Upstream
/
harbor
mirror of https://github.com/goharbor/harbor.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Remove validation for item in CVE whitelist 

To contain various vulnerabilities in the CVE whitelist, this commit
removes the validation.
Fixes #9242

Signed-off-by: Daniel Jiang <jiangd@vmware.com>
This commit is contained in:
Daniel Jiang 2019-10-17 00:54:37 +08:00
parent 8d65bd6da7
commit 1a9cebd5e8
3 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/core/api/sys_cve_whitelist_test.go
View File

@ -115,6 +115,7 @@ func TestSysCVEWhitelistAPIPut(t *testing.T) {
ExpiresAt: &s,
Items: []models.CVEWhitelistItem{
{CVEID: "CVE-2019-12310"},
{CVEID: "RHSA-2019:2237"},
},
},
credential: sysAdmin,

10
src/pkg/scan/whitelist/validator.go
View File

@ -17,7 +17,6 @@ package whitelist
import (
"fmt"
"github.com/goharbor/harbor/src/common/models"
"regexp"
)
type invalidErr struct {
@ -46,11 +45,12 @@ const cveIDPattern = `^CVE-\d{4}-\d+$`
// Validate help validates the CVE whitelist, to ensure the CVE ID is valid and there's no duplication
func Validate(wl models.CVEWhitelist) error {
m := map[string]struct{}{}
re := regexp.MustCompile(cveIDPattern)
// re := regexp.MustCompile(cveIDPattern)
for _, it := range wl.Items {
if !re.MatchString(it.CVEID) {
return &invalidErr{fmt.Sprintf("invalid CVE ID: %s", it.CVEID)}
}
// Bypass the cve format checking
// if !re.MatchString(it.CVEID) {
// return &invalidErr{fmt.Sprintf("invalid CVE ID: %s", it.CVEID)}
// }
if _, ok := m[it.CVEID]; ok {
return &invalidErr{fmt.Sprintf("duplicate CVE ID in whitelist: %s", it.CVEID)}
}

1
src/pkg/scan/whitelist/validator_test.go
View File

@ -67,6 +67,7 @@ func TestValidate(t *testing.T) {
l: models.CVEWhitelist{
Items: []models.CVEWhitelistItem{
{CVEID: "breakit"},
{CVEID: "breakit"},
},
},
noError: false,