Create pipeline for symbol reachability - #2151
Conversation
944dcbe to
da128db
Compare
|
The pipeline requires the unidiff dependency to parse diffs/patch text |
d5fed3d to
08512ab
Compare
|
This depends on: We have an API support for patching VulnerableCode, see: |
3686a85 to
dfbb4db
Compare
|
I'm also not sure why Run unit tests on macOS / run-unit-tests (3.13) is failing. |
|
@ziadhany try to fix the failing test please |
| data = { | ||
| "purls": purls, | ||
| "details": True, | ||
| "reachability": True, |
There was a problem hiding this comment.
You should only go for reachability if collect_symbols_reachability has called it, not for every VCIO call
There was a problem hiding this comment.
We're currently relying on the find_vulnerabilities pipeline to retrieve vulnerabilities. One possible solution is to introduce an optional field reachability in the find_vulnerabilities pipeline.
|
@ziadhany this mostly looks good, let's have a session soon and do a demo and understand the limitations of the current approach |
6768aa8 to
577d4be
Compare
1555040 to
27de9f1
Compare
tdruez
left a comment
There was a problem hiding this comment.
- The new code does not follow current codebase conventions: remote all the type hint.
- Make sure all functions have a proper docstrings and are properly covered by a unit test
- Lack of a global test for the new pipeline
keshav-space
left a comment
There was a problem hiding this comment.
@ziadhany thanks. We should not rebuild index over and over again for the same resource each time we match against a new patch. I suggest that instead of having one big monolithic step, we break the pipeline into minimum 4 logical steps.
- Step 1: get vcs_url and patch for all vulnerabilities.
- Step 2: for each patch, collect vulnerable symbols.
- Step 3: iterate over resource, parse and collect resource symbols, and match them against vulnerable symbols.
- Step 4: prepare and store consolidated reachability for each vulnerability.
The final reachability report should be keyed by vulnerability. For each vulnerability I should get reachability (Yes, No, or Unknown) along with tool-specific details.
Also please remove type hints as we don't yet use/support type hints in SCIO
|
test package: pipeline input: |
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Add end-to-end test for Symbol Reachability pipeline Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Split pipeline to multiple steps Build resource_index once per resource Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Simplify add_reachability_report function Remove type hints for symbols.py Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
…all commits Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Refactor the pipeline Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Fix the test Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Add resource filter based on language we support Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
bdc627e to
cb83ff3
Compare
Signed-off-by: ziad hany <ziadhany2016@gmail.com>
Signed-off-by: ziad hany <ziadhany2016@gmail.com>

Issues
Changes
Add Pipeline(s) that can retrieve vulnerable / fix symbols, collect local symbols (pur2sym) and match them
Pipeline Graph:
graph TD %% Main Entry Point Start([SymbolReachability Pipeline]) --> Step1[get_vulnerabilities_patches] %% Step 1: Get Patches Step1 --> ExtractPatches[Extract fixed_in_patches from vulnerabilities] ExtractPatches --> DedupePatches[Deduplicate by vcs_url & commit_hash] DedupePatches --> Step2[collect_resource_index] %% Step 2: Collect Resource Index Step2 --> FilterResources[Filter codebaseresources by TS_QUERIES languages] FilterResources --> ResLoop{For each candidate_resource} ResLoop -->|Next resource| BuildResIndex[ResourceAnalyzer.build_index] BuildResIndex --> ExtractDefs[Extract definitions, imports, calls & callers_of] ExtractDefs --> SaveResIndex[Store in resource_indexes] SaveResIndex --> ResLoop ResLoop -->|All resources processed| Step3[collect_patch_symbols] %% Step 3: Collect Patch Symbols Step3 --> GroupPatches[Group patches by vcs_url] GroupPatches --> RepoLoop{For each repository} RepoLoop -->|Next repo| CloneRepo[Clone repo to temp dir] CloneRepo --> PatchLoop{For each patch in repo} PatchLoop -->|Next patch| PatchAnalyzer[PatchAnalyzer.collect_patch_symbols] PatchAnalyzer --> GetDiff[Get changed files & diff vulnerable/fixed texts] GetDiff --> DetectLang[detect_language_with_scancode] DetectLang --> ParseAST[LanguageQuery.parse_code_to_ast] ParseAST --> ExtractSymbols[SymbolExtractor.extract_changed_symbols] ExtractSymbols --> DiffSymbols[diff_changed_symbols] DiffSymbols --> SavePatchSyms[Store in patch_symbols by commit_hash] SavePatchSyms --> PatchLoop PatchLoop -->|All patches checked| RepoLoop RepoLoop -->|All repos processed| Step4[collect_and_match_resources] %% Step 4: Match Resources and Patches Step4 --> MatchPatchLoop{For each patch} MatchPatchLoop -->|Next patch| MatchResLoop{For each candidate_resource} MatchResLoop -->|Next resource| CheckLang{Language matches patch?} CheckLang -->|No| MatchResLoop CheckLang -->|Yes| Matcher[ResourcePatchMatcher.match] Matcher --> MatchVuln[Match Vulnerable Symbols] Matcher --> MatchFixed[Match Fixed Symbols] MatchVuln & MatchFixed --> CheckEvidence{Evidence found?} CheckEvidence -->|No| MatchResLoop CheckEvidence -->|Yes| Classify[classify_reachability] Classify --> StatusReach[REACHABLE / UNKNOWN / NOT_REACHABLE] StatusReach --> UpdateData[save_resource_reachability_report] UpdateData --> MatchResLoop MatchResLoop -->|All resources checked| MatchPatchLoop MatchPatchLoop -->|All patches checked| End([End Process]) %% Styling classDef stepNode fill:#e1f5fe,stroke:#03a9f4,stroke-width:2px; classDef functionNode fill:#f1f8e9,stroke:#4caf50,stroke-width:2px; classDef logicNode fill:#fff3e0,stroke:#ff9800,stroke-width:2px; classDef loopNode fill:#f3e5f5,stroke:#9c27b0,stroke-width:2px; class Start,End,Step1,Step2,Step3,Step4 stepNode; class RepoLoop,PatchLoop,ResLoop,MatchPatchLoop,MatchResLoop loopNode; class CheckLang,CheckEvidence logicNode; class PatchAnalyzer,Matcher,Classify,BuildResIndex functionNode;Checklist