Skip to content

Commit bd50c8e

Browse files
cyberchen1995cyberchen1995
committed
Merge branch 'cc-dev' of https://github.com/SuperChen-CC/OpenSCA-cli into cc-dev
2 parents fd9fa5a + ff03ff4 commit bd50c8e

37 files changed

+1370
-37
lines changed

‎.github/workflows/run_opensca_scan.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: OpenSCA Scan
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
pull_request:
8+
branches:
9+
- master
10+
workflow_dispatch:
11+
12+
13+
jobs:
14+
opensca_scan:
15+
name: OpenSCA Scan
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: Checkout
19+
uses: actions/checkout@v4
20+
with:
21+
sparse-checkout: |
22+
cmd/
23+
opensca/
24+
go.mod
25+
main.go
26+
- name: Run OpenSCA Scan
27+
uses: XmirrorSecurity/opensca-scan-action@v1
28+
with:
29+
token: ${{ secrets.OPENSCA_TOKEN }}
30+
proj: ${{ secrets.OPENSCA_PROJECT_ID }}
31+
need-artifact: true
32+
out: "outputs/results.json,outputs/result.html"

‎README.md‎

Lines changed: 24 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@
6161

6262
## 下载安装
6363

64-
1. 从 [github](https://github.com/XmirrorSecurity/OpenSCA-cli/releases) 或 [gitee](https://gitee.com/XmirrorSecurity/OpenSCA-cli/releases) 下载对应系统架构的可执行文件压缩包
64+
1. 从 [github](https://github.com/XmirrorSecurity/OpenSCA-cli/releases) 或 [gitee](https://gitee.com/XmirrorSecurity/OpenSCA-cli/releases) 或 [gitcode](https://gitcode.com/XmirrorSecurity/OpenSCA-cli/releases) 下载对应系统架构的可执行文件压缩包
6565

6666
2. 或者下载源码编译(需要 `go 1.18` 及以上版本)
6767

@@ -70,10 +70,14 @@
7070
git clone https://github.com/XmirrorSecurity/OpenSCA-cli.git opensca && cd opensca && go build
7171
// gitee linux/mac
7272
git clone https://gitee.com/XmirrorSecurity/OpenSCA-cli.git opensca && cd opensca && go build
73+
// gitcode linux/mac
74+
git clone https://gitcode.com/XmirrorSecurity/OpenSCA-cli.git opensca && cd opensca && go build
7375
// github windows
7476
git clone https://github.com/XmirrorSecurity/OpenSCA-cli.git opensca ; cd opensca ; go build
7577
// gitee windows
7678
git clone https://gitee.com/XmirrorSecurity/OpenSCA-cli.git opensca ; cd opensca ; go build
79+
// gitcode windows
80+
git clone https://gitcode.com/XmirrorSecurity/OpenSCA-cli.git opensca ; cd opensca ; go build
7781
```
7882

7983
默认生成当前系统架构的程序，如需生成其他系统架构可配置环境变量后编译
@@ -191,25 +195,25 @@ docker run -ti --rm -v ${PWD}:/src opensca/opensca-cli -token ${put_your_token_h
191195

192196
### 漏洞库字段说明
193197

194-
| 字段 | 描述 | 是否必填 |
195-
| :------------------ | :-------------------------------- | :------- |
196-
| `vendor` | 组件厂商 | 否 |
197-
| `product` | 组件名 | 是 |
198-
| `version` | 漏洞影响版本 | 是 |
199-
| `language` | 组件语言 | 是 |
200-
| `name` | 漏洞名 | 否 |
201-
| `id` | 自定义编号 | 是 |
202-
| `cve_id` | cve 编号 | 否 |
203-
| `cnnvd_id` | cnnvd 编号 | 否 |
204-
| `cnvd_id` | cnvd 编号 | 否 |
205-
| `cwe_id` | cwe 编号 | 否 |
206-
| `description` | 漏洞描述 | 否 |
207-
| `description_en` | 漏洞英文描述 | 否 |
208-
| `suggestion` | 漏洞修复建议 | 否 |
209-
| `attack_type` | 攻击方式 | 否 |
210-
| `release_date` | 漏洞发布日期 | 否 |
211-
| `security_level_id` | 漏洞风险评级(1~4 风险程度递减) | 否 |
212-
| `exploit_level_id` | 漏洞利用评级(0:不可利用,1:可利用) | 否 |
198+
| 字段 | 描述 | 是否必填 |
199+
| :------------------ | :--------------------------------------- | :------- |
200+
| `vendor` | 组件厂商 | 否 |
201+
| `product` | 组件名 | 是 |
202+
| `version` | 漏洞影响版本(必须为范围，不能填单个版本) | 是 |
203+
| `language` | 组件语言 | 是 |
204+
| `name` | 漏洞名 | 否 |
205+
| `id` | 自定义编号 | 是 |
206+
| `cve_id` | cve 编号 | 否 |
207+
| `cnnvd_id` | cnnvd 编号 | 否 |
208+
| `cnvd_id` | cnvd 编号 | 否 |
209+
| `cwe_id` | cwe 编号 | 否 |
210+
| `description` | 漏洞描述 | 否 |
211+
| `description_en` | 漏洞英文描述 | 否 |
212+
| `suggestion` | 漏洞修复建议 | 否 |
213+
| `attack_type` | 攻击方式 | 否 |
214+
| `release_date` | 漏洞发布日期 | 否 |
215+
| `security_level_id` | 漏洞风险评级(1~4 风险程度递减) | 否 |
216+
| `exploit_level_id` | 漏洞利用评级(0:不可利用,1:可利用) | 否 |
213217

214218
本地漏洞库中`language`字段设定值包含`java、javascript、golang、rust、php、ruby、python`
215219

‎cmd/format/dpsbom.go‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
package format
2+
3+
import (
4+
"archive/zip"
5+
"crypto/md5"
6+
"crypto/sha1"
7+
"crypto/sha256"
8+
"encoding/hex"
9+
"encoding/json"
10+
"errors"
11+
"fmt"
12+
"hash"
13+
"io"
14+
"path/filepath"
15+
"strings"
16+
17+
"github.com/xmirrorsecurity/opensca-cli/v3/cmd/detail"
18+
"github.com/xmirrorsecurity/opensca-cli/v3/opensca/model"
19+
)
20+
21+
func DpSbomZip(report Report, out string) {
22+
zipFile := out
23+
if !strings.HasSuffix(out, ".zip") {
24+
zipFile = out + ".zip"
25+
}
26+
jsonName := filepath.Base(out)
27+
if !strings.HasSuffix(jsonName, ".json") {
28+
jsonName = jsonName + ".json"
29+
}
30+
outWrite(zipFile, func(w io.Writer) error {
31+
doc := pdSbomDoc(report)
32+
if doc.Hashes.HashFile == "" {
33+
return errors.New("hash file is required")
34+
}
35+
36+
var h hash.Hash
37+
switch strings.ToLower(doc.Hashes.Algorithm) {
38+
case "sha-256":
39+
h = sha256.New()
40+
case "sha-1":
41+
h = sha1.New()
42+
case "md5":
43+
h = md5.New()
44+
case "":
45+
return errors.New("hash algorithm is required")
46+
default:
47+
return fmt.Errorf("unsupported hash algorithm: %s", doc.Hashes.Algorithm)
48+
}
49+
50+
tojson := func(w io.Writer) error {
51+
encoder := json.NewEncoder(w)
52+
encoder.SetIndent("", " ")
53+
return encoder.Encode(doc)
54+
}
55+
56+
zipfile := zip.NewWriter(w)
57+
defer zipfile.Close()
58+
59+
sbomfile, err := zipfile.Create(jsonName)
60+
if err != nil {
61+
return err
62+
}
63+
err = tojson(sbomfile)
64+
if err != nil {
65+
return err
66+
}
67+
68+
hashfile, err := zipfile.Create(doc.Hashes.HashFile)
69+
if err != nil {
70+
return err
71+
}
72+
err = tojson(h)
73+
if err != nil {
74+
return err
75+
}
76+
hashstr := hex.EncodeToString(h.Sum(nil)[:])
77+
hashfile.Write([]byte(hashstr))
78+
79+
return nil
80+
})
81+
}
82+
83+
func pdSbomDoc(report Report) *model.DpSbomDocument {
84+
85+
doc := model.NewDpSbomDocument(report.TaskInfo.AppName, "opensca-cli")
86+
87+
report.DepDetailGraph.ForEach(func(n *detail.DepDetailGraph) bool {
88+
89+
if n.Name == "" {
90+
return true
91+
}
92+
93+
lics := []string{}
94+
for _, lic := range n.Licenses {
95+
lics = append(lics, lic.ShortName)
96+
}
97+
doc.AppendComponents(func(dsp *model.DpSbomPackage) {
98+
dsp.Identifier.Purl = n.Purl()
99+
dsp.Name = n.Name
100+
dsp.Version = n.Version
101+
dsp.License = lics
102+
})
103+
104+
children := []string{}
105+
for _, c := range n.Children {
106+
if c.Name == "" {
107+
continue
108+
}
109+
children = append(children, c.Purl())
110+
}
111+
doc.AppendDependencies(n.Purl(), children)
112+
113+
return true
114+
})
115+
116+
return doc
117+
}

‎cmd/format/save.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,12 @@ func Save(report Report, output string) {
3939
switch filepath.Ext(out) {
4040
case ".html":
4141
Html(genReport(report), out)
42+
case ".zip":
43+
if strings.HasSuffix(out, ".dpsbom.zip") {
44+
DpSbomZip(report, out)
45+
} else {
46+
Json(genReport(report), out)
47+
}
4248
case ".json":
4349
if strings.HasSuffix(out, ".spdx.json") {
4450
SpdxJson(report, out)
@@ -48,9 +54,13 @@ func Save(report Report, output string) {
4854
CycloneDXJson(report, out)
4955
} else if strings.HasSuffix(out, ".swid.json") {
5056
SwidJson(report, out)
57+
} else if strings.HasSuffix(out, ".dpsbom.json") {
58+
DpSbomZip(report, out)
5159
} else {
5260
Json(genReport(report), out)
5361
}
62+
case ".dpsbom":
63+
DpSbomZip(report, out)
5464
case ".dsdx":
5565
Dsdx(report, out)
5666
case ".spdx":

‎docs/Integrations/IDE_Plugins-zh_CN.md‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
[返回目录](/docs/README-zh-CN.md) / [English](./IDE_Plugins.md)
2+
3+
- [Visual Studio Code](#visual-studio-code)
4+
- [安装插件](#安装插件)
5+
- [使用插件](#使用插件)
6+
- [插件功能](#插件功能)
7+
- [插件执行流程](#插件执行流程)
8+
- [运行扫描](#运行扫描)
9+
- [Jetbrains IDEs](#jetbrains-ides)
10+
- [安装插件](#安装插件-1)
11+
- [使用插件](#使用插件-1)
12+
- [插件功能](#插件功能-1)
13+
- [插件执行流程](#插件执行流程-1)
14+
- [运行扫描](#运行扫描-1)
15+
16+
17+
# Visual Studio Code
18+
19+
## 安装插件
20+
21+
- **安装方法 一**：在 [VS Marketplace](https://marketplace.visualstudio.com/items?itemName=xmirror.opensca) 中安装（推荐）
22+
23+
在VS Code中左边栏打开扩展->扩展的搜索框中输入“OpenSCA Xcheck”，点击“Install”
24+
25+
<img src="https://opensca.xmirror.cn/docs/img/vscode_01.jpg" alt="xcheck_market" />
26+
27+
- **安装方法二**：在[OpenSCA 官网](https://opensca.xmirror.cn/pages/plug-in)下载插件安装
28+
29+
- 从OpenSCA平台下载 “OpenSCA-Xcheck.vsix”；
30+
- 打开VS Code，依次操作：左边栏打开扩展->扩展顶栏的更多操作->“从VSIX安装”->找到并安装“OpenSCA-Xcheck.vsix”；
31+
32+
- **安装方法三**：[下载源码](https://github.com/XmirrorSecurity/)自行编译安装
33+
34+
- 环境要求：
35+
36+
- node v18及以上版本
37+
- 系统支持MacOS、Windows、Linux
38+
39+
- 从[gitee](https://gitee.com/XmirrorSecurity/OpenSCA-VSCode-plugin)或[github](https://github.com/XmirrorSecurity/OpenSCA-VSCode-plugin/)下载源码
40+
41+
* 全局安装vsce
42+
43+
```
44+
npm install --global @vscode/vsce
45+
```
46+
47+
* 执行打包命令
48+
49+
```
50+
vsce package
51+
```
52+
53+
## 使用插件
54+
55+
### 插件功能
56+
57+
- 开始检测：点击操作栏的“Run”，开始检测当前项目内的组件漏洞风险情况；
58+
- 停止检测：点击操作栏的“Stop”，停止检测当前项目内的组件漏洞风险情况；
59+
- 清除检测结果：点击操作栏的“Clean”，清除当前项目的检测结果；
60+
- 连接配置：点击操作栏的“Test”按钮，配置平台Url及Token信息，点击“测试连接”按钮可测试连接配置是否正确，连接成功后就可以开始检测啦；
61+
- 设置：点击操作栏的“Setting”，查看OpenSCA Xcheck相关设置信息。
62+
- 使用说明：点击操作栏的“Instructions”，查看OpenSCA Xcheck相关使用说明。
63+
- 查看更多：点击操作栏的“See more”，跳转到[opensca.xmirror.cn](https://opensca.xmirror.cn)查看OpenSCA Xcheck 更多相关信息。
64+
65+
<img src="https://opensca.xmirror.cn/docs/img/vscode_02.jpg" alt="xcheck_function" />
66+
67+
### 插件执行流程
68+
69+
<img src="https://opensca.xmirror.cn/docs/assets/img/xcheck_process.7083b869.jpg" alt="xcheck流程图" />
70+
71+
### 运行扫描
72+
73+
点击OpenSCA Xcheck可打开OpenSCA窗口。首先在配置界面中配置服务器参数（参考：插件功能-设置），然后在OpenSCA窗口中点击“Run”（参考：插件功能-开始检测）
74+
75+
# Jetbrains IDEs
76+
77+
## 安装插件
78+
79+
- **安装方法一**：从 [Jetbrains 插件市场](https://plugins.jetbrains.com/plugin/18246-opensca-xcheck) 中安装（推荐）
80+
81+
以IntelliJ IDEA为例：在IDE中依次点击“File|Settings|Plugins|Marketplace”，在搜索框中输入“OpenSCA Xcheck”，点击“Install”
82+
83+
![xcheck_market](/resources/xcheck_marketplace.jpg)
84+
85+
- **安装方法二**：在[OpenSCA平台](https://opensca.xmirror.cn/pages/plug-in )下载插件安装
86+
87+
以IntelliJ IDEA为例：将下载下来的插件安装包拖入适配的IDE中即可
88+
89+
- **安装方法三**：[下载源码](https://github.com/XmirrorSecurity/OpenSCA-intellij-plugin )自行编译安装
90+
91+
使用IntelliJ IDEA打开下载到本地的源码，需要配置运行环境：`jDK11`，待Gradle导入依赖和插件，在Gradle中执行`intellij`插件的`buildPlugin`任务，构建的安装包存放于当前项目下*build/distributions*目录下，将此目录下的安装包拖入当前IDE中即可
92+
93+
## 使用插件
94+
95+
### 插件功能
96+
97+
- 配置：点击File|Settings|Other Settings|OpenSCA Setting或点击OpenSCA窗口中的`Setting`按钮，在配置界面中配置连接服务器Url和Token
98+
- 测试连接：在OpenSCA配置界面中，配置服务器Url和Token之后点击`测试连接`按钮可验证Url和Token是否有效
99+
- 运行：点击OpenSCA窗口中的`Run`按钮，可对当前项目进行代码评估
100+
- 停止：如果正在对当前项目代码评估，那么`Stop`按钮是可用的，点击Stop按钮可结束当前评估任务
101+
- 清除：如果OpenSCA窗口中的Xcheck子窗口已有评估结果，点击`Clean`按钮可清除Xcheck子窗口中所有结果
102+
![xcheck_function](/resources/xcheck_function.jpg)
103+
104+
### 插件执行流程
105+
106+
![xcheck流程图](/resources/xcheck_process.jpg)
107+
108+
### 运行扫描
109+
110+
点击 `View` > `Tool Windows` > `OpenSCA` 可打开OpenSCA窗口。首先在OpenSCA配置界面中配置服务器参数（参考：插件功能-配置），然后在OpenSCA窗口中点击“运行”（参考：插件功能-运行）

0 commit comments

Comments
 (0)