codesake-dawn 1.0.6 → 1.1.0.rc1

data/lib/codesake/dawn/knowledge_base.rb

@@ -5,6 +5,8 @@ require "codesake/dawn/kb/dependency_check"
 require "codesake/dawn/kb/ruby_version_check"
 require "codesake/dawn/kb/operating_system_check"
 require "codesake/dawn/kb/combo_check"
+require "codesake/dawn/kb/version_check"
+require "codesake/dawn/kb/deprecation_check"
 
 # Q&A related checks
 ## Not revised code
@@ -111,6 +113,7 @@ require "codesake/dawn/kb/cve_2011_3186"
 require "codesake/dawn/kb/cve_2011_3187"
 require "codesake/dawn/kb/cve_2011_4319"
 require "codesake/dawn/kb/cve_2011_4815"
+require "codesake/dawn/kb/cve_2011_5036"
 
 # CVE - 2012
 require "codesake/dawn/kb/cve_2012_1098"
@@ -134,6 +137,7 @@ require "codesake/dawn/kb/cve_2012_4522"
 require "codesake/dawn/kb/cve_2012_5370"
 require "codesake/dawn/kb/cve_2012_5371"
 require "codesake/dawn/kb/cve_2012_5380"
+require "codesake/dawn/kb/cve_2012_6109"
 require "codesake/dawn/kb/cve_2012_6134"
 require "codesake/dawn/kb/cve_2012_6496"
 require "codesake/dawn/kb/cve_2012_6497"
@@ -143,8 +147,11 @@ require "codesake/dawn/kb/cve_2013_0155"
 require "codesake/dawn/kb/cve_2013_0156"
 require "codesake/dawn/kb/cve_2013_0162"
 require "codesake/dawn/kb/cve_2013_0175"
+require "codesake/dawn/kb/cve_2013_0183"
+require "codesake/dawn/kb/cve_2013_0184"
 require "codesake/dawn/kb/cve_2013_0233"
 require "codesake/dawn/kb/cve_2013_0256"
+require "codesake/dawn/kb/cve_2013_0262"
 require "codesake/dawn/kb/cve_2013_0263"
 require "codesake/dawn/kb/cve_2013_0269"
 require "codesake/dawn/kb/cve_2013_0276"
@@ -152,6 +159,7 @@ require "codesake/dawn/kb/cve_2013_0277"
 require "codesake/dawn/kb/cve_2013_0284"
 require "codesake/dawn/kb/cve_2013_0285"
 require "codesake/dawn/kb/cve_2013_0333"
+require "codesake/dawn/kb/cve_2013_1607"
 require "codesake/dawn/kb/cve_2013_1655"
 require "codesake/dawn/kb/cve_2013_1656"
 require "codesake/dawn/kb/cve_2013_1756"
@@ -173,19 +181,26 @@ require "codesake/dawn/kb/cve_2013_1948"
 require "codesake/dawn/kb/cve_2013_2065"
 require "codesake/dawn/kb/cve_2013_2090"
 require "codesake/dawn/kb/cve_2013_2119"
+require "codesake/dawn/kb/cve_2013_2512"
+require "codesake/dawn/kb/cve_2013_2513"
+require "codesake/dawn/kb/cve_2013_2516"
 require "codesake/dawn/kb/cve_2013_2615"
 require "codesake/dawn/kb/cve_2013_2616"
 require "codesake/dawn/kb/cve_2013_2617"
 require "codesake/dawn/kb/cve_2013_3221"
 require "codesake/dawn/kb/cve_2013_4164"
 require "codesake/dawn/kb/cve_2013_4389"
+require "codesake/dawn/kb/cve_2013_4413"
 require "codesake/dawn/kb/cve_2013_4457"
 require "codesake/dawn/kb/cve_2013_4478"
 require "codesake/dawn/kb/cve_2013_4479"
+require "codesake/dawn/kb/cve_2013_4489"
 require "codesake/dawn/kb/cve_2013_4491"
 require "codesake/dawn/kb/cve_2013_4492"
 require "codesake/dawn/kb/cve_2013_4562"
+require "codesake/dawn/kb/cve_2013_4593"
 require "codesake/dawn/kb/cve_2013_5647"
+require "codesake/dawn/kb/cve_2013_5671"
 require "codesake/dawn/kb/cve_2013_6414"
 require "codesake/dawn/kb/cve_2013_6415"
 require "codesake/dawn/kb/cve_2013_6416"
@@ -197,6 +212,7 @@ require "codesake/dawn/kb/cve_2013_7086"
 # CVE - 2014
 
 require "codesake/dawn/kb/cve_2014_0036"
+require "codesake/dawn/kb/cve_2014_0080"
 require "codesake/dawn/kb/cve_2014_0081"
 require "codesake/dawn/kb/cve_2014_0082"
 require "codesake/dawn/kb/cve_2014_1233"
@@ -217,13 +233,16 @@ module Codesake
       OS_CHECK            = :os_check
       COMBO_CHECK         = :combo_check
 
-      def initialize
-        @security_checks = Codesake::Dawn::KnowledgeBase.load_security_checks
+      def initialize(options={})
+        @enabled_checks = Codesake::Dawn::Kb::BasicCheck::ALLOWED_FAMILIES
+        @enabled_checks = options[:enabled_checks] unless options[:enabled_check].nil?
+
+        @security_checks = load_security_checks
       end
 
       def self.find(checks=nil, name)
         return nil if name.nil? or name.empty?
-        checks = Codesake::Dawn::KnowledgeBase.load_security_checks if checks.nil?
+        checks = Codesake::Dawn::KnowledgeBase.new.load_security_checks if checks.nil?
 
         checks.each do |sc|
           return sc if sc.name == name
@@ -239,6 +258,13 @@ module Codesake
         @security_checks
       end
 
+      # TODO - next big refactoring will include also a change in this API.
+      #
+      # So to match Semantic Version, it must bring to a major version bump.
+      # MVC name should be passed as constructor option, so the all_by_mvc can
+      #
+      # be called without parameter, having a nice-to-read code.
+      # @checks = Codesake::Dawn::KnowledgeBase.new({:enabled_checks=>@enabled_checks}).all_by_mvc(@name) 
       def all_by_mvc(mvc)
         ret = []
         @security_checks.each do |sc|
@@ -263,61 +289,53 @@ module Codesake
         self.all_by_mvc("rack")
       end
 
-      def self.load_security_checks
-        [  
-          Codesake::Dawn::Kb::NotRevisedCode.new,
-          Codesake::Dawn::Kb::OwaspRorCheatSheet::CommandInjection.new,
-          Codesake::Dawn::Kb::OwaspRorCheatSheet::Csrf.new,
-          Codesake::Dawn::Kb::OwaspRorCheatSheet::SessionStoredInDatabase.new,
-          Codesake::Dawn::Kb::OwaspRorCheatSheet::MassAssignmentInModel.new, 
-          Codesake::Dawn::Kb::OwaspRorCheatSheet::SecurityRelatedHeaders.new, 
-          Codesake::Dawn::Kb::OwaspRorCheatSheet::CheckForSafeRedirectAndForward.new,
-          Codesake::Dawn::Kb::OwaspRorCheatSheet::SensitiveFiles.new,
-          Codesake::Dawn::Kb::SimpleForm_Xss_20131129.new,
-          Codesake::Dawn::Kb::NokogiriDos20131217.new,
-          Codesake::Dawn::Kb::Nokogiri_EntityExpansion_Dos_20131217.new,
-          Codesake::Dawn::Kb::CVE_2004_0755.new, 
-          Codesake::Dawn::Kb::CVE_2004_0983.new, 
-          Codesake::Dawn::Kb::CVE_2005_1992.new, 
-          Codesake::Dawn::Kb::CVE_2005_2337.new, 
-          Codesake::Dawn::Kb::CVE_2006_1931.new, 
-          Codesake::Dawn::Kb::CVE_2006_2582.new, 
-          Codesake::Dawn::Kb::CVE_2006_3694.new, 
-          Codesake::Dawn::Kb::CVE_2006_4112.new, 
-          Codesake::Dawn::Kb::CVE_2006_5467.new, 
-          Codesake::Dawn::Kb::CVE_2006_6303.new, 
-          Codesake::Dawn::Kb::CVE_2006_6852.new, 
-          Codesake::Dawn::Kb::CVE_2006_6979.new, 
-          Codesake::Dawn::Kb::CVE_2007_0469.new, 
-          Codesake::Dawn::Kb::CVE_2007_5162.new, 
-          Codesake::Dawn::Kb::CVE_2007_5379.new, 
-          Codesake::Dawn::Kb::CVE_2007_5380.new, 
-          Codesake::Dawn::Kb::CVE_2007_5770.new, 
-          Codesake::Dawn::Kb::CVE_2007_6077.new, 
-          Codesake::Dawn::Kb::CVE_2007_6612.new, 
-          Codesake::Dawn::Kb::CVE_2008_1145.new, 
-          Codesake::Dawn::Kb::CVE_2008_1891.new, 
-          Codesake::Dawn::Kb::CVE_2008_2376.new, 
-          Codesake::Dawn::Kb::CVE_2008_2662.new, 
-          Codesake::Dawn::Kb::CVE_2008_2663.new, 
-          Codesake::Dawn::Kb::CVE_2008_2664.new, 
-          Codesake::Dawn::Kb::CVE_2008_2725.new, 
-          Codesake::Dawn::Kb::CVE_2008_3655.new, 
-          Codesake::Dawn::Kb::CVE_2008_3657.new, 
-          Codesake::Dawn::Kb::CVE_2008_3790.new, 
-          Codesake::Dawn::Kb::CVE_2008_3905.new, 
-          Codesake::Dawn::Kb::CVE_2008_4094.new, 
-          Codesake::Dawn::Kb::CVE_2008_4310.new, 
-          Codesake::Dawn::Kb::CVE_2008_5189.new, 
-          Codesake::Dawn::Kb::CVE_2008_7248.new, 
-          Codesake::Dawn::Kb::CVE_2009_4078.new, 
-          Codesake::Dawn::Kb::CVE_2009_4124.new, 
-          Codesake::Dawn::Kb::CVE_2009_4214.new, 
-          Codesake::Dawn::Kb::CVE_2010_1330.new, 
-          Codesake::Dawn::Kb::CVE_2010_2489.new, 
-          Codesake::Dawn::Kb::CVE_2010_3933.new, 
-          Codesake::Dawn::Kb::CVE_2011_0188.new, 
-          Codesake::Dawn::Kb::CVE_2011_0446.new, 
+      def load_security_checks
+
+        # START @cve_security_checks array
+        @cve_security_checks =
+        [
+          Codesake::Dawn::Kb::CVE_2004_0755.new,
+          Codesake::Dawn::Kb::CVE_2004_0983.new,
+          Codesake::Dawn::Kb::CVE_2005_1992.new,
+          Codesake::Dawn::Kb::CVE_2005_2337.new,
+          Codesake::Dawn::Kb::CVE_2006_1931.new,
+          Codesake::Dawn::Kb::CVE_2006_2582.new,
+          Codesake::Dawn::Kb::CVE_2006_3694.new,
+          Codesake::Dawn::Kb::CVE_2006_4112.new,
+          Codesake::Dawn::Kb::CVE_2006_5467.new,
+          Codesake::Dawn::Kb::CVE_2006_6303.new,
+          Codesake::Dawn::Kb::CVE_2006_6852.new,
+          Codesake::Dawn::Kb::CVE_2006_6979.new,
+          Codesake::Dawn::Kb::CVE_2007_0469.new,
+          Codesake::Dawn::Kb::CVE_2007_5162.new,
+          Codesake::Dawn::Kb::CVE_2007_5379.new,
+          Codesake::Dawn::Kb::CVE_2007_5380.new,
+          Codesake::Dawn::Kb::CVE_2007_5770.new,
+          Codesake::Dawn::Kb::CVE_2007_6077.new,
+          Codesake::Dawn::Kb::CVE_2007_6612.new,
+          Codesake::Dawn::Kb::CVE_2008_1145.new,
+          Codesake::Dawn::Kb::CVE_2008_1891.new,
+          Codesake::Dawn::Kb::CVE_2008_2376.new,
+          Codesake::Dawn::Kb::CVE_2008_2662.new,
+          Codesake::Dawn::Kb::CVE_2008_2663.new,
+          Codesake::Dawn::Kb::CVE_2008_2664.new,
+          Codesake::Dawn::Kb::CVE_2008_2725.new,
+          Codesake::Dawn::Kb::CVE_2008_3655.new,
+          Codesake::Dawn::Kb::CVE_2008_3657.new,
+          Codesake::Dawn::Kb::CVE_2008_3790.new,
+          Codesake::Dawn::Kb::CVE_2008_3905.new,
+          Codesake::Dawn::Kb::CVE_2008_4094.new,
+          Codesake::Dawn::Kb::CVE_2008_4310.new,
+          Codesake::Dawn::Kb::CVE_2008_5189.new,
+          Codesake::Dawn::Kb::CVE_2008_7248.new,
+          Codesake::Dawn::Kb::CVE_2009_4078.new,
+          Codesake::Dawn::Kb::CVE_2009_4124.new,
+          Codesake::Dawn::Kb::CVE_2009_4214.new,
+          Codesake::Dawn::Kb::CVE_2010_1330.new,
+          Codesake::Dawn::Kb::CVE_2010_2489.new,
+          Codesake::Dawn::Kb::CVE_2010_3933.new,
+          Codesake::Dawn::Kb::CVE_2011_0188.new,
+          Codesake::Dawn::Kb::CVE_2011_0446.new,
           Codesake::Dawn::Kb::CVE_2011_0447.new, 
           Codesake::Dawn::Kb::CVE_2011_0739.new, 
           Codesake::Dawn::Kb::CVE_2011_0995.new, 
@@ -335,6 +353,7 @@ module Codesake
           Codesake::Dawn::Kb::CVE_2011_3187.new, 
           Codesake::Dawn::Kb::CVE_2011_4319.new, 
           Codesake::Dawn::Kb::CVE_2011_4815.new, 
+          Codesake::Dawn::Kb::CVE_2011_5036.new, 
           Codesake::Dawn::Kb::CVE_2012_1098.new, 
           Codesake::Dawn::Kb::CVE_2012_1099.new, 
           Codesake::Dawn::Kb::CVE_2012_1241.new, 
@@ -356,6 +375,7 @@ module Codesake
           Codesake::Dawn::Kb::CVE_2012_5370.new, 
           Codesake::Dawn::Kb::CVE_2012_5371.new, 
           Codesake::Dawn::Kb::CVE_2012_5380.new, 
+          Codesake::Dawn::Kb::CVE_2012_6109.new, 
           Codesake::Dawn::Kb::CVE_2012_6134.new, 
           Codesake::Dawn::Kb::CVE_2012_6496.new, 
           Codesake::Dawn::Kb::CVE_2012_6497.new,
@@ -363,8 +383,11 @@ module Codesake
           Codesake::Dawn::Kb::CVE_2013_0156.new,
           Codesake::Dawn::Kb::CVE_2013_0162.new,
           Codesake::Dawn::Kb::CVE_2013_0175.new,
+          Codesake::Dawn::Kb::CVE_2013_0183.new,
+          Codesake::Dawn::Kb::CVE_2013_0184.new,
           Codesake::Dawn::Kb::CVE_2013_0233.new,
           Codesake::Dawn::Kb::CVE_2013_0256.new,
+          Codesake::Dawn::Kb::CVE_2013_0262.new,
           Codesake::Dawn::Kb::CVE_2013_0263.new,
           Codesake::Dawn::Kb::CVE_2013_0269.new,
           Codesake::Dawn::Kb::CVE_2013_0276.new,
@@ -372,6 +395,7 @@ module Codesake
           Codesake::Dawn::Kb::CVE_2013_0284.new,
           Codesake::Dawn::Kb::CVE_2013_0285.new,
           Codesake::Dawn::Kb::CVE_2013_0333.new,
+          Codesake::Dawn::Kb::CVE_2013_1607.new,
           Codesake::Dawn::Kb::CVE_2013_1655.new,
           Codesake::Dawn::Kb::CVE_2013_1656.new,
           Codesake::Dawn::Kb::CVE_2013_1756.new,
@@ -393,19 +417,26 @@ module Codesake
           Codesake::Dawn::Kb::CVE_2013_2065.new, 
           Codesake::Dawn::Kb::CVE_2013_2090.new, 
           Codesake::Dawn::Kb::CVE_2013_2119.new, 
+          Codesake::Dawn::Kb::CVE_2013_2512.new, 
+          Codesake::Dawn::Kb::CVE_2013_2513.new, 
+          Codesake::Dawn::Kb::CVE_2013_2516.new, 
           Codesake::Dawn::Kb::CVE_2013_2615.new, 
           Codesake::Dawn::Kb::CVE_2013_2616.new, 
           Codesake::Dawn::Kb::CVE_2013_2617.new, 
           Codesake::Dawn::Kb::CVE_2013_3221.new, 
           Codesake::Dawn::Kb::CVE_2013_4164.new, 
           Codesake::Dawn::Kb::CVE_2013_4389.new, 
+          Codesake::Dawn::Kb::CVE_2013_4413.new,
           Codesake::Dawn::Kb::CVE_2013_4457.new,
           Codesake::Dawn::Kb::CVE_2013_4478.new,
           Codesake::Dawn::Kb::CVE_2013_4479.new,
+          Codesake::Dawn::Kb::CVE_2013_4489.new,
           Codesake::Dawn::Kb::CVE_2013_4491.new,
           Codesake::Dawn::Kb::CVE_2013_4492.new,
           Codesake::Dawn::Kb::CVE_2013_4562.new, 
+          Codesake::Dawn::Kb::CVE_2013_4593.new, 
           Codesake::Dawn::Kb::CVE_2013_5647.new, 
+          Codesake::Dawn::Kb::CVE_2013_5671.new, 
           Codesake::Dawn::Kb::CVE_2013_6414.new, 
           Codesake::Dawn::Kb::CVE_2013_6415.new, 
           Codesake::Dawn::Kb::CVE_2013_6416.new, 
@@ -414,14 +445,43 @@ module Codesake
           Codesake::Dawn::Kb::CVE_2013_6459.new, 
           Codesake::Dawn::Kb::CVE_2013_7086.new, 
           Codesake::Dawn::Kb::CVE_2014_0036.new, 
+          Codesake::Dawn::Kb::CVE_2014_0080.new, 
           Codesake::Dawn::Kb::CVE_2014_0081.new, 
           Codesake::Dawn::Kb::CVE_2014_0082.new, 
           Codesake::Dawn::Kb::CVE_2014_1233.new,
           Codesake::Dawn::Kb::CVE_2014_1234.new,
           Codesake::Dawn::Kb::CVE_2014_2322.new,
           Codesake::Dawn::Kb::CVE_2014_2538.new,
-
         ]
+        # END @cve_security_checks array
+        # START @owasp_ror_cheatsheet_checks array
+        @owasp_ror_cheatsheet_checks = [
+          Codesake::Dawn::Kb::OwaspRorCheatSheet::CommandInjection.new,
+          Codesake::Dawn::Kb::OwaspRorCheatSheet::Csrf.new,
+          Codesake::Dawn::Kb::OwaspRorCheatSheet::SessionStoredInDatabase.new,
+          Codesake::Dawn::Kb::OwaspRorCheatSheet::MassAssignmentInModel.new, 
+          Codesake::Dawn::Kb::OwaspRorCheatSheet::SecurityRelatedHeaders.new, 
+          Codesake::Dawn::Kb::OwaspRorCheatSheet::CheckForSafeRedirectAndForward.new,
+          Codesake::Dawn::Kb::OwaspRorCheatSheet::SensitiveFiles.new,
+        ]
+        # END @owasp_ror_cheatsheet_checks array
+        @code_quality_checks = [
+          Codesake::Dawn::Kb::NotRevisedCode.new,
+        ]
+        @aux_checks =
+        [
+          Codesake::Dawn::Kb::SimpleForm_Xss_20131129.new,
+          Codesake::Dawn::Kb::NokogiriDos20131217.new,
+          Codesake::Dawn::Kb::Nokogiri_EntityExpansion_Dos_20131217.new,
+        ]
+
+        ret = []
+        ret += @aux_checks
+        ret += @cve_security_checks         if @enabled_checks.include?(:cve_bulletin)
+        ret += @owasp_ror_cheatsheet_checks if @enabled_checks.include?(:owasp_ror_cheatsheet)
+        ret += @code_quality_checks         if @enabled_checks.include?(:code_quality)
+
+        ret
       end
     end
 

data/lib/codesake/dawn/reporter.rb

@@ -0,0 +1,272 @@
+module Codesake
+  module Dawn
+    class Reporter
+
+      def initialize(options={})
+        @engine = nil
+        @ret = false
+
+        @filename = options[:filename]
+        @ret = options[:apply_all_code] unless options[:apply_all_code].nil?
+        @format = options[:format] unless options[:format].nil?
+        @engine = options[:engine] unless options[:engine].nil?
+
+        @format = :console unless is_valid_format?(@format)
+      end
+
+      def report
+        ascii_tabular_report  if @format == :tabular
+        json_report           if @format == :json
+        ascii_plain_report    if @format == :console
+        html_report           if @format == :html
+      end
+      private
+
+      def write(output)
+
+        puts output if @filename.nil?
+
+        unless @filename.nil?
+          $logger.warn "I will use codesake.css, bootstrap.min.css and bootstrap.js stored in ./support/ directory" if @format == :html
+          File.open(@filename, "w") do |f|
+            f.puts output
+          end
+          $logger.ok "#{@filename} created (#{output.length} bytes)"
+        end
+      end
+      def is_valid_format?(format)
+        return false if format.nil?
+        return true if (format == :console) || (format == :tabular) || (format == :json) || (format == :html) || (format == :csv)
+        return false # otherwise
+      end
+
+      def html_report
+        html_head = "<!doctype html>\n<html>\n<head>\n<title>Codesake::Dawn report for #{File.basename(@engine.target)}</title>"
+        html_head += "<script src=\"./support/bootstrap.js\"></script>\n"
+        html_head += "<link href=\"./support/codesake.css\" media=\"all\" rel=\"stylesheet\" />\n"
+        html_head += "<link href=\"./support/bootstrap.min.css\" media=\"all\" rel=\"stylesheet\" />\n"
+        html_head += "</head>\n"
+        html_body =  "<body>\n"
+        html_body +=  ""
+        html_body += "<div id=\"wrap\">\n"
+        html_body += "<div class=\"container-narrow\">\n"
+        html_body += "<div class=\"masthead\">\n"
+        html_body += "<ul class=\"nav nav-pills pull-right\">\n"
+        html_body += "<li class=\"\"><a href=\"https://dawn.codesake.com\">Home</a></li>\n"
+        html_body += "<li class=\"active\"><a href=\"https://github.com/codesake/codesake-dawn\">Github repo</a></li>\n"
+        html_body += "</ul>\n"
+        html_body += "<h3 class=\"muted\">Codesake::Dawn</h3>\n"
+        html_body += "</div>\n"
+        html_body += "<h1>Security code review results for \"#{File.basename(@engine.target)}\"</h1>\n"
+        html_body += "<hr />\n"
+        html_body += "<h2>Scan detail</h2>\n"
+        html_body += "<div class=\"row\">\n"
+        html_body += "<p>The scan was last executed #{@engine.scan_start.strftime("%d %b %Y - %T")} and Codesake::Dawn founds #{@engine.count_vulnerabilities} vulnerabilities</p>\n"
+        html_body += "</div>\n"
+        html_body += "<hr />\n"
+        html_body += "<h2>Scan details</h2>\n"
+        html_body += "<table class=\"table-striped table-bordered table\">\n"
+        html_body += "<thead><tr><td>Key</td><td>Value</td></tr></thead>\n"
+        html_body += "<tbody>\n"
+        html_body += "<tr><td>Dawn version</td><td>#{Codesake::Dawn::VERSION}</td></tr>" unless Codesake::Dawn::RELEASE == "(development)\n"
+        html_body += "<tr><td>Dawn development version</td><td>#{Codesake::Dawn::VERSION}</td></tr>" if Codesake::Dawn::RELEASE == "(development)\n"
+        html_body += "<tr><td>Scan duration</td><td>#{@engine.scan_time.round(3)} sec</td></tr>\n"
+        html_body += "<tr><td>Target</td><td>#{@engine.target}</td></tr>\n"
+        html_body += "<tr><td>MVC detected framework</td><td>#{@engine.name} v#{@engine.get_mvc_version}</td></tr>" unless @engine.name == "Gemfile.lock\n"
+        html_body += "<tr><td>MVC detected framework</td><td>#{@engine.force} v#{@engine.get_mvc_version}</td></tr>" if @engine.name == "Gemfile.lock\n"
+        if @ret
+          html_body += "<tr><td>Applied checks</td><td>#{@engine.applied_checks} security checks</td></tr>\n"
+          html_body += "<tr><td>Skipped checks</td><td>#{@engine.skipped_checks} security checks</td></tr>\n"
+        else
+          html_body += "<tr><td>Applied checks</td><td>No security checks in the knowledge base</td></tr>\n"
+        end
+
+        html_body+="<tr><td>Vulnerabilities found</td><td>#{@engine.count_vulnerabilities}</td></tr>\n"
+        html_body+="<tr><td>Mitigated issues found</td><td>#{@engine.mitigated_issues.count}</td></tr>\n"
+        html_body+="<tr><td>Reflected XSS</td><td>#{@engine.reflected_xss.count}</td></tr>\n"
+        html_body += "</tbody>\n"
+        html_body += "</table>\n"
+
+
+        if @engine.count_vulnerabilities > 0
+          html_body += "<hr />\n"
+          html_body += "<h2>Vulnerabilities found</h2>\n"
+          html_body += "<table class=\"table-striped table-bordered table\">\n"
+          html_body += "<thead><tr><td>Name</td><td>Severity</td><td>Priority</td><td>CVSS score</td><td>Description</td><td>Remediation</td></tr></thead>\n"
+
+          @engine.vulnerabilities.each do |vuln|
+            html_body += "<tr><td><a href=\"#{vuln[:cve_link]}\">#{vuln[:name]}</a></td><td>#{vuln[:severity]}</td><td>#{vuln[:priority]}</td><td>#{vuln[:cvss_score]}</td><td>#{vuln[:message]}</td><td>#{vuln[:remediation]}</td></tr>\n"
+          end
+          html_body += "</tbody>\n"
+          html_body += "</table>\n"
+        end
+        html_body += "<div id=\"push\"></div>\n"
+        html_body += "<div id=\"footer\">\n"
+        html_body += "<div class=\"container\">\n"
+        html_body += "<p class=\"muted credit\">&copy; <a href=\"http://dawn.codesake.com\">Codesake::Dawn</a> &mdash; #{Time.now.strftime("%Y")} &mdash; engine v#{Codesake::Dawn::VERSION} (#{Codesake::Dawn::RELEASE})</p>\n"
+        html_body += "</div>\n"
+        html_body += "</div>\n"
+        html_body += "</div>\n"
+        html_body += "</div>\n"
+
+        html_body += "</body>\n"
+        html_body += "</html>"
+
+
+        html = html_head + html_body
+
+        write(html)
+        true
+      end
+
+      def ascii_tabular_report
+
+        # 0_First table: executive summary
+        rows = []
+        rows << ['Dawn version', Codesake::Dawn::VERSION] unless Codesake::Dawn::RELEASE == "(development)"
+        rows << ['Dawn development version', Codesake::Dawn::VERSION] if Codesake::Dawn::RELEASE == "(development)"
+        rows << ['Scan started', @engine.scan_start]
+        rows << ['Scan duration', "#{@engine.scan_time.round(3)} sec"]
+        rows << ['Target', @engine.target]
+        rows << ['MVC detected framework', "#{@engine.name} v#{@engine.get_mvc_version}" ] unless @engine.name == "Gemfile.lock"
+        rows << ['MVC detected framework', "#{@engine.force} v#{@engine.get_mvc_version}" ] if @engine.name == "Gemfile.lock"
+        if @ret
+          rows << ['Applied checks', "#{@engine.applied_checks} security checks"]
+          rows << ['Skipped checks', "#{@engine.skipped_checks} security checks"]
+        else
+          rows << ['Applied checks', "No security checks in the knowledge base"]
+        end
+        rows << ['Vulnerabilities found', @engine.count_vulnerabilities]
+        rows << ['Mitigated issues found', @engine.mitigated_issues.count]
+        rows << ['Reflected XSS', @engine.reflected_xss.count]
+        table = Terminal::Table.new :title=>'Scan summary', :rows => rows
+        puts table
+
+
+        if @engine.count_vulnerabilities > 0
+
+          # 1_Vulnerabilities
+          rows = []
+          @engine.vulnerabilities.each do |vuln|
+            rows << [vuln[:name].justify(10), vuln[:severity], vuln[:priority], vuln[:message].justify(50), vuln[:remediation].justify(15), vuln[:evidences].join.justify(15)]
+            rows << :separator
+          end
+          table = Terminal::Table.new :title=>"Vulnerabilities", :headings=>['Issue', 'Severity', 'Priority', 'Description', 'Solution', 'Evidences'], :rows=>rows
+          puts table
+
+          rows = []
+          if @engine.has_reflected_xss?
+            @engine.reflected_xss.each do |vuln|
+              rows << [vuln[:sink_source], vuln[:sink_view], "#{vuln[:sink_file]}@#{vuln[:sink_line]}",vuln[:sink_evidence]]
+              rows << :separator
+            end
+            table = Terminal::Table.new :title=>"Reflected Cross Site Scripting", :headings=>['Sink name', 'View', 'Location the sink was read', 'Evidences'], :rows=>rows
+            puts table
+
+          end
+
+        end
+
+        if @engine.mitigated_issues.count > 0
+          # 2_Mitigated issues
+          rows = []
+          @engine.mitigated_issues.each do |vuln|
+            rows << [vuln[:name].justify(10), vuln[:message].justify(50), vuln[:evidences].join.justify(15)]
+            rows << :separator
+          end
+          table = Terminal::Table.new :title=>"Mitigated issues", :headings=>['Issue', 'Description', 'Evidences'], :rows=>rows
+          puts table
+        end
+
+        true
+      end
+
+
+      def json_report
+        result = {}
+        return {:status=>"KO", :message=>"BUG at #{__FILE__}@#{__LINE__}: target is empty or engine is nil."}.to_json if @engine.target.empty? or @engine.nil?
+        return {:status=>"KO", :message=>"#{target} doesn't exist"}.to_json if ! Dir.exist?(@engine.target)
+        return {:status=>"KO", :message=>"no security checks applied"}.to_json unless @ret
+
+        result[:status]="OK"
+        result[:dawn_version] = Codesake::Dawn::VERSION
+        result[:dawn_status] = "Develoment version" if Codesake::Dawn::RELEASE == "(development)"
+        result[:scan_started] = @engine.scan_start
+        result[:scan_duration] = "#{@engine.scan_time.round(3)} sec"
+        result[:target]=@engine.target
+        result[:mvc]=@engine.name unless @engine.name == "Gemfile.lock"
+        result[:mvc]=@engine.force if @engine.name == "Gemfile.lock"
+        result[:mvc_version]=@engine.get_mvc_version
+
+        result[:applied_checks_count] = @engine.applied_checks
+        result[:skipped_checks_count] = @engine.skipped_checks
+        result[:vulnerabilities_count]=@engine.count_vulnerabilities
+
+        result[:mitigated_issues_count] = @engine.mitigated_issues.count
+        result[:reflected_xss_count] = @engine.reflected_xss.count
+        result[:vulnerabilities]=[]
+        @engine.vulnerabilities.each do |v|
+          result[:vulnerabilities] << v[:name]
+        end
+        result[:mitigated_vuln] = @engine.mitigated_issues
+        result[:reflected_xss] = []
+        @engine.reflected_xss.each do |r|
+          result[:reflected_xss] << "request parameter \"#{r[:sink_source]}\""
+        end
+
+        write(result.to_json)
+        true
+      end
+
+      def ascii_plain_report
+
+        $logger.log "scanning #{@engine.target}"
+        $logger.log "#{@engine.name} v#{@engine.get_mvc_version} detected" unless @engine.name == "Gemfile.lock"
+        $logger.log "#{@engine.force} v#{@engine.get_mvc_version} detected" if @engine.name == "Gemfile.lock"
+        $logger.log "applying all security checks"
+        if @ret
+          $logger.log "#{@engine.applied_checks} security checks applied - #{@engine.skipped_checks} security checks skipped"
+        else
+          $logger.err "no security checks in the knowledge base"
+        end
+
+        if @engine.count_vulnerabilities != 0
+          $logger.log "#{@engine.count_vulnerabilities} vulnerabilities found"
+          @engine.vulnerabilities.each do |vuln|
+            $logger.err "#{vuln[:name]} check failed"
+            $logger.log "Severity: #{vuln[:severity]}"
+            $logger.log "Priority: #{vuln[:priority]}"
+            $logger.log "Description: #{vuln[:message]}"
+            $logger.log "Solution: #{vuln[:remediation]}"
+            $logger.log "Evidence:"
+            vuln[:evidences].each do |evidence|
+              $logger.log "\t#{evidence}"
+            end
+          end
+          if @engine.has_reflected_xss?
+            $logger.log "#{@engine.reflected_xss.count} reflected XSS found"
+            @engine.reflected_xss.each do |vuln|
+              $logger.log "request parameter \"#{vuln[:sink_source]}\" is used without escaping in #{vuln[:sink_view]}. It was read here: #{vuln[:sink_file]}@#{vuln[:sink_line]}"
+              $logger.err "evidence: #{vuln[:sink_evidence]}"
+            end
+          end
+
+        else
+          $logger.ok "no vulnerabilities found."
+        end
+
+        if @engine.mitigated_issues.count != 0
+          $logger.log "#{@engine.mitigated_issues.count} mitigated vulnerabilities found"
+          @engine.mitigated_issues.each do |vuln|
+            $logger.ok "#{vuln[:name]} mitigated"
+            vuln[:evidences].each do |evidence|
+              $logger.err evidence
+            end
+          end
+        end
+
+        true
+      end
+    end
+  end
+end