vulnerability

package
v2.10.2 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 5, 2026 License: BSD-3-Clause Imports: 50 Imported by: 0

Documentation

Overview

Package vulnerability owns vulnerability scanning, persistence, and HTTP routes.

Index

Constants

View Source
const (
	ScanStatusPending   = "pending"
	ScanStatusScanning  = "scanning"
	ScanStatusCompleted = "completed"
	ScanStatusFailed    = "failed"
)

Scan status constants

Variables

This section is empty.

Functions

func RegisterVulnerability

func RegisterVulnerability(api huma.API, vulnerabilityService *VulnerabilityService, appCtx handlerutil.ActivityAppContext)

RegisterVulnerability registers vulnerability scanning routes using Huma.

Types

type GetEnvironmentSummaryInput

type GetEnvironmentSummaryInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
}

type GetScanResultInput

type GetScanResultInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	ImageID       string `path:"imageId" doc:"Image ID"`
}

type GetScanSummariesInput

type GetScanSummariesInput struct {
	EnvironmentID string                             `path:"id" doc:"Environment ID"`
	Body          vulnerability.ScanSummariesRequest `doc:"Batch scan summary request"`
}

type GetScanSummaryInput

type GetScanSummaryInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	ImageID       string `path:"imageId" doc:"Image ID"`
}

type GetScannerStatusInput

type GetScannerStatusInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
}

type IgnoreVulnerabilityInput

type IgnoreVulnerabilityInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	Body          vulnerability.IgnorePayload
}

type ListAllVulnerabilitiesInput

type ListAllVulnerabilitiesInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	Search        string `query:"search" doc:"Search query"`
	Sort          string `query:"sort" doc:"Sort field"`
	Order         string `query:"order" doc:"Sort order"`
	Start         int    `query:"start" doc:"Start offset"`
	Limit         int    `query:"limit" doc:"Limit"`

	Severity  string `query:"severity" doc:"Comma-separated severity filter"`
	ImageName string `query:"imageName" doc:"Filter by image/repo name (substring)"`
	Ignored   bool   `query:"ignored" doc:"Show only ignored vulnerabilities instead of active ones"`
}

type ListAllVulnerabilityImageOptionsInput

type ListAllVulnerabilityImageOptionsInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	Severity      string `query:"severity" doc:"Comma-separated severity filter"`
}

type ListIgnoredVulnerabilitiesInput

type ListIgnoredVulnerabilitiesInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	Search        string `query:"search" doc:"Search query"`
	Sort          string `query:"sort" doc:"Sort field"`
	Order         string `query:"order" doc:"Sort order"`
	Start         int    `query:"start" doc:"Start offset"`
	Limit         int    `query:"limit" doc:"Limit"`
}

type ListImageVulnerabilitiesInput

type ListImageVulnerabilitiesInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	ImageID       string `path:"imageId" doc:"Image ID"`
	Search        string `query:"search" doc:"Search query"`
	Sort          string `query:"sort" doc:"Sort field"`
	Order         string `query:"order" doc:"Sort order"`
	Start         int    `query:"start" doc:"Start offset"`
	Limit         int    `query:"limit" doc:"Limit"`

	Severity string `query:"severity" doc:"Comma-separated severity filter"`
}

type Module

type Module struct {
	// contains filtered or unexported fields
}

func New

func New(service *VulnerabilityService) *Module

func (*Module) RegisterRoutes

func (m *Module) RegisterRoutes(api huma.API, appCtx handlerutil.ActivityAppContext)

func (*Module) Service

func (m *Module) Service() *VulnerabilityService

type ScanImageInput

type ScanImageInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	ImageID       string `path:"imageId" doc:"Image ID to scan"`
}

type ScannerStatus

type ScannerStatus struct {
	// Available indicates if the vulnerability scanner (Trivy) is available
	Available bool `json:"available"`

	// Version is the version of the scanner if available
	Version string `json:"version,omitempty"`
}

type UnignoreVulnerabilityInput

type UnignoreVulnerabilityInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	IgnoreID      string `path:"ignoreId" doc:"Ignore record ID"`
}

type VulnerabilityHandler

type VulnerabilityHandler struct {
	// contains filtered or unexported fields
}

VulnerabilityHandler provides Huma-based vulnerability scanning endpoints.

func (*VulnerabilityHandler) GetEnvironmentSummary

GetEnvironmentSummary returns aggregated vulnerability info for the current environment.

func (*VulnerabilityHandler) GetScanResult

GetScanResult retrieves the vulnerability scan result for an image.

func (*VulnerabilityHandler) GetScanSummaries

GetScanSummaries retrieves scan summaries for a list of image IDs.

func (*VulnerabilityHandler) GetScanSummary

GetScanSummary retrieves just the vulnerability summary for an image.

func (*VulnerabilityHandler) GetScannerStatus

GetScannerStatus checks if the vulnerability scanner is available.

func (*VulnerabilityHandler) IgnoreVulnerability

IgnoreVulnerability creates an ignore record for a vulnerability.

func (*VulnerabilityHandler) ListAllVulnerabilities

ListAllVulnerabilities returns a paginated list of vulnerabilities across all images.

func (*VulnerabilityHandler) ListAllVulnerabilityImageOptions

func (h *VulnerabilityHandler) ListAllVulnerabilityImageOptions(ctx context.Context, input *ListAllVulnerabilityImageOptionsInput) (*handlerutil.Out[[]string], error)

ListAllVulnerabilityImageOptions returns available image options for vulnerability filtering.

func (*VulnerabilityHandler) ListIgnoredVulnerabilities

ListIgnoredVulnerabilities returns a list of ignored vulnerabilities.

func (*VulnerabilityHandler) ListImageVulnerabilities

ListImageVulnerabilities returns a paginated list of vulnerabilities for an image.

func (*VulnerabilityHandler) ScanImage

ScanImage initiates a vulnerability scan for an image.

func (*VulnerabilityHandler) UnignoreVulnerability

func (h *VulnerabilityHandler) UnignoreVulnerability(ctx context.Context, input *UnignoreVulnerabilityInput) (*handlerutil.Out[struct{}], error)

UnignoreVulnerability removes an ignore record for a vulnerability.

type VulnerabilityIgnore added in v2.8.1

type VulnerabilityIgnore struct {
	// ID is the unique identifier for this ignore record
	ID string `json:"id" gorm:"primaryKey;type:text"`

	// EnvironmentID is the environment where this ignore applies
	EnvironmentID string `json:"environmentId" gorm:"column:environment_id;index"`

	// ImageID is the Docker image ID
	ImageID string `json:"imageId" gorm:"column:image_id;index"`

	// VulnerabilityID is the CVE or vulnerability identifier (e.g., CVE-2023-1234)
	VulnerabilityID string `json:"vulnerabilityId" gorm:"column:vulnerability_id;index"`

	// PkgName is the package name containing the vulnerability
	PkgName string `json:"pkgName" gorm:"column:pkg_name"`

	// InstalledVersion is the version of the package with the vulnerability
	InstalledVersion string `json:"installedVersion" gorm:"column:installed_version"`

	// Reason is an optional reason for ignoring this vulnerability
	Reason *string `json:"reason,omitempty" gorm:"column:reason"`

	// CreatedBy is the user ID who created this ignore record
	CreatedBy string `json:"createdBy" gorm:"column:created_by"`

	// CreatedAt is when this ignore record was created
	CreatedAt time.Time `json:"createdAt" gorm:"column:created_at"`
}

VulnerabilityIgnore stores ignored vulnerability records

func (*VulnerabilityIgnore) BeforeCreate added in v2.8.1

func (v *VulnerabilityIgnore) BeforeCreate(db *gorm.DB) error

BeforeCreate sets the ID and CreatedAt before inserting

func (*VulnerabilityIgnore) CompositeKey added in v2.8.1

func (v *VulnerabilityIgnore) CompositeKey() string

CompositeKey generates a composite key for deduplication. This helps prevent duplicate ignore records for the same vulnerability.

func (*VulnerabilityIgnore) TableName added in v2.8.1

func (v *VulnerabilityIgnore) TableName() string

type VulnerabilityReportRecord added in v2.10.0

type VulnerabilityReportRecord struct {
	ImageID   string     `json:"imageId" gorm:"column:image_id;primaryKey;type:text"`
	Data      string     `json:"-" gorm:"column:data;type:text"`
	CreatedAt time.Time  `json:"createdAt" gorm:"column:created_at"`
	UpdatedAt *time.Time `json:"updatedAt,omitempty" gorm:"column:updated_at"`
}

VulnerabilityReportRecord stores the raw Trivy JSON report used for report-based image patching, one row per image, replaced on rescan.

func (VulnerabilityReportRecord) TableName added in v2.10.0

func (VulnerabilityReportRecord) TableName() string

type VulnerabilityScanItem added in v2.10.2

type VulnerabilityScanItem struct {
	ID               int64   `json:"id" gorm:"primaryKey;autoIncrement;column:id"`
	ImageID          string  `json:"imageId" gorm:"column:image_id;index"`
	VulnerabilityID  string  `json:"vulnerabilityId" gorm:"column:vulnerability_id;index"`
	PkgName          string  `json:"pkgName" gorm:"column:pkg_name"`
	InstalledVersion string  `json:"installedVersion" gorm:"column:installed_version"`
	FixedVersion     string  `json:"fixedVersion" gorm:"column:fixed_version"`
	Severity         string  `json:"severity" gorm:"column:severity;index"`
	SeverityRank     int     `json:"severityRank" gorm:"column:severity_rank"`
	PkgClass         string  `json:"pkgClass" gorm:"column:pkg_class"`
	PkgType          string  `json:"pkgType" gorm:"column:pkg_type"`
	Title            string  `json:"title" gorm:"column:title"`
	Details          *string `json:"-" gorm:"column:details"`
}

VulnerabilityScanItem is one CVE finding from a completed scan, normalized for list queries.

func (VulnerabilityScanItem) TableName added in v2.10.2

func (VulnerabilityScanItem) TableName() string

type VulnerabilityScanRecord added in v2.8.1

type VulnerabilityScanRecord struct {
	database.BaseModel

	// ImageID is the Docker image ID (primary key)
	ID string `json:"id" gorm:"primaryKey;type:text"`

	// ImageName is the image name with tag (e.g., nginx:latest)
	ImageName string `json:"imageName" gorm:"column:image_name" sortable:"true"`

	// Status is the status of the scan (pending, scanning, completed, failed)
	Status string `json:"status" gorm:"column:status"`

	// ScanTime is the timestamp when the scan was performed
	ScanTime time.Time `json:"scanTime" gorm:"column:scan_time" sortable:"true"`

	// Duration is the duration of the scan in milliseconds
	Duration int64 `json:"duration" gorm:"column:duration"`

	// Total vulnerability counts by severity
	CriticalCount int `json:"criticalCount" gorm:"column:critical_count"`
	HighCount     int `json:"highCount" gorm:"column:high_count"`
	MediumCount   int `json:"mediumCount" gorm:"column:medium_count"`
	LowCount      int `json:"lowCount" gorm:"column:low_count"`
	UnknownCount  int `json:"unknownCount" gorm:"column:unknown_count"`
	TotalCount    int `json:"totalCount" gorm:"column:total_count"`

	// Vulnerabilities stores the JSON encoded vulnerabilities list
	Vulnerabilities database.StringSlice `json:"vulnerabilities" gorm:"column:vulnerabilities;type:text"`

	// Error contains the error message if the scan failed
	Error *string `json:"error,omitempty" gorm:"column:error"`

	// ScannerVersion is the version of the scanner used
	ScannerVersion string `json:"scannerVersion" gorm:"column:scanner_version"`

	// FixableCount is the number of vulnerabilities with a known fix, stored at
	// scan time so image patching can query it without parsing the JSON blob.
	// NULL on records written before the column existed.
	FixableCount *int `json:"fixableCount,omitempty" gorm:"column:fixable_count" sortable:"true"`

	ScanPolicy string `json:"-" gorm:"column:scan_policy"`
}

VulnerabilityScanRecord stores vulnerability scan results for images

func (*VulnerabilityScanRecord) GetHighestSeverity added in v2.8.1

func (v *VulnerabilityScanRecord) GetHighestSeverity() string

GetHighestSeverity returns the highest severity level found

func (*VulnerabilityScanRecord) GetTotalVulnerabilities added in v2.8.1

func (v *VulnerabilityScanRecord) GetTotalVulnerabilities() int

GetTotalVulnerabilities returns the total count of vulnerabilities

func (*VulnerabilityScanRecord) IsCompleted added in v2.8.1

func (v *VulnerabilityScanRecord) IsCompleted() bool

IsCompleted returns true if the scan has completed

func (*VulnerabilityScanRecord) IsFailed added in v2.8.1

func (v *VulnerabilityScanRecord) IsFailed() bool

IsFailed returns true if the scan has failed

func (*VulnerabilityScanRecord) IsScanning added in v2.8.1

func (v *VulnerabilityScanRecord) IsScanning() bool

IsScanning returns true if the scan is in progress

func (*VulnerabilityScanRecord) TableName added in v2.8.1

func (v *VulnerabilityScanRecord) TableName() string

type VulnerabilityService

type VulnerabilityService struct {
	// contains filtered or unexported fields
}

VulnerabilityService handles vulnerability scanning of container images

func NewVulnerabilityService

func NewVulnerabilityService(db *database.DB, dockerService *docker.DockerClientService, eventService *event.EventService, settingsService *settings.SettingsService, notificationService *notification.NotificationService, activityService *activity.ActivityService, registryService *registry.ContainerRegistryService) *VulnerabilityService

NewVulnerabilityService creates a new VulnerabilityService instance

func (*VulnerabilityService) ActionableCountExcludingIgnored

func (s *VulnerabilityService) ActionableCountExcludingIgnored(ctx context.Context) (int, error)

ActionableCountExcludingIgnored counts critical and high severity vulnerabilities across all completed scans, excluding any that have been ignored. This is used by the dashboard to show an accurate action item count that reflects ignore decisions.

Without ignore records the count comes from the indexed critical_count/ high_count columns; with ignore records it is a single COUNT over the per-CVE item rows.

func (*VulnerabilityService) BackfillScanItems added in v2.10.2

func (s *VulnerabilityService) BackfillScanItems(ctx context.Context)

BackfillScanItems populates vulnerability_scan_items for completed scans recorded before the table existed. Idempotent; failures are logged and never block startup.

func (*VulnerabilityService) CleanupOrphanedScanRecords

func (s *VulnerabilityService) CleanupOrphanedScanRecords(ctx context.Context) (deleted int64, err error)

CleanupOrphanedScanRecords removes vulnerability scan records for images that no longer exist in Docker. This keeps "images scanned" counts in sync (e.g. avoids "5/3" when images were deleted after being scanned). Safe to call even when no images exist; returns the number of records deleted.

func (*VulnerabilityService) DeleteScanResult

func (s *VulnerabilityService) DeleteScanResult(ctx context.Context, imageID string) error

DeleteScanResult deletes the scan result for an image

func (*VulnerabilityService) DeleteScanResultsByImageIDs

func (s *VulnerabilityService) DeleteScanResultsByImageIDs(ctx context.Context, imageIDs []string) error

DeleteScanResultsByImageIDs deletes scan results for multiple images in one query.

func (*VulnerabilityService) GetEnvironmentSummary

GetEnvironmentSummary returns aggregated vulnerability counts across all images.

func (*VulnerabilityService) GetIgnoreRecordsForImage

func (s *VulnerabilityService) GetIgnoreRecordsForImage(ctx context.Context, envID string, imageID string) ([]VulnerabilityIgnore, error)

GetIgnoreRecordsForImage retrieves all ignore records for a specific image

func (*VulnerabilityService) GetScanResult

func (s *VulnerabilityService) GetScanResult(ctx context.Context, imageID string) (*vulnerability.ScanResult, error)

GetScanResult retrieves the most recent scan result for an image

func (*VulnerabilityService) GetScanSummariesByImageIDs

func (s *VulnerabilityService) GetScanSummariesByImageIDs(ctx context.Context, imageIDs []string) (map[string]*vulnerability.ScanSummary, error)

GetScanSummariesByImageIDs retrieves scan summaries for multiple images

func (*VulnerabilityService) GetScanSummary

func (s *VulnerabilityService) GetScanSummary(ctx context.Context, imageID string) (*vulnerability.ScanSummary, error)

GetScanSummary retrieves just the summary for an image (for list views)

func (*VulnerabilityService) GetTrivyVersion

func (s *VulnerabilityService) GetTrivyVersion(ctx context.Context) string

GetTrivyVersion returns the Trivy version from the configured scanner image.

func (*VulnerabilityService) IgnoreVulnerability

func (s *VulnerabilityService) IgnoreVulnerability(ctx context.Context, envID string, payload *vulnerability.IgnorePayload) (*VulnerabilityIgnore, error)

IgnoreVulnerability creates a new ignore record for a vulnerability

func (*VulnerabilityService) ImportLegacyReportFiles added in v2.10.0

func (s *VulnerabilityService) ImportLegacyReportFiles(ctx context.Context)

ImportLegacyReportFiles moves raw Trivy report files written by older versions into the vulnerability_reports table, backfilling missing fixable counts, then removes the on-disk report directory. No-op once imported; failures are logged and never block startup.

func (*VulnerabilityService) ListAllVulnerabilities

ListAllVulnerabilities returns a paginated list of vulnerabilities across all scanned images.

func (*VulnerabilityService) ListAllVulnerabilityImageOptions

func (s *VulnerabilityService) ListAllVulnerabilityImageOptions(ctx context.Context, severityFilter string) ([]string, error)

ListAllVulnerabilityImageOptions returns unique image names (or image IDs when name is empty) for vulnerability filtering, optionally constrained by severity.

func (*VulnerabilityService) ListIgnoredVulnerabilities

ListIgnoredVulnerabilities returns a list of ignored vulnerabilities for an environment

func (*VulnerabilityService) ListVulnerabilities

ListVulnerabilities returns a paginated, filtered list of vulnerabilities for an image.

func (*VulnerabilityService) ScanAllImages

func (s *VulnerabilityService) ScanAllImages(ctx context.Context, envID string, user common.User, force bool) (scanned, failed int, err error)

ScanAllImages scans all Docker images for vulnerabilities. It is intended for use by the scheduled vulnerability scan job. A single long-running Trivy container is created and reused for every image via docker exec, which avoids the overhead of creating/destroying a container per scan. The caller-supplied user is recorded in the event log.

func (*VulnerabilityService) ScanImage

func (s *VulnerabilityService) ScanImage(ctx context.Context, envID string, imageID string, user common.User) (*vulnerability.ScanResult, error)

ScanImage scans an image for vulnerabilities using Trivy

func (*VulnerabilityService) UnignoreVulnerability

func (s *VulnerabilityService) UnignoreVulnerability(ctx context.Context, envID string, ignoreID string) error

UnignoreVulnerability removes an ignore record

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL