diff --git a/PROJECTS/simple-vulnerability-scanner/internal/cli/output.go b/PROJECTS/simple-vulnerability-scanner/internal/cli/output.go index f4d1d5e2..2711bd35 100644 --- a/PROJECTS/simple-vulnerability-scanner/internal/cli/output.go +++ b/PROJECTS/simple-vulnerability-scanner/internal/cli/output.go @@ -307,6 +307,26 @@ func truncate(s string, maxLen int) string { return s[:maxLen-3] + "..." } +func filterVulnsBySeverity( + vulns map[string][]types.Vulnerability, + minSev string, +) map[string][]types.Vulnerability { + threshold := severityRank(minSev) + filtered := make(map[string][]types.Vulnerability) + for pkg, vlist := range vulns { + var kept []types.Vulnerability + for _, v := range vlist { + if severityRank(v.Severity) <= threshold { + kept = append(kept, v) + } + } + if len(kept) > 0 { + filtered[pkg] = kept + } + } + return filtered +} + // PrintSummary displays final counts after an update or scan operation func PrintSummary(result types.ScanResult, updated bool) { if updated { diff --git a/PROJECTS/simple-vulnerability-scanner/internal/cli/update.go b/PROJECTS/simple-vulnerability-scanner/internal/cli/update.go index 2d279585..a11b38f0 100644 --- a/PROJECTS/simple-vulnerability-scanner/internal/cli/update.go +++ b/PROJECTS/simple-vulnerability-scanner/internal/cli/update.go @@ -18,7 +18,10 @@ import ( "github.com/spf13/cobra" ) -var verbose bool +var ( + verbose bool + minSeverity string +) type updateFlags struct { file string @@ -50,6 +53,10 @@ latest stable versions, and checks for known CVEs using OSV.dev.`, &verbose, "verbose", "v", false, "show full vulnerability details", ) + root.PersistentFlags().StringVar( + &minSeverity, "min-severity", "low", + "minimum severity to report (critical, high, moderate, low)", + ) root.AddCommand( newUpdateCmd(), @@ -220,6 +227,7 @@ func runUpdate( } if vulns != nil { + vulns = filterVulnsBySeverity(vulns, minSeverity) PrintVulnerabilities(vulns) } @@ -255,6 +263,7 @@ func runScan(ctx context.Context, file string) error { PrintScanning(len(deps)) vulns := scanForVulns(ctx, deps) + vulns = filterVulnsBySeverity(vulns, minSeverity) PrintVulnerabilities(vulns) totalVulns := 0