dawnscanner 2.0.0.rc2 → 2.0.0.rc3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2b6bee4d3b7a5f1fd9189a556dccfe88631e1eed526de637cc0d74dbecea9a71
-  data.tar.gz: f8ad2cf91ce1e212abcfd9732534512aa54794512853f8a200a6d8d0396d5c53
+  metadata.gz: 72552d751163f1b0a97daa602bf4251d879e66155cb213aaecb0e7b4e9654af1
+  data.tar.gz: 2f50331bf792286959cd79efb3fc36f106548e11f7c338318b84779b5cb3aa4a
 SHA512:
-  metadata.gz: 547d98cc3af2c146a7ad987e98c9b67f1f6f7237a669ed509dc08bbbc885d4c4638598b683624ce9efd627e70c6500d42f5d11204caa45a9c3f916a44c863ac5
-  data.tar.gz: b75df8fc99cee42cba08919c7a56ff4eb41e1b0c234502f779d5957ab40efde8f4bbd5ef1c562cc113dee4489d8c718fccb615dc2bf3688526b832c2c6bc9e28
+  metadata.gz: 4e1d78d9d5e1b8c407b560a5199d0a3536382e13ce09bda3de2e98a9bffde2e8a0b472acb90a18b16e252355bbfbdde35180072c034500388389613dabd8497a
+  data.tar.gz: 600b924b3801499ef17e75fbfd5b9e01f9973394f7a76d34828f2702ae76ad4b0364b75403fc0c12820089f9b56a55ec1d2c42a8b7c8c57d5e434f96dac621f1

data/Changelog.md

@@ -17,6 +17,8 @@ _latest update: mer 28 nov 2018, 11.03.53, CET_
 * Adding telemetry
 * Dawn::Utils include refactory. Now it's available application wide
 * debug information refactory. 
+* engine class, apply_all method now accepts an optional parameter containing a
+  list of security checks to be excluded (issue #230).
 
 ## Version 1.6.9 - codename: Tow Mater (2018-11-28)
 

data/README.md

@@ -1,7 +1,7 @@
 # Dawnscanner - The raising security scanner for ruby web applications
 
-dawnscanner is a source code scanner designed to review your ruby code for security
-issues.
+dawnscanner is a source code scanner designed to review your ruby code for
+security issues.
 
 dawnscanner is able to scan plain ruby scripts (e.g. command line applications) but
 all its features are unleashed when dealing with web applications source code.

data/VERSION

@@ -12,4 +12,4 @@
 # |   "Guido"       |  x.x.0  |
 # |   "Luigi"       |  x.x.0  |
 # | "Doc Hudson"    |  x.x.0  |
-2.0.0.rc2 - Finn McMissile
+2.0.0.rc3 - Finn McMissile

data/checksum/dawnscanner-2.0.0.rc2.gem.sha1

@@ -0,0 +1 @@
+1c96f786d3683b79311855a14b8ef7d7ebe7b13d

data/lib/dawn/cli/dawn_cli.rb

@@ -50,11 +50,13 @@ module Dawn
       desc "kb SUBCOMMAND ... ARGS", "Interacts with the knowledge base"
       subcommand "kb", Dawn::Cli::Kb
 
-      desc "scan", "scans a folder for security issues"
+      desc "scan", "scans a ruby written application for security issues"
       option :config_file
-      option :gemfile, :type=>:boolean
+      method_option :gemfile, :type=>:boolean, :default=>true, :aliases => "-G", :desc => "uses Gemfile.lock to detect MVC"
+      method_option :skip, :type=>:array, :aliases => "-S", :desc => "specify a list of security checks to be skipped"
       option :exit_on_warn, :type=>:boolean
       option :count, :type=>:boolean
+      option :s
       option :output
 
       def scan(target)
@@ -65,6 +67,10 @@ module Dawn
 
         $debug = true if options[:debug]
         $verbose = true if options[:verbose]
+        checks_to_be_skipped = []
+        checks_to_be_skipped = options[:skip] unless options[:skip].nil?
+
+        $logger.error("#{options[:skip]}")
 
         debug_me("scanning #{target}")
 
@@ -73,9 +79,10 @@ module Dawn
 
         $telemetry_url = $config[:telemetry][:endpoint] if $config[:telemetry][:enabled]
         debug_me("telemetry url is " + $telemetry_url) unless @telemetry_url.nil?
+        
         $telemetry_id = $config[:telemetry][:id] if $config[:telemetry][:enabled]
-
         debug_me("telemetry id is " + $telemetry_id) unless @telemetry_id.nil?
+
         $logger.info("telemetry is disabled in config file") unless $config[:telemetry][:enabled]
  
         engine = Dawn::Core.detect_mvc(target) unless options[:gemfile]
@@ -97,7 +104,7 @@ module Dawn
       
         engine.load_knowledge_base
         
-        ret = engine.apply_all
+        ret = engine.apply_all(checks_to_be_skipped)
         if options[:output]
           STDERR.puts (ret)? engine.vulnerabilities.count : "-1" unless options[:output] == "json"
           STDERR.puts (ret)? {:status=>"OK", :vulnerabilities_count=>engine.count_vulnerabilities}.to_json : {:status=>"KO", :vulnerabilities_count=>-1}.to_json if options[:output] == "json"

data/lib/dawn/engine.rb

@@ -332,28 +332,25 @@ module Dawn
       request = Net::HTTP::Post.new(uri.request_uri, header)
       request.body = tele.to_json
 
-      response=http.request(request)
-      debug_me(response.inspect)
-
-      return true
-      
+      begin
+        response=http.request(request)
+        debug_me(response.inspect)
+        return true
+      rescue => e
+        $logger.error "telemetry: #{e.message}"
+        return false
+      end
     end
 
-    def apply_all
+    def apply_all(checks_to_be_skipped=[])
       @scan_start = Time.now
+      debug_me("I'm asked to skip those checks #{checks_to_be_skipped}")
       debug_me("SCAN STARTED: #{@scan_start}")
 
       telemetry
 
-      # FIXME.20140325
-      # Now if no checks are loaded because knowledge base was not previously called, apply and apply_all proudly refuse to run.
-      # Reason is simple, load_knowledge_base now needs enabled check array
-      # and I don't want to pollute engine API to propagate this value. It's
-      # a param to load_knowledge_base and then bin/dawn calls it
-      # accordingly.
-      # load_knowledge_base if @checks.nil?
       if @checks.nil?
-        $logger.err "you must load knowledge base before trying to apply security checks"
+        $logger.error "you must load knowledge base before trying to apply security checks"
         @scan_stop = Time.now
         debug_me("SCAN STOPPED: #{@scan_stop}")
         return false
@@ -366,7 +363,11 @@ module Dawn
       end
 
       @checks.each do |check|
-        _do_apply(check)
+        if checks_to_be_skipped.include?(check.name) 
+          $logger.info("skipping security check #{check.name}")
+        else
+          _do_apply(check)
+        end
       end
 
       @scan_stop = Time.now

data/lib/dawn/version.rb

@@ -1,7 +1,7 @@
 module Dawn
-  VERSION = "2.0.0.rc2"
-    CODENAME = "Finn McMissile"
-    RELEASE = "(development)"
-    BUILD = "4"
-    COMMIT = "g95c13be"
+  VERSION = "2.0.0.rc3"
+  CODENAME = "Finn McMissile"
+  RELEASE = "(development)"
+  BUILD = "2"
+  COMMIT = "g8c963e9"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dawnscanner
 version: !ruby/object:Gem::Version
-  version: 2.0.0.rc2
+  version: 2.0.0.rc3
 platform: ruby
 authors:
 - Paolo Perego
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-04-16 00:00:00.000000000 Z
+date: 2019-05-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: cvss
@@ -288,6 +288,7 @@ files:
 - checksum/dawnscanner-1.6.7.gem.sha1
 - checksum/dawnscanner-1.6.8.gem.sha1
 - checksum/dawnscanner-2.0.0.rc1.gem.sha1
+- checksum/dawnscanner-2.0.0.rc2.gem.sha1
 - code_of_conduct.md
 - dawnscanner.gemspec
 - doc/change.sh