@@ -13307,26 +13307,30 @@ Downloader.trivyRepository = {
13307
13307
repo: 'trivy',
13308
13308
};
13309
13309
class Trivy {
13310
- static scan(trivyPath, image, options) {
13310
+ static scan(trivyPath, image, option) {
13311
+ Trivy.validateOption(option);
13311
13312
const args = [
13312
13313
'--severity',
13313
- options .severity,
13314
+ option .severity,
13314
13315
'--vuln-type',
13315
- options .vulnType,
13316
+ option .vulnType,
13316
13317
'--format',
13317
13318
'json',
13318
13319
'--quiet',
13319
13320
'--no-progress',
13320
13321
];
13321
- if (options .ignoreUnfixed) {
13322
+ if (option .ignoreUnfixed) {
13322
13323
args.push('--ignore-unfixed');
13323
13324
}
13324
13325
args.push(image);
13325
13326
const result = child_process_1.spawnSync(trivyPath, args, {
13326
13327
encoding: 'utf-8',
13327
13328
});
13328
13329
if (result.stdout && result.stdout.length > 0) {
13329
- return JSON.parse(result.stdout);
13330
+ const vulnerabilities = JSON.parse(result.stdout);
13331
+ if (vulnerabilities.length > 0) {
13332
+ return vulnerabilities;
13333
+ }
13330
13334
}
13331
13335
throw new Error(`Failed vulnerability scan using Trivy.
13332
13336
stdout: ${result.stdout}
@@ -13358,6 +13362,21 @@ class Trivy {
13358
13362
console.debug(issueContent);
13359
13363
return issueContent;
13360
13364
}
13365
+ static validateOption(option) {
13366
+ const allowedSeverities = /UNKNOWN|LOW|MEDIUM|HIGH|CRITICAL/;
13367
+ const allowedVulnTypes = /os|library/;
13368
+ for (const severity of option.severity.split(',')) {
13369
+ if (!allowedSeverities.test(severity)) {
13370
+ throw new Error(`severity option error: ${severity} is unknown severity`);
13371
+ }
13372
+ }
13373
+ for (const vulnType of option.vulnType.split(',')) {
13374
+ if (!allowedVulnTypes.test(vulnType)) {
13375
+ throw new Error(`vuln-type option error: ${vulnType} is unknown vuln-type`);
13376
+ }
13377
+ }
13378
+ return true;
13379
+ }
13361
13380
}
13362
13381
exports.Trivy = Trivy;
13363
13382
0 commit comments