External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: Add post-exec reporting support (#134)

Browse Source 
* feat: Add post install reporting support

* fix: UI report handling

* fix: Duplicate reporting

* fix: Show warning on insecure bypass

* fix: Proxy event log insecure skip installation

* fix: Proxy event log insecure skip installation

* fix: Common definition for infer outcome
This commit is contained in:
Abhisek Datta
2026-01-27 17:50:26 +05:30
committed by GitHub
parent 0aa82033a5
commit 36ac3e3384
14 changed files with 1022 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files
proxy/interceptors/base_registry.go
+37
View File
@@ -19,6 +19,7 @@ import (
type baseRegistryInterceptor struct {
analyzer analyzer.PackageVersionAnalyzer
cache AnalysisCache
statsCollector *AnalysisStatsCollector
confirmationChan chan *ConfirmationRequest
}
@@ -56,6 +57,17 @@ func (b *baseRegistryInterceptor) analyzePackage(
Version: packageVersion,
}
if cfg := config.Get(); cfg.InsecureInstallation {
log.Debugf("[%s] Skipping insecure installation", ctx.RequestID)
eventlog.LogInstallInsecureBypass(packageName, packageVersion, ecosystem.String())
return &analyzer.PackageVersionAnalysisResult{
PackageVersion: pkgVersion,
Action: analyzer.ActionAllow,
}, nil
}
if config.IsTrustedPackage(pkgVersion) {
log.Debugf("[%s] Skipping trusted package: %s/%s@%s",
ctx.RequestID, ecosystem.String(), packageName, packageVersion)
@@ -108,6 +120,10 @@ func (b *baseRegistryInterceptor) handleAnalysisResult(
"reference_url": result.ReferenceURL,
})
if b.statsCollector != nil {
b.statsCollector.RecordBlocked(result)
}
message := fmt.Sprintf("Malicious package blocked: %s/%s@%s\n\nReason: %s\n\nReference: %s",
ecosystem.String(),
packageName, packageVersion,
@@ -126,6 +142,11 @@ func (b *baseRegistryInterceptor) handleAnalysisResult(
confirmed, err := b.requestUserConfirmation(ctx, result)
if err != nil {
log.Errorf("[%s] Failed to get user confirmation: %v", ctx.RequestID, err)
if b.statsCollector != nil {
b.statsCollector.RecordBlocked(result)
}
return &proxy.InterceptorResponse{
Action: proxy.ActionBlock,
BlockCode: http.StatusForbidden,
@@ -141,6 +162,10 @@ func (b *baseRegistryInterceptor) handleAnalysisResult(
"reference_url": result.ReferenceURL,
})
if b.statsCollector != nil {
b.statsCollector.RecordUserCancelled(result)
}
message := fmt.Sprintf("Installation blocked by user: %s/%s@%s\n\nReason: %s\n\nReference: %s",
ecosystem.String(),
packageName, packageVersion,
@@ -157,18 +182,30 @@ func (b *baseRegistryInterceptor) handleAnalysisResult(
eventlog.LogMalwareConfirmed(packageName, packageVersion, ecosystem.String())
eventlog.LogInstallAllowed(packageName, packageVersion, ecosystem.String(), 1)
if b.statsCollector != nil {
b.statsCollector.RecordConfirmed(result)
}
log.Infof("[%s] User confirmed installation of suspicious package %s/%s@%s", ctx.RequestID, ecosystem.String(), packageName, packageVersion)
return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, nil
case analyzer.ActionAllow:
eventlog.LogInstallAllowed(packageName, packageVersion, ecosystem.String(), 1)
if b.statsCollector != nil {
b.statsCollector.RecordAllowed(result)
}
log.Debugf("[%s] Package %s/%s@%s is safe, allowing request", ctx.RequestID, ecosystem.String(), packageName, packageVersion)
return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, nil
default:
eventlog.LogInstallAllowed(packageName, packageVersion, ecosystem.String(), 1)
if b.statsCollector != nil {
b.statsCollector.RecordAllowed(result)
}
log.Warnf("[%s] Unknown analysis action %d for package %s/%s@%s, allowing by default", ctx.RequestID, result.Action, ecosystem.String(), packageName, packageVersion)
return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, nil
}