NexposeRunner 0.0.16b → 0.0.16

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: f8e89ef4d3e80c11b69a9ac7c428b5364038fa69
-  data.tar.gz: 14fa8331a41d2e546427779f0980db6805d78f0d
+  metadata.gz: dba55e03de0483d335ea8587e78cf98fd592d822
+  data.tar.gz: 17d89e707f96cefae4c27781d5c4804913e58f8a
 SHA512:
-  metadata.gz: 3b0a68bafb364870344cd0d3ccc0bd38a06fcf701321ec300c35b8ac9146d9c59e9b45de51cffec1b3a3f193511fb29332d3668d133ea94f26f6cf5c37fb030b
-  data.tar.gz: 43bf8f648747b2c00a33103c427fcfe08be560668833cdc72e40d6d3268b6bdd962ab0012df7ef6d8d19c2b3097ee6c36475896589f58a00505a6ed1be84948f
+  metadata.gz: a12740921d51d353c6d49cba1b63244f07ae4de715843153da931bb934c4efdb0a67439f98d16f23df7124553068bddff75b8db1ca3e6db1a34eb8c87d77fb16
+  data.tar.gz: ab7c13e940e0cfe7057ba77c6944ec6dc9a8a99216126fb5d738cc6a08e8bf016a16e1a5914646947cf7ee5243210c54e251916e3c12b784c263c62ad89ccf5f

data/NexposeRunner.gemspec

@@ -18,7 +18,7 @@ Gem::Specification.new do |spec|
   spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
   spec.require_paths = ['lib']
 
-  spec.add_dependency 'nexpose', '7.1.1'
+  spec.add_dependency 'nexpose', '0.8.3'
 
   spec.add_development_dependency 'bundler', '~> 1.6'
   spec.add_development_dependency 'rake', '< 11.0'

data/bin/scan

@@ -13,9 +13,8 @@ if ARGV.grep(/^--/).empty?
     'site_name' => ARGV[4], 
     'ip_addresses' => ARGV[5], 
     'scan_template' => ARGV[6],
-    'engine' => ARGV[7],
-    'timeout' => ARGV[8],
-    'open_timeout' => ARGV[9]})
+    'engine' => ARGV[7]
+  })
 else
   NexposeRunner::Scan.start(ARGV)
 end

data/config/scan.yml.example

@@ -6,5 +6,3 @@ site_name: ''
 ip_addresses: ''
 scan_template: ''
 engine: ''
-timeout: ''
-open_timeout: ''

data/lib/NexposeRunner/version.rb

@@ -1,4 +1,3 @@
 module NexposeRunner
-    VERSION = '0.0.16b'
+    VERSION = '0.0.16'
 end
-

data/lib/nexpose-runner/constants.rb

@@ -8,10 +8,8 @@ module CONSTANTS
   REQUIRED_SCAN_TEMPLATE_MESSAGE = 'OOPS! Looks like you forgot to give me a Scan Template to use'
   VULNERABILITY_FOUND_MESSAGE = '---------All YOUR BASE ARE BELONG TO US---------------\nVulnerabilities were found, breaking build'
   DEFAULT_PORT = '3780'
-  DEFAULT_TIMEOUT = '120'
-  DEFAULT_OPEN_TIMEOUT = '120'
   VULNERABILITY_REPORT_NAME = 'nexpose-vulnerability-report.csv'
-  VULNERABILITY_DETAIL_REPORT_NAME = 'nexpose-vulnerability-detail-report.csv'
+  VULNERABILITY_DETAIL_REPORT_NAME = 'nexpose-vulnerability-detail-report.csv' 
   SOFTWARE_REPORT_NAME = 'nexpose-software-report.csv'
   POLICY_REPORT_NAME = 'nexpose-policy-report.csv'
 

data/lib/nexpose-runner/scan.rb

@@ -8,7 +8,7 @@ require 'nexpose-runner/scan_run_description'
 
 module NexposeRunner
   module Scan
-    
+
     def self.allow_vulnerabilities?(vulnerabilities, run_details)
       vuln_array = []
       exceptions_array = get_exceptions(run_details)
@@ -33,8 +33,13 @@ module NexposeRunner
     end
 
     def self.get_exceptions(run_details)
-      uri = URI("#{run_details.exceptions_list_url}")
-      ex = Net::HTTP.get(uri).split("\n")
+      path = "#{run_details.exceptions_list_url}"
+      uri = URI(path)
+      if path.include? "http:"
+        ex = Net::HTTP.get(uri).split("\n")
+      elsif (File.file?(path))
+        ex = File.read(path).split("\n")
+      end
       ex
     end
 
@@ -58,7 +63,7 @@ module NexposeRunner
       puts "Scan complete for #{run_details.site_name}, Generating Vulnerability Report"
       vulnerabilities = generate_report(CONSTANTS::VULNERABILITY_REPORT_QUERY, site.id, nsc)
       generate_csv(vulnerabilities, CONSTANTS::VULNERABILITY_REPORT_NAME)
-      
+
       puts "Scan complete for #{run_details.site_name}, Generating Vulnerability Detail Report"
       vuln_details = generate_report(CONSTANTS:: VULNERABILITY_DETAIL_REPORT_QUERY, site.id, nsc)
       generate_csv(vuln_details, CONSTANTS::VULNERABILITY_DETAIL_REPORT_NAME)
@@ -73,7 +78,7 @@ module NexposeRunner
 
       puts "Scan complete for #{run_details.site_name}, Generating Audit Report"
       generate_template_report(nsc, site.id, CONSTANTS::AUDIT_REPORT_FILE_NAME, CONSTANTS::AUDIT_REPORT_NAME, CONSTANTS::AUDIT_REPORT_FORMAT)
-      
+
       puts "Scan complete for #{run_details.site_name}, Generating Xml Report"
       generate_template_report(nsc, site.id, CONSTANTS::XML_REPORT_FILE_NAME, CONSTANTS::XML_REPORT_NAME, CONSTANTS::XML_REPORT_FORMAT)
 
@@ -83,7 +88,7 @@ module NexposeRunner
     def self.verify_run(vulnerabilities, run_details)
 
       if run_details.exceptions_list_url.to_s.empty? and vulnerabilities.count > 0
-        raise StandardError, CONSTANTS::VULNERABILITY_FOUND_MESSAGE 
+        raise StandardError, CONSTANTS::VULNERABILITY_FOUND_MESSAGE
 
       elsif vulnerabilities.count == 0
           puts "No vulnerabilities found!"
@@ -118,7 +123,7 @@ module NexposeRunner
       end
       site.save nsc
       puts "Created site #{run_details.site_name} successfully with the following host(s) #{run_details.ip_addresses.join(', ')}"
-      
+
       site
     end
 

data/lib/nexpose-runner/scan_run_description.rb

@@ -5,8 +5,6 @@ class ScanRunDescription
   attr_accessor :connection_url, :exceptions_list_url, :username, :password, :port, :site_name, :ip_addresses, :scan_template, :engine
   @@port_value = ''
   @@ip_addresses = []
-  @@timeout = ''
-  @@open_timeout =''
   exceptions_list_url_value = ''
 
   def initialize(options)
@@ -25,8 +23,6 @@ class ScanRunDescription
     self.ip_addresses = options['ip_addresses']
     self.scan_template = options['scan_template']
     self.engine = options['engine']
-    self.timeout = options['timeout']
-    self.open_timeout = options['open_timeout']
   end
 
   def verify
@@ -47,22 +43,6 @@ class ScanRunDescription
     get_value(@@port_value, CONSTANTS::DEFAULT_PORT)
   end
 
-  def timeout=(value)
-    @@timeout = value
-  end
-
-  def timeout
-    get_value(@@timeout, CONSTANTS::DEFAULT_TIMEOUT)
-  end
-
-  def open_timeout=(value)
-    @@open_timeout = value
-  end
-
-  def open_timeout
-    get_value(@@open_timeout, CONSTANTS::DEFAULT_OPEN_TIMEOUT)
-  end
-
   def exceptions_list_url=(value)
     @@exceptions_list_url_value = value
   end

data/spec/data/test_exclist.txt

@@ -0,0 +1,2 @@
+Database Open Access
+MySQL Obsolete Version

data/spec/scan_spec.rb

@@ -21,8 +21,6 @@ describe 'nexpose-runner' do
       @expected_site_name = 'my_cool_software_build-28'
       @expected_ips = '10.5.0.15,10.5.0.20,10.5.0.35'
       @expected_scan_template = 'full-audit-widget-corp'
-      @timeout = '120'
-      @open_timeout = '120'
 
       @mock_scan_id = '12'
       @mock_site_id = '1'
@@ -31,8 +29,8 @@ describe 'nexpose-runner' do
       @mock_vuln_report = 'ip_address,title,date_published,severity,summary,fix
                             10.5.0.15,Database Open Access,2010-01-01,Severe,Restrict database access,<p><p>Configure the database server to only allow access to trusted systems. For example, the PCI DSS standard requires you to place the database in an internal network zone, segregated from the DMZ </p></p>
                             10.5.0.15.180,MySQL Obsolete Version,2007-07-25,Critical,Upgrade to the latest version of Oracle MySQL,<p>Download and apply the upgrade from: <a href=http://dev.mysql.com/downloads/mysql>http://dev.mysql.com/downloads/mysql</a></p>'.chomp
-      @mock_exceptions = "Database Open Access\nMySQL Obsolete Version"                      
-      
+      @mock_exceptions = "Database Open Access\nMySQL Obsolete Version"
+
       @mock_vuln_detail_report = 'stuff'.chomp
 
       @mock_software_report = 'name,ip_address,host_name,description,description,vendor,name,version
@@ -65,8 +63,6 @@ describe 'nexpose-runner' do
         'site_name' => @expected_site_name,
         'ip_addresses' => @expected_ips,
         'scan_template' => @expected_scan_template,
-        'timeout' => @timeout,
-        'open_timeout' => @open_timeout
       }
 
     end
@@ -74,10 +70,9 @@ describe 'nexpose-runner' do
       it 'should create a session with the nexpose server' do
         expect(Nexpose::Connection).to receive(:new)
                                     .with(@options['connection_url'],
-                                          @options['username'], 
-                                          @options['password'], 
-                                          @options['port']
-                                         )
+                                          @options['username'],
+                                          @options['password'],
+                                          @options['port'])
                                     .and_return(@mock_nexpose_client)
 
         expect(@mock_nexpose_client).to receive(:login)
@@ -89,56 +84,56 @@ describe 'nexpose-runner' do
       it 'should throw an error if no connection url is passed' do
         options = @options.clone
         options['connection_url'] = nil
-        expect { 
-          NexposeRunner::Scan.start(options) 
+        expect {
+          NexposeRunner::Scan.start(options)
         }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me the URL/IP address to your Nexpose Server')
       end
 
       it 'should throw an error if no username is passed' do
         options = @options.clone
         options['username'] = nil
-        expect { 
-          NexposeRunner::Scan.start(options) 
+        expect {
+          NexposeRunner::Scan.start(options)
         }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me a username to login to Nexpose with')
       end
 
       it 'should throw an error if no password is passed' do
         options = @options.clone
         options['password'] = nil
-        expect { 
-          NexposeRunner::Scan.start(options) 
+        expect {
+          NexposeRunner::Scan.start(options)
         }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me a password to login to Nexpose with')
       end
 
       it 'should throw an error if no site name is passed' do
         options = @options.clone
         options['site_name'] = nil
-        expect { 
-          NexposeRunner::Scan.start(options) 
+        expect {
+          NexposeRunner::Scan.start(options)
         }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me a Nexpose Site Name')
       end
 
       it 'should throw an error if no ip address is passed' do
         options = @options.clone
         options['ip_addresses'] = '';
-        expect { 
-          NexposeRunner::Scan.start(options) 
+        expect {
+          NexposeRunner::Scan.start(options)
         }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me an IP Address to scan')
       end
 
       it 'should throw an error if no scan template is passed' do
         options = @options.clone
         options['scan_template'] = nil
-        expect { 
-          NexposeRunner::Scan.start(options) 
+        expect {
+          NexposeRunner::Scan.start(options)
         }.to raise_error(StandardError, 'OOPS! Looks like you forgot to give me a Scan Template to use')
       end
 
       it 'should use 3780 as default if port is empty string' do
         expect(Nexpose::Connection).to receive(:new)
-                                       .with(@options['connection_url'], 
-                                             @options['username'], 
-                                             @options['password'], 
+                                       .with(@options['connection_url'],
+                                             @options['username'],
+                                             @options['password'],
                                              '3780')
                                        .and_return(@mock_nexpose_client)
 
@@ -181,37 +176,37 @@ describe 'nexpose-runner' do
       describe 'wait for the Nexpose Scan to complete' do
         it 'should call to check the status of the scan' do
           expect(@mock_nexpose_client).to receive(:scan_statistics).with(@mock_scan_id)
-  
+
           NexposeRunner::Scan.start(@options)
         end
-  
+
         it 'should call to check the status until it is not running' do
           expect(@mock_scan_summary).to receive(:status)
                                       .and_return(Nexpose::Scan::Status::RUNNING)
                                       .exactly(3).times
                                       .ordered
-  
+
           expect(@mock_scan_summary).to receive(:status)
                                       .and_return(Nexpose::Scan::Status::FINISHED)
                                       .once
                                       .ordered
-  
+
           NexposeRunner::Scan.start(@options)
         end
-  
+
         it 'should sleep for 3 seconds if the status is still running' do
           expect(@mock_scan_summary).to receive(:status)
                                       .and_return(Nexpose::Scan::Status::RUNNING)
                                       .exactly(3).times
                                       .ordered
-  
+
           expect(@mock_scan_summary).to receive(:status)
                                       .and_return(Nexpose::Scan::Status::FINISHED)
                                       .once
                                       .ordered
 
           expect(NexposeRunner::Scan).to receive(:sleep).with(3).exactly(4).times
-  
+
           NexposeRunner::Scan.start(@options)
         end
       end
@@ -230,16 +225,16 @@ describe 'nexpose-runner' do
           expect(Nexpose::AdhocReportConfig).to receive(:new)
                                                 .with(CONSTANTS::AUDIT_REPORT_NAME, CONSTANTS::AUDIT_REPORT_FORMAT, @mock_site_id)
                                                 .and_return(@mock_report)
-        
+
           expect(Nexpose::AdhocReportConfig).to receive(:new)
                                                 .with(CONSTANTS::XML_REPORT_NAME, CONSTANTS::XML_REPORT_FORMAT, @mock_site_id)
                                                 .and_return(@mock_report)
 
           expect_template_report_to_be_called_with(CONSTANTS::AUDIT_REPORT_FILE_NAME)
           expect_template_report_to_be_called_with(CONSTANTS::XML_REPORT_FILE_NAME)
-          
-          expect { 
-            NexposeRunner::Scan.start(@options) 
+
+          expect {
+            NexposeRunner::Scan.start(@options)
           }.to raise_error(StandardError, CONSTANTS::VULNERABILITY_FOUND_MESSAGE)
       end
     end
@@ -247,19 +242,30 @@ describe 'nexpose-runner' do
       it 'should throw exception if vulnerability exists' do
       expect_report_to_be_called_with(CONSTANTS::VULNERABILITY_REPORT_NAME, CONSTANTS::VULNERABILITY_REPORT_QUERY, @mock_vuln_report)
 
-      expect { 
-        NexposeRunner::Scan.start(@options) 
+      expect {
+        NexposeRunner::Scan.start(@options)
       }.to raise_error(StandardError, CONSTANTS::VULNERABILITY_FOUND_MESSAGE)
     end
 
     it 'should not throw exception if exceptions exist for all vulnerabilities' do
       expect_report_to_be_called_with(CONSTANTS::VULNERABILITY_REPORT_NAME, CONSTANTS::VULNERABILITY_REPORT_QUERY, @mock_vuln_report)
-      
+
       options = @options.clone
       options['exceptions_list_url'] = 'http://google.com'
-      
+
       expect_exceptions_to_be_called_with(options['exceptions_list_url'])
-      
+
+      NexposeRunner::Scan.start(options)
+      end
+
+    it 'should not throw exception if exceptions exist from a file for all vulnerabilities' do
+      expect_report_to_be_called_with(CONSTANTS::VULNERABILITY_REPORT_NAME, CONSTANTS::VULNERABILITY_REPORT_QUERY, @mock_vuln_report)
+
+      options = @options.clone
+      options['exceptions_list_url'] = 'spec/data/test_exclist.txt'
+
+      expect_exceptions_to_be_called_with_file(options['exceptions_list_url'])
+
       NexposeRunner::Scan.start(options)
       end
   end
@@ -275,6 +281,10 @@ def expect_exceptions_to_be_called_with(exceptions_list_url)
                           .with(uri).and_return(@mock_exceptions)
 end
 
+def expect_exceptions_to_be_called_with_file(exceptions_list_url)
+  expect(File.read(exceptions_list_url)).to eq "Database Open Access\nMySQL Obsolete Version\n"
+end
+
 def expect_report_to_be_called_with(report_name, report_query, report_response)
   expect(@mock_report).to receive(:add_filter)
                           .with('version', '1.3.0')
@@ -311,29 +321,29 @@ def get_mock_nexpose_client
 
   allow(Nexpose::Connection).to receive(:new)
                              .and_return(mock_nexpose_client)
-                             
+
   allow(mock_nexpose_client).to receive(:make_xml)
                              .with(any_args)
                              .and_return(xml)
-                             
+
   allow(mock_nexpose_client).to receive(:make_xml)
                              .with(any_args)
                              .and_return(xml)
-                             
+
   allow(mock_nexpose_client).to receive(:filter)
                             .with(any_args)
-                            .and_return({})                             
-                             
+                            .and_return({})
+
   allow(mock_nexpose_client).to receive(:execute)
                              .with(any_args)
                              .and_return(mock_api_request)
-                             
+
   allow(mock_api_request).to receive(:success)
                              .and_return(false) #this is just to shut up the underlying api.
-                             
+
   allow(mock_api_request).to receive(:attributes)
-                             .and_return(xml)                             
-                             
+                             .and_return(xml)
+
   mock_nexpose_client
 end
 
@@ -345,9 +355,9 @@ def get_mock_scan_summary
   allow(mock_scan_summary).to receive(:tasks).and_return(tasks)
 
   allow(mock_scan_summary).to receive(:status).and_return(
-				Nexpose::Scan::Status::RUNNING, 
 				Nexpose::Scan::Status::RUNNING,
- 				Nexpose::Scan::Status::RUNNING, 
+				Nexpose::Scan::Status::RUNNING,
+ 				Nexpose::Scan::Status::RUNNING,
 				Nexpose::Scan::Status::FINISHED)
   mock_scan_summary
 end
@@ -411,4 +421,3 @@ def get_mock_scan
   allow(mock_scan).to receive(:id).and_return(@mock_scan_id)
   mock_scan
 end
-

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: NexposeRunner
 version: !ruby/object:Gem::Version
-  version: 0.0.16b
+  version: 0.0.16
 platform: ruby
 authors:
 - Nathan Gibson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-10-27 00:00:00.000000000 Z
+date: 2017-10-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nexpose
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.1
+        version: 0.8.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.1
+        version: 0.8.3
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -91,6 +91,7 @@ files:
 - lib/nexpose-runner/constants.rb
 - lib/nexpose-runner/scan.rb
 - lib/nexpose-runner/scan_run_description.rb
+- spec/data/test_exclist.txt
 - spec/scan_config_spec.rb
 - spec/scan_spec.rb
 - spec/spec_helper.rb
@@ -109,9 +110,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">"
+  - - ">="
     - !ruby/object:Gem::Version
-      version: 1.3.1
+      version: '0'
 requirements: []
 rubyforge_project: 
 rubygems_version: 2.5.2
@@ -122,6 +123,7 @@ summary: This is a gem that provides the ability to create a new site, add an IP
   and finally produce a reports for vulnerabilities, installed software, and policy
   compliance.
 test_files:
+- spec/data/test_exclist.txt
 - spec/scan_config_spec.rb
 - spec/scan_spec.rb
 - spec/spec_helper.rb