Skip to content

Commit d3fa233

Browse files
attiasasattiasas
authored
Dont change central config exclude pattern in JAS scans (#623)
1 parent b192fc8 commit d3fa233

File tree

10 files changed

+39
-37
lines changed

10 files changed

+39
-37
lines changed

‎commands/audit/audit_test.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -381,7 +381,7 @@ func TestAuditWithConfigProfile(t *testing.T) {
381381
},
382382
SecretsScannerConfig: services.SecretsScannerConfig{
383383
EnableSecretsScan: true,
384-
ExcludePatterns: []string{"*api_secrets*"},
384+
ExcludePatterns: []string{"**/*api_secrets*/**"},
385385
},
386386
IacScannerConfig: services.IacScannerConfig{
387387
EnableIacScan: false,
@@ -441,7 +441,7 @@ func TestAuditWithConfigProfile(t *testing.T) {
441441
},
442442
SastScannerConfig: services.SastScannerConfig{
443443
EnableSastScan: true,
444-
ExcludePatterns: []string{"*flask_webgoat*"},
444+
ExcludePatterns: []string{"**/*flask_webgoat*/**"},
445445
},
446446
SecretsScannerConfig: services.SecretsScannerConfig{
447447
EnableSecretsScan: false,
@@ -459,7 +459,7 @@ func TestAuditWithConfigProfile(t *testing.T) {
459459
name: "Enable only IaC scanner",
460460
testDirPath: filepath.Join("..", "..", "tests", "testdata", "projects", "jas", "jas"),
461461
configProfile: services.ConfigProfile{
462-
ProfileName: "only-sast",
462+
ProfileName: "only-iac",
463463
Modules: []services.Module{{
464464
ModuleId: 1,
465465
ModuleName: "only-iac-module",
@@ -510,7 +510,7 @@ func TestAuditWithConfigProfile(t *testing.T) {
510510
},
511511
IacScannerConfig: services.IacScannerConfig{
512512
EnableIacScan: true,
513-
ExcludePatterns: []string{"*iac/gcp*"},
513+
ExcludePatterns: []string{"**/*iac/gcp*/**"},
514514
},
515515
},
516516
}},
@@ -570,11 +570,11 @@ func TestAuditWithConfigProfile(t *testing.T) {
570570
},
571571
SastScannerConfig: services.SastScannerConfig{
572572
EnableSastScan: true,
573-
ExcludePatterns: []string{"*flask_webgoat*"},
573+
ExcludePatterns: []string{"**/*flask_webgoat*/**"},
574574
},
575575
SecretsScannerConfig: services.SecretsScannerConfig{
576576
EnableSecretsScan: true,
577-
ExcludePatterns: []string{"*api_secrets*"},
577+
ExcludePatterns: []string{"**/*api_secrets*/**"},
578578
},
579579
IacScannerConfig: services.IacScannerConfig{
580580
EnableIacScan: true,

‎jas/applicability/applicabilitymanager.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ func newApplicabilityScanManager(directDependenciesCves, indirectDependenciesCve
8888
}
8989

9090
func (asm *ApplicabilityScanManager) Run(module jfrogappsconfig.Module) (vulnerabilitiesSarifRuns []*sarif.Run, violationsSarifRuns []*sarif.Run, err error) {
91-
if err = asm.createConfigFile(module, append(asm.scanner.Exclusions, asm.scanner.ScannersExclusions.ContextualAnalysisExcludePatterns...)...); err != nil {
91+
if err = asm.createConfigFile(module, asm.scanner.ScannersExclusions.ContextualAnalysisExcludePatterns, asm.scanner.Exclusions...); err != nil {
9292
return
9393
}
9494
if err = asm.runAnalyzerManager(); err != nil {
@@ -116,12 +116,12 @@ type scanConfiguration struct {
116116
ScanType string `yaml:"scantype"`
117117
}
118118

119-
func (asm *ApplicabilityScanManager) createConfigFile(module jfrogappsconfig.Module, exclusions ...string) error {
119+
func (asm *ApplicabilityScanManager) createConfigFile(module jfrogappsconfig.Module, centralConfigExclusions []string, exclusions ...string) error {
120120
roots, err := jas.GetSourceRoots(module, nil)
121121
if err != nil {
122122
return err
123123
}
124-
excludePatterns := jas.GetExcludePatterns(module, nil, exclusions...)
124+
excludePatterns := jas.GetExcludePatterns(module, nil, centralConfigExclusions, exclusions...)
125125
if asm.thirdPartyScan {
126126
log.Info("Including node modules folder in applicability scan")
127127
excludePatterns = removeElementFromSlice(excludePatterns, utils.NodeModulesPattern)

‎jas/applicability/applicabilitymanager_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -175,7 +175,7 @@ func TestCreateConfigFile_VerifyFileWasCreated(t *testing.T) {
175175

176176
currWd, err := coreutils.GetWorkingDirectory()
177177
assert.NoError(t, err)
178-
err = applicabilityManager.createConfigFile(jfrogappsconfig.Module{SourceRoot: currWd})
178+
err = applicabilityManager.createConfigFile(jfrogappsconfig.Module{SourceRoot: currWd}, []string{})
179179
assert.NoError(t, err)
180180

181181
defer func() {

‎jas/common.go‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -420,37 +420,39 @@ func GetSourceRoots(module jfrogappsconfig.Module, scanner *jfrogappsconfig.Scan
420420
return roots, nil
421421
}
422422

423-
func GetExcludePatterns(module jfrogappsconfig.Module, scanner *jfrogappsconfig.Scanner, exclusions ...string) []string {
424-
if len(exclusions) > 0 {
425-
return filterUniqueAndConvertToFilesExcludePatterns(exclusions)
423+
func GetExcludePatterns(module jfrogappsconfig.Module, scanner *jfrogappsconfig.Scanner, centralConfigExclusions []string, cliExclusions ...string) []string {
424+
uniqueExcludePatterns := datastructures.MakeSet[string]()
425+
if len(cliExclusions) > 0 || len(centralConfigExclusions) > 0 {
426+
// Adding exclusions from CLI requires to convert them to file exclude patterns
427+
uniqueExcludePatterns.AddElements(convertToFilesExcludePatterns(cliExclusions)...)
428+
// Adding exclusions from centralized config, no need to convert
429+
uniqueExcludePatterns.AddElements(centralConfigExclusions...)
430+
return uniqueExcludePatterns.ToSlice()
426431
}
427-
428432
// Adding exclusions from jfrog-apps-config IF no exclusions provided from other source (flags, env vars, config profile)
429-
excludePatterns := module.ExcludePatterns
433+
uniqueExcludePatterns.AddElements(module.ExcludePatterns...)
430434
if scanner != nil {
431-
excludePatterns = append(excludePatterns, scanner.ExcludePatterns...)
435+
uniqueExcludePatterns.AddElements(scanner.ExcludePatterns...)
432436
}
433-
if len(excludePatterns) == 0 {
437+
if uniqueExcludePatterns.Size() == 0 {
434438
return utils.DefaultJasExcludePatterns
435439
}
436-
return excludePatterns
440+
return uniqueExcludePatterns.ToSlice()
437441
}
438442

439443
// This function convert every exclude pattern to a file exclude pattern form.
440444
// Checks are being made since some of the exclude patters we get here might already be in a file exclude pattern
441-
// Additionally, we keep patterns without duplications
442-
func filterUniqueAndConvertToFilesExcludePatterns(excludePatterns []string) []string {
443-
uniqueExcludePatterns := datastructures.MakeSet[string]()
445+
func convertToFilesExcludePatterns(excludePatterns []string) (converted []string) {
444446
for _, excludePattern := range excludePatterns {
445447
if !strings.HasPrefix(excludePattern, "**/") {
446448
excludePattern = "**/" + excludePattern
447449
}
448450
if !strings.HasSuffix(excludePattern, "/**") {
449451
excludePattern += "/**"
450452
}
451-
uniqueExcludePatterns.Add(excludePattern)
453+
converted = append(converted, excludePattern)
452454
}
453-
return uniqueExcludePatterns.ToSlice()
455+
return converted
454456
}
455457

456458
func CheckForSecretValidation(xrayManager *xray.XrayServicesManager, xrayVersion string, validateSecrets bool) bool {

‎jas/common_test.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ func TestGetExcludePatterns(t *testing.T) {
127127
for _, testCase := range getExcludePatternsCases {
128128
t.Run("", func(t *testing.T) {
129129
scanner := testCase.scanner
130-
actualExcludePatterns := GetExcludePatterns(module, scanner)
130+
actualExcludePatterns := GetExcludePatterns(module, scanner, []string{})
131131
if scanner == nil {
132132
assert.ElementsMatch(t, module.ExcludePatterns, actualExcludePatterns)
133133
return
@@ -280,7 +280,7 @@ func TestAddScoreToRunRules(t *testing.T) {
280280
}
281281
}
282282

283-
func TestFilterUniqueAndConvertToFilesExcludePatterns(t *testing.T) {
283+
func TestConvertToFilesExcludePatterns(t *testing.T) {
284284
tests := []struct {
285285
name string
286286
excludePatterns []string
@@ -297,7 +297,7 @@ func TestFilterUniqueAndConvertToFilesExcludePatterns(t *testing.T) {
297297
}
298298

299299
for _, test := range tests {
300-
filteredExcludePatterns := filterUniqueAndConvertToFilesExcludePatterns(test.excludePatterns)
300+
filteredExcludePatterns := convertToFilesExcludePatterns(test.excludePatterns)
301301
// Sort is needed since we create the response slice from a Set (unordered)
302302
slices.Sort(filteredExcludePatterns)
303303
assert.EqualValues(t, test.expectedOutput, filteredExcludePatterns)

‎jas/iac/iacscanner.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ func newIacScanManager(scanner *jas.JasScanner, scannerTempDir string, resultsTo
7070
}
7171

7272
func (iac *IacScanManager) Run(module jfrogappsconfig.Module) (vulnerabilitiesSarifRuns []*sarif.Run, violationsSarifRuns []*sarif.Run, err error) {
73-
if err = iac.createConfigFile(module, append(iac.scanner.Exclusions, iac.scanner.ScannersExclusions.IacExcludePatterns...)...); err != nil {
73+
if err = iac.createConfigFile(module, iac.scanner.ScannersExclusions.IacExcludePatterns, iac.scanner.Exclusions...); err != nil {
7474
return
7575
}
7676
if err = iac.runAnalyzerManager(); err != nil {
@@ -91,7 +91,7 @@ type iacScanConfiguration struct {
9191
SkippedDirs []string `yaml:"skipped-folders"`
9292
}
9393

94-
func (iac *IacScanManager) createConfigFile(module jfrogappsconfig.Module, exclusions ...string) error {
94+
func (iac *IacScanManager) createConfigFile(module jfrogappsconfig.Module, centralConfigExclusions []string, exclusions ...string) error {
9595
roots, err := jas.GetSourceRoots(module, module.Scanners.Iac)
9696
if err != nil {
9797
return err
@@ -103,7 +103,7 @@ func (iac *IacScanManager) createConfigFile(module jfrogappsconfig.Module, exclu
103103
Output: iac.resultsFileName,
104104
PathToResultsToCompare: iac.resultsToCompareFileName,
105105
Type: iacScannerType,
106-
SkippedDirs: jas.GetExcludePatterns(module, module.Scanners.Iac, exclusions...),
106+
SkippedDirs: jas.GetExcludePatterns(module, module.Scanners.Iac, centralConfigExclusions, exclusions...),
107107
},
108108
},
109109
}

‎jas/iac/iacscanner_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ func TestIacScan_CreateConfigFile_VerifyFileWasCreated(t *testing.T) {
6767

6868
currWd, err := coreutils.GetWorkingDirectory()
6969
assert.NoError(t, err)
70-
err = iacScanManager.createConfigFile(jfrogappsconfig.Module{SourceRoot: currWd})
70+
err = iacScanManager.createConfigFile(jfrogappsconfig.Module{SourceRoot: currWd}, []string{})
7171

7272
defer func() {
7373
err = os.Remove(iacScanManager.configFileName)

‎jas/sast/sastscanner.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ func newSastScanManager(scanner *jas.JasScanner, scannerTempDir string, signedDe
6969
}
7070

7171
func (ssm *SastScanManager) Run(module jfrogappsconfig.Module) (vulnerabilitiesSarifRuns []*sarif.Run, violationsSarifRuns []*sarif.Run, err error) {
72-
if err = ssm.createConfigFile(module, ssm.signedDescriptions, append(ssm.scanner.Exclusions, ssm.scanner.ScannersExclusions.SastExcludePatterns...)...); err != nil {
72+
if err = ssm.createConfigFile(module, ssm.signedDescriptions, ssm.scanner.ScannersExclusions.SastExcludePatterns, ssm.scanner.Exclusions...); err != nil {
7373
return
7474
}
7575
if err = ssm.runAnalyzerManager(filepath.Dir(ssm.scanner.AnalyzerManager.AnalyzerManagerFullPath)); err != nil {
@@ -104,7 +104,7 @@ type sastParameters struct {
104104
SignedDescriptions bool `yaml:"signed_descriptions,omitempty"`
105105
}
106106

107-
func (ssm *SastScanManager) createConfigFile(module jfrogappsconfig.Module, signedDescriptions bool, exclusions ...string) error {
107+
func (ssm *SastScanManager) createConfigFile(module jfrogappsconfig.Module, signedDescriptions bool, centralConfigExclusions []string, exclusions ...string) error {
108108
sastScanner := module.Scanners.Sast
109109
if sastScanner == nil {
110110
sastScanner = &jfrogappsconfig.SastScanner{}
@@ -125,7 +125,7 @@ func (ssm *SastScanManager) createConfigFile(module jfrogappsconfig.Module, sign
125125
SastParameters: sastParameters{
126126
SignedDescriptions: signedDescriptions,
127127
},
128-
ExcludePatterns: jas.GetExcludePatterns(module, &sastScanner.Scanner, exclusions...),
128+
ExcludePatterns: jas.GetExcludePatterns(module, &sastScanner.Scanner, centralConfigExclusions, exclusions...),
129129
UserRules: ssm.sastRules,
130130
},
131131
},

‎jas/secrets/secretsscanner.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ func newSecretsScanManager(scanner *jas.JasScanner, scanType SecretsScanType, sc
7575
}
7676

7777
func (ssm *SecretScanManager) Run(module jfrogappsconfig.Module) (vulnerabilitiesSarifRuns []*sarif.Run, violationsSarifRuns []*sarif.Run, err error) {
78-
if err = ssm.createConfigFile(module, append(ssm.scanner.Exclusions, ssm.scanner.ScannersExclusions.SecretsExcludePatterns...)...); err != nil {
78+
if err = ssm.createConfigFile(module, ssm.scanner.ScannersExclusions.SecretsExcludePatterns, ssm.scanner.Exclusions...); err != nil {
7979
return
8080
}
8181
if err = ssm.runAnalyzerManager(); err != nil {
@@ -96,7 +96,7 @@ type secretsScanConfiguration struct {
9696
SkippedDirs []string `yaml:"skipped-folders"`
9797
}
9898

99-
func (s *SecretScanManager) createConfigFile(module jfrogappsconfig.Module, exclusions ...string) error {
99+
func (s *SecretScanManager) createConfigFile(module jfrogappsconfig.Module, centralConfigExclusions []string, exclusions ...string) error {
100100
roots, err := jas.GetSourceRoots(module, module.Scanners.Secrets)
101101
if err != nil {
102102
return err
@@ -108,7 +108,7 @@ func (s *SecretScanManager) createConfigFile(module jfrogappsconfig.Module, excl
108108
Output: s.resultsFileName,
109109
PathToResultsToCompare: s.resultsToCompareFileName,
110110
Type: string(s.scanType),
111-
SkippedDirs: jas.GetExcludePatterns(module, module.Scanners.Secrets, exclusions...),
111+
SkippedDirs: jas.GetExcludePatterns(module, module.Scanners.Secrets, centralConfigExclusions, exclusions...),
112112
},
113113
},
114114
}

‎jas/secrets/secretsscanner_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ func TestSecretsScan_CreateConfigFile_VerifyFileWasCreated(t *testing.T) {
6262

6363
currWd, err := coreutils.GetWorkingDirectory()
6464
assert.NoError(t, err)
65-
err = secretScanManager.createConfigFile(jfrogappsconfig.Module{SourceRoot: currWd})
65+
err = secretScanManager.createConfigFile(jfrogappsconfig.Module{SourceRoot: currWd}, []string{})
6666
assert.NoError(t, err)
6767

6868
defer func() {

0 commit comments

Comments
 (0)