Skip to content

Commit 42584a3

Browse files
flowstateflowstate
committed
added SARIF back in
1 parent ab26041 commit 42584a3

File tree

4 files changed

+97
-53
lines changed

4 files changed

+97
-53
lines changed

‎README.md

Lines changed: 63 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -2,45 +2,76 @@
22

33
The Socket Security CLI was created to enable integrations with other tools like Github Actions, Gitlab, BitBucket, local use cases and more. The tool will get the head scan for the provided repo from Socket, create a new one, and then report any new alerts detected. If there are new alerts against the Socket security policy it'll exit with a non-Zero exit code.
44

5-
6-
75
## Usage
86

97
```` shell
10-
socketcli [-h] [--api-token API_TOKEN] [--repo REPO] [--branch BRANCH] [--committer COMMITTER] [--pr-number PR_NUMBER]
11-
[--commit-message COMMIT_MESSAGE] [--default-branch] [--target-path TARGET_PATH] [--scm {api,github,gitlab}] [--sbom-file SBOM_FILE]
12-
[--commit-sha COMMIT_SHA] [--generate-license GENERATE_LICENSE] [-v] [--enable-debug] [--enable-json] [--enable-sarif] [--disable-overview]
13-
[--disable-security-issue] [--files FILES] [--ignore-commit-files] [--timeout]
8+
socketcli [-h] [--api-token API_TOKEN] [--repo REPO] [--integration {api,github,gitlab}] [--owner OWNER] [--branch BRANCH]
9+
[--committers [COMMITTERS ...]] [--pr-number PR_NUMBER] [--commit-message COMMIT_MESSAGE] [--commit-sha COMMIT_SHA]
10+
[--target-path TARGET_PATH] [--sbom-file SBOM_FILE] [--files FILES] [--default-branch] [--pending-head]
11+
[--generate-license] [--enable-debug] [--enable-json] [--enable-sarif] [--disable-overview] [--disable-security-issue]
12+
[--allow-unverified] [--ignore-commit-files] [--disable-blocking] [--scm SCM] [--timeout TIMEOUT]
1413
````
1514

1615
If you don't want to provide the Socket API Token every time then you can use the environment variable `SOCKET_SECURITY_API_KEY`
1716
18-
19-
| Parameter | Alternate Name | Required | Default | Description |
20-
|:-------------------------|:---------------|:---------|:--------|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
21-
| -h | --help | False | | Show the CLI help message |
22-
| --api-token | | False | | Provides the Socket API Token |
23-
| --repo | | True | | The string name in a git approved name for repositories. |
24-
| --branch | | False | | The string name in a git approved name for branches. |
25-
| --committer | | False | | The string name of the person doing the commit or running the CLI. Can be specified multiple times to have more than one committer |
26-
| --pr-number | | False | 0 | The integer for the PR or MR number |
27-
| --commit-message | | False | | The string for a commit message if there is one |
28-
| --default-branch | | False | False | If the flag is specified this will signal that this is the default branch. This needs to be enabled for a report to update Org Alerts and Org Dependencies |
29-
| --target-path | | False | ./ | This is the path to where the manifest files are location. The tool will recursively search for all supported manifest files |
30-
| --scm | | False | api | This is the mode that the tool is to run in. For local runs `api` would be the mode. Other options are `gitlab` and `github` |
31-
| --generate-license | | False | False | If this flag is specified it will generate a json file with the license per package and license text in the current working directory |
32-
| --version | -v | False | | Prints the version and exits |
33-
| --enable-debug | | False | False | Enables debug messaging for the CLI |
34-
| --sbom-file | | False | False | Creates a JSON file with all dependencies and alerts |
35-
| --commit-sha | | False | | The commit hash for the commit |
36-
| --generate-license | | False | False | If enabled with `--sbom-file` will include license details |
37-
| --enable-json | | False | False | If enabled will change the console output format to JSON |
38-
| --enable-sarif | | False | False | If enabled will change the console output format to SARIF |
39-
| --disable-overview | | False | False | If enabled will disable Dependency Overview comments |
40-
| --disable-security-issue | | False | False | If enabled will disable Security Issue Comments |
41-
| --files | | False | | If provided in the format of `["file1", "file2"]` will be used to determine if there have been supported file changes. This is used if it isn't a git repo and you would like to only run if it supported files have changed. |
42-
| --ignore-commit-files | | False | False | If enabled then the CLI will ignore what files are changed in the commit and look for all manifest files |
43-
| --disable-blocking | | False | False | Disables failing checks and will only exit with an exit code of 0 |
17+
### Parameters
18+
19+
#### Authentication
20+
| Parameter | Required | Default | Description |
21+
|:-------------|:---------|:--------|:--------------------------------------------------------------------------------------|
22+
| --api-token | False | | Socket Security API token (can also be set via SOCKET_SECURITY_API_KEY env var) |
23+
24+
#### Repository
25+
| Parameter | Required | Default | Description |
26+
|:-------------|:---------|:--------|:-------------------------------------------------------------------------|
27+
| --repo | False | | Repository name in owner/repo format |
28+
| --integration| False | api | Integration type (api, github, gitlab) |
29+
| --owner | False | | Name of the integration owner, defaults to the socket organization slug |
30+
| --branch | False | "" | Branch name |
31+
| --committers | False | | Committer(s) to filter by |
32+
33+
#### Pull Request and Commit
34+
| Parameter | Required | Default | Description |
35+
|:----------------|:---------|:--------|:-------------------|
36+
| --pr-number | False | "0" | Pull request number|
37+
| --commit-message| False | | Commit message |
38+
| --commit-sha | False | "" | Commit SHA |
39+
40+
#### Path and File
41+
| Parameter | Required | Default | Description |
42+
|:-------------|:---------|:--------|:-------------------------------------------|
43+
| --target-path| False | ./ | Target path for analysis |
44+
| --sbom-file | False | | SBOM file path |
45+
| --files | False | [] | Files to analyze (JSON array string) |
46+
47+
#### Branch and Scan Configuration
48+
| Parameter | Required | Default | Description |
49+
|:---------------|:---------|:--------|:----------------------------------------------------------|
50+
| --default-branch| False | False | Make this branch the default branch |
51+
| --pending-head | False | False | If true, the new scan will be set as the branch's head scan|
52+
53+
#### Output Configuration
54+
| Parameter | Required | Default | Description |
55+
|:----------------------|:---------|:--------|:---------------------------------------------------------------|
56+
| --generate-license | False | False | Generate license information |
57+
| --enable-debug | False | False | Enable debug logging |
58+
| --enable-json | False | False | Output in JSON format |
59+
| --enable-sarif | False | False | Enable SARIF output of results instead of table or JSON format|
60+
| --disable-overview | False | False | Disable overview output |
61+
62+
#### Security Configuration
63+
| Parameter | Required | Default | Description |
64+
|:-----------------------|:---------|:--------|:-------------------------------|
65+
| --allow-unverified | False | False | Allow unverified packages |
66+
| --disable-security-issue| False | False | Disable security issue checks |
67+
68+
#### Advanced Configuration
69+
| Parameter | Required | Default | Description |
70+
|:-------------------|:---------|:--------|:-----------------------------------------------|
71+
| --ignore-commit-files| False | False | Ignore commit files |
72+
| --disable-blocking | False | False | Disable blocking mode |
73+
| --scm | False | api | Source control management type |
74+
| --timeout | False | | Timeout in seconds for API requests |
4475

4576
## Development
4677

‎socketsecurity/config.py

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ class CliConfig:
2323
enable_debug: bool = False
2424
allow_unverified: bool = False
2525
enable_json: bool = False
26+
enable_sarif: bool = False
2627
disable_overview: bool = False
2728
disable_security_issue: bool = False
2829
files: str = "[]"
@@ -61,6 +62,7 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
6162
'enable_debug': args.enable_debug,
6263
'allow_unverified': args.allow_unverified,
6364
'enable_json': args.enable_json,
65+
'enable_sarif': args.enable_sarif,
6466
'disable_overview': args.disable_overview,
6567
'disable_security_issue': args.disable_security_issue,
6668
'files': args.files,
@@ -260,9 +262,10 @@ def create_argument_parser() -> argparse.ArgumentParser:
260262
help="Output in JSON format"
261263
)
262264
output_group.add_argument(
263-
"--enable_json",
264-
dest="enable_json",
265-
help=argparse.SUPPRESS
265+
"--enable-sarif",
266+
dest="enable_sarif",
267+
action="store_true",
268+
help="Enable SARIF output of results instead of table or JSON format"
266269
)
267270
output_group.add_argument(
268271
"--disable-overview",

‎socketsecurity/output.py

Lines changed: 25 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -5,29 +5,32 @@
55
from typing import Any, Dict, Optional
66
from .core.messages import Messages
77
from .core.classes import Diff, Issue
8+
from .config import CliConfig
89

910

1011
class OutputHandler:
11-
blocking_disabled: bool
12+
config: CliConfig
1213
logger: logging.Logger
1314

14-
def __init__(self, blocking_disabled: bool):
15-
self.blocking_disabled = blocking_disabled
15+
def __init__(self, config: CliConfig):
16+
self.config = config
1617
self.logger = logging.getLogger("socketcli")
1718

18-
def handle_output(self, diff_report: Diff, sbom_file_name: Optional[str] = None, json_output: bool = False) -> int:
19-
"""Main output handler that determines output format and returns exit code"""
20-
if json_output:
21-
self.output_console_json(diff_report, sbom_file_name)
19+
def handle_output(self, diff_report: Diff) -> None:
20+
"""Main output handler that determines output format"""
21+
if self.config.enable_json:
22+
self.output_console_json(diff_report, self.config.sbom_file)
23+
elif self.config.enable_sarif:
24+
self.output_console_sarif(diff_report, self.config.sbom_file)
2225
else:
23-
self.output_console_comments(diff_report, sbom_file_name)
26+
self.output_console_comments(diff_report, self.config.sbom_file)
2427

25-
self.save_sbom_file(diff_report, sbom_file_name)
28+
self.save_sbom_file(diff_report, self.config.sbom_file)
2629

2730
def return_exit_code(self, diff_report: Diff) -> int:
28-
if not self.report_pass(diff_report) and not self.blocking_disabled:
31+
if not self.report_pass(diff_report) and not self.config.disable_blocking:
2932
return 1
30-
elif len(diff_report.new_alerts) > 0 and not self.blocking_disabled:
33+
elif len(diff_report.new_alerts) > 0 and not self.config.disable_blocking:
3134
# 5 means warning alerts but no blocking alerts
3235
return 5
3336
else:
@@ -48,13 +51,23 @@ def output_console_json(self, diff_report: Diff, sbom_file_name: Optional[str] =
4851
console_security_comment = Messages.create_security_comment_json(diff_report)
4952
self.logger.info(json.dumps(console_security_comment))
5053

54+
def output_console_sarif(self, diff_report: Diff, sbom_file_name: Optional[str] = None) -> None:
55+
"""
56+
Generate SARIF output from the diff report and print to console.
57+
"""
58+
if diff_report.id != "NO_DIFF_RAN":
59+
# Generate the SARIF structure using Messages
60+
console_security_comment = Messages.create_security_comment_sarif(diff_report)
61+
62+
# Print the SARIF output to the console in JSON format
63+
self.logger.info(json.dumps(console_security_comment, indent=2))
5164

5265
def report_pass(self, diff_report: Diff) -> bool:
5366
"""Determines if the report passes security checks"""
5467
if not diff_report.new_alerts:
5568
return True
5669

57-
if self.blocking_disabled:
70+
if self.config.disable_blocking:
5871
return True
5972

6073
return not any(issue.error for issue in diff_report.new_alerts)

‎socketsecurity/socketcli.py

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ def cli():
4646
def main_code():
4747
config = CliConfig.from_args()
4848
print(f"config: {config.to_dict()}")
49-
output_handler = OutputHandler(blocking_disabled=config.disable_blocking)
49+
output_handler = OutputHandler(config)
5050

5151
sdk = socketdev(token=config.api_token)
5252
print("sdk loaded")
@@ -240,14 +240,11 @@ def main_code():
240240
log.info("Starting non-PR/MR flow")
241241
diff = core.create_new_diff(config.target_path, params, no_change=should_skip_scan)
242242

243-
output_handler.handle_output(diff, config.sbom_file, config.enable_json)
243+
output_handler.handle_output(diff)
244244
else:
245245
log.info("API Mode")
246246
diff = core.create_new_diff(config.target_path, params, no_change=should_skip_scan)
247-
if config.enable_json:
248-
output_handler.output_console_json(diff, config.sbom_file)
249-
else:
250-
output_handler.output_console_comments(diff, config.sbom_file)
247+
output_handler.handle_output(diff)
251248

252249
# Handle license generation
253250
if diff is not None and config.generate_license:

0 commit comments

Comments
 (0)