cloudflare/cloudflared
Publicmirrored from https://github.com/cloudflare/cloudflaredAvailable
.ci/scripts/vuln-check.sh
53lines · modecode
| 1 | #!/bin/bash |
| 2 | set -e -u |
| 3 | |
| 4 | # Define the file to store the list of vulnerabilities to ignore. |
| 5 | IGNORE_FILE=".vulnignore" |
| 6 | |
| 7 | go version |
| 8 | # Check if the ignored vulnerabilities file exists. If not, create an empty one. |
| 9 | if [ ! -f "$IGNORE_FILE" ]; then |
| 10 | touch "$IGNORE_FILE" |
| 11 | echo "Created an empty file to store ignored vulnerabilities: $IGNORE_FILE" |
| 12 | echo "# Add vulnerability IDs (e.g., GO-2022-0450) to ignore, one per line." >>"$IGNORE_FILE" |
| 13 | echo "# You can also add comments on the same line after the ID." >>"$IGNORE_FILE" |
| 14 | echo "" >>"$IGNORE_FILE" |
| 15 | fi |
| 16 | |
| 17 | # Run govulncheck and capture its output. |
| 18 | VULN_OUTPUT=$(go run -mod=readonly golang.org/x/vuln/cmd/govulncheck@latest ./... || true) |
| 19 | |
| 20 | # Print the govuln output |
| 21 | echo "=====================================" |
| 22 | echo "Full Output of govulncheck:" |
| 23 | echo "=====================================" |
| 24 | echo "$VULN_OUTPUT" |
| 25 | echo "=====================================" |
| 26 | echo "End of govulncheck Output" |
| 27 | echo "=====================================" |
| 28 | |
| 29 | # Process the ignore file to remove comments and empty lines. |
| 30 | # The 'cut' command gets the vulnerability ID and removes anything after the '#'. |
| 31 | # The 'grep' command filters out empty lines and lines starting with '#'. |
| 32 | CLEAN_IGNORES=$(grep -v '^\s*#' "$IGNORE_FILE" | cut -d'#' -f1 | sed 's/ //g' | sort -u || true) |
| 33 | |
| 34 | # Filter out the ignored vulnerabilities. |
| 35 | UNIGNORED_VULNS=$(echo "$VULN_OUTPUT" | grep 'Vulnerability' || true) |
| 36 | |
| 37 | # If the list of ignored vulnerabilities is not empty, filter them out. |
| 38 | if [ -n "$CLEAN_IGNORES" ]; then |
| 39 | UNIGNORED_VULNS=$(echo "$UNIGNORED_VULNS" | grep -vFf <(echo "$CLEAN_IGNORES") || true) |
| 40 | fi |
| 41 | |
| 42 | # If there are any vulnerabilities that were not in our ignore list, print them and exit with an error. |
| 43 | if [ -n "$UNIGNORED_VULNS" ]; then |
| 44 | echo "🚨 Found new, unignored vulnerabilities:" |
| 45 | echo "-------------------------------------" |
| 46 | echo "$UNIGNORED_VULNS" |
| 47 | echo "-------------------------------------" |
| 48 | echo "Exiting with an error. ❌" |
| 49 | exit 1 |
| 50 | else |
| 51 | echo "🎉 No new vulnerabilities found. All clear! ✨" |
| 52 | exit 0 |
| 53 | fi |