Frogbot shouldn't attempt upgrading Go and Pip (#315)

Author: omerzi

commands/createfixpullrequests.go

@@ -12,6 +12,7 @@ import (
 	"github.com/jfrog/jfrog-client-go/utils/io/fileutils"
 	"github.com/jfrog/jfrog-client-go/utils/log"
 	"github.com/jfrog/jfrog-client-go/xray/services"
+	"golang.org/x/exp/slices"
 	"os"
 	"strings"
 )
@@ -305,6 +306,13 @@ func (cfp *CreateFixPullRequestsCmd) updatePackageToFixedVersion(impactedPackage
 			}
 		}()
 	}
+	// Skip build tools dependencies (for example, pip)
+	// That are not defined in the descriptor file and cannot be fixed by a PR.
+	if slices.Contains(utils.BuildToolsDependenciesMap[fixVersionInfo.PackageType], impactedPackage) {
+		log.Info("Skipping vulnerable package", impactedPackage, "since it is not defined in your package descriptor file.",
+			"Update", impactedPackage, "version to", fixVersionInfo.FixVersion, "to fix this vulnerability.")
+		return
+	}
 	packageHandler := packagehandlers.GetCompatiblePackageHandler(fixVersionInfo, cfp.details, &cfp.mavenDepToPropertyMap)
 	return packageHandler.UpdateImpactedPackage(impactedPackage, fixVersionInfo)
 }

commands/createfixpullrequests_test.go

@@ -25,13 +25,15 @@ type packageFixTest struct {
 	fixVersion           string
 	packageDescriptor    string
 	testPath             string
+	shouldNotFix         bool
 	fixPackageVersionCmd FixPackagesTestFunc
 }
 
 var packageFixTests = []packageFixTest{
 	{technology: coreutils.Maven, impactedPackaged: "junit", fixVersion: "4.11", packageDescriptor: "pom.xml", fixPackageVersionCmd: getMavenFixPackageVersionFunc()},
 	{technology: coreutils.Npm, impactedPackaged: "minimatch", fixVersion: "3.0.2", packageDescriptor: "package.json", fixPackageVersionCmd: getGenericFixPackageVersionFunc()},
 	{technology: coreutils.Go, impactedPackaged: "github.com/google/uuid", fixVersion: "1.3.0", packageDescriptor: "go.mod", fixPackageVersionCmd: getGenericFixPackageVersionFunc()},
+	{technology: coreutils.Go, impactedPackaged: "github.com/golang/go", fixVersion: "1.20.3", packageDescriptor: "go.mod", fixPackageVersionCmd: getGenericFixPackageVersionFunc(), shouldNotFix: true},
 	{technology: coreutils.Yarn, impactedPackaged: "minimist", fixVersion: "1.2.6", packageDescriptor: "package.json", fixPackageVersionCmd: getGenericFixPackageVersionFunc()},
 	{technology: coreutils.Pipenv, impactedPackaged: "pyjwt", fixVersion: "2.4.0", packageDescriptor: "Pipfile", fixPackageVersionCmd: getGenericFixPackageVersionFunc()},
 	{technology: coreutils.Pipenv, impactedPackaged: "Pyjwt", fixVersion: "2.4.0", packageDescriptor: "Pipfile", fixPackageVersionCmd: getGenericFixPackageVersionFunc()},
@@ -40,6 +42,9 @@ var packageFixTests = []packageFixTest{
 	{technology: coreutils.Pip, impactedPackaged: "pyjwt", fixVersion: "2.4.0", packageDescriptor: "requirements.txt", fixPackageVersionCmd: getGenericFixPackageVersionFunc()},
 	{technology: coreutils.Pip, impactedPackaged: "PyJwt", fixVersion: "2.4.0", packageDescriptor: "requirements.txt", fixPackageVersionCmd: getGenericFixPackageVersionFunc()},
 	{technology: coreutils.Pip, impactedPackaged: "pyjwt", fixVersion: "2.4.0", packageDescriptor: "setup.py", fixPackageVersionCmd: getGenericFixPackageVersionFunc()},
+	{technology: coreutils.Pip, impactedPackaged: "pip", fixVersion: "23.1", packageDescriptor: "setup.py", fixPackageVersionCmd: getGenericFixPackageVersionFunc(), shouldNotFix: true},
+	{technology: coreutils.Pip, impactedPackaged: "wheel", fixVersion: "2.3.0", packageDescriptor: "setup.py", fixPackageVersionCmd: getGenericFixPackageVersionFunc(), shouldNotFix: true},
+	{technology: coreutils.Pip, impactedPackaged: "setuptools", fixVersion: "66.6.6", packageDescriptor: "setup.py", fixPackageVersionCmd: getGenericFixPackageVersionFunc(), shouldNotFix: true},
 }
 
 var requirementsFile = "oslo.config>=1.12.1,<1.13\noslo.utils<5.0,>=4.0.0\nparamiko==2.7.2\npasslib<=1.7.4\nprance>=0.9.0\nprompt-toolkit~=1.0.15\npyinotify>0.9.6\nPyJWT>1.7.1\nurllib3 > 1.1.9, < 1.5.*"
@@ -150,9 +155,13 @@ func TestFixPackageVersion(t *testing.T) {
 				assert.NoError(t, cfg.updatePackageToFixedVersion(test.impactedPackaged, fixVersionInfo))
 				file, err := os.ReadFile(test.packageDescriptor)
 				assert.NoError(t, err)
-				assert.Contains(t, string(file), test.fixVersion)
-				// Verify that case-sensitive packages in python are lowered
-				assert.Contains(t, string(file), strings.ToLower(test.impactedPackaged))
+				if test.shouldNotFix {
+					assert.NotContains(t, string(file), test.fixVersion)
+				} else {
+					assert.Contains(t, string(file), test.fixVersion)
+					// Verify that case-sensitive packages in python are lowered
+					assert.Contains(t, string(file), strings.ToLower(test.impactedPackaged))
+				}
 			})
 		}()
 	}

commands/utils/packagehandlers/genericpackagehandler.go

@@ -14,16 +14,14 @@ type PackageHandler interface {
 	UpdateImpactedPackage(impactedPackage string, fixVersionInfo *utils.FixVersionInfo, extraArgs ...string) error
 }
 
-func GetCompatiblePackageHandler(fixVersionInfo *utils.FixVersionInfo, pipfilePath *utils.ScanDetails, mavenPropertyMap *map[string][]string) PackageHandler {
+func GetCompatiblePackageHandler(fixVersionInfo *utils.FixVersionInfo, details *utils.ScanDetails, mavenPropertyMap *map[string][]string) PackageHandler {
 	switch fixVersionInfo.PackageType {
-	case coreutils.Go:
-		return &GoPackageHandler{}
 	case coreutils.Maven:
 		return &MavenPackageHandler{mavenDepToPropertyMap: *mavenPropertyMap}
 	case coreutils.Poetry:
 		return &PythonPackageHandler{}
 	case coreutils.Pip:
-		return &PythonPackageHandler{pipRequirementsFile: pipfilePath.PipRequirementsFile}
+		return &PythonPackageHandler{pipRequirementsFile: details.PipRequirementsFile}
 	default:
 		return &GenericPackageHandler{FixVersionInfo: fixVersionInfo}
 	}

commands/utils/packagehandlers/gopackagehandler.go

@@ -15,7 +15,6 @@ const (
 
 	// Package names are case-insensitive with this prefix
 	PythonPackageRegexPrefix = "(?i)"
-
 	// Match all possible operators and versions syntax
 	PythonPackageRegexSuffix = "\\s*(([\\=\\<\\>\\~]=)|([\\>\\<]))\\s*(\\.|\\d)*(\\d|(\\.\\*))(\\,\\s*(([\\=\\<\\>\\~]=)|([\\>\\<])).*\\s*(\\.|\\d)*(\\d|(\\.\\*)))?"
 )
@@ -35,7 +34,7 @@ func (py *PythonPackageHandler) UpdateImpactedPackage(impactedPackage string, fi
 	case coreutils.Pipenv:
 		return py.GenericPackageHandler.UpdateImpactedPackage(impactedPackage, fixVersionInfo, extraArgs...)
 	default:
-		return errors.New("Unknown python package manger: " + fixVersionInfo.PackageType.GetPackageType())
+		return errors.New("unknown python package manger: " + fixVersionInfo.PackageType.GetPackageType())
 	}
 }
 

commands/utils/packagehandlers/pythonpackagehandler.go

@@ -41,6 +41,11 @@ var (
 	branchInvalidCharsRegex = regexp.MustCompile(branchNameRegex)
 )
 
+var BuildToolsDependenciesMap = map[coreutils.Technology][]string{
+	coreutils.Go:  {"github.com/golang/go"},
+	coreutils.Pip: {"pip", "setuptools", "wheel"},
+}
+
 type ErrMissingEnv struct {
 	VariableName string
 }