diff --git a/.rubocop.yml b/.rubocop.yml index b3dc1ce..53e4b99 100644 --- a/.rubocop.yml +++ b/.rubocop.yml @@ -1,14 +1,28 @@ AllCops: TargetRubyVersion: 2.3 +Lint/RaiseException: + Enabled: true + +Lint/StructNewOverride: + Enabled: true + + +Metrics: + Enabled: false + + Style/FrozenStringLiteralComment: Enabled: false Style/Documentation: Enabled: false -Metrics/MethodLength: - Max: 50 +Style/HashEachMethods: + Enabled: true + +Style/HashTransformKeys: + Enabled: true -Metrics/BlockLength: - Max: 200 +Style/HashTransformValues: + Enabled: true diff --git a/Gemfile.lock b/Gemfile.lock index 8ffbed2..fe8ffbf 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -16,11 +16,12 @@ GEM multi_json domain_name (0.5.20190701) unf (>= 0.0.5, < 1.0.0) - excon (0.92.1) + excon (0.92.3) http-accept (1.7.0) http-cookie (1.0.4) domain_name (~> 0.5) - json (2.6.1) + jaro_winkler (1.5.4) + json (2.6.2) mime-types (3.4.1) mime-types-data (~> 3.2015) mime-types-data (3.2022.0105) @@ -28,11 +29,10 @@ GEM multi_json (1.15.0) netrc (0.11.0) parallel (1.22.1) - parser (3.1.1.0) + parser (3.1.2.0) ast (~> 2.4.1) rainbow (3.1.1) - rake (10.5.0) - regexp_parser (2.2.1) + rake (13.0.6) rest-client (2.1.0) http-accept (>= 1.7.0, < 2.0) http-cookie (>= 1.0.2, < 2.0) @@ -48,21 +48,18 @@ GEM rspec-expectations (3.11.0) diff-lcs (>= 1.2.0, < 2.0) rspec-support (~> 3.11.0) - rspec-mocks (3.11.0) + rspec-mocks (3.11.1) diff-lcs (>= 1.2.0, < 2.0) rspec-support (~> 3.11.0) rspec-support (3.11.0) - rubocop (0.93.1) + rubocop (0.81.0) + jaro_winkler (~> 1.5.1) parallel (~> 1.10) - parser (>= 2.7.1.5) + parser (>= 2.7.0.1) rainbow (>= 2.2.2, < 4.0) - regexp_parser (>= 1.8) rexml - rubocop-ast (>= 0.6.0) ruby-progressbar (~> 1.7) unicode-display_width (>= 1.4.0, < 2.0) - rubocop-ast (1.16.0) - parser (>= 3.1.1.0) ruby-progressbar (1.11.0) sensu-plugin (4.0.0) json (< 3.0.0) @@ -78,9 +75,9 @@ PLATFORMS DEPENDENCIES bundler (~> 2.1) quayio-scanner! - rake (~> 10.0) + rake (~> 13.0) rspec (~> 3.7) - rubocop (~> 0.49) + rubocop (~> 0.49, <= 0.81) BUNDLED WITH - 2.2.23 + 2.1.4 diff --git a/README.md b/README.md index bb2c530..d09ccef 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,7 @@ # Quayio::Scanner -Scan quay.io for vulnerabilties in running docker containers. Implemented as sensu check. +Quayio Scanner translates critical vulnerabilities in running docker containers +into Sensu check results to transform vulnerability scans into actionable alerts. ## Installation @@ -18,11 +19,26 @@ Or install it yourself as: $ gem install quayio-scanner +## USAGE + +This plugin attempts to fetch vulnerabilities for all running containers + +### Parameters + +| Parameter | Description | +|---------------|-------------------------| +| -d URL | Docker URL | +| -t TOKEN | Quay.io oauth token | +| -w WHITELIST | Vulnerability whitelist | + +### Example + + $ check-container-vulnerabilities.rb --docker-url unix:///var/run/docker.sock --quayio-token AccessTokenGoesHere + ## Contributing Bug reports and pull requests are welcome on GitHub at https://github.com/aboutsource/quayio-scanner. - ## License The gem is available as open source under the terms of the [MIT License](http://opensource.org/licenses/MIT). @@ -33,4 +49,4 @@ Copyright 2019 - present [Florian Frank](mailto:flori@ping.de) - The gem [json]( ## Security -* [Snyk](https://app.snyk.io/org/about-source/project/6eb2d381-87e7-49c4-a47f-ccad97f33ae3) +- [Snyk](https://app.snyk.io/org/about-source/project/6eb2d381-87e7-49c4-a47f-ccad97f33ae3) diff --git a/bin/check-container-vulnerabilities.rb b/bin/check-container-vulnerabilities.rb index f90f575..4174b72 100755 --- a/bin/check-container-vulnerabilities.rb +++ b/bin/check-container-vulnerabilities.rb @@ -4,7 +4,7 @@ # # DESCRIPTION: # -# This plugin attempts to fetch vulnerabilties for all running containers +# This plugin attempts to fetch vulnerabilities for all running containers # # OUTPUT: # plain text @@ -18,7 +18,8 @@ # gem: rest-client # # USAGE: -# ./check-container-vulnerabilities.rb -d -t +# ./check-container-vulnerabilities.rb \ +# -d -t # require 'sensu-plugin/check/cli' diff --git a/lib/quayio/scanner/check.rb b/lib/quayio/scanner/check.rb index 0379266..5b568df 100644 --- a/lib/quayio/scanner/check.rb +++ b/lib/quayio/scanner/check.rb @@ -9,7 +9,10 @@ def run if vulnerable_images.empty? [:ok, "#{containers.size} Containers are ok"] else - [:critical, "The images are insecure: #{vulnerable_images.join(', ')}"] + [ + :critical, + "The images are insecure: #{vulnerable_images.join(', ')}" + ] end end diff --git a/lib/quayio/scanner/image.rb b/lib/quayio/scanner/image.rb index 6c0d553..b445886 100644 --- a/lib/quayio/scanner/image.rb +++ b/lib/quayio/scanner/image.rb @@ -2,7 +2,8 @@ module Quayio module Scanner class Image RELEVANT_SEVERITIES = %w[High Critical].freeze - QUAY_IO_REPO_NAME = %r{quay.io\/(?[\w-]+)\/(?[\w-]+):(?[\w.-]+)}.freeze + QUAY_IO_REPO_NAME = + %r{quay.io\/(?[\w-]+)\/(?[\w-]+):(?[\w.-]+)}.freeze attr_reader :name, :whitelist, :repository @@ -24,7 +25,7 @@ def vulnerable? def quayio? # safe guard, do not trust QUAY_IO_REPO_NAME regex match - !!name.match(%r{^quay.io\/}) + name.match?(%r{^quay.io\/}) end def scanned? @@ -32,11 +33,12 @@ def scanned? end def vulnerabilities_present? - !!raw_scan['data']['Layer']['Features'].detect do |f| + !raw_scan['data']['Layer']['Features'].detect do |f| f['Vulnerabilities']&.detect do |v| - RELEVANT_SEVERITIES.include?(v['Severity']) && !whitelist.include?(v['Name']) + RELEVANT_SEVERITIES.include?(v['Severity']) &&\ + !whitelist.include?(v['Name']) end - end + end.nil? end def raw_scan diff --git a/lib/quayio/scanner/repository.rb b/lib/quayio/scanner/repository.rb index 8c1e6d3..90dbe83 100644 --- a/lib/quayio/scanner/repository.rb +++ b/lib/quayio/scanner/repository.rb @@ -18,7 +18,7 @@ def manifest_ref def fetch_manifest_ref result = api_call("/tag/?specificTag=#{tag}&onlyActiveTags=1") - (result['tags'].first)['manifest_digest'] + result['tags'].first['manifest_digest'] end def api_call(uri) diff --git a/quayio-scanner.gemspec b/quayio-scanner.gemspec index dbfde55..d365fd6 100644 --- a/quayio-scanner.gemspec +++ b/quayio-scanner.gemspec @@ -8,7 +8,8 @@ Gem::Specification.new do |spec| spec.authors = ['Benjamin Meichsner'] spec.email = ['benjamin.meichsner@aboutsource.net'] - spec.summary = 'Scan quay.io for vulnerabilties in running docker containers.' + spec.summary = 'Scan quay.io for vulnerabilities in '\ + 'running docker containers.' spec.homepage = 'https://github.com/aboutsource/quayio-scanner' spec.license = 'MIT' @@ -17,14 +18,14 @@ Gem::Specification.new do |spec| spec.files = `git ls-files -z`.split("\x0").reject do |f| f.match(%r{^(test|spec|features)/}) end - spec.executables = Dir.glob('bin/**/*.rb').map { |file| File.basename(file) } + spec.executables = Dir.glob('bin/**/*.rb').map { |f| File.basename(f) } spec.require_paths = ['lib'] spec.add_dependency 'docker-api', '~> 1.33' spec.add_dependency 'rest-client', '~> 2.1' spec.add_dependency 'sensu-plugin', '~> 4.0' spec.add_development_dependency 'bundler', '~> 2.1' - spec.add_development_dependency 'rake', '~> 10.0' + spec.add_development_dependency 'rake', '~> 13.0' spec.add_development_dependency 'rspec', '~> 3.7' - spec.add_development_dependency 'rubocop', '~> 0.49' + spec.add_development_dependency 'rubocop', '~> 0.49', '<= 0.81' end