Package.json and package-lock,json are not scanned on a nginx image

Abierto
  • ¿Algo no está bien?
#19,633 3 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Necesita aclaración
Estado de actividad
Tranquilo
Stack tecnológico
angular, docker, go, javascript, nginx, typescript
Área
devops, security

Línea de trabajo

Start by reproducing the report with the example Dockerfile, including package.json and package-lock.json at the image root, and compare StackRox 4.10.0 results with Trivy. Check how StackRox discovers JavaScript and TypeScript manifests in nginx images; done means confirming whether this is configuration, an unsupported scan case, or a product defect and recording the expected behavior.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Hey guys,
we are using stackrox 4.10.0 to check our kubernetes environment for CVEs. We are building SPAs with Angular and copy the generated JS/HTML into NGINX images.

Package.json on nginx
When we also put the package.json and package-lock.json into the root folder of the NGINX image, then no CVEs from the JavaScript/TypeScript workloads appear. We expect to see the same issues in stackrox as in trivy during the build of angular. We only see the issues from the underlying linux.

We are seeing this as well with .net images (where the .net dlls in a dotnet baseimage won't trigger any CVE alerts, only the issues from the underlying linux are shown.).

As we are just starting with stackrox, this could be a configuration mistake as well.

Example Dockerfile:

FROM corporateregistry,io/baseimages/nginx:latest
ARG NGINX_CONFIG_PATH=./workspace/nginx/default/default.conf
ARG APP_NAME=startseite
ARG APP_ROOTFOLDER=./workspace/dist/apps/

EXPOSE 8080

ENV APP_NAME=${APP_NAME}
ENV NGINX_ENVSUBST_TEMPLATE_DIR=/usr/share/nginx/html/browser/assets
ENV NGINX_ENVSUBST_OUTPUT_DIR=/usr/share/nginx/html/browser/assets
ENV NGINX_ENVSUBST_TEMPLATE_SUFFIX=.template

COPY ./workspace/package.json /package.json
COPY ./workspace/package-lock.json /package-lock.json
COPY ${NGINX_CONFIG_PATH} /etc/nginx/conf.d/
COPY ${APP_ROOTFOLDER}/${APP_NAME} /usr/share/nginx/html

Thanks in advance

Lenguaje dominante
Go
Estrellas
1.3k
Forks
194
Merge medio
2 d 20 h
PR fusionados (30 d)
392

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de stackrox/stackrox

Todos los issues de stackrox/stackrox

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.