Documentation
¶
Overview ¶
Package osv provides CEL helpers for writing policies over OSV results predicates. OSV data nests findings three levels deep:
(results -> packages -> vulnerabilities)
and encodes severity as CVSS vector strings, which makes raw CEL policies verbose and error-prone. These plugin methods flatten the JSON traversal, expose alias aware id matching, and reuse the AMPEL cvss plugin scorer so authors can write intent-level checks.
Index ¶
- Variables
- type OSVTool
- func (t *OSVTool) CompileOptions() []cel.EnvOption
- func (*OSVTool) ConvertToNative(_ reflect.Type) (any, error)
- func (t *OSVTool) ConvertToType(typeVal ref.Type) ref.Val
- func (*OSVTool) Equal(_ ref.Val) ref.Val
- func (t *OSVTool) Functions() []cel.EnvOption
- func (*OSVTool) ProgramOptions() []cel.ProgramOption
- func (*OSVTool) Type() ref.Type
- func (t *OSVTool) Value() any
- type Plugin
- type TypeAdapter
Constants ¶
This section is empty.
Variables ¶
var Identity = class.MustParseIdentity("osv@v1")
var OSVType = cel.ObjectType("osv", traits.ReceiverType)
OSVType is the CEL receiver type backing the `osv` variable.
Functions ¶
This section is empty.
Types ¶
type OSVTool ¶
type OSVTool struct{}
func (*OSVTool) CompileOptions ¶
func (*OSVTool) Functions ¶
Functions returns the CEL member functions exposed on the `osv` object.
Document-level take an OSV results object or a whole predicate, so both osv.vulns(predicate) and osv.vulns(predicate.data) work:
osv.vulns(data) -> list : every vulnerability, flattened across
results -> packages -> vulnerabilities
osv.ids(data) -> list : the id of every vulnerability
osv.forEcosystem(data, eco) -> list : vulnerabilities in the ecosystem
osv.forPackage(data, name) -> list : vulnerabilities affecting the package
Vulnerability-level (take a single vulnerability from osv.vulns):
osv.aliases(vuln) -> list : a vulnerability's id plus its aliases osv.matchesID(vuln, id) -> bool : true if id equals the vuln's id or alias osv.cvss(vuln) -> double: highest CVSS base score across severities osv.severityLabel(vuln) -> string: qualitative severity (CRITICAL/HIGH/...) osv.isFixed(vuln) -> bool : true if a fixed version is available osv.fixedVersions(vuln) -> list : the versions that fix the vulnerability osv.purl(vuln) -> string: the affected package URL osv.ecosystem(vuln) -> string: the affected package ecosystem osv.references(vuln) -> list : reference URLs
Enriched field provided by original scanners *stored in database_specific) and which default to 0/false/empty when the scanner did not supply the field:
osv.epss(vuln) -> double: EPSS exploitation probability (0..1) osv.risk(vuln) -> double: scanner risk score osv.isKEV(vuln) -> bool : listed in a known-exploited catalog (CISA KEV) osv.cwes(vuln) -> list : associated CWE identifiers
func (*OSVTool) ProgramOptions ¶
func (*OSVTool) ProgramOptions() []cel.ProgramOption
type Plugin ¶
type Plugin struct {
Tool *OSVTool
}
func (*Plugin) Capabilities ¶
func (p *Plugin) Capabilities() []api.Capability
type TypeAdapter ¶
type TypeAdapter struct{}
func (TypeAdapter) NativeToValue ¶
func (TypeAdapter) NativeToValue(value any) ref.Val
Source Files