Add CVE chart filtering and non-critical CVE data collection (backend) - #47470
Conversation
|
@coderabbitai review |
✅ Action performedReview finished.
|
WalkthroughThis PR refactors the CVE chart data flow by replacing a single Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #47470 +/- ##
==========================================
+ Coverage 67.20% 67.23% +0.03%
==========================================
Files 3393 3401 +8
Lines 228256 229193 +937
Branches 11755 11755
==========================================
+ Hits 153396 154101 +705
- Misses 61034 61203 +169
- Partials 13826 13889 +63
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
sgress454
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
changes/44746-collect-and-filter-more-cves (1)
1-1: 💤 Low valueConsider clarifying the scope of filtering capabilities.
The entry accurately describes the data collection expansion and default filtering behavior. However, it could be clearer that this change also introduces interactive filtering capabilities (by software category, known-exploit status, EPSS score, and CVE exclusions) rather than just a fixed default filter, and that the feature is restricted to Fleet Premium tier.
📝 Suggested enhancement for clarity
-- Started collecting non-critical CVEs, filtering them out of charts by default. +- Started collecting non-critical CVEs while maintaining critical-only chart display. Added Premium-tier filtering by software category, known-exploit status, EPSS score, and CVE exclusions.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@changes/44746-collect-and-filter-more-cves` at line 1, The changelog entry for the CVE collection and filtering feature in the file changes/44746-collect-and-filter-more-cves is incomplete. Update the entry to clarify that in addition to the default filtering behavior, the feature includes interactive filtering capabilities that allow users to filter by software category, known-exploit status, EPSS score, and CVE exclusions. Also add an explicit note that these filtering capabilities are restricted to the Fleet Premium tier. This will provide users with a more complete understanding of what functionality has been added and any tier-related limitations.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@changes/44746-collect-and-filter-more-cves`:
- Line 1: The changelog entry for the CVE collection and filtering feature in
the file changes/44746-collect-and-filter-more-cves is incomplete. Update the
entry to clarify that in addition to the default filtering behavior, the feature
includes interactive filtering capabilities that allow users to filter by
software category, known-exploit status, EPSS score, and CVE exclusions. Also
add an explicit note that these filtering capabilities are restricted to the
Fleet Premium tier. This will provide users with a more complete understanding
of what functionality has been added and any tier-related limitations.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: c7dbf764-500e-4b0d-9d9c-6bd4df4ef3b1
📒 Files selected for processing (2)
changes/44746-collect-and-filter-more-cvesserver/chart/api/chart.go
🚧 Files skipped from review as they are similar to previous changes (1)
- server/chart/api/chart.go
There was a problem hiding this comment.
Warning
- Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.
Pull request overview
This PR expands CVE chart data collection to include a wider, curated universe of CVEs (all severities) and adds read-time filtering so the vulnerability exposure chart can be narrowed by software categories, EPSS bounds, known-exploit status, and excluded CVEs (while keeping the default display critical-only for now).
Changes:
- Replace the “tracked critical CVEs” collector scope with a broader “collectible CVEs” set and introduce a resolver to compute the chart’s entity allow-set at read time.
- Add CVE-related query parameters to the charts API handler/types and echo filter fields in responses.
- Add/expand unit and MySQL-backed tests around CVE collection and filtering behavior.
Reviewed changes
Copilot reviewed 12 out of 13 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| tools/charts-backfill/main.go | Update backfill tool to discover CVEs using the new collectible-CVE query. |
| server/chart/internal/types/chart.go | Add CVEChartFilter and extend datastore interface for collection + resolution. |
| server/chart/internal/testutils/testutils.go | Expand test DB truncation to include vulnerability-related tables. |
| server/chart/internal/service/service.go | Resolve CVE entity allow-set at read time; include CVE filter fields in response. |
| server/chart/internal/service/service_test.go | Update mocks/tests for new CVE resolver and collectible collection path. |
| server/chart/internal/service/handler.go | Parse CVE filter query params into RequestOpts. |
| server/chart/internal/mysql/charts.go | Implement CollectibleCVEs and ResolveCVEChartEntities with category/meta predicates. |
| server/chart/internal/mysql/cve_filter_test.go | Add MySQL integration tests for collectible set + resolver filtering. |
| server/chart/datasets.go | Use api.MetricCVE constant and switch collector to CollectibleCVEs. |
| server/chart/bootstrap/bootstrap.go | Expose CollectibleCVEs helper for dev tooling. |
| server/chart/api/http/types.go | Add CVE filter query parameters to request type. |
| server/chart/api/chart.go | Add MetricCVE + category constants and RequestOpts/Filters fields for CVE filters. |
| changes/44746-collect-and-filter-more-cves | Release note entry (content excluded from review). |
Files excluded by content exclusion policy (1)
- changes/44746-collect-and-filter-more-cves
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
getvictor
left a comment
getvictor
left a comment
There was a problem hiding this comment.
Only did a cursory review. Performance is always a concern for vulns. Please make sure the test plan test performance for different variations of settings.
| // CVE entity filters (apply only to the MetricCVE metric). | ||
| SoftwareFilters []string | ||
| KnownExploit bool | ||
| // EPSS bounds are 0.0–1.0 (matching cve_meta.epss_probability); nil means |
There was a problem hiding this comment.
Do we validate inputs against the bound on the backend?
There was a problem hiding this comment.
In the API yes, not at the query level
Related issue: Resolves #44746
Details
Related PRs update the front-end to allow sending these filters, and update GitOps to allow changing the default filters.
Checklist for submitter
If some of the following don't apply, delete the relevant line.
Changes file added for user-visible changes in
changes/,orbit/changes/oree/fleetd-chrome/changes.See Changes files for more information.
Input data is properly validated,
SELECT *is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.Testing
Manual test plan — CVE chart filtering (backend smoke test)
Setup
cve_meta/software_cve/operating_system_vulnerabilitiesare populated)go run ./tools/charts-backfill --dataset cve --use-tracked-cves --days 7Checks (compare against the no-filter baseline)
peaks (no low-severity leak; client severity ignored)
baseline
== baseline (no-op)
SELECT COUNT(DISTINCT scd.entity_id) AS below_critical
FROM host_scd_data scd JOIN cve_meta cm ON cm.cve = scd.entity_id
WHERE scd.dataset='cve' AND cm.cvss_score < 9.0;
Summary by CodeRabbit
Summary of changes
New Features
Tests
Chores