Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added a check for sarif if the scanner should be appended #184

Closed
wants to merge 3 commits into from
Closed

Added a check for sarif if the scanner should be appended #184

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9e6e78f
added a check for sarif to see if the scanner should be appended
eyalk007 Sep 22, 2024
366df05
Merge branch 'dev' into bug-fix/remove-xray-scanner-in-sarif-sast
eyalk007 Sep 22, 2024
5424021
merge to dev
eyalk007 Sep 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 2 additions & 6 deletions utils/resultstable.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -392,16 +392,12 @@ func prepareSecrets(secrets []*sarif.Run, isTable bool) []formats.SourceCodeRow
return secretsRows
}

func PrintSecretsTable(secrets []*sarif.Run, entitledForSecretsScan bool, tokenValidationEnabled bool) error {
func PrintSecretsTable(secrets []*sarif.Run, entitledForSecretsScan bool) error {
if entitledForSecretsScan {
secretsRows := prepareSecrets(secrets, true)
log.Output()
err := coreutils.PrintTable(formats.ConvertToSecretsTableRow(secretsRows), "Secret Detection",
return coreutils.PrintTable(formats.ConvertToSecretsTableRow(secretsRows), "Secret Detection",
"✨ No secrets were found ✨", false)
if err == nil && tokenValidationEnabled {
log.Output("This table contains multiple secret types, such as tokens, generic password, ssh keys and more, token validation is only supported on tokens.")
}
return err
}
return nil
}
Expand Down
38 changes: 21 additions & 17 deletions utils/resultwriter.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,7 +141,7 @@
case format.Json:
return PrintJson(rw.results.GetScaScansXrayResults())
case format.Sarif:
return PrintSarif(rw.results, rw.isMultipleRoots, rw.includeLicenses)
return PrintSarif(rw.results, rw.isMultipleRoots, rw.includeLicenses, rw.subScansPreformed, rw.results.ResultType)
}
return nil
}
Expand All @@ -157,7 +157,7 @@
printMessage(coreutils.PrintTitle("The full scan results are available here: ") + coreutils.PrintLink(resultsPath))
}
log.Output()
if shouldPrintTable(rw.subScansPreformed, ScaScan, rw.results.ResultType) {
if isScanRequested(rw.subScansPreformed, ScaScan, rw.results.ResultType) {
if rw.hasViolationContext {
if err = PrintViolationsTable(violations, rw.results, rw.isMultipleRoots, rw.printExtended); err != nil {
return
Expand All @@ -174,23 +174,23 @@
}
}
}
if shouldPrintTable(rw.subScansPreformed, SecretsScan, rw.results.ResultType) {
if err = PrintSecretsTable(rw.results.ExtendedScanResults.SecretsScanResults, rw.results.ExtendedScanResults.EntitledForJas, rw.results.ExtendedScanResults.SecretValidation); err != nil {
if isScanRequested(rw.subScansPreformed, SecretsScan, rw.results.ResultType) {
if err = PrintSecretsTable(rw.results.ExtendedScanResults.SecretsScanResults, rw.results.ExtendedScanResults.EntitledForJas); err != nil {
return
}
}
if shouldPrintTable(rw.subScansPreformed, IacScan, rw.results.ResultType) {
if isScanRequested(rw.subScansPreformed, IacScan, rw.results.ResultType) {
if err = PrintIacTable(rw.results.ExtendedScanResults.IacScanResults, rw.results.ExtendedScanResults.EntitledForJas); err != nil {
return
}
}
if !shouldPrintTable(rw.subScansPreformed, SastScan, rw.results.ResultType) {
if !isScanRequested(rw.subScansPreformed, SastScan, rw.results.ResultType) {
return nil
}
return PrintSastTable(rw.results.ExtendedScanResults.SastScanResults, rw.results.ExtendedScanResults.EntitledForJas)
}

func shouldPrintTable(requestedScans []SubScanType, subScan SubScanType, scanType CommandType) bool {
func isScanRequested(requestedScans []SubScanType, subScan SubScanType, scanType CommandType) bool {
if scanType.IsTargetBinary() && (subScan == IacScan || subScan == SastScan) {
return false
}
Expand All @@ -210,20 +210,27 @@
log.Output("💬" + message)
}

func GenerateSarifReportFromResults(results *Results, isMultipleRoots, includeLicenses bool, allowedLicenses []string) (report *sarif.Report, err error) {
func appendRunsIfRequired(requestedScans []SubScanType, subScan SubScanType, scanType CommandType, results *Results, scanResults []*sarif.Run, report *sarif.Report) {
if isScanRequested(requestedScans, subScan, scanType) {
report.Runs = append(report.Runs, patchRunsToPassIngestionRules(subScan, results, scanResults...)...)
}
}

func GenerateSarifReportFromResults(results *Results, isMultipleRoots, includeLicenses bool, allowedLicenses []string, requestedScans []SubScanType, scanType CommandType) (report *sarif.Report, err error) {
report, err = sarifutils.NewReport()
if err != nil {
return
}

xrayRun, err := convertXrayResponsesToSarifRun(results, isMultipleRoots, includeLicenses, allowedLicenses)
if err != nil {
return
}

report.Runs = append(report.Runs, patchRunsToPassIngestionRules(ScaScan, results, xrayRun)...)
report.Runs = append(report.Runs, patchRunsToPassIngestionRules(IacScan, results, results.ExtendedScanResults.IacScanResults...)...)
report.Runs = append(report.Runs, patchRunsToPassIngestionRules(SecretsScan, results, results.ExtendedScanResults.SecretsScanResults...)...)
report.Runs = append(report.Runs, patchRunsToPassIngestionRules(SastScan, results, results.ExtendedScanResults.SastScanResults...)...)
appendRunsIfRequired(requestedScans, ScaScan, scanType, results, []*sarif.Run{xrayRun}, report)
appendRunsIfRequired(requestedScans, IacScan, scanType, results, results.ExtendedScanResults.IacScanResults, report)
appendRunsIfRequired(requestedScans, SecretsScan, scanType, results, results.ExtendedScanResults.SecretsScanResults, report)
appendRunsIfRequired(requestedScans, SastScan, scanType, results, results.ExtendedScanResults.SastScanResults, report)

return
}
Expand Down Expand Up @@ -766,7 +773,7 @@
// * Layer: <HASH>
// * Filepath: <PATH>
// * Evidence: <Snippet>
func getBinaryLocationMarkdownString(commandType CommandType, subScanType SubScanType, location *sarif.Location, result *sarif.Result) (content string) {

Check failure on line 776 in utils/resultwriter.go

View workflow job for this annotation

GitHub Actions / Static-Check 

`getBinaryLocationMarkdownString` - `result` is unused (unparam)
if location == nil {
return ""
}
Expand All @@ -788,9 +795,6 @@
if snippet := sarifutils.GetLocationSnippet(location); snippet != "" {
content += fmt.Sprintf("\nEvidence: %s", snippet)
}
if tokenValidation := GetResultPropertyTokenValidation(result); tokenValidation != "" {
content += fmt.Sprintf("\nToken Validation %s", tokenValidation)
}
return
}

Expand Down Expand Up @@ -927,8 +931,8 @@
return nil
}

func PrintSarif(results *Results, isMultipleRoots, includeLicenses bool) error {
sarifReport, err := GenerateSarifReportFromResults(results, isMultipleRoots, includeLicenses, nil)
func PrintSarif(results *Results, isMultipleRoots, includeLicenses bool, subScans []SubScanType, commandType CommandType) error {
sarifReport, err := GenerateSarifReportFromResults(results, isMultipleRoots, includeLicenses, nil, subScans, commandType)
if err != nil {
return err
}
Expand Down
7 changes: 3 additions & 4 deletions utils/securityJobSummary.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,10 +187,9 @@
log.Info("Results can be uploaded to Github security tab automatically by upgrading your JFrog subscription.")
return
}
sarifReport, err := GenerateSarifReportFromResults(cmdResults, true, false, nil)
if err != nil {
return err
}

sarifReport, err := GenerateSarifReportFromResults(cmdResults, true, false, nil, []SubScanType{}, cmdResults.ResultType)

Check failure on line 191 in utils/securityJobSummary.go

View workflow job for this annotation

GitHub Actions / Static-Check 

ineffectual assignment to err (ineffassign)

out, err := JSONMarshalNotEscaped(sarifReport)
if err != nil {
return errorutils.CheckError(err)
Expand Down
Loading