pwn 0.5.508 → 0.5.509

data/lib/pwn/reports/sast.rb

@@ -1,435 +0,0 @@
-# frozen_string_literal: true
-
-require 'json'
-
-module PWN
-  module Reports
-    # This plugin generates the Static Code Anti-Pattern Matching Analysis
-    # results within the root of a given source repo.  Two files are created,
-    # a JSON file containing all of the SAST results and an HTML file
-    # which is essentially the UI for the JSON file.
-    module SAST
-      # Supported Method Parameters::
-      # PWN::Reports::SAST.generate(
-      #   dir_path: 'optional - Directory path to save the report (defaults to .)',
-      #   results_hash: 'optional - Hash containing the results of the SAST analysis (defaults to empty hash structure)',
-      #   report_name: 'optional - Name of the report file (defaults to current directory name)'
-      # )
-
-      public_class_method def self.generate(opts = {})
-        dir_path = opts[:dir_path] ||= '.'
-        results_hash = opts[:results_hash] ||= {
-          report_name: HTMLEntities.new.encode(report_name.to_s.scrub.strip.chomp),
-          data: []
-        }
-
-        report_name = opts[:report_name] ||= File.basename(Dir.pwd)
-        File.write(
-          "#{dir_path}/#{report_name}.json",
-          JSON.pretty_generate(results_hash)
-        )
-
-        column_names = [
-          'Timestamp',
-          'Test Case / Security References',
-          'Path',
-          'Line# | Source | AI Analysis | Author',
-          'Raw Content',
-          'Test Case'
-        ]
-
-        driver_src_uri = 'https://github.com/0dayinc/pwn/blob/master/bin/pwn_sast'
-
-        html_report = %(#{PWN::Reports::HTMLHeader.generate(column_names: column_names, driver_src_uri: driver_src_uri)}
-              $(document).ready(function() {
-                var table = $('#pwn_results').DataTable( {
-                  "order": [[2, 'asc']],
-                  "scrollY": scrollYHeight + "px",
-                  "scrollCollapse": true,
-                  "searchHighlight": true,
-                  "paging": true,
-                  "lengthMenu": [25, 50, 100, 250, 500, 1000, 2500, 5000],
-                  "drawCallback": function () {
-                    var api = this.api();
-
-                    // Redo the row counters
-                    api.column(0, {page: 'current'} ).nodes().each(function(cell, i) {
-                      cell.innerHTML = i + 1;
-                    });
-
-                    // Jump to top of scroll body when utilizing pagination
-                    var info = api.page.info();
-                    if (info.start !== oldStart) {
-                      $('.dt-scroll-body').animate({scrollTop: 0}, 500);
-                      oldStart = info.start;
-                    }
-                  },
-                  "ajax": "#{report_name}.json",
-                  "deferRender": false,
-                  "layout": {
-                  },
-                  "autoWidth": false,
-                  "columns": [
-                    { "data": null },
-                    {
-                      "data": "timestamp",
-                      "render": function (data, type, row, meta) {
-                        if (type === 'display') {
-                          timestamp = htmlEntityEncode(data);
-                          return '<table class="squish"><tr><td style="width:70px;" align="left">' + timestamp + '</td></tr></table>';
-                        } else {
-                          return data;
-                        }
-                      }
-                    },
-                    {
-                      "data": "security_references",
-                      "render": function (data, type, row, meta) {
-                        if (type === 'display') {
-                          var sast_dirname = data['sast_module'].split('::')[0].toLowerCase() + '/' + data['sast_module'].split('::')[1].toLowerCase();
-                          var sast_module = data['sast_module'].split('::')[2];
-                          var sast_test_case = sast_module.replace(/\\.?([A-Z])/g, function (x,y){ if (sast_module.match(/\\.?([A-Z][a-z])/g) ) { return "_" + y.toLowerCase(); } else { return y.toLowerCase(); } }).replace(/^_/g, "");
-
-                          return '<table class="squish"><tr><td style="width:125px;" align="left"><a href="https://github.com/0dayinc/pwn/tree/master/lib/' + htmlEntityEncode(sast_dirname) + '/' + htmlEntityEncode(sast_test_case) + '.rb" target="_blank">' + htmlEntityEncode(data['sast_module'].split("::")[2]) + '</a><br /><br /><a href="' + htmlEntityEncode(data['nist_800_53_uri']) + '" target="_blank">NIST 800-53: ' + htmlEntityEncode(data['section'])  + '</a><br /><br /><a href="' + htmlEntityEncode(data['cwe_uri']) + '" target="_blank">CWE:' + htmlEntityEncode(data['cwe_id'])  + '</a></td></tr></table>';
-                        } else {
-                          return data['sast_module'].split("::")[2] + ' | NIST 800-53: ' + data['section'] + ' | CWE:' + data['cwe_id'];
-                        }
-                      }
-                    },
-                    {
-                      "data": "filename",
-                      "render": function (data, type, row, meta) {
-                        if (type === 'display') {
-                          line_entry_uri = htmlEntityEncode(
-                            data['git_repo_root_uri'] + '/' + data['entry']
-                          );
-
-                          file = htmlEntityEncode(data['entry']);
-
-                          return '<table class="squish"><tr><td style="width:200px;" align="left"><a href="' + line_entry_uri + '" target="_blank">' + file + '</a></td></tr></table>';
-                        } else {
-                          return data['entry'];
-                        }
-                      }
-                    },
-                    {
-                      "data": "line_no_and_contents",
-                      "render": function (data, type, row, meta) {
-                        if (type === 'display') {
-                          var pwn_rows = '<table class="multi_line_select squish" style="width: 725px"><tbody>';
-                          for (var i = 0; i < data.length; i++) {
-                            var tr_class;
-                            if (i % 2 == 0) { tr_class = "odd"; } else { tr_class = "even"; }
-
-                            var filename_link = row.filename;
-
-                            var author_and_email_arr = data[i]['author'].split(" ");
-                            var email = author_and_email_arr[author_and_email_arr.length - 1];
-                            var email_user_arr = email.split("@");
-                            var assigned_to = email_user_arr[0].replace("&lt;", "");
-
-                            var uri = '#uri';
-
-                            var canned_email_results = 'Timestamp: ' + row.timestamp + '\\n' +
-                                                       'Source Code File Impacted: ' + $("<div/>").html(filename_link).text() + '\\n\\n' +
-                                                       'Source Code in Question:\\n\\n' +
-                                                       data[i]['line_no'] + ': ' +
-                                                       $("<div/>").html(data[i]['contents'].replace(/\\s{2,}/g, " ")).text() + '\\n\\n';
-
-                            var canned_email = email.replace("&lt;", "").replace("&gt;", "") + '?subject=Potential%20Bug%20within%20Source%20File:%20'+ encodeURIComponent(row.filename) +'&body=Greetings,%0A%0AThe%20following%20information%20likely%20represents%20a%20bug%20discovered%20through%20automated%20security%20testing%20initiatives:%0A%0A' + encodeURIComponent(canned_email_results) + 'Is%20this%20something%20that%20can%20be%20addressed%20immediately%20or%20would%20filing%20a%20bug%20be%20more%20appropriate?%20%20Please%20let%20us%20know%20at%20your%20earliest%20convenience%20to%20ensure%20we%20can%20meet%20security%20expectations%20for%20this%20release.%20%20Thanks%20and%20have%20a%20great%20day!';
-
-                            domain = line_entry_uri.replace('http://','').replace('https://','').split(/[/?#]/)[0];
-                            if (domain.includes('stash') || domain.includes('bitbucket') || domain.includes('gerrit')) {
-                              to_line_number = line_entry_uri + '#' + data[i]['line_no'];
-                            } else {
-                              // e.g. GitHub, GitLab, etc.
-                              to_line_number = line_entry_uri + '#L' + data[i]['line_no'];
-                            }
-
-                            pwn_rows = pwn_rows.concat('<tr class="' + tr_class + '"><td style="width:50px" align="left"><a href="' + htmlEntityEncode(to_line_number) + '" target="_blank">' + htmlEntityEncode(data[i]['line_no']) + '</a>:&nbsp;</td><td style="width:300px" align="left">' + htmlEntityEncode(data[i]['contents']) + '</td><td style="width:200px" align=:left">' + htmlEntityEncode(data[i]['ai_analysis']) + '</td><td style="width:175px" align="right"><a href="mailto:' + canned_email + '">' + htmlEntityEncode(data[i]['author']) + '</a></td></tr>');
-                          }
-                          pwn_rows = pwn_rows.concat('</tbody></table>');
-                          return pwn_rows;
-                        } else {
-                          var lines = [];
-                          for (var i = 0; i < data.length; i++) {
-                            lines.push(data[i]['line_no'] + ': ' + data[i]['contents'] + ' | AI: ' + data[i]['ai_analysis'] + ' | By: ' + data[i]['author']);
-                          }
-                          return lines.join('\\n');
-                        }
-                      }
-                    },
-                    {
-                      "data": "raw_content",
-                      "render": function (data, type, row, meta) {
-                        if (type === 'display') {
-                          raw_content = htmlEntityEncode(data);
-                          return '<table class="squish"><tr><td style="width:300px;" align="left">' + raw_content + '</td></tr></table>';
-                        } else {
-                          return data;
-                        }
-                      }
-                    },
-                    {
-                      "data": "test_case_filter",
-                      "render": function (data, type, row, meta) {
-                        if (type === 'display') {
-                          test_case_filter = htmlEntityEncode(data);
-                          return '<table class="squish"><tr><td style="width:300px;" align="left">' + test_case_filter + '</td></tr></table>';
-                        } else {
-                          return data;
-                        }
-                      }
-                    }
-                  ],
-                  "initComplete": function(settings, json) {
-                    $('#report_name').text(json.report_name);
-                    var raw_content_column = 5;
-                    var test_case_filter_column = 6;
-                    table.column(raw_content_column).visible(false);
-                    table.column(test_case_filter_column).visible(false);
-
-                    // Add export buttons after initialization
-                    new $.fn.dataTable.Buttons(table, {
-                      buttons: [
-                        {
-                          text: 'Select / Deselect All Lines',
-                          action: function () {
-                            select_deselect_all();
-                          }
-                        },
-                        {
-                          text: 'Export to JSON',
-                          action: function () {
-                            export_json(table);
-                          }
-                        },
-                        {
-                          text: 'Export to XLSX',
-                          action: function () {
-                            export_xlsx_or_pdf('xlsx');
-                          }
-                        },
-                        {
-                          text: 'Export to PDF',
-                          action: function () {
-                            export_xlsx_or_pdf('pdf');
-                          }
-                        }
-                      ]
-                    });
-
-                    table.buttons().container().appendTo('#toggle_col_and_button_group');
-
-                    // Update Smart Search Label with Example
-                    $('.dt-search label').text('Smart Search (e.g., "password !secure"):').css({'font-weight': 'bold', color: '#B40404'});
-                  }
-                });
-
-                function export_xlsx_or_pdf(type) {
-                  if ($('.multi_line_select tr.highlighted').length === 0 && !confirm('No lines selected. Export all records?')) {
-                    return;
-                  }
-
-                  getExportData(table).then(({data, report_name}) => {
-                    // Flatten data for export
-                    var flatData = [];
-                    data.forEach(function(row) {
-                      row.line_no_and_contents.forEach(function(line) {
-                        flatData.push({
-                          timestamp: row.timestamp,
-                          test_case: row.security_references.sast_module.split('::')[2],
-                          nist_800_53_security_control: row.security_references.nist_800_53_uri,
-                          cwe: row.security_references.cwe_uri,
-                          nist_section: row.security_references.section,
-                          cwe_id: row.security_references.cwe_id,
-                          path: row.filename.entry,
-                          line_no: line.line_no,
-                          contents: line.contents,
-                          ai_analysis: line.ai_analysis,
-                          author: line.author
-                        });
-                      });
-                    });
-
-                    var exportDate = new Date().toLocaleString();
-                    var title = '~ pwn sast >>> ' + report_name + ' (Exported on ' + exportDate + ')';
-
-                    if (type === 'xlsx') {
-                      const workbook = new ExcelJS.Workbook();
-                      const worksheet = workbook.addWorksheet('PWN SAST Results');
-
-                      // Add title row and merge
-                      worksheet.mergeCells('A1:I1');
-                      const titleCell = worksheet.getCell('A1');
-                      titleCell.value = title;
-                      titleCell.font = { size: 14, bold: true };
-                      titleCell.alignment = { horizontal: 'center' };
-
-                      // Add header row
-                      worksheet.addRow(['Timestamp', 'Test Case', 'NIST 800-53', 'CWE', 'Path', 'Line#', 'Content', 'AI Analysis', 'Author']);
-                      const headerRow = worksheet.getRow(2);
-                      headerRow.eachCell((cell) => {
-                        cell.font = { bold: true, color: { argb: 'FF000000' } };
-                        cell.fill = { type: 'pattern', pattern: 'solid', fgColor: { argb: 'FF999999' } };
-                        cell.alignment = { horizontal: 'center', wrapText: true };
-                      });
-
-                      // Add data rows with alternating fills and hyperlinks
-                      flatData.forEach((item, index) => {
-                        const row = worksheet.addRow([
-                          item.timestamp,
-                          item.test_case,
-                          { text: item.nist_section, hyperlink: item.nist_800_53_security_control },
-                          { text: item.cwe_id, hyperlink: item.cwe },
-                          item.path,
-                          item.line_no,
-                          item.contents,
-                          item.ai_analysis,
-                          item.author
-                        ]);
-
-                        const fill = (index % 2 === 0)
-                          ? { type: 'pattern', pattern: 'solid', fgColor: { argb: 'FFDEDEDE' } }
-                          : { type: 'pattern', pattern: 'solid', fgColor: { argb: 'FFFFFFFF' } };
-
-                        row.eachCell((cell) => {
-                          cell.fill = fill;
-                          cell.alignment = { wrapText: true, vertical: 'top', horizontal: 'left' };
-                        });
-                      });
-
-                      // Set column widths (converted from pixels to character units approx.)
-                      const pixelWidthsInches = [1.0, 2.0, 4.5, 0.5, 2.5, 0.75, 3.5, 3.5, 2];
-                      worksheet.columns = pixelWidthsInches.map(inches => {
-                        let width;
-                        width = inches / 0.077
-                        return { width: width };
-                      });
-
-                      // Freeze header
-                      worksheet.views = [{ state: 'frozen', ySplit: 2 }];
-
-                      // Generate and download the file
-                      workbook.xlsx.writeBuffer().then(buffer => {
-                        const blob = new Blob([buffer], { type: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet' });
-                        const url = URL.createObjectURL(blob);
-                        const a = document.createElement('a');
-                        a.href = url;
-                        a.download = report_name + '.xlsx';
-                        a.click();
-                        URL.revokeObjectURL(url);
-                      });
-                    } else if (type === 'pdf') {
-                      var docDefinition = {
-                        pageOrientation: 'landscape',
-                        pageSize: 'LETTER',
-                        pageMargins: [10, 10, 10, 10],
-                        header: {
-                          text: title, margin: [20, 10, 20, 0],
-                          fontSize: 12, bold: true,
-                          alignment: 'center'
-                        },
-                        footer: function(currentPage, pageCount) {
-                          return {
-                            text: 'Page ' + currentPage.toString() + ' of ' + pageCount + ' | Exported on ' + exportDate,
-                            alignment: 'center',
-                            fontSize: 8,
-                            margin: [0, 0, 0, 10]
-                          };
-                        },
-                        content: [
-                          {
-                            text: title,
-                            style: 'header'
-                          },
-                          {
-                            table: {
-                              headerRows: 1,
-                              widths: [45, 40, 70, 30, 80, 30, 165, 165, 70],
-                              body: [
-                                ['Timestamp', 'Test Case', 'NIST 800-53', 'CWE', 'Path', 'Line#', 'Content', 'AI Analysis', 'Author'],
-                                ...flatData.map(r => [
-                                  r.timestamp,
-                                  r.test_case,
-                                  { text: r.nist_section, link: r.nist_800_53_security_control, style: {decoration: 'underline'} },
-                                  { text: r.cwe_id, link: r.cwe, style: {decoration: 'underline'} },
-                                  r.path,
-                                  r.line_no,
-                                  r.contents,
-                                  r.ai_analysis,
-                                  r.author
-                                ])
-                              ]
-                            },
-                            layout: {
-                              hLineWidth: function(i, node) { return (i === 0 || i === node.table.body.length) ? 1 : 0.5; },
-                              vLineWidth: function(i, node) { return 0.5; },
-                              hLineColor: function(i, node) { return '#aaaaaa'; },
-                              vLineColor: function(i, node) { return '#aaaaaa'; },
-                              fillColor: function (rowIndex, node, columnIndex) {
-                                if (rowIndex === 0) {
-                                  return '#999999'; // Dark header
-                                }
-                                return (rowIndex % 2 === 0) ? '#ffffff' : '#dedede'; // White even, gray odd
-                              },
-                              paddingLeft: function(i, node) { return 4; },
-                              paddingRight: function(i, node) { return 4; },
-                              paddingTop: function(i, node) { return 2; },
-                              paddingBottom: function(i, node) { return 2; }
-                            }
-                          }
-                        ],
-                        styles: {
-                          header: {
-                            fontSize: 12,
-                            bold: true,
-                            margin: [0, 0, 0, 10]
-                          }
-                        },
-                        defaultStyle: {
-                          fontSize: 8,
-                          color: '#000000',
-                          columnGap: 20
-                        }
-                      };
-                      pdfMake.createPdf(docDefinition).download(report_name + '.pdf');
-                    }
-                  });
-                }
-              });
-              #{PWN::Reports::HTMLFooter.generate}
-        )
-
-        File.open("#{dir_path}/#{report_name}.html", 'w') do |f|
-          f.print(html_report)
-        end
-      rescue StandardError => e
-        raise e
-        # ensure
-        # spin.stop unless spin.nil?
-      end
-
-      # Author(s):: 0day Inc. <support@0dayinc.com>
-
-      public_class_method def self.authors
-        "AUTHOR(S):
-          0day Inc. <support@0dayinc.com>
-        "
-      end
-
-      # Display Usage for this Module
-
-      public_class_method def self.help
-        puts "USAGE:
-          #{self}.generate(
-            dir_path: dir_path,
-            results_hash: results_hash
-          )
-
-          #{self}.authors
-        "
-      end
-    end
-  end
-end