softvisor/Infrastruktur-Monitoring-System
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Roll findings up per package and image, expandable to their CVEs

Browse Source 
The findings table listed every CVE, which is thousands of rows on a real
host. It now shows one row per affected package (host) or image
(containers) with its severity split, how many findings it has and how
many of them have a fix. Clicking a row loads and shows the CVEs of that
group; collapsing keeps them cached.

The rollup is a GROUP BY in SQLite behind a new groups endpoint, so the
page loads a few dozen rows instead of the full finding list, and the
flat list gained a package filter to expand one group.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Dennis Nemec
2026-09-03 20:02:25 +02:00
parent 751296b3b0
commit 278b5e47a3
14 changed files with 635 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files

69
backend/crates/application/src/test_fakes.rs
View File

@ -507,7 +507,8 @@ impl ClusterGateway for MemCluster {
use domain::ports::{FindingRepository, VulnerabilityScanner};
use domain::vuln::{
Finding, FindingFilter, FindingStatus, RawFinding, Severity, SeverityCounts, TargetKind,
Finding, FindingFilter, FindingGroup, FindingStatus, RawFinding, Severity, SeverityCounts,
TargetKind,
};
pub fn raw(
@ -630,6 +631,7 @@ impl FindingRepository for MemFindings {
.filter(|f| filter.include_fixed || f.status != FindingStatus::Fixed)
.filter(|f| filter.min_severity.is_none_or(|m| f.raw.severity >= m))
.filter(|f| filter.target_kind.is_none_or(|k| f.target_kind == k))
.filter(|f| filter.package.as_ref().is_none_or(|p| &f.raw.package == p))
.filter(|f| filter.target.as_ref().is_none_or(|t| &f.target == t))
.filter(|f| filter.status.is_none_or(|s| f.status == s))
.cloned()
@ -642,6 +644,71 @@ impl FindingRepository for MemFindings {
});
Ok(v)
}
async fn groups(&self, filter: &FindingFilter) -> Result<Vec<FindingGroup>, DomainError> {
let per_image = filter.target_kind == Some(TargetKind::Image);
let mut by_key: HashMap<String, FindingGroup> = HashMap::new();
let mut packages: HashMap<String, std::collections::HashSet<String>> = HashMap::new();
for f in self.list(filter).await? {
let key = if per_image {
f.target.clone()
} else {
f.raw.package.clone()
};
packages
.entry(key.clone())
.or_default()
.insert(f.raw.package.clone());
let g = by_key.entry(key.clone()).or_insert_with(|| FindingGroup {
key,
kind: f.target_kind,
source: if per_image {
String::new()
} else {
f.raw.source.clone()
},
installed: if per_image {
String::new()
} else {
f.raw.installed_version.clone()
},
counts: SeverityCounts::default(),
total: 0,
fixable: 0,
packages: 0,
});
g.counts.add(f.raw.severity);
g.total += 1;
if f.raw.fixed_version.is_some() {
g.fixable += 1;
}
}
let mut groups: Vec<FindingGroup> = by_key
.into_values()
.map(|mut g| {
g.packages = packages.get(&g.key).map(|p| p.len()).unwrap_or(1);
g
})
.collect();
let worst = |g: &FindingGroup| {
Severity::ALL
.iter()
.position(|s| match s {
Severity::Critical => g.counts.critical > 0,
Severity::High => g.counts.high > 0,
Severity::Medium => g.counts.medium > 0,
Severity::Low => g.counts.low > 0,
Severity::Unknown => g.counts.unknown > 0,
})
.unwrap_or(usize::MAX)
};
groups.sort_by(|a, b| {
worst(a)
.cmp(&worst(b))
.then(b.total.cmp(&a.total))
.then(a.key.cmp(&b.key))
});
Ok(groups)
}
async fn counts(&self, kind: Option<TargetKind>) -> Result<SeverityCounts, DomainError> {
let mut c = SeverityCounts::default();
for f in

94
backend/crates/application/src/tests/vuln_tests.rs
View File

@ -417,17 +417,38 @@ async fn host_findings_are_grouped_per_package_and_containers_per_image() {
.with(
"os",
Ok(vec![
raw("CVE-1", "openssl", "3.0.1", Severity::Critical, Some("3.0.2")),
raw(
"CVE-1",
"openssl",
"3.0.1",
Severity::Critical,
Some("3.0.2"),
),
raw("CVE-2", "openssl", "3.0.1", Severity::Low, None),
go,
]),
)
.with(GITEA, Ok(vec![raw("CVE-3", "git", "2.39", Severity::High, None), raw("CVE-4", "curl", "7.8", Severity::Medium, None)]))
.with(PG, Ok(vec![raw("CVE-5", "libssl3", "3.0", Severity::Low, None)]));
.with(
GITEA,
Ok(vec![
raw("CVE-3", "git", "2.39", Severity::High, None),
raw("CVE-4", "curl", "7.8", Severity::Medium, None),
]),
)
.with(
PG,
Ok(vec![raw("CVE-5", "libssl3", "3.0", Severity::Low, None)]),
);
let (_f, svc) = fixture(scanner);
svc.scan(&VecLog::default()).await.unwrap();
let host = svc.groups(FindingFilter { target_kind: Some(TargetKind::Os), ..Default::default() }).await.unwrap();
let host = svc
.groups(FindingFilter {
target_kind: Some(TargetKind::Os),
..Default::default()
})
.await
.unwrap();
assert_eq!(host.len(), 2, "one row per package, not per CVE");
// worst severity first
assert_eq!(host[0].key, "openssl");
@ -440,30 +461,75 @@ async fn host_findings_are_grouped_per_package_and_containers_per_image() {
assert_eq!(host[1].key, "stdlib");
assert_eq!(host[1].source, "gobinary");
let images = svc.groups(FindingFilter { target_kind: Some(TargetKind::Image), ..Default::default() }).await.unwrap();
assert_eq!(images.iter().map(|g| g.key.as_str()).collect::<Vec<_>>(), vec![GITEA, PG]);
let images = svc
.groups(FindingFilter {
target_kind: Some(TargetKind::Image),
..Default::default()
})
.await
.unwrap();
assert_eq!(
images.iter().map(|g| g.key.as_str()).collect::<Vec<_>>(),
vec![GITEA, PG]
);
assert_eq!(images[0].total, 2);
assert_eq!(images[0].packages, 2, "distinct packages in the image");
// the group list honours the other filters
let high = svc
.groups(FindingFilter { target_kind: Some(TargetKind::Os), min_severity: Some(Severity::High), ..Default::default() })
.groups(FindingFilter {
target_kind: Some(TargetKind::Os),
min_severity: Some(Severity::High),
..Default::default()
})
.await
.unwrap();
assert_eq!(high.iter().map(|g| g.key.as_str()).collect::<Vec<_>>(), vec!["openssl", "stdlib"]);
assert_eq!(high[0].total, 1, "the low finding is filtered out of the counts");
assert_eq!(
high.iter().map(|g| g.key.as_str()).collect::<Vec<_>>(),
vec!["openssl", "stdlib"]
);
assert_eq!(
high[0].total, 1,
"the low finding is filtered out of the counts"
);
}
#[tokio::test]
async fn findings_of_one_group_can_be_listed() {
let scanner = FakeScanner::default()
.with("os", Ok(vec![raw("CVE-1", "openssl", "3.0.1", Severity::Critical, None), raw("CVE-2", "bash", "5.2", Severity::Low, None)]))
.with(GITEA, Ok(vec![raw("CVE-3", "git", "2.39", Severity::High, None)]));
.with(
"os",
Ok(vec![
raw("CVE-1", "openssl", "3.0.1", Severity::Critical, None),
raw("CVE-2", "bash", "5.2", Severity::Low, None),
]),
)
.with(
GITEA,
Ok(vec![raw("CVE-3", "git", "2.39", Severity::High, None)]),
);
let (_f, svc) = fixture(scanner);
svc.scan(&VecLog::default()).await.unwrap();
let pkg = svc.list(FindingFilter { package: Some("openssl".into()), ..Default::default() }).await.unwrap();
assert_eq!(pkg.iter().map(|f| f.raw.cve_id.as_str()).collect::<Vec<_>>(), vec!["CVE-1"]);
let image = svc.list(FindingFilter { target: Some(GITEA.into()), ..Default::default() }).await.unwrap();
let pkg = svc
.list(FindingFilter {
package: Some("openssl".into()),
..Default::default()
})
.await
.unwrap();
assert_eq!(
pkg.iter()
.map(|f| f.raw.cve_id.as_str())
.collect::<Vec<_>>(),
vec!["CVE-1"]
);
let image = svc
.list(FindingFilter {
target: Some(GITEA.into()),
..Default::default()
})
.await
.unwrap();
assert_eq!(image.len(), 1);
}

9
backend/crates/application/src/vuln_service.rs
View File

@ -7,8 +7,8 @@ use async_trait::async_trait;
use chrono::{DateTime, Utc};
use domain::ports::{ClusterGateway, FindingRepository, LineSink, VulnerabilityScanner};
use domain::vuln::{
Finding, FindingFilter, FindingStatus, RawFinding, ScanReport, Severity, SeverityCounts,
TargetKind,
Finding, FindingFilter, FindingGroup, FindingStatus, RawFinding, ScanReport, Severity,
SeverityCounts, TargetKind,
};
use domain::DomainError;
use uuid::Uuid;
@ -237,6 +237,11 @@ impl VulnerabilityService {
self.findings.list(&filter).await
}
/// Findings rolled up per package (host) or per image (containers).
pub async fn groups(&self, filter: FindingFilter) -> Result<Vec<FindingGroup>, DomainError> {
self.findings.groups(&filter).await
}
/// Scanned targets that still have open findings, host first.
pub async fn targets(&self) -> Result<Vec<TargetSummary>, DomainError> {
let mut by_target: std::collections::HashMap<(TargetKind, String), usize> =