Feat/fixing downstream kiro vulnerability scans#19
Feat/fixing downstream kiro vulnerability scans#19AntonBarashSnyk wants to merge 4 commits intomainfrom
Conversation
…am vulnerabilities are caught in tree
…am vulnerabilities are caught in tree
sathvi-k
left a comment
sathvi-k
left a comment
There was a problem hiding this comment.
a few questions about things i wanted to understand / things that might need to be changed
| @@ -46,6 +46,40 @@ | |||
| LOG_DIR = os.environ.get("SNYK_HOOK_LOG_DIR", "/tmp") | |||
There was a problem hiding this comment.
just curious: where is SNYK_HOOK_LOG_DIR set?
There was a problem hiding this comment.
Not set anywhere explicitly right now, so presumably this line will always set LOG_DIR to /tmp unless there is an environment variable set for SNYK_HOOK_LOG_DIR by the user. I think having this as the default is fine since it'll fallback to tmp
guardrail_directives/secure_at_inception/kiro_hooks/git/lib/run_snyk_scan.py
Outdated
Show resolved
Hide resolved
guardrail_directives/secure_at_inception/kiro_hooks/git/lib/filter_new_vulns.py
Outdated
Show resolved
Hide resolved
guardrail_directives/secure_at_inception/kiro_hooks/git/lib/filter_new_vulns.py
Outdated
Show resolved
Hide resolved
guardrail_directives/secure_at_inception/kiro_hooks/git/lib/run_snyk_scan.py
Outdated
Show resolved
Hide resolved
ifeanyiecheruo
left a comment
ifeanyiecheruo
left a comment
There was a problem hiding this comment.
One non-blocking comment about moving code out of the pre-commit hook. Otherwise looks good
| "fixed_version": v.fixed_version, | ||
| "cve": v.cve | ||
| }) | ||
| # Find the top-level package (first package after project name in dependency path) |
There was a problem hiding this comment.
Non blocknig.
The pre-commit is getting kinda big. Maybe we should move this chunk into one of the existing files or make a new file for it
3 participants
JIRA ticket:
https://snyksec.atlassian.net/browse/AG-132
This PR fixes an issue in the Kiro SCA scanner which didn't flag packages as vulnerable if they had downstream packages that were vulnerable. This was an issue because the scanner would only cache and check the issues that were directly connected to the specific package placed in package.json, but wouldn't check the dependency tree of the package for downstream dependencies that are vulnerable. This PR makes it so that the scanner now checks the entire dependency tree of each package to scan and cache whether the package is vulnerable