feat: quarantine based on scanner malicious verdict#1991
Open
janbro wants to merge 2 commits into
Open
Conversation
Some security providers return an explicit isMalicious verdict rather than relying solely on rule/finding matches. Add support for scanners to report this verdict; quarantine is enforced when malicious is true, and findings are recorded as warnings when malicious is false.
Reformat multi-argument calls in ExtensionScanPersistenceServiceTest and RemoteScannerTest to match the project's eclipse formatter output.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Some security scanners return an explicit
isMaliciousverdict rather than relying solely on rule/finding matches. This adds support for scanners to report that verdict and uses it to drive quarantine decisions:malicious = true→ the extension is quarantined, even if there are no other findings.malicious = false→ findings are recorded for the audit trail but treated as warnings only, not enforced.null) → falls back to the existing behavior, enforcing based on findings alone.The verdict can only narrow enforcement, never widen it past what a scanner's own
enforcedsetting allows. A scanner explicitly configured withenforced: falsenever quarantines, regardless of verdict.Follow-up
This is the first stage of enabling
isMaliciousverdict parsing for existing scanners in production. After this PR is merged, application configuration will need to be updated to add theisMaliciousJSONPath to each scanner's result mapping.