Security Hub
Relevant source files
The following files were used as context for generating this wiki page:
- src/controller/securityhub/controller.go
- src/pkg/securityhub/manager.go
- src/server/v2.0/handler/security.go
- api/v2.0/swagger.yaml
- tests/apitests/python/test_security_hub.py
- src/portal/src/app/base/left-side-nav/interrogation-services/vulnerability-database/vulnerability-summary/vulnerability-summary.component.ts
Security Hub is a centralized interrogation service within Harbor designed to provide a comprehensive overview of the security posture across the entire registry. It aggregates vulnerability data from various projects and repositories, offering system-level summaries and detailed vulnerability lists to help administrators identify and mitigate risks.
The module facilitates the identification of "dangerous" artifacts and CVEs by ranking them based on severity and frequency. It provides specialized API endpoints for retrieving security summaries, including counts of vulnerabilities categorized by severity (Critical, High, Medium, Low) and statistics on scanned versus unscanned artifacts.
Sources: api/v2.0/swagger.yaml, src/server/v2.0/handler/security.go:34-45
Architecture and Components
The Security Hub follows a tiered architecture consisting of an API handler, a controller, and a manager that interacts with the Data Access Object (DAO) layer.
System Flow
The diagram below illustrates the request flow from the API layer down to the data management layer for retrieving security information.
The flow ensures that security data is consistently retrieved and transformed from internal records into the API models defined in the system.
Sources: src/server/v2.0/handler/security.go:28-32, src/pkg/securityhub/manager.go:34-40
Key Data Structures
The system utilizes specific models to represent the security state. The SecuritySummary provides a high-level view, while VulnerabilityItem represents individual security flaws.
| Component | Description |
|---|---|
| SecuritySummary | Aggregates counts of vulnerabilities (Critical to None), total artifacts, and lists of top dangerous items. |
| DangerousArtifact | Represents an artifact with high counts of critical or high-severity vulnerabilities. |
| DangerousCVE | Represents high-impact CVEs identified across the registry. |
| VulnerabilityItem | Detailed record of a specific vulnerability including CVE ID, package, version, and CVSS score. |
Sources: api/v2.0/swagger.yaml:1260-1324, src/server/v2.0/handler/security.go:47-60
API Endpoints
Security Hub exposes two primary RESTful endpoints under the /security path. Access to these endpoints requires system-level permissions (rbac.ResourceSecurityHub).
Summary and Vulnerability Management
- GET
/security/summary: Retrieves the vulnerability summary of the system. Parameters likewith_dangerous_cveandwith_dangerous_artifactcan be used to include specific rankings in the response. - GET
/security/vul: Lists vulnerabilities with extensive filtering support.
Supported Query Parameters for Vulnerabilities
The list vulnerability API supports a query string q for complex filtering:
| Parameter | Match Type | Description |
|---|---|---|
cve_id | Exact | The ID of the vulnerability (e.g., CVE-2021-44228). |
severity | Exact | Severity level (Critical, High, Medium, Low). |
project_id | Exact | Filter by specific project. |
repository_name | Exact | Filter by repository. |
cvss_score_v3 | Range | Range condition (e.g., [9.0~10.0]). |
package | Exact | Filter by affected software package. |
Sources: api/v2.0/swagger.yaml:890-955, tests/apitests/python/test_security_hub.py:65-98
Logic and Data Flow
The Security Hub manager (Manager interface) serves as the primary engine for security logic. It calculates artifact counts and vulnerability distributions.
Vulnerability Aggregation
The Summary function in the manager aggregates report data from scanner results. It uses a scannerUUID (typically the system default scanner) to filter relevant interrogation records.
Security Hub Manager Interface
The manager defines the core capabilities for system-wide security assessment:
ScannedArtifactsCount: Returns the count of artifacts that have successfully undergone interrogation.DangerousArtifacts: Identifies the top 5 most dangerous artifacts based on their vulnerability profile.DangerousCVEs: Identifies the top 5 CVEs that present the highest risk across all repositories.
Sources: src/pkg/securityhub/manager.go:28-36
UI Integration
The Security Hub is integrated into the Harbor portal under the "Interrogation Services" section. The frontend utilizes components like VulnerabilitySummaryComponent to visualize the data via charts and lists.
Visualization Details
- Pie Chart: Displays the distribution of vulnerabilities across different severity levels using the ECharts library.
- Dangerous Lists: Shows the "Top 5 Most Dangerous Artifacts" and "Top 5 Most Dangerous CVEs" with direct links to project repositories and CVE databases.
- Filtering: The UI allows users to trigger searches for specific CVEs or repositories directly from the summary view.
Sources: src/portal/src/app/base/left-side-nav/interrogation-services/vulnerability-database/vulnerability-summary/vulnerability-summary.component.ts:60-160, src/portal/src/app/base/left-side-nav/interrogation-services/vulnerability-database/vulnerability-summary/vulnerability-summary.component.html
Conclusion
Security Hub provides Harbor administrators with the critical visibility needed to manage security debt. By consolidating vulnerability data and highlighting the most significant threats, it enables proactive security management. The system's reliance on RBAC ensures that sensitive security summaries are only accessible to authorized system or project administrators.
Sources: src/server/v2.0/handler/security.go:35-37, tests/apitests/python/test_security_hub.py:122-132