Skip to content

Commit 12cce9f

Browse files
eranturgemaneranturgeman
authored
Integrating new Config Profile changes + Add support in scanners exclusions through profile (jfrog#314)
1 parent dd7069a commit 12cce9f

File tree

19 files changed

+381
-95
lines changed

19 files changed

+381
-95
lines changed

‎commands/audit/audit.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -309,6 +309,8 @@ func RunJasScans(auditParallelRunner *utils.SecurityParallelRunner, auditParams
309309
),
310310
auditParams.Exclusions()...,
311311
)
312+
jas.UpdateJasScannerWithExcludePatternsFromProfile(jasScanner, auditParams.AuditBasicParams.GetConfigProfile())
313+
312314
auditParallelRunner.ResultsMu.Unlock()
313315
if err != nil {
314316
generalError = fmt.Errorf("failed to create jas scanner: %s", err.Error())
@@ -349,7 +351,7 @@ func createJasScansTasks(auditParallelRunner *utils.SecurityParallelRunner, scan
349351
ServerDetails: serverDetails,
350352
Scanner: scanner,
351353
Module: *module,
352-
ConfigProfile: auditParams.configProfile,
354+
ConfigProfile: auditParams.AuditBasicParams.GetConfigProfile(),
353355
ScansToPerform: auditParams.ScansToPerform(),
354356
SecretsScanType: secrets.SecretsScannerType,
355357
DirectDependencies: auditParams.DirectDependencies(),

‎commands/audit/audit_test.go‎

Lines changed: 208 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -241,8 +241,12 @@ func TestAuditWithConfigProfile(t *testing.T) {
241241
ModuleName: "only-sca-module",
242242
PathFromRoot: ".",
243243
ScanConfig: services.ScanConfig{
244-
EnableScaScan: true,
245-
EnableContextualAnalysisScan: false,
244+
ScaScannerConfig: services.ScaScannerConfig{
245+
EnableScaScan: true,
246+
},
247+
ContextualAnalysisScannerConfig: services.CaScannerConfig{
248+
EnableCaScan: false,
249+
},
246250
SastScannerConfig: services.SastScannerConfig{
247251
EnableSastScan: false,
248252
},
@@ -258,6 +262,38 @@ func TestAuditWithConfigProfile(t *testing.T) {
258262
},
259263
expectedScaIssues: 15,
260264
},
265+
{
266+
name: "Sca scanner enabled with exclusions",
267+
testDirPath: filepath.Join("..", "..", "tests", "testdata", "projects", "jas", "jas"),
268+
configProfile: services.ConfigProfile{
269+
ProfileName: "Sca-exclude-dirs",
270+
Modules: []services.Module{{
271+
ModuleId: 1,
272+
ModuleName: "Sca-exclude-dirs-module",
273+
PathFromRoot: ".",
274+
ScanConfig: services.ScanConfig{
275+
ScaScannerConfig: services.ScaScannerConfig{
276+
EnableScaScan: true,
277+
ExcludePatterns: []string{"*.*"},
278+
},
279+
ContextualAnalysisScannerConfig: services.CaScannerConfig{
280+
EnableCaScan: false,
281+
},
282+
SastScannerConfig: services.SastScannerConfig{
283+
EnableSastScan: false,
284+
},
285+
SecretsScannerConfig: services.SecretsScannerConfig{
286+
EnableSecretsScan: false,
287+
},
288+
IacScannerConfig: services.IacScannerConfig{
289+
EnableIacScan: false,
290+
},
291+
},
292+
}},
293+
IsDefault: false,
294+
},
295+
expectedScaIssues: 0,
296+
},
261297
{
262298
name: "Enable Sca and Applicability scanners",
263299
testDirPath: filepath.Join("..", "..", "tests", "testdata", "projects", "jas", "jas"),
@@ -268,8 +304,12 @@ func TestAuditWithConfigProfile(t *testing.T) {
268304
ModuleName: "sca-and-applicability",
269305
PathFromRoot: ".",
270306
ScanConfig: services.ScanConfig{
271-
EnableScaScan: true,
272-
EnableContextualAnalysisScan: true,
307+
ScaScannerConfig: services.ScaScannerConfig{
308+
EnableScaScan: true,
309+
},
310+
ContextualAnalysisScannerConfig: services.CaScannerConfig{
311+
EnableCaScan: true,
312+
},
273313
SastScannerConfig: services.SastScannerConfig{
274314
EnableSastScan: false,
275315
},
@@ -288,6 +328,7 @@ func TestAuditWithConfigProfile(t *testing.T) {
288328
expectedCaNotCovered: 4,
289329
expectedCaNotApplicable: 2,
290330
},
331+
// TODO Add testcase for Sca and Applicability with exclusions after resolving the Glob patterns issues
291332
{
292333
name: "Enable only secrets scanner",
293334
testDirPath: filepath.Join("..", "..", "tests", "testdata", "projects", "jas", "jas"),
@@ -298,8 +339,12 @@ func TestAuditWithConfigProfile(t *testing.T) {
298339
ModuleName: "only-secrets-module",
299340
PathFromRoot: ".",
300341
ScanConfig: services.ScanConfig{
301-
EnableScaScan: false,
302-
EnableContextualAnalysisScan: false,
342+
ScaScannerConfig: services.ScaScannerConfig{
343+
EnableScaScan: false,
344+
},
345+
ContextualAnalysisScannerConfig: services.CaScannerConfig{
346+
EnableCaScan: false,
347+
},
303348
SastScannerConfig: services.SastScannerConfig{
304349
EnableSastScan: false,
305350
},
@@ -316,7 +361,39 @@ func TestAuditWithConfigProfile(t *testing.T) {
316361
expectedSecretsIssues: 16,
317362
},
318363
{
319-
name: "Enable only sast scanner",
364+
name: "Secrets scanner is enabled with exclusions",
365+
testDirPath: filepath.Join("..", "..", "tests", "testdata", "projects", "jas", "jas"),
366+
configProfile: services.ConfigProfile{
367+
ProfileName: "secrets-with-exclusions",
368+
Modules: []services.Module{{
369+
ModuleId: 1,
370+
ModuleName: "secrets-with-exclusions-module",
371+
PathFromRoot: ".",
372+
ScanConfig: services.ScanConfig{
373+
ScaScannerConfig: services.ScaScannerConfig{
374+
EnableScaScan: false,
375+
},
376+
ContextualAnalysisScannerConfig: services.CaScannerConfig{
377+
EnableCaScan: false,
378+
},
379+
SastScannerConfig: services.SastScannerConfig{
380+
EnableSastScan: false,
381+
},
382+
SecretsScannerConfig: services.SecretsScannerConfig{
383+
EnableSecretsScan: true,
384+
ExcludePatterns: []string{"*api_secrets*"},
385+
},
386+
IacScannerConfig: services.IacScannerConfig{
387+
EnableIacScan: false,
388+
},
389+
},
390+
}},
391+
IsDefault: false,
392+
},
393+
expectedSecretsIssues: 7,
394+
},
395+
{
396+
name: "Enable only Sast scanner",
320397
testDirPath: filepath.Join("..", "..", "tests", "testdata", "projects", "jas", "jas"),
321398
configProfile: services.ConfigProfile{
322399
ProfileName: "only-sast",
@@ -325,8 +402,12 @@ func TestAuditWithConfigProfile(t *testing.T) {
325402
ModuleName: "only-sast-module",
326403
PathFromRoot: ".",
327404
ScanConfig: services.ScanConfig{
328-
EnableScaScan: false,
329-
EnableContextualAnalysisScan: false,
405+
ScaScannerConfig: services.ScaScannerConfig{
406+
EnableScaScan: false,
407+
},
408+
ContextualAnalysisScannerConfig: services.CaScannerConfig{
409+
EnableCaScan: false,
410+
},
330411
SastScannerConfig: services.SastScannerConfig{
331412
EnableSastScan: true,
332413
},
@@ -342,6 +423,38 @@ func TestAuditWithConfigProfile(t *testing.T) {
342423
},
343424
expectedSastIssues: 3,
344425
},
426+
{
427+
name: "Sast scanner is enabled with exclusions",
428+
testDirPath: filepath.Join("..", "..", "tests", "testdata", "projects", "jas", "jas"),
429+
configProfile: services.ConfigProfile{
430+
ProfileName: "sast-with-exclusions",
431+
Modules: []services.Module{{
432+
ModuleId: 1,
433+
ModuleName: "sast-with-exclusions-module",
434+
PathFromRoot: ".",
435+
ScanConfig: services.ScanConfig{
436+
ScaScannerConfig: services.ScaScannerConfig{
437+
EnableScaScan: false,
438+
},
439+
ContextualAnalysisScannerConfig: services.CaScannerConfig{
440+
EnableCaScan: false,
441+
},
442+
SastScannerConfig: services.SastScannerConfig{
443+
EnableSastScan: true,
444+
ExcludePatterns: []string{"*flask_webgoat*"},
445+
},
446+
SecretsScannerConfig: services.SecretsScannerConfig{
447+
EnableSecretsScan: false,
448+
},
449+
IacScannerConfig: services.IacScannerConfig{
450+
EnableIacScan: false,
451+
},
452+
},
453+
}},
454+
IsDefault: false,
455+
},
456+
expectedSastIssues: 0,
457+
},
345458
{
346459
name: "Enable only IaC scanner",
347460
testDirPath: filepath.Join("..", "..", "tests", "testdata", "projects", "jas", "jas"),
@@ -352,8 +465,12 @@ func TestAuditWithConfigProfile(t *testing.T) {
352465
ModuleName: "only-iac-module",
353466
PathFromRoot: ".",
354467
ScanConfig: services.ScanConfig{
355-
EnableScaScan: false,
356-
EnableContextualAnalysisScan: false,
468+
ScaScannerConfig: services.ScaScannerConfig{
469+
EnableScaScan: false,
470+
},
471+
ContextualAnalysisScannerConfig: services.CaScannerConfig{
472+
EnableCaScan: false,
473+
},
357474
SastScannerConfig: services.SastScannerConfig{
358475
EnableSastScan: false,
359476
},
@@ -369,6 +486,38 @@ func TestAuditWithConfigProfile(t *testing.T) {
369486
},
370487
expectedIacIssues: 9,
371488
},
489+
{
490+
name: "Iac is enabled with exclusions",
491+
testDirPath: filepath.Join("..", "..", "tests", "testdata", "projects", "jas", "jas"),
492+
configProfile: services.ConfigProfile{
493+
ProfileName: "iac-with-exclusions",
494+
Modules: []services.Module{{
495+
ModuleId: 1,
496+
ModuleName: "iac-with-exclusions-module",
497+
PathFromRoot: ".",
498+
ScanConfig: services.ScanConfig{
499+
ScaScannerConfig: services.ScaScannerConfig{
500+
EnableScaScan: false,
501+
},
502+
ContextualAnalysisScannerConfig: services.CaScannerConfig{
503+
EnableCaScan: false,
504+
},
505+
SastScannerConfig: services.SastScannerConfig{
506+
EnableSastScan: false,
507+
},
508+
SecretsScannerConfig: services.SecretsScannerConfig{
509+
EnableSecretsScan: false,
510+
},
511+
IacScannerConfig: services.IacScannerConfig{
512+
EnableIacScan: true,
513+
ExcludePatterns: []string{"*iac/gcp*"},
514+
},
515+
},
516+
}},
517+
IsDefault: false,
518+
},
519+
expectedIacIssues: 0,
520+
},
372521
{
373522
name: "Enable All Scanners",
374523
testDirPath: filepath.Join("..", "..", "tests", "testdata", "projects", "jas", "jas"),
@@ -379,8 +528,12 @@ func TestAuditWithConfigProfile(t *testing.T) {
379528
ModuleName: "all-jas-module",
380529
PathFromRoot: ".",
381530
ScanConfig: services.ScanConfig{
382-
EnableScaScan: true,
383-
EnableContextualAnalysisScan: true,
531+
ScaScannerConfig: services.ScaScannerConfig{
532+
EnableScaScan: true,
533+
},
534+
ContextualAnalysisScannerConfig: services.CaScannerConfig{
535+
EnableCaScan: true,
536+
},
384537
SastScannerConfig: services.SastScannerConfig{
385538
EnableSastScan: true,
386539
},
@@ -402,6 +555,45 @@ func TestAuditWithConfigProfile(t *testing.T) {
402555
expectedCaNotCovered: 4,
403556
expectedCaNotApplicable: 2,
404557
},
558+
{
559+
name: "All scanners enabled but some with exclude patterns",
560+
testDirPath: filepath.Join("..", "..", "tests", "testdata", "projects", "jas", "jas"),
561+
configProfile: services.ConfigProfile{
562+
ProfileName: "some-scanners-with-exclusions",
563+
Modules: []services.Module{{
564+
ModuleId: 1,
565+
ModuleName: "some-scanners-with-exclusions-module",
566+
PathFromRoot: ".",
567+
ScanConfig: services.ScanConfig{
568+
ScaScannerConfig: services.ScaScannerConfig{
569+
EnableScaScan: true,
570+
},
571+
ContextualAnalysisScannerConfig: services.CaScannerConfig{
572+
EnableCaScan: true,
573+
},
574+
SastScannerConfig: services.SastScannerConfig{
575+
EnableSastScan: true,
576+
ExcludePatterns: []string{"*flask_webgoat*"},
577+
},
578+
SecretsScannerConfig: services.SecretsScannerConfig{
579+
EnableSecretsScan: true,
580+
ExcludePatterns: []string{"*api_secrets*"},
581+
},
582+
IacScannerConfig: services.IacScannerConfig{
583+
EnableIacScan: true,
584+
},
585+
},
586+
}},
587+
IsDefault: false,
588+
},
589+
expectedSastIssues: 0,
590+
expectedSecretsIssues: 7,
591+
expectedIacIssues: 9,
592+
expectedCaApplicable: 3,
593+
expectedCaUndetermined: 6,
594+
expectedCaNotCovered: 4,
595+
expectedCaNotApplicable: 2,
596+
},
405597
}
406598

407599
for _, testcase := range testcases {
@@ -413,19 +605,19 @@ func TestAuditWithConfigProfile(t *testing.T) {
413605
defer createTempDirCallback()
414606
assert.NoError(t, biutils.CopyDir(testcase.testDirPath, tempDirPath, true, nil))
415607

608+
configProfile := testcase.configProfile
416609
auditBasicParams := (&utils.AuditBasicParams{}).
417610
SetServerDetails(serverDetails).
418611
SetXrayVersion(utils.EntitlementsMinVersion).
419612
SetXscVersion(services.ConfigProfileMinXscVersion).
420613
SetOutputFormat(format.Table).
421-
SetUseJas(true)
614+
SetUseJas(true).
615+
SetConfigProfile(&configProfile)
422616

423-
configProfile := testcase.configProfile
424617
auditParams := NewAuditParams().
425618
SetWorkingDirs([]string{tempDirPath}).
426619
SetMultiScanId(validations.TestMsi).
427620
SetGraphBasicParams(auditBasicParams).
428-
SetConfigProfile(&configProfile).
429621
SetResultsContext(results.ResultContext{IncludeVulnerabilities: true})
430622

431623
auditParams.SetWorkingDirs([]string{tempDirPath}).SetIsRecursiveScan(true)

‎commands/audit/auditparams.go‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ import (
77
"github.com/jfrog/jfrog-cli-security/utils/results"
88
"github.com/jfrog/jfrog-cli-security/utils/severityutils"
99
"github.com/jfrog/jfrog-client-go/xray/services"
10-
xscservices "github.com/jfrog/jfrog-client-go/xsc/services"
1110
)
1211

1312
type AuditParams struct {
@@ -22,7 +21,6 @@ type AuditParams struct {
2221
// Include third party dependencies source code in the applicability scan.
2322
thirdPartyApplicabilityScan bool
2423
threads int
25-
configProfile *xscservices.ConfigProfile
2624
scanResultsOutputDir string
2725
startTime time.Time
2826
}
@@ -112,11 +110,6 @@ func (params *AuditParams) SetResultsContext(resultsContext results.ResultContex
112110
return params
113111
}
114112

115-
func (params *AuditParams) SetConfigProfile(configProfile *xscservices.ConfigProfile) *AuditParams {
116-
params.configProfile = configProfile
117-
return params
118-
}
119-
120113
func (params *AuditParams) SetScansResultsOutputDir(outputDir string) *AuditParams {
121114
params.scanResultsOutputDir = outputDir
122115
return params

‎commands/audit/sca/common.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,10 @@ var CurationErrorMsgToUserTemplate = "Failed to retrieve the dependencies tree f
3131

3232
func GetExcludePattern(params utils.AuditParams) string {
3333
exclusions := params.Exclusions()
34+
if configProfile := params.GetConfigProfile(); configProfile != nil {
35+
exclusions = append(exclusions, configProfile.Modules[0].ScanConfig.ScaScannerConfig.ExcludePatterns...)
36+
}
37+
3438
if len(exclusions) == 0 {
3539
exclusions = append(exclusions, utils.DefaultScaExcludePatterns...)
3640
}

0 commit comments

Comments
 (0)