From 2f884cff1841828f28703675c70c73d21f807e89 Mon Sep 17 00:00:00 2001
From: Stefan Walluhn <stefan.walluhn@aboutsource.net>
Date: Tue, 29 May 2018 19:07:02 +0200
Subject: [PATCH] add parameter to whitelist detected vulnerabilities

---
 Rakefile                               |  7 ++++++-
 bin/check-container-vulnerabilities.rb | 11 +++++++++--
 lib/quayio/scanner/check.rb            |  4 ++--
 lib/quayio/scanner/image.rb            |  9 +++++----
 quayio-scanner.gemspec                 |  7 +++----
 5 files changed, 25 insertions(+), 13 deletions(-)

diff --git a/Rakefile b/Rakefile
index d65c578..1bf0995 100644
--- a/Rakefile
+++ b/Rakefile
@@ -1,2 +1,7 @@
 require 'bundler/gem_tasks'
-task default: :spec
+require 'rspec/core/rake_task'
+require 'rubocop/rake_task'
+
+RuboCop::RakeTask.new
+
+task default: %i[rubocop]
diff --git a/bin/check-container-vulnerabilities.rb b/bin/check-container-vulnerabilities.rb
index 70e19aa..927078b 100755
--- a/bin/check-container-vulnerabilities.rb
+++ b/bin/check-container-vulnerabilities.rb
@@ -36,9 +36,16 @@ class CheckContainerVulnerabilities < Sensu::Plugin::Check::CLI
          short: '-t TOKEN',
          long: '--quayio-token TOKEN'
 
+  option :whitelist,
+         description: 'Vulnerability whitelist',
+         short: '-w WHITELIST[,WHITELIST]',
+         long: '--whitelist WHITELIST[,WHITELIST]',
+         default: '',
+         proc: proc { |w| w.split(',') }
+
   def run
-    status, message = Quayio::Scanner::Check.new(config[:docker_url],
-                                        config[:quayio_token]).run
+    status, message = Quayio::Scanner::Check.new(
+        config[:docker_url], config[:quayio_token], config[:whitelist]).run
 
     if status == :ok
       ok message
diff --git a/lib/quayio/scanner/check.rb b/lib/quayio/scanner/check.rb
index cbe3c8d..651b6a7 100644
--- a/lib/quayio/scanner/check.rb
+++ b/lib/quayio/scanner/check.rb
@@ -3,7 +3,7 @@
 
 module Quayio
   module Scanner
-    class Check < Struct.new(:docker_url, :quayio_token)
+    class Check < Struct.new(:docker_url, :quayio_token, :whitelist)
       def run
         Docker.url = docker_url
         containers = Docker::Container.all
@@ -11,7 +11,7 @@ def run
                                       .uniq
 
         vulnerable_images = containers
-                            .map { |container| Image.new(container, quayio_token) }
+                            .map { |container| Image.new(container, quayio_token, whitelist) }
                             .select(&:vulnerable?)
                             .map(&:name)
 
diff --git a/lib/quayio/scanner/image.rb b/lib/quayio/scanner/image.rb
index 57a9f2c..a260264 100644
--- a/lib/quayio/scanner/image.rb
+++ b/lib/quayio/scanner/image.rb
@@ -3,7 +3,7 @@
 
 module Quayio
   module Scanner
-    class Image < Struct.new(:name, :quayio_token)
+    class Image < Struct.new(:name, :quayio_token, :whitelist)
       RELEVANT_SEVERITIES = %w(Medium High Critical)
 
       def vulnerable?
@@ -26,9 +26,10 @@ def scanned?
 
       def high_vulnerabilities_present?
         raw_scan['data']['Layer']['Features'].detect do |f|
-          f['Vulnerabilities'] &&
-            f['Vulnerabilities']
-              .detect { |v| RELEVANT_SEVERITIES.include?(v['Severity']) }
+          f['Vulnerabilities'] && f['Vulnerabilities'].detect do |v|
+            RELEVANT_SEVERITIES.include?(v['Severity']) &&
+              !whitelist.include?(v['Name'])
+          end
         end
       end
 
diff --git a/quayio-scanner.gemspec b/quayio-scanner.gemspec
index 7176d1c..9620bc1 100644
--- a/quayio-scanner.gemspec
+++ b/quayio-scanner.gemspec
@@ -1,6 +1,4 @@
-# coding: utf-8
-
-lib = File.expand_path('../lib', __FILE__)
+lib = File.expand_path('lib', __dir__)
 $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 require 'quayio/scanner/version'
 
@@ -20,10 +18,11 @@ Gem::Specification.new do |spec|
   spec.executables   = Dir.glob('bin/**/*.rb').map { |file| File.basename(file) }
   spec.require_paths = ['lib']
 
-  spec.add_dependency 'sensu-plugin', '~> 2.1'
   spec.add_dependency 'docker-api', '~> 1.33'
   spec.add_dependency 'rest-client', '~> 2.0'
+  spec.add_dependency 'sensu-plugin', '~> 2.1'
   spec.add_development_dependency 'bundler', '~> 1.14'
   spec.add_development_dependency 'rake', '~> 10.0'
+  spec.add_development_dependency 'rspec', '~> 3.7'
   spec.add_development_dependency 'rubocop', '~> 0.49'
 end