add parameter to whitelist detected vulnerabilities

Author: stefan-as

Rakefile

@@ -1,2 +1,7 @@
 require 'bundler/gem_tasks'
-task default: :spec
+require 'rspec/core/rake_task'
+require 'rubocop/rake_task'
+
+RuboCop::RakeTask.new
+
+task default: %i[rubocop]

bin/check-container-vulnerabilities.rb

@@ -36,9 +36,16 @@ class CheckContainerVulnerabilities < Sensu::Plugin::Check::CLI
          short: '-t TOKEN',
          long: '--quayio-token TOKEN'
 
+  option :whitelist,
+         description: 'Vulnerability whitelist',
+         short: '-w WHITELIST[,WHITELIST]',
+         long: '--whitelist WHITELIST[,WHITELIST]',
+         default: '',
+         proc: proc { |w| w.split(',') }
+
   def run
-    status, message = Quayio::Scanner::Check.new(config[:docker_url],
-                                        config[:quayio_token]).run
+    status, message = Quayio::Scanner::Check.new(
+        config[:docker_url], config[:quayio_token], config[:whitelist]).run
 
     if status == :ok
       ok message

lib/quayio/scanner/check.rb

@@ -3,15 +3,15 @@
 
 module Quayio
   module Scanner
-    class Check < Struct.new(:docker_url, :quayio_token)
+    class Check < Struct.new(:docker_url, :quayio_token, :whitelist)
       def run
         Docker.url = docker_url
         containers = Docker::Container.all
                                       .map { |dc| dc.json['Config']['Image'] }
                                       .uniq
 
         vulnerable_images = containers
-                            .map { |container| Image.new(container, quayio_token) }
+                            .map { |container| Image.new(container, quayio_token, whitelist) }
                             .select(&:vulnerable?)
                             .map(&:name)
 

lib/quayio/scanner/image.rb

@@ -3,7 +3,7 @@
 
 module Quayio
   module Scanner
-    class Image < Struct.new(:name, :quayio_token)
+    class Image < Struct.new(:name, :quayio_token, :whitelist)
       RELEVANT_SEVERITIES = %w(Medium High Critical)
 
       def vulnerable?
@@ -26,9 +26,10 @@ def scanned?
 
       def high_vulnerabilities_present?
         raw_scan['data']['Layer']['Features'].detect do |f|
-          f['Vulnerabilities'] &&
-            f['Vulnerabilities']
-              .detect { |v| RELEVANT_SEVERITIES.include?(v['Severity']) }
+          f['Vulnerabilities'] && f['Vulnerabilities'].detect do |v|
+            RELEVANT_SEVERITIES.include?(v['Severity']) &&
+              !whitelist.include?(v['Name'])
+          end
         end
       end
 

quayio-scanner.gemspec

@@ -1,6 +1,4 @@
-# coding: utf-8
-
-lib = File.expand_path('../lib', __FILE__)
+lib = File.expand_path('lib', __dir__)
 $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 require 'quayio/scanner/version'
 
@@ -20,10 +18,11 @@ Gem::Specification.new do |spec|
   spec.executables   = Dir.glob('bin/**/*.rb').map { |file| File.basename(file) }
   spec.require_paths = ['lib']
 
-  spec.add_dependency 'sensu-plugin', '~> 2.1'
   spec.add_dependency 'docker-api', '~> 1.33'
   spec.add_dependency 'rest-client', '~> 2.0'
+  spec.add_dependency 'sensu-plugin', '~> 2.1'
   spec.add_development_dependency 'bundler', '~> 1.14'
   spec.add_development_dependency 'rake', '~> 10.0'
+  spec.add_development_dependency 'rspec', '~> 3.7'
   spec.add_development_dependency 'rubocop', '~> 0.49'
 end