nebius/SWE-rebench-V2-PRs huggingface dataset:
Repository: FairwindsOps/polaris
Pull request #538 (2021-05-07 17:10:53)

add failure.all.yaml for dangerouscapabilities test
Added failure.all.yaml for dangerousCapabilities test


Patch:
diff --git a/checks/dangerousCapabilities.yaml b/checks/dangerousCapabilities.yaml
index d1daa414..a4d1517e 100644
--- a/checks/dangerousCapabilities.yaml
+++ b/checks/dangerousCapabilities.yaml
@@ -14,12 +14,13 @@ schema:
           properties:
             add:
               type: array
-              not:
-                contains:
-                  const: ALL
-              not:
-                contains:
-                  const: SYS_ADMIN
-              not:
-                contains:
-                  const: NET_ADMIN
+              allOf:
+                - not:
+                    contains:
+                      const: ALL
+                - not:
+                    contains:
+                      const: SYS_ADMIN
+                - not:
+                    contains:
+                      const: NET_ADMIN


Test patch:
diff --git a/test/checks/dangerousCapabilities/failure.all.yaml b/test/checks/dangerousCapabilities/failure.all.yaml
new file mode 100644
index 00000000..4a3a5378
--- /dev/null
+++ b/test/checks/dangerousCapabilities/failure.all.yaml
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx
+  labels:
+    app.kubernetes.io/name: nginx
+spec:
+  containers:
+  - name: nginx
+    image: nginx
+    securityContext:
+      capabilities:
+        add: ["ALL"]
Repository: FairwindsOps/polaris
Pull request #593 (2021-07-23 19:56:11)

better support for namespaces in additional schemas
This will let you create a check on a `Namespace` object to check for the presence of a resource in that namespace

Discussion here: https://fairwindscommunity.slack.com/archives/CURU6LA91/p1627066123055100

rbren: I removed the new check for alertmanager. Since it's a CRD, I think it will break clusters that don't have it.

Patch:
diff --git a/pkg/config/schema.go b/pkg/config/schema.go
index 6babae6a..22e3d4c6 100644
--- a/pkg/config/schema.go
+++ b/pkg/config/schema.go
@@ -167,6 +167,9 @@ func (check *SchemaCheck) Initialize(id string) error {
 		}
 		check.SchemaString = string(jsonBytes)
 	}
+	if check.AdditionalSchemaStrings == nil {
+		check.AdditionalSchemaStrings = make(map[string]string)
+	}
 	for kind, schema := range check.AdditionalSchemas {
 		jsonBytes, err := json.Marshal(schema)
 		if err != nil {
diff --git a/pkg/kube/resources.go b/pkg/kube/resources.go
index 97903cab..5745ac61 100644
--- a/pkg/kube/resources.go
+++ b/pkg/kube/resources.go
@@ -277,6 +277,9 @@ func CreateResourceProviderFromAPI(ctx context.Context, kube kubernetes.Interfac
 		for key := range check.AdditionalSchemas {
 			neededKinds = append(neededKinds, conf.TargetKind(key))
 		}
+		for key := range check.AdditionalSchemaStrings {
+			neededKinds = append(neededKinds, conf.TargetKind(key))
+		}
 		for _, kind := range neededKinds {
 			if !funk.Contains(conf.HandledTargets, kind) {
 				additionalKinds = append(additionalKinds, kind)
diff --git a/pkg/validator/schema.go b/pkg/validator/schema.go
index c27e48f3..8c76d90e 100644
--- a/pkg/validator/schema.go
+++ b/pkg/validator/schema.go
@@ -261,6 +261,13 @@ func applySchemaCheck(conf *config.Configuration, checkID string, test schemaTes
 			break
 		}
 		resources := test.ResourceProvider.Resources[groupkind]
+		namespace := test.Resource.ObjectMeta.GetNamespace()
+		if test.Resource.Kind == "Namespace" {
+			namespace = test.Resource.ObjectMeta.GetName()
+		}
+		resources = funk.Filter(resources, func(res kube.GenericResource) bool {
+			return res.ObjectMeta.GetNamespace() == namespace
+		}).([]kube.GenericResource)
 		objects := funk.Map(resources, func(res kube.GenericResource) interface{} {
 			return res.Resource.Object
 		}).([]interface{})


Test patch:
diff --git a/test/checks/missingPodDisruptionBudget/failure-bad-ns.yaml b/test/checks/missingPodDisruptionBudget/failure-bad-ns.yaml
new file mode 100644
index 00000000..bff79160
--- /dev/null
+++ b/test/checks/missingPodDisruptionBudget/failure-bad-ns.yaml
@@ -0,0 +1,24 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: zookeeper
+  namespace: rightnamespace
+  labels:
+    app: zookeeper
+spec:
+  template:
+    spec:
+      containers:
+      - name: zookeeper
+        image: zookeeper
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: zk-pdb
+  namespace: wrongnamespace
+spec:
+  minAvailable: 2
+  selector:
+    matchLabels:
+      app: zookeeper
Repository: DataDog/guarddog
Pull request #147 (2023-02-09 13:04:34)

Fix bug on local target


Patch:
diff --git a/guarddog/cli.py b/guarddog/cli.py
index 73defdd..7fdcb36 100644
--- a/guarddog/cli.py
+++ b/guarddog/cli.py
@@ -136,7 +136,7 @@ def is_local_target(identifier: str) -> bool:
     @param identifier:  The name/path of the package as passed to "guarddog ecosystem scan"
     @return:            Whether the identifier should be consider a local path
     """
-    if identifier.startswith("/") or identifier.startswith("./"):
+    if identifier.startswith("/") or identifier.startswith("./") or identifier.startswith("../"):
         return True
 
     # If this looks like an archive, consider it as a local target if the target exists on the local filesystem


Test patch:
diff --git a/tests/core/test_cli.py b/tests/core/test_cli.py
index 4b87062..1326a96 100644
--- a/tests/core/test_cli.py
+++ b/tests/core/test_cli.py
@@ -7,6 +7,7 @@ import guarddog.cli
 def test_is_local_target():
     assert guarddog.cli.is_local_target("/tmp/foo")
     assert guarddog.cli.is_local_target("./foo")
+    assert guarddog.cli.is_local_target("../foo")
     assert not guarddog.cli.is_local_target("foo")
 
     with unittest.mock.patch('os.path.exists') as mock:
Repository: DataDog/guarddog
Pull request #199 (2023-03-08 09:41:40)

Fix integrity rule crash when a project does not have a homepage URL set (#190)


Patch:
diff --git a/guarddog/analyzer/metadata/pypi/repository_integrity_mismatch.py b/guarddog/analyzer/metadata/pypi/repository_integrity_mismatch.py
index b5163c2..5f55518 100644
--- a/guarddog/analyzer/metadata/pypi/repository_integrity_mismatch.py
+++ b/guarddog/analyzer/metadata/pypi/repository_integrity_mismatch.py
@@ -107,7 +107,13 @@ def _ensure_proper_url(url):
 def find_github_candidates(package_info) -> Tuple[set[str], Optional[str]]:
     infos = package_info["info"]
     homepage = None
-    if "Homepage" in package_info["info"]["project_urls"]:
+
+    project_urls = infos.get("project_urls", {})
+    # In some cases, the "project_urls" key is set, but is set to None
+    if project_urls is None:
+        return set(), None
+
+    if "Homepage" in project_urls:
         homepage = package_info["info"]["project_urls"]["Homepage"]
     github_urls = set()
     for dict_path in dict_generator(infos):


Test patch:
diff --git a/tests/analyzer/metadata/test_repository_integrity_mismatch.py b/tests/analyzer/metadata/test_repository_integrity_mismatch.py
index f0b9309..c35c85e 100644
--- a/tests/analyzer/metadata/test_repository_integrity_mismatch.py
+++ b/tests/analyzer/metadata/test_repository_integrity_mismatch.py
@@ -23,3 +23,14 @@ def test_no_good_github_links():
     match, message = detector.detect(current_info, name="mypackage", path="")
     assert not match
     assert message == "Could not find a good GitHub url in the project's description"
+
+
+def test_empty_homepage_urls():
+    """
+    Regression test for https://github.com/DataDog/guarddog/issues/190
+    """
+    current_info = deepcopy(PYPI_PACKAGE_INFO)
+    current_info["info"]["project_urls"] = None
+    detector = PypiIntegrityMismatchDetector()
+    match, _ = detector.detect(current_info, name="mypackage", path="")
+    assert not match
\ No newline at end of file
Repository: DataDog/guarddog
Pull request #406 (2024-07-04 14:16:51)

Hotfix: No rules are ran by default 
Version v1.11.1 introduced a bug that produced that no rule is assigned to run by default


Patch:
diff --git a/guarddog/cli.py b/guarddog/cli.py
index 8e2cddf..a501e1a 100644
--- a/guarddog/cli.py
+++ b/guarddog/cli.py
@@ -4,11 +4,11 @@ CLI command that scans a PyPI package version for user-specified malware flags.
 Includes rules based on package registry metadata and source code analysis.
 """
 
+import json as js
 import logging
 import os
 import sys
-from typing import cast, Optional
-import json as js
+from typing import Optional, cast
 
 import click
 from prettytable import PrettyTable
@@ -153,8 +153,14 @@ def cli(log_level):
     pass
 
 
-def _get_rule_param(rules: tuple[str, ...], exclude_rules: tuple[str, ...], ecosystem: ECOSYSTEM) -> set:
-    rule_param = set()
+def _get_rule_param(
+    rules: tuple[str, ...], exclude_rules: tuple[str, ...], ecosystem: ECOSYSTEM
+) -> Optional[set]:
+    """
+    This function should return None if no rules are provided
+    Else a set of rules to be used for scanning
+    """
+    rule_param = None
     if len(rules) > 0:
         rule_param = set(rules)
 


Test patch:
diff --git a/tests/core/test_cli.py b/tests/core/test_cli.py
index 5b6d878..404bc75 100644
--- a/tests/core/test_cli.py
+++ b/tests/core/test_cli.py
@@ -24,13 +24,22 @@ def test_get_rule_param_include():
     """
     Test the parsing function returns the included parameter
     """
-    assert len(guarddog.cli._get_rule_param(("shady-links",), (), ECOSYSTEM.NPM)) == 1
-
+    rules = guarddog.cli._get_rule_param(("shady-links",), (), ECOSYSTEM.NPM)
+    assert rules
+    assert len(rules) == 1
 
 def test_get_rule_param_exclude():
     """
-    Test the parsing function returns returns a list without the excluded parameter
+    Test the parsing function returns a list without the excluded parameter
     """
     rules = guarddog.cli._get_rule_param((), ("shady-links",), ECOSYSTEM.PYPI)
+    assert rules
     assert len(rules) != 1
     assert "shady-links" not in rules
+
+def test_get_rule_param_empty():
+    """
+    Test the parsing function returns None when no rules are provided
+    """
+    rules = guarddog.cli._get_rule_param((), (), ECOSYSTEM.PYPI)
+    assert rules is None