Skip to content

Commit ac2aec2

Browse files
attiasasattiasas
committed
Dont change central config exclude pattern in JAS scans
1 parent b192fc8 commit ac2aec2

File tree

9 files changed

+43
-24
lines changed

9 files changed

+43
-24
lines changed

‎jas/applicability/applicabilitymanager.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ func newApplicabilityScanManager(directDependenciesCves, indirectDependenciesCve
8888
}
8989

9090
func (asm *ApplicabilityScanManager) Run(module jfrogappsconfig.Module) (vulnerabilitiesSarifRuns []*sarif.Run, violationsSarifRuns []*sarif.Run, err error) {
91-
if err = asm.createConfigFile(module, append(asm.scanner.Exclusions, asm.scanner.ScannersExclusions.ContextualAnalysisExcludePatterns...)...); err != nil {
91+
if err = asm.createConfigFile(module, asm.scanner.ScannersExclusions.ContextualAnalysisExcludePatterns, asm.scanner.Exclusions...); err != nil {
9292
return
9393
}
9494
if err = asm.runAnalyzerManager(); err != nil {
@@ -116,12 +116,12 @@ type scanConfiguration struct {
116116
ScanType string `yaml:"scantype"`
117117
}
118118

119-
func (asm *ApplicabilityScanManager) createConfigFile(module jfrogappsconfig.Module, exclusions ...string) error {
119+
func (asm *ApplicabilityScanManager) createConfigFile(module jfrogappsconfig.Module, centralConfigExclusions []string, exclusions ...string) error {
120120
roots, err := jas.GetSourceRoots(module, nil)
121121
if err != nil {
122122
return err
123123
}
124-
excludePatterns := jas.GetExcludePatterns(module, nil, exclusions...)
124+
excludePatterns := jas.GetExcludePatterns(module, nil, centralConfigExclusions, exclusions...)
125125
if asm.thirdPartyScan {
126126
log.Info("Including node modules folder in applicability scan")
127127
excludePatterns = removeElementFromSlice(excludePatterns, utils.NodeModulesPattern)

‎jas/applicability/applicabilitymanager_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -175,7 +175,7 @@ func TestCreateConfigFile_VerifyFileWasCreated(t *testing.T) {
175175

176176
currWd, err := coreutils.GetWorkingDirectory()
177177
assert.NoError(t, err)
178-
err = applicabilityManager.createConfigFile(jfrogappsconfig.Module{SourceRoot: currWd})
178+
err = applicabilityManager.createConfigFile(jfrogappsconfig.Module{SourceRoot: currWd}, []string{})
179179
assert.NoError(t, err)
180180

181181
defer func() {

‎jas/common.go‎

Lines changed: 27 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -420,20 +420,24 @@ func GetSourceRoots(module jfrogappsconfig.Module, scanner *jfrogappsconfig.Scan
420420
return roots, nil
421421
}
422422

423-
func GetExcludePatterns(module jfrogappsconfig.Module, scanner *jfrogappsconfig.Scanner, exclusions ...string) []string {
424-
if len(exclusions) > 0 {
425-
return filterUniqueAndConvertToFilesExcludePatterns(exclusions)
423+
func GetExcludePatterns(module jfrogappsconfig.Module, scanner *jfrogappsconfig.Scanner, centralConfigExclusions []string, cliExclusions ...string) []string {
424+
uniqueExcludePatterns := datastructures.MakeSet[string]()
425+
if len(cliExclusions) > 0 || len(centralConfigExclusions) > 0 {
426+
// Adding exclusions from CLI requires to convert them to file exclude patterns
427+
uniqueExcludePatterns.AddElements(convertToFilesExcludePatterns(cliExclusions)...)
428+
// Adding exclusions from centralized config, no need to convert
429+
uniqueExcludePatterns.AddElements(centralConfigExclusions...)
430+
return uniqueExcludePatterns.ToSlice()
426431
}
427-
428432
// Adding exclusions from jfrog-apps-config IF no exclusions provided from other source (flags, env vars, config profile)
429-
excludePatterns := module.ExcludePatterns
433+
uniqueExcludePatterns.AddElements(module.ExcludePatterns...)
430434
if scanner != nil {
431-
excludePatterns = append(excludePatterns, scanner.ExcludePatterns...)
435+
uniqueExcludePatterns.AddElements(scanner.ExcludePatterns...)
432436
}
433-
if len(excludePatterns) == 0 {
437+
if uniqueExcludePatterns.Size() == 0 {
434438
return utils.DefaultJasExcludePatterns
435439
}
436-
return excludePatterns
440+
return uniqueExcludePatterns.ToSlice()
437441
}
438442

439443
// This function convert every exclude pattern to a file exclude pattern form.
@@ -453,6 +457,21 @@ func filterUniqueAndConvertToFilesExcludePatterns(excludePatterns []string) []st
453457
return uniqueExcludePatterns.ToSlice()
454458
}
455459

460+
// This function convert every exclude pattern to a file exclude pattern form.
461+
// Checks are being made since some of the exclude patters we get here might already be in a file exclude pattern
462+
func convertToFilesExcludePatterns(excludePatterns []string) (converted []string) {
463+
for _, excludePattern := range excludePatterns {
464+
if !strings.HasPrefix(excludePattern, "**/") {
465+
excludePattern = "**/" + excludePattern
466+
}
467+
if !strings.HasSuffix(excludePattern, "/**") {
468+
excludePattern += "/**"
469+
}
470+
converted = append(converted, excludePattern)
471+
}
472+
return converted
473+
}
474+
456475
func CheckForSecretValidation(xrayManager *xray.XrayServicesManager, xrayVersion string, validateSecrets bool) bool {
457476
dynamicTokenVersionMismatchErr := goclientutils.ValidateMinimumVersion(goclientutils.Xray, xrayVersion, jasutils.DynamicTokenValidationMinXrayVersion)
458477
if dynamicTokenVersionMismatchErr != nil {

‎jas/common_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ func TestGetExcludePatterns(t *testing.T) {
127127
for _, testCase := range getExcludePatternsCases {
128128
t.Run("", func(t *testing.T) {
129129
scanner := testCase.scanner
130-
actualExcludePatterns := GetExcludePatterns(module, scanner)
130+
actualExcludePatterns := GetExcludePatterns(module, scanner, []string{})
131131
if scanner == nil {
132132
assert.ElementsMatch(t, module.ExcludePatterns, actualExcludePatterns)
133133
return

‎jas/iac/iacscanner.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ func newIacScanManager(scanner *jas.JasScanner, scannerTempDir string, resultsTo
7070
}
7171

7272
func (iac *IacScanManager) Run(module jfrogappsconfig.Module) (vulnerabilitiesSarifRuns []*sarif.Run, violationsSarifRuns []*sarif.Run, err error) {
73-
if err = iac.createConfigFile(module, append(iac.scanner.Exclusions, iac.scanner.ScannersExclusions.IacExcludePatterns...)...); err != nil {
73+
if err = iac.createConfigFile(module, iac.scanner.ScannersExclusions.IacExcludePatterns, iac.scanner.Exclusions...); err != nil {
7474
return
7575
}
7676
if err = iac.runAnalyzerManager(); err != nil {
@@ -91,7 +91,7 @@ type iacScanConfiguration struct {
9191
SkippedDirs []string `yaml:"skipped-folders"`
9292
}
9393

94-
func (iac *IacScanManager) createConfigFile(module jfrogappsconfig.Module, exclusions ...string) error {
94+
func (iac *IacScanManager) createConfigFile(module jfrogappsconfig.Module, centralConfigExclusions []string, exclusions ...string) error {
9595
roots, err := jas.GetSourceRoots(module, module.Scanners.Iac)
9696
if err != nil {
9797
return err
@@ -103,7 +103,7 @@ func (iac *IacScanManager) createConfigFile(module jfrogappsconfig.Module, exclu
103103
Output: iac.resultsFileName,
104104
PathToResultsToCompare: iac.resultsToCompareFileName,
105105
Type: iacScannerType,
106-
SkippedDirs: jas.GetExcludePatterns(module, module.Scanners.Iac, exclusions...),
106+
SkippedDirs: jas.GetExcludePatterns(module, module.Scanners.Iac, centralConfigExclusions, exclusions...),
107107
},
108108
},
109109
}

‎jas/iac/iacscanner_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ func TestIacScan_CreateConfigFile_VerifyFileWasCreated(t *testing.T) {
6767

6868
currWd, err := coreutils.GetWorkingDirectory()
6969
assert.NoError(t, err)
70-
err = iacScanManager.createConfigFile(jfrogappsconfig.Module{SourceRoot: currWd})
70+
err = iacScanManager.createConfigFile(jfrogappsconfig.Module{SourceRoot: currWd}, []string{})
7171

7272
defer func() {
7373
err = os.Remove(iacScanManager.configFileName)

‎jas/sast/sastscanner.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ func newSastScanManager(scanner *jas.JasScanner, scannerTempDir string, signedDe
6969
}
7070

7171
func (ssm *SastScanManager) Run(module jfrogappsconfig.Module) (vulnerabilitiesSarifRuns []*sarif.Run, violationsSarifRuns []*sarif.Run, err error) {
72-
if err = ssm.createConfigFile(module, ssm.signedDescriptions, append(ssm.scanner.Exclusions, ssm.scanner.ScannersExclusions.SastExcludePatterns...)...); err != nil {
72+
if err = ssm.createConfigFile(module, ssm.signedDescriptions, ssm.scanner.ScannersExclusions.SastExcludePatterns, ssm.scanner.Exclusions...); err != nil {
7373
return
7474
}
7575
if err = ssm.runAnalyzerManager(filepath.Dir(ssm.scanner.AnalyzerManager.AnalyzerManagerFullPath)); err != nil {
@@ -104,7 +104,7 @@ type sastParameters struct {
104104
SignedDescriptions bool `yaml:"signed_descriptions,omitempty"`
105105
}
106106

107-
func (ssm *SastScanManager) createConfigFile(module jfrogappsconfig.Module, signedDescriptions bool, exclusions ...string) error {
107+
func (ssm *SastScanManager) createConfigFile(module jfrogappsconfig.Module, signedDescriptions bool, centralConfigExclusions []string, exclusions ...string) error {
108108
sastScanner := module.Scanners.Sast
109109
if sastScanner == nil {
110110
sastScanner = &jfrogappsconfig.SastScanner{}
@@ -125,7 +125,7 @@ func (ssm *SastScanManager) createConfigFile(module jfrogappsconfig.Module, sign
125125
SastParameters: sastParameters{
126126
SignedDescriptions: signedDescriptions,
127127
},
128-
ExcludePatterns: jas.GetExcludePatterns(module, &sastScanner.Scanner, exclusions...),
128+
ExcludePatterns: jas.GetExcludePatterns(module, &sastScanner.Scanner, centralConfigExclusions, exclusions...),
129129
UserRules: ssm.sastRules,
130130
},
131131
},

‎jas/secrets/secretsscanner.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ func newSecretsScanManager(scanner *jas.JasScanner, scanType SecretsScanType, sc
7575
}
7676

7777
func (ssm *SecretScanManager) Run(module jfrogappsconfig.Module) (vulnerabilitiesSarifRuns []*sarif.Run, violationsSarifRuns []*sarif.Run, err error) {
78-
if err = ssm.createConfigFile(module, append(ssm.scanner.Exclusions, ssm.scanner.ScannersExclusions.SecretsExcludePatterns...)...); err != nil {
78+
if err = ssm.createConfigFile(module, ssm.scanner.ScannersExclusions.SecretsExcludePatterns, ssm.scanner.Exclusions...); err != nil {
7979
return
8080
}
8181
if err = ssm.runAnalyzerManager(); err != nil {
@@ -96,7 +96,7 @@ type secretsScanConfiguration struct {
9696
SkippedDirs []string `yaml:"skipped-folders"`
9797
}
9898

99-
func (s *SecretScanManager) createConfigFile(module jfrogappsconfig.Module, exclusions ...string) error {
99+
func (s *SecretScanManager) createConfigFile(module jfrogappsconfig.Module, centralConfigExclusions []string, exclusions ...string) error {
100100
roots, err := jas.GetSourceRoots(module, module.Scanners.Secrets)
101101
if err != nil {
102102
return err
@@ -108,7 +108,7 @@ func (s *SecretScanManager) createConfigFile(module jfrogappsconfig.Module, excl
108108
Output: s.resultsFileName,
109109
PathToResultsToCompare: s.resultsToCompareFileName,
110110
Type: string(s.scanType),
111-
SkippedDirs: jas.GetExcludePatterns(module, module.Scanners.Secrets, exclusions...),
111+
SkippedDirs: jas.GetExcludePatterns(module, module.Scanners.Secrets, centralConfigExclusions, exclusions...),
112112
},
113113
},
114114
}

‎jas/secrets/secretsscanner_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ func TestSecretsScan_CreateConfigFile_VerifyFileWasCreated(t *testing.T) {
6262

6363
currWd, err := coreutils.GetWorkingDirectory()
6464
assert.NoError(t, err)
65-
err = secretScanManager.createConfigFile(jfrogappsconfig.Module{SourceRoot: currWd})
65+
err = secretScanManager.createConfigFile(jfrogappsconfig.Module{SourceRoot: currWd}, []string{})
6666
assert.NoError(t, err)
6767

6868
defer func() {

0 commit comments

Comments
 (0)