Pipeline .net get vulnerabilities
Asked by DavidL:

Hi

I am creating a pipeline and using this to try and get the vulnerabilities and stop the build with notifcation of issues:

dotnet list package --vulnerable --include-transitive 2\>\&1 \| tee build.log

<br />

grep -q -i "critical\\\|high\\\|moderate\\\|low" build.log; \[ $? -eq 0 \] \&\& echo "Security Vulnerabilities found on the log output" \&\& exit 1

Line 1 works but line 2 errors and the pipeline does not build.

This is where I found the example:

<https://www.mytechramblings.com/posts/check-if-your-dotnet-app-dependencies-has-a-security-vulnerability-on-you-cicd-pipelines/>

Thanks.

Dave


Answers:
author: Patrik S
body: Hey [@DavidL](/t5/user/viewprofilepage/user-id/3060024) ! Thank you for reaching out to the community!

I think the command is failing because by default grep will return a non-zero exit code when no matching string is found in the file, and pipelines will immediately fail the build when a non-exit code is returned.

In this case, I would suggest adding the grep command directly on an **if statement** condition, so bash will not abort the pipeline when resolving the exit code. The command in your step would look like the following :  

```
pipelines:
  default:
    - step:
        name: My test
        script:
          - dotnet list package --vulnerable --include-transitive 2>&1 | tee build.log
          - cat build.log
          - if grep -q -i "critical\|high\|moderate\|low" build.log;then echo "Security Vulnerabilities found on the log output" && exit 1;fi
          - <rest of your commands> 
```

You can try testing based on the example above and let us know how it goes.

Thank you, [@DavidL](/t5/user/viewprofilepage/user-id/3060024) !

Patrik S

comments: author: DavidL
body: Hi Patrik

<br />

Thanks for the response, it still does not work, there is also an error when trying to get the assets file on the packages along with it still erroring run the grep command, it does not seem to show an error on the grep command however?

![Screenshot 2023-07-10 101658.png](https://community.atlassian.com/t5/image/serverpage/image-id/267699i67E36865D14C6BBC/image-size/large?v=v2&px=999 "Screenshot 2023-07-10 101658.png")


author: Patrik S
body: Hey [@DavidL](/t5/user/viewprofilepage/user-id/3060024) ,

This error seems to be specific to dotnet. The documentation you shared in the questions states that a **dotnet restore** is required before the dotnet list package command. You can include that **dotnet restore** command as the first command in the pipeline step and verify if the issue is solved.

If the error is still happening, I would suggest debugging your pipeline locally in a docker container following the instruction in the article below :

* <https://confluence.atlassian.com/bbkb/debug-pipelines-locally-with-docker-1167698072.html>

With this option, you can test different approaches to fix the issue locally without wasting your bitbucket pipeline build minutes. Once it's running fine locally, you can then push the changes to Bitbucket and the pipeline should complete successfully as well.

Thank you, [@DavidL](/t5/user/viewprofilepage/user-id/3060024) !

Patrik S


author: DavidL
body: Thanks, I now have the dotnet vulnerability check working at least, however it is actually reporting issues with the dotnet docker image/dot net sdk, which is the latest one!

![Screenshot 2023-07-13 172915.png](https://community.atlassian.com/t5/image/serverpage/image-id/268688iC0A8392AEE0CC38A/image-size/large?v=v2&px=999 "Screenshot 2023-07-13 172915.png")


Tags: bitbucket-cloud

cloud