在 dotnet 项目中发现易受攻击的 nuget 包时，使 GitHub Actions CI 构建失败时出错

问题描述 投票：0回答：1

我正在检查当解决方案中的项目中发现易受攻击的 nuget 包时使 GitHub Actions CI 构建失败的方法。这是repo

最初，我在 

deployment.yml

中有以下简单命令 
# Check Vulnerable Nuget Packages
- name: Checking Vulnerable Nuget Packages
  run: dotnet list package --vulnerable --include-transitive

但这并不会使构建失败。因此，经过一番谷歌搜索后，我发现当按照以下文章发现易受攻击的包时，构建可能会失败。所以我将上面的yml修改如下，

# Check Vulnerable Nuget Packages
- name: Checking Vulnerable Nuget Packages
  run: |
    dotnet list package --vulnerable --include-transitive 2>&1 | tee build.log
    echo "Analyze dotnet vulnerable nuget package command log output..."
    grep -q -i "critical\|high\|moderate\|low" build.log; [ $? -eq 0 ] && echo "Security Vulnerabilities found in Nuget Packages on the log output" && exit 1

这是上述命令的日志，

Run dotnet list package --vulnerable --include-transitive 2>&1 | tee build.log
  dotnet list package --vulnerable --include-transitive 2>&1 | tee build.log
  echo "Analyze dotnet vulnerable nuget package command log output..."
  grep -q -i "critical\|high\|moderate\|low" build.log; [ $? -eq 0 ] && echo "Security Vulnerabilities found in Nuget Packages on the log output" && exit 1
  shell: /usr/bin/bash -e {0}
  env:
    DOTNET_ROOT: /usr/share/dotnet

The following sources were used:
   https://api.nuget.org/v3/index.json

The given project `Web` has no vulnerable packages given the current sources.
The given project `BaseComponents` has no vulnerable packages given the current sources.
The given project `BlazorDemoComponents` has no vulnerable packages given the current sources.
The given project `SharedModels` has no vulnerable packages given the current sources.
The given project `OOPSDemoComponents` has no vulnerable packages given the current sources.
The given project `UITests` has no vulnerable packages given the current sources.
The given project `DependencyInjectionDemoComponents` has no vulnerable packages given the current sources.
The given project `SharedComponents` has no vulnerable packages given the current sources.
The given project `LINQDemoComponents` has no vulnerable packages given the current sources.
The given project `DesignPatternDemoComponents` has no vulnerable packages given the current sources.
The given project `ReportDemoComponents` has no vulnerable packages given the current sources.
The given project `HTTPClientDemoComponents` has no vulnerable packages given the current sources.
The given project `MiddlewareDemoComponents` has no vulnerable packages given the current sources.
The given project `PythonDemoComponents` has no vulnerable packages given the current sources.
The given project `SOLIDDemoComponents` has no vulnerable packages given the current sources.
The given project `TDDDemoComponents` has no vulnerable packages given the current sources.
The given project `WebAPIDemoComponents` has no vulnerable packages given the current sources.
The given project `CommonComponents` has no vulnerable packages given the current sources.
Analyze dotnet vulnerable nuget package command log output...
Security Vulnerabilities found in Nuget Packages on the log output
Error: Process completed with exit code 1.

上面的日志显示任何项目中都没有易受攻击的包，但构建仍然失败。所以我决定打印

build.log
的内容来看看其中有什么问题。这是更新后的命令，

- name: Checking Vulnerable Nuget Packages
  run: |
    dotnet list package --vulnerable --include-transitive 2>&1 | tee build.log
    echo "printing build.log..."
    cat build.log
    echo "Analyze dotnet vulnerable nuget package command log output..."
    grep -q -i "critical\|high\|moderate\|low" build.log; [ $? -eq 0 ] && echo "Security Vulnerabilities found in Nuget Packages on the log output" && exit 1

这是上述命令的输出，

Run dotnet list package --vulnerable --include-transitive 2>&1 | tee build.log
  dotnet list package --vulnerable --include-transitive 2>&1 | tee build.log
  echo "printing build.log..."
  cat build.log
  echo "Analyze dotnet vulnerable nuget package command log output..."
  grep -q -i "critical\|high\|moderate\|low" build.log; [ $? -eq 0 ] && echo "Security Vulnerabilities found in Nuget Packages on the log output" && exit 1
  shell: /usr/bin/bash -e {0}
  env:
    DOTNET_ROOT: /usr/share/dotnet

The following sources were used:
   https://api.nuget.org/v3/index.json

The given project `Web` has no vulnerable packages given the current sources.
The given project `BaseComponents` has no vulnerable packages given the current sources.
The given project `BlazorDemoComponents` has no vulnerable packages given the current sources.
The given project `SharedModels` has no vulnerable packages given the current sources.
The given project `OOPSDemoComponents` has no vulnerable packages given the current sources.
The given project `UITests` has no vulnerable packages given the current sources.
The given project `DependencyInjectionDemoComponents` has no vulnerable packages given the current sources.
The given project `SharedComponents` has no vulnerable packages given the current sources.
The given project `LINQDemoComponents` has no vulnerable packages given the current sources.
The given project `DesignPatternDemoComponents` has no vulnerable packages given the current sources.
The given project `ReportDemoComponents` has no vulnerable packages given the current sources.
The given project `HTTPClientDemoComponents` has no vulnerable packages given the current sources.
The given project `MiddlewareDemoComponents` has no vulnerable packages given the current sources.
The given project `PythonDemoComponents` has no vulnerable packages given the current sources.
The given project `SOLIDDemoComponents` has no vulnerable packages given the current sources.
The given project `TDDDemoComponents` has no vulnerable packages given the current sources.
The given project `WebAPIDemoComponents` has no vulnerable packages given the current sources.
The given project `CommonComponents` has no vulnerable packages given the current sources.
printing build.log...

The following sources were used:
   https://api.nuget.org/v3/index.json

The given project `Web` has no vulnerable packages given the current sources.
The given project `BaseComponents` has no vulnerable packages given the current sources.
The given project `BlazorDemoComponents` has no vulnerable packages given the current sources.
The given project `SharedModels` has no vulnerable packages given the current sources.
The given project `OOPSDemoComponents` has no vulnerable packages given the current sources.
The given project `UITests` has no vulnerable packages given the current sources.
The given project `DependencyInjectionDemoComponents` has no vulnerable packages given the current sources.
The given project `SharedComponents` has no vulnerable packages given the current sources.
The given project `LINQDemoComponents` has no vulnerable packages given the current sources.
The given project `DesignPatternDemoComponents` has no vulnerable packages given the current sources.
The given project `ReportDemoComponents` has no vulnerable packages given the current sources.
The given project `HTTPClientDemoComponents` has no vulnerable packages given the current sources.
The given project `MiddlewareDemoComponents` has no vulnerable packages given the current sources.
The given project `PythonDemoComponents` has no vulnerable packages given the current sources.
The given project `SOLIDDemoComponents` has no vulnerable packages given the current sources.
The given project `TDDDemoComponents` has no vulnerable packages given the current sources.
The given project `WebAPIDemoComponents` has no vulnerable packages given the current sources.
The given project `CommonComponents` has no vulnerable packages given the current sources.
Analyze dotnet vulnerable nuget package command log output...
Security Vulnerabilities found in Nuget Packages on the log output
Error: Process completed with exit code 1.

构建仍然失败。请你能帮我理解我在这个命令中做错了什么吗？ grep 命令有问题吗？

.net unix grep nuget github-actions
1个回答
0
投票

使用 

grep
命令的解决方案即：

grep -q -i "critical\|high\|moderate\|low" build.log

扫描完整的

build.log
，包括：

The following sources were used:
   https://api.nuget.org/v3/index.json

并且，这里它将单词“low”与“following”相匹配，这就是它失败的原因：

除此之外，将来组件名称或日志消息本身可能包含

grep
命令检查的字符串，从而导致失败。

更可靠的解决方案是使用 JSON 格式。

从 .NET SDK 7.0.200 开始，

dotnet list package
子命令提供了一个 
--format
标志，可用于生成 JSON 输出：

可以使用 

severity
 命令检查 JSON 密钥 
jq 来识别漏洞。


这是一个例子（https://jqplay.org/s/Ym9kqW4LbCe）：


dotnet list package --vulnerable --include-transitive --format=json > list.json
if jq -cre '.projects | .. | .severity? // empty' list.json; then
  echo 'Vulnerabilities found! Exiting...'
  jq . list.json
  exit 1
else
  echo 'No vulnerabilities found!'
fi



它：


    

  • 将 JSON 输出转储到 
    list.json
     文件
    • 

  • 递归检查 
    severity
     下的 
    projects
    •  键

  • 如果有一个或多个
    severity
     KV 对，则返回零

      

    • 如果成功，它会将完整的 JSON 转储到控制台上
      • 

    • 如果需要，您可以再次运行命令来打印控制台输出
      • 

    

    • 

  • 如果没有严重性键，则返回非零退出代码
    • 


    

    

    


  

  

    
最新问题


  





  

    © www.soinside.com 2019 - 2024. All rights reserved.