feat: added new endpoints for ExploitIQ reports #1981
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Reviewer's GuideIntroduces new REST endpoints for creating and fetching ExploitIQ reports (with associated models and OpenAPI updates), streamlines the existing SBOM download handler, and enhances error handling and dependencies for JSON and streaming support. Sequence diagram for creating an ExploitIQ reportsequenceDiagram
participant Client
participant API["API Server"]
participant SBOM["SBOM Service"]
participant Ingestor["Ingestor Service"]
participant ExploitIQ["ExploitIQ API"]
Client->>API: POST /v2/sbom/{id}/exploitiq (ReportRequest)
API->>SBOM: fetch_sbom_summary(id)
SBOM-->>API: SBOM summary (with source_document)
API->>Ingestor: retrieve(source_document)
Ingestor-->>API: SBOM document stream
API->>API: parse SBOM JSON
API->>ExploitIQ: POST /reports/new (ExploitIqRequest)
ExploitIQ-->>API: ReportResult
API-->>Client: 201 Created (ReportResult)
Sequence diagram for fetching an ExploitIQ reportsequenceDiagram
participant Client
participant API["API Server"]
participant ExploitIQ["ExploitIQ API"]
Client->>API: GET /v2/sbom/exploitiq/{id}
API->>ExploitIQ: GET /reports/{id}
ExploitIQ-->>API: Report stream
API-->>Client: 200 OK (streamed report)
ER diagram for new ExploitIQ report OpenAPI schemaserDiagram
REPORTREQUEST {
vulnerabilities string
}
REPORTRESULT {
id string
reportId string
}
REPORTREQUEST ||--o{ REPORTRESULT : "creates"
Class diagram for new ExploitIQ report modelsclassDiagram
class ReportRequest {
+vulnerabilities: Vec<String>
}
class ReportResult {
+id: String
+report_id: String
}
class ExploitIqRequest {
+vulnerabilities: Vec<String>
+sbom: Value
+sbom_info_type: String
+metadata: Value
+new(sbom: Value, vulnerabilities: Vec<String>)
}
ReportRequest --> ExploitIqRequest : used to construct
ExploitIqRequest --> ReportResult : used in create_report()
File-Level Changes
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1981 +/- ##
==========================================
- Coverage 67.91% 67.67% -0.24%
==========================================
Files 354 355 +1
Lines 19729 19794 +65
Branches 19729 19794 +65
==========================================
- Hits 13398 13396 -2
- Misses 5552 5618 +66
- Partials 779 780 +1 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
But happy to see progress :) thank you very much!!! |
jcrossley3
changed the title
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey there - I've reviewed your changes - here's some feedback:
- The create_exploitiq_report handler currently returns HttpResponse::Ok but your OpenAPI spec declares a 201 Created; please return Created to keep them in sync.
- You’re collecting the entire SBOM into a BytesMut buffer before sending it off—consider streaming or deserializing directly from the response to avoid high memory usage with large SBOMs.
- In fetch_exploitiq_report you’re streaming the report but not forwarding the upstream Content-Type header; consider propagating the remote response’s media type for accurate client behavior.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The create_exploitiq_report handler currently returns HttpResponse::Ok but your OpenAPI spec declares a 201 Created; please return Created to keep them in sync.
- You’re collecting the entire SBOM into a BytesMut buffer before sending it off—consider streaming or deserializing directly from the response to avoid high memory usage with large SBOMs.
- In fetch_exploitiq_report you’re streaming the report but not forwarding the upstream Content-Type header; consider propagating the remote response’s media type for accurate client behavior.
## Individual Comments
### Comment 1
<location> `modules/fundamental/src/sbom/model/exploitiq.rs:61-62` </location>
<code_context>
+ Ok(response.bytes_stream().map_err(Error::Http))
+}
+
+fn base_url() -> Result<String, Error> {
+ match env::var(ENV_URL) {
+ Ok(s) => Ok(s),
+ _ => {
+ log::error!("ExploitIQ reports require {ENV_URL} to be set");
+ Err(Error::Unavailable)
+ }
</code_context>
<issue_to_address>
**suggestion:** String interpolation in log message will not expand ENV_URL.
Use format!(...) or include the variable value directly to ensure ENV_URL is shown correctly in the log.
```suggestion
_ => {
+ log::error!("{}", format!("ExploitIQ reports require {} to be set", ENV_URL));
```
</issue_to_address>
### Comment 2
<location> `modules/fundamental/src/sbom/model/exploitiq.rs:68-70` </location>
<code_context>
+ }
+}
+
+fn authorized_client() -> Result<reqwest::Client, Error> {
+ let Ok(token) = env::var(ENV_TOKEN) else {
+ log::error!("ExploitIQ reports require {ENV_TOKEN} to be set");
+ return Err(Error::Unavailable);
+ };
</code_context>
<issue_to_address>
**suggestion:** String interpolation in log message will not expand ENV_TOKEN.
Use format!(...) or include the variable value directly to ensure ENV_TOKEN is displayed correctly in the log.
Suggested implementation:
```rust
log::error!("{}", format!("ExploitIQ reports require {} to be set", ENV_URL));
```
```rust
log::error!("{}", format!("ExploitIQ reports require {} to be set", ENV_TOKEN));
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
carlosthe19916
approved these changes
Sep 19, 2025
There was a problem hiding this comment.
@jcrossley3 LGTM!
But I would like this PR not to fully close the issue #1967 because we are still missing saving the ExploitIQ report IDs in the Trustify Database.
But this is a huge first step!
Fixes: guacsec#1967 Cleaned up a bit of the download endpoint while I was in there.
|
/scale-test |
|
🛠️ Scale test has started! Follow the progress here: Workflow Run |
Goose ReportGoose Attack ReportPlan Overview
Request Metrics
Response Time Metrics
Status Code Metrics
Transaction Metrics
Scenario Metrics
Error Metrics
📄 Full Report (Go to "Artifacts" and download report) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes: #1967
Cleaned up a bit of the download endpoint while I was in there.
Summary by Sourcery
Add new ExploitIQ report functionality by integrating an HTTP client, creating POST and GET endpoints, refactoring the SBOM download handler, enhancing error types, updating dependencies, and extending the API documentation in OpenAPI.
New Features:
Enhancements:
Build:
Documentation: