Mirrors/grype
2
0
Fork 0
mirror of https://github.com/anchore/grype synced 2024-11-10 06:34:13 +00:00
Code Issues Projects Releases Packages Wiki Activity

fix: ask catalog for package rather than type asserting (#1857)

Browse source 
This fixes a class of false positive where removing language packages that are
owned by OS packages would incorrectly fail due to a buggy type assertion.

---------

Signed-off-by: Will Murphy <will.murphy@anchore.com>
This commit is contained in:
William Murphy 2024-05-10 11:20:24 -04:00 committed by GitHub
parent 24d5d4ffb2
commit 5ac483a3bc
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 21 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
grype/pkg/package.go
View file

@ -109,8 +109,8 @@ func removePackagesByOverlap(catalog *pkg.Collection, relationships []artifact.R
for p := range catalog.Enumerate() {
r, ok := byOverlap[p.ID()]
if ok {
from, ok := r.From.(pkg.Package)
if ok && excludePackage(comprehensiveDistroFeed, p, from) {
from := catalog.Package(r.From.ID())
if from != nil && excludePackage(comprehensiveDistroFeed, p, *from) {
continue
}
}

25
grype/pkg/package_test.go
View file

@ -874,7 +874,7 @@ func catalogWithOverlaps(packages []string, overlaps []string) *sbom.SBOM {
pkgs = append(pkgs, p)
}
for _, overlap := range overlaps {
for i, overlap := range overlaps {
parts := strings.Split(overlap, "->")
if len(parts) < 2 {
panic("invalid overlap, use -> to specify, e.g.: pkg1->pkg2")
@ -882,11 +882,24 @@ func catalogWithOverlaps(packages []string, overlaps []string) *sbom.SBOM {
from := toPkg(parts[0])
to := toPkg(parts[1])
relationships = append(relationships, artifact.Relationship{
From: from,
To: to,
Type: artifact.OwnershipByFileOverlapRelationship,
})
// The catalog will type check whether To or From is a pkg.Package or a *pkg.Package.
// Previously, there was a bug where Grype assumed that From was always a pkg.Package.
// Therefore, intentionally mix pointer and non-pointer packages to prevent Grype from
// assuming which is which again. (The correct usage, calling catalog.Package, always
// returns a *pkg.Package, and doesn't rely on any type assertion.)
if i%2 == 0 {
relationships = append(relationships, artifact.Relationship{
From: &from,
To: &to,
Type: artifact.OwnershipByFileOverlapRelationship,
})
} else {
relationships = append(relationships, artifact.Relationship{
From: from,
To: to,
Type: artifact.OwnershipByFileOverlapRelationship,
})
}
}
catalog := syftPkg.NewCollection(pkgs...)