Skip to content

Commit

Permalink
Merge branch 'dev' of https://github.com/jfrog/jfrog-cli-security int…
Browse files Browse the repository at this point in the history 
…o add-warning-when-dir-for-scan-doesnt-exist
  • Loading branch information
@eranturgeman
eranturgeman committed May 1, 2024
2 parents dcd2051 + 6c255ac commit 138b1e6
Show file tree
Hide file tree
Showing 46 changed files with 519 additions and 167 deletions.
49 changes: 25 additions & 24 deletions audit_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ func TestXrayAuditNpmSimpleJson(t *testing.T) {
}

func testXrayAuditNpm(t *testing.T, format string) string {
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion, "")
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion)
tempDirPath, createTempDirCallback := coreTests.CreateTempDirWithCallbackAndAssert(t)
defer createTempDirCallback()
npmProjectPath := filepath.Join(filepath.FromSlash(securityTestUtils.GetTestResourcesPath()), "projects", "package-managers", "npm", "npm")
Expand All @@ -64,7 +64,7 @@ func TestXrayAuditPnpmSimpleJson(t *testing.T) {
}

func testXrayAuditPnpm(t *testing.T, format string) string {
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion, "")
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion)
tempDirPath, createTempDirCallback := coreTests.CreateTempDirWithCallbackAndAssert(t)
defer createTempDirCallback()
npmProjectPath := filepath.Join(filepath.FromSlash(securityTestUtils.GetTestResourcesPath()), "projects", "package-managers", "npm", "npm-no-lock")
Expand Down Expand Up @@ -120,7 +120,7 @@ func TestXrayAuditYarnV1SimpleJson(t *testing.T) {
}

func testXrayAuditYarn(t *testing.T, projectDirName string, yarnCmd func()) {
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion, "")
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion)
tempDirPath, createTempDirCallback := coreTests.CreateTempDirWithCallbackAndAssert(t)
defer createTempDirCallback()
yarnProjectPath := filepath.Join(filepath.FromSlash(securityTestUtils.GetTestResourcesPath()), "projects", "package-managers", "yarn", projectDirName)
Expand Down Expand Up @@ -173,14 +173,14 @@ func TestXrayAuditNugetJson(t *testing.T) {
projectName: "multi",
format: string(format.Json),
restoreTech: "dotnet",
minVulnerabilities: 5,
minVulnerabilities: 4,
minLicences: 3,
},
{
projectName: "multi",
format: string(format.Json),
restoreTech: "",
minVulnerabilities: 5,
minVulnerabilities: 4,
minLicences: 3,
},
}
Expand Down Expand Up @@ -235,7 +235,7 @@ func TestXrayAuditNugetSimpleJson(t *testing.T) {
}

func testXrayAuditNuget(t *testing.T, projectName, format string, restoreTech string) string {
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion, "")
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion)
tempDirPath, createTempDirCallback := coreTests.CreateTempDirWithCallbackAndAssert(t)
defer createTempDirCallback()
projectPath := filepath.Join(filepath.FromSlash(securityTestUtils.GetTestResourcesPath()), "projects", "package-managers", "nuget", projectName)
Expand Down Expand Up @@ -264,7 +264,7 @@ func TestXrayAuditGradleSimpleJson(t *testing.T) {
}

func testXrayAuditGradle(t *testing.T, format string) string {
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion, "")
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion)
tempDirPath, createTempDirCallback := coreTests.CreateTempDirWithCallbackAndAssert(t)
defer createTempDirCallback()
gradleProjectPath := filepath.Join(filepath.FromSlash(securityTestUtils.GetTestResourcesPath()), "projects", "package-managers", "gradle", "gradle")
Expand All @@ -288,7 +288,7 @@ func TestXrayAuditMavenSimpleJson(t *testing.T) {
}

func testXrayAuditMaven(t *testing.T, format string) string {
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion, "")
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion)
tempDirPath, createTempDirCallback := coreTests.CreateTempDirWithCallbackAndAssert(t)
defer createTempDirCallback()
mvnProjectPath := filepath.Join(filepath.FromSlash(securityTestUtils.GetTestResourcesPath()), "projects", "package-managers", "maven", "maven")
Expand All @@ -302,7 +302,7 @@ func testXrayAuditMaven(t *testing.T, format string) string {
}

func TestXrayAuditNoTech(t *testing.T) {
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion, "")
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion)
tempDirPath, createTempDirCallback := coreTests.CreateTempDirWithCallbackAndAssert(t)
defer createTempDirCallback()
prevWd := securityTestUtils.ChangeWD(t, tempDirPath)
Expand All @@ -313,7 +313,7 @@ func TestXrayAuditNoTech(t *testing.T) {
}

func TestXrayAuditMultiProjects(t *testing.T) {
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion, "")
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion)
tempDirPath, createTempDirCallback := coreTests.CreateTempDirWithCallbackAndAssert(t)
defer createTempDirCallback()
multiProject := filepath.Join(filepath.FromSlash(securityTestUtils.GetTestResourcesPath()), "projects")
Expand All @@ -323,13 +323,13 @@ func TestXrayAuditMultiProjects(t *testing.T) {
defer clientTests.ChangeDirAndAssert(t, prevWd)
workingDirsFlag := fmt.Sprintf("--working-dirs=%s, %s ,%s, %s",
filepath.Join(tempDirPath, "package-managers", "maven", "maven"), filepath.Join(tempDirPath, "package-managers", "nuget", "single4.0"),
filepath.Join(tempDirPath, "package-managers", "python", "pip", "pip-project"), filepath.Join(tempDirPath, "jas", "jas-test"))
filepath.Join(tempDirPath, "package-managers", "python", "pip", "pip-project"), filepath.Join(tempDirPath, "jas", "jas"))
// Configure a new server named "default"
securityTestUtils.CreateJfrogHomeConfig(t, true)
defer securityTestUtils.CleanTestsHomeEnv()
output := securityTests.PlatformCli.WithoutCredentials().RunCliCmdWithOutput(t, "audit", "--format="+string(format.SimpleJson), workingDirsFlag)
securityTestUtils.VerifySimpleJsonScanResults(t, output, 35, 0)
securityTestUtils.VerifySimpleJsonJasResults(t, output, 1, 9, 7, 3)
securityTestUtils.VerifySimpleJsonJasResults(t, output, 1, 9, 7, 3, 0, 25, 2)
}

func TestXrayAuditPipJson(t *testing.T) {
Expand All @@ -353,7 +353,7 @@ func TestXrayAuditPipSimpleJsonWithRequirementsFile(t *testing.T) {
}

func testXrayAuditPip(t *testing.T, format, requirementsFile string) string {
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion, "")
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion)
tempDirPath, createTempDirCallback := coreTests.CreateTempDirWithCallbackAndAssert(t)
defer createTempDirCallback()
pipProjectPath := filepath.Join(filepath.FromSlash(securityTestUtils.GetTestResourcesPath()), "projects", "package-managers", "python", "pip", "pip-project")
Expand Down Expand Up @@ -382,7 +382,7 @@ func TestXrayAuditPipenvSimpleJson(t *testing.T) {
}

func testXrayAuditPipenv(t *testing.T, format string) string {
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion, "")
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion)
tempDirPath, createTempDirCallback := coreTests.CreateTempDirWithCallbackAndAssert(t)
defer createTempDirCallback()
pipenvProjectPath := filepath.Join(filepath.FromSlash(securityTestUtils.GetTestResourcesPath()), "projects", "package-managers", "python", "pipenv", "pipenv-project")
Expand All @@ -406,7 +406,7 @@ func TestXrayAuditPoetrySimpleJson(t *testing.T) {
}

func testXrayAuditPoetry(t *testing.T, format string) string {
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion, "")
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion)
tempDirPath, createTempDirCallback := coreTests.CreateTempDirWithCallbackAndAssert(t)
defer createTempDirCallback()
poetryProjectPath := filepath.Join(filepath.FromSlash(securityTestUtils.GetTestResourcesPath()), "projects", "package-managers", "python", "poetry", "poetry-project")
Expand All @@ -432,23 +432,23 @@ func addDummyPackageDescriptor(t *testing.T, hasPackageJson bool) {
// JAS

func TestXrayAuditJasSimpleJson(t *testing.T) {
output := testXrayAuditJas(t, string(format.SimpleJson), filepath.Join("jas", "jas-test"))
securityTestUtils.VerifySimpleJsonJasResults(t, output, 1, 9, 7, 2)
output := testXrayAuditJas(t, string(format.SimpleJson), filepath.Join("jas", "jas"))
securityTestUtils.VerifySimpleJsonJasResults(t, output, 1, 9, 7, 3, 0, 2, 2)
}

func TestXrayAuditJasSimpleJsonWithConfig(t *testing.T) {
output := testXrayAuditJas(t, string(format.SimpleJson), filepath.Join("jas", "jas-config"))
securityTestUtils.VerifySimpleJsonJasResults(t, output, 0, 0, 1, 2)
securityTestUtils.VerifySimpleJsonJasResults(t, output, 0, 0, 1, 3, 0, 2, 2)
}

func TestXrayAuditJasNoViolationsSimpleJson(t *testing.T) {
output := testXrayAuditJas(t, string(format.SimpleJson), filepath.Join("package-managers", "npm", "npm"))
securityTestUtils.VerifySimpleJsonScanResults(t, output, 1, 0)
securityTestUtils.VerifySimpleJsonJasResults(t, output, 0, 0, 0, 0)
securityTestUtils.VerifySimpleJsonJasResults(t, output, 0, 0, 0, 0, 0, 0, 1)
}

func testXrayAuditJas(t *testing.T, format string, project string) string {
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion, "")
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion)
tempDirPath, createTempDirCallback := coreTests.CreateTempDirWithCallbackAndAssert(t)
defer createTempDirCallback()
projectDir := filepath.Join(filepath.FromSlash(securityTestUtils.GetTestResourcesPath()), filepath.Join("projects", project))
Expand All @@ -465,7 +465,7 @@ func testXrayAuditJas(t *testing.T, format string, project string) string {
}

func TestXrayAuditDetectTech(t *testing.T) {
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion, "")
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion)
tempDirPath, createTempDirCallback := coreTests.CreateTempDirWithCallbackAndAssert(t)
defer createTempDirCallback()
mvnProjectPath := filepath.Join(filepath.FromSlash(securityTestUtils.GetTestResourcesPath()), "projects", "package-managers", "maven", "maven")
Expand All @@ -483,7 +483,7 @@ func TestXrayAuditDetectTech(t *testing.T) {
}

func TestXrayRecursiveScan(t *testing.T) {
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion, "")
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion)
tempDirPath, createTempDirCallback := coreTests.CreateTempDirWithCallbackAndAssert(t)
defer createTempDirCallback()
projectDir := filepath.Join(filepath.FromSlash(securityTestUtils.GetTestResourcesPath()), "projects", "package-managers")
Expand All @@ -509,7 +509,7 @@ func TestXrayRecursiveScan(t *testing.T) {
output := securityTests.PlatformCli.RunCliCmdWithOutput(t, "audit", "--format=json")

// We anticipate the identification of five vulnerabilities: four originating from the .NET project and one from the NPM project.
securityTestUtils.VerifyJsonScanResults(t, output, 0, 5, 0)
securityTestUtils.VerifyJsonScanResults(t, output, 0, 4, 0)

var results []services.ScanResponse
err = json.Unmarshal([]byte(output), &results)
Expand All @@ -519,7 +519,8 @@ func TestXrayRecursiveScan(t *testing.T) {
}

func TestXscAnalyticsForAudit(t *testing.T) {
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion, xscservices.AnalyticsMetricsMinXscVersion)
securityTestUtils.InitSecurityTest(t, scangraph.GraphScanMinXrayVersion)
securityTestUtils.ValidateXscVersion(t, xscservices.AnalyticsMetricsMinXscVersion)
reportUsageCallBack := clientTests.SetEnvWithCallbackAndAssert(t, coreutils.ReportUsage, "true")
defer reportUsageCallBack()
// Scan npm project and verify that analytics general event were sent to XSC.
Expand Down
2 changes: 1 addition & 1 deletion cli/docs/flags.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -182,7 +182,7 @@ var flagsMap = map[string]components.Flag{
"Defines the output format of the command. Acceptable values are: table, json, simple-json and sarif. Note: the json format doesn't include information about scans that are included as part of the Advanced Security package.",
components.WithStrDefaultValue("table"),
),
Fail: components.NewBoolFlag(Fail, "Set to false if you do not wish the command to return exit code 3, even if the 'Fail Build' rule is matched by Xray.", components.WithBoolDefaultValue(true)),
Fail: components.NewBoolFlag(Fail, fmt.Sprintf("When using one of the flags --%s, --%s or --%s and a 'Fail build' rule is matched, the command will return exit code 3. Set to false if you'd like to see violations with exit code 0.", Watches, Project, RepoPath), components.WithBoolDefaultValue(true)),
ExtendedTable: components.NewBoolFlag(ExtendedTable, "Set to true if you'd like the table to include extended fields such as 'CVSS' & 'Xray Issue Id'. Ignored if provided 'format' is not 'table'."),
BypassArchiveLimits: components.NewBoolFlag(BypassArchiveLimits, "Set to true to bypass the indexer-app archive limits."),
MinSeverity: components.NewStringFlag(MinSeverity, "Set the minimum severity of issues to display. The following values are accepted: Low, Medium, High or Critical."),
Expand Down
8 changes: 2 additions & 6 deletions commands/audit/jas/applicability/applicabilitymanager.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -43,8 +43,8 @@ type ApplicabilityScanManager struct {
func RunApplicabilityScan(xrayResults []services.ScanResponse, directDependencies []string,
scannedTechnologies []coreutils.Technology, scanner *jas.JasScanner, thirdPartyContextualAnalysis bool) (results []*sarif.Run, err error) {
applicabilityScanManager := newApplicabilityScanManager(xrayResults, directDependencies, scanner, thirdPartyContextualAnalysis)
if !applicabilityScanManager.shouldRunApplicabilityScan(scannedTechnologies) {
log.Debug("The technologies that have been scanned are currently not supported for contextual analysis scanning, or we couldn't find any vulnerable dependencies. Skipping....")
if !applicabilityScanManager.cvesExists() {
log.Debug("We couldn't find any vulnerable dependencies. Skipping....")
return
}
if err = applicabilityScanManager.scanner.Run(applicabilityScanManager); err != nil {
Expand Down Expand Up @@ -132,10 +132,6 @@ func (asm *ApplicabilityScanManager) Run(module jfrogappsconfig.Module) (err err
return
}

func (asm *ApplicabilityScanManager) shouldRunApplicabilityScan(technologies []coreutils.Technology) bool {
return asm.cvesExists() && coreutils.ContainsApplicabilityScannableTech(technologies)
}

func (asm *ApplicabilityScanManager) cvesExists() bool {
return len(asm.indirectDependenciesCves) > 0 || len(asm.directDependenciesCves) > 0
}
Expand Down
107 changes: 44 additions & 63 deletions commands/audit/jas/applicability/applicabilitymanager_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -153,29 +153,6 @@ func TestNewApplicabilityScanManager_VulnerabilitiesDontExist(t *testing.T) {
}
}

func TestApplicabilityScanManager_ShouldRun_TechnologiesNotEligibleForScan(t *testing.T) {
scanner, cleanUp := jas.InitJasTest(t)
defer cleanUp()

results, err := RunApplicabilityScan(jas.FakeBasicXrayResults, mockDirectDependencies, []coreutils.Technology{coreutils.Nuget, coreutils.Go}, scanner, false)

// Assert
assert.Nil(t, results)
assert.NoError(t, err)
}

func TestApplicabilityScanManager_ShouldRun_ScanResultsAreEmpty(t *testing.T) {
// Arrange
scanner, cleanUp := jas.InitJasTest(t)
defer cleanUp()

applicabilityManager := newApplicabilityScanManager(nil, mockDirectDependencies, scanner, false)

// Assert
eligible := applicabilityManager.shouldRunApplicabilityScan([]coreutils.Technology{coreutils.Nuget})
assert.False(t, eligible)
}

func TestExtractXrayDirectViolations(t *testing.T) {
var xrayResponseForDirectViolationsTest = []services.ScanResponse{
{
Expand Down Expand Up @@ -283,54 +260,58 @@ func TestCreateConfigFile_VerifyFileWasCreated(t *testing.T) {
assert.True(t, len(fileContent) > 0)
}

func TestParseResults_EmptyResults_AllCvesShouldGetUnknown(t *testing.T) {
// Arrange
scanner, cleanUp := jas.InitJasTest(t)
defer cleanUp()

applicabilityManager := newApplicabilityScanManager(jas.FakeBasicXrayResults, mockDirectDependencies, scanner, false)
applicabilityManager.scanner.ResultsFileName = filepath.Join(jas.GetTestDataPath(), "applicability-scan", "empty-results.sarif")

// Act
var err error
applicabilityManager.applicabilityScanResults, err = jas.ReadJasScanRunsFromFile(applicabilityManager.scanner.ResultsFileName, scanner.JFrogAppsConfig.Modules[0].SourceRoot, applicabilityDocsUrlSuffix)

if assert.NoError(t, err) {
assert.Len(t, applicabilityManager.applicabilityScanResults, 1)
assert.Empty(t, applicabilityManager.applicabilityScanResults[0].Results)
}
}

func TestParseResults_ApplicableCveExist(t *testing.T) {
// Arrange
scanner, cleanUp := jas.InitJasTest(t)
defer cleanUp()
applicabilityManager := newApplicabilityScanManager(jas.FakeBasicXrayResults, mockDirectDependencies, scanner, false)
applicabilityManager.scanner.ResultsFileName = filepath.Join(jas.GetTestDataPath(), "applicability-scan", "applicable-cve-results.sarif")

// Act
var err error
applicabilityManager.applicabilityScanResults, err = jas.ReadJasScanRunsFromFile(applicabilityManager.scanner.ResultsFileName, scanner.JFrogAppsConfig.Modules[0].SourceRoot, applicabilityDocsUrlSuffix)
func TestParseResults_NewApplicabilityStatuses(t *testing.T) {
testCases := []struct {
name string
fileName string
expectedResults int
expectedApplicabilityStatuses []string
}{
{
name: "empty results - all cves should get unknown",
fileName: "empty-results.sarif",
expectedResults: 0,
},
{
name: "applicable cve exist",
fileName: "applicable-cve-results.sarif",
expectedResults: 2,
},
{
name: "all cves not applicable",
fileName: "no-applicable-cves-results.sarif",
expectedResults: 5,
},

if assert.NoError(t, err) && assert.NotNil(t, applicabilityManager.applicabilityScanResults) {
assert.Len(t, applicabilityManager.applicabilityScanResults, 1)
assert.NotEmpty(t, applicabilityManager.applicabilityScanResults[0].Results)
{
name: "new applicability statuses",
fileName: "new_ca_status.sarif",
expectedResults: 5,
expectedApplicabilityStatuses: []string{"applicable", "undetermined", "not_covered", "not_applicable"},
},
}
}

func TestParseResults_AllCvesNotApplicable(t *testing.T) {
// Arrange
scanner, cleanUp := jas.InitJasTest(t)
defer cleanUp()
applicabilityManager := newApplicabilityScanManager(jas.FakeBasicXrayResults, mockDirectDependencies, scanner, false)
applicabilityManager.scanner.ResultsFileName = filepath.Join(jas.GetTestDataPath(), "applicability-scan", "no-applicable-cves-results.sarif")

// Act
var err error
applicabilityManager.applicabilityScanResults, err = jas.ReadJasScanRunsFromFile(applicabilityManager.scanner.ResultsFileName, scanner.JFrogAppsConfig.Modules[0].SourceRoot, applicabilityDocsUrlSuffix)

if assert.NoError(t, err) && assert.NotNil(t, applicabilityManager.applicabilityScanResults) {
assert.Len(t, applicabilityManager.applicabilityScanResults, 1)
assert.NotEmpty(t, applicabilityManager.applicabilityScanResults[0].Results)
for _, tc := range testCases {
t.Run(tc.name, func(t *testing.T) {
applicabilityManager.scanner.ResultsFileName = filepath.Join(jas.GetTestDataPath(), "applicability-scan", tc.fileName)
var err error
applicabilityManager.applicabilityScanResults, err = jas.ReadJasScanRunsFromFile(applicabilityManager.scanner.ResultsFileName, scanner.JFrogAppsConfig.Modules[0].SourceRoot, applicabilityDocsUrlSuffix)
if assert.NoError(t, err) && assert.NotNil(t, applicabilityManager.applicabilityScanResults) {
assert.Len(t, applicabilityManager.applicabilityScanResults, 1)
assert.Len(t, applicabilityManager.applicabilityScanResults[0].Results, tc.expectedResults)
if tc.name == "new applicability statuses" {
assert.Len(t, applicabilityManager.applicabilityScanResults[0].Tool.Driver.Rules, len(tc.expectedApplicabilityStatuses))
for i, value := range tc.expectedApplicabilityStatuses {
assert.Equal(t, value, applicabilityManager.applicabilityScanResults[0].Tool.Driver.Rules[i].Properties["applicability"])
}
}
}
})
}
}
Loading

0 comments on commit 138b1e6

Please sign in to comment.