Scan android hosts for vulnerabilities - #49319
Conversation
1ea4dee to
72ee844
Compare
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## 35075-software-os-show-android-versions-and-vulnerabilities #49319 +/- ##
===============================================================================================
+ Coverage 67.97% 67.98% +0.01%
===============================================================================================
Files 3801 3806 +5
Lines 239965 240886 +921
Branches 12693 12693
===============================================================================================
+ Hits 163123 163776 +653
- Misses 62058 62233 +175
- Partials 14784 14877 +93
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
Adds Android OS-version vulnerability scanning by downloading Android OSV artifacts and matching them against operating_systems rows (major + SPL) to write CVEs into operating_system_vulnerabilities, wired into the vulnerability cron.
Changes:
- Extend OSV syncing to recognize and download
osv-android-*artifacts (including inventory-driven refresh). - Add an Android analyzer that loads the gzipped artifact, matches SPL vs fixed SPL, and upserts OS vulnerabilities (delta insert/delete).
- Wire Android analysis into the vuln cron and add unit tests for the new analyzer and updated OSV syncing helpers.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| server/vulnerabilities/osv/sync.go | Adds Android OSV artifact prefix support and Android-specific refresh + cleanup logic. |
| server/vulnerabilities/osv/sync_test.go | Updates tests for expanded versionsFromRelease return values. |
| server/vulnerabilities/android/analyzer.go | Implements Android OSV artifact loading + SPL-based matching and OS vuln upsert logic. |
| server/vulnerabilities/android/analyzer_test.go | Adds unit tests for parsing + matching behavior and delta deletion behavior. |
| server/fleet/vulnerabilities.go | Introduces AndroidOSVSource as a new VulnerabilitySource. |
| cmd/fleet/cron.go | Adds an Android OSV phase to the vuln scan cron (sync + analyze). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| logger.InfoContext(ctx, "phase completed", "phase", "windows_msrc", "elapsed", time.Since(phaseStart)) | ||
|
|
||
| phaseStart = time.Now() | ||
| checkAndroidVulnerabilities(ctx, ds, logger, vulnPath, config, vulnAutomationEnabled != "") |
There was a problem hiding this comment.
Shouldn't this be gated by config.OSVForVulnerabilities ?
|
|
||
| // LatestArtifactDate returns the date encoded in the latest Android artifact | ||
| // filename for the given version, or zero time if none found. | ||
| func LatestArtifactDate(majorVersion, vulnPath string) time.Time { |
| analyzeCtx, analyzeSpan := tracer.Start(ctx, "vuln.android.analyze") | ||
| for _, o := range oses { | ||
| start := time.Now() | ||
| r, err := androidvuln.Analyze(analyzeCtx, ds, o, vulnPath, collectVulns, logger) |
There was a problem hiding this comment.
This will call loadArtifact for each o, even though the artifact is only a function of the "major version", right?
Maybe something that can be optimized by keeping a cache of loaded artifacts and then providing that to Analyze.
|
There are some gaps here in testing:
|
| func TestResolvedVersion(t *testing.T) { | ||
| got := resolvedVersion("16", "2026-06-01") | ||
| require.NotNil(t, got) | ||
| assert.Equal(t, "16 (2026-06-01)", *got) |
There was a problem hiding this comment.
nit: lets use require here for consistency
| SELECT id, name, version, arch, kernel_version, platform, display_version, installation_type, os_version_id | ||
| FROM operating_systems | ||
| WHERE platform = ? | ||
| ORDER BY version |
There was a problem hiding this comment.
This is to support not loading all of the android artifacts into cache, but rather one version at at time.
76b4faf
into
35075-software-os-show-android-versions-and-vulnerabilities
Related issue: Resolves #47336
SELECT *is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.Testing