Skip to content

Commit 848d30b

Browse files
attiasasattiasas
committed
fix some bugs
1 parent 1bd432f commit 848d30b

File tree

8 files changed

+71
-131
lines changed

8 files changed

+71
-131
lines changed

‎jas/runner/jasrunner.go‎

Lines changed: 12 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -137,15 +137,12 @@ func runSecretsScan(securityParallelRunner *utils.SecurityParallelRunner, scanne
137137
vulnerabilitiesResults, violationsResults, err := secrets.RunSecretsScan(scanner, secretsScanType, module, threadId)
138138
securityParallelRunner.ResultsMu.Lock()
139139
defer securityParallelRunner.ResultsMu.Unlock()
140-
140+
// We first add the scan results and than check for errors to store the exit code to report it in the end
141141
extendedScanResults.NewJasScanResults(jasutils.Secrets, vulnerabilitiesResults, violationsResults, jas.GetAnalyzerManagerExitCode(err))
142-
err = jas.ParseAnalyzerManagerError(jasutils.Secrets, err)
143-
144-
if err != nil {
142+
if err = jas.ParseAnalyzerManagerError(jasutils.Secrets, err); err != nil {
145143
return fmt.Errorf("%s%s", clientutils.GetLogMsgPrefix(threadId, false), err.Error())
146144
}
147-
err = dumpSarifRunToFileIfNeeded(vulnerabilitiesResults, scansOutputDir, jasutils.Secrets)
148-
return
145+
return dumpSarifRunToFileIfNeeded(vulnerabilitiesResults, scansOutputDir, jasutils.Secrets)
149146
}
150147
}
151148

@@ -158,15 +155,12 @@ func runIacScan(securityParallelRunner *utils.SecurityParallelRunner, scanner *j
158155
vulnerabilitiesResults, violationsResults, err := iac.RunIacScan(scanner, module, threadId)
159156
securityParallelRunner.ResultsMu.Lock()
160157
defer securityParallelRunner.ResultsMu.Unlock()
161-
158+
// We first add the scan results and than check for errors to store the exit code to report it in the end
162159
extendedScanResults.NewJasScanResults(jasutils.IaC, vulnerabilitiesResults, violationsResults, jas.GetAnalyzerManagerExitCode(err))
163-
err = jas.ParseAnalyzerManagerError(jasutils.IaC, err)
164-
165-
if err != nil {
160+
if err = jas.ParseAnalyzerManagerError(jasutils.IaC, err); err != nil {
166161
return fmt.Errorf("%s%s", clientutils.GetLogMsgPrefix(threadId, false), err.Error())
167162
}
168-
err = dumpSarifRunToFileIfNeeded(vulnerabilitiesResults, scansOutputDir, jasutils.IaC)
169-
return
163+
return dumpSarifRunToFileIfNeeded(vulnerabilitiesResults, scansOutputDir, jasutils.IaC)
170164
}
171165
}
172166

@@ -179,15 +173,12 @@ func runSastScan(securityParallelRunner *utils.SecurityParallelRunner, scanner *
179173
vulnerabilitiesResults, violationsResults, err := sast.RunSastScan(scanner, module, signedDescriptions, threadId)
180174
securityParallelRunner.ResultsMu.Lock()
181175
defer securityParallelRunner.ResultsMu.Unlock()
182-
176+
// We first add the scan results and than check for errors to store the exit code to report it in the end
183177
extendedScanResults.NewJasScanResults(jasutils.Sast, vulnerabilitiesResults, violationsResults, jas.GetAnalyzerManagerExitCode(err))
184-
err = jas.ParseAnalyzerManagerError(jasutils.Sast, err)
185-
186-
if err != nil {
178+
if err = jas.ParseAnalyzerManagerError(jasutils.Sast, err); err != nil {
187179
return fmt.Errorf("%s%s", clientutils.GetLogMsgPrefix(threadId, false), err.Error())
188180
}
189-
err = dumpSarifRunToFileIfNeeded(vulnerabilitiesResults, scansOutputDir, jasutils.Sast)
190-
return
181+
return dumpSarifRunToFileIfNeeded(vulnerabilitiesResults, scansOutputDir, jasutils.Sast)
191182
}
192183
}
193184

@@ -202,15 +193,12 @@ func runContextualScan(securityParallelRunner *utils.SecurityParallelRunner, sca
202193
caScanResults, err := applicability.RunApplicabilityScan(scanResults.GetScaScansXrayResults(), *directDependencies, scanner, thirdPartyApplicabilityScan, scanType, module, threadId)
203194
securityParallelRunner.ResultsMu.Lock()
204195
defer securityParallelRunner.ResultsMu.Unlock()
205-
196+
// We first add the scan results and than check for errors to store the exit code to report it in the end
206197
scanResults.JasResults.NewApplicabilityScanResults(caScanResults, jas.GetAnalyzerManagerExitCode(err))
207-
err = jas.ParseAnalyzerManagerError(jasutils.Applicability, err)
208-
209-
if err != nil {
198+
if err = jas.ParseAnalyzerManagerError(jasutils.Applicability, err); err != nil {
210199
return fmt.Errorf("%s%s", clientutils.GetLogMsgPrefix(threadId, false), err.Error())
211200
}
212-
err = dumpSarifRunToFileIfNeeded(caScanResults, scansOutputDir, jasutils.Applicability)
213-
return
201+
return dumpSarifRunToFileIfNeeded(caScanResults, scansOutputDir, jasutils.Applicability)
214202
}
215203
}
216204

‎utils/formats/sarifutils/sarifutils.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -681,7 +681,7 @@ func GetRuleById(run *sarif.Run, ruleId string) *sarif.ReportingDescriptor {
681681
}
682682

683683
func GetRuleFullDescription(rule *sarif.ReportingDescriptor) string {
684-
if rule.FullDescription != nil && rule.FullDescription.Text != nil {
684+
if rule != nil && rule.FullDescription != nil && rule.FullDescription.Text != nil {
685685
return *rule.FullDescription.Text
686686
}
687687
return ""
@@ -710,7 +710,7 @@ func GetRuleHelpMarkdown(rule *sarif.ReportingDescriptor) string {
710710
}
711711

712712
func GetRuleShortDescription(rule *sarif.ReportingDescriptor) string {
713-
if rule.ShortDescription != nil && rule.ShortDescription.Text != nil {
713+
if rule != nil && rule.ShortDescription != nil && rule.ShortDescription.Text != nil {
714714
return *rule.ShortDescription.Text
715715
}
716716
return ""

‎utils/formats/simplejsonapi.go‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ type ScanStatus struct {
3838

3939
type ViolationContext struct {
4040
Watch string `json:"watch,omitempty"`
41+
IssueId string `json:"issueId,omitempty"`
4142
Policies []string `json:"policies,omitempty"`
4243
}
4344

@@ -97,15 +98,19 @@ type OperationalRiskViolationRow struct {
9798
type SourceCodeRow struct {
9899
SeverityDetails
99100
ViolationContext
101+
ScannerInfo
100102
Location
101-
RuleId string `json:"ruleId"`
102-
IssueId string `json:"issueId"`
103-
CWE []string `json:"cwe,omitempty"`
104-
Finding string `json:"finding,omitempty"`
105-
Fingerprint string `json:"fingerprint,omitempty"`
106-
Applicability *Applicability `json:"applicability,omitempty"`
107-
ScannerDescription string `json:"scannerDescription,omitempty"`
108-
CodeFlow [][]Location `json:"codeFlow,omitempty"`
103+
Finding string `json:"finding,omitempty"`
104+
Fingerprint string `json:"fingerprint,omitempty"`
105+
Applicability *Applicability `json:"applicability,omitempty"`
106+
CodeFlow [][]Location `json:"codeFlow,omitempty"`
107+
}
108+
109+
type ScannerInfo struct {
110+
RuleId string `json:"ruleId"`
111+
Cwe []string `json:"cwe,omitempty"`
112+
ScannerShortDescription string `json:"scannerShortDescription,omitempty"`
113+
ScannerDescription string `json:"scannerDescription,omitempty"`
109114
}
110115

111116
type Location struct {

‎utils/results/common.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -549,6 +549,9 @@ func getApplicabilityStatusFromRule(rule *sarif.ReportingDescriptor) jasutils.Ap
549549
}
550550

551551
func GetDependencyId(depName, version string) string {
552+
if version == "" {
553+
return depName
554+
}
552555
return fmt.Sprintf("%s:%s", depName, version)
553556
}
554557

‎utils/results/conversion/convertor_test.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,12 @@ func getAuditValidationParams() validations.ValidationParams {
4646
}
4747
}
4848

49+
func getAuditTestResults() *results.SecurityCommandResults {
50+
cmdResults := results.NewCommandResults(utils.SourceCode)
51+
52+
return cmdResults
53+
}
54+
4955
// For Summary we count unique CVE finding (issueId), for SARIF and SimpleJson we count all findings (pair of issueId+impactedComponent)
5056
// We have in the result 2 CVE with 2 impacted components each
5157
func getDockerScanValidationParams(unique bool) validations.ValidationParams {
@@ -73,6 +79,12 @@ func getDockerScanValidationParams(unique bool) validations.ValidationParams {
7379
return params
7480
}
7581

82+
func getDockerScanTestResults() *results.SecurityCommandResults {
83+
cmdResults := results.NewCommandResults(utils.DockerImage)
84+
85+
return cmdResults
86+
}
87+
7688
func TestConvertResults(t *testing.T) {
7789
auditInputResults := testUtils.ReadCmdScanResults(t, filepath.Join(testDataDir, "audit", "audit_results.json"))
7890
dockerScanInputResults := testUtils.ReadCmdScanResults(t, filepath.Join(testDataDir, "dockerscan", "docker_results.json"))

‎utils/results/conversion/simplejsonparser/simplejsonparser.go‎

Lines changed: 26 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -72,13 +72,11 @@ func (sjc *CmdResultsSimpleJsonConverter) ParseScaIssues(target results.ScanTarg
7272
if sjc.current.Statuses.ScaStatusCode == nil || *sjc.current.Statuses.ScaStatusCode == 0 {
7373
sjc.current.Statuses.ScaStatusCode = &scaResponse.StatusCode
7474
}
75-
76-
for _, applicabilityScanResult := range applicableScan {
75+
for _, applicableScan := range applicableScan {
7776
if sjc.current.Statuses.ApplicabilityStatusCode == nil || *sjc.current.Statuses.ApplicabilityStatusCode == 0 {
78-
sjc.current.Statuses.ApplicabilityStatusCode = &applicabilityScanResult.StatusCode
77+
sjc.current.Statuses.ApplicabilityStatusCode = &applicableScan.StatusCode
7978
}
8079
}
81-
8280
if violations {
8381
err = sjc.parseScaViolations(target, scaResponse.Scan, results.ScanResultsToRuns(applicableScan)...)
8482
} else {
@@ -209,7 +207,7 @@ func PrepareSimpleJsonViolations(target results.ScanTarget, scaResponse services
209207
scaResponse.Violations,
210208
jasEntitled,
211209
applicabilityRuns,
212-
addSimpleJsonSecurityViolation(&securityViolationsRows, pretty),
210+
addSimpleJsonSecurityViolation(target, &securityViolationsRows, pretty),
213211
addSimpleJsonLicenseViolation(&licenseViolationsRows, pretty),
214212
addSimpleJsonOperationalRiskViolation(&operationalRiskViolationsRows, pretty),
215213
)
@@ -223,13 +221,17 @@ func PrepareSimpleJsonVulnerabilities(target results.ScanTarget, scaResponse ser
223221
scaResponse.Vulnerabilities,
224222
entitledForJas,
225223
applicabilityRuns,
226-
addSimpleJsonVulnerability(&vulnerabilitiesRows, pretty),
224+
addSimpleJsonVulnerability(target, &vulnerabilitiesRows, pretty),
227225
)
228226
return vulnerabilitiesRows, err
229227
}
230228

231-
func addSimpleJsonVulnerability(vulnerabilitiesRows *[]formats.VulnerabilityOrViolationRow, pretty bool) results.ParseScaVulnerabilityFunc {
229+
func addSimpleJsonVulnerability(target results.ScanTarget, vulnerabilitiesRows *[]formats.VulnerabilityOrViolationRow, pretty bool) results.ParseScaVulnerabilityFunc {
232230
return func(vulnerability services.Vulnerability, cves []formats.CveRow, applicabilityStatus jasutils.ApplicabilityStatus, severity severityutils.Severity, impactedPackagesName, impactedPackagesVersion, impactedPackagesType string, fixedVersion []string, directComponents []formats.ComponentRow, impactPaths [][]formats.ComponentRow) error {
231+
tech := target.Technology
232+
if tech == "" {
233+
tech = techutils.Technology(impactedPackagesType)
234+
}
233235
*vulnerabilitiesRows = append(*vulnerabilitiesRows,
234236
formats.VulnerabilityOrViolationRow{
235237
Summary: vulnerability.Summary,
@@ -246,16 +248,20 @@ func addSimpleJsonVulnerability(vulnerabilitiesRows *[]formats.VulnerabilityOrVi
246248
References: vulnerability.References,
247249
JfrogResearchInformation: convertJfrogResearchInformation(vulnerability.ExtendedInformation),
248250
ImpactPaths: impactPaths,
249-
Technology: techutils.Technology(vulnerability.Technology),
251+
Technology: tech,
250252
Applicable: applicabilityStatus.ToString(pretty),
251253
},
252254
)
253255
return nil
254256
}
255257
}
256258

257-
func addSimpleJsonSecurityViolation(securityViolationsRows *[]formats.VulnerabilityOrViolationRow, pretty bool) results.ParseScaViolationFunc {
259+
func addSimpleJsonSecurityViolation(target results.ScanTarget, securityViolationsRows *[]formats.VulnerabilityOrViolationRow, pretty bool) results.ParseScaViolationFunc {
258260
return func(violation services.Violation, cves []formats.CveRow, applicabilityStatus jasutils.ApplicabilityStatus, severity severityutils.Severity, impactedPackagesName, impactedPackagesVersion, impactedPackagesType string, fixedVersion []string, directComponents []formats.ComponentRow, impactPaths [][]formats.ComponentRow) error {
261+
tech := target.Technology
262+
if tech == "" {
263+
tech = techutils.Technology(impactedPackagesType)
264+
}
259265
*securityViolationsRows = append(*securityViolationsRows,
260266
formats.VulnerabilityOrViolationRow{
261267
Summary: violation.Summary,
@@ -276,7 +282,7 @@ func addSimpleJsonSecurityViolation(securityViolationsRows *[]formats.Vulnerabil
276282
References: violation.References,
277283
JfrogResearchInformation: convertJfrogResearchInformation(violation.ExtendedInformation),
278284
ImpactPaths: impactPaths,
279-
Technology: techutils.Technology(violation.Technology),
285+
Technology: tech,
280286
Applicable: applicabilityStatus.ToString(pretty),
281287
},
282288
)
@@ -374,23 +380,22 @@ func addSimpleJsonLicense(licenseViolationsRows *[]formats.LicenseRow) results.P
374380
func PrepareSimpleJsonJasIssues(entitledForJas, pretty bool, jasIssues ...*sarif.Run) ([]formats.SourceCodeRow, error) {
375381
var rows []formats.SourceCodeRow
376382
err := results.ApplyHandlerToJasIssues(jasIssues, entitledForJas, func(run *sarif.Run, rule *sarif.ReportingDescriptor, severity severityutils.Severity, result *sarif.Result, location *sarif.Location) error {
377-
scannerDescription := ""
378-
if rule != nil {
379-
scannerDescription = sarifutils.GetRuleFullDescription(rule)
380-
}
381383
rows = append(rows,
382384
formats.SourceCodeRow{
383-
RuleId: sarifutils.GetResultRuleId(result),
384-
IssueId: sarifutils.GetResultIssueId(result),
385-
CWE: sarifutils.GetRuleCWE(rule),
385+
ScannerInfo: formats.ScannerInfo{
386+
RuleId: sarifutils.GetResultRuleId(result),
387+
Cwe: sarifutils.GetRuleCWE(rule),
388+
ScannerDescription: sarifutils.GetRuleFullDescription(rule),
389+
ScannerShortDescription: sarifutils.GetRuleShortDescription(rule),
390+
},
386391
ViolationContext: formats.ViolationContext{
387392
Watch: sarifutils.GetResultWatches(result),
393+
IssueId: sarifutils.GetResultIssueId(result),
388394
Policies: sarifutils.GetResultPolicies(result),
389395
},
390-
SeverityDetails: severityutils.GetAsDetails(severity, jasutils.Applicable, pretty),
391-
Finding: sarifutils.GetResultMsgText(result),
392-
ScannerDescription: scannerDescription,
393-
Fingerprint: sarifutils.GetResultFingerprint(result),
396+
SeverityDetails: severityutils.GetAsDetails(severity, jasutils.Applicable, pretty),
397+
Finding: sarifutils.GetResultMsgText(result),
398+
Fingerprint: sarifutils.GetResultFingerprint(result),
394399
Location: formats.Location{
395400
File: sarifutils.GetRelativeLocationFileName(location, run.Invocations),
396401
StartLine: sarifutils.GetLocationStartLine(location),

‎utils/results/results.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -503,12 +503,14 @@ func (jsr *JasScansResults) HasInformation() bool {
503503
}
504504

505505
func (jsr *JasScansResults) HasInformationByType(scanType jasutils.JasScanType) bool {
506+
if scanType == jasutils.Applicability && len(jsr.ApplicabilityScanResults) > 0 {
507+
return true
508+
}
506509
for _, run := range jsr.GetVulnerabilitiesResults(scanType) {
507510
if len(run.Results) > 0 {
508511
return true
509512
}
510513
}
511-
512514
for _, run := range jsr.GetViolationsResults(scanType) {
513515
if len(run.Results) > 0 {
514516
return true

‎utils/techutils/techutils.go‎

Lines changed: 0 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -421,29 +421,6 @@ func getDirNoTechList(technologiesDetected map[Technology]map[string][]string, d
421421
// If all children exists in childNoTechList, add only the parent directory to NoTech
422422
noTechList = []string{dir}
423423
}
424-
425-
// for _, techDirs := range technologiesDetected {
426-
// if _, exist := techDirs[dir]; exist {
427-
// // The directory is already mapped to a technology, no need to add the dir or its sub directories to NoTech
428-
// break
429-
// }
430-
// for _, child := range children {
431-
// childNoTechList := getDirNoTechList(technologiesDetected, child, dirsList)
432-
// }
433-
434-
// if len(children) == 0 {
435-
// // No children directories, add the directory to NoTech
436-
// childNoTechList = append(childNoTechList, dir)
437-
// break
438-
// }
439-
// for _, child := range children {
440-
// childNoTechList = append(childNoTechList, getDirNoTechList(technologiesDetected, child, dirsList)...)
441-
// }
442-
// // If all children exists in childNoTechList, add only the parent directory to NoTech
443-
// if len(children) == len(childNoTechList) {
444-
// childNoTechList = []string{dir}
445-
// }
446-
// }
447424
return
448425
}
449426

@@ -456,58 +433,6 @@ func getDirChildren(dir string, dirsList []string) (children []string) {
456433
return
457434
}
458435

459-
// func addNoTechIfNeeded(technologiesDetected map[Technology]map[string][]string, path, excludePathPattern string) (finalMap map[Technology]map[string][]string, err error) {
460-
// finalMap = technologiesDetected
461-
// noTechMap := map[string][]string{}
462-
// // TODO: not only direct, need to see if multiple levels of directories are missing technology indicators
463-
// // if all directories in are found no need for anything else,
464-
// // if one missing need to add it to NoTech
465-
// // if not one detected add only parent directory no need for each directory
466-
// directories, err := getDirectDirectories(path, excludePathPattern)
467-
// if err != nil {
468-
// return
469-
// }
470-
// for _, dir := range directories {
471-
// // Check if the directory is already mapped to a technology
472-
// isMapped := false
473-
// for _, techDirs := range finalMap {
474-
// if _, exist := techDirs[dir]; exist {
475-
// isMapped = true
476-
// break
477-
// }
478-
// }
479-
// if !isMapped {
480-
// // Add the directory to NoTech (no indicators/descriptors were found)
481-
// noTechMap[dir] = []string{}
482-
// }
483-
// }
484-
// if len(technologiesDetected) == 0 || len(noTechMap) > 0 {
485-
// // no technologies detected at all (add NoTech without any directories) or some directories were added to NoTech
486-
// finalMap[NoTech] = noTechMap
487-
// }
488-
// return
489-
// }
490-
491-
// func getDirectDirectories(path, excludePathPattern string) (directories []string, err error) {
492-
// // Get all files and directories in the path, not recursive
493-
// filesOrDirsInPath, err := fspatterns.ListFiles(path, false, true, true, true, excludePathPattern)
494-
// if err != nil {
495-
// return
496-
// }
497-
// // Filter to directories only
498-
// for _, potentialDir := range filesOrDirsInPath {
499-
// isDir, e := fileutils.IsDirExists(potentialDir, true)
500-
// if e != nil {
501-
// err = errors.Join(err, fmt.Errorf("failed to check if %s is a directory: %w", potentialDir, e))
502-
// continue
503-
// }
504-
// if isDir {
505-
// directories = append(directories, potentialDir)
506-
// }
507-
// }
508-
// return
509-
// }
510-
511436
// Map files to relevant working directories according to the technologies' indicators/descriptors and requested descriptors.
512437
// files: The file paths to map.
513438
// requestedDescriptors: Special requested descriptors (for example in Pip requirement.txt can have different path) for each technology.

0 commit comments

Comments
 (0)