fix(guided remediation): Add special handling for specific Maven pack…

…ages (#1219) Add some special cases for overriding versions of Maven packages to prevent undesirable outcomes from following the correct versioning rules: - `com.google.guava:guava`: Preserve the version's 'flavor' (`-android` or `-jre`) when updating (Closes #1183) - Apache `commons-*`: Sort the ancient CalVer versions (e.g.`20021128.082114`) before the newer versions (`1.0`). The logic from this workaround should probably also be added to the updater, and also the other remediation strategies might want to make use of similar workarounds.
google · Sep 3, 2024 · 9a93484 · 9a93484
1 parent 5b4d517
commit 9a93484
Show file tree

Hide file tree

Showing 13 changed files with 1,340 additions and 152 deletions.
diff --git a/internal/remediation/__snapshots__/testhelpers_test.snap b/internal/remediation/__snapshots__/testhelpers_test.snap
@@ -249,9 +249,9 @@
           },
           "Type": {},
           "OrigRequire": "",
-          "NewRequire": "32.0.0-android",
+          "NewRequire": "32.0.0-jre",
           "OrigResolved": "22.0",
-          "NewResolved": "32.0.0-android"
+          "NewResolved": "32.0.0-jre"
         }
       ],
       "EcosystemSpecific": null
@@ -749,9 +749,9 @@
           },
           "Type": {},
           "OrigRequire": "",
-          "NewRequire": "24.1.1-android",
+          "NewRequire": "24.1.1-jre",
           "OrigResolved": "22.0",
-          "NewResolved": "24.1.1-android"
+          "NewResolved": "24.1.1-jre"
         }
       ],
       "EcosystemSpecific": null
@@ -1235,6 +1235,134 @@
 ]
 ---
 
+[TestComputeOverridePatches/workaround-commons - 1]
+[
+  {
+    "Patch": {
+      "Deps": [
+        {
+          "Pkg": {
+            "System": 6,
+            "Name": "commons-beanutils:commons-beanutils"
+          },
+          "Type": {},
+          "OrigRequire": "",
+          "NewRequire": "1.9.4",
+          "OrigResolved": "20020520",
+          "NewResolved": "1.9.4"
+        }
+      ],
+      "EcosystemSpecific": null
+    },
+    "RemovedVulns": [
+      {
+        "ID": "GHSA-6phf-73q6-gh87",
+        "AffectedNodes": [
+          1
+        ]
+      }
+    ],
+    "AddedVulns": []
+  }
+]
+---
+
+[TestComputeOverridePatches/workaround-maven-guava-android-to-android - 1]
+[
+  {
+    "Patch": {
+      "Deps": [
+        {
+          "Pkg": {
+            "System": 6,
+            "Name": "com.google.guava:guava"
+          },
+          "Type": {},
+          "OrigRequire": "",
+          "NewRequire": "24.0-android",
+          "OrigResolved": "22.0-android",
+          "NewResolved": "24.0-android"
+        }
+      ],
+      "EcosystemSpecific": null
+    },
+    "RemovedVulns": [
+      {
+        "ID": "OSV-000-000",
+        "AffectedNodes": [
+          1
+        ]
+      }
+    ],
+    "AddedVulns": []
+  }
+]
+---
+
+[TestComputeOverridePatches/workaround-maven-guava-jre-to-jre - 1]
+[
+  {
+    "Patch": {
+      "Deps": [
+        {
+          "Pkg": {
+            "System": 6,
+            "Name": "com.google.guava:guava"
+          },
+          "Type": {},
+          "OrigRequire": "",
+          "NewRequire": "24.0-jre",
+          "OrigResolved": "23.1-jre",
+          "NewResolved": "24.0-jre"
+        }
+      ],
+      "EcosystemSpecific": null
+    },
+    "RemovedVulns": [
+      {
+        "ID": "OSV-000-000",
+        "AffectedNodes": [
+          1
+        ]
+      }
+    ],
+    "AddedVulns": []
+  }
+]
+---
+
+[TestComputeOverridePatches/workaround-maven-guava-none-to-jre - 1]
+[
+  {
+    "Patch": {
+      "Deps": [
+        {
+          "Pkg": {
+            "System": 6,
+            "Name": "com.google.guava:guava"
+          },
+          "Type": {},
+          "OrigRequire": "",
+          "NewRequire": "24.0-jre",
+          "OrigResolved": "20.0",
+          "NewResolved": "24.0-jre"
+        }
+      ],
+      "EcosystemSpecific": null
+    },
+    "RemovedVulns": [
+      {
+        "ID": "OSV-000-000",
+        "AffectedNodes": [
+          1
+        ]
+      }
+    ],
+    "AddedVulns": []
+  }
+]
+---
+
 [TestComputeRelaxPatches/npm-santatracker - 1]
 [
   {

diff --git a/internal/remediation/fixtures/override-workaround/commons/osv-scanner.toml b/internal/remediation/fixtures/override-workaround/commons/osv-scanner.toml
@@ -0,0 +1,11 @@
+[[PackageOverrides]]
+name = "commons-beanutils:commons-beanutils"
+ecosystem = "Maven"
+ignore = true
+reason = "This is an intentionally vulnerable test project"
+
+[[PackageOverrides]]
+name = "commons-httpclient:commons-httpclient"
+ecosystem = "Maven"
+ignore = true
+reason = "This is an intentionally vulnerable test project"
diff --git a/internal/remediation/fixtures/override-workaround/commons/pom.xml b/internal/remediation/fixtures/override-workaround/commons/pom.xml
@@ -0,0 +1,20 @@
+<project>
+  <modelVersion>4.0.0</modelVersion>
+
+  <groupId>dev.osv</groupId>
+  <artifactId>osv-fix</artifactId>
+  <version>1</version>
+
+  <dependencies>
+    <dependency>
+      <groupId>commons-beanutils</groupId>
+      <artifactId>commons-beanutils</artifactId>
+      <version>20020520</version>
+    </dependency>
+        <dependency>
+      <groupId>commons-httpclient</groupId>
+      <artifactId>commons-httpclient</artifactId>
+      <version>3.0</version>
+    </dependency>
+  </dependencies>
+</project>
diff --git a/internal/remediation/fixtures/override-workaround/guava/android-to-android/osv-scanner.toml b/internal/remediation/fixtures/override-workaround/guava/android-to-android/osv-scanner.toml
@@ -0,0 +1,5 @@
+[[PackageOverrides]]
+name = "com.google.guava:guava"
+ecosystem = "Maven"
+ignore = true
+reason = "This is an intentionally vulnerable test project"
diff --git a/internal/remediation/fixtures/override-workaround/guava/android-to-android/pom.xml b/internal/remediation/fixtures/override-workaround/guava/android-to-android/pom.xml
@@ -0,0 +1,15 @@
+<project>
+  <modelVersion>4.0.0</modelVersion>
+
+  <groupId>dev.osv</groupId>
+  <artifactId>osv-fix</artifactId>
+  <version>1</version>
+
+  <dependencies>
+    <dependency>
+      <groupId>com.google.guava</groupId>
+      <artifactId>guava</artifactId>
+      <version>22.0-android</version>
+    </dependency>
+  </dependencies>
+</project>
diff --git a/internal/remediation/fixtures/override-workaround/guava/jre-to-jre/osv-scanner.toml b/internal/remediation/fixtures/override-workaround/guava/jre-to-jre/osv-scanner.toml
@@ -0,0 +1,5 @@
+[[PackageOverrides]]
+name = "com.google.guava:guava"
+ecosystem = "Maven"
+ignore = true
+reason = "This is an intentionally vulnerable test project"
diff --git a/internal/remediation/fixtures/override-workaround/guava/jre-to-jre/pom.xml b/internal/remediation/fixtures/override-workaround/guava/jre-to-jre/pom.xml
@@ -0,0 +1,15 @@
+<project>
+  <modelVersion>4.0.0</modelVersion>
+
+  <groupId>dev.osv</groupId>
+  <artifactId>osv-fix</artifactId>
+  <version>1</version>
+
+  <dependencies>
+    <dependency>
+      <groupId>com.google.guava</groupId>
+      <artifactId>guava</artifactId>
+      <version>23.1-jre</version>
+    </dependency>
+  </dependencies>
+</project>
diff --git a/internal/remediation/fixtures/override-workaround/guava/none-to-jre/osv-scanner.toml b/internal/remediation/fixtures/override-workaround/guava/none-to-jre/osv-scanner.toml
@@ -0,0 +1,5 @@
+[[PackageOverrides]]
+name = "com.google.guava:guava"
+ecosystem = "Maven"
+ignore = true
+reason = "This is an intentionally vulnerable test project"
diff --git a/internal/remediation/fixtures/override-workaround/guava/none-to-jre/pom.xml b/internal/remediation/fixtures/override-workaround/guava/none-to-jre/pom.xml
@@ -0,0 +1,15 @@
+<project>
+  <modelVersion>4.0.0</modelVersion>
+
+  <groupId>dev.osv</groupId>
+  <artifactId>osv-fix</artifactId>
+  <version>1</version>
+
+  <dependencies>
+    <dependency>
+      <groupId>com.google.guava</groupId>
+      <artifactId>guava</artifactId>
+      <version>20.0</version>
+    </dependency>
+  </dependencies>
+</project>
diff --git a/internal/remediation/fixtures/override-workaround/universe.yaml b/internal/remediation/fixtures/override-workaround/universe.yaml
@@ -0,0 +1,79 @@
+system: Maven
+schema: |
+  com.google.guava:guava
+    20.0
+    21.0
+    22.0
+    22.0-android
+    23.0
+    23.0-android
+    23.1-android
+    23.1-jre
+    24.0-android
+    24.0-jre
+  commons-beanutils:commons-beanutils
+    1.0
+    1.2
+    1.9.0
+    1.9.3
+    1.9.4
+    20020520
+    20021128.082114
+    20030211.134440
+  commons-httpclient:commons-httpclient
+    2.0.2
+    3.0
+    3.1
+    20020423
+vulns:
+  - id: OSV-000-000
+    affected:
+      - package:
+          ecosystem: Maven
+          name: com.google.guava:guava
+        ranges:
+          - type: ECOSYSTEM
+            events:
+              - introduced: '0'
+              - fixed: '24.0-android'
+        versions:
+          - '20.0'
+          - '21.0'
+          - '22.0'
+          - '22.0-android'
+          - '23.0'
+          - '23.0-android'
+          - '23.1-android'
+          - '23.1-jre'
+  - id: GHSA-6phf-73q6-gh87
+    affected:
+      - package:
+          ecosystem: Maven
+          name: commons-beanutils:commons-beanutils
+        ranges:
+          - type: ECOSYSTEM
+            events:
+              - introduced: '0'
+              - fixed: '1.9.4'
+              - introduced: '20020520' # The real OSV record is missing this event
+        versions:
+          - '1.0'
+          - '1.2'
+          - '1.9.0'
+          - '1.9.3'
+          - '20020520'
+          - '20021128.082114'
+          - '20030211.134440'
+  - id: GHSA-3832-9276-x7gf
+    affected:
+      - package:
+          ecosystem: Maven
+          name: commons-httpclient:commons-httpclient
+        ranges:
+          - type: ECOSYSTEM
+            events:
+              - introduced: '3.0'
+              - fixed: '4.0'
+        versions:
+          - '3.0'
+          - '3.1'