class DCCSCR::Whitelist::UpdateAllowlistWithDCCSCR
Service class to update a GitLab vulnerability-allowlist.yml with whitelisted_vulnerabilities from the dccscr-whitelist for a set of images.
Attributes
allow_filename[R]
images[R]
local_filename[R]
Public Class Methods
new(images: [], allow_filename: nil, local_filename: nil)
click to toggle source
# File lib/dccscr/whitelist/update_allowlist_with_dccscr.rb, line 13 def initialize(images: [], allow_filename: nil, local_filename: nil) @images = images @allow_filename = allow_filename || 'vulnerability-allowlist.yml' @local_filename = local_filename || 'local-vulnerability-allowlist.yml' end
Public Instance Methods
run()
click to toggle source
# File lib/dccscr/whitelist/update_allowlist_with_dccscr.rb, line 23 def run ll = load_gitlab_allowlist wl = load_dccscr_whitelist dl = allow_list_dccscr(wl) cl = combined_list(dl, ll) update_allow_list_file(cl) end
whitelist()
click to toggle source
# File lib/dccscr/whitelist/update_allowlist_with_dccscr.rb, line 19 def whitelist @_whitelist ||= DCCSCR::Whitelist.new end
Private Instance Methods
allow_list_dccscr(wl)
click to toggle source
# File lib/dccscr/whitelist/update_allowlist_with_dccscr.rb, line 62 def allow_list_dccscr(wl) warn 'Generating dccscr list in gitlab format' { 'generalallowlist' => Hash[ wl.entries.map { |_, entry| entry.value['whitelisted_vulnerabilities'].map { |v| [v['vulnerability'], "dccscr-whitelists:\n#{v['justification']}"] }.compact }.flatten(1).sort ] } end
combined_list(dl, ll)
click to toggle source
# File lib/dccscr/whitelist/update_allowlist_with_dccscr.rb, line 76 def combined_list(dl, ll) warn 'Merging dccscr and local lists' dl.merge(ll) { |_, d, l| case d when Hash d.merge(l) else l end } end
load(yml)
click to toggle source
# File lib/dccscr/whitelist/update_allowlist_with_dccscr.rb, line 58 def load(yml) YAML.safe_load(File.read(yml)) end
load_dccscr_whitelist()
click to toggle source
# File lib/dccscr/whitelist/update_allowlist_with_dccscr.rb, line 36 def load_dccscr_whitelist whitelist.tap do |wl| # load wl entries for args # will load parents as well images.each { |arg| wl[arg] } end end
load_gitlab_allowlist()
click to toggle source
# File lib/dccscr/whitelist/update_allowlist_with_dccscr.rb, line 44 def load_gitlab_allowlist if File.exist?(local_filename) warn 'Loading local file' load(local_filename) elsif File.exist?(allow_filename) warn 'Loading and renaming local allow file' File.rename(allow_filename, local_filename) load(local_filename) else warn 'No local allow file' {} end end
update_allow_list_file(cl)
click to toggle source
# File lib/dccscr/whitelist/update_allowlist_with_dccscr.rb, line 89 def update_allow_list_file(cl) warn 'Updating allow file' File.open(allow_filename, 'w') do |f| f << cl.to_yaml end end