search

optiopay / klar

Integration of Clair and Docker Registry
MIT License
506 stars 138 forks source link

Allow Response to be limited by Severity Level #15

Closed hulu1522 closed 7 years ago

hulu1522 commented 7 years ago

It seems that the Klar just outputs all vulnerabilities no matter what the severity level. It would be nice to have an option for the Klar command to limit the response. I do like the summary portion of it though.

Something like this: <ENV_VARS> klar --out_level="High" <image>

The output would be something similar to this:

CVE-2016-1252: [High]
A man-in-the-middle attacker could circumvent the InRelease signature of a repository, leading to a malicious package being installed and, therefore, remote arbitrary code execution.
http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-1252
-----------------------------------------
Negligible: 10
Low: 69
Medium: 86
High: 1
supereagle commented 7 years ago

@hulu1522 Sound reasonable, thanks for your suggestion. @hashmap Any comments about this feature?

hulu1522 commented 7 years ago

@supereagle @hashmap , It could probably be simplified to just -output="High". Thanks for considering it.

hashmap commented 7 years ago

Sounds good, thanks for suggestion! I'd like to keep it simple anduse the value as threshold, not as filter. I mean Medium would mean show Medium and High. Also no support for complex filters like Low, Medium

hulu1522 commented 7 years ago

I completely agree @hashmap . My example didn't have a 'Critical' or else it would be displayed also.

supereagle commented 7 years ago

LGTM. @hashmap Are you working on this? If not, I am glad to submit a PR for this.

hashmap commented 7 years ago

@supereagle please go ahead, thanks!