diff --git a/api/src/main/java/com/epam/pipeline/entity/scan/ToolOSVersionExecutionPermit.java b/api/src/main/java/com/epam/pipeline/entity/scan/ToolOSVersionExecutionPermit.java new file mode 100644 index 0000000000..efb1d36973 --- /dev/null +++ b/api/src/main/java/com/epam/pipeline/entity/scan/ToolOSVersionExecutionPermit.java @@ -0,0 +1,32 @@ +/* + * Copyright 2024 EPAM Systems, Inc. (https://www.epam.com/) + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package com.epam.pipeline.entity.scan; + +import lombok.AllArgsConstructor; +import lombok.Getter; + +@Getter +@AllArgsConstructor +public class ToolOSVersionExecutionPermit { + + // true if tool allowed to be executed + private final boolean isAllowed; + + // true if warning should be shown + private final boolean isAllowedWarning; + +} diff --git a/api/src/main/java/com/epam/pipeline/entity/scan/ToolOSVersionView.java b/api/src/main/java/com/epam/pipeline/entity/scan/ToolOSVersionView.java index 0653ef7069..c32ad1dfed 100644 --- a/api/src/main/java/com/epam/pipeline/entity/scan/ToolOSVersionView.java +++ b/api/src/main/java/com/epam/pipeline/entity/scan/ToolOSVersionView.java @@ -24,16 +24,22 @@ public class ToolOSVersionView { private final String distribution; private final String version; private final Boolean isAllowed; + private final Boolean isAllowedWarning; - public ToolOSVersionView(String distribution, String version, Boolean isAllowed) { + public ToolOSVersionView(String distribution, String version, Boolean isAllowed, Boolean isAllowedWarning) { this.distribution = distribution; this.version = version; this.isAllowed = isAllowed; + this.isAllowedWarning = isAllowedWarning; } - public static ToolOSVersionView from(final ToolOSVersion osVersion, final boolean isAllowed) { + public static ToolOSVersionView from(final ToolOSVersion osVersion, + final ToolOSVersionExecutionPermit executionPermit) { return osVersion != null - ? new ToolOSVersionView(osVersion.getDistribution(), osVersion.getVersion(), isAllowed) + ? new ToolOSVersionView( + osVersion.getDistribution(), osVersion.getVersion(), + executionPermit.isAllowed(), executionPermit.isAllowedWarning() + ) : null; } } diff --git a/api/src/main/java/com/epam/pipeline/entity/scan/ToolVersionScanResultView.java b/api/src/main/java/com/epam/pipeline/entity/scan/ToolVersionScanResultView.java index e625543692..517b350940 100644 --- a/api/src/main/java/com/epam/pipeline/entity/scan/ToolVersionScanResultView.java +++ b/api/src/main/java/com/epam/pipeline/entity/scan/ToolVersionScanResultView.java @@ -47,12 +47,13 @@ public class ToolVersionScanResultView { private Integer layersCount; private Map vulnerabilitiesCount; - public static ToolVersionScanResultView from(final ToolVersionScanResult scanResult, final boolean isOSAllowed) { + public static ToolVersionScanResultView from(final ToolVersionScanResult scanResult, + final ToolOSVersionExecutionPermit executionPermit) { return Optional.ofNullable(scanResult).map(scan -> ToolVersionScanResultView.builder() .toolId(scan.getToolId()) .version(scan.getVersion()) - .toolOSVersion(ToolOSVersionView.from(scan.getToolOSVersion(), isOSAllowed)) + .toolOSVersion(ToolOSVersionView.from(scan.getToolOSVersion(), executionPermit)) .status(scan.getStatus()) .scanDate(scan.getScanDate()) .successScanDate(scan.getSuccessScanDate()) diff --git a/api/src/main/java/com/epam/pipeline/manager/docker/scan/AggregatingToolScanManager.java b/api/src/main/java/com/epam/pipeline/manager/docker/scan/AggregatingToolScanManager.java index e9b27ada24..864d531cee 100644 --- a/api/src/main/java/com/epam/pipeline/manager/docker/scan/AggregatingToolScanManager.java +++ b/api/src/main/java/com/epam/pipeline/manager/docker/scan/AggregatingToolScanManager.java @@ -270,7 +270,7 @@ private ToolExecutionCheckStatus checkStatus(final Tool tool, final String tag, LOGGER.debug("Tool: {} version: {} Check tool os version.", tool.getId(), tag); if (toolVersionScanResult.getToolOSVersion() != null - && !toolManager.isToolOSVersionAllowed(toolVersionScanResult.getToolOSVersion())) { + && !toolManager.isToolOSVersionAllowed(toolVersionScanResult.getToolOSVersion()).isAllowed()) { LOGGER.warn("Tool: {} version: {}. Tool os version isn't allowed, check preference {} ! Cancel run.", tool.getId(), tag, SystemPreferences.DOCKER_SECURITY_TOOL_OS.getKey()); return ToolExecutionCheckStatus.fail("This type of OS is not supported."); diff --git a/api/src/main/java/com/epam/pipeline/manager/pipeline/ToolManager.java b/api/src/main/java/com/epam/pipeline/manager/pipeline/ToolManager.java index 02d7df6e10..2549dd6160 100644 --- a/api/src/main/java/com/epam/pipeline/manager/pipeline/ToolManager.java +++ b/api/src/main/java/com/epam/pipeline/manager/pipeline/ToolManager.java @@ -38,6 +38,7 @@ import com.epam.pipeline.entity.pipeline.ToolWithIssuesCount; import com.epam.pipeline.entity.scan.ToolDependency; import com.epam.pipeline.entity.scan.ToolOSVersion; +import com.epam.pipeline.entity.scan.ToolOSVersionExecutionPermit; import com.epam.pipeline.entity.scan.ToolScanResult; import com.epam.pipeline.entity.scan.ToolVersionScanResult; import com.epam.pipeline.entity.scan.ToolVersionScanResultView; @@ -824,14 +825,18 @@ public ToolVersionAttributes loadToolVersionAttributes(final Long toolId, final loadToolVersionAttributes(tool, version); } - public boolean isToolOSVersionAllowed(final ToolOSVersion toolOSVersion) { + public ToolOSVersionExecutionPermit isToolOSVersionAllowed(final ToolOSVersion toolOSVersion) { final String allowedOSes = preferenceManager.getPreference(SystemPreferences.DOCKER_SECURITY_TOOL_OS); final String allowedWithWarningOSes = preferenceManager.getPreference( SystemPreferences.DOCKER_SECURITY_TOOL_OS_WITH_WARNING); + boolean allowedWithWarning = toolOSVersion != null && toolOSVersion.isMatched(allowedWithWarningOSes); if (StringUtils.isEmpty(allowedOSes) || toolOSVersion == null) { - return true; + return new ToolOSVersionExecutionPermit(true, allowedWithWarning); } - return toolOSVersion.isMatched(allowedOSes) || toolOSVersion.isMatched(allowedWithWarningOSes); + return new ToolOSVersionExecutionPermit( + toolOSVersion.isMatched(allowedOSes) || allowedWithWarning, + allowedWithWarning + ); } /** diff --git a/api/src/main/java/com/epam/pipeline/manager/preference/SystemPreferences.java b/api/src/main/java/com/epam/pipeline/manager/preference/SystemPreferences.java index 423751395c..5960dc10f7 100644 --- a/api/src/main/java/com/epam/pipeline/manager/preference/SystemPreferences.java +++ b/api/src/main/java/com/epam/pipeline/manager/preference/SystemPreferences.java @@ -963,6 +963,8 @@ public class SystemPreferences { public static final ObjectPreference> UI_RUNS_TAGS = new ObjectPreference<>( "ui.runs.tags", Collections.emptyList(), new TypeReference>() {}, UI_GROUP, isNullOrValidJson(new TypeReference>() {}), true); + public static final StringPreference UI_TOOLS_OS_WITH_WARNING = new StringPreference("ui.tools.os.with.warning", + "", UI_GROUP, pass, true); // Facet Filters public static final ObjectPreference> FACETED_FILTER_DICT = new ObjectPreference<>( diff --git a/api/src/test/java/com/epam/pipeline/manager/docker/scan/AggregatingToolScanManagerTest.java b/api/src/test/java/com/epam/pipeline/manager/docker/scan/AggregatingToolScanManagerTest.java index 949c8e11a7..3e4900414a 100644 --- a/api/src/test/java/com/epam/pipeline/manager/docker/scan/AggregatingToolScanManagerTest.java +++ b/api/src/test/java/com/epam/pipeline/manager/docker/scan/AggregatingToolScanManagerTest.java @@ -455,6 +455,10 @@ public void testAllowOnAllowedOSVersion() { TestUtils.generateScanResult(MAX_CRITICAL_VULNERABILITIES, MAX_HIGH_VULNERABILITIES, ONE, toolScanResult, new ToolOSVersion(CENTOS_OS, "7")); Assert.assertTrue(aggregatingToolScanManager.checkTool(testTool, LATEST_VERSION).isAllowed()); + final ToolOSVersionExecutionPermit executionPermit = toolManager.isToolOSVersionAllowed( + ToolOSVersion.builder().distribution(CENTOS_OS).version("7").build()); + Assert.assertTrue(executionPermit.isAllowed()); + Assert.assertFalse(executionPermit.isAllowedWarning()); } @Test @@ -466,6 +470,10 @@ public void testAllowOnAllowedOSInToolOsWithWarning() { TestUtils.generateScanResult(0, 0, ONE, toolScanResult, new ToolOSVersion(UBUNTU_OS, "14")); Assert.assertTrue(aggregatingToolScanManager.checkTool(testTool, LATEST_VERSION).isAllowed()); + final ToolOSVersionExecutionPermit executionPermit = toolManager.isToolOSVersionAllowed( + ToolOSVersion.builder().distribution(UBUNTU_OS).version("14").build()); + Assert.assertTrue(executionPermit.isAllowed()); + Assert.assertTrue(executionPermit.isAllowedWarning()); } @Test @@ -475,6 +483,10 @@ public void testAllowIfAllowedOSsIsEmpty() { TestUtils.generateScanResult(0, 0, ONE, toolScanResult, new ToolOSVersion(UBUNTU_OS, "14")); Assert.assertTrue(aggregatingToolScanManager.checkTool(testTool, LATEST_VERSION).isAllowed()); + final ToolOSVersionExecutionPermit executionPermit = toolManager.isToolOSVersionAllowed( + ToolOSVersion.builder().distribution(UBUNTU_OS).version("14").build()); + Assert.assertTrue(executionPermit.isAllowed()); + Assert.assertTrue(executionPermit.isAllowedWarning()); } @Test @@ -486,6 +498,21 @@ public void testAllowIfAllowedOSsIsEmptyAndAllowedOSesWithWarningDoesntAllow() { Assert.assertTrue(aggregatingToolScanManager.checkTool(testTool, LATEST_VERSION).isAllowed()); } + @Test + public void testAllowAndWarnIfBothAllowedOSAndAllowedOSWithWarningMatched() { + when(preferenceManager.getPreference(SystemPreferences.DOCKER_SECURITY_TOOL_OS)) + .thenReturn(UBUNTU_OS); + when(preferenceManager.getPreference(SystemPreferences.DOCKER_SECURITY_TOOL_OS_WITH_WARNING)) + .thenReturn(UBUNTU_OS); + TestUtils.generateScanResult(0, 0, + ONE, toolScanResult, new ToolOSVersion(UBUNTU_OS, "14")); + Assert.assertTrue(aggregatingToolScanManager.checkTool(testTool, LATEST_VERSION).isAllowed()); + final ToolOSVersionExecutionPermit executionPermit = toolManager.isToolOSVersionAllowed( + ToolOSVersion.builder().distribution(UBUNTU_OS).version("14").build()); + Assert.assertTrue(executionPermit.isAllowed()); + Assert.assertTrue(executionPermit.isAllowedWarning()); + } + @Test public void testDenyOnHigh() { TestUtils.generateScanResult(MAX_CRITICAL_VULNERABILITIES, MAX_HIGH_VULNERABILITIES + ONE,