kubernetes / sig-security

Process documentation, non-code deliverables, and miscellaneous artifacts of Kubernetes SIG Security
Apache License 2.0
161 stars 53 forks source link

Bug: Unbound variable in vulnerability scanning script #85

Closed PushkarJ closed 1 month ago

PushkarJ commented 1 year ago

Job run: https://storage.googleapis.com/kubernetes-jenkins/logs/ci-kubernetes-snyk-master/1643706990876168192/build-log.txt

/bin/bash: line 30: null: unbound variable

Fix needs to happen where TOTAL_COUNT variable is set as null when curl command returns this error:

{"message":"API rate limit exceeded for 98.37.153.210. (But here's the good news: Authenticated requests get a higher rate limit. Check out the documentation for more details.)","documentation_url":"https://docs.github.com/rest/overview/resources-in-the-rest-api#rate-limiting"}

We need to check if the variable is "null" and then fail the job if it is since that means we are unable to filter out vulnerabilities that we can.

Something like this would work (optional improvements for redundant code are welcome too):

                  if [ $TOTAL_COUNT == "null" ]; then
                      echo "Vulnerability filtering failed"
                      exit 1
                  else
                    if [[ $TOTAL_COUNT -eq 0 ]]; then
                      echo "Vulnerability filtering failed"
                      exit 1
                    fi
                  fi

/sig security testing k8s-infra /kind bug

pacoxu commented 1 year ago

/help

k8s-ci-robot commented 1 year ago

@pacoxu: This request has been marked as needing help from a contributor.

Guidelines

Please ensure that the issue body includes answers to the following questions:

For more details on the requirements of such an issue, please see here and ensure that they are met.

If this request no longer meets these requirements, the label can be removed by commenting with the /remove-help command.

In response to [this](https://github.com/kubernetes/sig-security/issues/85): >/help Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.
carlory commented 1 year ago

/assign

PushkarJ commented 1 year ago

@carlory hope you're well. Are you still working on this or need any help from me?

carlory commented 1 year ago

Sorry for the delay. I'll do it this week.

PushkarJ commented 7 months ago

The chances of this recurring are greatly reduced thanks to https://github.com/kubernetes/test-infra/pull/31076

PushkarJ commented 1 month ago

Since there have been no newer failures because of this bug, it seems this would be okay to close for now. If anyone still wants to work on this, please open a PR with a fix and reopen this issue again so that it is resolved by the PR.