owasp-pipeline 0.8.3

data/lib/pipeline/reporters/text_reporter.rb

@@ -0,0 +1,19 @@
+require 'pipeline/finding'
+require 'pipeline/reporters/base_reporter'
+
+class Pipeline::TextReporter < Pipeline::BaseReporter
+
+  Pipeline::Reporters.add self
+
+  attr_accessor :name, :format
+ 
+  def initialize()
+    @name = "TextReporter"  
+    @format = :to_s
+  end
+  
+  def out(finding)
+    finding.to_string << "\n"
+  end
+
+end

data/lib/pipeline/scanner.rb

@@ -0,0 +1,28 @@
+require 'pipeline/event'
+require 'pipeline/tracker'
+require 'pipeline/tasks'
+
+class Pipeline::Scanner
+  attr_reader :tracker
+  attr_reader :mounter
+
+  #Pass in path to the root of the Rails application
+  def initialize
+    @stage = :wait
+    @stages = [ :wait, :mount, :file, :code, :live, :done]
+  end
+
+  #Process everything in the Rails application
+  def process target, tracker
+    @stages.each do |stage|
+      Pipeline.notify "Running tasks in stage: #{stage}"
+      @stage = stage
+      begin
+         Pipeline::Tasks.run_tasks(target, stage, tracker)
+      rescue Exception => e
+        Pipeline.warn e.message
+        raise e
+      end
+    end
+  end
+end

data/lib/pipeline/tasks.rb

@@ -0,0 +1,124 @@
+require 'thread'
+
+#Collects up results from running different tasks.
+#
+#tasks can be added with +task.add(task_class)+
+#
+#All .rb files in tasks/ will be loaded.
+class Pipeline::Tasks
+  @tasks = []
+  @optional_tasks = []
+
+  attr_reader :tasks_run
+
+  #Add a task. This will call +_klass_.new+ when running tests
+  def self.add klass
+    @tasks << klass unless @tasks.include? klass
+  end
+
+  #Add an optional task
+  def self.add_optional klass
+    @optional_tasks << klass unless @tasks.include? klass
+  end
+
+  def self.tasks
+    @tasks + @optional_tasks
+  end
+
+  def self.optional_tasks
+    @optional_tasks
+  end
+
+  def self.initialize_tasks task_directory = ""
+    #Load all files in task_directory
+    Dir.glob(File.join(task_directory, "*.rb")).sort.each do |f|
+      require f
+    end
+  end
+
+  #No need to use this directly.
+  def initialize options = { }
+    @warnings = []
+    @tasks_run = []
+  end
+
+  #Add Warning to list of warnings to report.
+  def add_warning warning
+    @warnings << warning
+  end
+
+  #Run all the tasks on the given Tracker.
+  #Returns a new instance of tasks with the results.
+  def self.run_tasks(target, stage, tracker)
+    task_runner = self.new
+
+    trigger = Pipeline::Event.new(tracker.options[:appname])
+    trigger.path = target
+
+    self.tasks_to_run(tracker).each do |c|
+      task_name = get_task_name c
+
+      #Run or don't run task based on options
+      #Now case-insensitive specifiers:  nodesecurityproject = Pipeline::NodeSecurityProject
+      
+      if tracker.options[:skip_tasks] 
+        skip_tasks = tracker.options[:skip_tasks].map {|task| task.downcase}
+      end
+      if (tracker.options[:run_tasks])
+        run_tasks = tracker.options[:run_tasks].map {|task| task.downcase}
+      end
+
+      unless skip_tasks.include? task_name.downcase or
+        (run_tasks and not run_tasks.include? task_name.downcase)
+
+        task = c.new(trigger, tracker)
+        begin
+          if task.supported? and task.stage == stage  
+            if task.labels.intersect? tracker.options[:labels] or          # Only run tasks with labels 
+                 ( run_tasks and run_tasks.include? task_name.downcase )   # or that are explicitly requested. 
+              Pipeline.notify "#{stage} - #{task_name} - #{task.labels}"
+              task.run
+              task.analyze
+              task.findings.each do | finding |
+                tracker.report finding
+              end
+           end
+          end
+        rescue => e
+          Pipeline.notify e.message
+          tracker.error e
+        end
+
+        task.warnings.each do |w|
+          task_runner.add_warning w
+        end
+
+        #Maintain list of which tasks were run
+        #mainly for reporting purposes
+        task_runner.tasks_run << task_name[5..-1]
+      end
+    end
+
+    task_runner
+  end
+
+
+  private
+
+  def self.get_task_name task_class
+    task_class.to_s.split("::").last
+  end
+
+  def self.tasks_to_run tracker
+    if tracker.options[:run_all_tasks] or tracker.options[:run_tasks]
+      @tasks + @optional_tasks
+    else
+      @tasks
+    end
+  end
+end
+
+#Load all files in tasks/ directory
+Dir.glob("#{File.expand_path(File.dirname(__FILE__))}/tasks/*.rb").sort.each do |f|
+  require f.match(/(pipeline\/tasks\/.*)\.rb$/)[0]
+end

data/lib/pipeline/tasks/av.rb

@@ -0,0 +1,43 @@
+# https://gist.github.com/paulspringett/8802240
+
+require 'pipeline/tasks/base_task'
+
+class Pipeline::AV < Pipeline::BaseTask
+
+  Pipeline::Tasks.add self
+
+  def initialize(trigger, tracker)
+    super(trigger,tracker)
+    @name = "AV"
+    @description = "Test for virus/malware"
+    @stage = :file
+    @labels << "filesystem"
+  end
+
+  def run
+    # Update AV
+    `freshclam`
+    # Run AV
+    # TODO:  Circle back and use runsystem.
+    Pipeline.notify "Malware/Virus Check"
+  	rootpath = @trigger.path
+	  @result=`clamscan --no-summary -i -r "#{rootpath}"`
+  end
+
+  def analyze
+	  list = @result.split(/\n/)
+	  list.each do |v|
+	     # v.slice! installdir
+	     Pipeline.notify v
+       report "Malicious file identified.", v, @name, :medium
+    end
+  end
+
+  def supported?
+        # TODO verify.
+  	# In future, verify tool is available.
+  	return true
+  end
+
+end
+

data/lib/pipeline/tasks/base_task.rb

@@ -0,0 +1,64 @@
+require 'pipeline/finding'
+require 'set'
+require 'digest'
+
+class Pipeline::BaseTask
+  attr_reader :findings, :warnings, :trigger, :labels
+  attr_accessor :name
+  attr_accessor :description
+  attr_accessor :stage
+  attr_accessor :appname
+
+  def initialize(trigger, tracker)
+    @findings = []
+    @warnings = []
+    @labels = Set.new
+    @trigger = trigger
+    @tracker = tracker
+    @severity_filter = {
+      :low => ['low','weak'],
+      :medium => ['medium','med','average'],
+      :high => ['high','severe','critical']
+    }
+  end
+
+  def report description, detail, source, severity, fingerprint
+    finding = Pipeline::Finding.new( @trigger.appname, description, detail, source, severity, fingerprint )
+    @findings << finding
+  end
+
+  def warn warning
+    @warnings << warning
+  end
+
+  def name
+    @name
+  end
+
+  def description
+    @description
+  end
+
+  def stage
+    @stage
+  end
+
+
+  def run
+  end
+
+  def analyze
+  end
+
+  def supported?
+  end
+
+  def severity sev
+    sev = '' if sev.nil?
+    return 1 if @severity_filter[:low].include?(sev.strip.chomp.downcase)
+    return 2 if @severity_filter[:medium].include?(sev.strip.chomp.downcase)
+    return 3 if @severity_filter[:high].include?(sev.strip.chomp.downcase)
+    return 0
+  end
+
+end

data/lib/pipeline/tasks/brakeman.rb

@@ -0,0 +1,60 @@
+require 'pipeline/tasks/base_task'
+require 'json'
+require 'pipeline/util'
+require 'pathname'
+
+class Pipeline::Brakeman < Pipeline::BaseTask
+
+  Pipeline::Tasks.add self
+  include Pipeline::Util
+
+  def initialize(trigger, tracker)
+    super(trigger, tracker)
+    @name = "Brakeman"
+    @description = "Source analysis for Ruby"
+    @stage = :code
+    @labels << "code" << "ruby" << "rails"
+  end
+
+  def run
+    # Pipeline.notify "#{@name}"
+    rootpath = @trigger.path
+    @result=runsystem(true, "brakeman", "-A", "-q", "-f", "json", "#{rootpath}")
+  end
+
+  def analyze
+    # puts @result
+    begin
+      parsed = JSON.parse(@result)
+      parsed["warnings"].each do |warning|
+        file = relative_path(warning['file'], @trigger.path)
+
+        detail = "#{warning['message']}\n#{warning['link']}"
+        if ! warning['line']
+          warning['line'] = "0"
+        end
+        if ! warning['code']
+          warning['code'] = ""
+        end
+        source = { :scanner => @name, :file => file, :line => warning['line'], :code => warning['code'].lstrip }
+
+        report warning["warning_type"], detail, source, severity(warning["confidence"]), fingerprint("#{warning['message']}#{warning['link']}#{severity(warning["confidence"])}#{source}")
+      end
+    rescue Exception => e
+      Pipeline.warn e.message
+      Pipeline.warn e.backtrace
+    end
+  end
+
+  def supported?
+    supported=runsystem(true, "brakeman", "-v")
+    if supported =~ /command not found/
+      Pipeline.notify "Run: gem install brakeman"
+      return false
+    else
+      return true
+    end
+  end
+
+end
+

data/lib/pipeline/tasks/bundle-audit.rb

@@ -0,0 +1,93 @@
+require 'pipeline/tasks/base_task'
+require 'json'
+require 'pipeline/util'
+require 'digest'
+
+class Pipeline::BundleAudit < Pipeline::BaseTask
+  Pipeline::Tasks.add self
+  include Pipeline::Util
+
+  def initialize(trigger, tracker)
+    super(trigger, tracker)
+    @name = "BundleAudit"
+    @description = "Dependency Checker analysis for Ruby"
+    @stage = :code
+    @labels << "code" << "ruby"
+  end
+
+  def run
+    # Pipeline.notify "#{@name}"
+    rootpath = @trigger.path
+    Pipeline.debug "Rootpath: #{rootpath}"
+    Dir.chdir("#{rootpath}") do
+      @result= runsystem(true, "bundle-audit", "check")
+    end
+  end
+
+  def analyze
+    # puts @result
+    begin
+      get_warnings
+    rescue Exception => e
+      Pipeline.warn e.message
+      Pipeline.notify "Appears not to be a project with Gemfile.lock or there was another problem ... bundle-audit skipped."
+    end
+  end
+
+  def supported?
+    supported=runsystem(true, "bundle-audit", "update")
+    if supported =~ /command not found/
+      Pipeline.notify "Run: gem install bundler-audit"
+      return false
+    else
+      return true
+    end
+  end
+
+  private
+  def get_warnings
+    detail, jem, source, sev, hash = '','',{},'',''
+    @result.each_line do | line |
+
+      if /\S/ !~ line
+        # Signal section is over.  Reset variables and report.
+        if detail != ''
+          report "Gem #{jem} has known security issues.", detail, source, sev, fingerprint(hash)
+        end
+
+        detail, jem, source, sev, hash = '','', {},'',''
+      end
+
+      name, value = line.chomp.split(':')
+      case name
+      when 'Name'
+        jem << value
+        hash << value
+      when 'Version'
+        jem << value
+        hash << value
+      when 'Advisory'
+        source = { :scanner => @name, :file => 'Gemfile.lock', :line => nil, :code => nil }
+        hash << value
+      when 'Criticality'
+        sev = severity(value)
+        hash << sev
+      when 'URL'
+        detail += line.chomp.split('URL:').last
+      when 'Title'
+        detail += ",#{value}"
+      when 'Solution'
+        detail += ": #{value}"
+      when 'Insecure Source URI found'
+        report "Insecure GEM Source", "#{line.chomp} - use git or https", {:scanner => @name, :file => 'Gemfile.lock', :line => nil, :code =>  nil}, severity('high'), fingerprint("bundlerauditgemsource#{line.chomp}")
+      else
+        if line =~ /\S/ and line !~ /Unpatched versions found/
+          Pipeline.debug "Not sure how to handle line: #{line}"
+        end
+      end
+    end
+  end
+
+
+end
+

data/lib/pipeline/tasks/checkmarx.rb

@@ -0,0 +1,62 @@
+require 'pipeline/tasks/base_task'
+require 'pipeline/util'
+# require 'nokogiri'
+
+class Pipeline::Checkmarx < Pipeline::BaseTask
+
+  # Pipeline::Tasks.add self
+  include Pipeline::Util
+
+  def initialize(trigger, tracker)
+    super(trigger, tracker)
+    @name = "Checkmarx"
+    @description = "CxSAST"
+    @stage = :code
+    @labels << "code"
+  end
+
+  def run
+    Pipeline.notify "#{@name}"
+    rootpath = @trigger.path
+    runsystem(true, "runCxConsole.sh", "scan", "-v",
+      "-CxUser", "#{@tracker.options[:checkmarx_user]}",
+      "-CxPassword", "#{@tracker.options[:checkmarx_password]}",
+      "-CxServer", "#{@tracker.options[:checkmarx_server]}",
+      "-LocationType", "folder",
+      "-LocationPath", "#{rootpath}",
+      "-ProjectName", "#{@tracker.options[:checkmarx_project]}",
+      "-ReportXML", "#{rootpath}checkmarx_results.xml",
+      "-Log", "#{@tracker.options[:checkmarx_log]}"
+    )
+    # @results = Nokogiri::XML(File.read("#{rootpath}checkmarx_results.xml")).xpath '//Result'
+  end
+
+  def analyze
+    begin
+      @results.each do |result|
+        description = result.parent.attributes['name'].value.gsub('_', ' ')
+        detail = result.attributes['DeepLink'].value
+        source = { :scanner => @name, :file => result.attributes['FileName'].value, :line =>  result.attributes['Line'].value.to_i, :code => result.at_xpath('Path/PathNode/Snippet/Line/Code').text }
+        sev = severity(result.parent.attributes['Severity'].value)
+        print = fingerprint("#{description}#{source}#{sev}")
+
+        report description, detail, source, sev, print
+      end
+    rescue Exception => e
+      Pipeline.warn e.message
+      Pipeline.warn e.backtrace
+    end
+  end
+
+  def supported?
+    supported=runsystem(true, "runCxConsole.sh", "--help")
+    if supported =~ /command not found/
+      Pipeline.notify "Install CxConsolePlugin"
+      return false
+    else
+      return true
+    end
+  end
+
+end
+