feat/vuln list command

cmd/harbor/root/vulnerability/cmd.go

@@ -26,6 +26,7 @@ func Vulnerability() *cobra.Command {
 
 	cmd.AddCommand(
 		GetVulnerabilitySummaryCommand(),
+		ListVulnerabilitiesCommand(),
 	)
 
 	return cmd

cmd/harbor/root/vulnerability/list.go

@@ -0,0 +1,116 @@
+// Copyright Project Harbor Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package vulnerability
+
+import (
+	"fmt"
+
+	"github.com/goharbor/go-client/pkg/sdk/v2.0/models"
+	"github.com/goharbor/harbor-cli/pkg/api"
+	"github.com/goharbor/harbor-cli/pkg/utils"
+	vulnlist "github.com/goharbor/harbor-cli/pkg/views/vulnerability/list"
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+func ListVulnerabilitiesCommand() *cobra.Command {
+	var opts api.ListVulnerabilityOptions
+
+	cmd := &cobra.Command{
+		Use:     "list",
+		Short:   "List vulnerabilities in Security Hub",
+		Long:    "List vulnerabilities from Harbor Security Hub",
+		Example: `  harbor vulnerability list`,
+		Args:    cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if opts.PageSize < 0 {
+				return fmt.Errorf("page size must be greater than or equal to 0")
+			}
+
+			if opts.PageSize > 100 {
+				return fmt.Errorf("page size should be less than or equal to 100")
+			}
+
+			allVulnerabilities, hasNext, err := fetchVulnerabilities(opts)
+			if err != nil {
+				return fmt.Errorf("failed to list vulnerabilities: %v", utils.ParseHarborErrorMsg(err))
+			}
+
+			if len(allVulnerabilities) == 0 {
+				log.Info("No vulnerabilities found")
+				return nil
+			}
+
+			formatFlag := viper.GetString("output-format")
+			if formatFlag != "" {
+				err = utils.PrintFormat(allVulnerabilities, formatFlag)
+				if err != nil {
+					return err
+				}
+			} else {
+				vulnlist.ViewVulnerabilityList(allVulnerabilities, hasNext)
+			}
+
+			return nil
+		},
+	}
+
+	flags := cmd.Flags()
+	flags.Int64VarP(&opts.Page, "page", "", 1, "Page number")
+	flags.Int64VarP(&opts.PageSize, "page-size", "", 10, "Size of per page")
+	flags.StringVarP(&opts.Q, "query", "q", "", "Filter vulnerabilities with a ',' separated query string like exact k=v and range k=[min~max]")
+	flags.StringVarP(&opts.CVEID, "cve-id", "", "", "Filter by exact CVE ID")
+	flags.StringVarP(&opts.CVSSScore, "cvss-score", "", "", "Filter by CVSS v3 score range (e.g. 7.0~10.0) or exact score (e.g. 7.0)")
+	flags.StringVarP(&opts.Severity, "severity", "", "", "Filter by severity level")
+	flags.StringVarP(&opts.Repository, "repository", "", "", "Filter by exact repository name")
+	flags.StringVarP(&opts.ProjectName, "project-name", "", "", "Filter by exact project name")
+	flags.StringVarP(&opts.Package, "package", "", "", "Filter by exact package name")
+	flags.StringVarP(&opts.Tag, "tag", "", "", "Filter by exact artifact tag")
+	flags.StringVarP(&opts.Digest, "digest", "", "", "Filter by exact artifact digest")
+	flags.StringVarP(&opts.Exclude, "exclude", "", "", "Exclude vulnerabilities using a ',' separated query string (e.g., k=v or k=[min~max])")
+	flags.BoolVarP(&opts.Fixable, "fixable", "", false, "Only show fixable vulnerabilities")
+
+	return cmd
+}
+
+func fetchVulnerabilities(opts api.ListVulnerabilityOptions) ([]*models.VulnerabilityItem, bool, error) {
+	var allVuln []*models.VulnerabilityItem
+	if opts.PageSize == 0 {
+		log.Debug("Page size is 0, will fetch all vulnerabilities")
+		opts.PageSize = 100
+		opts.Page = 1
+		for {
+			response, err := api.ListVulnerabilities(opts)
+			if err != nil {
+				return nil, false, fmt.Errorf("failed to list vulnerabilities: %v", utils.ParseHarborErrorMsg(err))
+			}
+			if len(response.Payload) == 0 {
+				break
+			}
+			allVuln = append(allVuln, response.Payload...)
+			opts.Page++
+			if opts.Page > 10 {
+				return allVuln, true, nil
+			}
+		}
+	} else {
+		response, err := api.ListVulnerabilities(opts)
+		if err != nil {
+			return nil, false, fmt.Errorf("failed to list vulnerabilities: %v", utils.ParseHarborErrorMsg(err))
+		}
+		allVuln = append(allVuln, response.Payload...)
+	}
+	return allVuln, false, nil
+}

doc/cli-docs/harbor-vulnerability-list.md

@@ -0,0 +1,55 @@
+---
+title: harbor vulnerability list
+weight: 90
+---
+## harbor vulnerability list
+
+### Description
+
+##### List vulnerabilities in Security Hub
+
+### Synopsis
+
+List vulnerabilities from Harbor Security Hub
+
+```sh
+harbor vulnerability list [flags]
+```
+
+### Examples
+
+```sh
+  harbor vulnerability list
+```
+
+### Options
+
+```sh
+      --cve-id string         Filter by exact CVE ID
+      --cvss-score string     Filter by CVSS v3 score range (e.g. 7.0~10.0) or exact score (e.g. 7.0)
+      --digest string         Filter by exact artifact digest
+      --exclude string        Exclude vulnerabilities using a ',' separated query string (e.g., k=v or k=[min~max])
+      --fixable               Only show fixable vulnerabilities
+  -h, --help                  help for list
+      --package string        Filter by exact package name
+      --page int              Page number (default 1)
+      --page-size int         Size of per page (default 10)
+      --project-name string   Filter by exact project name
+  -q, --query string          Filter vulnerabilities with a ',' separated query string like exact k=v and range k=[min~max]
+      --repository string     Filter by exact repository name
+      --severity string       Filter by severity level
+      --tag string            Filter by exact artifact tag
+```
+
+### Options inherited from parent commands
+
+```sh
+  -c, --config string          config file (default is $HOME/.config/harbor-cli/config.yaml)
+  -o, --output-format string   Output format. One of: json|yaml
+  -v, --verbose                verbose output
+```
+
+### SEE ALSO
+
+* [harbor vulnerability](harbor-vulnerability.md)	 - Manage vulnerabilities in Security Hub
+

doc/cli-docs/harbor-vulnerability.md

@@ -35,5 +35,6 @@ List vulnerabilities and view vulnerability summary from Harbor Security Hub
 ### SEE ALSO
 
 * [harbor](harbor.md)	 - Official Harbor CLI
+* [harbor vulnerability list](harbor-vulnerability-list.md)	 - List vulnerabilities in Security Hub
 * [harbor vulnerability summary](harbor-vulnerability-summary.md)	 - Get Security Hub vulnerability summary
 

doc/man-docs/man1/harbor-vulnerability-list.1

@@ -0,0 +1,93 @@
+.nh
+.TH "HARBOR" "1"  "Harbor Community" "Harbor User Manuals"
+
+.SH NAME
+harbor-vulnerability-list - List vulnerabilities in Security Hub
+
+
+.SH SYNOPSIS
+\fBharbor vulnerability list [flags]\fP
+
+
+.SH DESCRIPTION
+List vulnerabilities from Harbor Security Hub
+
+
+.SH OPTIONS
+\fB--cve-id\fP=""
+	Filter by exact CVE ID
+
+.PP
+\fB--cvss-score\fP=""
+	Filter by CVSS v3 score range (e.g. 7.0~10.0) or exact score (e.g. 7.0)
+
+.PP
+\fB--digest\fP=""
+	Filter by exact artifact digest
+
+.PP
+\fB--exclude\fP=""
+	Exclude vulnerabilities using a ',' separated query string (e.g., k=v or k=[min~max])
+
+.PP
+\fB--fixable\fP[=false]
+	Only show fixable vulnerabilities
+
+.PP
+\fB-h\fP, \fB--help\fP[=false]
+	help for list
+
+.PP
+\fB--package\fP=""
+	Filter by exact package name
+
+.PP
+\fB--page\fP=1
+	Page number
+
+.PP
+\fB--page-size\fP=10
+	Size of per page
+
+.PP
+\fB--project-name\fP=""
+	Filter by exact project name
+
+.PP
+\fB-q\fP, \fB--query\fP=""
+	Filter vulnerabilities with a ',' separated query string like exact k=v and range k=[min~max]
+
+.PP
+\fB--repository\fP=""
+	Filter by exact repository name
+
+.PP
+\fB--severity\fP=""
+	Filter by severity level
+
+.PP
+\fB--tag\fP=""
+	Filter by exact artifact tag
+
+
+.SH OPTIONS INHERITED FROM PARENT COMMANDS
+\fB-c\fP, \fB--config\fP=""
+	config file (default is $HOME/.config/harbor-cli/config.yaml)
+
+.PP
+\fB-o\fP, \fB--output-format\fP=""
+	Output format. One of: json|yaml
+
+.PP
+\fB-v\fP, \fB--verbose\fP[=false]
+	verbose output
+
+
+.SH EXAMPLE
+.EX
+  harbor vulnerability list
+.EE
+
+
+.SH SEE ALSO
+\fBharbor-vulnerability(1)\fP

doc/man-docs/man1/harbor-vulnerability.1

@@ -38,4 +38,4 @@ List vulnerabilities and view vulnerability summary from Harbor Security Hub
 
 
 .SH SEE ALSO
-\fBharbor(1)\fP, \fBharbor-vulnerability-summary(1)\fP
+\fBharbor(1)\fP, \fBharbor-vulnerability-list(1)\fP, \fBharbor-vulnerability-summary(1)\fP

pkg/api/types.go

@@ -81,3 +81,20 @@ type GetMemberOptions struct {
 	ID              int64
 	ProjectNameOrID string
 }
+
+type ListVulnerabilityOptions struct {
+	CVEID       string
+	CVSSScore   string
+	Severity    string
+	Repository  string
+	ProjectName string
+	Package     string
+	Tag         string
+	Digest      string
+	Exclude     string
+	WithTag     bool
+	Fixable     bool
+	Page        int64
+	PageSize    int64
+	Q           string
+}