You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Reduce the amount of duplicated security alerts for the Quarkus distribution
#20427
The Snyk workflow was introduced in the Keycloak upstream repository with the aim to effectively identify and fix vulnerability on third-party dependencies targeting the quarkus path. Although, it has been generating a considerable amount of duplicated alerts due to multiple POM files in the same folder. That can lead to unnecessary noise, making the triage of CVEs on third-party libraries difficult.
Today we target the quarkus folder, that means that the scanner will also look at the deployments, runtime and dist folder ignoring test dependencies:
Considering that Snyk CLI uses Maven to analyze not only direct dependencies but also transitive dependencies, we should be able to reduce the amount of duplicated alerts by targeting only the server folder when running snyk test. The command below shows an example of the dependencies analyzed by Snyk:
cd quarkus
mvn -f ../pom.xml dependency:tree
Proof-of-concept
Below is possible to see the differences before the changes proposed and after.
area/dist/quarkusQuarkus distribution — packaging, container images, server config (kc.sh)
1 participant
Heading
Bold
Italic
Quote
Code
Link
Numbered list
Unordered list
Task list
Attach files
Mention
Reference
Menu
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
The Snyk workflow was introduced in the Keycloak upstream repository with the aim to effectively identify and fix vulnerability on third-party dependencies targeting the
quarkuspath. Although, it has been generating a considerable amount of duplicated alerts due to multiple POM files in the same folder. That can lead to unnecessary noise, making the triage of CVEs on third-party libraries difficult.Today we target the
quarkusfolder, that means that the scanner will also look at thedeployments,runtimeanddistfolder ignoring test dependencies:Proposal
Considering that Snyk CLI uses Maven to analyze not only direct dependencies but also transitive dependencies, we should be able to reduce the amount of duplicated alerts by targeting only the
serverfolder when runningsnyk test. The command below shows an example of the dependencies analyzed by Snyk:Proof-of-concept
Below is possible to see the differences before the changes proposed and after.
Current workflow in Keycloak repository
Changes proposed
https://github.com/keycloak-poc/keycloak/blob/main/.github/workflows/snyk-analysis.yml
12 issues reported during the PoC
All reactions