class DCCSCR::Whitelist::UpdateAllowlistWithDCCSCR

Service class to update a GitLab vulnerability-allowlist.yml with whitelisted_vulnerabilities from the dccscr-whitelist for a set of images.

Attributes

allow_filename[R]
images[R]
local_filename[R]

Public Class Methods

new(images: [], allow_filename: nil, local_filename: nil) click to toggle source
# File lib/dccscr/whitelist/update_allowlist_with_dccscr.rb, line 13
def initialize(images: [], allow_filename: nil, local_filename: nil)
  @images = images
  @allow_filename = allow_filename || 'vulnerability-allowlist.yml'
  @local_filename = local_filename || 'local-vulnerability-allowlist.yml'
end

Public Instance Methods

run() click to toggle source
# File lib/dccscr/whitelist/update_allowlist_with_dccscr.rb, line 23
def run
  ll = load_gitlab_allowlist

  wl = load_dccscr_whitelist
  dl = allow_list_dccscr(wl)

  cl = combined_list(dl, ll)

  update_allow_list_file(cl)
end
whitelist() click to toggle source
# File lib/dccscr/whitelist/update_allowlist_with_dccscr.rb, line 19
def whitelist
  @_whitelist ||= DCCSCR::Whitelist.new
end

Private Instance Methods

allow_list_dccscr(wl) click to toggle source
# File lib/dccscr/whitelist/update_allowlist_with_dccscr.rb, line 62
def allow_list_dccscr(wl)
  warn 'Generating dccscr list in gitlab format'

  {
    'generalallowlist' => Hash[
      wl.entries.map { |_, entry|
        entry.value['whitelisted_vulnerabilities'].map { |v|
          [v['vulnerability'], "dccscr-whitelists:\n#{v['justification']}"]
        }.compact
      }.flatten(1).sort
    ]
  }
end
combined_list(dl, ll) click to toggle source
# File lib/dccscr/whitelist/update_allowlist_with_dccscr.rb, line 76
def combined_list(dl, ll)
  warn 'Merging dccscr and local lists'

  dl.merge(ll) { |_, d, l|
    case d
    when Hash
      d.merge(l)
    else
      l
    end
  }
end
load(yml) click to toggle source
# File lib/dccscr/whitelist/update_allowlist_with_dccscr.rb, line 58
def load(yml)
  YAML.safe_load(File.read(yml))
end
load_dccscr_whitelist() click to toggle source
# File lib/dccscr/whitelist/update_allowlist_with_dccscr.rb, line 36
def load_dccscr_whitelist
  whitelist.tap do |wl|
    # load wl entries for args
    # will load parents as well
    images.each { |arg| wl[arg] }
  end
end
load_gitlab_allowlist() click to toggle source
# File lib/dccscr/whitelist/update_allowlist_with_dccscr.rb, line 44
def load_gitlab_allowlist
  if File.exist?(local_filename)
    warn 'Loading local file'
    load(local_filename)
  elsif File.exist?(allow_filename)
    warn 'Loading and renaming local allow file'
    File.rename(allow_filename, local_filename)
    load(local_filename)
  else
    warn 'No local allow file'
    {}
  end
end
update_allow_list_file(cl) click to toggle source
# File lib/dccscr/whitelist/update_allowlist_with_dccscr.rb, line 89
def update_allow_list_file(cl)
  warn 'Updating allow file'

  File.open(allow_filename, 'w') do |f|
    f << cl.to_yaml
  end
end