Skip to content

Commit 066eea3

Browse files
RahulChan35RahulChan35
committed
7787: Add support for parsing allow/deny dependency lists from config file
1 parent 4b88517 commit 066eea3

4 files changed

Lines changed: 230 additions & 2 deletions

File tree

‎internal/upload/batch.go‎

Lines changed: 31 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -322,8 +322,9 @@ type purlConfig struct {
322322
}
323323

324324
type DebrickedConfig struct {
325-
Overrides []purlConfig `json:"override,omitempty" yaml:"overrides"`
326-
Ignore *IgnoreConfig `json:"ignore,omitempty" yaml:"ignore,omitempty"`
325+
Overrides []purlConfig `json:"override,omitempty" yaml:"overrides"`
326+
Ignore *IgnoreConfig `json:"ignore,omitempty" yaml:"ignore,omitempty"`
327+
Policies *PoliciesConfig `json:"policies,omitempty" yaml:"policies,omitempty"`
327328
}
328329

329330
// IgnoreConfig matches the structure of the 'ignore' section in YAML
@@ -336,6 +337,17 @@ type IgnorePackage struct {
336337
Version string `json:"version,omitempty" yaml:"version,omitempty"`
337338
}
338339

340+
// PoliciesConfig matches the structure of the 'policies' section in YAML
341+
type PoliciesConfig struct {
342+
Allow *PolicyPackages `json:"allow,omitempty" yaml:"allow,omitempty"`
343+
Deny *PolicyPackages `json:"deny,omitempty" yaml:"deny,omitempty"`
344+
}
345+
346+
// PolicyPackages contains a list of package identifiers.
347+
type PolicyPackages struct {
348+
Packages []string `json:"packages" yaml:"packages"`
349+
}
350+
339351
type uploadFinish struct {
340352
CiUploadId string `json:"ciUploadId"`
341353
RepositoryName string `json:"repositoryName"`
@@ -387,6 +399,21 @@ func extractIgnore(raw map[string]interface{}) *IgnoreConfig {
387399
return nil
388400
}
389401

402+
// extractPolicies unmarshals the policies section from raw config
403+
func extractPolicies(raw map[string]interface{}) *PoliciesConfig {
404+
if rawPolicies, ok := raw["policies"]; ok {
405+
policiesYaml, err := yaml.Marshal(rawPolicies)
406+
if err == nil {
407+
var policiesObj PoliciesConfig
408+
if yaml.Unmarshal(policiesYaml, &policiesObj) == nil {
409+
return &policiesObj
410+
}
411+
}
412+
}
413+
414+
return nil
415+
}
416+
390417
// convertOverrides converts YAML overrides to purlConfig slice
391418
func convertOverrides(yamlOverrides []pURLConfigYAML) []purlConfig {
392419
var overrides []purlConfig
@@ -463,10 +490,12 @@ func GetDebrickedConfig(path string) *DebrickedConfig {
463490
}
464491

465492
ignore := extractIgnore(raw)
493+
policies := extractPolicies(raw)
466494
overrides := convertOverrides(yamlConfig.Overrides)
467495

468496
return &DebrickedConfig{
469497
Overrides: overrides,
470498
Ignore: ignore,
499+
Policies: policies,
471500
}
472501
}

‎internal/upload/batch_test.go‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -310,3 +310,113 @@ func TestGetDebrickedConfigSingularOverride(t *testing.T) {
310310
assert.Nil(t, err)
311311
assert.JSONEq(t, string(configJSON), string(expectedJSON))
312312
}
313+
314+
func TestGetDebrickedConfigPolicies(t *testing.T) {
315+
config := GetDebrickedConfig(filepath.Join("testdata", "debricked-config-policies.yaml"))
316+
configJSON, err := json.Marshal(config)
317+
assert.Nil(t, err)
318+
expectedJSON, err := json.Marshal(DebrickedConfig{
319+
Overrides: []purlConfig{
320+
{
321+
PackageURL: "pkg:npm/lodash",
322+
Version: boolOrString{Version: "1.0.0", HasVersion: true},
323+
FileRegexes: []string{"chart.js-2.6.0.tgz"},
324+
},
325+
},
326+
Ignore: &IgnoreConfig{
327+
Packages: []IgnorePackage{
328+
{PURL: "pkg:maven/javax.transaction/jta"},
329+
{PURL: "pkg:maven/org.quartz-scheduler/quartz"},
330+
{PURL: "pkg:maven/com.google.guava/guava", Version: "1.1.1"},
331+
{PURL: "pkg:maven/com.googlecode.json-simple/json-simplea", Version: "1.1.1"},
332+
{PURL: "pkg:maven/com.fasterxml.jackson.core/jackson-databind"},
333+
},
334+
},
335+
Policies: &PoliciesConfig{
336+
Allow: &PolicyPackages{
337+
Packages: []string{
338+
"pkg:npm/lodash@4.17.21",
339+
"pkg:maven/org.springframework/spring-core@5.3.20",
340+
"react",
341+
"express",
342+
"axios@1.3.0",
343+
"lodash@>=4.17.21,<5.0.0",
344+
"log4j@2.15.0-2.17.1",
345+
},
346+
},
347+
Deny: &PolicyPackages{
348+
Packages: []string{
349+
"pkg:npm/request",
350+
"colors@<=1.4.0",
351+
"node-ipc@<=9.2.1",
352+
"pkg:pypi/setuptools@<65.0.0",
353+
"pkg:pypi/gpl-restricted-package",
354+
"proprietary-lib",
355+
},
356+
},
357+
},
358+
})
359+
assert.Nil(t, err)
360+
assert.JSONEq(t, string(configJSON), string(expectedJSON))
361+
}
362+
363+
func TestGetDebrickedConfigPoliciesOnly(t *testing.T) {
364+
config := GetDebrickedConfig(filepath.Join("testdata", "debricked-config-policies-only.yaml"))
365+
configJSON, err := json.Marshal(config)
366+
assert.Nil(t, err)
367+
expectedJSON, err := json.Marshal(DebrickedConfig{
368+
Policies: &PoliciesConfig{
369+
Allow: &PolicyPackages{
370+
Packages: []string{
371+
// PURL format
372+
"pkg:npm/lodash@4.17.21",
373+
"pkg:maven/org.springframework/spring-core@5.3.20",
374+
"pkg:pypi/requests@2.28.0",
375+
"pkg:nuget/Newtonsoft.Json@13.0.1",
376+
"pkg:npm/@angular/core@15.0.0",
377+
// Name only
378+
"react",
379+
"webpack",
380+
"express",
381+
"typescript",
382+
// Name@version
383+
"axios@1.3.0",
384+
"lodash@4.17.21",
385+
"vue@3.2.45",
386+
// Version ranges
387+
"django@>=3.2.0,<5.0.0",
388+
"spring-boot@>=2.7.0,<3.0.0",
389+
"lodash@>=4.17.21,<5.0.0",
390+
"log4j@2.15.0-2.17.1",
391+
// Comparison operators
392+
"pytest@>=7.0.0",
393+
"guava@>=31.0.0",
394+
},
395+
},
396+
Deny: &PolicyPackages{
397+
Packages: []string{
398+
// PURL format
399+
"pkg:npm/request",
400+
"pkg:npm/event-stream@3.3.6",
401+
"pkg:maven/log4j/log4j@1.2.17",
402+
"pkg:pypi/pycrypto",
403+
"pkg:npm/flatmap-stream",
404+
// Name only
405+
"colors",
406+
"node-ipc",
407+
// Version ranges and constraints
408+
"setuptools@<65.0.0",
409+
"minimist@<1.2.6",
410+
"pillow@<8.3.2",
411+
"log4j@1.0-2.14.1",
412+
"commons-collections@<=3.2.1",
413+
// Comparison operators
414+
"System.Text.Encodings.Web@<4.7.2",
415+
"moment@<=2.29.1",
416+
},
417+
},
418+
},
419+
})
420+
assert.Nil(t, err)
421+
assert.JSONEq(t, string(configJSON), string(expectedJSON))
422+
}

‎internal/upload/testdata/debricked-config-policies-only.yaml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
policies:
2+
allow:
3+
packages:
4+
# PURL format (exact package match)
5+
- "pkg:npm/lodash@4.17.21"
6+
- "pkg:maven/org.springframework/spring-core@5.3.20"
7+
- "pkg:pypi/requests@2.28.0"
8+
- "pkg:nuget/Newtonsoft.Json@13.0.1"
9+
- "pkg:npm/@angular/core@15.0.0"
10+
11+
# Name only (matches all versions, all package managers)
12+
- "react"
13+
- "webpack"
14+
- "express"
15+
- "typescript"
16+
17+
# Name@version (specific version)
18+
- "axios@1.3.0"
19+
- "lodash@4.17.21"
20+
- "vue@3.2.45"
21+
22+
# Version ranges (semver style)
23+
- "django@>=3.2.0,<5.0.0"
24+
- "spring-boot@>=2.7.0,<3.0.0"
25+
- "lodash@>=4.17.21,<5.0.0"
26+
- "log4j@2.15.0-2.17.1"
27+
28+
# Comparison operators
29+
- "pytest@>=7.0.0"
30+
- "guava@>=31.0.0"
31+
32+
deny:
33+
packages:
34+
# PURL format (exact package match)
35+
- "pkg:npm/request"
36+
- "pkg:npm/event-stream@3.3.6"
37+
- "pkg:maven/log4j/log4j@1.2.17"
38+
- "pkg:pypi/pycrypto"
39+
- "pkg:npm/flatmap-stream"
40+
41+
# Name only (any version)
42+
- "colors"
43+
- "node-ipc"
44+
45+
# Version ranges and constraints
46+
- "setuptools@<65.0.0"
47+
- "minimist@<1.2.6"
48+
- "pillow@<8.3.2"
49+
- "log4j@1.0-2.14.1"
50+
- "commons-collections@<=3.2.1"
51+
52+
# Comparison operators
53+
- "System.Text.Encodings.Web@<4.7.2"
54+
- "moment@<=2.29.1"

‎internal/upload/testdata/debricked-config-policies.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
overrides:
2+
- pURL: "pkg:npm/lodash"
3+
version: "1.0.0"
4+
fileRegexes:
5+
- "chart.js-2.6.0.tgz"
6+
7+
ignore:
8+
packages:
9+
- pURL: "pkg:maven/javax.transaction/jta"
10+
- pURL: "pkg:maven/org.quartz-scheduler/quartz"
11+
- pURL: "pkg:maven/com.google.guava/guava"
12+
version: "1.1.1"
13+
- pURL: "pkg:maven/com.googlecode.json-simple/json-simplea"
14+
version: "1.1.1"
15+
- pURL: "pkg:maven/com.fasterxml.jackson.core/jackson-databind"
16+
17+
policies:
18+
allow:
19+
packages:
20+
- "pkg:npm/lodash@4.17.21"
21+
- "pkg:maven/org.springframework/spring-core@5.3.20"
22+
- "react"
23+
- "express"
24+
- "axios@1.3.0"
25+
- "lodash@>=4.17.21,<5.0.0"
26+
- "log4j@2.15.0-2.17.1"
27+
28+
deny:
29+
packages:
30+
- "pkg:npm/request"
31+
- "colors@<=1.4.0"
32+
- "node-ipc@<=9.2.1"
33+
- "pkg:pypi/setuptools@<65.0.0"
34+
- "pkg:pypi/gpl-restricted-package"
35+
- "proprietary-lib"

0 commit comments

Comments
 (0)