vulnerability

package
v2.8.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 13, 2026 License: BSD-3-Clause Imports: 44 Imported by: 0

Documentation

Overview

Package vulnerability owns vulnerability scanning, persistence, and HTTP routes.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func RegisterVulnerability 

func RegisterVulnerability(api huma.API, vulnerabilityService *VulnerabilityService, appCtx handlerutil.ActivityAppContext)

RegisterVulnerability registers vulnerability scanning routes using Huma.

Types

type GetEnvironmentSummaryInput 

type GetEnvironmentSummaryInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
}

type GetEnvironmentSummaryOutput 

type GetEnvironmentSummaryOutput struct {
	Body base.ApiResponse[vulnerability.EnvironmentVulnerabilitySummary]
}

type GetScanResultInput 

type GetScanResultInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	ImageID       string `path:"imageId" doc:"Image ID"`
}

type GetScanResultOutput 

type GetScanResultOutput struct {
	Body base.ApiResponse[vulnerability.ScanResult]
}

type GetScanSummariesInput 

type GetScanSummariesInput struct {
	EnvironmentID string                             `path:"id" doc:"Environment ID"`
	Body          vulnerability.ScanSummariesRequest `doc:"Batch scan summary request"`
}

type GetScanSummariesOutput 

type GetScanSummariesOutput struct {
	Body base.ApiResponse[vulnerability.ScanSummariesResponse]
}

type GetScanSummaryInput 

type GetScanSummaryInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	ImageID       string `path:"imageId" doc:"Image ID"`
}

type GetScanSummaryOutput 

type GetScanSummaryOutput struct {
	Body base.ApiResponse[vulnerability.ScanSummary]
}

type GetScannerStatusInput 

type GetScannerStatusInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
}

type GetScannerStatusOutput 

type GetScannerStatusOutput struct {
	Body base.ApiResponse[ScannerStatus]
}

type IgnoreVulnerabilityInput 

type IgnoreVulnerabilityInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	Body          vulnerability.IgnorePayload
}

type IgnoreVulnerabilityOutput 

type IgnoreVulnerabilityOutput struct {
	Body base.ApiResponse[vulnerability.IgnoredVulnerability]
}

type ListAllVulnerabilitiesInput 

type ListAllVulnerabilitiesInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	Search        string `query:"search" doc:"Search query"`
	Sort          string `query:"sort" doc:"Sort field"`
	Order         string `query:"order" doc:"Sort order"`
	Start         int    `query:"start" doc:"Start offset"`
	Limit         int    `query:"limit" doc:"Limit"`

	Severity  string `query:"severity" doc:"Comma-separated severity filter"`
	ImageName string `query:"imageName" doc:"Filter by image/repo name (substring)"`
}

type ListAllVulnerabilitiesOutput 

type ListAllVulnerabilitiesOutput struct {
	Body base.Paginated[vulnerability.VulnerabilityWithImage]
}

type ListAllVulnerabilityImageOptionsInput 

type ListAllVulnerabilityImageOptionsInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	Severity      string `query:"severity" doc:"Comma-separated severity filter"`
}

type ListAllVulnerabilityImageOptionsOutput 

type ListAllVulnerabilityImageOptionsOutput struct {
	Body base.ApiResponse[[]string]
}

type ListIgnoredVulnerabilitiesInput 

type ListIgnoredVulnerabilitiesInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	Search        string `query:"search" doc:"Search query"`
	Sort          string `query:"sort" doc:"Sort field"`
	Order         string `query:"order" doc:"Sort order"`
	Start         int    `query:"start" doc:"Start offset"`
	Limit         int    `query:"limit" doc:"Limit"`
}

type ListIgnoredVulnerabilitiesOutput 

type ListIgnoredVulnerabilitiesOutput struct {
	Body base.Paginated[vulnerability.IgnoredVulnerability]
}

type ListImageVulnerabilitiesInput 

type ListImageVulnerabilitiesInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	ImageID       string `path:"imageId" doc:"Image ID"`
	Search        string `query:"search" doc:"Search query"`
	Sort          string `query:"sort" doc:"Sort field"`
	Order         string `query:"order" doc:"Sort order"`
	Start         int    `query:"start" doc:"Start offset"`
	Limit         int    `query:"limit" doc:"Limit"`

	Severity string `query:"severity" doc:"Comma-separated severity filter"`
}

type ListImageVulnerabilitiesOutput 

type ListImageVulnerabilitiesOutput struct {
	Body base.Paginated[vulnerability.Vulnerability]
}

type Module 

type Module struct {
	// contains filtered or unexported fields
}

func New 

func New(service *VulnerabilityService) *Module

func (*Module) RegisterRoutes 

func (m *Module) RegisterRoutes(api huma.API, appCtx handlerutil.ActivityAppContext)

func (*Module) Service 

func (m *Module) Service() *VulnerabilityService

type ScanImageInput 

type ScanImageInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	ImageID       string `path:"imageId" doc:"Image ID to scan"`
}

type ScanImageOutput 

type ScanImageOutput struct {
	Body base.ApiResponse[vulnerability.ScanResult]
}

type ScannerStatus 

type ScannerStatus struct {
	// Available indicates if the vulnerability scanner (Trivy) is available
	Available bool `json:"available"`

	// Version is the version of the scanner if available
	Version string `json:"version,omitempty"`
}

type UnignoreVulnerabilityInput 

type UnignoreVulnerabilityInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	IgnoreID      string `path:"ignoreId" doc:"Ignore record ID"`
}

type UnignoreVulnerabilityOutput 

type UnignoreVulnerabilityOutput struct {
	Body base.ApiResponse[struct{}]
}

type VulnerabilityHandler 

type VulnerabilityHandler struct {
	// contains filtered or unexported fields
}

VulnerabilityHandler provides Huma-based vulnerability scanning endpoints.

func (*VulnerabilityHandler) GetEnvironmentSummary 

func (h *VulnerabilityHandler) GetEnvironmentSummary(ctx context.Context, input *GetEnvironmentSummaryInput) (*GetEnvironmentSummaryOutput, error)

GetEnvironmentSummary returns aggregated vulnerability info for the current environment.

func (*VulnerabilityHandler) GetScanResult 

func (h *VulnerabilityHandler) GetScanResult(ctx context.Context, input *GetScanResultInput) (*GetScanResultOutput, error)

GetScanResult retrieves the vulnerability scan result for an image.

func (*VulnerabilityHandler) GetScanSummaries 

func (h *VulnerabilityHandler) GetScanSummaries(ctx context.Context, input *GetScanSummariesInput) (*GetScanSummariesOutput, error)

GetScanSummaries retrieves scan summaries for a list of image IDs.

func (*VulnerabilityHandler) GetScanSummary 

func (h *VulnerabilityHandler) GetScanSummary(ctx context.Context, input *GetScanSummaryInput) (*GetScanSummaryOutput, error)

GetScanSummary retrieves just the vulnerability summary for an image.

func (*VulnerabilityHandler) GetScannerStatus 

func (h *VulnerabilityHandler) GetScannerStatus(ctx context.Context, input *GetScannerStatusInput) (*GetScannerStatusOutput, error)

GetScannerStatus checks if the vulnerability scanner is available.

func (*VulnerabilityHandler) IgnoreVulnerability 

func (h *VulnerabilityHandler) IgnoreVulnerability(ctx context.Context, input *IgnoreVulnerabilityInput) (*IgnoreVulnerabilityOutput, error)

IgnoreVulnerability creates an ignore record for a vulnerability.

func (*VulnerabilityHandler) ListAllVulnerabilities 

func (h *VulnerabilityHandler) ListAllVulnerabilities(ctx context.Context, input *ListAllVulnerabilitiesInput) (*ListAllVulnerabilitiesOutput, error)

ListAllVulnerabilities returns a paginated list of vulnerabilities across all images.

func (*VulnerabilityHandler) ListAllVulnerabilityImageOptions 

func (h *VulnerabilityHandler) ListAllVulnerabilityImageOptions(ctx context.Context, input *ListAllVulnerabilityImageOptionsInput) (*ListAllVulnerabilityImageOptionsOutput, error)

ListAllVulnerabilityImageOptions returns available image options for vulnerability filtering.

func (*VulnerabilityHandler) ListIgnoredVulnerabilities 

func (h *VulnerabilityHandler) ListIgnoredVulnerabilities(ctx context.Context, input *ListIgnoredVulnerabilitiesInput) (*ListIgnoredVulnerabilitiesOutput, error)

ListIgnoredVulnerabilities returns a list of ignored vulnerabilities.

func (*VulnerabilityHandler) ListImageVulnerabilities 

func (h *VulnerabilityHandler) ListImageVulnerabilities(ctx context.Context, input *ListImageVulnerabilitiesInput) (*ListImageVulnerabilitiesOutput, error)

ListImageVulnerabilities returns a paginated list of vulnerabilities for an image.

func (*VulnerabilityHandler) ScanImage 

func (h *VulnerabilityHandler) ScanImage(ctx context.Context, input *ScanImageInput) (*ScanImageOutput, error)

ScanImage initiates a vulnerability scan for an image.

func (*VulnerabilityHandler) UnignoreVulnerability 

func (h *VulnerabilityHandler) UnignoreVulnerability(ctx context.Context, input *UnignoreVulnerabilityInput) (*UnignoreVulnerabilityOutput, error)

UnignoreVulnerability removes an ignore record for a vulnerability.

type VulnerabilityService 

type VulnerabilityService struct {
	// contains filtered or unexported fields
}

VulnerabilityService handles vulnerability scanning of container images

func NewVulnerabilityService 

func NewVulnerabilityService(db *database.DB, dockerService *docker.DockerClientService, eventService *event.EventService, settingsService *settings.SettingsService, notificationService *notification.NotificationService, activityService *activity.ActivityService, registryService *registry.ContainerRegistryService) *VulnerabilityService

NewVulnerabilityService creates a new VulnerabilityService instance

func (*VulnerabilityService) ActionableCountExcludingIgnored 

func (s *VulnerabilityService) ActionableCountExcludingIgnored(ctx context.Context) (int, error)

ActionableCountExcludingIgnored counts critical and high severity vulnerabilities across all completed scans, excluding any that have been ignored. This is used by the dashboard to show an accurate action item count that reflects ignore decisions.

Images without ignore records are counted from the indexed critical_count/ high_count columns; only images that have ignore rows decode their vulnerability blob, so the common no-ignores dashboard poll never unmarshals a scan payload.

func (*VulnerabilityService) CleanupOrphanedScanRecords 

func (s *VulnerabilityService) CleanupOrphanedScanRecords(ctx context.Context) (deleted int64, err error)

CleanupOrphanedScanRecords removes vulnerability scan records for images that no longer exist in Docker. This keeps "images scanned" counts in sync (e.g. avoids "5/3" when images were deleted after being scanned). Safe to call even when no images exist; returns the number of records deleted.

func (*VulnerabilityService) DeleteScanResult 

func (s *VulnerabilityService) DeleteScanResult(ctx context.Context, imageID string) error

DeleteScanResult deletes the scan result for an image

func (*VulnerabilityService) DeleteScanResultsByImageIDs 

func (s *VulnerabilityService) DeleteScanResultsByImageIDs(ctx context.Context, imageIDs []string) error

DeleteScanResultsByImageIDs deletes scan results for multiple images in one query.

func (*VulnerabilityService) GetEnvironmentSummary 

func (s *VulnerabilityService) GetEnvironmentSummary(ctx context.Context) (*vulnerability.EnvironmentVulnerabilitySummary, error)

GetEnvironmentSummary returns aggregated vulnerability counts across all images.

func (*VulnerabilityService) GetIgnoreRecordsForImage 

func (s *VulnerabilityService) GetIgnoreRecordsForImage(ctx context.Context, envID string, imageID string) ([]models.VulnerabilityIgnore, error)

GetIgnoreRecordsForImage retrieves all ignore records for a specific image

func (*VulnerabilityService) GetScanResult 

func (s *VulnerabilityService) GetScanResult(ctx context.Context, imageID string) (*vulnerability.ScanResult, error)

GetScanResult retrieves the most recent scan result for an image

func (*VulnerabilityService) GetScanSummariesByImageIDs 

func (s *VulnerabilityService) GetScanSummariesByImageIDs(ctx context.Context, imageIDs []string) (map[string]*vulnerability.ScanSummary, error)

GetScanSummariesByImageIDs retrieves scan summaries for multiple images

func (*VulnerabilityService) GetScanSummary 

func (s *VulnerabilityService) GetScanSummary(ctx context.Context, imageID string) (*vulnerability.ScanSummary, error)

GetScanSummary retrieves just the summary for an image (for list views)

func (*VulnerabilityService) GetTrivyVersion 

func (s *VulnerabilityService) GetTrivyVersion(ctx context.Context) string

GetTrivyVersion returns the Trivy version from the configured scanner image.

func (*VulnerabilityService) IgnoreVulnerability 

func (s *VulnerabilityService) IgnoreVulnerability(ctx context.Context, envID string, payload *vulnerability.IgnorePayload) (*models.VulnerabilityIgnore, error)

IgnoreVulnerability creates a new ignore record for a vulnerability

func (*VulnerabilityService) ListAllVulnerabilities 

func (s *VulnerabilityService) ListAllVulnerabilities(ctx context.Context, envID string, params pagination.QueryParams) ([]vulnerability.VulnerabilityWithImage, pagination.Response, error)

ListAllVulnerabilities returns a paginated list of vulnerabilities across all scanned images.

func (*VulnerabilityService) ListAllVulnerabilityImageOptions 

func (s *VulnerabilityService) ListAllVulnerabilityImageOptions(ctx context.Context, severityFilter string) ([]string, error)

ListAllVulnerabilityImageOptions returns unique image names (or image IDs when name is empty) for vulnerability filtering, optionally constrained by severity.

func (*VulnerabilityService) ListIgnoredVulnerabilities 

func (s *VulnerabilityService) ListIgnoredVulnerabilities(ctx context.Context, envID string, params pagination.QueryParams) ([]vulnerability.IgnoredVulnerability, pagination.Response, error)

ListIgnoredVulnerabilities returns a list of ignored vulnerabilities for an environment

func (*VulnerabilityService) ListVulnerabilities 

func (s *VulnerabilityService) ListVulnerabilities(ctx context.Context, imageID string, params pagination.QueryParams) ([]vulnerability.Vulnerability, pagination.Response, error)

ListVulnerabilities returns a paginated, filtered list of vulnerabilities for an image.

func (*VulnerabilityService) ScanAllImages 

func (s *VulnerabilityService) ScanAllImages(ctx context.Context, envID string, user models.User) (scanned, failed int, err error)

ScanAllImages scans all Docker images for vulnerabilities. It is intended for use by the scheduled vulnerability scan job. A single long-running Trivy container is created and reused for every image via docker exec, which avoids the overhead of creating/destroying a container per scan. The caller-supplied user is recorded in the event log.

func (*VulnerabilityService) ScanImage 

func (s *VulnerabilityService) ScanImage(ctx context.Context, envID string, imageID string, user models.User) (*vulnerability.ScanResult, error)

ScanImage scans an image for vulnerabilities using Trivy

func (*VulnerabilityService) UnignoreVulnerability 

func (s *VulnerabilityService) UnignoreVulnerability(ctx context.Context, envID string, ignoreID string) error

UnignoreVulnerability removes an ignore record

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.