feat/vuln list command by Sypher845 · Pull Request #748 · goharbor/harbor-cli

Sypher845 · 2026-03-16T23:09:57Z

Note: This is the secoond PR for the isue #723

Description

The PR adds the new harbor vuln list command. A command that displays the list of vulnerabilities along with filtering from the Security Hub.

Command usage

harbor vuln list (No filters)

The CVE-IDs are hyperlinked to aquasec website (provided by the api)
harbor vuln list --query "k=v , , , k=[min~max]" : Using query flag based filtering
harbor vuln list (flags based filtering) : Using flags for filtering
harbor vuln list --fixable: Show only fixable vulnerabilities (cli side)
harbor vuln list --exclude : woks oppposite of query flag (cli side)

Type of Change

codecov · 2026-03-16T23:34:52Z

Codecov Report

❌ Patch coverage is 0% with 237 lines in your changes missing coverage. Please review.
✅ Project coverage is 7.66%. Comparing base (60ad0bd) to head (013e125).
⚠️ Report is 119 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/api/vulnerability_handler.go	0.00%	133 Missing ⚠️
cmd/harbor/root/vulnerability/list.go	0.00%	63 Missing ⚠️
pkg/views/vulnerability/list/view.go	0.00%	40 Missing ⚠️
cmd/harbor/root/vulnerability/cmd.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff            @@
##             main    #748      +/-   ##
=========================================
- Coverage   10.99%   7.66%   -3.33%     
=========================================
  Files         173     272      +99     
  Lines        8671   13406    +4735     
=========================================
+ Hits          953    1027      +74     
- Misses       7612   12266    +4654     
- Partials      106     113       +7

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

pkg/api/vulnerability_handler.go

Signed-off-by: Sypher845 <suyashpatil845@gmail.com>

Sypher845 · 2026-03-19T22:11:45Z

@NucleoFusion Please take a look

NucleoFusion

Instead of --page-size 0 I think a special flag would be better, since its not that user friendly and hard to describe in the help

cmd/harbor/root/vulnerability/list.go

Sypher845 · 2026-03-20T05:53:40Z

--all flag works?

NucleoFusion · 2026-03-20T08:37:11Z

Yep

Signed-off-by: Sypher845 <suyashpatil845@gmail.com>

Sypher845 · 2026-03-20T12:39:36Z

@NucleoFusion Ptal :)

Sypher845 · 2026-03-22T06:57:25Z

@NucleoFusion any update on this?

NucleoFusion · 2026-03-22T07:05:17Z

@NucleoFusion any update on this?

Yeah I will have a look at it.
A little sick currently, mb.

Sypher845 · 2026-03-22T09:40:54Z

No worries, get well soon!

NucleoFusion

this look good, but waiting for some clarifications

NucleoFusion · 2026-03-23T10:59:19Z

cmd/harbor/root/vulnerability/list.go

+	flags := cmd.Flags()
+	flags.Int64VarP(&opts.Page, "page", "", 1, "Page number")
+	flags.Int64VarP(&opts.PageSize, "page-size", "", 10, "Size of per page")
+	flags.StringVarP(&opts.Q, "query", "q", "", "Filter vulnerabilities with a ',' separated query string like exact k=v and range k=[min~max]")
+	flags.StringVarP(&opts.CVEID, "cve-id", "", "", "Filter by exact CVE ID")
+	flags.StringVarP(&opts.CVSSScore, "cvss-score", "", "", "Filter by CVSS v3 score range (e.g. 7.0~10.0) or exact score (e.g. 7.0)")
+	flags.StringVarP(&opts.Severity, "severity", "", "", "Filter by severity level")
+	flags.StringVarP(&opts.Repository, "repository", "", "", "Filter by exact repository name")
+	flags.StringVarP(&opts.ProjectName, "project-name", "", "", "Filter by exact project name")
+	flags.StringVarP(&opts.Package, "package", "", "", "Filter by exact package name")
+	flags.StringVarP(&opts.Tag, "tag", "", "", "Filter by exact artifact tag")
+	flags.StringVarP(&opts.Digest, "digest", "", "", "Filter by exact artifact digest")


@bupd @qcserestipy
Should we have this many flags? would it be better to just have the Q param?
And since I am planning a PR on adding validKeys and usage to the query param about how it works in #731 .

Cause managing the current BuildQuery function takes the flags and just creates the full query, so integrating these two would be a little unintuitive.
And then also another problem is the individual flags are rigid, no support for exact/fuzzy switch, and there are also the Q params rigidity, like the params dont allow/follow 2 exact matching, they only do one. Using the Q would also allow or and and.

one thing to note, the SecurityHub API doesn't actually suport the fuzzy match, union and intersection for vuln fields.

Signed-off-by: Sypher845 <suyashpatil845@gmail.com>

Sypher845 · 2026-03-25T19:04:21Z

@NucleoFusion removed the query flag, PTAL

NucleoFusion

minor changes, works well

pkg/api/vulnerability_handler.go

Signed-off-by: Sypher845 <suyashpatil845@gmail.com>

NucleoFusion suggested changes Mar 17, 2026

View reviewed changes

pkg/api/vulnerability_handler.go Show resolved Hide resolved

pkg/api/vulnerability_handler.go Show resolved Hide resolved

pkg/api/vulnerability_handler.go Outdated Show resolved Hide resolved

Sypher845 added 3 commits March 20, 2026 03:30

feat(api): add vuln list handler for Security Hub endpoint

982a216

Signed-off-by: Sypher845 <suyashpatil845@gmail.com>

feat(vuln): vuln list command and view

317cae0

Signed-off-by: Sypher845 <suyashpatil845@gmail.com>

docs: cli and man page docs for vuln list command

8eb543c

Signed-off-by: Sypher845 <suyashpatil845@gmail.com>

Sypher845 force-pushed the feat/vuln-list-command branch from 2dc9c47 to 7b28626 Compare March 19, 2026 22:02

refactor: vuln filtering logic

a744965

Signed-off-by: Sypher845 <suyashpatil845@gmail.com>

Sypher845 force-pushed the feat/vuln-list-command branch from 7b28626 to a744965 Compare March 19, 2026 22:09

NucleoFusion suggested changes Mar 20, 2026

View reviewed changes

cmd/harbor/root/vulnerability/list.go Outdated Show resolved Hide resolved

cmd/harbor/root/vulnerability/list.go Outdated Show resolved Hide resolved

refractor: add 'all' flag to fetch all vuln upto 1000

86b2cf3

Signed-off-by: Sypher845 <suyashpatil845@gmail.com>

Sypher845 force-pushed the feat/vuln-list-command branch from 3fd8703 to 86b2cf3 Compare March 20, 2026 12:31

NucleoFusion reviewed Mar 23, 2026

View reviewed changes

chore(vuln): remove raw --query flag

12051ea

Signed-off-by: Sypher845 <suyashpatil845@gmail.com>

NucleoFusion suggested changes Mar 26, 2026

View reviewed changes

pkg/api/vulnerability_handler.go Outdated Show resolved Hide resolved

pkg/api/vulnerability_handler.go Show resolved Hide resolved

pkg/api/vulnerability_handler.go Outdated Show resolved Hide resolved

refactor(vuln): improve vulnerability list filtering flow

013e125

Signed-off-by: Sypher845 <suyashpatil845@gmail.com>

Conversation

Sypher845 commented Mar 16, 2026

Description

Command usage

Type of Change

Uh oh!

codecov bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Sypher845 commented Mar 19, 2026

Uh oh!

NucleoFusion left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Sypher845 commented Mar 20, 2026

Uh oh!

NucleoFusion commented Mar 20, 2026

Uh oh!

Sypher845 commented Mar 20, 2026

Uh oh!

Sypher845 commented Mar 22, 2026

Uh oh!

NucleoFusion commented Mar 22, 2026

Uh oh!

Sypher845 commented Mar 22, 2026

Uh oh!

NucleoFusion left a comment

Choose a reason for hiding this comment

Uh oh!

NucleoFusion Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Sypher845 Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

Sypher845 commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

NucleoFusion left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

codecov bot commented Mar 16, 2026 •

edited

Loading

Sypher845 commented Mar 25, 2026 •

edited

Loading