/explorer"
"go.mondoo.com/cnquery/v11/providers-sdk/v1/inventory"
"go.mondoo.com/cnquery/v11/providers-sdk/v1/upstream/mvd"
"go.mondoo.com/cnquery/v11/utils/iox"
"go.mondoo.com/cnspec/v11/policy"
)
Expand Down Expand Up @@ -164,17 +162,11 @@ func assetPolicyTests(r *policy.ReportCollection, assetMrn string, assetObj *inv
// assetPolicyTests converts asset vulnerability results to Junit test cases
func assetMvdTests(r *policy.ReportCollection, assetMrn string, assetObj *inventory.Asset) *junit.Testsuite {
// check if we have a vulnerability report
results, ok := r.Reports[assetMrn]
vulnReport, ok := r.VulnReports[assetMrn]
if !ok {
return nil
}

rawResults := results.RawResults()
value, _ := getVulnReport(rawResults)
if value == nil || value.Data == nil {
return nil
}

ts := &junit.Testsuite{
Name: "Vulnerability Report for " + assetObj.Name,
Tests: 0,
Expand All @@ -183,36 +175,6 @@ func assetMvdTests(r *policy.ReportCollection, assetMrn string, assetObj *invent
Testcases: []junit.Testcase{},
}

if value.Data.Error != nil {
ts.Errors++
ts.Testcases = append(ts.Testcases, junit.Testcase{
Failure: &junit.Result{
Message: "could not load the vulnerability report: " + value.Data.Error.Error(),
Type: "fail",
},
})
return ts
}

// parse the vulnerability report
rawData := value.Data.Value
var vulnReport mvd.VulnReport
cfg := &mapstructure.DecoderConfig{
Metadata: nil,
Result: &vulnReport,
TagName: "json",
}
decoder, _ := mapstructure.NewDecoder(cfg)
if err := decoder.Decode(rawData); err != nil {
ts.Errors++
ts.Testcases = append(ts.Testcases, junit.Testcase{
Failure: &junit.Result{
Message: "could not decode advisory report",
Type: "fail",
},
})
}

// packages advisories
if vulnReport.Stats != nil && vulnReport.Stats.Packages != nil && vulnReport.Stats.Packages.Affected > 0 {
ts.Tests = len(vulnReport.Packages)
Expand Down Expand Up @@ -252,7 +214,7 @@ func assetMvdTests(r *policy.ReportCollection, assetMrn string, assetObj *invent
ts.Failures++

var content string
content += pkg.Name + "with version" + pkg.Version + " has known vulnerabilities"
content += pkg.Name + " with version" + pkg.Version + " has known vulnerabilities"
if pkg.Score > 0 {
content += " (score " + fmt.Sprintf("%v", float32(pkg.Score)/10) + ")"
}
Expand Down
30 changes: 28 additions & 2 deletions cli/reporter/junit_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ import (
"github.com/stretchr/testify/require"
"go.mondoo.com/cnquery/v11/explorer"
"go.mondoo.com/cnquery/v11/providers-sdk/v1/inventory"
"go.mondoo.com/cnquery/v11/providers-sdk/v1/upstream/mvd"
"go.mondoo.com/cnquery/v11/utils/iox"
"go.mondoo.com/cnspec/v11/policy"
)
Expand Down Expand Up @@ -73,11 +74,11 @@ func sampleReportCollection() *policy.ReportCollection {
},
// add passed, failed and skipped test
Scores: map[string]*policy.Score{
"+u6doYoYG5E=": &policy.Score{
"+u6doYoYG5E=": {
Type: 2, // result
Value: 100,
},
"057itYF8s30=": &policy.Score{
"057itYF8s30=": {
Type: 4, // error
Value: 0,
},
Expand All @@ -88,6 +89,26 @@ func sampleReportCollection() *policy.ReportCollection {
},
},
},
VulnReports: map[string]*mvd.VulnReport{
"//assets.api.mondoo.app/spaces/dazzling-golick-767384/assets/2DRZ1cCWFyTYCArycAXHwvn1oU2": {
Packages: []*mvd.Package{
{
Name: "libssl1.1",
Version: "1.1.1f-3ubuntu2.19",
Affected: true,
Score: 100,
Available: "1.1.1f-3ubuntu2.20",
},
},
Stats: &mvd.ReportStats{
Packages: &mvd.ReportStatsPackages{
Total: 1,
Critical: 1,
Affected: 1,
},
},
},
},
}
}

Expand All @@ -103,6 +124,11 @@ func TestJunitConverter(t *testing.T) {
assert.Contains(t, junitReport, "<testcase name=\"Ensure SNMP server is stopped and not enabled\" classname=\"score\"></testcase>")
assert.Contains(t, junitReport, "<testcase name=\"Configure kubelet to capture all event creation\" classname=\"score\">\n\t\t\t<failure message=\"\" type=\"error\"></failure>\n\t\t</testcase>")
assert.Contains(t, junitReport, "<testcase name=\"Set secure file permissions on the scheduler.conf file\" classname=\"score\">\n\t\t\t<skipped message=\"skipped\"></skipped>\n\t\t</testcase>")
assert.Contains(t, junitReport, "<testsuite name=\"Vulnerability Report for")
assert.Contains(t, junitReport, "<property name=\"report.packages.total\" value=\"1\"></property>")
assert.Contains(t, junitReport, "<property name=\"report.packages.critical\" value=\"1\"></property>")
assert.Contains(t, junitReport, "<testcase name=\"libssl1.1\" classname=\"vulnerability\">")
assert.Contains(t, junitReport, "<failure message=\"Update libssl1.1 to 1.1.1f-3ubuntu2.20\"><![CDATA[libssl1.1 with version1.1.1f-3ubuntu2.19 has known vulnerabilities (score 10)]]></failure>")
}

func TestJunitNilReport(t *testing.T) {
Expand Down
Loading