|
| 1 | +package verbose |
| 2 | + |
| 3 | +import ( |
| 4 | + "errors" |
| 5 | + "fmt" |
| 6 | + "github.com/fabric8-analytics/cli-tools/analyses/driver" |
| 7 | + "github.com/owenrumney/go-sarif/models" |
| 8 | + "github.com/owenrumney/go-sarif/sarif" |
| 9 | + "github.com/rs/zerolog/log" |
| 10 | + "io/ioutil" |
| 11 | + "os" |
| 12 | + "regexp" |
| 13 | + "strings" |
| 14 | +) |
| 15 | + |
| 16 | +type RegexDependencyLocator struct { |
| 17 | + FileContent string |
| 18 | + Ecosystem string |
| 19 | + EndIndices []int |
| 20 | + DependencyNodeIndex []int |
| 21 | +} |
| 22 | + |
| 23 | +func ProcessSarif(analysedResult *driver.GetResponseType, manifestFilePath string) (bool, error) { |
| 24 | + var hasVuln bool |
| 25 | + report, err := sarif.New(sarif.Version210) |
| 26 | + |
| 27 | + if err != nil { |
| 28 | + log.Fatal().Msg("Error forming SARIF respose") |
| 29 | + return false, errors.New("unable to create SARIF file") |
| 30 | + } |
| 31 | + |
| 32 | + run := report.AddRun("CRDA", "https://github.com/fabric8-analytics") |
| 33 | + |
| 34 | + regexDependencyLocator := RegexDependencyLocator{} |
| 35 | + if len(analysedResult.AnalysedDeps) == 0 { |
| 36 | + log.Fatal().Msg("Dependencies have not been analysed") |
| 37 | + return false, errors.New("dependencies have not been analysed") |
| 38 | + } |
| 39 | + err = regexDependencyLocator.SetUp(manifestFilePath, analysedResult.AnalysedDeps[0].Ecosystem) |
| 40 | + |
| 41 | + if err != nil { |
| 42 | + return false, errors.New("unable to setup dependency locator") |
| 43 | + } |
| 44 | + |
| 45 | + manifestParts := strings.Split(manifestFilePath, string(os.PathSeparator)) |
| 46 | + manifest := manifestParts[len(manifestParts) - 1] |
| 47 | + for _, dep := range analysedResult.AnalysedDeps { |
| 48 | + line, column := regexDependencyLocator.LocateDependency(dep.Name) |
| 49 | + for _, publicVuln := range dep.PublicVulnerabilities { |
| 50 | + addVulnToReport(run, publicVuln, manifest, line, column) |
| 51 | + hasVuln = true |
| 52 | + } |
| 53 | + for _, privateVuln := range dep.PrivateVulnerabilities { |
| 54 | + addVulnToReport(run, privateVuln, manifest, line, column) |
| 55 | + hasVuln = true |
| 56 | + } |
| 57 | + } |
| 58 | + |
| 59 | + report.Write(os.Stdout) |
| 60 | + return hasVuln, nil |
| 61 | +} |
| 62 | + |
| 63 | +func addVulnToReport(run *models.Run, vuln driver.VulnerabilitiesType, manifestFilePath string, line int, column int) { |
| 64 | + rule := run.AddRule(vuln.ID). |
| 65 | + WithHelpURI(vuln.URL).WithDescription(vuln.Title) |
| 66 | + |
| 67 | + run.AddResult(rule.ID). |
| 68 | + WithMessage(vuln.Title). |
| 69 | + WithLevel(vuln.Severity). |
| 70 | + WithLocationDetails(manifestFilePath, line, column) |
| 71 | +} |
| 72 | + |
| 73 | + |
| 74 | +func (r *RegexDependencyLocator) SetUp(manifestFilePath string, ecosystem string) error{ |
| 75 | + content, err := ioutil.ReadFile(manifestFilePath) |
| 76 | + if err != nil { |
| 77 | + log.Fatal().Msg("Unable to load manifest File " + manifestFilePath) |
| 78 | + return fmt.Errorf("unable to load manifest file %s" ,manifestFilePath) |
| 79 | + } |
| 80 | + |
| 81 | + r.FileContent = string(content) |
| 82 | + r.Ecosystem = ecosystem |
| 83 | + newLineRegex, _ := regexp.Compile("\n") |
| 84 | + |
| 85 | + lines := newLineRegex.FindAllStringIndex(r.FileContent, -1) |
| 86 | + r.EndIndices = make([]int, len(lines)) |
| 87 | + // Finding the end index for each end of line |
| 88 | + for i, line := range lines { |
| 89 | + r.EndIndices[i] = line[1] |
| 90 | + } |
| 91 | + |
| 92 | + dependenciesRegex, _ := regexp.Compile(getDependencyNodeRegex(r.Ecosystem)) |
| 93 | + // Find the index for the start of the dependency node ( <dependencies> in case of pom.xml, |
| 94 | + // dependencies: in case of package.json) |
| 95 | + r.DependencyNodeIndex = dependenciesRegex.FindStringIndex(r.FileContent) |
| 96 | + |
| 97 | + return nil |
| 98 | + |
| 99 | +} |
| 100 | + |
| 101 | +func (r *RegexDependencyLocator) LocateDependency(dependency string) (int, int){ |
| 102 | + // In case of maven the dependency consists groupId and artifactID |
| 103 | + // Picking up the artifact ID as the dependency |
| 104 | + if r.Ecosystem == "maven" { |
| 105 | + dependencyParts := strings.Split(dependency, ":") |
| 106 | + dependency = dependencyParts[len(dependencyParts) - 1] |
| 107 | + } |
| 108 | + // Adding the actual dependency in to the dependency regex |
| 109 | + dependencyRegexStr := strings.Replace(getDependencyRegex(r.Ecosystem), "?", dependency, 1) |
| 110 | + dependencyRegex, _ := regexp.Compile(dependencyRegexStr) |
| 111 | + dependencyIndex := dependencyRegex.FindStringIndex(r.FileContent) |
| 112 | + |
| 113 | + var lineNum int |
| 114 | + var column int |
| 115 | + |
| 116 | + // Check if the dependency index is within the dependency node |
| 117 | + if r.DependencyNodeIndex[0] < dependencyIndex[0] && dependencyIndex[0] < r.DependencyNodeIndex[1] { |
| 118 | + for i, val := range r.EndIndices { |
| 119 | + // Getting the line num and column number of the dependency |
| 120 | + if val <= dependencyIndex[0] && dependencyIndex[0] < r.EndIndices[i+1] { |
| 121 | + lineNum = i + 2 |
| 122 | + column = dependencyIndex[0] - val + 2 |
| 123 | + break |
| 124 | + } |
| 125 | + } |
| 126 | + } |
| 127 | + return lineNum, column |
| 128 | +} |
| 129 | + |
| 130 | +func getDependencyNodeRegex(ecosystem string) string{ |
| 131 | + switch ecosystem { |
| 132 | + case "npm": |
| 133 | + return "\"dependencies\"[\\s]*:[\\s\n]*{[\\s\na-z\"\\d.,\\-:^]*}" |
| 134 | + case "maven": |
| 135 | + return "<dependencies[\\s\\n]*>[\\s]*[\\s\\n]*[<>!\\s\\w\\/${}\"\\d.,\\-:^]*<\\/dependencies[\\s\\n]*>" |
| 136 | + default: |
| 137 | + return "[\\s\\S]*" |
| 138 | + |
| 139 | + } |
| 140 | +} |
| 141 | + |
| 142 | +func getDependencyRegex(ecosystem string) string{ |
| 143 | + switch ecosystem{ |
| 144 | + case "npm": |
| 145 | + return "\"?\"[\\s]*:[\\s\n]*\"[\\d\\.^\\-\\w]*\"" |
| 146 | + case "maven": |
| 147 | + return "?[\\s\\n]*<\\/artifactId[\\s\\n]*>" |
| 148 | + default: |
| 149 | + return "?[\\s]*==" |
| 150 | + |
| 151 | + } |
| 152 | +} |
| 153 | + |
0 commit comments