Vulnerability Scanning on Third Party Deps #36506

sealesj · 2022-09-29T17:28:28Z

Introduce vulnerability scanning github workflow on third party dependencies defined in the DEPS file.

Project details
The main flow of the scanning is the following:
extract third party dependencies outlined in the DEPS file
for each of those dependencies:

check there is a pinned commit hash value
use the corresponding upstream dependency url (found in DEPS file, vars section) to find a commit hash that the mirror dependency has most recently in common
use the above commit hash in common to query the Open Source Vulnerability database for potential vulnerabilities on the dependency
if a vulnerability is found, add the details to a SARIF file
display the SARIF file report on the Flutter Engine "Security" tab
For more details, see the design document link

Resolves b/230824334

Recipe Test:
~~Successful recipe run for test outlined in tests.yaml https://chromium-swarm.appspot.com/task?id=5d7f4dc5008f7810~~
~~Recipe will be added to recipes/engine which will trigger the tests defined in tests.yaml~~
engine/engine_lint recipe updated to ensure that the DEPS file has the correct dependency metadata -- for mirrored deps it is essential to have the upstream repo url in the DEPS file
Successful recipe test: https://chromium-swarm.appspot.com/task?id=5dccb000b2594810

Pre-launch Checklist

I read the Contributor Guide and followed the process outlined there for submitting PRs.
I read the Tree Hygiene wiki page, which explains my responsibilities.
I read and followed the Flutter Style Guide and the C++, Objective-C, Java style guides.
I listed at least one issue that this PR fixes in the description above.
I added new tests to check the change I am making or feature I am adding, or Hixie said the PR is test-exempt. See testing the engine for instructions on
writing and running engine tests.
I updated/added relevant documentation (doc comments with ///).
I signed the CLA.
All existing and new tests are passing.

If you need help, consider asking for advice on the #hackers-new channel on Discord.

…deps-parse-workflow

zanderso

Sorry for the delay. Still hoping for answers to the open questions I had.

sealesj · 2022-11-10T19:23:55Z

Sorry for the delay. Still hoping for answers to the open questions I had.

Apologies, I had several responses I needed to click "submit" for multiple responses

zanderso · 2022-11-10T22:22:47Z

.github/workflows/third_party_scan.yml

@@ -0,0 +1,56 @@
+name: Third party dependency scan


What does "Notify the person who triggered it" mean? I'd prefer a notification, and not anything that could block developers, like a presubmit check. The new test added below should be the only new thing that engine team members need to pay attention to unless there's a vulnerability detected.

DEPS

ci/deps_parser_tests.py

zanderso · 2022-11-10T22:27:48Z

ci/deps_parser_tests.py

+      }
+
+      # Eval the content.
+      exec(deps_content, global_scope_mirror, local_scope_mirror)


Is this resolved?

ci/deps_parser_tests.py

ci/scan_flattened_deps.py

Co-authored-by: Zachary Anderson <[email protected]>

chinmaygarde · 2022-11-17T21:32:47Z

cc @zanderso I believe this is good for another review. All outstanding questions seem to be resolved.

zanderso

This is getting close. Just a couple more comments.

ci/deps_parser.py

ci/scan_flattened_deps.py

skia-gold · 2022-11-22T19:50:29Z

Gold has detected about 1 new digest(s) on patchset 221.
View them at https://flutter-engine-gold.skia.org/cl/github/36506

zanderso

lgtm w/ optional nit

Still not entirely sure I understand how this is going to work in practice, but we can tweak it as we go.

zanderso · 2022-11-22T22:44:53Z

ci/scan_flattened_deps.py

+  # dep[1] contains the mirror's pinned SHA
+  # upstream is the origin repo
+  dep_name = dep[0].split('/')[-1].split('.')[0]
+  if UPSTREAM_PREFIX + dep_name in deps_list:


optional nit: flip the sense, do an early return, then un-indent the try: catch::

if UPSTREAM_PREFIX + dep_name not in deps_list: print('did not find dep: ' + dep_name) return {} try: ... except ...: ... return {}

Thank you for this recommendation! I added this early return.

zanderso · 2022-11-22T22:47:26Z

Looks like the PR needs a rebase to pass presubs.

skia-gold · 2022-11-23T17:50:29Z

Gold has detected about 1 new digest(s) on patchset 222.
View them at https://flutter-engine-gold.skia.org/cl/github/36506

…-scan

…36506)

…115952) * 399fca706 [web] Use generic variable name for trusted url (flutter/engine#37872) * acefe5f11 Vulnerability Scanning on Third Party Deps (flutter/engine#36506) * 8a40e8324 Roll Dart SDK from c32f12ffbef2 to a7d1f804fa27 (1 revision) (flutter/engine#37873)

zanderso · 2022-11-28T15:58:18Z

.github/workflows/third_party_scan.yml

+      - name: setup python
+        uses: actions/setup-python@98f2ad02fd48d057ee3b4d4f66525b231c3e52b6
+        with:
+          python-version: '3.7.7' # install the python version needed


Looks like this is failing https://github.com/flutter/engine/actions/runs/3566233289

…lutter#115952) * 399fca706 [web] Use generic variable name for trusted url (flutter/engine#37872) * acefe5f11 Vulnerability Scanning on Third Party Deps (flutter/engine#36506) * 8a40e8324 Roll Dart SDK from c32f12ffbef2 to a7d1f804fa27 (1 revision) (flutter/engine#37873)

sealesj and others added 30 commits May 13, 2022 12:10

initial flatten deps scan

695f6cc

Merge branch 'main' of github.com:sealesj/engine

fcb67e7

Merge branch 'flutter:main' into deps-parse-workflow

32b64f9

move 3rd party scan to separate action

83f51a3

Merge branch 'deps-parse-workflow' of github.com:sealesj/engine into …

d656f82

…deps-parse-workflow

allow fork to run

54d1e47

install requests

e87e814

use packages

176a213

pip install

0b00a04

rename

75a10e2

Merge branch 'flutter:main' into main

7148f07

conditional vuln report

1bfc9e0

trailing whitespace

4e306c1

trailing whitespace

e17b4af

Merge branch 'flutter:main' into main

5c17623

detailed print

6a78cca

add testing file

dc94c73

Merge branch 'main' of github.com:sealesj/engine

b565c52

Merge branch 'flutter:main' into main

a1c8e47

add upload test sarif

050dbdb

Merge branch 'main' of github.com:sealesj/engine

946b92f

results sarif

25ac959

move sarif

13717a0

upload modified sarif

f89ea8b

test flow

be44799

test with results.sarif

d40fc0d

formatting

05a7a19

test naming convention

5592b92

description with text in artifactLocation

6d228e6

don't use locations

b6d23ad

sealesj requested review from zanderso and removed request for zanderso November 9, 2022 16:18

zanderso reviewed Nov 10, 2022

View reviewed changes

sealesj and others added 5 commits November 10, 2022 18:08

Update ci/deps_parser_tests.py

f33c848

Co-authored-by: Zachary Anderson <[email protected]>

Update ci/deps_parser_tests.py

c49fbd5

Co-authored-by: Zachary Anderson <[email protected]>

more description

e5b5b0f

lint

f49ead5

Merge branch 'osv-scan' of github.com:sealesj/engine into osv-scan

cb1b4f2

zanderso reviewed Nov 22, 2022

View reviewed changes

ci/deps_parser.py Outdated Show resolved Hide resolved

ci/scan_flattened_deps.py Outdated Show resolved Hide resolved

refactor deps file parsing

8aff9ba

zanderso approved these changes Nov 22, 2022

View reviewed changes

sealesj and others added 2 commits November 23, 2022 12:37

early return

39a404e

Merge branch 'flutter:main' into osv-scan

20804a9

sealesj added 2 commits November 23, 2022 12:59

lint

c94df9b

Merge branch 'osv-scan' of https://github.com/sealesj/engine into osv…

6c0ecfe

…-scan

sealesj added the autosubmit Merge PR when tree becomes green via auto submit App label Nov 23, 2022

sealesj merged commit acefe5f into flutter:main Nov 23, 2022

engine-flutter-autoroll mentioned this pull request Nov 23, 2022

Roll Flutter Engine from e74cecbf830e to 8a40e8324b48 (3 revisions) flutter/flutter#115952

Merged

engine-flutter-autoroll added a commit to engine-flutter-autoroll/flutter that referenced this pull request Nov 23, 2022

acefe5f11 Vulnerability Scanning on Third Party Deps (flutter/engine#…

d13740e

…36506)

sealesj deleted the osv-scan branch November 28, 2022 14:44

zanderso reviewed Nov 28, 2022

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Vulnerability Scanning on Third Party Deps #36506

Vulnerability Scanning on Third Party Deps #36506

sealesj commented Sep 29, 2022 •

edited

Loading

zanderso left a comment

sealesj commented Nov 10, 2022 •

edited

Loading

zanderso Nov 10, 2022

zanderso Nov 10, 2022

chinmaygarde commented Nov 17, 2022

zanderso left a comment

skia-gold commented Nov 22, 2022

zanderso left a comment

zanderso Nov 22, 2022

sealesj Nov 23, 2022

zanderso commented Nov 22, 2022

skia-gold commented Nov 23, 2022

zanderso Nov 28, 2022

Vulnerability Scanning on Third Party Deps #36506

Vulnerability Scanning on Third Party Deps #36506

Conversation

sealesj commented Sep 29, 2022 • edited Loading

Pre-launch Checklist

zanderso left a comment

Choose a reason for hiding this comment

sealesj commented Nov 10, 2022 • edited Loading

zanderso Nov 10, 2022

Choose a reason for hiding this comment

zanderso Nov 10, 2022

Choose a reason for hiding this comment

chinmaygarde commented Nov 17, 2022

zanderso left a comment

Choose a reason for hiding this comment

skia-gold commented Nov 22, 2022

zanderso left a comment

Choose a reason for hiding this comment

zanderso Nov 22, 2022

Choose a reason for hiding this comment

sealesj Nov 23, 2022

Choose a reason for hiding this comment

zanderso commented Nov 22, 2022

skia-gold commented Nov 23, 2022

zanderso Nov 28, 2022

Choose a reason for hiding this comment

sealesj commented Sep 29, 2022 •

edited

Loading

sealesj commented Nov 10, 2022 •

edited

Loading