From 3887ec809162a46a4137f39fc6307501542785d0 Mon Sep 17 00:00:00 2001 From: fsl <1171313930@qq.com> Date: Mon, 21 Feb 2022 16:40:28 +0800 Subject: [PATCH] fix uuid high-risk vulnerability --- cautils/rbac.go | 4 ++-- clihandler/cmd/results.go | 5 ++--- go.mod | 10 +++++----- resultshandling/reporter/v1/reporteventreceiver.go | 5 ++--- .../reporter/v1/reporteventreceiverutils.go | 4 ++-- resultshandling/reporter/v2/reporteventreceiver.go | 4 ++-- .../reporter/v2/reporteventreceiverutils.go | 4 ++-- 7 files changed, 17 insertions(+), 19 deletions(-) diff --git a/cautils/rbac.go b/cautils/rbac.go index a9d8bfbc..3f729f49 100644 --- a/cautils/rbac.go +++ b/cautils/rbac.go @@ -8,7 +8,7 @@ import ( "github.com/armosec/opa-utils/reporthandling" "github.com/armosec/rbac-utils/rbacscanner" "github.com/armosec/rbac-utils/rbacutils" - uuid "github.com/satori/go.uuid" + "github.com/google/uuid" ) type RBACObjects struct { @@ -21,7 +21,7 @@ func NewRBACObjects(scanner *rbacscanner.RbacScannerFromK8sAPI) *RBACObjects { func (rbacObjects *RBACObjects) SetResourcesReport() (*reporthandling.PostureReport, error) { return &reporthandling.PostureReport{ - ReportID: uuid.NewV4().String(), + ReportID: uuid.NewString(), ReportGenerationTime: time.Now().UTC(), CustomerGUID: rbacObjects.scanner.CustomerGUID, ClusterName: rbacObjects.scanner.ClusterName, diff --git a/clihandler/cmd/results.go b/clihandler/cmd/results.go index f7c09896..73b090ac 100644 --- a/clihandler/cmd/results.go +++ b/clihandler/cmd/results.go @@ -13,7 +13,7 @@ import ( "github.com/armosec/kubescape/clihandler/cliinterfaces" reporterv1 "github.com/armosec/kubescape/resultshandling/reporter/v1" "github.com/armosec/opa-utils/reporthandling" - uuid "github.com/satori/go.uuid" + "github.com/google/uuid" "github.com/spf13/cobra" ) @@ -37,10 +37,9 @@ func (resultsObject *ResultsObject) SetResourcesReport() (*reporthandling.Postur if err != nil { return nil, err } - return &reporthandling.PostureReport{ FrameworkReports: frameworkReports, - ReportID: uuid.NewV4().String(), + ReportID: uuid.NewString(), ReportGenerationTime: time.Now().UTC(), CustomerGUID: resultsObject.customerGUID, ClusterName: resultsObject.clusterName, diff --git a/go.mod b/go.mod index ca9009c0..9988151e 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/armosec/kubescape go 1.17 require ( - github.com/armosec/armoapi-go v0.0.49 + github.com/armosec/armoapi-go v0.0.54 github.com/armosec/k8s-interface v0.0.60 github.com/armosec/opa-utils v0.0.110 github.com/armosec/rbac-utils v0.0.14 @@ -13,12 +13,11 @@ require ( github.com/enescakir/emoji v1.0.0 github.com/fatih/color v1.13.0 github.com/francoispqt/gojay v1.2.13 - github.com/gofrs/uuid v4.1.0+incompatible + github.com/google/uuid v1.3.0 github.com/johnfercher/maroto v0.34.0 github.com/mattn/go-isatty v0.0.14 github.com/olekukonko/tablewriter v0.0.5 github.com/open-policy-agent/opa v0.33.1 - github.com/satori/go.uuid v1.2.0 github.com/spf13/cobra v1.2.1 github.com/stretchr/testify v1.7.0 go.uber.org/zap v1.19.1 @@ -62,13 +61,13 @@ require ( github.com/go-gota/gota v0.12.0 // indirect github.com/go-logr/logr v0.4.0 // indirect github.com/gobwas/glob v0.2.3 // indirect + github.com/gofrs/uuid v4.1.0+incompatible // indirect github.com/gogo/protobuf v1.3.2 // indirect github.com/golang/glog v1.0.0 // indirect github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect github.com/golang/protobuf v1.5.2 // indirect github.com/google/go-cmp v0.5.6 // indirect github.com/google/gofuzz v1.1.0 // indirect - github.com/google/uuid v1.1.2 // indirect github.com/googleapis/gax-go/v2 v2.0.5 // indirect github.com/googleapis/gnostic v0.5.5 // indirect github.com/imdario/mergo v0.3.12 // indirect @@ -87,6 +86,7 @@ require ( github.com/pquerna/cachecontrol v0.1.0 // indirect github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0 // indirect github.com/ruudk/golang-pdf417 v0.0.0-20181029194003-1af4ab5afa58 // indirect + github.com/satori/go.uuid v1.2.0 // indirect github.com/spf13/pflag v1.0.5 // indirect github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect @@ -99,7 +99,7 @@ require ( golang.org/x/oauth2 v0.0.0-20211005180243-6b3c2da341f1 // indirect golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf // indirect golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d // indirect - golang.org/x/text v0.3.6 // indirect + golang.org/x/text v0.3.7 // indirect golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect gonum.org/v1/gonum v0.9.1 // indirect google.golang.org/api v0.44.0 // indirect diff --git a/resultshandling/reporter/v1/reporteventreceiver.go b/resultshandling/reporter/v1/reporteventreceiver.go index abdbdcc9..a7c67f9e 100644 --- a/resultshandling/reporter/v1/reporteventreceiver.go +++ b/resultshandling/reporter/v1/reporteventreceiver.go @@ -13,7 +13,7 @@ import ( "github.com/armosec/kubescape/cautils/logger" "github.com/armosec/kubescape/cautils/logger/helpers" "github.com/armosec/opa-utils/reporthandling" - uuid "github.com/satori/go.uuid" + "github.com/google/uuid" ) const MAX_REPORT_SIZE = 2097152 // 2 MB @@ -51,8 +51,7 @@ func (report *ReportEventReceiver) ActionSendReport(opaSessionObj *cautils.OPASe report.message = "WARNING: Failed to publish results because the cluster name is Unknown. If you are scanning YAML files the results are not submitted to the Kubescape SaaS.Please feel free to contact ARMO team for more details" return nil } - - opaSessionObj.PostureReport.ReportID = uuid.NewV4().String() + opaSessionObj.PostureReport.ReportID = uuid.NewString() opaSessionObj.PostureReport.CustomerGUID = report.customerGUID opaSessionObj.PostureReport.ClusterName = report.clusterName diff --git a/resultshandling/reporter/v1/reporteventreceiverutils.go b/resultshandling/reporter/v1/reporteventreceiverutils.go index 6b816aec..f16bd1ef 100644 --- a/resultshandling/reporter/v1/reporteventreceiverutils.go +++ b/resultshandling/reporter/v1/reporteventreceiverutils.go @@ -6,7 +6,7 @@ import ( "github.com/armosec/k8s-interface/workloadinterface" "github.com/armosec/kubescape/cautils/getter" "github.com/armosec/opa-utils/reporthandling" - "github.com/gofrs/uuid" + "github.com/google/uuid" ) func (report *ReportEventReceiver) initEventReceiverURL() { @@ -16,7 +16,7 @@ func (report *ReportEventReceiver) initEventReceiverURL() { urlObj.Host = getter.GetArmoAPIConnector().GetReportReceiverURL() urlObj.Path = "/k8s/postureReport" q := urlObj.Query() - q.Add("customerGUID", uuid.FromStringOrNil(report.customerGUID).String()) + q.Add("customerGUID", uuid.MustParse(report.customerGUID).String()) q.Add("clusterName", report.clusterName) urlObj.RawQuery = q.Encode() diff --git a/resultshandling/reporter/v2/reporteventreceiver.go b/resultshandling/reporter/v2/reporteventreceiver.go index 77ba546e..bbc84779 100644 --- a/resultshandling/reporter/v2/reporteventreceiver.go +++ b/resultshandling/reporter/v2/reporteventreceiver.go @@ -11,7 +11,7 @@ import ( "github.com/armosec/kubescape/cautils/getter" "github.com/armosec/kubescape/cautils/logger" "github.com/armosec/kubescape/cautils/logger/helpers" - uuid "github.com/satori/go.uuid" + "github.com/google/uuid" "github.com/armosec/opa-utils/reporthandling" "github.com/armosec/opa-utils/reporthandling/results/v1/resourcesresults" @@ -51,7 +51,7 @@ func (report *ReportEventReceiver) ActionSendReport(opaSessionObj *cautils.OPASe report.message = "WARNING: Failed to publish results because the cluster name is Unknown. If you are scanning YAML files the results are not submitted to the Kubescape SaaS" return nil } - opaSessionObj.Report.ReportID = uuid.NewV4().String() + opaSessionObj.Report.ReportID = uuid.NewString() opaSessionObj.Report.CustomerGUID = report.customerGUID opaSessionObj.Report.ClusterName = report.clusterName diff --git a/resultshandling/reporter/v2/reporteventreceiverutils.go b/resultshandling/reporter/v2/reporteventreceiverutils.go index 66c823f3..d1f0f06c 100644 --- a/resultshandling/reporter/v2/reporteventreceiverutils.go +++ b/resultshandling/reporter/v2/reporteventreceiverutils.go @@ -7,7 +7,7 @@ import ( "github.com/armosec/kubescape/cautils/getter" "github.com/armosec/opa-utils/reporthandling" reporthandlingv2 "github.com/armosec/opa-utils/reporthandling/v2" - "github.com/gofrs/uuid" + "github.com/google/uuid" ) func (report *ReportEventReceiver) initEventReceiverURL() { @@ -18,7 +18,7 @@ func (report *ReportEventReceiver) initEventReceiverURL() { urlObj.Path = "/k8s/v2/postureReport" q := urlObj.Query() - q.Add("customerGUID", uuid.FromStringOrNil(report.customerGUID).String()) + q.Add("customerGUID", uuid.MustParse(report.customerGUID).String()) q.Add("clusterName", report.clusterName) urlObj.RawQuery = q.Encode()