dawnscanner 1.6.9 → 2.0.0.rc1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 269664ca2d6f8f14993ab85be4b78b81bba739743f25b560cc2e5c724e7d40e2
-  data.tar.gz: 88a2ad2f4e4e9a130e349ccde068d857b1b3eab17b531855f09e0262b7914be0
+  metadata.gz: fedb521a49d75d72343489c68b9871fea0df9de953a3907dbe57e1ca375d5f65
+  data.tar.gz: b1e3c420155adf6c0ed829fad272970bca0c17245fcfea1da38ebd2f69d6043c
 SHA512:
-  metadata.gz: fa2a9f80292666ddfec7e62f3f75559dbbcf72f09b8787b7b67a31d2c89da87a0c51a9041bbf6958a6b51df0a29cd504b45e893a0a0949d0c63fcb611894bad5
-  data.tar.gz: d0a70f5255f423d5da629946efbc46531e2e7d881157a6a5800e9be7f11e1fa1dd6f5e64642a5fa103be9b138194693188f0d28da4c96bda8f541047c45302c9
+  metadata.gz: f5f5496969dd2f55cde87c9156e2d4ee55b70516af1b73a08fad3b8c140ad008c77cfb12d701229539ef430caabb4cbfc4cd27413ebe13c4d19d38de8ca87b59
+  data.tar.gz: 0727f9f752bbb2f99e977ae893cafd765fe602241894a793bfe8000e5327f92932059669313ed7bb0c167b9102d60afc4f3cdfaf229d702f42c750e828eb4b90

data/.ruby-version

@@ -1 +1 @@
-2.3.1
+2.5.1

data/Changelog.md

@@ -7,6 +7,14 @@ frameworks.
 
 _latest update: mer 28 nov 2018, 11.03.53, CET_
 
+## Version 2.0.0 - codename: Finn McMissile (2019-xx-xx)
+
+* New knowledge base, YAML based and distributed separately from the ruby gem.
+* New CLI based on Thor library. Please read README.md file to know how to
+  invoke dawn the right way or use the 'dawn help' command
+* Added a new debug\_verbosely API for engines and checks
+* Removed rake osvdb[name] and rake cve[name] tasks
+
 ## Version 1.6.9 - codename: Tow Mater (2018-11-28)
 
 * Removed signing certificate. This will solve issue #233 and #229

data/LICENSE.txt

@@ -1,4 +1,4 @@
-Copyright (c) 2013-2015 Paolo Perego
+Copyright (c) 2013-2019 Paolo Perego
 
 MIT License
 

data/Rakefile

@@ -8,7 +8,6 @@ require 'cucumber/rake/task'
 require 'fileutils'
 require "dawn/utils"
 require "dawn/knowledge_base"
-require "dawn/knowledge_base_experimental"
 
 Cucumber::Rake::Task.new(:features) do |t|
   t.cucumber_opts = "features --format pretty -x"
@@ -63,214 +62,6 @@ namespace :version do
   end
 end
 
-# namespace :check do
-# desc "Create a dependency check"
-# task :dependency, :name do |t, args|
-# end
-
-# end
-desc "Create a new CVE test"
-task :cve, :name do |t,args|
-  name      = args.name
-  SRC_DIR   = "./lib/dawn/kb/"
-  SPEC_DIR  = "./spec/lib/kb/"
-
-  raise "### It seems that #{name} is already in Dawn knowledge base" unless Dawn::KnowledgeBase.find(nil, name).nil?
-  raise "### Invalid CVE title: #{name}" if name.nil? or name.empty? or /CVE-\d{4}-\d{4}/.match(name).nil?
-  raise "### No target directory: #{SRC_DIR}" unless Dir.exists?(SRC_DIR)
-  raise "### No rspec directory: #{SPEC_DIR}" unless Dir.exists?(SPEC_DIR)
-
-  puts "Adding #{name} to knowledge base..."
-
-  rb_filename = SRC_DIR+name.downcase.gsub("-", "_")+".rb"
-  spec_filename = SPEC_DIR+name.downcase.gsub("-", "_")+"_spec.rb"
-  class_name = name.gsub("-", "_")
-
-  open(rb_filename, "w") do |file|
-    file.puts "module Dawn"
-    file.puts "\t\tmodule Kb"
-    file.puts "\t\t\t# Automatically created with rake on #{Time.now.strftime('%Y-%m-%d')}"
-    file.puts "\t\t\tclass #{class_name}"
-    file.puts "\t\t\t\t# Include the testing skeleton for this CVE"
-    file.puts "\t\t\t\t# include PatternMatchCheck"
-    file.puts "\t\t\t\t# include DependencyCheck"
-    file.puts "\t\t\t\t# include RubyVersionCheck"
-    file.puts ""
-    file.puts "\t\t\t\tdef initialize"
-    file.puts "\t\t\t\t\ttitle   = \"\""
-    file.puts "\t\t\t\t\tmessage = \"\""
-    file.puts "\t\t\t\tend"
-    file.puts "\t\t\tend"
-    file.puts "\t\tend"
-    file.puts "end"
-  end
-  puts "#{rb_filename} created"
-
-  open(spec_filename, "w") do |file|
-    file.puts "require 'spec_helper'"
-
-    file.puts "describe \"The #{name} vulnerability\" do"
-    file.puts "\tbefore(:all) do"
-    file.puts "\t\t@check = Dawn::Kb::#{class_name}.new"
-    file.puts "\t\t# @check.debug = true"
-    file.puts "\tend"
-    file.puts "\tit \"is reported when the vulnerable gem is detected\" do"
-    file.puts "\t\t@check.dependencies = [{:name=>\"\", :version=>\"\"}]"
-    file.puts "\t\texpect(@check.vuln?).to   eq(true)"
-    file.puts "\tend"
-    file.puts "\tit \"is not reported when a fixed release is detected\" do"
-    file.puts "\t\t@check.dependencies = [{:name=>\"\", :version=>\"\"}]"
-    file.puts "\t\texpect(@check.vuln?).to   eq(false)"
-    file.puts "\tend"
-    file.puts "end"
-  end
-  puts "#{spec_filename} created"
-
-  puts "*** PLEASE IMPLEMENT TEST FOR #{name} IN ./spec/lib/dawn/codesake_knowledgebase_spec.rb in order to reflect changes"
-  puts "*** PLEASE ADD THIS CODE IN ./lib/dawn/knowledge_base.rb in order to reflect changes"
-  puts "require \"dawn/kb/#{class_name.downcase}\""
-  puts "it \"must have test for #{name}\" do"
-  puts "  sc = kb.find(\"#{name}\")"
-  puts "  expect(sc).not_to   be_nil"
-  puts "  expect(sc.class).to eq(Dawn::Kb::#{class_name})"
-  puts "end"
-
-
-end
-
-desc "Create a new OSVDB security check"
-task :osvdb, :name do |t,args|
-  name      = args.name
-  SRC_DIR   = "./lib/dawn/kb/"
-  SPEC_DIR  = "./spec/lib/kb/"
-
-  raise "### It seems that #{name} is already in Dawn knowledge base" unless Dawn::KnowledgeBase.find(nil, name).nil?
-  raise "### Invalid OSVDB identifier: #{name}" if name.nil? or name.empty? or /\d{6}/.match(name).nil?
-  raise "### No target directory: #{SRC_DIR}" unless Dir.exists?(SRC_DIR)
-  raise "### No rspec directory: #{SPEC_DIR}" unless Dir.exists?(SPEC_DIR)
-
-  puts "Adding #{name} to knowledge base..."
-
-  name = "OSVDB_"+name
-
-  rb_filename = SRC_DIR+name.downcase.gsub("-", "_")+".rb"
-  spec_filename = SPEC_DIR+name.downcase.gsub("-", "_")+"_spec.rb"
-  class_name = name.gsub("-", "_")
-
-  open(rb_filename, "w") do |file|
-    file.puts "module Dawn"
-    file.puts "\t\tmodule Kb"
-    file.puts "\t\t\t# Automatically created with rake on #{Time.now.strftime('%Y-%m-%d')}"
-    file.puts "\t\t\tclass #{class_name}"
-    file.puts "\t\t\t\t# Include the testing skeleton for this Security Check"
-    file.puts "\t\t\t\t# include PatternMatchCheck"
-    file.puts "\t\t\t\t# include DependencyCheck"
-    file.puts "\t\t\t\t# include RubyVersionCheck"
-    file.puts ""
-    file.puts "\t\t\t\tdef initialize"
-    file.puts "\t\t\t\t\ttitle   = \"\""
-    file.puts "\t\t\t\t\tmessage = \"\""
-    file.puts "\t\t\t\tend"
-    file.puts "\t\t\tend"
-    file.puts "\t\tend"
-    file.puts "end"
-  end
-  puts "#{rb_filename} created"
-
-  open(spec_filename, "w") do |file|
-    file.puts "require 'spec_helper'"
-
-    file.puts "describe \"The #{name} vulnerability\" do"
-    file.puts "\tbefore(:all) do"
-    file.puts "\t\t@check = Dawn::Kb::#{class_name}.new"
-    file.puts "\t\t# @check.debug = true"
-    file.puts "\tend"
-    file.puts "\tit \"is reported when the vulnerable gem is detected\" do"
-    file.puts "\t\t@check.dependencies = [{:name=>\"\", :version=>\"\"}]"
-    file.puts "\t\texpect(@check.vuln?).to   eq(true)"
-    file.puts "\tend"
-    file.puts "\tit \"is not reported when a fixed release is detected\" do"
-    file.puts "\t\t@check.dependencies = [{:name=>\"\", :version=>\"\"}]"
-    file.puts "\t\texpect(@check.vuln?).to   eq(false)"
-    file.puts "\tend"
-    file.puts "end"
-  end
-  puts "#{spec_filename} created"
-
-
-  puts "*** PLEASE IMPLEMENT TEST FOR #{name} IN ./spec/lib/dawn/codesake_knowledgebase_spec.rb in order to reflect changes"
-  puts "*** PLEASE ADD THIS CODE IN ./lib/dawn/knowledge_base.rb in order to reflect changes"
-  puts "require \"dawn/kb/#{class_name.downcase}\""
-  puts "it \"must have test for #{name}\" do"
-  puts "  sc = kb.find(\"#{name}\")"
-  puts "  expect(sc).not_to   be_nil"
-  puts "  expect(sc.class).to eq(Dawn::Kb::#{class_name})"
-  puts "end"
-
-end
-
-
-
-desc "Create a new Generic security check"
-task :check, :name do |t,args|
-  name      = args.name
-  SRC_DIR   = "./lib/dawn/kb/"
-  SPEC_DIR  = "./spec/lib/kb/"
-
-  raise "### It seems that #{name} is already in Dawn knowledge base" unless Dawn::KnowledgeBase.find(nil, name).nil?
-  raise "### No target directory: #{SRC_DIR}" unless Dir.exists?(SRC_DIR)
-  raise "### No rspec directory: #{SPEC_DIR}" unless Dir.exists?(SPEC_DIR)
-
-  puts "Adding #{name} to knowledge base..."
-
-  rb_filename = SRC_DIR+name.downcase.gsub("-", "_")+".rb"
-  spec_filename = SPEC_DIR+name.downcase.gsub("-", "_")+"_spec.rb"
-  class_name = name.gsub("-", "_")
-
-  open(rb_filename, "w") do |file|
-    file.puts "module Dawn"
-    file.puts "\t\tmodule Kb"
-    file.puts "\t\t\t# Automatically created with rake on #{Time.now.strftime('%Y-%m-%d')}"
-    file.puts "\t\t\tclass #{class_name}"
-    file.puts "\t\t\t\t# Include the testing skeleton for this Security Check"
-    file.puts "\t\t\t\t# include PatternMatchCheck"
-    file.puts "\t\t\t\t# include DependencyCheck"
-    file.puts "\t\t\t\t# include RubyVersionCheck"
-    file.puts ""
-    file.puts "\t\t\t\tdef initialize"
-    file.puts "\t\t\t\tend"
-    file.puts "\t\t\tend"
-    file.puts "\t\tend"
-    file.puts "end"
-  end
-  puts "#{rb_filename} created"
-
-  open(spec_filename, "w") do |file|
-    file.puts "require 'spec_helper'"
-
-    file.puts "describe \"The #{name} vulnerability\" do"
-    file.puts "\tbefore(:all) do"
-    file.puts "\t\t@check = Dawn::Kb::#{class_name}.new"
-    file.puts "\t\t# @check.debug = true"
-    file.puts "\tend"
-    file.puts "\tit \"is reported when...\""
-    file.puts "end"
-  end
-  puts "#{spec_filename} created"
-
-
-  puts "*** PLEASE IMPLEMENT TEST FOR #{name} IN ./spec/lib/dawn/codesake_knowledgebase_spec.rb in order to reflect changes"
-  puts "*** PLEASE ADD THIS CODE IN ./lib/dawn/knowledge_base.rb in order to reflect changes"
-  puts "require \"dawn/kb/#{class_name.downcase}\""
-  puts "it \"must have test for #{name}\" do"
-  puts "  sc = kb.find(\"#{name}\")"
-  puts "  sc.should_not   be_nil"
-  puts "  sc.class.should == Dawn::Kb::#{class_name}"
-  puts "end"
-
-
-end
-
 namespace :kb do
   desc 'Check information lint'
   task :lint do
@@ -287,26 +78,6 @@ namespace :kb do
     __kb_pack
   end
 
-  desc 'Transform all checks to YAML file and pack the library for shipping'
-  task :to_yaml do
-    YAML_KB = File.join(Dir.pwd, 'db')
-    FileUtils.rm_rf YAML_KB
-    FileUtils.mkdir_p YAML_KB
-
-    Dawn::KnowledgeBase.new.all.each do |check|
-      out_dir = File.join(YAML_KB, check.check_family.to_s)
-      FileUtils.mkdir_p(out_dir) unless Dir.exists? out_dir
-
-      filename = File.join(out_dir, check.name.gsub(" ", "_").gsub("-", "_") + '.yml')
-      open(filename, 'w') do |f|
-        f.puts(check.to_yaml)
-      end
-      puts "#{filename} created"
-    end
-
-    __kb_pack
-  end
-
   desc 'Creates a KnowledgeBase.md file'
   task :create do
     checks = Dawn::KnowledgeBase.new.all
@@ -393,35 +164,35 @@ end
 
 def __kb_pack
   if Dir.exists? "#{YAML_KB}/bulletin"
-    system "tar cfvz #{YAML_KB}/bulletin.tar.gz #{YAML_KB}/bulletin"
+    system "tar cfvz #{YAML_KB}/bulletin.tar.gz -C #{YAML_KB} bulletin"
     system "rm -rf #{YAML_KB}/bulletin"
     system "shasum -a 256 #{YAML_KB}/bulletin.tar.gz > #{YAML_KB}/bulletin.tar.gz.sig"
   end
 
   if Dir.exists? "#{YAML_KB}/generic_check"
-    system "tar cfvz #{YAML_KB}/generic_check.tar.gz #{YAML_KB}/generic_check"
+    system "tar cfvz #{YAML_KB}/generic_check.tar.gz -C #{YAML_KB} generic_check"
     system "rm -rf #{YAML_KB}/generic_check"
     system "shasum -a 256 #{YAML_KB}/generic_check.tar.gz > #{YAML_KB}/generic_check.tar.gz.sig"
   end
 
   if Dir.exists? "#{YAML_KB}/owasp_ror_cheatsheet"
-    system "tar cfvz #{YAML_KB}/owasp_ror_cheatsheet.tar.gz #{YAML_KB}/owasp_ror_cheatsheet"
+    system "tar cfvz #{YAML_KB}/owasp_ror_cheatsheet.tar.gz -C #{YAML_KB} owasp_ror_cheatsheet"
     system "rm -rf #{YAML_KB}/owasp_ror_cheatsheet"
     system "shasum -a 256 #{YAML_KB}/owasp_ror_cheatsheet.tar.gz > #{YAML_KB}/owasp_ror_cheatsheet.tar.gz.sig"
   end
 
   if Dir.exists? "#{YAML_KB}/code_style"
-    system "tar cfvz #{YAML_KB}/code_style.tar.gz #{YAML_KB}/code_style"
+    system "tar cfvz #{YAML_KB}/code_style.tar.gz -C #{YAML_KB} code_style"
     system "rm -rf #{YAML_KB}/code_style"
     system "shasum -a 256 #{YAML_KB}/code_style.tar.gz > #{YAML_KB}/code_style.tar.gz.sig"
   end
   if Dir.exists? "#{YAML_KB}/code_quality"
-    system "tar cfvz #{YAML_KB}/code_quality.tar.gz #{YAML_KB}/code_quality"
+    system "tar cfvz #{YAML_KB}/code_quality.tar.gz -C #{YAML_KB} code_quality"
     system "rm -rf #{YAML_KB}/code_quality"
     system "shasum -a 256 #{YAML_KB}/code_quality.tar.gz > #{YAML_KB}/code_quality.tar.gz.sig"
   end
   if Dir.exists? "#{YAML_KB}/owasp_top_10"
-    system "tar cfvz #{YAML_KB}/owasp_top_10.tar.gz #{YAML_KB}/owasp_top_10"
+    system "tar cfvz #{YAML_KB}/owasp_top_10.tar.gz -C #{YAML_KB} owasp_top_10"
     system "rm -rf #{YAML_KB}/owasp_top_10"
     system "shasum -a 256 #{YAML_KB}/owasp_top_10.tar.gz > #{YAML_KB}/owasp_top_10.tar.gz.sig"
   end
@@ -433,10 +204,6 @@ def __kb_pack
   puts "kb.yaml created"
   system "shasum -a 256 #{YAML_KB}/kb.yaml > #{YAML_KB}/kb.yaml.sig"
 
-  system "tar cfvz #{YAML_KB}/signatures.tar.gz #{YAML_KB}/*.tar.gz.sig"
-  system "rm -rf #{YAML_KB}/*.tar.gz.sig "
-  puts "#{YAML_KB}/signatures.tar.gz created"
-
   puts "Library ready to be shipped"
 
 end

data/VERSION

@@ -12,4 +12,4 @@
 # |   "Guido"       |  x.x.0  |
 # |   "Luigi"       |  x.x.0  |
 # | "Doc Hudson"    |  x.x.0  |
-1.6.9 - Tow Mater
+2.0.0.rc1 - Finn McMissile

data/bin/dawn

@@ -1,7 +1,6 @@
 #!/usr/bin/env ruby
 
 require 'bundler'
-require 'getoptlong'
 require 'json'
 require 'terminal-table'
 require 'justify'
@@ -22,55 +21,19 @@ require 'logger'
 $logger = Logger.new(STDOUT)
 $logger.datetime_format = '%Y-%m-%d %H:%M:%S'
 
-opts    = GetoptLong.new(
-  # report formatting options
-
-  [ '--ascii-tabular-report',   '-a',   GetoptLong::NO_ARGUMENT], # Deprecated in 1.5.x - To be removed in 2.0.0
-  [ '--tabular',                '-T',   GetoptLong::NO_ARGUMENT],
-  [ '--json',                   '-j',   GetoptLong::NO_ARGUMENT],
-  [ '--html',                   '-H',   GetoptLong::NO_ARGUMENT],
-  [ '--console',                '-K',   GetoptLong::NO_ARGUMENT],
-
-  [ '--gem-lock',               '-G',   GetoptLong::REQUIRED_ARGUMENT], # Deprecated in 1.5.x - To be removed in 2.0.0
-  [ '--dependencies',           '-d',   GetoptLong::REQUIRED_ARGUMENT],
-
-  [ '--count-only',             '-C',   GetoptLong::NO_ARGUMENT],
-  [ '--exit-on-warn',           '-z',   GetoptLong::NO_ARGUMENT],
-
-  # Disable checks by family type
-  [ '--disable-cve-bulletins',          GetoptLong::NO_ARGUMENT],
-  [ '--disable-code-quality',           GetoptLong::NO_ARGUMENT],
-  [ '--disable-code-style',             GetoptLong::NO_ARGUMENT],
-  [ '--disable-owasp-ror-cheatsheet',   GetoptLong::NO_ARGUMENT],
-  [ '--disable-owasp-top-10',           GetoptLong::NO_ARGUMENT],
-
-  # Search knowledge base
-  [ '--search-knowledge-base',  '-S',   GetoptLong::REQUIRED_ARGUMENT],
-  # List stuff
-  [ '--list-knowledge-base',            GetoptLong::NO_ARGUMENT],
-  [ '--list-known-framework',           GetoptLong::NO_ARGUMENT],
-  [ '--list-known-families',            GetoptLong::NO_ARGUMENT],
-  [ '--list-scan-registry',             GetoptLong::NO_ARGUMENT],
-  # please save output to file
-  [ '--file',                   '-F',   GetoptLong::REQUIRED_ARGUMENT],
-  # specify an alternate config file
-  [ '--config-file',            '-c',   GetoptLong::REQUIRED_ARGUMENT],
-
-  # service options
-  [ '--verbose',                '-V',   GetoptLong::NO_ARGUMENT],
-  [ '--debug',                  '-D',   GetoptLong::NO_ARGUMENT],
-  [ '--version',                '-v',   GetoptLong::NO_ARGUMENT],
-  [ '--help',                   '-h',   GetoptLong::NO_ARGUMENT]
-)
-opts.quiet=true
-
 engine  = nil
+$debug=false
+$verbose=false
 
 
 options = Dawn::Core.read_conf(Dawn::Core.find_conf(true))
 check = ""
 guess = {:name=>"", :version=>"", :connected_gems=>[]}
 
+Dawn::Cli::DawnCli.start
+$logger.bye
+Kernel.exit(0)
+
 ###############################################################################
 # CLI argument start.
 #
@@ -179,7 +142,6 @@ target=ARGV.shift
 
 target = File.expand_path(".") if target == "."
 
-$logger.helo APPNAME, Dawn::VERSION
 
 ## It will be migrated to active record in 2019
 # r = Dawn::Registry.new
@@ -222,7 +184,6 @@ end
 if options[:exit_on_warn]
   Kernel.at_exit do
     if engine.count_vulnerabilities != 0
-      # r.do_save({:target=>engine.target, :scan_started=>engine.scan_start, :scan_duration => engine.scan_time.round(3), :issues_found=>engine.vulnerabilities.count, :output_dir=>engine.output_dir_name, :scan_status=>:completed})
       Kernel.exit(engine.count_vulnerabilities)
     end
   end
@@ -270,4 +231,3 @@ Dawn::Reporter.new({:engine=>engine, :apply_all_code=>ret, :format=>options[:out
 #    $logger.error error
 #  end
 #end
-$logger.bye

data/dawnscanner.gemspec

@@ -27,7 +27,12 @@ Gem::Specification.new do |gem|
   gem.add_dependency 'justify'
   gem.add_dependency 'logger-colors'
   gem.add_dependency 'ptools'
-  gem.add_dependency 'sqlite3'
+  gem.add_dependency 'psych'
+
+  # For CLI we will use thor
+  gem.add_dependency 'thor'
+
+  # gem.add_dependency 'sqlite3'
   # gem.add_dependency 'datamapper'
   # gem.add_dependency 'dm-sqlite-adapter'