External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat(cooldown): add dependency_cooldown.skip list (per-control exemption) (#328)

Browse Source 
Let dependency cooldown respect an explicit skip list so first-party /
internal packages that must be installed the moment they are published
(e.g. to sanity-test a freshly released version) are not held back by the
cooldown window.

Per review, this is a per-control skip list — NOT a second definition of
"trusted package". There remains a single top-level `trusted_packages`
(which waives malware analysis); `dependency_cooldown.skip` waives ONLY
the cooldown wait, so a fast-tracked package is still malware-scanned.

Matching:
- a PURL without a version skips cooldown for all versions of the package
  (package-level) — the metadata passes through unmodified;
- a PURL with a version skips cooldown for that version only — that
  version is preserved during stripping while other recent versions are
  still held.

- config: DependencyCooldownConfig.Skip + CooldownSkip()/CooldownSkipInfo.
- npm/pypi interceptors: bypass on package-level skip; thread per-version
  exemptions into the cooldown stripper so pinned versions survive.
- docs + config template; unit tests for the matcher (package/version
  level, precedence, mismatches) and the skip-vs-trusted independence.

Signed-off-by: dmdhrumilmistry <56185972+dmdhrumilmistry@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
dmdhrumilmistry
2026-06-15 19:44:55 +05:30
committed by GitHub
co-authored by Claude Opus 4.8
parent 26d5c0ad71
commit 61230fbcd7
11 changed files with 372 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
proxy/interceptors/npm_cooldown.go
+7 -3
View File
@@ -33,7 +33,7 @@ func newNpmCooldownHandler(statsCollector *AnalysisStatsCollector) *npmCooldownH
// HandleMetadataRequest overrides the Accept header to force the registry to return
// a full packument (which includes publish dates in the "time" field), then registers
// a response modifier that strips versions within the cooldown window.
func (h *npmCooldownHandler) HandleMetadataRequest(ctx *proxy.RequestContext, packageName string, cooldownDays int, pinnedVersion string) (*proxy.InterceptorResponse, error) {
func (h *npmCooldownHandler) HandleMetadataRequest(ctx *proxy.RequestContext, packageName string, cooldownDays int, pinnedVersion string, exemptVersions map[string]bool) (*proxy.InterceptorResponse, error) {
log.Debugf("[%s] Cooldown: registering metadata modifier for %s", ctx.RequestID, packageName)
// Force full packument so the response always contains the "time" field.
@@ -62,7 +62,7 @@ func (h *npmCooldownHandler) HandleMetadataRequest(ctx *proxy.RequestContext, pa
log.Debugf("[%s] Cooldown: parsed %d publish dates for %s", ctx.RequestID, len(dates), packageName)
strippedBody, stripped, remaining := h.stripCooldownVersions(body, dates, cooldownDays)
strippedBody, stripped, remaining := h.stripCooldownVersions(body, dates, cooldownDays, exemptVersions)
if stripped > 0 {
log.Infof("[%s] Cooldown: stripped %d version(s) from %s metadata (%d days, %d eligible remain)",
ctx.RequestID, stripped, packageName, cooldownDays, remaining)
@@ -123,9 +123,13 @@ func (h *npmCooldownHandler) parseMetadataTime(body []byte) (map[string]time.Tim
// stripCooldownVersions removes versions published within the cooldown window from the
// NPM metadata response. It strips entries from "versions", "time", and updates "dist-tags".
func (h *npmCooldownHandler) stripCooldownVersions(body []byte, dates map[string]time.Time, cooldownDays int) ([]byte, int, int) {
func (h *npmCooldownHandler) stripCooldownVersions(body []byte, dates map[string]time.Time, cooldownDays int, exemptVersions map[string]bool) ([]byte, int, int) {
tooNew := make(map[string]bool)
for version, publishDate := range dates {
// Version-pinned skip entries are never stripped, even inside the window.
if exemptVersions[version] {
continue
}
if withinCooldown, _, _ := cooldownIsWithinWindow(publishDate, cooldownDays); withinCooldown {
tooNew[version] = true
}
proxy/interceptors/npm_cooldown_test.go
+18 -18
View File
@@ -183,7 +183,7 @@ func TestStripCooldownVersions_MixedVersions(t *testing.T) {
dates, err := handler.parseMetadataTime(body)
require.NoError(t, err)
newBody, stripped, remaining := handler.stripCooldownVersions(body, dates, 5)
newBody, stripped, remaining := handler.stripCooldownVersions(body, dates, 5, nil)
assert.Equal(t, 1, stripped)
assert.Equal(t, 2, remaining)
@@ -223,7 +223,7 @@ func TestStripCooldownVersions_AllVersionsTooNew(t *testing.T) {
dates, err := handler.parseMetadataTime(body)
require.NoError(t, err)
newBody, stripped, remaining := handler.stripCooldownVersions(body, dates, 5)
newBody, stripped, remaining := handler.stripCooldownVersions(body, dates, 5, nil)
assert.Equal(t, 2, stripped)
assert.Equal(t, 0, remaining)
@@ -249,7 +249,7 @@ func TestStripCooldownVersions_NoVersionsTooNew(t *testing.T) {
dates, err := handler.parseMetadataTime(body)
require.NoError(t, err)
newBody, stripped, remaining := handler.stripCooldownVersions(body, dates, 5)
newBody, stripped, remaining := handler.stripCooldownVersions(body, dates, 5, nil)
assert.Equal(t, 0, stripped)
assert.Equal(t, 2, remaining)
assert.Equal(t, body, newBody) // body unchanged
@@ -267,7 +267,7 @@ func TestStripCooldownVersions_SingleVersionInCooldown(t *testing.T) {
dates, err := handler.parseMetadataTime(body)
require.NoError(t, err)
_, stripped, remaining := handler.stripCooldownVersions(body, dates, 5)
_, stripped, remaining := handler.stripCooldownVersions(body, dates, 5, nil)
assert.Equal(t, 1, stripped)
assert.Equal(t, 0, remaining)
}
@@ -277,7 +277,7 @@ func TestStripCooldownVersions_MalformedJSON(t *testing.T) {
body := []byte(`not-json`)
dates := map[string]time.Time{"1.0.0": time.Now().Add(-1 * time.Hour)}
newBody, stripped, _ := handler.stripCooldownVersions(body, dates, 5)
newBody, stripped, _ := handler.stripCooldownVersions(body, dates, 5, nil)
assert.Equal(t, 0, stripped)
assert.Equal(t, body, newBody)
}
@@ -302,7 +302,7 @@ func TestStripCooldownVersions_LatestRepairedToStableNotPlatform(t *testing.T) {
dates, err := handler.parseMetadataTime(body)
require.NoError(t, err)
newBody, _, _ := handler.stripCooldownVersions(body, dates, 5)
newBody, _, _ := handler.stripCooldownVersions(body, dates, 5, nil)
var result map[string]json.RawMessage
require.NoError(t, json.Unmarshal(newBody, &result))
@@ -329,7 +329,7 @@ func TestStripCooldownVersions_NonLatestTagRemovedWhenStripped(t *testing.T) {
dates, err := handler.parseMetadataTime(body)
require.NoError(t, err)
newBody, _, _ := handler.stripCooldownVersions(body, dates, 5)
newBody, _, _ := handler.stripCooldownVersions(body, dates, 5, nil)
var result map[string]json.RawMessage
require.NoError(t, json.Unmarshal(newBody, &result))
@@ -368,7 +368,7 @@ func TestStripCooldownVersions_LatestRepairSkipsVersionsMissingFromPackument(t *
dates, err := handler.parseMetadataTime(body)
require.NoError(t, err)
newBody, _, _ := handler.stripCooldownVersions(body, dates, 5)
newBody, _, _ := handler.stripCooldownVersions(body, dates, 5, nil)
var result map[string]json.RawMessage
require.NoError(t, json.Unmarshal(newBody, &result))
@@ -398,7 +398,7 @@ func TestStripCooldownVersions_LatestRepairStaysWithinBlessedLineage(t *testing.
dates, err := handler.parseMetadataTime(body)
require.NoError(t, err)
newBody, _, _ := handler.stripCooldownVersions(body, dates, 5)
newBody, _, _ := handler.stripCooldownVersions(body, dates, 5, nil)
var result map[string]json.RawMessage
require.NoError(t, json.Unmarshal(newBody, &result))
@@ -432,7 +432,7 @@ func TestNpmCooldown_HandleMetadataRequest_OverridesHeaders(t *testing.T) {
ctx.Headers.Set("If-None-Match", `"abc123"`)
ctx.Headers.Set("If-Modified-Since", "Wed, 01 Jan 2025 00:00:00 GMT")
resp, err := handler.HandleMetadataRequest(ctx, "lodash", 5, "")
resp, err := handler.HandleMetadataRequest(ctx, "lodash", 5, "", nil)
require.NoError(t, err)
assert.Equal(t, proxy.ActionModifyResponse, resp.Action)
assert.Equal(t, "application/json", ctx.Headers.Get("Accept"))
@@ -454,7 +454,7 @@ func TestNpmCooldown_HandleMetadataRequest_StripsRecentVersions(t *testing.T) {
handler := newNpmCooldownHandler(collector)
ctx := makeTestRequestContext("https://registry.npmjs.org/testpkg")
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "")
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "", nil)
require.NoError(t, err)
require.NotNil(t, resp.ResponseModifier)
@@ -489,7 +489,7 @@ func TestNpmCooldown_HandleMetadataRequest_NoVersionsInCooldown(t *testing.T) {
handler := newNpmCooldownHandler(collector)
ctx := makeTestRequestContext("https://registry.npmjs.org/testpkg")
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "")
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "", nil)
require.NoError(t, err)
require.NotNil(t, resp.ResponseModifier)
@@ -510,7 +510,7 @@ func TestNpmCooldown_HandleMetadataRequest_AllVersionsInCooldown_RecordsStats(t
handler := newNpmCooldownHandler(collector)
ctx := makeTestRequestContext("https://registry.npmjs.org/newpkg")
resp, err := handler.HandleMetadataRequest(ctx, "newpkg", 5, "")
resp, err := handler.HandleMetadataRequest(ctx, "newpkg", 5, "", nil)
require.NoError(t, err)
require.NotNil(t, resp.ResponseModifier)
@@ -542,7 +542,7 @@ func TestNpmCooldown_HandleMetadataRequest_AllVersionsInCooldown_ReportsOldestVe
handler := newNpmCooldownHandler(collector)
ctx := makeTestRequestContext("https://registry.npmjs.org/multipkg")
resp, err := handler.HandleMetadataRequest(ctx, "multipkg", 100, "")
resp, err := handler.HandleMetadataRequest(ctx, "multipkg", 100, "", nil)
require.NoError(t, err)
_, _, _, err = resp.ResponseModifier(200, http.Header{}, body)
@@ -559,7 +559,7 @@ func TestNpmCooldown_HandleMetadataRequest_MalformedJSON_FailOpen(t *testing.T)
handler := newNpmCooldownHandler(collector)
ctx := makeTestRequestContext("https://registry.npmjs.org/badpkg")
resp, err := handler.HandleMetadataRequest(ctx, "badpkg", 5, "")
resp, err := handler.HandleMetadataRequest(ctx, "badpkg", 5, "", nil)
require.NoError(t, err)
require.NotNil(t, resp.ResponseModifier)
@@ -581,7 +581,7 @@ func TestNpmCooldown_HandleMetadataRequest_PinnedVersionInCooldown_RecordsStats(
handler := newNpmCooldownHandler(collector)
ctx := makeTestRequestContext("https://registry.npmjs.org/testpkg")
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "2.0.0")
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "2.0.0", nil)
require.NoError(t, err)
require.NotNil(t, resp.ResponseModifier)
@@ -612,7 +612,7 @@ func TestNpmCooldown_HandleMetadataRequest_PinnedVersionNotInCooldown_NoBlock(t
handler := newNpmCooldownHandler(collector)
ctx := makeTestRequestContext("https://registry.npmjs.org/testpkg")
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "1.0.0")
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "1.0.0", nil)
require.NoError(t, err)
require.NotNil(t, resp.ResponseModifier)
@@ -636,7 +636,7 @@ func TestNpmCooldown_HandleMetadataRequest_UnpinnedWithRemainingVersions_NoBlock
handler := newNpmCooldownHandler(collector)
ctx := makeTestRequestContext("https://registry.npmjs.org/testpkg")
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "")
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "", nil)
require.NoError(t, err)
require.NotNil(t, resp.ResponseModifier)
proxy/interceptors/npm_registry.go
+11 -1
View File
@@ -113,7 +113,17 @@ func (i *NpmRegistryInterceptor) HandleRequest(ctx *proxy.RequestContext) (*prox
if !pkgInfo.IsFileDownload() {
if depCooldownConfig.Enabled {
return i.cooldownHandler.HandleMetadataRequest(ctx, pkgInfo.GetName(), depCooldownConfig.Days, i.execContext.PinnedVersions[pkgInfo.GetName()])
skip := pmgconfig.CooldownSkip(packagev1.Ecosystem_ECOSYSTEM_NPM, pkgInfo.GetName())
if skip.SkipAll {
// Whole package is on the cooldown skip list: let the metadata pass
// through unmodified. The tarball download still hits analyzePackage,
// so malware analysis is preserved.
log.Infof("[%s] Cooldown: package %s is on the skip list (dependency_cooldown.skip); malware analysis still applies", ctx.RequestID, pkgInfo.GetName())
return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, nil
}
// Version-pinned skip entries (if any) are preserved during stripping.
return i.cooldownHandler.HandleMetadataRequest(ctx, pkgInfo.GetName(), depCooldownConfig.Days, i.execContext.PinnedVersions[pkgInfo.GetName()], skip.Versions)
}
log.Debugf("[%s] Skipping analysis for metadata request: %s", ctx.RequestID, pkgInfo.GetName())
proxy/interceptors/pypi_cooldown.go
+7 -3
View File
@@ -29,7 +29,7 @@ func newPypiCooldownHandler(statsCollector *AnalysisStatsCollector) *pypiCooldow
// then registers a response modifier that strips files for versions within the cooldown window.
// If the client does not support PEP 691 (pip < 22.3), cooldown is skipped to avoid
// returning a content type the client cannot parse.
func (h *pypiCooldownHandler) HandleMetadataRequest(ctx *proxy.RequestContext, packageName string, cooldownDays int, pinnedVersion string) (*proxy.InterceptorResponse, error) {
func (h *pypiCooldownHandler) HandleMetadataRequest(ctx *proxy.RequestContext, packageName string, cooldownDays int, pinnedVersion string, exemptVersions map[string]bool) (*proxy.InterceptorResponse, error) {
log.Debugf("[%s] Cooldown: registering metadata modifier for %s", ctx.RequestID, packageName)
originalAccept := ctx.Headers.Get("Accept")
@@ -62,7 +62,7 @@ func (h *pypiCooldownHandler) HandleMetadataRequest(ctx *proxy.RequestContext, p
log.Debugf("[%s] Cooldown: parsed %d versions for %s", ctx.RequestID, len(dates), packageName)
strippedBody, stripped, remaining := h.stripCooldownFiles(body, dates, cooldownDays)
strippedBody, stripped, remaining := h.stripCooldownFiles(body, dates, cooldownDays, exemptVersions)
if stripped > 0 {
log.Infof("[%s] Cooldown: stripped %d version(s) from %s metadata (%d days, %d eligible remain)",
ctx.RequestID, stripped, packageName, cooldownDays, remaining)
@@ -133,9 +133,13 @@ func (h *pypiCooldownHandler) parsePEP691Files(body []byte) (map[string]time.Tim
// stripCooldownFiles removes all file entries for versions within the cooldown window
// from a PEP 691 JSON body. Returns the modified body, number of versions stripped,
// and number of versions remaining.
func (h *pypiCooldownHandler) stripCooldownFiles(body []byte, dates map[string]time.Time, cooldownDays int) ([]byte, int, int) {
func (h *pypiCooldownHandler) stripCooldownFiles(body []byte, dates map[string]time.Time, cooldownDays int, exemptVersions map[string]bool) ([]byte, int, int) {
tooNew := make(map[string]bool)
for version, uploadDate := range dates {
// Version-pinned skip entries are never stripped, even inside the window.
if exemptVersions[version] {
continue
}
if within, _, _ := cooldownIsWithinWindow(uploadDate, cooldownDays); within {
tooNew[version] = true
}
proxy/interceptors/pypi_cooldown_test.go
+18 -18
View File
@@ -180,7 +180,7 @@ func TestStripCooldownFiles_MixedVersions(t *testing.T) {
dates, err := handler.parsePEP691Files(body)
require.NoError(t, err)
newBody, stripped, remaining := handler.stripCooldownFiles(body, dates, 5)
newBody, stripped, remaining := handler.stripCooldownFiles(body, dates, 5, nil)
assert.Equal(t, 1, stripped)
assert.Equal(t, 1, remaining)
@@ -213,7 +213,7 @@ func TestStripCooldownFiles_AllVersionsTooNew(t *testing.T) {
dates, err := handler.parsePEP691Files(body)
require.NoError(t, err)
newBody, stripped, remaining := handler.stripCooldownFiles(body, dates, 5)
newBody, stripped, remaining := handler.stripCooldownFiles(body, dates, 5, nil)
assert.Equal(t, 2, stripped)
assert.Equal(t, 0, remaining)
@@ -238,7 +238,7 @@ func TestStripCooldownFiles_NoVersionsTooNew(t *testing.T) {
dates, err := handler.parsePEP691Files(body)
require.NoError(t, err)
newBody, stripped, remaining := handler.stripCooldownFiles(body, dates, 5)
newBody, stripped, remaining := handler.stripCooldownFiles(body, dates, 5, nil)
assert.Equal(t, 0, stripped)
assert.Equal(t, 2, remaining)
assert.Equal(t, body, newBody)
@@ -256,7 +256,7 @@ func TestStripCooldownFiles_SingleVersionInCooldown(t *testing.T) {
dates, err := handler.parsePEP691Files(body)
require.NoError(t, err)
_, stripped, remaining := handler.stripCooldownFiles(body, dates, 5)
_, stripped, remaining := handler.stripCooldownFiles(body, dates, 5, nil)
assert.Equal(t, 1, stripped)
assert.Equal(t, 0, remaining)
}
@@ -287,8 +287,8 @@ func TestStripCooldownFiles_MultipleFilesPerVersion_AllStripped(t *testing.T) {
dates, err := handler.parsePEP691Files(body)
require.NoError(t, err)
newBody, stripped, remaining := handler.stripCooldownFiles(body, dates, 5)
assert.Equal(t, 1, stripped) // 1 version stripped
newBody, stripped, remaining := handler.stripCooldownFiles(body, dates, 5, nil)
assert.Equal(t, 1, stripped) // 1 version stripped
assert.Equal(t, 0, remaining)
var result struct {
@@ -303,7 +303,7 @@ func TestStripCooldownFiles_MalformedJSON(t *testing.T) {
body := []byte(`not-json`)
dates := map[string]time.Time{"1.0.0": time.Now().Add(-1 * time.Hour)}
newBody, stripped, _ := handler.stripCooldownFiles(body, dates, 5)
newBody, stripped, _ := handler.stripCooldownFiles(body, dates, 5, nil)
assert.Equal(t, 0, stripped)
assert.Equal(t, body, newBody)
}
@@ -338,7 +338,7 @@ func TestStripCooldownFiles_UnparseableFilename_KeepFile(t *testing.T) {
forcedDates := map[string]time.Time{
"1.0.0": now.Add(-1 * 24 * time.Hour),
}
newBody, stripped, _ := handler.stripCooldownFiles(body, forcedDates, 5)
newBody, stripped, _ := handler.stripCooldownFiles(body, forcedDates, 5, nil)
assert.Equal(t, 1, stripped) // version is "stripped" from the date map perspective
var result struct {
@@ -357,7 +357,7 @@ func TestPyPICooldown_HandleMetadataRequest_OverridesHeaders(t *testing.T) {
ctx.Headers.Set("If-None-Match", `"abc123"`)
ctx.Headers.Set("If-Modified-Since", "Wed, 01 Jan 2025 00:00:00 GMT")
resp, err := handler.HandleMetadataRequest(ctx, "requests", 5, "")
resp, err := handler.HandleMetadataRequest(ctx, "requests", 5, "", nil)
require.NoError(t, err)
assert.Equal(t, proxy.ActionModifyResponse, resp.Action)
assert.Equal(t, "application/vnd.pypi.simple.v1+json", ctx.Headers.Get("Accept"))
@@ -371,7 +371,7 @@ func TestPyPICooldown_HandleMetadataRequest_ClientWithoutPEP691_SkipsCooldown(t
ctx := makeTestRequestContext("https://pypi.org/simple/requests/")
ctx.Headers.Set("Accept", "text/html")
resp, err := handler.HandleMetadataRequest(ctx, "requests", 5, "")
resp, err := handler.HandleMetadataRequest(ctx, "requests", 5, "", nil)
require.NoError(t, err)
assert.Equal(t, proxy.ActionAllow, resp.Action)
assert.Nil(t, resp.ResponseModifier)
@@ -383,7 +383,7 @@ func TestPyPICooldown_HandleMetadataRequest_NonJSONResponse_FailOpen(t *testing.
ctx := makeTestRequestContext("https://pypi.org/simple/requests/")
ctx.Headers.Set("Accept", pypiSimpleAPIContentType)
resp, err := handler.HandleMetadataRequest(ctx, "requests", 5, "")
resp, err := handler.HandleMetadataRequest(ctx, "requests", 5, "", nil)
require.NoError(t, err)
require.NotNil(t, resp.ResponseModifier)
@@ -410,7 +410,7 @@ func TestPyPICooldown_HandleMetadataRequest_StripsRecentVersions(t *testing.T) {
ctx := makeTestRequestContext("https://pypi.org/simple/testpkg/")
ctx.Headers.Set("Accept", pypiSimpleAPIContentType)
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "")
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "", nil)
require.NoError(t, err)
require.NotNil(t, resp.ResponseModifier)
@@ -448,7 +448,7 @@ func TestPyPICooldown_HandleMetadataRequest_AllVersionsInCooldown_RecordsStats(t
ctx := makeTestRequestContext("https://pypi.org/simple/newpkg/")
ctx.Headers.Set("Accept", pypiSimpleAPIContentType)
resp, err := handler.HandleMetadataRequest(ctx, "newpkg", 5, "")
resp, err := handler.HandleMetadataRequest(ctx, "newpkg", 5, "", nil)
require.NoError(t, err)
require.NotNil(t, resp.ResponseModifier)
@@ -482,7 +482,7 @@ func TestPyPICooldown_HandleMetadataRequest_NoVersionsInCooldown_BodyUnchanged(t
ctx := makeTestRequestContext("https://pypi.org/simple/testpkg/")
ctx.Headers.Set("Accept", pypiSimpleAPIContentType)
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "")
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "", nil)
require.NoError(t, err)
require.NotNil(t, resp.ResponseModifier)
@@ -499,7 +499,7 @@ func TestPyPICooldown_HandleMetadataRequest_MalformedJSON_FailOpen(t *testing.T)
ctx := makeTestRequestContext("https://pypi.org/simple/badpkg/")
ctx.Headers.Set("Accept", pypiSimpleAPIContentType)
resp, err := handler.HandleMetadataRequest(ctx, "badpkg", 5, "")
resp, err := handler.HandleMetadataRequest(ctx, "badpkg", 5, "", nil)
require.NoError(t, err)
require.NotNil(t, resp.ResponseModifier)
@@ -526,7 +526,7 @@ func TestPyPICooldown_HandleMetadataRequest_PinnedVersionInCooldown_RecordsStats
ctx := makeTestRequestContext("https://pypi.org/simple/testpkg/")
ctx.Headers.Set("Accept", pypiSimpleAPIContentType)
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "2.0.0")
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "2.0.0", nil)
require.NoError(t, err)
require.NotNil(t, resp.ResponseModifier)
@@ -561,7 +561,7 @@ func TestPyPICooldown_HandleMetadataRequest_PinnedVersionNotInCooldown_NoBlock(t
ctx := makeTestRequestContext("https://pypi.org/simple/testpkg/")
ctx.Headers.Set("Accept", pypiSimpleAPIContentType)
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "1.0.0")
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "1.0.0", nil)
require.NoError(t, err)
require.NotNil(t, resp.ResponseModifier)
@@ -589,7 +589,7 @@ func TestPyPICooldown_HandleMetadataRequest_UnpinnedWithRemainingVersions_NoBloc
ctx := makeTestRequestContext("https://pypi.org/simple/testpkg/")
ctx.Headers.Set("Accept", pypiSimpleAPIContentType)
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "")
resp, err := handler.HandleMetadataRequest(ctx, "testpkg", 5, "", nil)
require.NoError(t, err)
require.NotNil(t, resp.ResponseModifier)
proxy/interceptors/pypi_registry.go
+14 -1
View File
@@ -126,7 +126,20 @@ func (i *PypiRegistryInterceptor) HandleRequest(ctx *proxy.RequestContext) (*pro
// for version resolution. JSON API requests (/pypi/{pkg}/json) are allowed through;
// they have a different response structure and pip does not use them for installs.
if depCooldownConfig.Enabled && strings.HasPrefix(ctx.URL.Path, "/simple/") {
return i.cooldownHandler.HandleMetadataRequest(ctx, pkgInfo.GetName(), depCooldownConfig.Days, i.execContext.PinnedVersions[pkgInfo.GetName()])
// Match the skip list against the normalized name (lowercase, _/. → -),
// the same canonical form used for pinned-version lookups, so a PURL
// like pkg:pypi/My_Pkg reliably matches the resolved request name.
skip := pmgconfig.CooldownSkip(packagev1.Ecosystem_ECOSYSTEM_PYPI, denormalizePyPIPackageName(pkgInfo.GetName()))
if skip.SkipAll {
// Whole package is on the cooldown skip list: pass metadata through
// unmodified. The tarball download still hits analyzePackage, so
// malware analysis is preserved.
log.Infof("[%s] Cooldown: package %s is on the skip list (dependency_cooldown.skip); malware analysis still applies", ctx.RequestID, pkgInfo.GetName())
return &proxy.InterceptorResponse{Action: proxy.ActionAllow}, nil
}
// Version-pinned skip entries (if any) are preserved during stripping.
return i.cooldownHandler.HandleMetadataRequest(ctx, pkgInfo.GetName(), depCooldownConfig.Days, i.execContext.PinnedVersions[pkgInfo.GetName()], skip.Versions)
}
log.Debugf("[%s] Skipping analysis for metadata request: %s", ctx.RequestID, pkgInfo.GetName())