Skip to content

Commit 0daaa3c

Browse files
attiasasattiasas
committed
remove comments and unused code
1 parent 71bdcf4 commit 0daaa3c

File tree

7 files changed

+8
-576
lines changed

7 files changed

+8
-576
lines changed

‎commands/upload/uploadcdx.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"path/filepath"
66
"strings"
77

8+
clientUtils "github.com/jfrog/jfrog-client-go/utils"
89
ioUtils "github.com/jfrog/jfrog-client-go/utils/io"
910
"github.com/jfrog/jfrog-client-go/utils/io/fileutils"
1011
"github.com/jfrog/jfrog-client-go/utils/log"
@@ -175,7 +176,7 @@ func createRepositoryIfNeededAndUploadFile(filePath string, serverDetails *confi
175176
log.Debug(fmt.Sprintf("Uploading scan results to %s", scanResultsRepository))
176177
// target repo is <repository name>/<repository path>, If the target path ends with a slash, the path is assumed to be a folder.
177178
// Else it is assumed to be a file. so we add a slash to the end of the repo to indicate that it is a folder.
178-
uploaded, err := artifactory.UploadArtifactsByPattern(filePath, serverDetails, artifactory.AddSuffixSlashIfNeeded(scanResultsRepository), relatedProjectKey)
179+
uploaded, err := artifactory.UploadArtifactsByPattern(filePath, serverDetails, clientUtils.AddTrailingSlashIfNeeded(scanResultsRepository), relatedProjectKey)
179180
if err != nil {
180181
return "", fmt.Errorf("failed to upload file %s to repository %s: %w", filePath, scanResultsRepository, err)
181182
}

‎policy/local/localconvertor.go‎

Lines changed: 0 additions & 126 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ import (
77

88
"github.com/CycloneDX/cyclonedx-go"
99
"github.com/jfrog/gofrog/datastructures"
10-
// "github.com/jfrog/gofrog/log"
1110
"github.com/jfrog/jfrog-cli-security/policy"
1211
"github.com/jfrog/jfrog-cli-security/utils/formats"
1312
"github.com/jfrog/jfrog-cli-security/utils/formats/cdxutils"
@@ -357,128 +356,3 @@ func ForEachScanGraphViolation(target results.ScanTarget, descriptors []string,
357356
watches = watchesSet.ToSlice()
358357
return
359358
}
360-
361-
// This func iterates every violation and checks if there is a violation that should fail the build.
362-
// The build should be failed if there exists at least one violation in any target that holds the following conditions:
363-
// 1) The violation is set to fail the build by FailBuild or FailPr
364-
// 2) The violation has applicability status other than 'NotApplicable' OR the violation has 'NotApplicable' status and is not set to skip-non-applicable
365-
// func CheckIfFailBuild(auditResults *results.SecurityCommandResults) (bool, error) {
366-
// for _, target := range auditResults.Targets {
367-
// shouldFailBuild := false
368-
// // We first check if JasResults exist so we can extract CA results and consider Applicability status when checking if the build should fail.
369-
// if target.JasResults == nil {
370-
// shouldFailBuild = checkIfFailBuildWithoutConsideringApplicability(target)
371-
// } else {
372-
// // If JasResults are not empty we check old and new violation while considering Applicability status and Skip-not-applicable policy rule.
373-
// if err := checkIfFailBuildConsideringApplicability(target, auditResults.EntitledForJas, &shouldFailBuild); err != nil {
374-
// return false, fmt.Errorf("failed to check if build should fail for target %s: %w", target.ScanTarget.Target, err)
375-
// }
376-
// }
377-
// if shouldFailBuild {
378-
// // If we found a violation that should fail the build, we return true.
379-
// return true, nil
380-
// }
381-
// }
382-
// return false, nil
383-
// }
384-
385-
// func checkIfFailBuildConsideringApplicability(target *results.TargetResults, entitledForJas bool, shouldFailBuild *bool) error {
386-
// jasApplicabilityResults := target.JasResults.GetApplicabilityScanResults()
387-
388-
// if target.ScaResults == nil {
389-
// return nil
390-
// }
391-
// // Get new violations from the target
392-
// // newViolations := target.ScaResults.Violations
393-
394-
// // // Here we iterate the new violation results and check if any of them should fail the build.
395-
// // _, _, err := ForEachScanGraphViolation(
396-
// // target.ScanTarget,
397-
// // []string{},
398-
// // newViolations,
399-
// // entitledForJas,
400-
// // jasApplicabilityResults,
401-
// // checkIfShouldFailBuildAccordingToPolicy(shouldFailBuild),
402-
// // nil,
403-
// // nil)
404-
// // if err != nil {
405-
// // return err
406-
// // }
407-
408-
// // Here we iterate the deprecated violation results to check if any of them should fail the build.
409-
// // TODO remove this part once the DeprecatedXrayResults are completely removed and no longer in use
410-
// for _, result := range target.ScaResults.DeprecatedXrayResults {
411-
// deprecatedViolations := result.Scan.Violations
412-
// _, _, err := ForEachScanGraphViolation(
413-
// target.ScanTarget,
414-
// []string{},
415-
// deprecatedViolations,
416-
// entitledForJas,
417-
// jasApplicabilityResults,
418-
// checkIfShouldFailBuildAccordingToPolicy(shouldFailBuild),
419-
// nil,
420-
// nil)
421-
// if err != nil {
422-
// return err
423-
// }
424-
// }
425-
// return nil
426-
// }
427-
428-
// func checkIfFailBuildWithoutConsideringApplicability(target *results.TargetResults) bool {
429-
// if target.ScaResults == nil {
430-
// return false
431-
// }
432-
// // for _, newViolation := range target.ScaResults.Violations {
433-
// // if newViolation.FailBuild || newViolation.FailPr {
434-
// // return true
435-
// // }
436-
// // }
437-
// // TODO remove this for loop once the DeprecatedXrayResults are completely removed and no longer in use
438-
// for _, scanResponse := range target.GetScaScansXrayResults() {
439-
// for _, oldViolation := range scanResponse.Violations {
440-
// if oldViolation.FailBuild || oldViolation.FailPr {
441-
// return true
442-
// }
443-
// }
444-
// }
445-
// return false
446-
// }
447-
448-
// func checkIfShouldFailBuildAccordingToPolicy(shouldFailBuild *bool) func(violation services.Violation, cves []formats.CveRow, applicabilityStatus jasutils.ApplicabilityStatus, severity severityutils.Severity, impactedPackagesId string, fixedVersion []string, directComponents []formats.ComponentRow, impactPaths [][]formats.ComponentRow) (err error) {
449-
// return func(violation services.Violation, cves []formats.CveRow, applicabilityStatus jasutils.ApplicabilityStatus, severity severityutils.Severity, impactedPackagesId string, fixedVersion []string, directComponents []formats.ComponentRow, impactPaths [][]formats.ComponentRow) (err error) {
450-
// if !violation.FailBuild && !violation.FailPr {
451-
// // If the violation is not set to fail the build we simply return
452-
// return nil
453-
// }
454-
// // If the violation is set to fail the build, we check if the violation has NotApplicable status and is set to skip-non-applicable.
455-
// // If the violation is NotApplicable and is set to skip-non-applicable, we don't fail the build.
456-
// // If the violation has any other status OR has NotApplicable status but is not set to skip-not-applicable, we fail the build.
457-
// var shouldSkip bool
458-
// if shouldSkip, err = shouldSkipNotApplicable(violation, applicabilityStatus); err != nil {
459-
// return err
460-
// }
461-
// if !shouldSkip {
462-
// *shouldFailBuild = true
463-
// }
464-
// return nil
465-
// }
466-
// }
467-
468-
// Checks if the violation's applicability status is NotApplicable and if all of its policies states that non-applicable CVEs should be skipped
469-
// func shouldSkipNotApplicable(violation services.Violation, applicabilityStatus jasutils.ApplicabilityStatus) (bool, error) {
470-
// if applicabilityStatus != jasutils.NotApplicable {
471-
// return false, nil
472-
// }
473-
474-
// if len(violation.Policies) == 0 {
475-
// return false, errors.New("a violation with no policies was provided")
476-
// }
477-
478-
// for _, policy := range violation.Policies {
479-
// if !policy.SkipNotApplicable {
480-
// return false, nil
481-
// }
482-
// }
483-
// return true, nil
484-
// }

‎utils/artifactory/artifactoryutils.go‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -107,13 +107,6 @@ func getArtifactsPaths(repo string, reader *content.ContentReader) (paths []stri
107107
return
108108
}
109109

110-
func AddSuffixSlashIfNeeded(path string) string {
111-
if path != "" && !strings.HasSuffix(path, "/") {
112-
path += "/"
113-
}
114-
return path
115-
}
116-
117110
func IsRepoExists(repoKey string, serverDetails *config.ServerDetails) (exists bool, err error) {
118111
if repoKey == "" || serverDetails == nil {
119112
return false, errors.New("repository key and server details must be provided")

‎utils/formats/violationutils/violations.go‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -189,19 +189,17 @@ type JasViolation struct {
189189

190190
type ScaViolation struct {
191191
Violation
192-
ImpactedComponent cyclonedx.Component `json:"impacted_component"`
193-
// TODO:
194-
DirectComponents []formats.ComponentRow `json:"direct_components,omitempty"`
195-
ImpactPaths [][]formats.ComponentRow `json:"impact_paths,omitempty"`
192+
ImpactedComponent cyclonedx.Component `json:"impacted_component"`
193+
DirectComponents []formats.ComponentRow `json:"direct_components,omitempty"`
194+
ImpactPaths [][]formats.ComponentRow `json:"impact_paths,omitempty"`
196195
}
197196

198197
type CveViolation struct {
199198
ScaViolation
200199
CveVulnerability cyclonedx.Vulnerability
201-
ContextualAnalysis *formats.Applicability `json:"contextual_analysis,omitempty"`
202-
// TODO:
203-
FixedVersions *[]cyclonedx.AffectedVersions `json:"fixed_versions,omitempty"`
204-
// TODO: remove after information displayed in cyclonedx.Vulnerability
200+
ContextualAnalysis *formats.Applicability `json:"contextual_analysis,omitempty"`
201+
FixedVersions *[]cyclonedx.AffectedVersions `json:"fixed_versions,omitempty"`
202+
// TODO: remove comment after information displayed in cyclonedx.Vulnerability
205203
JfrogResearchInformation *formats.JfrogResearchInformation `json:"jfrogResearchInformation,omitempty"`
206204
}
207205

‎utils/results/conversion/sarifparser/sarifparser.go‎

Lines changed: 0 additions & 167 deletions
Original file line numberDiff line numberDiff line change
@@ -200,17 +200,6 @@ func (sc *CmdResultsSarifConverter) validateBeforeParse() (err error) {
200200

201201
func (sc *CmdResultsSarifConverter) DeprecatedParseScaVulnerabilities(descriptors []string, scaResponse results.ScanResult[services.ScanResponse], applicableScan ...results.ScanResult[[]*sarif.Run]) (err error) {
202202
return sc.parseScaVulnerabilities(sc.currentTargetConvertedRuns.currentTarget, descriptors, scaResponse, applicableScan...)
203-
204-
// if violations {
205-
// if err = sc.parseScaViolations(target, descriptors, scaResponse, applicableScan...); err != nil {
206-
// return
207-
// }
208-
// return
209-
// }
210-
// if err = sc.parseScaVulnerabilities(target, descriptors, scaResponse, applicableScan...); err != nil {
211-
// return
212-
// }
213-
// return
214203
}
215204

216205
func (sc *CmdResultsSarifConverter) ParseViolations(violationsScanResults results.ScanResult[violationutils.Violations]) (err error) {
@@ -305,127 +294,6 @@ func (sc *CmdResultsSarifConverter) ParseViolations(violationsScanResults result
305294
return
306295
}
307296

308-
// func parseCveViolation() {
309-
310-
// }
311-
312-
// func (sc *CmdResultsSarifConverter) parseScaViolations(target results.ScanTarget, descriptors []string, scanResponse results.ScanResult[services.ScanResponse], applicableScan ...results.ScanResult[[]*sarif.Run]) (err error) {
313-
// if err = sc.validateBeforeParse(); err != nil {
314-
// return
315-
// }
316-
// if sc.currentTargetConvertedRuns.scaCurrentRun == nil {
317-
// sc.currentTargetConvertedRuns.scaCurrentRun = sc.createScaRun(target, len(sc.currentErrors))
318-
// }
319-
// // Parse violations
320-
// sarifResults, sarifRules, err := PrepareSarifScaViolations(sc.currentCmdType, target, descriptors, scanResponse.Scan.Violations, sc.entitledForJas, results.ScanResultsToRuns(applicableScan)...)
321-
// if err != nil || len(sarifRules) == 0 || len(sarifResults) == 0 {
322-
// return
323-
// }
324-
// sc.addScaResultsToCurrentRun(sarifRules, sarifResults...)
325-
// return
326-
// }
327-
328-
// func PrepareSarifScaViolations(cmdType utils.CommandType, target results.ScanTarget, descriptors []string, violations []services.Violation, entitledForJas bool, applicabilityRuns ...*sarif.Run) ([]*sarif.Result, map[string]*sarif.ReportingDescriptor, error) {
329-
// sarifResults := []*sarif.Result{}
330-
// rules := map[string]*sarif.ReportingDescriptor{}
331-
// _, _, err := local.ForEachScanGraphViolation(
332-
// target,
333-
// descriptors,
334-
// violations,
335-
// entitledForJas,
336-
// applicabilityRuns,
337-
// addSarifScaSecurityViolation(cmdType, &sarifResults, &rules),
338-
// addSarifScaLicenseViolation(cmdType, &sarifResults, &rules),
339-
// // Operational risks violations are not supported in Sarif format
340-
// nil,
341-
// )
342-
// return sarifResults, rules, err
343-
// }
344-
345-
// func addSarifScaSecurityViolation(cmdType utils.CommandType, sarifResults *[]*sarif.Result, rules *map[string]*sarif.ReportingDescriptor) local.ParseScanGraphViolationFunc {
346-
// return func(violation services.Violation, cves []formats.CveRow, applicabilityStatus jasutils.ApplicabilityStatus, severity severityutils.Severity, impactedPackagesId string, fixedVersions []string, directComponents []formats.ComponentRow, impactPaths [][]formats.ComponentRow) error {
347-
// maxCveScore, err := results.FindMaxCVEScore(severity, applicabilityStatus, cves)
348-
// if err != nil {
349-
// return err
350-
// }
351-
// markdownDescription, err := getScaIssueMarkdownDescription(directComponents, maxCveScore, applicabilityStatus, fixedVersions)
352-
// if err != nil {
353-
// return err
354-
// }
355-
// impactedPackagesName, impactedPackagesVersion, _ := techutils.SplitComponentId(impactedPackagesId)
356-
// currentResults, currentRule := parseScaToSarifFormat(scaParseParams{
357-
// CmdType: cmdType,
358-
// IssueId: violation.IssueId,
359-
// Watch: violation.WatchName,
360-
// Summary: violation.Summary,
361-
// MarkdownDescription: markdownDescription,
362-
// CveScore: maxCveScore,
363-
// GenerateTitleFunc: getScaSecurityViolationSarifHeadline,
364-
// Cves: cves,
365-
// Severity: severity,
366-
// ApplicabilityStatus: applicabilityStatus,
367-
// ImpactedPackagesName: impactedPackagesName,
368-
// ImpactedPackagesVersion: impactedPackagesVersion,
369-
// FixedVersions: fixedVersions,
370-
// DirectComponents: directComponents,
371-
// ImpactPaths: impactPaths,
372-
// Violation: &violationContext{
373-
// Watch: violation.WatchName,
374-
// Policies: results.ConvertPolicesToString(violation.Policies),
375-
// },
376-
// })
377-
// cveImpactedComponentRuleId := results.GetScaIssueId(impactedPackagesName, impactedPackagesVersion, results.GetIssueIdentifier(cves, violation.IssueId, "_"))
378-
// if _, ok := (*rules)[cveImpactedComponentRuleId]; !ok {
379-
// // New Rule
380-
// (*rules)[cveImpactedComponentRuleId] = currentRule
381-
// }
382-
// *sarifResults = append(*sarifResults, currentResults...)
383-
// return nil
384-
// }
385-
// }
386-
387-
// func addSarifScaLicenseViolation(cmdType utils.CommandType, sarifResults *[]*sarif.Result, rules *map[string]*sarif.ReportingDescriptor) local.ParseScanGraphViolationFunc {
388-
// return func(violation services.Violation, cves []formats.CveRow, applicabilityStatus jasutils.ApplicabilityStatus, severity severityutils.Severity, impactedPackagesId string, fixedVersions []string, directComponents []formats.ComponentRow, impactPaths [][]formats.ComponentRow) error {
389-
// maxCveScore, err := results.FindMaxCVEScore(severity, applicabilityStatus, cves)
390-
// if err != nil {
391-
// return err
392-
// }
393-
// impactedPackagesName, impactedPackagesVersion, _ := techutils.SplitComponentId(impactedPackagesId)
394-
// markdownDescription, err := getScaLicenseViolationMarkdown(impactedPackagesName, impactedPackagesVersion, violation.LicenseKey, directComponents)
395-
// if err != nil {
396-
// return err
397-
// }
398-
// currentResults, currentRule := parseScaToSarifFormat(scaParseParams{
399-
// CmdType: cmdType,
400-
// Watch: violation.WatchName,
401-
// IssueId: violation.LicenseKey,
402-
// Summary: getLicenseViolationSummary(impactedPackagesName, impactedPackagesVersion, violation.LicenseKey),
403-
// MarkdownDescription: markdownDescription,
404-
// CveScore: maxCveScore,
405-
// GenerateTitleFunc: getXrayLicenseSarifHeadline,
406-
// Cves: cves,
407-
// Severity: severity,
408-
// ApplicabilityStatus: applicabilityStatus,
409-
// ImpactedPackagesName: impactedPackagesName,
410-
// ImpactedPackagesVersion: impactedPackagesVersion,
411-
// FixedVersions: fixedVersions,
412-
// DirectComponents: directComponents,
413-
// ImpactPaths: impactPaths,
414-
// Violation: &violationutils.Violation{
415-
// Watch: violation.WatchName,
416-
// Policies: results.ConvertPolicesToString(violation.Policies),
417-
// },
418-
// })
419-
// cveImpactedComponentRuleId := results.GetScaIssueId(impactedPackagesName, impactedPackagesVersion, results.GetIssueIdentifier(cves, violation.LicenseKey, "_"))
420-
// if _, ok := (*rules)[cveImpactedComponentRuleId]; !ok {
421-
// // New Rule
422-
// (*rules)[cveImpactedComponentRuleId] = currentRule
423-
// }
424-
// *sarifResults = append(*sarifResults, currentResults...)
425-
// return nil
426-
// }
427-
// }
428-
429297
func (sc *CmdResultsSarifConverter) parseScaVulnerabilities(target results.ScanTarget, descriptors []string, scanResponse results.ScanResult[services.ScanResponse], applicableScan ...results.ScanResult[[]*sarif.Run]) (err error) {
430298
if err = sc.validateBeforeParse(); err != nil {
431299
return
@@ -923,27 +791,6 @@ func patchSarifRuns(params PatchSarifParams, runs ...*sarif.Run) []*sarif.Run {
923791
return patchedRuns
924792
}
925793

926-
// func patchRunsToPassIngestionRules(baseJfrogUrl string, cmdType utils.CommandType, subScanType utils.SubScanType, patchBinaryPaths, isViolations bool, target results.ScanTarget, runs ...*sarif.Run) []*sarif.Run {
927-
// patchedRuns := []*sarif.Run{}
928-
// // Patch changes may alter the original run, so we will create a new run for each
929-
// for _, run := range runs {
930-
// patched := sarifutils.CopyRun(run)
931-
// // Since we run in temp directories files should be relative
932-
// // Patch by converting the file paths to relative paths according to the invocations
933-
// convertPaths(cmdType, subScanType, patched)
934-
// if cmdType.IsTargetBinary() && subScanType == utils.SecretsScan {
935-
// // Patch the tool name in case of binary scan
936-
// sarifutils.SetRunToolName(BinarySecretScannerToolName, patched)
937-
// }
938-
// if patched.Tool.Driver != nil {
939-
// patched.Tool.Driver.Rules = patchRules(baseJfrogUrl, cmdType, subScanType, isViolations, patched.Tool.Driver.Rules...)
940-
// }
941-
// patched.Results = patchResults(cmdType, subScanType, patchBinaryPaths, isViolations, target, patched, patched.Results...)
942-
// patchedRuns = append(patchedRuns, patched)
943-
// }
944-
// return patchedRuns
945-
// }
946-
947794
func patchPaths(params PatchSarifParams, runs ...*sarif.Run) {
948795
if !params.ConvertPaths {
949796
return
@@ -978,20 +825,6 @@ func pathTool(params PatchSarifParams, runs ...*sarif.Run) {
978825
}
979826
}
980827

981-
// func convertPaths(commandType utils.CommandType, subScanType utils.SubScanType, runs ...*sarif.Run) {
982-
// // Convert base on invocation for source code
983-
// sarifutils.ConvertRunsPathsToRelative(runs...)
984-
// if !(commandType == utils.DockerImage && subScanType == utils.SecretsScan) {
985-
// return
986-
// }
987-
// for _, run := range runs {
988-
// for _, result := range run.Results {
989-
// // For Docker secret scan, patch the logical location if not exists
990-
// patchDockerSecretLocations(result)
991-
// }
992-
// }
993-
// }
994-
995828
// Patch the URI to be the file path from sha<number>/<hash>/
996829
// Extract the layer from the location URI, adds it as a logical location kind "layer"
997830
func patchDockerSecretLocations(result *sarif.Result) {

0 commit comments

Comments
 (0)