search

sonatype-nexus-community / jake

Check your Python environments for vulnerable Open Source packages with OSS Index or Sonatype Nexus Lifecycle.
https://jake.readthedocs.io/
Apache License 2.0
114 stars 24 forks source link

[FEATURE] add a optional whitelist to ddt #88

Closed daviskirk closed 2 years ago

daviskirk commented 2 years ago

It would nice to have a whitelist where certain vulnerabilities / packages that are ignored in the evaluation of the error code.

There might be packages that have known vulnerabilities but are patched manually or not used in a fashion that makes them vulnerable. In these cases it would be nice to have a kind of "whitelist". This is especially relevant if the error code returned by jake is relevant in some way or another (pre commit hook for example).

auditjs has a "whitelist" option that might be applicable here as well: https://github.com/sonatype-nexus-community/auditjs#whitelisting

jake ddt --whitelist .jake.json

or something similar.

cc @bhamail / @DarthHater

matthewdeanmartin commented 2 years ago

This is going to be a problem soon for people trying to use this on a build server, as soon as a common package has an unpatchable vulnerability, e.g. pip's CVE-2018-20225.

It doesn't look like I can give jake a list of packages (it is checking packages in the venv?) or I could "skip" unfixable that way.

The output for a given failure is many idiosyncratic lines, so I can't easily parse the text & ignore the cve that way.

DarthHater commented 2 years ago

A note, don't use the term whitelist, we were in process of switching this in auditjs, just never got it taken care of. The issue where we were tracking that is here: https://github.com/sonatype-nexus-community/auditjs/issues/202.

Suggestion allow-list or deny-list for the inverse if you went that direction.

The bonus of using the new terms is they are easier to translate outside of English, as well!

matthewdeanmartin commented 2 years ago

ignore is a good term as well.