illikainen / ossaudit Goto Github PK
View Code? Open in Web Editor NEWAudit python packages for known vulnerabilities
License: BSD 2-Clause "Simplified" License
Audit python packages for known vulnerabilities
License: BSD 2-Clause "Simplified" License
Could be good to export data as SARIF format or another simple format like raw object export as JSON
I case of the index DB is updated (a vulnerability is fixed) the ossaudit
tool uses the data from the cache and doesn't fetch new records.
To get new data I had to find and remove the cache.json
file.
It would be great to have a flag --no-cache
to ignore the data from cache.json
or --reset-cache
to rewrite the cache file.
columns = id, name, version, title
ossaudit -c ossaudit.conf -i
id
column to the outputoptions.py add_config does not work well with the config parser output. click-config-file can be used instead of add_config of option.py
I have a situation where developers have a requirements.txt file but none of the packages have a version. While this is allowed by pip, it has resulted in false positives because pip grabs the latest version, but the scan is pulling vulnerability data for the 0 version. While I am trying to get our developers to add versions, which is a much better DevSecOps practice, there really should be a way for the OssIndex scan to use the latest version for the scan as this is what pip pulls in this case. Given the recent dependency confusion attack, this and warning on no version would be huge helps.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.