Skip to content

Commit bce7437

Browse files
eranturgemaneranturgeman
authored
Enable all scanners enablement/disablement through config profile (jfrog#235)
1 parent bb72551 commit bce7437

File tree

4 files changed

+164
-27
lines changed

4 files changed

+164
-27
lines changed

‎commands/audit/audit_test.go‎

Lines changed: 148 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -218,76 +218,188 @@ func TestDetectScansToPreform(t *testing.T) {
218218
// Note: Currently, if a config profile is provided, the scan will use the profile's settings, IGNORING jfrog-apps-config if exists.
219219
func TestAuditWithConfigProfile(t *testing.T) {
220220
testcases := []struct {
221-
name string
222-
configProfile services.ConfigProfile
223-
expectedSastIssues int
224-
expectedSecretsIssues int
221+
name string
222+
testDirPath string
223+
configProfile services.ConfigProfile
224+
expectedScaIssues int
225+
expectedCaApplicable int
226+
expectedCaUndetermined int
227+
expectedCaNotCovered int
228+
expectedCaNotApplicable int
229+
expectedSastIssues int
230+
expectedSecretsIssues int
231+
expectedIacIssues int
225232
}{
226233
{
227-
name: "Enable only secrets scanner",
234+
name: "Enable Sca scanner",
235+
testDirPath: filepath.Join("..", "..", "tests", "testdata", "projects", "jas", "jas"),
236+
configProfile: services.ConfigProfile{
237+
ProfileName: "Sca only",
238+
Modules: []services.Module{{
239+
ModuleId: 1,
240+
ModuleName: "only-sca-module",
241+
PathFromRoot: ".",
242+
ScanConfig: services.ScanConfig{
243+
EnableScaScan: true,
244+
EnableContextualAnalysisScan: false,
245+
SastScannerConfig: services.SastScannerConfig{
246+
EnableSastScan: false,
247+
},
248+
SecretsScannerConfig: services.SecretsScannerConfig{
249+
EnableSecretsScan: false,
250+
},
251+
IacScannerConfig: services.IacScannerConfig{
252+
EnableIacScan: false,
253+
},
254+
},
255+
}},
256+
IsDefault: false,
257+
},
258+
expectedScaIssues: 15,
259+
},
260+
{
261+
name: "Enable Sca and Applicability scanners",
262+
testDirPath: filepath.Join("..", "..", "tests", "testdata", "projects", "jas", "jas"),
263+
configProfile: services.ConfigProfile{
264+
ProfileName: "Sca&Applicability",
265+
Modules: []services.Module{{
266+
ModuleId: 1,
267+
ModuleName: "sca-and-applicability",
268+
PathFromRoot: ".",
269+
ScanConfig: services.ScanConfig{
270+
EnableScaScan: true,
271+
EnableContextualAnalysisScan: true,
272+
SastScannerConfig: services.SastScannerConfig{
273+
EnableSastScan: false,
274+
},
275+
SecretsScannerConfig: services.SecretsScannerConfig{
276+
EnableSecretsScan: false,
277+
},
278+
IacScannerConfig: services.IacScannerConfig{
279+
EnableIacScan: false,
280+
},
281+
},
282+
}},
283+
IsDefault: false,
284+
},
285+
expectedCaApplicable: 3,
286+
expectedCaUndetermined: 6,
287+
expectedCaNotCovered: 4,
288+
expectedCaNotApplicable: 2,
289+
},
290+
{
291+
name: "Enable only secrets scanner",
292+
testDirPath: filepath.Join("..", "..", "tests", "testdata", "projects", "jas", "jas"),
228293
configProfile: services.ConfigProfile{
229294
ProfileName: "only-secrets",
230295
Modules: []services.Module{{
231296
ModuleId: 1,
232297
ModuleName: "only-secrets-module",
233298
PathFromRoot: ".",
234299
ScanConfig: services.ScanConfig{
300+
EnableScaScan: false,
301+
EnableContextualAnalysisScan: false,
235302
SastScannerConfig: services.SastScannerConfig{
236303
EnableSastScan: false,
237304
},
238305
SecretsScannerConfig: services.SecretsScannerConfig{
239306
EnableSecretsScan: true,
240307
},
308+
IacScannerConfig: services.IacScannerConfig{
309+
EnableIacScan: false,
310+
},
241311
},
242312
}},
243313
IsDefault: false,
244314
},
245-
expectedSastIssues: 0,
246315
expectedSecretsIssues: 16,
247316
},
248317
{
249-
name: "Enable only sast scanner",
318+
name: "Enable only sast scanner",
319+
testDirPath: filepath.Join("..", "..", "tests", "testdata", "projects", "jas", "jas"),
250320
configProfile: services.ConfigProfile{
251321
ProfileName: "only-sast",
252322
Modules: []services.Module{{
253323
ModuleId: 1,
254324
ModuleName: "only-sast-module",
255325
PathFromRoot: ".",
256326
ScanConfig: services.ScanConfig{
327+
EnableScaScan: false,
328+
EnableContextualAnalysisScan: false,
257329
SastScannerConfig: services.SastScannerConfig{
258330
EnableSastScan: true,
259331
},
260332
SecretsScannerConfig: services.SecretsScannerConfig{
261333
EnableSecretsScan: false,
262334
},
335+
IacScannerConfig: services.IacScannerConfig{
336+
EnableIacScan: false,
337+
},
263338
},
264339
}},
265340
IsDefault: false,
266341
},
267-
expectedSastIssues: 1,
268-
expectedSecretsIssues: 0,
342+
expectedSastIssues: 1,
269343
},
270344
{
271-
name: "Enable secrets and sast",
345+
name: "Enable only IaC scanner",
346+
testDirPath: filepath.Join("..", "..", "tests", "testdata", "projects", "jas", "jas"),
272347
configProfile: services.ConfigProfile{
273-
ProfileName: "secrets&sast",
348+
ProfileName: "only-sast",
274349
Modules: []services.Module{{
275350
ModuleId: 1,
276-
ModuleName: "secrets&sast-module",
351+
ModuleName: "only-iac-module",
277352
PathFromRoot: ".",
278353
ScanConfig: services.ScanConfig{
354+
EnableScaScan: false,
355+
EnableContextualAnalysisScan: false,
356+
SastScannerConfig: services.SastScannerConfig{
357+
EnableSastScan: false,
358+
},
359+
SecretsScannerConfig: services.SecretsScannerConfig{
360+
EnableSecretsScan: false,
361+
},
362+
IacScannerConfig: services.IacScannerConfig{
363+
EnableIacScan: true,
364+
},
365+
},
366+
}},
367+
IsDefault: false,
368+
},
369+
expectedIacIssues: 9,
370+
},
371+
{
372+
name: "Enable All Scanners",
373+
testDirPath: filepath.Join("..", "..", "tests", "testdata", "projects", "jas", "jas"),
374+
configProfile: services.ConfigProfile{
375+
ProfileName: "all-jas-scanners",
376+
Modules: []services.Module{{
377+
ModuleId: 1,
378+
ModuleName: "all-jas-module",
379+
PathFromRoot: ".",
380+
ScanConfig: services.ScanConfig{
381+
EnableScaScan: true,
382+
EnableContextualAnalysisScan: true,
279383
SastScannerConfig: services.SastScannerConfig{
280384
EnableSastScan: true,
281385
},
282386
SecretsScannerConfig: services.SecretsScannerConfig{
283387
EnableSecretsScan: true,
284388
},
389+
IacScannerConfig: services.IacScannerConfig{
390+
EnableIacScan: true,
391+
},
285392
},
286393
}},
287394
IsDefault: false,
288395
},
289-
expectedSastIssues: 1,
290-
expectedSecretsIssues: 16,
396+
expectedSastIssues: 1,
397+
expectedSecretsIssues: 16,
398+
expectedIacIssues: 9,
399+
expectedCaApplicable: 3,
400+
expectedCaUndetermined: 6,
401+
expectedCaNotCovered: 4,
402+
expectedCaNotApplicable: 2,
291403
},
292404
}
293405

@@ -298,8 +410,7 @@ func TestAuditWithConfigProfile(t *testing.T) {
298410

299411
tempDirPath, createTempDirCallback := coreTests.CreateTempDirWithCallbackAndAssert(t)
300412
defer createTempDirCallback()
301-
testDirPath := filepath.Join("..", "..", "tests", "testdata", "projects", "jas", "jas")
302-
assert.NoError(t, biutils.CopyDir(testDirPath, tempDirPath, true, nil))
413+
assert.NoError(t, biutils.CopyDir(testcase.testDirPath, tempDirPath, true, nil))
303414

304415
auditBasicParams := (&utils.AuditBasicParams{}).
305416
SetServerDetails(serverDetails).
@@ -316,18 +427,35 @@ func TestAuditWithConfigProfile(t *testing.T) {
316427
ScanType: scanservices.Dependency,
317428
IncludeVulnerabilities: true,
318429
XscVersion: services.ConfigProfileMinXscVersion,
319-
MultiScanId: "random-msi",
430+
MultiScanId: validations.TestMsi,
320431
})
321432

322433
auditParams.SetWorkingDirs([]string{tempDirPath}).SetIsRecursiveScan(true)
323434
auditResults := RunAudit(auditParams)
324435
assert.NoError(t, auditResults.GetErrors())
325436

326-
// Currently, the only supported scanners are Secrets and Sast, therefore if a config profile is utilized - all other scanners are disabled.
327437
summary, err := conversion.NewCommandResultsConvertor(conversion.ResultConvertParams{IncludeVulnerabilities: true, HasViolationContext: true}).ConvertToSummary(auditResults)
328438
assert.NoError(t, err)
329-
// Validate Sast and Secrets have the expected number of issues and that Iac and Sca did not run
330-
validations.ValidateCommandSummaryOutput(t, validations.ValidationParams{Actual: summary, ExactResultsMatch: true, Sast: testcase.expectedSastIssues, Secrets: testcase.expectedSecretsIssues, Vulnerabilities: testcase.expectedSastIssues + testcase.expectedSecretsIssues})
439+
440+
var ScaResultsCount int
441+
// When checking Applicability results with ExactResultsMatch = true, the sum of all statuses should equal total Sca results amount. Else, we check the provided Sca issues amount
442+
if testcase.expectedCaApplicable > 0 || testcase.expectedCaNotApplicable > 0 || testcase.expectedCaNotCovered > 0 || testcase.expectedCaUndetermined > 0 {
443+
ScaResultsCount = testcase.expectedCaApplicable + testcase.expectedCaNotApplicable + testcase.expectedCaNotCovered + testcase.expectedCaUndetermined
444+
} else {
445+
ScaResultsCount = testcase.expectedScaIssues
446+
}
447+
validations.ValidateCommandSummaryOutput(t, validations.ValidationParams{
448+
Actual: summary,
449+
ExactResultsMatch: true,
450+
Vulnerabilities: testcase.expectedSastIssues + testcase.expectedSecretsIssues + testcase.expectedIacIssues + ScaResultsCount,
451+
Sast: testcase.expectedSastIssues,
452+
Secrets: testcase.expectedSecretsIssues,
453+
Iac: testcase.expectedIacIssues,
454+
Applicable: testcase.expectedCaApplicable,
455+
NotApplicable: testcase.expectedCaNotApplicable,
456+
NotCovered: testcase.expectedCaNotCovered,
457+
Undetermined: testcase.expectedCaUndetermined,
458+
})
331459
})
332460
}
333461
}

‎commands/audit/scarunner.go‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,8 +59,14 @@ func buildDepTreeAndRunScaScan(auditParallelRunner *utils.SecurityParallelRunner
5959
return
6060
}
6161
if auditParams.configProfile != nil {
62-
log.Debug("Skipping SCA scan as a configuration profile is being utilized and currently only Secrets and Sast scanners are supported when utilizing a configuration profile")
63-
return
62+
if len(auditParams.configProfile.Modules) < 1 {
63+
// Verify Modules are not nil and contain at least one modules
64+
return fmt.Errorf("config profile %s has no modules. A config profile must contain at least one modules", auditParams.configProfile.ProfileName)
65+
}
66+
if !auditParams.configProfile.Modules[0].ScanConfig.EnableScaScan {
67+
log.Debug(fmt.Sprintf("Skipping SCA scan as requested by '%s' config profile...", auditParams.configProfile.ProfileName))
68+
return
69+
}
6470
}
6571
// Prepare
6672
currentWorkingDir, generalError := os.Getwd()

‎jas/runner/jasrunner.go‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,10 @@ func addJasScanTaskForModuleIfNeeded(params JasRunnerParams, subScan utils.SubSc
8787
if params.ConfigProfile != nil {
8888
// This code section is related to CentralizedConfig integration in CI Next.
8989
log.Debug(fmt.Sprintf("Using config profile '%s' to determine whether to run %s scan...", params.ConfigProfile.ProfileName, jasType))
90+
if len(params.ConfigProfile.Modules) < 1 {
91+
// Verify Modules are not nil and contain at least one modules
92+
return fmt.Errorf("config profile %s has no modules. A config profile must contain at least one modules", params.ConfigProfile.ProfileName)
93+
}
9094
// Currently, if config profile exists, the only possible scanners to run are: Secrets, Sast
9195
enabled := false
9296
switch jasType {
@@ -95,11 +99,9 @@ func addJasScanTaskForModuleIfNeeded(params JasRunnerParams, subScan utils.SubSc
9599
case jasutils.Sast:
96100
enabled = params.ConfigProfile.Modules[0].ScanConfig.SastScannerConfig.EnableSastScan
97101
case jasutils.IaC:
98-
log.Debug("Skipping Iac scan as it is not currently supported with a config profile...")
99-
return
102+
enabled = params.ConfigProfile.Modules[0].ScanConfig.IacScannerConfig.EnableIacScan
100103
case jasutils.Applicability:
101-
log.Debug("Skipping Contextual Analysis scan as it is not currently supported with a config profile...")
102-
return
104+
enabled = params.ConfigProfile.Modules[0].ScanConfig.EnableContextualAnalysisScan
103105
}
104106
if enabled {
105107
generalError = addModuleJasScanTask(jasType, params.Runner, task, params.ScanResults, params.AllowPartialResults)

‎utils/validations/test_mocks.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,8 @@ func XrayServer(t *testing.T, xrayVersion string) (*httptest.Server, *config.Ser
101101
}
102102
}
103103
}
104-
if strings.HasPrefix(r.RequestURI, "/xray/api/v1/scan/graph") {
104+
// Scan graph with Xray or Xsc
105+
if strings.Contains(r.RequestURI, "/scan/graph") {
105106
if r.Method == http.MethodPost {
106107
w.WriteHeader(http.StatusCreated)
107108
_, err := w.Write([]byte(fmt.Sprintf(`{"scan_id" : "%s"}`, TestScaScanId)))

0 commit comments

Comments
 (0)