Skip to content

Commit 8e732ac

Browse files
kerenr-jfrogkerenr-jfrog
authored
Merge branch 'jfrog:main' into fix-audit-command-usage-of-exclusions-flag
2 parents 30ec138 + 24a89d1 commit 8e732ac

File tree

15 files changed

+54
-36
lines changed

15 files changed

+54
-36
lines changed

‎commands/audit/audit.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"fmt"
66

77
jfrogappsconfig "github.com/jfrog/jfrog-apps-config/go"
8+
"github.com/jfrog/jfrog-cli-core/v2/common/format"
89
"github.com/jfrog/jfrog-cli-core/v2/utils/config"
910
"github.com/jfrog/jfrog-cli-core/v2/utils/coreutils"
1011
"github.com/jfrog/jfrog-cli-security/commands/audit/sca"
@@ -303,6 +304,7 @@ func downloadAnalyzerManagerAndRunScanners(auditParallelRunner *utils.SecurityPa
303304
DirectDependencies: auditParams.DirectDependencies(),
304305
ThirdPartyApplicabilityScan: auditParams.thirdPartyApplicabilityScan,
305306
ApplicableScanType: applicability.ApplicabilityScannerType,
307+
SignedDescriptions: auditParams.OutputFormat() == format.Sarif,
306308
ScanResults: scan,
307309
TargetOutputDir: auditParams.scanResultsOutputDir,
308310
}

‎go.mod‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,8 @@ require (
1010
github.com/jfrog/froggit-go v1.16.2
1111
github.com/jfrog/gofrog v1.7.6
1212
github.com/jfrog/jfrog-apps-config v1.0.1
13-
github.com/jfrog/jfrog-cli-core/v2 v2.56.3
14-
github.com/jfrog/jfrog-client-go v1.47.2
13+
github.com/jfrog/jfrog-cli-core/v2 v2.56.4
14+
github.com/jfrog/jfrog-client-go v1.47.3
1515
github.com/magiconair/properties v1.8.7
1616
github.com/owenrumney/go-sarif/v2 v2.3.0
1717
github.com/stretchr/testify v1.9.0

‎go.sum‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -130,10 +130,10 @@ github.com/jfrog/gofrog v1.7.6 h1:QmfAiRzVyaI7JYGsB7cxfAJePAZTzFz0gRWZSE27c6s=
130130
github.com/jfrog/gofrog v1.7.6/go.mod h1:ntr1txqNOZtHplmaNd7rS4f8jpA5Apx8em70oYEe7+4=
131131
github.com/jfrog/jfrog-apps-config v1.0.1 h1:mtv6k7g8A8BVhlHGlSveapqf4mJfonwvXYLipdsOFMY=
132132
github.com/jfrog/jfrog-apps-config v1.0.1/go.mod h1:8AIIr1oY9JuH5dylz2S6f8Ym2MaadPLR6noCBO4C22w=
133-
github.com/jfrog/jfrog-cli-core/v2 v2.56.3 h1:9ZZ7TGpobk4XShPzrHkRGfpYzs1w0rg7Hqtfg51iNRg=
134-
github.com/jfrog/jfrog-cli-core/v2 v2.56.3/go.mod h1:xL9b2DrH5FemiTuk2bfUBfbQYC/RvpBkPxxV6XxssXs=
135-
github.com/jfrog/jfrog-client-go v1.47.2 h1:Lu+2n4EU+MzNfotV1VOvF/ZQIWsQJg11Z4YSVhumFy0=
136-
github.com/jfrog/jfrog-client-go v1.47.2/go.mod h1:fx2fq5XwZ7e2pzpBB9pXsP8+ZdKLB8g+A6fjGU6F2XI=
133+
github.com/jfrog/jfrog-cli-core/v2 v2.56.4 h1:LqByz2FmVTDQm/u2xGeTL6O8Hs9JadaTj3QMpel9ZwY=
134+
github.com/jfrog/jfrog-cli-core/v2 v2.56.4/go.mod h1:AwQ9WuOA64g3torX9K5kP0xFAAbchfRInhZwbufoW+Q=
135+
github.com/jfrog/jfrog-client-go v1.47.3 h1:99/JSSgU0rvnM2zWYos2n+Gz1IYLCUoIorE4Xco+Dew=
136+
github.com/jfrog/jfrog-client-go v1.47.3/go.mod h1:NepfaidmK/xiKsVC+0Ur9sANOqL6io8Y7pSaCau7J6o=
137137
github.com/k0kubun/colorstring v0.0.0-20150214042306-9440f1994b88/go.mod h1:3w7q1U84EfirKl04SVQ/s7nPm1ZPhiXd34z40TNz36k=
138138
github.com/k0kubun/pp v3.0.1+incompatible/go.mod h1:GWse8YhT0p8pT4ir3ZgBbfZild3tgzSScAn6HmfYukg=
139139
github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=

‎jas/analyzermanager.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ import (
2424
const (
2525
ApplicabilityFeatureId = "contextual_analysis"
2626
AnalyzerManagerZipName = "analyzerManager.zip"
27-
defaultAnalyzerManagerVersion = "1.9.7"
27+
defaultAnalyzerManagerVersion = "1.9.9"
2828
analyzerManagerDownloadPath = "xsc-gen-exe-analyzer-manager-local/v1"
2929
analyzerManagerDirName = "analyzerManager"
3030
analyzerManagerExecutableName = "analyzerManager"

‎jas/runner/jasrunner.go‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -32,11 +32,14 @@ type JasRunnerParams struct {
3232

3333
ScansToPreform []utils.SubScanType
3434

35+
// Secret scan flags
3536
SecretsScanType secrets.SecretsScanType
36-
37+
// Contextual Analysis scan flags
38+
ApplicableScanType applicability.ApplicabilityScanType
3739
DirectDependencies *[]string
3840
ThirdPartyApplicabilityScan bool
39-
ApplicableScanType applicability.ApplicabilityScanType
41+
// SAST scan flags
42+
SignedDescriptions bool
4043

4144
ScanResults *results.TargetResults
4245
TargetOutputDir string
@@ -68,7 +71,7 @@ func AddJasScannersTasks(params JasRunnerParams) (err error) {
6871
if err = addJasScanTaskForModuleIfNeeded(params, utils.IacScan, runIacScan(params.Runner, params.Scanner, params.ScanResults.JasResults, params.Module, params.TargetOutputDir)); err != nil {
6972
return
7073
}
71-
return addJasScanTaskForModuleIfNeeded(params, utils.SastScan, runSastScan(params.Runner, params.Scanner, params.ScanResults.JasResults, params.Module, params.TargetOutputDir))
74+
return addJasScanTaskForModuleIfNeeded(params, utils.SastScan, runSastScan(params.Runner, params.Scanner, params.ScanResults.JasResults, params.Module, params.TargetOutputDir, params.SignedDescriptions))
7275
}
7376

7477
func addJasScanTaskForModuleIfNeeded(params JasRunnerParams, subScan utils.SubScanType, task parallel.TaskFunc) (err error) {
@@ -157,12 +160,12 @@ func runIacScan(securityParallelRunner *utils.SecurityParallelRunner, scanner *j
157160
}
158161

159162
func runSastScan(securityParallelRunner *utils.SecurityParallelRunner, scanner *jas.JasScanner, extendedScanResults *results.JasScansResults,
160-
module jfrogappsconfig.Module, scansOutputDir string) parallel.TaskFunc {
163+
module jfrogappsconfig.Module, scansOutputDir string, signedDescriptions bool) parallel.TaskFunc {
161164
return func(threadId int) (err error) {
162165
defer func() {
163166
securityParallelRunner.JasScannersWg.Done()
164167
}()
165-
results, err := sast.RunSastScan(scanner, module, threadId)
168+
results, err := sast.RunSastScan(scanner, module, signedDescriptions, threadId)
166169
if err != nil {
167170
return fmt.Errorf("%s %s", clientutils.GetLogMsgPrefix(threadId, false), err.Error())
168171
}

‎jas/sast/sastscanner.go‎

Lines changed: 24 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -23,16 +23,17 @@ const (
2323
type SastScanManager struct {
2424
sastScannerResults []*sarif.Run
2525
scanner *jas.JasScanner
26+
signedDescriptions bool
2627
configFileName string
2728
resultsFileName string
2829
}
2930

30-
func RunSastScan(scanner *jas.JasScanner, module jfrogappsconfig.Module, threadId int) (results []*sarif.Run, err error) {
31+
func RunSastScan(scanner *jas.JasScanner, module jfrogappsconfig.Module, signedDescriptions bool, threadId int) (results []*sarif.Run, err error) {
3132
var scannerTempDir string
3233
if scannerTempDir, err = jas.CreateScannerTempDirectory(scanner, jasutils.Sast.String()); err != nil {
3334
return
3435
}
35-
sastScanManager := newSastScanManager(scanner, scannerTempDir)
36+
sastScanManager := newSastScanManager(scanner, scannerTempDir, signedDescriptions)
3637
log.Info(clientutils.GetLogMsgPrefix(threadId, false) + "Running SAST scan...")
3738
if err = sastScanManager.scanner.Run(sastScanManager, module); err != nil {
3839
err = jas.ParseAnalyzerManagerError(jasutils.Sast, err)
@@ -45,16 +46,17 @@ func RunSastScan(scanner *jas.JasScanner, module jfrogappsconfig.Module, threadI
4546
return
4647
}
4748

48-
func newSastScanManager(scanner *jas.JasScanner, scannerTempDir string) (manager *SastScanManager) {
49+
func newSastScanManager(scanner *jas.JasScanner, scannerTempDir string, signedDescriptions bool) (manager *SastScanManager) {
4950
return &SastScanManager{
5051
sastScannerResults: []*sarif.Run{},
5152
scanner: scanner,
53+
signedDescriptions: signedDescriptions,
5254
configFileName: filepath.Join(scannerTempDir, "config.yaml"),
5355
resultsFileName: filepath.Join(scannerTempDir, "results.sarif")}
5456
}
5557

5658
func (ssm *SastScanManager) Run(module jfrogappsconfig.Module) (err error) {
57-
if err = ssm.createConfigFile(module, ssm.scanner.Exclusions...); err != nil {
59+
if err = ssm.createConfigFile(module, ssm.signedDescriptions, ssm.scanner.Exclusions...); err != nil {
5860
return
5961
}
6062
if err = ssm.runAnalyzerManager(filepath.Dir(ssm.scanner.AnalyzerManager.AnalyzerManagerFullPath)); err != nil {
@@ -74,14 +76,19 @@ type sastScanConfig struct {
7476
}
7577

7678
type scanConfiguration struct {
77-
Roots []string `yaml:"roots,omitempty"`
78-
Type string `yaml:"type,omitempty"`
79-
Language string `yaml:"language,omitempty"`
80-
ExcludePatterns []string `yaml:"exclude_patterns,omitempty"`
81-
ExcludedRules []string `yaml:"excluded-rules,omitempty"`
79+
Roots []string `yaml:"roots,omitempty"`
80+
Type string `yaml:"type,omitempty"`
81+
Language string `yaml:"language,omitempty"`
82+
ExcludePatterns []string `yaml:"exclude_patterns,omitempty"`
83+
ExcludedRules []string `yaml:"excluded-rules,omitempty"`
84+
SastParameters sastParameters `yaml:"sast_parameters,omitempty"`
8285
}
8386

84-
func (ssm *SastScanManager) createConfigFile(module jfrogappsconfig.Module, exclusions ...string) error {
87+
type sastParameters struct {
88+
SignedDescriptions bool `yaml:"signed_descriptions,omitempty"`
89+
}
90+
91+
func (ssm *SastScanManager) createConfigFile(module jfrogappsconfig.Module, signedDescriptions bool, exclusions ...string) error {
8592
sastScanner := module.Scanners.Sast
8693
if sastScanner == nil {
8794
sastScanner = &jfrogappsconfig.SastScanner{}
@@ -93,10 +100,13 @@ func (ssm *SastScanManager) createConfigFile(module jfrogappsconfig.Module, excl
93100
configFileContent := sastScanConfig{
94101
Scans: []scanConfiguration{
95102
{
96-
Type: sastScannerType,
97-
Roots: roots,
98-
Language: sastScanner.Language,
99-
ExcludedRules: sastScanner.ExcludedRules,
103+
Type: sastScannerType,
104+
Roots: roots,
105+
Language: sastScanner.Language,
106+
ExcludedRules: sastScanner.ExcludedRules,
107+
SastParameters: sastParameters{
108+
SignedDescriptions: signedDescriptions,
109+
},
100110
ExcludePatterns: jas.GetExcludePatterns(module, &sastScanner.Scanner, exclusions...),
101111
},
102112
},

‎jas/sast/sastscanner_test.go‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,12 @@ func TestNewSastScanManager(t *testing.T) {
1717
jfrogAppsConfigForTest, err := jas.CreateJFrogAppsConfig([]string{"currentDir"})
1818
assert.NoError(t, err)
1919
// Act
20-
sastScanManager := newSastScanManager(scanner, "temoDirPath")
20+
sastScanManager := newSastScanManager(scanner, "temoDirPath", true)
2121

2222
// Assert
2323
if assert.NotNil(t, sastScanManager) {
2424
assert.NotEmpty(t, sastScanManager.configFileName)
25+
assert.True(t, sastScanManager.signedDescriptions)
2526
assert.NotEmpty(t, sastScanManager.resultsFileName)
2627
assert.NotEmpty(t, jfrogAppsConfigForTest.Modules[0].SourceRoot)
2728
assert.Equal(t, &jas.FakeServerDetails, sastScanManager.scanner.ServerDetails)
@@ -35,7 +36,7 @@ func TestSastParseResults_EmptyResults(t *testing.T) {
3536
assert.NoError(t, err)
3637

3738
// Arrange
38-
sastScanManager := newSastScanManager(scanner, "temoDirPath")
39+
sastScanManager := newSastScanManager(scanner, "temoDirPath", true)
3940
sastScanManager.resultsFileName = filepath.Join(jas.GetTestDataPath(), "sast-scan", "no-violations.sarif")
4041

4142
// Act
@@ -57,7 +58,7 @@ func TestSastParseResults_ResultsContainIacViolations(t *testing.T) {
5758
jfrogAppsConfigForTest, err := jas.CreateJFrogAppsConfig([]string{})
5859
assert.NoError(t, err)
5960
// Arrange
60-
sastScanManager := newSastScanManager(scanner, "temoDirPath")
61+
sastScanManager := newSastScanManager(scanner, "temoDirPath", false)
6162
sastScanManager.resultsFileName = filepath.Join(jas.GetTestDataPath(), "sast-scan", "contains-sast-violations.sarif")
6263

6364
// Act

‎tests/testdata/other/sast-scan/contains-sast-violations.sarif‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
{
44
"tool": {
55
"driver": {
6-
"name": "USAF",
6+
"name": "🐸 JFrog SAST",
77
"rules": [
88
{
99
"id": "python-command-injection",

‎tests/testdata/other/sast-scan/no-violations.sarif‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
{
44
"tool": {
55
"driver": {
6-
"name": "USAF",
6+
"name": "🐸 JFrog SAST",
77
"rules": []
88
}
99
},

‎tests/testdata/output/audit/audit_results.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2204,7 +2204,7 @@
22042204
"tool": {
22052205
"driver": {
22062206
"informationUri": "https://docs.jfrog-applications.jfrog.io/jfrog-security-features/sast",
2207-
"name": "USAF",
2207+
"name": "🐸 JFrog SAST",
22082208
"rules": [
22092209
{
22102210
"id": "js-express-without-helmet",

0 commit comments

Comments
 (0)