mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
feat(cooldown): respect trusted_packages in dependency cooldown (#342)
* feat(cooldown): respect trusted_packages in dependency cooldown Trusted packages are now treated as a superset waiver that bypasses every PMG control (malware analysis, cooldown, and any future controls). A globally trusted package is automatically exempt from the cooldown window and no longer needs a duplicate entry in dependency_cooldown.skip. The skip list remains the narrower, cooldown-only waiver for packages that must bypass the cooldown wait but still be malware-scanned. * refactor(cooldown): tag skip reason and audit-log skipped packages Address review feedback on #342: - Restore cooldownSkip to a pure single-list function (SRP); the merge into trusted_packages now happens in a separate mergeCooldownSkip step, driven by the exported CooldownSkip wrapper. - Extend CooldownSkipInfo with a CooldownSkipReason (TrustedPackage / CooldownSkipList) on both SkipAll and per-version entries, so callers can tell apart the broad waiver from the cooldown-only one. When both lists match the same package, trusted_packages wins. - Add audit.LogCooldownSkipped and emit it from the npm and PyPI interceptors on the SkipAll path, alongside the existing info log, carrying the source list as the reason. * refactor(cooldown): inline list merge, audit per-version exemptions Address further review feedback: - Drop the separate mergeCooldownSkip helper; cooldownSkip now writes into a shared *CooldownSkipInfo and is called twice from CooldownSkip (cooldown skip list first, trusted_packages on top so trusted entries override the reason on overlap). - Audit log every exemption, not just SkipAll: a new auditCooldownSkip helper in proxy/interceptors/cooldown.go emits one event per match (package-wide or per-version), each tagged with its source list. LogCooldownSkipped gains a version argument for the per-version case. - Cover the trusted_packages reason path in TestCooldownSkip. * fix(cooldown): avoid double-auditing trusted package exemptions auditCooldownSkip now only emits EventTypeCooldownSkipped for entries that came from dependency_cooldown.skip. Trusted-package exemptions already get an EventTypeInstallTrustedAllowed event at tarball-download time (proxy/interceptors/base_registry.go), so emitting a cooldown event for them too would double-count the same waiver. * emit trusted and cooldown skip events to cloud * fix tests * refactor(cooldown): return value from collectCooldownSkip, short-circuit on trusted SkipAll Address PR review feedback: - Rename cooldownSkip to collectCooldownSkip and return CooldownSkipInfo instead of mutating an input pointer. - Add mergeCooldownSkip to combine per-list results with trusted_packages taking precedence on overlap. - CooldownSkip now consults trusted_packages first and returns immediately on a package-wide trusted exemption (DC skip list cannot add anything). - Extend tests to cover disjoint pinned entries across both lists and the case where DC version-less subsumes a trusted pinned entry. * fix(audit): address cooldown review feedback * fix(cooldown): audit cooldown skips at download time with concrete version Backend rejects PackageVersion messages without a version, and audit logs should reflect the runtime fact (a specific version was skipped) rather than the config rule. Move the audit emission from metadata-request handling to download-request handling, where the concrete version is known, and require version in LogCooldownSkipped. * chore(audit): drop dead scope assignment in LogCooldownSkipped * refactor(cooldown): move skip-list logic into cooldown handlers Registry interceptors no longer compute CooldownSkip or branch on SkipAll; they just call HandleMetadataRequest. The npm and pypi cooldown handlers own the skip lookup, the package-wide exemption short-circuit, and (for pypi) the canonical-name denormalization. Also align LogCooldownSkipped with other LogXxx signatures by taking *packagev1.PackageVersion. * fix: Simplify audit logging for dependency cooldown skip * refactor: Simplify cooldown handling and maintain separation of concepts for trusted and DC skip packages * fix: Code review fixes * fix: Emit cooldown skipped audit event ONLY when an in-window version is skipped --------- Co-authored-by: Abhisek Datta <abhisek.datta@gmail.com>
This commit is contained in:
Sahil Bansal
co-authored by
Abhisek Datta
Abhisek Datta
parent
c17b941ac3
commit
327c9c7068
@@ -357,7 +357,7 @@ func TestPyPICooldown_HandleMetadataRequest_OverridesHeaders(t *testing.T) {
|
||||
ctx.Headers.Set("If-None-Match", `"abc123"`)
|
||||
ctx.Headers.Set("If-Modified-Since", "Wed, 01 Jan 2025 00:00:00 GMT")
|
||||
|
||||
resp, err := handler.HandleMetadataRequest(ctx, "requests", 5, "", nil)
|
||||
resp, err := handler.HandleMetadataRequest(ctx, "requests", 5, "")
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, proxy.ActionModifyResponse, resp.Action)
|
||||
assert.Equal(t, "application/vnd.pypi.simple.v1+json", ctx.Headers.Get("Accept"))
|
||||
@@ -371,7 +371,7 @@ func TestPyPICooldown_HandleMetadataRequest_ClientWithoutPEP691_SkipsCooldown(t
|
||||
ctx := makeTestRequestContext("https://pypi.org/simple/requests/")
|
||||
ctx.Headers.Set("Accept", "text/html")
|
||||
|
||||
resp, err := handler.HandleMetadataRequest(ctx, "requests", 5, "", nil)
|
||||
resp, err := handler.HandleMetadataRequest(ctx, "requests", 5, "")
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, proxy.ActionAllow, resp.Action)
|
||||
assert.Nil(t, resp.ResponseModifier)
|
||||
@@ -383,7 +383,7 @@ func TestPyPICooldown_HandleMetadataRequest_NonJSONResponse_FailOpen(t *testing.
|
||||
ctx := makeTestRequestContext("https://pypi.org/simple/requests/")
|
||||
ctx.Headers.Set("Accept", pypiSimpleAPIContentType)
|
||||
|
||||
resp, err := handler.HandleMetadataRequest(ctx, "requests", 5, "", nil)
|
||||
resp, err := handler.HandleMetadataRequest(ctx, "requests", 5, "")
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, resp.ResponseModifier)
|
||||
|
||||
@@ -410,7 +410,7 @@ func TestPyPICooldown_HandleMetadataRequest_StripsRecentVersions(t *testing.T) {
|
||||
ctx := makeTestRequestContext("https://pypi.org/simple/testpkg/")
|
||||
ctx.Headers.Set("Accept", pypiSimpleAPIContentType)
|
||||
|
||||
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "", nil)
|
||||
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "")
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, resp.ResponseModifier)
|
||||
|
||||
@@ -448,7 +448,7 @@ func TestPyPICooldown_HandleMetadataRequest_AllVersionsInCooldown_RecordsStats(t
|
||||
ctx := makeTestRequestContext("https://pypi.org/simple/newpkg/")
|
||||
ctx.Headers.Set("Accept", pypiSimpleAPIContentType)
|
||||
|
||||
resp, err := handler.HandleMetadataRequest(ctx, "newpkg", 5, "", nil)
|
||||
resp, err := handler.HandleMetadataRequest(ctx, "newpkg", 5, "")
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, resp.ResponseModifier)
|
||||
|
||||
@@ -482,7 +482,7 @@ func TestPyPICooldown_HandleMetadataRequest_NoVersionsInCooldown_BodyUnchanged(t
|
||||
ctx := makeTestRequestContext("https://pypi.org/simple/testpkg/")
|
||||
ctx.Headers.Set("Accept", pypiSimpleAPIContentType)
|
||||
|
||||
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "", nil)
|
||||
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "")
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, resp.ResponseModifier)
|
||||
|
||||
@@ -499,7 +499,7 @@ func TestPyPICooldown_HandleMetadataRequest_MalformedJSON_FailOpen(t *testing.T)
|
||||
ctx := makeTestRequestContext("https://pypi.org/simple/badpkg/")
|
||||
ctx.Headers.Set("Accept", pypiSimpleAPIContentType)
|
||||
|
||||
resp, err := handler.HandleMetadataRequest(ctx, "badpkg", 5, "", nil)
|
||||
resp, err := handler.HandleMetadataRequest(ctx, "badpkg", 5, "")
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, resp.ResponseModifier)
|
||||
|
||||
@@ -526,7 +526,7 @@ func TestPyPICooldown_HandleMetadataRequest_PinnedVersionInCooldown_RecordsStats
|
||||
ctx := makeTestRequestContext("https://pypi.org/simple/testpkg/")
|
||||
ctx.Headers.Set("Accept", pypiSimpleAPIContentType)
|
||||
|
||||
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "2.0.0", nil)
|
||||
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "2.0.0")
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, resp.ResponseModifier)
|
||||
|
||||
@@ -561,7 +561,7 @@ func TestPyPICooldown_HandleMetadataRequest_PinnedVersionNotInCooldown_NoBlock(t
|
||||
ctx := makeTestRequestContext("https://pypi.org/simple/testpkg/")
|
||||
ctx.Headers.Set("Accept", pypiSimpleAPIContentType)
|
||||
|
||||
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "1.0.0", nil)
|
||||
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "1.0.0")
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, resp.ResponseModifier)
|
||||
|
||||
@@ -589,7 +589,7 @@ func TestPyPICooldown_HandleMetadataRequest_UnpinnedWithRemainingVersions_NoBloc
|
||||
ctx := makeTestRequestContext("https://pypi.org/simple/testpkg/")
|
||||
ctx.Headers.Set("Accept", pypiSimpleAPIContentType)
|
||||
|
||||
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "", nil)
|
||||
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "")
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, resp.ResponseModifier)
|
||||
|
||||
@@ -663,6 +663,49 @@ func TestPyPICooldown_JSONAPIRequest_NotIntercepted(t *testing.T) {
|
||||
assert.Equal(t, "application/json", ctx.Headers.Get("Accept"))
|
||||
}
|
||||
|
||||
func TestPyPICooldown_HandleMetadataRequest_PreservesTrustedVersion(t *testing.T) {
|
||||
// testpkg@2.0.0 is trusted; 2.1.0 is not. Both are fresh (in cooldown).
|
||||
setTrustedPackagesForTest(t, []config.TrustedPackage{{Purl: "pkg:pypi/testpkg@2.0.0"}})
|
||||
|
||||
now := time.Now()
|
||||
day := 24 * time.Hour
|
||||
versions := map[string]time.Time{
|
||||
"1.0.0": now.Add(-30 * day), // old — eligible
|
||||
"2.0.0": now.Add(-1 * day), // fresh, trusted — must be preserved
|
||||
"2.1.0": now.Add(-1 * day), // fresh, untrusted — must be stripped
|
||||
}
|
||||
body := buildTestPEP691Response(versions)
|
||||
|
||||
handler := newPypiCooldownHandler(NewAnalysisStatsCollector())
|
||||
ctx := makeTestRequestContext("https://pypi.org/simple/testpkg/")
|
||||
ctx.Headers.Set("Accept", pypiSimpleAPIContentType)
|
||||
|
||||
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "")
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, resp.ResponseModifier)
|
||||
|
||||
headers := http.Header{}
|
||||
headers.Set("Content-Type", "application/vnd.pypi.simple.v1+json")
|
||||
|
||||
_, _, retBody, err := resp.ResponseModifier(200, headers, body)
|
||||
require.NoError(t, err)
|
||||
|
||||
var result struct {
|
||||
Files []struct {
|
||||
Filename string `json:"filename"`
|
||||
} `json:"files"`
|
||||
}
|
||||
require.NoError(t, json.Unmarshal(retBody, &result))
|
||||
|
||||
filenames := make([]string, 0, len(result.Files))
|
||||
for _, f := range result.Files {
|
||||
filenames = append(filenames, f.Filename)
|
||||
}
|
||||
assert.Contains(t, filenames, "testpkg-2.0.0.tar.gz", "trusted fresh version must be preserved")
|
||||
assert.NotContains(t, filenames, "testpkg-2.1.0.tar.gz", "untrusted fresh version must be stripped")
|
||||
assert.Contains(t, filenames, "testpkg-1.0.0.tar.gz", "old version must be preserved")
|
||||
}
|
||||
|
||||
func TestPyPICooldown_FileDownloadBypassesCooldown(t *testing.T) {
|
||||
setCooldownConfig(t, config.DependencyCooldownConfig{Enabled: true, Days: 5})
|
||||
|
||||
|
||||
Reference in New Issue
Block a user