Skip to content

Commit ff53b41

Browse files
basel1322basel1322
authored
Merge branch 'dev' into docker-curation-supprot
2 parents 3370714 + 059d7e7 commit ff53b41

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+1375
-165
lines changed

‎artifactory_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,7 @@ func TestDependencyResolutionFromArtifactory(t *testing.T) {
119119
for _, testCase := range testCases {
120120
t.Run(testCase.projectType.String(), func(t *testing.T) {
121121
if testCase.skipMsg != "" {
122-
securityTestUtils.SkipTestIfDurationNotPassed(t, "22-11-2025", 30, testCase.skipMsg)
122+
securityTestUtils.SkipTestIfDurationNotPassed(t, "22-12-2025", 30, testCase.skipMsg)
123123
}
124124
testSingleTechDependencyResolution(t, testCase.testProjectPath, testCase.resolveRepoName, testCase.cacheRepoName, testCase.projectType)
125125
})

‎cli/docs/flags.go‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ const (
2525
GitCountContributors = "count-contributors"
2626
Enrich = "sbom-enrich"
2727
UploadCdx = "upload-cdx"
28+
MaliciousScan = "malicious-scan"
2829

2930
// TODO: Deprecated commands (remove at next CLI major version)
3031
AuditMvn = "audit-maven"
@@ -129,6 +130,7 @@ const (
129130
ScanVuln = scanPrefix + Vuln
130131
SecretValidation = "validate-secrets"
131132
StaticSca = "static-sca"
133+
malProjectKey = Project
132134
scanProjectKey = scanPrefix + Project
133135
uploadProjectKey = UploadCdx + "-" + Project
134136

@@ -176,6 +178,9 @@ var commandFlags = map[string][]string{
176178
Enrich: {
177179
Url, XrayUrl, user, password, accessToken, ServerId, Threads, InsecureTls,
178180
},
181+
MaliciousScan: {
182+
Url, XrayUrl, user, password, accessToken, ServerId, Threads, InsecureTls, OutputFormat, MinSeverity, AnalyzerManagerCustomPath, WorkingDirs, malProjectKey,
183+
},
179184
BuildScan: {
180185
Url, XrayUrl, user, password, accessToken, ServerId, scanProjectKey, BuildVuln, OutputFormat, Fail, ExtendedTable, Rescan, InsecureTls, TriggerScanRetries,
181186
},
@@ -237,11 +242,11 @@ var commandFlags = map[string][]string{
237242
var flagsMap = map[string]components.Flag{
238243
// Common commands flags
239244
ServerId: components.NewStringFlag(ServerId, "Server ID configured using the config command."),
240-
Url: components.NewStringFlag(Url, "JFrog URL."),
241-
XrayUrl: components.NewStringFlag(XrayUrl, "JFrog Xray URL."),
242-
user: components.NewStringFlag(user, "JFrog username."),
243-
password: components.NewStringFlag(password, "JFrog password."),
244-
accessToken: components.NewStringFlag(accessToken, "JFrog access token."),
245+
Url: components.NewStringFlag(Url, "Specifies the URL of the JFrog platform."),
246+
XrayUrl: components.NewStringFlag(XrayUrl, "Specifies the URL of your Xray server."),
247+
user: components.NewStringFlag(user, "Specifies the user name of your JFrog platform."),
248+
password: components.NewStringFlag(password, "Specifies the user password of your JFrog platform."),
249+
accessToken: components.NewStringFlag(accessToken, "Specifies the access token of your JFrog platform."),
245250
Threads: components.NewStringFlag(Threads, "The number of parallel threads used to scan the source code project.", components.WithIntDefaultValue(cliutils.Threads)),
246251
// Xray flags
247252
LicenseId: components.NewStringFlag(LicenseId, "Xray license ID.", components.SetMandatory(), components.WithHelpValue("Xray license ID")),
@@ -257,6 +262,7 @@ var flagsMap = map[string]components.Flag{
257262
scanRegexp: components.NewBoolFlag(RegexpFlag, "Set to true to use a regular expression instead of wildcards expression to collect files to scan."),
258263
scanAnt: components.NewBoolFlag(AntFlag, "Set to true to use an ant pattern instead of wildcards expression to collect files to scan."),
259264
scanProjectKey: components.NewStringFlag(Project, "JFrog project key, to enable Xray to determine security violations accordingly. The command accepts this option only if the --repo-path and --watches options are not provided. If none of the three options are provided, the command will show all known vulnerabilities."),
265+
malProjectKey: components.NewStringFlag(Project, "JFrog project key"),
260266
uploadProjectKey: components.NewStringFlag(Project, "JFrog project key to upload the file to."),
261267
Watches: components.NewStringFlag(Watches, "Comma-separated list of Xray watches to determine violations. Supported violations are CVEs, operational risk, and Licenses. Incompatible with --project and --repo-path."),
262268
RepoPath: components.NewStringFlag(RepoPath, "Artifactory repository path, to enable Xray to determine violations accordingly. The command accepts this option only if the --project and --watches options are not provided. If none of the three options are provided, the command will show all known vulnerabilities."),

‎cli/docs/maliciousscan/help.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
package maliciousscan
2+
3+
import (
4+
"github.com/jfrog/jfrog-cli-core/v2/plugins/components"
5+
)
6+
7+
func GetDescription() string {
8+
return "[Beta] Scan malicious models (pickle files, etc.) located in the working directory."
9+
}
10+
11+
func GetArguments() []components.Argument {
12+
return []components.Argument{}
13+
}

‎cli/scancommands.go‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121
flags "github.com/jfrog/jfrog-cli-security/cli/docs"
2222
auditSpecificDocs "github.com/jfrog/jfrog-cli-security/cli/docs/auditspecific"
2323
enrichDocs "github.com/jfrog/jfrog-cli-security/cli/docs/enrich"
24+
maliciousScanDocs "github.com/jfrog/jfrog-cli-security/cli/docs/maliciousscan"
2425
mcpDocs "github.com/jfrog/jfrog-cli-security/cli/docs/mcp"
2526
auditDocs "github.com/jfrog/jfrog-cli-security/cli/docs/scan/audit"
2627
buildScanDocs "github.com/jfrog/jfrog-cli-security/cli/docs/scan/buildscan"
@@ -40,6 +41,7 @@ import (
4041

4142
"github.com/jfrog/jfrog-cli-security/commands/audit"
4243
"github.com/jfrog/jfrog-cli-security/commands/curation"
44+
"github.com/jfrog/jfrog-cli-security/commands/maliciousscan"
4345
"github.com/jfrog/jfrog-cli-security/commands/scan"
4446
"github.com/jfrog/jfrog-cli-security/commands/upload"
4547

@@ -72,6 +74,15 @@ func getAuditAndScansCommands() []components.Command {
7274
Category: securityCategory,
7375
Action: EnrichCmd,
7476
},
77+
{
78+
Name: "malicious-scan",
79+
Aliases: []string{"ms"},
80+
Flags: flags.GetCommandFlags(flags.MaliciousScan),
81+
Description: maliciousScanDocs.GetDescription(),
82+
Arguments: maliciousScanDocs.GetArguments(),
83+
Category: securityCategory,
84+
Action: MaliciousScanCmd,
85+
},
7586
{
7687
Name: "build-scan",
7788
Aliases: []string{"bs"},
@@ -230,6 +241,43 @@ func EnrichCmd(c *components.Context) error {
230241
return commandsCommon.Exec(EnrichCmd)
231242
}
232243

244+
func MaliciousScanCmd(c *components.Context) error {
245+
serverDetails, err := CreateServerDetailsFromFlags(c)
246+
if err != nil {
247+
return err
248+
}
249+
if err = validateConnectionInputs(serverDetails); err != nil {
250+
return err
251+
}
252+
format, err := outputFormat.GetOutputFormat(c.GetStringFlagValue(flags.OutputFormat))
253+
if err != nil {
254+
return err
255+
}
256+
threads, err := pluginsCommon.GetThreadsCount(c)
257+
if err != nil {
258+
return err
259+
}
260+
minSeverity, err := getMinimumSeverity(c)
261+
if err != nil {
262+
return err
263+
}
264+
workingDirs := []string{}
265+
if c.GetStringFlagValue(flags.WorkingDirs) != "" {
266+
workingDirs = splitByCommaAndTrim(c.GetStringFlagValue(flags.WorkingDirs))
267+
}
268+
maliciousScanCmd := maliciousscan.NewMaliciousScanCommand().
269+
SetServerDetails(serverDetails).
270+
SetWorkingDirs(workingDirs).
271+
SetThreads(threads).
272+
SetOutputFormat(format).
273+
SetMinSeverityFilter(minSeverity).
274+
SetProject(getProject(c))
275+
if c.IsFlagSet(flags.AnalyzerManagerCustomPath) {
276+
maliciousScanCmd.SetCustomAnalyzerManagerPath(c.GetStringFlagValue(flags.AnalyzerManagerCustomPath))
277+
}
278+
return commandsCommon.Exec(maliciousScanCmd)
279+
}
280+
233281
func ScanCmd(c *components.Context) error {
234282
if len(c.Arguments) == 0 && !c.IsFlagSet(flags.SpecFlag) {
235283
return pluginsCommon.PrintHelpAndReturnError("providing either a <source pattern> argument or the 'spec' option is mandatory", c)

‎commands/audit/audit_test.go‎

Lines changed: 6 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -261,7 +261,6 @@ func TestAuditWithConfigProfile(t *testing.T) {
261261
},
262262
},
263263
}},
264-
IsDefault: false,
265264
},
266265
expectedScaIssues: 15,
267266
},
@@ -293,7 +292,6 @@ func TestAuditWithConfigProfile(t *testing.T) {
293292
},
294293
},
295294
}},
296-
IsDefault: false,
297295
},
298296
expectedScaIssues: 0,
299297
},
@@ -324,7 +322,6 @@ func TestAuditWithConfigProfile(t *testing.T) {
324322
},
325323
},
326324
}},
327-
IsDefault: false,
328325
},
329326
expectedCaNotCovered: 15,
330327
},
@@ -356,7 +353,6 @@ func TestAuditWithConfigProfile(t *testing.T) {
356353
},
357354
},
358355
}},
359-
IsDefault: false,
360356
},
361357
expectedSecretsIssues: 16,
362358
},
@@ -381,14 +377,13 @@ func TestAuditWithConfigProfile(t *testing.T) {
381377
},
382378
SecretsScannerConfig: services.SecretsScannerConfig{
383379
EnableSecretsScan: true,
384-
ExcludePatterns: []string{"*api_secrets*"},
380+
ExcludePatterns: []string{"**/*api_secrets*/**"},
385381
},
386382
IacScannerConfig: services.IacScannerConfig{
387383
EnableIacScan: false,
388384
},
389385
},
390386
}},
391-
IsDefault: false,
392387
},
393388
expectedSecretsIssues: 7,
394389
},
@@ -419,7 +414,6 @@ func TestAuditWithConfigProfile(t *testing.T) {
419414
},
420415
},
421416
}},
422-
IsDefault: false,
423417
},
424418
expectedSastIssues: 4,
425419
},
@@ -441,7 +435,7 @@ func TestAuditWithConfigProfile(t *testing.T) {
441435
},
442436
SastScannerConfig: services.SastScannerConfig{
443437
EnableSastScan: true,
444-
ExcludePatterns: []string{"*flask_webgoat*"},
438+
ExcludePatterns: []string{"**/*flask_webgoat*/**"},
445439
},
446440
SecretsScannerConfig: services.SecretsScannerConfig{
447441
EnableSecretsScan: false,
@@ -451,15 +445,14 @@ func TestAuditWithConfigProfile(t *testing.T) {
451445
},
452446
},
453447
}},
454-
IsDefault: false,
455448
},
456449
expectedSastIssues: 0,
457450
},
458451
{
459452
name: "Enable only IaC scanner",
460453
testDirPath: filepath.Join("..", "..", "tests", "testdata", "projects", "jas", "jas"),
461454
configProfile: services.ConfigProfile{
462-
ProfileName: "only-sast",
455+
ProfileName: "only-iac",
463456
Modules: []services.Module{{
464457
ModuleId: 1,
465458
ModuleName: "only-iac-module",
@@ -482,7 +475,6 @@ func TestAuditWithConfigProfile(t *testing.T) {
482475
},
483476
},
484477
}},
485-
IsDefault: false,
486478
},
487479
expectedIacIssues: 9,
488480
},
@@ -510,11 +502,10 @@ func TestAuditWithConfigProfile(t *testing.T) {
510502
},
511503
IacScannerConfig: services.IacScannerConfig{
512504
EnableIacScan: true,
513-
ExcludePatterns: []string{"*iac/gcp*"},
505+
ExcludePatterns: []string{"**/*iac/gcp*/**"},
514506
},
515507
},
516508
}},
517-
IsDefault: false,
518509
},
519510
expectedIacIssues: 0,
520511
},
@@ -545,7 +536,6 @@ func TestAuditWithConfigProfile(t *testing.T) {
545536
},
546537
},
547538
}},
548-
IsDefault: false,
549539
},
550540
expectedSastIssues: 4,
551541
expectedSecretsIssues: 16,
@@ -570,18 +560,17 @@ func TestAuditWithConfigProfile(t *testing.T) {
570560
},
571561
SastScannerConfig: services.SastScannerConfig{
572562
EnableSastScan: true,
573-
ExcludePatterns: []string{"*flask_webgoat*"},
563+
ExcludePatterns: []string{"**/*flask_webgoat*/**"},
574564
},
575565
SecretsScannerConfig: services.SecretsScannerConfig{
576566
EnableSecretsScan: true,
577-
ExcludePatterns: []string{"*api_secrets*"},
567+
ExcludePatterns: []string{"**/*api_secrets*/**"},
578568
},
579569
IacScannerConfig: services.IacScannerConfig{
580570
EnableIacScan: true,
581571
},
582572
},
583573
}},
584-
IsDefault: false,
585574
},
586575
expectedSastIssues: 0,
587576
expectedSecretsIssues: 7,

0 commit comments

Comments
 (0)