Repository: sonatype-nexus-community/nancy
Pull request #25 (2019-09-04 15:24:12)

Add a -quiet flag
Some projects will have a very large number of dependencies installed,
and the default behaviour prints a message for each package whether or
not it has vulnerabilities. This adds a -quiet flag that would print
output for packages only if they have vulnerabilities, to make it
easier to see at a glance what issues exist. The summary information,
packages analyzed vs vulnerable, is always printed.

cc @bhamail / @DarthHater


sonatypecla[bot]: Thanks for the contribution!  Before we can merge this, we need @packrat386 to [sign the Sonatype Contributor License Agreement](https://sonatypecla.herokuapp.com/sign-cla).
packrat386: Thanks, I'll get on that. Also do y'all know what's up with this travis failure? 

```
--- FAIL: TestAuditPackages_ErrorHttpRequest (1.05s)

    ossindex_test.go:121: 

        	Error Trace:	ossindex_test.go:121

        	Error:      	Not equal: 

        	            	expected: "invalid character \"\\\\\" in host name"

        	            	actual  : "invalid port \":46783\\\\\" after host"

        	            	

        	            	Diff:

        	            	--- Expected

        	            	+++ Actual

        	            	@@ -1 +1 @@

        	            	-invalid character "\\" in host name

        	            	+invalid port ":46783\\" after host

        	Test:       	TestAuditPackages_ErrorHttpRequest
```

I can't recreate it locally (it passes) and it seems like it's due to a discrepancy in the error message.
packrat386: Ok so it turned out https://github.com/golang/go/commit/61bb56ad63992a3199acc55b2537c8355ef887b6 in go 1.13 changes the error message you get back and breaks that test (which I can reproduce on master running go 1.13 locally). I figure it's best to just drop the assertion here https://github.com/sonatype-nexus-community/nancy/blob/master/ossindex/ossindex_test.go#L121 , since it's best to avoid checking exact error messages from the standard library anyway, and we already checked the type and opcode to know that it's a URL parse error. 

Would you prefer I send that in a separate PR, or add that here? Or is there some other way you'd like to address that?
bhamail: @packrat386 I'm fine with you solution of dropping that assertion, and I'm fine with adding the fix to this PR. Thanks!
packrat386: @DarthHater || @ken-duck || @bhamail added the test fix, lmk if there's anything else you think the PR needs.

Patch:
diff --git a/audit/auditlog.go b/audit/auditlog.go
index da89397..ef3cf7f 100644
--- a/audit/auditlog.go
+++ b/audit/auditlog.go
@@ -71,7 +71,7 @@ func logVulnerablePackage(noColor bool, idx int, packageCount int, coordinate ty
 
 // LogResults will given a number of expected results and the results themselves, log the
 // results.
-func LogResults(noColor bool, packageCount int, coordinates []types.Coordinate) int {
+func LogResults(noColor bool, quiet bool, packageCount int, coordinates []types.Coordinate) int {
 	vulnerableCount := 0
 
 	for i := 0; i < len(coordinates); i++ {
@@ -79,7 +79,9 @@ func LogResults(noColor bool, packageCount int, coordinates []types.Coordinate)
 		idx := i + 1
 
 		if len(coordinate.Vulnerabilities) == 0 {
-			logPackage(noColor, idx, packageCount, coordinate)
+			if !quiet {
+				logPackage(noColor, idx, packageCount, coordinate)
+			}
 		} else {
 			logVulnerablePackage(noColor, idx, packageCount, coordinate)
 			vulnerableCount++
diff --git a/main.go b/main.go
index c979448..747476b 100644
--- a/main.go
+++ b/main.go
@@ -27,12 +27,14 @@ import (
 )
 
 var noColorPtr *bool
+var quietPtr *bool
 var path string
 
 func main() {
 	args := os.Args[1:]
 
 	noColorPtr = flag.Bool("noColor", false, "indicate output should not be colorized")
+	quietPtr = flag.Bool("quiet", false, "indicate output should contain only packages with vulnerabilities")
 	version := flag.Bool("version", false, "prints current nancy version")
 
 	flag.Usage = func() {
@@ -93,7 +95,7 @@ func checkOSSIndex(purls []string, packageCount int) {
 	coordinates, err := ossindex.AuditPackages(purls)
 	customerrors.Check(err, "Error auditing packages")
 
-	if count := audit.LogResults(*noColorPtr, packageCount, coordinates); count > 0 {
+	if count := audit.LogResults(*noColorPtr, *quietPtr, packageCount, coordinates); count > 0 {
 		os.Exit(count)
 	}
 }


Test patch:
diff --git a/audit/auditlog_test.go b/audit/auditlog_test.go
index 651a11b..3b7e911 100644
--- a/audit/auditlog_test.go
+++ b/audit/auditlog_test.go
@@ -64,7 +64,7 @@ func createVulnerability() (vulnerability types.Vulnerability) {
 func TestLogResultsWithVulnerabilitiesNoColor(t *testing.T) {
 	projects := 20
 	coordinates := createCoordinates(projects, true)
-	i := LogResults(false, 20, coordinates)
+	i := LogResults(false, false, 20, coordinates)
 
 	if i != projects {
 		t.Errorf("Expected %d vulnerabilites but found %d", projects, i)
@@ -74,7 +74,7 @@ func TestLogResultsWithVulnerabilitiesNoColor(t *testing.T) {
 func TestLogResultsWithoutVulnerabilitiesNoColor(t *testing.T) {
 	projects := 20
 	coordinates := createCoordinates(projects, false)
-	i := LogResults(false, 20, coordinates)
+	i := LogResults(false, false, 20, coordinates)
 
 	if i != 0 {
 		t.Errorf("Expected %d vulnerabilites but found %d", 0, i)
@@ -84,7 +84,7 @@ func TestLogResultsWithoutVulnerabilitiesNoColor(t *testing.T) {
 func TestLogResultsWithVulnerabilitiesColor(t *testing.T) {
 	projects := 20
 	coordinates := createCoordinates(projects, true)
-	i := LogResults(true, 20, coordinates)
+	i := LogResults(true, false, 20, coordinates)
 
 	if i != projects {
 		t.Errorf("Expected %d vulnerabilites but found %d", projects, i)
@@ -94,7 +94,7 @@ func TestLogResultsWithVulnerabilitiesColor(t *testing.T) {
 func TestLogResultsWithoutVulnerabilitiesColor(t *testing.T) {
 	projects := 20
 	coordinates := createCoordinates(projects, false)
-	i := LogResults(true, 20, coordinates)
+	i := LogResults(true, false, 20, coordinates)
 
 	if i != 0 {
 		t.Errorf("Expected %d vulnerabilites but found %d", 0, i)
diff --git a/ossindex/ossindex_test.go b/ossindex/ossindex_test.go
index 6aba548..d68f10e 100644
--- a/ossindex/ossindex_test.go
+++ b/ossindex/ossindex_test.go
@@ -118,7 +118,6 @@ func TestAuditPackages_ErrorHttpRequest(t *testing.T) {
 	assert.Equal(t, []types.Coordinate(nil), coordinates)
 	parseError := err.(*url.Error)
 	assert.Equal(t, "parse", parseError.Op)
-	assert.Equal(t, "invalid character \"\\\\\" in host name", parseError.Err.Error())
 }
 
 func TestAuditPackages_ErrorNonExistentPurl(t *testing.T) {