Skip to content

Commit 6a26463

Browse files
tommyknowstommyknows
authored
Merge pull request #4224 from snyk/feat/app-vulns-featureflag
feat: disable container app scan with feature flag #4105
2 parents bc16000 + b12216d commit 6a26463

File tree

6 files changed

+109
-20
lines changed

6 files changed

+109
-20
lines changed

‎src/cli/commands/monitor/index.ts

Lines changed: 25 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@ import { isMultiProjectScan } from '../../../lib/is-multi-project-scan';
4848
import { getEcosystem, monitorEcosystem } from '../../../lib/ecosystems';
4949
import { getFormattedMonitorOutput } from '../../../lib/ecosystems/monitor';
5050
import { processCommandArgs } from '../process-command-args';
51+
import { hasFeatureFlag } from '../../../lib/feature-flags';
5152

5253
const SEPARATOR = '\n-------------------------------------------------------\n';
5354
const debug = Debug('snyk');
@@ -96,14 +97,31 @@ export default async function monitor(...args0: MethodArgs): Promise<any> {
9697
// TODO remove 'app-vulns' options and warning message once
9798
// https://github.com/snyk/cli/pull/3433 is merged
9899
if (options.docker) {
99-
if (!options['app-vulns'] || options['exclude-app-vulns']) {
100+
// order is important here, we want:
101+
// 1) exclude-app-vulns set -> no app vulns
102+
// 2) app-vulns set -> app-vulns
103+
// 3) neither set -> containerAppVulnsEnabled
104+
if (options['exclude-app-vulns']) {
100105
options['exclude-app-vulns'] = true;
101-
}
102-
103-
// we can't print the warning message with JSON output as that would make
104-
// the JSON output invalid.
105-
if (!options['app-vulns'] && !options['json']) {
106-
console.log(theme.color.status.warn(appVulnsReleaseWarningMsg));
106+
} else if (options['app-vulns']) {
107+
options['exclude-app-vulns'] = false;
108+
} else {
109+
options['exclude-app-vulns'] = !(await hasFeatureFlag(
110+
'containerCliAppVulnsEnabled',
111+
options,
112+
));
113+
114+
// we can't print the warning message with JSON output as that would make
115+
// the JSON output invalid.
116+
// We also only want to print the message if the user did not overwrite
117+
// the default with one of the flags.
118+
if (
119+
options['exclude-app-vulns'] &&
120+
!options['json'] &&
121+
!options['sarif']
122+
) {
123+
console.log(theme.color.status.warn(appVulnsReleaseWarningMsg));
124+
}
107125
}
108126
}
109127

‎src/cli/commands/test/index.ts

Lines changed: 24 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -98,14 +98,31 @@ export default async function test(
9898
// TODO remove 'app-vulns' options and warning message once
9999
// https://github.com/snyk/cli/pull/3433 is merged
100100
if (options.docker) {
101-
if (!options['app-vulns'] || options['exclude-app-vulns']) {
101+
// order is important here, we want:
102+
// 1) exclude-app-vulns set -> no app vulns
103+
// 2) app-vulns set -> app-vulns
104+
// 3) neither set -> containerAppVulnsEnabled
105+
if (options['exclude-app-vulns']) {
102106
options['exclude-app-vulns'] = true;
103-
}
104-
105-
// we can't print the warning message with JSON output as that would make
106-
// the JSON output invalid.
107-
if (!options['app-vulns'] && !options['json']) {
108-
console.log(theme.color.status.warn(appVulnsReleaseWarningMsg));
107+
} else if (options['app-vulns']) {
108+
options['exclude-app-vulns'] = false;
109+
} else {
110+
options['exclude-app-vulns'] = !(await hasFeatureFlag(
111+
'containerCliAppVulnsEnabled',
112+
options,
113+
));
114+
115+
// we can't print the warning message with JSON output as that would make
116+
// the JSON output invalid.
117+
// We also only want to print the message if the user did not overwrite
118+
// the default with one of the flags.
119+
if (
120+
options['exclude-app-vulns'] &&
121+
!options['json'] &&
122+
!options['sarif']
123+
) {
124+
console.log(theme.color.status.warn(appVulnsReleaseWarningMsg));
125+
}
109126
}
110127
}
111128

‎test/acceptance/fake-server.ts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ const featureFlagDefaults = (): Map<string, boolean> => {
1010
return new Map([
1111
['cliFailFast', false],
1212
['iacIntegratedExperience', false],
13+
['containerCliAppVulnsEnabled', false],
1314
]);
1415
};
1516

‎test/jest/acceptance/cli-args.spec.ts

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ const isWindows =
1212
jest.setTimeout(1000 * 60 * 5);
1313

1414
describe('cli args', () => {
15-
let server;
15+
let server: ReturnType<typeof fakeServer>;
1616
let env: Record<string, string>;
1717

1818
beforeAll((done) => {
@@ -301,7 +301,7 @@ describe('cli args', () => {
301301
});
302302

303303
test('iac test with flags not allowed with --sarif', async () => {
304-
const { code, stdout } = await runSnykCLI(`test iac --sarif --json`, {
304+
const { code, stdout } = await runSnykCLI(`iac test --sarif --json`, {
305305
env,
306306
});
307307
expect(stdout).toMatch(
@@ -312,10 +312,13 @@ describe('cli args', () => {
312312
expect(code).toEqual(2);
313313
});
314314

315-
test('iac container with flags not allowed with --sarif', async () => {
316-
const { code, stdout } = await runSnykCLI(`test container --sarif --json`, {
317-
env,
318-
});
315+
test('container test with flags not allowed with --sarif', async () => {
316+
const { code, stdout } = await runSnykCLI(
317+
`container test --sarif --json`,
318+
{
319+
env,
320+
},
321+
);
319322
expect(stdout).toMatch(
320323
new UnsupportedOptionCombinationError(['test', 'sarif', 'json'])
321324
.userMessage,

‎test/tap/cli-fail-on-docker.test.ts

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,11 @@ test('test docker image with no fixable vulns and --fail-on=all', async (t) => {
8181
await cli.test('debian/sqlite3:latest', {
8282
failOn: 'all',
8383
docker: true,
84+
// TODO: we should be able to remove that setting once once we remove the
85+
// containerCliAppVulnsEnabled feature flag has been removed as well.
86+
// Currently without setting this (or app-vulns), the code tries to reach
87+
// the API to check the feature flag and throws an exception.
88+
'exclude-app-vulns': true,
8489
});
8590
t.pass('should not throw exception');
8691
} catch (err) {
@@ -98,6 +103,11 @@ test('test docker image with fixable vulns and --fail-on=all', async (t) => {
98103
await cli.test('garethr/snyky:alpine', {
99104
failOn: 'all',
100105
docker: true,
106+
// TODO: we should be able to remove that setting once once we remove the
107+
// containerCliAppVulnsEnabled feature flag has been removed as well.
108+
// Currently without setting this (or app-vulns), the code tries to reach
109+
// the API to check the feature flag and throws an exception.
110+
'exclude-app-vulns': true,
101111
});
102112
t.fail('expected test to throw exception');
103113
} catch (err) {

‎test/tap/cli-monitor.acceptance.test.ts

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1876,6 +1876,46 @@ if (!isWindows) {
18761876
t.deepEqual(policyString, expected, 'sends correct policy');
18771877
});
18781878

1879+
test('`monitor foo:latest --docker` with app vulns feature flag enabled', async (t) => {
1880+
chdirWorkspaces('npm-package-policy');
1881+
const spyPlugin = stubDockerPluginResponse(
1882+
{
1883+
scanResults: [
1884+
{
1885+
identity: {
1886+
type: 'rpm',
1887+
},
1888+
target: {
1889+
image: 'docker-image|foo',
1890+
},
1891+
facts: [{ type: 'depGraph', data: {} }],
1892+
},
1893+
],
1894+
attributes: {},
1895+
},
1896+
t,
1897+
);
1898+
1899+
server.setFeatureFlag('containerCliAppVulnsEnabled', true);
1900+
await cli.monitor('foo:latest', {
1901+
docker: true,
1902+
org: 'explicit-org',
1903+
});
1904+
t.same(
1905+
spyPlugin.getCall(0).args,
1906+
[
1907+
{
1908+
docker: true,
1909+
'exclude-app-vulns': false,
1910+
org: 'explicit-org',
1911+
path: 'foo:latest',
1912+
},
1913+
],
1914+
'calls docker plugin with expected arguments',
1915+
);
1916+
server.setFeatureFlag('containerCliAppVulnsEnabled', false);
1917+
});
1918+
18791919
test('`monitor foo:latest --docker --platform=linux/arm64`', async (t) => {
18801920
const platform = 'linux/arm64';
18811921
const spyPlugin = stubDockerPluginResponse(

0 commit comments

Comments
 (0)