stackrox · theencee · Feb 10, 2022 · Dec 21, 2021
diff --git a/central/deployment/service/service_impl.go b/central/deployment/service/service_impl.go
@@ -143,6 +143,15 @@ func (s *serviceImpl) GetDeploymentWithRisk(ctx context.Context, request *v1.Res
 		return nil, err
 	}
 
+	msg := ""
+	for _, r := range risk.GetResults() {
+		if r.GetName() == "Image Vulnerabilities" {
+			for _, f := range r.GetFactors() {
+				msg += f.GetMessage()
+			}
+		}
+	}
+	log.Errorf("Got risk for deployment %s and img vuln msg: %s", deployment.GetName(), msg)
 	return &v1.GetDeploymentWithRiskResponse{
 		Deployment: deployment,
 		Risk:       risk,

diff --git a/central/risk/multipliers/component/vulnerabilities.go b/central/risk/multipliers/component/vulnerabilities.go
@@ -3,10 +3,12 @@ package component
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	"github.com/stackrox/rox/central/risk/multipliers"
 	"github.com/stackrox/rox/central/risk/scorer/vulns"
 	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/logging"
 	"github.com/stackrox/rox/pkg/scancomponent"
 )
 
@@ -31,10 +33,17 @@ func NewVulnerabilities(typ, heading string) Multiplier {
 
 // Score takes a component and evaluates its risk based on vulnerabilities
 func (c *vulnerabilitiesMultiplier) Score(_ context.Context, component scancomponent.ScanComponent) *storage.Risk_Result {
+	log := logging.LoggerForModule()
+	if strings.Contains(component.GetName(), "log4j") {
+		log.Errorf("[Score - Component] STARTING scoring for component %s", component.GetName())
+	}
 	min, max, sum, numCVEs := vulns.ProcessComponent(component)
 	if numCVEs == 0 {
 		return nil
 	}
+	if strings.Contains(component.GetName(), "log4j") {
+		log.Errorf("[Score - Component] ND scoring for component %s and got %v vulns", component.GetName(), numCVEs)
+	}
 
 	return &storage.Risk_Result{
 		Name: c.heading,

diff --git a/central/risk/multipliers/image/vulnerabilities.go b/central/risk/multipliers/image/vulnerabilities.go
@@ -3,10 +3,12 @@ package image
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	"github.com/stackrox/rox/central/risk/multipliers"
 	"github.com/stackrox/rox/central/risk/scorer/vulns"
 	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/logging"
 	"github.com/stackrox/rox/pkg/scancomponent"
 )
 
@@ -28,6 +30,11 @@ func NewVulnerabilities() Multiplier {
 
 // Score takes an image and evaluates its risk based on vulnerabilities
 func (c *vulnerabilitiesMultiplier) Score(_ context.Context, image *storage.Image) *storage.Risk_Result {
+	log := logging.LoggerForModule()
+	if strings.Contains(image.GetName().GetFullName(), "log4j") || strings.Contains(image.GetName().GetFullName(), "nginx") {
+		log.Errorf("[Score - Images] STARTING scoring for image %s", image.GetName().GetFullName())
+	}
+
 	imgComponents := image.GetScan().GetComponents()
 	components := make([]scancomponent.ScanComponent, 0, len(imgComponents))
 	for _, imgComponent := range imgComponents {
@@ -38,6 +45,11 @@ func (c *vulnerabilitiesMultiplier) Score(_ context.Context, image *storage.Imag
 		return nil
 	}
 
+
+	if strings.Contains(image.GetName().GetFullName(), "log4j") || strings.Contains(image.GetName().GetFullName(), "nginx") {
+		log.Errorf("[Score - Images] END scoring for image %s and got %v vulns", image.GetName().GetFullName(), num)
+	}
+
 	score := multipliers.NormalizeScore(sum, vulnSaturation, vulnMaxScore)
 	return &storage.Risk_Result{
 		Name: VulnerabilitiesHeading,

diff --git a/central/risk/scorer/vulns/component.go b/central/risk/scorer/vulns/component.go
@@ -2,9 +2,11 @@ package vulns
 
 import (
 	"math"
+	"strings"
 
 	"github.com/stackrox/rox/generated/storage"
 	"github.com/stackrox/rox/pkg/cvss"
+	"github.com/stackrox/rox/pkg/logging"
 	"github.com/stackrox/rox/pkg/scancomponent"
 )
 
@@ -37,6 +39,11 @@ func ProcessComponents(components []scancomponent.ScanComponent) (min, max Compo
 		}
 		sum += cSum
 		num += cNum
+
+		log := logging.LoggerForModule()
+		if strings.Contains(component.GetName(), "log4j") {
+			log.Errorf("[ProcessComponents] For component %s got %+v vulns", component.GetName(), cNum)
+		}
 	}
 	return min, max, sum, num
 }

diff --git a/central/vulnerabilityrequest/manager/requestmgr/manager_impl.go b/central/vulnerabilityrequest/manager/requestmgr/manager_impl.go
@@ -208,6 +208,7 @@ func (m *managerImpl) SnoozeVulnerabilityOnRequest(_ context.Context, request *s
 		}
 	}
 
+	log.Errorf("Reprocessing entities on snooze for request %s for cve %+v", request.GetId(), request.GetCves().GetIds())
 	go m.reprocessAffectedEntities(request.GetId(), imageIDs...)
 	return nil
 }
@@ -247,6 +248,7 @@ func (m *managerImpl) UnSnoozeVulnerabilityOnRequest(_ context.Context, request
 		}
 	}
 
+	log.Errorf("Reprocessing entities on unsnooze for request %s for cve %+v", request.GetId(), request.GetCves().GetIds())
 	go m.reprocessAffectedEntities(request.GetId(), imageIDs...)
 	return nil
 }

@@ -0,0 +1,62 @@
+package deploytime
+
+import (
+	"encoding/json"
+	"fmt"
+	"testing"
+
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/pkg/booleanpolicy/policyversion"
+	"github.com/stackrox/rox/pkg/detection"
+	"github.com/stackrox/rox/pkg/fixtures"
+	"github.com/stretchr/testify/suite"
+)
+
+func TestDeploytimeDetector(t *testing.T) {
+suite.Run(t, new(DeploytimeDetectorTestSuite))
+}
+
+type DeploytimeDetectorTestSuite struct {
+	suite.Suite
+}
+
+func (s *DeploytimeDetectorTestSuite) TestDeploytimeCVEPolicy() {
+	policySet := detection.NewPolicySet()
+
+	err := policySet.UpsertPolicy(s.getCVEPolicy())
+	s.NoError(err, "upsert policy should succeed")
+
+	d := NewDetector(policySet)
+
+	dep := fixtures.GetDeployment()
+	images := fixtures.DeploymentImages()
+	alerts, err := d.Detect(DetectionContext{}, dep, images)
+
+	s.NoError(err)
+	s.NotNil(alerts)
+	j, _ := json.Marshal(alerts[0])
+	fmt.Printf("%+v\n", alerts[0])
+	fmt.Println(string(j))
+}
+
+func (s *DeploytimeDetectorTestSuite) getCVEPolicy() *storage.Policy {
+	return policyversion.MustEnsureConverted(&storage.Policy{
+		Id:            "9dc8b85e-7b35-4423-847b-165cd9b92fc7",
+		PolicyVersion: "1.1",
+		Name:          "TEST-CVE_POLICY",
+		Severity:      storage.Severity_LOW_SEVERITY,
+		Categories:    []string{"test"},
+		PolicySections: []*storage.PolicySection{
+			{
+				PolicyGroups: []*storage.PolicyGroup{
+					{
+						FieldName: "CVE",
+						Negate:    false,
+						Values:    []*storage.PolicyValue{{Value: "cve"}},
+					},
+				},
+			},
+		},
+		LifecycleStages: []storage.LifecycleStage{storage.LifecycleStage_DEPLOY},
+	})
+}
@@ -1,6 +1,7 @@
 package services
 
 import io.stackrox.proto.api.v1.Common
+import io.stackrox.proto.api.v1.SearchServiceOuterClass
 import io.stackrox.proto.api.v1.VulnReqService
 import io.stackrox.proto.api.v1.VulnerabilityRequestServiceGrpc
 import io.stackrox.proto.storage.VulnRequests.VulnerabilityRequest
@@ -11,6 +12,10 @@ class VulnRequestService extends BaseService {
         return VulnerabilityRequestServiceGrpc.newBlockingStub(getChannel())
     }
 
+    static listVulnRequests() {
+        return getVulnRequestClient().listVulnerabilityRequests(SearchServiceOuterClass.RawQuery.newBuilder().build())
+    }
+
     static getVulnReq(String reqID) {
         def id = Common.ResourceByID.newBuilder()
                 .setId(reqID)
@@ -75,4 +80,19 @@ class VulnRequestService extends BaseService {
                 setGlobalScope(VulnerabilityRequest.Scope.Global.newBuilder()).
                         build()
     }
+
+    static imageScope(String fullImageName, boolean allTags) {
+        def imageParts = fullImageName.split(":")
+        def tag = allTags ? ".*" : imageParts[1]
+        def idx = imageParts[0].indexOf('/')
+
+        def imageBuilder = VulnerabilityRequest.Scope.Image.newBuilder().
+                setRegistry(imageParts[0].substring(0, idx)).
+                setRemote(imageParts[0].substring(idx+1)).
+                setTag(tag)
+
+        return VulnerabilityRequest.Scope.newBuilder().
+                setImageScope(imageBuilder).
+                build()
+    }
 }