sastbox_sdk 1.0.0

data/lib/sastbox-sdk/reporter_sarif.rb

@@ -0,0 +1,112 @@
+require 'digest'
+
+module SastBox
+  module Reporter
+    module Sarif
+
+      def generate_sarif_report
+        new_sarif_log
+        @issues.each do |issue|
+          sarif_result = convert_to_sarif_result(issue)
+          @sarif_results << sarif_result unless sarif_result.nil?
+        end
+
+        begin
+          JSON.pretty_generate(@sarif_log)
+        rescue JSON::GeneratorError => e
+          print_error("Could not generate sarif result=> #{e}")
+        end
+      end
+
+      def new_sarif_log
+        @sarif_results = []
+        @sarif_rules = []
+        @sarif_log = {
+          'version': '2.1.0',
+          '$schema': 'https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0-rtm.5.json',
+          'runs': sarif_runs
+        }
+      end
+
+      def sarif_runs
+        [{
+          'tool': { 'driver': {'name': @name, 'informationUri': '', 'semanticVersion': @version, 'rules': @sarif_rules } },
+          'results': @sarif_results
+        }]
+      end
+
+      def make_rule(issue)
+        rule_id = "#{@name}-#{Digest::SHA1.hexdigest(issue[:title])}"
+        rule_name = issue[:title]
+        help_uri = ''
+        help_uri = issue[:references].first if issue[:references].length > 0
+
+        rule_index = @sarif_rules.index { |r| r[:id] == rule_id }
+        if rule_index.nil?
+          rule = {
+            id: rule_id,
+            name: rule_name,
+            shortDescription: {text: issue[:title]},
+            fullDescription:  {text: issue[:title]},
+            helpUri: help_uri,
+            help: {text: ''}
+          }
+          rule_index = @sarif_rules.length
+          @sarif_rules << rule
+
+        end
+        rule_index
+      end
+
+      def convert_to_sarif_result(issue)
+        rule_index = make_rule(issue)
+        rule = @sarif_rules[rule_index]
+
+        relative_path = filename_relative(issue[:filename])
+        return nil if relative_path.nil?
+
+        snippet = issue[:snippet]
+
+        sarif_result = {
+          ruleId:    rule[:id],
+          ruleIndex: rule_index,
+          level:     'warning',
+          message:   {text: issue[:description]},
+
+          locations: [{
+            physicalLocation: {
+              artifactLocation: {uri: relative_path, uriBaseId: '%SRCROOT%'},
+              region: {
+                snippet: {
+                  text: snippet[:evidence_line][:content]
+                },
+                startLine: snippet[:evidence_line][:start_line]
+              },
+              contextRegion: {
+                snippet: {
+                  text: snippet[:evidence_full][:content]
+                },
+                startLine: snippet[:evidence_full][:start_line],
+                endLine: snippet[:evidence_full][:end_line]
+              }
+            }
+          }],
+          partialFingerprints: {
+            hashIssueV1:      issue[:hash_issue],       # compatible with sastbox v1
+            hashIssueV2:      issue[:hash_issue_v2],
+            snippetHashLine:  snippet[:evidence_line][:hash],
+            snippetHashFull:  snippet[:evidence_full][:hash]
+          },
+          properties: {
+            cweId: issue[:cwe_id].to_i,
+            tags: issue[:tags],
+            issueSeverity: issue[:severity],
+          }
+        }
+        sarif_result
+      end
+
+    end
+  end
+end
+

data/lib/sastbox-sdk/runner.rb

@@ -0,0 +1,55 @@
+require 'timeout'
+
+module SastBox
+  module Runner
+
+    # TODO: find a better way to do this
+    def command?(name)
+      `which #{name}`
+      $?.success?
+    end
+
+    def run_cmd(cmd)
+      print_debug(cmd) if @opts.verbose
+      if command?(cmd[0])
+        run_cmd_with_timeout(cmd)
+      else
+        print_error("Command not found: #{cmd[0]}")
+        exit 1
+      end
+    end
+
+    def run_cmd_with_timeout(cmd)
+      out_reader = ''
+      err_reader = ''
+      Open3.popen3(*cmd) do |stdin, stdout, stderr, wait_thr|
+        # https://stackoverflow.com/questions/8952043/how-to-fix-hanging-popen3-in-ruby
+        stdin.close_write
+        output, pid = [], wait_thr.pid
+        begin
+          Timeout.timeout(@opts.timeout) do
+            begin
+              err_reader = Thread.new { stderr.read }
+            rescue IOError
+            end
+
+            out_reader = stdout.read
+
+            #output = [stdout.read, stderr.read]
+            Process.wait(pid)
+          end
+        rescue Errno::ECHILD
+        rescue Timeout::Error
+          print_error('Timed out - Skipping...')
+          Process.kill('HUP', pid)
+          exit 1
+        end
+        [out_reader, wait_thr.value]
+      end
+    end
+  end
+end
+
+
+
+

data/lib/sastbox-sdk/scanner.rb

@@ -0,0 +1,152 @@
+module SastBox
+  class Scanner
+
+    include SastBox::OptParser
+    include SastBox::Printer
+    include SastBox::Runner
+    include SastBox::Snippet
+    include SastBox::Reporter::Sarif
+    include SastBox::Cwe
+    include SastBox::SeverityCalculator
+
+    attr_accessor :issues
+
+    def initialize(params)
+      @name = params[:name]
+      @name_alias = params[:name_alias] || @name
+      @description = params[:description]
+      @support = params[:support]
+      @version = params[:version]
+      @tool = params[:tool]
+
+      @issues = []
+    end
+
+    def info
+      {
+        name: @name,
+        description: @description,
+        support: @support,
+        version: @version,
+        sdk_version: SastBox::SDK_VERSION
+      }
+    end
+
+    def add_hash_issue_v1(issue) # compatibility with sastbox v1
+      issue[:hash_issue] = ''
+      return if got_line_range?(issue) # hash v1 not needed for scanners which report start/end line
+
+      scanner_name = @name_alias
+      short_filename = issue[:filename].sub(@opts.codebase, '')
+      data = [
+        scanner_name,
+        issue[:title],
+        issue[:description],
+        short_filename,
+        issue[:line].to_s,
+        (issue[:snippet][:evidence_line][:hash] || ''),
+      ]
+      issue[:hash_issue] = Digest::SHA256.hexdigest(data.join(':'))
+    end
+
+    def add_hash_issue_v2(issue)
+      filename_path = filename_relative(issue[:filename])
+      filename_path = '' if filename_path.nil?
+      data = [
+        issue[:title],
+        issue[:description],
+        filename_path,
+        got_line_range?(issue) ? "#{issue[:start_line].to_s}-#{issue[:end_line].to_s}" : issue[:line].to_s,
+        (issue[:snippet][:evidence_line][:hash]|| ''),
+      ]
+      issue[:hash_issue_v2] = Digest::SHA256.hexdigest(data.join(':'))
+    end
+
+    def got_line_range?(issue)
+      issue.key?(:start_line) && issue.key?(:end_line)
+    end
+
+    def add_issue(issue)
+      return if skip_issue?(issue)
+      issue[:tags] = [] unless issue.key? :tags
+      add_severity(issue)
+      add_hash_issue_v1(issue)
+      add_hash_issue_v2(issue)
+      guess_cwe(issue)
+      @issues << issue
+    end
+
+    def skip_issue?(issue)
+      return true if issue[:filename].include?('/.git/')
+      return true if issue[:snippet][:read_success] == false
+      return false # valid issue
+    end
+
+    def validate_opts
+      enable_color(@opts.color)
+      if @opts.info
+        puts JSON.pretty_generate(info)
+        exit 0
+      end
+
+      if @opts.output.nil?
+        print_error('output (-o) not passed')
+        exit 0
+      end
+
+      if @opts.codebase.nil?
+        print_error('codebase (-c) not passed')
+        exit 0
+      end
+    end
+
+    def start_scan
+      validate_opts
+
+      print_title("Running #{@name}")
+      run
+      #finish_scan
+    end
+
+    def finish_scan
+      status = 0
+      status = 1 unless @issues.empty?
+      print_title("Finished #{@name}")
+      exit status
+    end
+
+    def save_scan_output
+      File.open(@opts.output, "wb") { |file| file.write(generate_sarif_report) }
+      print_normal("Sarif result saved to #{@opts.output}", 1)
+    end
+
+    def gen_random_tmp_filename(suffix = '')
+      File.join(Dir.tmpdir, "#{SecureRandom.urlsafe_base64}#{suffix}")
+    end
+
+    def gen_random_tmp_filename_json
+      gen_random_tmp_filename('.json')
+    end
+
+    def parse_json_from_str(s)
+      content = nil
+      unless s.nil?
+        begin
+          content = JSON.parse(s)
+        rescue JSON::ParserError
+        end
+      end
+      content
+    end
+
+    def parse_json_from_file(filename)
+      content = nil
+      if File.exist?(filename)
+        content = parse_json_from_str(File.read(filename))
+      end
+      content
+    end
+
+  end
+end
+

data/lib/sastbox-sdk/severity_calculator.rb

@@ -0,0 +1,82 @@
+module SastBox
+  module SeverityCalculator
+
+    def add_severity(issue)
+      accepted_levels =  [:info, :low, :medium, :high, :critical]
+
+      if issue.key?(:severity)
+        issue[:severity] = issue[:severity].to_s.downcase.to_sym
+
+        unless accepted_levels.include?(issue[:severity])
+          issue[:severity] = attempt_to_determine_severity(issue)
+        end
+      else
+        issue[:severity] = attempt_to_determine_severity(issue)
+      end
+
+    end
+
+    def severity_pattern_found?(patterns, text)
+      patterns.each do |pattern|
+        return true if text.include?(pattern)
+      end
+      false
+    end
+
+    def attempt_to_determine_severity(issue)
+      text = "#{issue[:title]} #{issue[:description]}".downcase.gsub(/[^a-z ]/, ' ')
+
+      level = :undefined
+
+      critical = ['command exec', 'cmd exec', 'command inj', 'cmd inj', 'code inj', 'code exec',
+        'file inclusion', 'dangerous send', 'insecure deserialization']
+
+      high = ['xss', 'cross site scripting', 'sqli', 'sql injection', 'insecure url',
+        'file manipulation', 'file access', 'file disclosure', 'idor', 'xpath inj',
+        'weak cipher', 'weak crypto', 'insecure cipher', 'insecure crypto', 'insecure encryption',
+        'broken cipher', 'broken crypto', 'weak hash', 'insecure hash', 'broken hash',
+        'pathtraversal', 'path traversal', 'xxe', 'xml external entities']
+
+      medium = ['mass assignment', 'secret keyword',
+        'hard coded pass', 'hardcoded pass', 'pass hardcoded', 'password hardcoded',
+        'password hard coded', 'secret hardcoded',
+        'session fixation', 'security misconfiguration', 'vulnerable component',
+        'header injection', 'csrf', 'cross site request forgery',
+        'toctou', 'session setting', 'response splitting'
+      ]
+
+      low = ['open redirect', 'resource leak', 'format validation',
+      'information disclosure', 'logging', 'logger', 'stacktrace', 'stack trace',
+      'null pointer deref']
+
+      info = []
+
+
+      if level == :undefined
+        level = :critical if severity_pattern_found?(critical, text)
+      end
+
+      if level == :undefined
+        level = :high if severity_pattern_found?(high, text)
+      end
+
+      if level == :undefined
+        level = :medium if severity_pattern_found?(medium, text)
+      end
+
+      if level == :undefined
+        level = :low if severity_pattern_found?(low, text)
+      end
+
+      if level == :undefined
+        level = :info if severity_pattern_found?(info, text)
+      end
+
+      level
+    end
+  end
+end
+
+
+
+

data/lib/sastbox-sdk/snippet.rb

@@ -0,0 +1,107 @@
+require 'digest'
+
+module SastBox
+  module Snippet
+
+    def filename_relative(filename)
+      #filename.sub(@opts.codebase, '') if filename.start_with?(@opts.codebase)
+      filename_path = File.expand_path(filename)
+      codebase_path = File.expand_path(@opts.codebase)
+
+      if filename_path.start_with?(codebase_path)
+        filename_path.sub!(codebase_path, '')
+        filename_path = filename_path[1..-1] if filename_path.start_with?('/')
+        return filename_path
+      else
+        #print_warning("Filename outside codebase => #{filename_path}")
+        return nil
+      end
+    end
+
+    def snippet_calculate_hashes(snippet)
+      snippet[:evidence_line][:hash] = Digest::SHA256.hexdigest(snippet[:evidence_line][:content])
+      snippet[:evidence_full][:hash] = Digest::SHA256.hexdigest(snippet[:evidence_full][:content])
+    end
+
+    def snippet_read(filename, line, context=5)
+      snippet = {
+        evidence_line:    { content: '', start_line: 0, end_line: 0, hash: '' },
+        evidence_full:    { content: '', start_line: 0, end_line: 0, hash: '' },
+        read_success: false
+      }
+
+      if File.file?(filename)
+        snippet[:read_success] = true
+        lines = File.open(filename).readlines
+        begin_code = [1, line.to_i - context].max
+        end_code = [line.to_i + context, lines.length].min
+
+        if end_code > lines.length or line.to_i > lines.length
+          snippet[:read_success] = false
+          return snippet
+        end
+
+        snippet[:evidence_line][:start_line] = line.to_i
+        snippet[:evidence_line][:end_line]   = line.to_i
+        snippet[:evidence_line][:content] = lines[line.to_i - 1].chomp.force_encoding('ISO-8859-1').encode('UTF-8')
+
+        snippet[:evidence_full][:start_line] = begin_code
+        snippet[:evidence_full][:end_line]   = end_code
+
+        begin_code.upto(end_code) do |pos|
+          snippet[:evidence_full][:content] << lines[pos - 1].force_encoding('ISO-8859-1').encode('UTF-8')
+        end
+        snippet_calculate_hashes(snippet)
+        #snippet[:evidence_line][:hash] = Digest::SHA256.hexdigest(snippet[:evidence_line][:content])
+        #snippet[:evidence_full][:hash] = Digest::SHA256.hexdigest(snippet[:evidence_full][:content])
+      end
+
+      snippet
+    end
+
+    def snippet_read_range(filename, start_line, end_line, context=5)
+      snippet = {
+        evidence_line:    { content: '', start_line: 0, end_line: 0, hash: '' },
+        evidence_full:    { content: '', start_line: 0, end_line: 0, hash: '' },
+        read_success: false
+      }
+
+      if File.file?(filename)
+        snippet[:read_success] = true
+        lines = File.open(filename).readlines
+        num_lines = lines.length
+
+        if !start_line.between?(1, num_lines) || !end_line.between?(1, num_lines) || start_line > end_line
+          snippet[:read_success] = false
+          return snippet
+        end
+
+        begin_code = [1, start_line.to_i - context].max
+        end_code = [end_line.to_i + context, num_lines].min
+
+        if end_code > num_lines
+          snippet[:read_success] = false
+          return snippet
+        end
+
+        snippet[:evidence_line][:start_line] = start_line.to_i
+        snippet[:evidence_line][:end_line]   = end_line.to_i
+
+        start_line.upto(end_line) do |pos|
+          snippet[:evidence_line][:content] << lines[pos - 1].force_encoding('ISO-8859-1').encode('UTF-8')
+        end
+
+        snippet[:evidence_full][:start_line] = begin_code
+        snippet[:evidence_full][:end_line]   = end_code
+
+        begin_code.upto(end_code) do |pos|
+          snippet[:evidence_full][:content] << lines[pos - 1].force_encoding('ISO-8859-1').encode('UTF-8')
+        end
+
+        snippet_calculate_hashes(snippet)
+      end
+
+      snippet
+    end
+  end
+end