Dependency files should always be scanned about betterscan HOT 7 CLOSED

I just created a repo with only the package-lock.json and it did detect the vulnerable packages. I don't love the info in the report though, as it doesn't even mention the vulnerable package or package version. It's just the ID of the vulnerability report. I can Google that to get the vulnerability details though. It would be nice if it linked to the vulnerability report at least.

This has revealed a shortcoming to me of the design philosophy of this tool. As new vulnerabilities are discovered for existing dependencies, those vulnerabilities won't be detected until I update a dependency for the impacted project.

from betterscan.

For the sake of efficiency, I'd imagine it would be best to only scan head for dependency issues, rather than each commit snapshot.

from betterscan.

This is working for new repositories, but not existing repositories that already have scan data for the dependency files. How easy would it be to write a python script to purge scan results for the dependency files?

from betterscan.

@carlin-q-scott Away from the keyboard. Theoretically you can modify the file package-lock.json or remove it from state db

Osv-scanner should be working, as well as others.

from betterscan.

@carlin-q-scott It can be adjusted to always scan dependencies dbs i.e package-lock.json and others. This could address it. What do you think?

More details can be also added to description field, everything can be extracted.

I will look into it as time permits, PRs are also welcome.

Will rethink to make it better in PRO version

from betterscan.

I like your idea of always scanning dependency files. That alleviates my main concern in this issue.

I can open separate issues calling out various fields I'd like to see in my BetterScan report; issue per scanner? And if I have time I'll look into implementing those improvements myself.

from betterscan.

Thank you @carlin-q-scott

I think you can either modify each lockfile (new line or something?), maybe 2 commits, one modification other revert? maybe easier to do or go through state database and remove entries for package files.

If you can contribute with a script, could be great (possibly also for other state db mangling)

from betterscan.