vulnerability

package
v2.8.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 19, 2026 License: BSD-3-Clause Imports: 46 Imported by: 0

Documentation

Overview

Package vulnerability owns vulnerability scanning, persistence, and HTTP routes.

Index

Constants

View Source
const (
	ScanStatusPending   = "pending"
	ScanStatusScanning  = "scanning"
	ScanStatusCompleted = "completed"
	ScanStatusFailed    = "failed"
)

Scan status constants

Variables

This section is empty.

Functions

func RegisterVulnerability

func RegisterVulnerability(api huma.API, vulnerabilityService *VulnerabilityService, appCtx handlerutil.ActivityAppContext)

RegisterVulnerability registers vulnerability scanning routes using Huma.

Types

type GetEnvironmentSummaryInput

type GetEnvironmentSummaryInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
}

type GetEnvironmentSummaryOutput

type GetEnvironmentSummaryOutput struct {
	Body base.ApiResponse[vulnerability.EnvironmentVulnerabilitySummary]
}

type GetScanResultInput

type GetScanResultInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	ImageID       string `path:"imageId" doc:"Image ID"`
}

type GetScanResultOutput

type GetScanResultOutput struct {
	Body base.ApiResponse[vulnerability.ScanResult]
}

type GetScanSummariesInput

type GetScanSummariesInput struct {
	EnvironmentID string                             `path:"id" doc:"Environment ID"`
	Body          vulnerability.ScanSummariesRequest `doc:"Batch scan summary request"`
}

type GetScanSummariesOutput

type GetScanSummariesOutput struct {
	Body base.ApiResponse[vulnerability.ScanSummariesResponse]
}

type GetScanSummaryInput

type GetScanSummaryInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	ImageID       string `path:"imageId" doc:"Image ID"`
}

type GetScanSummaryOutput

type GetScanSummaryOutput struct {
	Body base.ApiResponse[vulnerability.ScanSummary]
}

type GetScannerStatusInput

type GetScannerStatusInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
}

type GetScannerStatusOutput

type GetScannerStatusOutput struct {
	Body base.ApiResponse[ScannerStatus]
}

type IgnoreVulnerabilityInput

type IgnoreVulnerabilityInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	Body          vulnerability.IgnorePayload
}

type IgnoreVulnerabilityOutput

type IgnoreVulnerabilityOutput struct {
	Body base.ApiResponse[vulnerability.IgnoredVulnerability]
}

type ListAllVulnerabilitiesInput

type ListAllVulnerabilitiesInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	Search        string `query:"search" doc:"Search query"`
	Sort          string `query:"sort" doc:"Sort field"`
	Order         string `query:"order" doc:"Sort order"`
	Start         int    `query:"start" doc:"Start offset"`
	Limit         int    `query:"limit" doc:"Limit"`

	Severity  string `query:"severity" doc:"Comma-separated severity filter"`
	ImageName string `query:"imageName" doc:"Filter by image/repo name (substring)"`
}

type ListAllVulnerabilitiesOutput

type ListAllVulnerabilitiesOutput struct {
	Body base.Paginated[vulnerability.VulnerabilityWithImage]
}

type ListAllVulnerabilityImageOptionsInput

type ListAllVulnerabilityImageOptionsInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	Severity      string `query:"severity" doc:"Comma-separated severity filter"`
}

type ListAllVulnerabilityImageOptionsOutput

type ListAllVulnerabilityImageOptionsOutput struct {
	Body base.ApiResponse[[]string]
}

type ListIgnoredVulnerabilitiesInput

type ListIgnoredVulnerabilitiesInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	Search        string `query:"search" doc:"Search query"`
	Sort          string `query:"sort" doc:"Sort field"`
	Order         string `query:"order" doc:"Sort order"`
	Start         int    `query:"start" doc:"Start offset"`
	Limit         int    `query:"limit" doc:"Limit"`
}

type ListIgnoredVulnerabilitiesOutput

type ListIgnoredVulnerabilitiesOutput struct {
	Body base.Paginated[vulnerability.IgnoredVulnerability]
}

type ListImageVulnerabilitiesInput

type ListImageVulnerabilitiesInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	ImageID       string `path:"imageId" doc:"Image ID"`
	Search        string `query:"search" doc:"Search query"`
	Sort          string `query:"sort" doc:"Sort field"`
	Order         string `query:"order" doc:"Sort order"`
	Start         int    `query:"start" doc:"Start offset"`
	Limit         int    `query:"limit" doc:"Limit"`

	Severity string `query:"severity" doc:"Comma-separated severity filter"`
}

type ListImageVulnerabilitiesOutput

type ListImageVulnerabilitiesOutput struct {
	Body base.Paginated[vulnerability.Vulnerability]
}

type Module

type Module struct {
	// contains filtered or unexported fields
}

func New

func New(service *VulnerabilityService) *Module

func (*Module) RegisterRoutes

func (m *Module) RegisterRoutes(api huma.API, appCtx handlerutil.ActivityAppContext)

func (*Module) Service

func (m *Module) Service() *VulnerabilityService

type ScanImageInput

type ScanImageInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	ImageID       string `path:"imageId" doc:"Image ID to scan"`
}

type ScanImageOutput

type ScanImageOutput struct {
	Body base.ApiResponse[vulnerability.ScanResult]
}

type ScannerStatus

type ScannerStatus struct {
	// Available indicates if the vulnerability scanner (Trivy) is available
	Available bool `json:"available"`

	// Version is the version of the scanner if available
	Version string `json:"version,omitempty"`
}

type UnignoreVulnerabilityInput

type UnignoreVulnerabilityInput struct {
	EnvironmentID string `path:"id" doc:"Environment ID"`
	IgnoreID      string `path:"ignoreId" doc:"Ignore record ID"`
}

type UnignoreVulnerabilityOutput

type UnignoreVulnerabilityOutput struct {
	Body base.ApiResponse[struct{}]
}

type VulnerabilityHandler

type VulnerabilityHandler struct {
	// contains filtered or unexported fields
}

VulnerabilityHandler provides Huma-based vulnerability scanning endpoints.

func (*VulnerabilityHandler) GetEnvironmentSummary

GetEnvironmentSummary returns aggregated vulnerability info for the current environment.

func (*VulnerabilityHandler) GetScanResult

GetScanResult retrieves the vulnerability scan result for an image.

func (*VulnerabilityHandler) GetScanSummaries

GetScanSummaries retrieves scan summaries for a list of image IDs.

func (*VulnerabilityHandler) GetScanSummary

GetScanSummary retrieves just the vulnerability summary for an image.

func (*VulnerabilityHandler) GetScannerStatus

GetScannerStatus checks if the vulnerability scanner is available.

func (*VulnerabilityHandler) IgnoreVulnerability

IgnoreVulnerability creates an ignore record for a vulnerability.

func (*VulnerabilityHandler) ListAllVulnerabilities

ListAllVulnerabilities returns a paginated list of vulnerabilities across all images.

func (*VulnerabilityHandler) ListAllVulnerabilityImageOptions

ListAllVulnerabilityImageOptions returns available image options for vulnerability filtering.

func (*VulnerabilityHandler) ListIgnoredVulnerabilities

ListIgnoredVulnerabilities returns a list of ignored vulnerabilities.

func (*VulnerabilityHandler) ListImageVulnerabilities

ListImageVulnerabilities returns a paginated list of vulnerabilities for an image.

func (*VulnerabilityHandler) ScanImage

ScanImage initiates a vulnerability scan for an image.

func (*VulnerabilityHandler) UnignoreVulnerability

UnignoreVulnerability removes an ignore record for a vulnerability.

type VulnerabilityIgnore added in v2.8.1

type VulnerabilityIgnore struct {
	// ID is the unique identifier for this ignore record
	ID string `json:"id" gorm:"primaryKey;type:text"`

	// EnvironmentID is the environment where this ignore applies
	EnvironmentID string `json:"environmentId" gorm:"column:environment_id;index"`

	// ImageID is the Docker image ID
	ImageID string `json:"imageId" gorm:"column:image_id;index"`

	// VulnerabilityID is the CVE or vulnerability identifier (e.g., CVE-2023-1234)
	VulnerabilityID string `json:"vulnerabilityId" gorm:"column:vulnerability_id;index"`

	// PkgName is the package name containing the vulnerability
	PkgName string `json:"pkgName" gorm:"column:pkg_name"`

	// InstalledVersion is the version of the package with the vulnerability
	InstalledVersion string `json:"installedVersion" gorm:"column:installed_version"`

	// Reason is an optional reason for ignoring this vulnerability
	Reason *string `json:"reason,omitempty" gorm:"column:reason"`

	// CreatedBy is the user ID who created this ignore record
	CreatedBy string `json:"createdBy" gorm:"column:created_by"`

	// CreatedAt is when this ignore record was created
	CreatedAt time.Time `json:"createdAt" gorm:"column:created_at"`
}

VulnerabilityIgnore stores ignored vulnerability records

func (*VulnerabilityIgnore) BeforeCreate added in v2.8.1

func (v *VulnerabilityIgnore) BeforeCreate(db *gorm.DB) error

BeforeCreate sets the ID and CreatedAt before inserting

func (*VulnerabilityIgnore) CompositeKey added in v2.8.1

func (v *VulnerabilityIgnore) CompositeKey() string

CompositeKey generates a composite key for deduplication. This helps prevent duplicate ignore records for the same vulnerability.

func (*VulnerabilityIgnore) TableName added in v2.8.1

func (v *VulnerabilityIgnore) TableName() string

type VulnerabilityScanRecord added in v2.8.1

type VulnerabilityScanRecord struct {
	database.BaseModel

	// ImageID is the Docker image ID (primary key)
	ID string `json:"id" gorm:"primaryKey;type:text"`

	// ImageName is the image name with tag (e.g., nginx:latest)
	ImageName string `json:"imageName" gorm:"column:image_name"`

	// Status is the status of the scan (pending, scanning, completed, failed)
	Status string `json:"status" gorm:"column:status"`

	// ScanTime is the timestamp when the scan was performed
	ScanTime time.Time `json:"scanTime" gorm:"column:scan_time"`

	// Duration is the duration of the scan in milliseconds
	Duration int64 `json:"duration" gorm:"column:duration"`

	// Total vulnerability counts by severity
	CriticalCount int `json:"criticalCount" gorm:"column:critical_count"`
	HighCount     int `json:"highCount" gorm:"column:high_count"`
	MediumCount   int `json:"mediumCount" gorm:"column:medium_count"`
	LowCount      int `json:"lowCount" gorm:"column:low_count"`
	UnknownCount  int `json:"unknownCount" gorm:"column:unknown_count"`
	TotalCount    int `json:"totalCount" gorm:"column:total_count"`

	// Vulnerabilities stores the JSON encoded vulnerabilities list
	Vulnerabilities database.StringSlice `json:"vulnerabilities" gorm:"column:vulnerabilities;type:text"`

	// Error contains the error message if the scan failed
	Error *string `json:"error,omitempty" gorm:"column:error"`

	// ScannerVersion is the version of the scanner used
	ScannerVersion string `json:"scannerVersion" gorm:"column:scanner_version"`
}

VulnerabilityScanRecord stores vulnerability scan results for images

func (*VulnerabilityScanRecord) GetHighestSeverity added in v2.8.1

func (v *VulnerabilityScanRecord) GetHighestSeverity() string

GetHighestSeverity returns the highest severity level found

func (*VulnerabilityScanRecord) GetTotalVulnerabilities added in v2.8.1

func (v *VulnerabilityScanRecord) GetTotalVulnerabilities() int

GetTotalVulnerabilities returns the total count of vulnerabilities

func (*VulnerabilityScanRecord) IsCompleted added in v2.8.1

func (v *VulnerabilityScanRecord) IsCompleted() bool

IsCompleted returns true if the scan has completed

func (*VulnerabilityScanRecord) IsFailed added in v2.8.1

func (v *VulnerabilityScanRecord) IsFailed() bool

IsFailed returns true if the scan has failed

func (*VulnerabilityScanRecord) IsScanning added in v2.8.1

func (v *VulnerabilityScanRecord) IsScanning() bool

IsScanning returns true if the scan is in progress

func (*VulnerabilityScanRecord) TableName added in v2.8.1

func (v *VulnerabilityScanRecord) TableName() string

type VulnerabilityService

type VulnerabilityService struct {
	// contains filtered or unexported fields
}

VulnerabilityService handles vulnerability scanning of container images

func NewVulnerabilityService

func NewVulnerabilityService(db *database.DB, dockerService *docker.DockerClientService, eventService *event.EventService, settingsService *settings.SettingsService, notificationService *notification.NotificationService, activityService *activity.ActivityService, registryService *registry.ContainerRegistryService) *VulnerabilityService

NewVulnerabilityService creates a new VulnerabilityService instance

func (*VulnerabilityService) ActionableCountExcludingIgnored

func (s *VulnerabilityService) ActionableCountExcludingIgnored(ctx context.Context) (int, error)

ActionableCountExcludingIgnored counts critical and high severity vulnerabilities across all completed scans, excluding any that have been ignored. This is used by the dashboard to show an accurate action item count that reflects ignore decisions.

Images without ignore records are counted from the indexed critical_count/ high_count columns; only images that have ignore rows decode their vulnerability blob, so the common no-ignores dashboard poll never unmarshals a scan payload.

func (*VulnerabilityService) CleanupOrphanedScanRecords

func (s *VulnerabilityService) CleanupOrphanedScanRecords(ctx context.Context) (deleted int64, err error)

CleanupOrphanedScanRecords removes vulnerability scan records for images that no longer exist in Docker. This keeps "images scanned" counts in sync (e.g. avoids "5/3" when images were deleted after being scanned). Safe to call even when no images exist; returns the number of records deleted.

func (*VulnerabilityService) DeleteScanResult

func (s *VulnerabilityService) DeleteScanResult(ctx context.Context, imageID string) error

DeleteScanResult deletes the scan result for an image

func (*VulnerabilityService) DeleteScanResultsByImageIDs

func (s *VulnerabilityService) DeleteScanResultsByImageIDs(ctx context.Context, imageIDs []string) error

DeleteScanResultsByImageIDs deletes scan results for multiple images in one query.

func (*VulnerabilityService) GetEnvironmentSummary

GetEnvironmentSummary returns aggregated vulnerability counts across all images.

func (*VulnerabilityService) GetIgnoreRecordsForImage

func (s *VulnerabilityService) GetIgnoreRecordsForImage(ctx context.Context, envID string, imageID string) ([]VulnerabilityIgnore, error)

GetIgnoreRecordsForImage retrieves all ignore records for a specific image

func (*VulnerabilityService) GetScanResult

func (s *VulnerabilityService) GetScanResult(ctx context.Context, imageID string) (*vulnerability.ScanResult, error)

GetScanResult retrieves the most recent scan result for an image

func (*VulnerabilityService) GetScanSummariesByImageIDs

func (s *VulnerabilityService) GetScanSummariesByImageIDs(ctx context.Context, imageIDs []string) (map[string]*vulnerability.ScanSummary, error)

GetScanSummariesByImageIDs retrieves scan summaries for multiple images

func (*VulnerabilityService) GetScanSummary

func (s *VulnerabilityService) GetScanSummary(ctx context.Context, imageID string) (*vulnerability.ScanSummary, error)

GetScanSummary retrieves just the summary for an image (for list views)

func (*VulnerabilityService) GetTrivyVersion

func (s *VulnerabilityService) GetTrivyVersion(ctx context.Context) string

GetTrivyVersion returns the Trivy version from the configured scanner image.

func (*VulnerabilityService) IgnoreVulnerability

func (s *VulnerabilityService) IgnoreVulnerability(ctx context.Context, envID string, payload *vulnerability.IgnorePayload) (*VulnerabilityIgnore, error)

IgnoreVulnerability creates a new ignore record for a vulnerability

func (*VulnerabilityService) ListAllVulnerabilities

ListAllVulnerabilities returns a paginated list of vulnerabilities across all scanned images.

func (*VulnerabilityService) ListAllVulnerabilityImageOptions

func (s *VulnerabilityService) ListAllVulnerabilityImageOptions(ctx context.Context, severityFilter string) ([]string, error)

ListAllVulnerabilityImageOptions returns unique image names (or image IDs when name is empty) for vulnerability filtering, optionally constrained by severity.

func (*VulnerabilityService) ListIgnoredVulnerabilities

ListIgnoredVulnerabilities returns a list of ignored vulnerabilities for an environment

func (*VulnerabilityService) ListVulnerabilities

ListVulnerabilities returns a paginated, filtered list of vulnerabilities for an image.

func (*VulnerabilityService) ScanAllImages

func (s *VulnerabilityService) ScanAllImages(ctx context.Context, envID string, user common.User) (scanned, failed int, err error)

ScanAllImages scans all Docker images for vulnerabilities. It is intended for use by the scheduled vulnerability scan job. A single long-running Trivy container is created and reused for every image via docker exec, which avoids the overhead of creating/destroying a container per scan. The caller-supplied user is recorded in the event log.

func (*VulnerabilityService) ScanImage

func (s *VulnerabilityService) ScanImage(ctx context.Context, envID string, imageID string, user common.User) (*vulnerability.ScanResult, error)

ScanImage scans an image for vulnerabilities using Trivy

func (*VulnerabilityService) UnignoreVulnerability

func (s *VulnerabilityService) UnignoreVulnerability(ctx context.Context, envID string, ignoreID string) error

UnignoreVulnerability removes an ignore record

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL