nodejs / nodejs/nodejs-dependency-vuln-assessments
Automate VEX file entry creation
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 22
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Description
We can automate the insertion of an entry in https://github.com/nodejs/security-wg/tree/main/vuln/deps whenever we close an issue.
If the issue contains a label such that signals for example: "vulnerable_code_not_in_execute_path` the automation can generate a file x.json such as
https://github.com/nodejs/security-wg/blob/main/vuln/deps/3.json
Example:
- User opens an issue
- After triaging we believe its not a vulnerability
- We close the issue with label
vulnerable_code_not_in_execute_path - Automation picks it up and open a PR in https://github.com/nodejs/security-wg/blob/main/vuln/deps with a file x.json
- We approve and merge the PR
- The vex file gets updated
- User scanner stops being triggered by that CVE
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the vuln/deps directory and the example 3.json file, then trace how the vulnerable_code_not_in_execute_path label and issue closure would connect to the proposed flow. Done means generating the appropriate VEX JSON entry and opening a pull request in the security-wg repository for approval.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- devops, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100