sastbox_sdk 1.0.0

data/spec/sastbox-sdk/scanner_spec.rb

@@ -0,0 +1,238 @@
+require_relative '../spec_helper'
+require_relative '../../lib/sastbox-sdk'
+
+RSpec.describe 'Scanner' do
+  let(:scanner) do
+    SastBox::Scanner.new(
+      name: 'test_name',
+      name_alias: 'test_alias',
+      description: 'test_desc',
+      support: ['test_support'],
+      version: '0.1',
+      tool: 'test_tool'
+    )
+  end
+
+  describe 'start_scan' do
+    context 'should raise name error for run method when correct options are provided' do
+      before do
+        scanner.parse_opts(['-o', 'xxx', '-c', 'aaa'])
+      end
+
+      it "should raise name error for run method when correct options are provided" do
+        expect { scanner.start_scan }.to raise_error(NameError) do |error| # #<NameError: undefined local variable or method `run' ...
+          expect( error.message ).to match(/undefined.*run/)
+        end
+      end
+    end
+  end
+
+  describe 'finish_scan' do
+    context 'should exit with status 1' do
+      let(:filename) do
+        File.absolute_path(File.join(File.dirname(__FILE__), '..', 'samples/low.php'))
+      end
+
+      let(:snippet) do
+        scanner.snippet_read(filename, 10)
+      end
+
+      let(:issue) do
+        {
+          title: 'vuln_name',
+          description: 'vuln_description',
+          references: [],
+          filename: filename,
+          snippet: snippet
+        }
+      end
+
+      before do
+        scanner.parse_opts(['-o', 'xxx', '-c', 'aaa'])
+        scanner.add_issue(issue)
+      end
+
+      it do
+        expect { scanner.finish_scan }.to raise_error(SystemExit) do |error|
+          expect( error.status ).to eq(1)
+        end
+      end
+    end
+
+    context 'should exit with status 0' do
+      let(:filename) do
+        File.absolute_path(File.join(File.dirname(__FILE__), '..', 'samples/low.php'))
+      end
+
+      let(:snippet) do
+        scanner.snippet_read(filename, 10)
+      end
+
+      before do
+        scanner.parse_opts(['-o', 'xxx', '-c', 'aaa'])
+      end
+
+      it do
+        expect { scanner.finish_scan }.to raise_error(SystemExit) do |error|
+          expect( error.status ).to eq(0)
+        end
+      end
+    end
+  end
+
+  describe 'info' do
+    subject { scanner.info }
+    it 'name' do
+      expect(subject[:name]).to eq 'test_name'
+    end
+
+    it 'description' do
+      expect(subject[:description]).to eq 'test_desc'
+    end
+
+    it 'support' do
+      expect(subject[:support]).to eq ['test_support']
+    end
+
+    it 'version' do
+      expect(subject[:version]).to eq '0.1'
+    end
+  end
+
+  describe 'add_issue' do
+    context 'when issue should be skipped' do
+
+      let(:snippet) do
+        {evidence_line: {content: 'abc', hash: ''}, evidence_full: {content: 'abc', hash: ''}}
+      end
+
+      let(:issue) do
+        {
+          title: 'vuln_name',
+          description: 'vuln_description',
+          references: [],
+          filename: 'base/.git/xxx',
+          snippet: snippet
+        }
+      end
+
+      before do
+        @status = scanner.add_issue(issue)
+      end
+
+      it { expect(@status).to be nil }
+      it { expect(scanner.issues.length).to be 0}
+    end
+
+    context 'when issue should not be skipped' do
+
+      let(:filename) do
+        File.absolute_path(File.join(File.dirname(__FILE__), '..', 'samples/low.php'))
+      end
+
+      let(:snippet) do
+        scanner.snippet_read(filename, 10)
+      end
+
+      let(:issue) do
+        {
+          title: 'vuln_name',
+          description: 'vuln_description',
+          references: [],
+          filename: filename,
+          snippet: snippet
+        }
+      end
+
+      before do
+        scanner.parse_opts(['-c', '/abc/def/ghi'])
+        @status = scanner.add_issue(issue)
+      end
+
+      #it { expect(@status).to be scanner.issues }
+      it { expect(scanner.issues.length).to be 1}
+      it "hash_issue_v1" do
+        expect(scanner.issues.first[:hash_issue]).to eq '220da2ef86cb34b97e4253f5b212b2a720c93d717e7fec8f243d851441774181'
+      end
+
+      it "hash_issue_v2" do
+        expect(scanner.issues.first[:hash_issue_v2]).to eq '55a52215b49450ebf8fdb8db1d50f4be3d204959989834e25ba2be9e2f2d5b00'
+      end
+
+    end
+  end
+
+  describe 'parse_json_from_str' do
+    context 'should parse json from string' do
+      it "should parse json from string" do
+        expect(scanner.parse_json_from_str('{"abc": "123"}') ).to be_an Hash
+        expect(scanner.parse_json_from_str('{"abc": "123"}') ).to have_key("abc")
+        expect(scanner.parse_json_from_str('{"abc": "123"}')["abc"] ).to eq "123"
+      end
+
+      it "should return nil when json is invalid" do
+        expect(scanner.parse_json_from_str('xxxxx') ).to eq nil
+      end
+    end
+  end
+
+  describe 'parse_json_from_file' do
+    context 'should parse json from file' do
+      let(:filename_valid) { '/tmp/json_input_valid_test.json' }
+      let(:filename_invalid) { '/tmp/json_input_invalid_test.json' }
+
+      before do
+        File.write(filename_valid, '{"abc": "123"}')
+        File.write(filename_invalid, 'xxxxx')
+      end
+
+      it "should parse json from file" do
+        expect(scanner.parse_json_from_file(filename_valid) ).to be_an Hash
+        expect(scanner.parse_json_from_file(filename_valid) ).to have_key("abc")
+        expect(scanner.parse_json_from_file(filename_valid)["abc"] ).to eq "123"
+      end
+
+      it "should return nil when json is invalid" do
+        expect(scanner.parse_json_from_file(filename_invalid) ).to eq nil
+      end
+    end
+  end
+
+  describe 'save_results' do
+    context 'should save results to file' do
+      let(:report) { '/tmp/save_results.json' }
+
+      before do
+        File.delete(report) if File.exist?(report)
+
+        allow(scanner).to receive(:generate_sarif_report) { '{}' }
+
+        scanner.parse_opts(['-o', report])
+        scanner.save_scan_output
+      end
+
+      it "should save results to file" do
+        expect(File.exist?(report)).to be true
+      end
+    end
+  end
+
+  describe 'gen_random_tmp_filename' do
+    context 'should generate random filename' do
+
+      it "should generate random filename" do
+        expect(scanner.gen_random_tmp_filename('.xxxyyy')).to match /\/tmp\/.*\.xxxyyy/
+      end
+    end
+  end
+
+  describe 'gen_random_tmp_filename_json' do
+    context 'should generate random json filename' do
+
+      it "should generate random json filename" do
+        expect(scanner.gen_random_tmp_filename_json).to match /\/tmp\/.*\.json/
+      end
+    end
+  end
+end
+

data/spec/sastbox-sdk/severity_calculator_spec.rb

@@ -0,0 +1,126 @@
+require_relative '../spec_helper'
+require_relative '../../lib/sastbox-sdk'
+
+
+RSpec.describe 'SeverityCalculator' do
+  let(:scanner) do
+    SastBox::Scanner.new(
+      name: 'test_name',
+      name_alias: 'test_alias',
+      description: 'test_desc',
+      support: ['test_support'],
+      version: '0.1',
+      tool: 'test_tool'
+    )
+  end
+
+  describe 'add_severity' do
+    context 'when dont have severity field' do
+      let(:issue) do
+        {
+          title: 'cmd exec',
+          description: 'cmd exec'
+        }
+      end
+
+      before do
+        scanner.add_severity(issue)
+      end
+
+      it {expect( issue[:severity]).to eq :critical}
+    end
+
+    context 'when have severity field different from accepted levels' do
+      let(:issue) do
+        {
+          title: 'cmd exec',
+          description: 'cmd exec',
+          severity: 'anything'
+        }
+      end
+
+      before do
+        scanner.add_severity(issue)
+      end
+
+      it {expect( issue[:severity]).to eq :critical}
+    end
+
+    context 'when have valid severity field' do
+      let(:issue) do
+        {
+          title: 'anything',
+          description: 'anything',
+          severity: :info
+        }
+      end
+
+      before do
+        scanner.add_severity(issue)
+      end
+
+      it {expect( issue[:severity]).to eq :info}
+    end
+  end
+
+
+  describe 'attempt_to_determine_severity' do
+    context 'when critical' do
+      let(:issue) do
+        {
+          title: 'cmd exec',
+          description: 'cmd exec'
+        }
+      end
+
+      it {expect( scanner.attempt_to_determine_severity(issue)).to eq :critical}
+    end
+
+    context 'when high' do
+      let(:issue) do
+        {
+          title: 'xss',
+          description: 'xss'
+        }
+      end
+
+      it {expect( scanner.attempt_to_determine_severity(issue)).to eq :high}
+    end
+
+    context 'when medium' do
+      let(:issue) do
+        {
+          title: 'csrf',
+          description: 'csrf'
+        }
+      end
+
+      it {expect( scanner.attempt_to_determine_severity(issue)).to eq :medium}
+    end
+
+    context 'when low' do
+      let(:issue) do
+        {
+          title: 'logging',
+          description: 'logging'
+        }
+      end
+
+      it {expect( scanner.attempt_to_determine_severity(issue)).to eq :low}
+    end
+
+    context 'when undefined' do
+      let(:issue) do
+        {
+          title: 'anything',
+          description: 'anything'
+        }
+      end
+
+      it {expect( scanner.attempt_to_determine_severity(issue)).to eq :undefined}
+    end
+  end
+
+
+end
+

data/spec/sastbox-sdk/snippet_spec.rb

@@ -0,0 +1,175 @@
+require_relative '../spec_helper'
+require_relative '../../lib/sastbox-sdk'
+
+
+RSpec.describe 'snippet' do
+  let(:scanner) do
+    SastBox::Scanner.new(
+      name: 'test_name',
+      name_alias: 'test_alias',
+      description: 'test_desc',
+      support: ['test_support'],
+      version: '0.1',
+      tool: 'test_tool'
+    )
+  end
+
+  let(:filename) do
+    File.absolute_path(File.join(File.dirname(__FILE__), '..', 'samples/low.php'))
+  end
+
+  describe 'filename_relative' do
+    before do
+      scanner.parse_opts(['-c', '/abc/def/ghi'])
+    end
+
+    context 'filename does not starts with codebase' do
+      it {expect( scanner.filename_relative('/xxx/yyy') ).to be nil }
+    end
+
+    context 'filename starts with codebase' do
+      it {expect( scanner.filename_relative('/abc/def/ghi/xxx/yyy') ).to eq 'xxx/yyy' }
+    end
+  end
+
+  describe 'snippet_calculate_hashes' do
+    context 'hashes to match correct value' do
+      let(:snippet) do
+        {evidence_line: {content: 'abc', hash: ''}, evidence_full: {content: 'abc', hash: ''}}
+      end
+
+      before do
+        scanner.snippet_calculate_hashes(snippet)
+      end
+
+      it {expect( snippet[:evidence_line][:hash]).to eq 'ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad' }
+
+      it {expect( snippet[:evidence_full][:hash]).to eq 'ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad' }
+    end
+  end
+
+  describe 'snippet_read' do
+    context 'when file exists and line is within range' do
+      subject {scanner.snippet_read(filename, 10) }
+
+      it 'snippet[:read_success]' do
+        expect(subject[:read_success]).to be true;
+      end
+
+      it 'snippet[:evidence_line][:content]' do
+        expect(subject[:evidence_line][:content]).to eq "\t\t$cmd = shell_exec( 'ping  ' . $target );";
+      end
+
+      it 'snippet[:evidence_line][:hash]' do
+        expect(subject[:evidence_line][:hash]).to eq '9882497a714594ae1d4ac2e167cce7de6cdc7dd4cffa5456bffd7b3194c9d042';
+      end
+
+      it 'snippet[:evidence_full][:hash]' do
+        expect(subject[:evidence_full][:hash]).to eq 'c61da3e81b8847eb0b6b34bda42db8177e120b6b1fc8e19e0ed332d6751000f0';
+      end
+    end
+
+    context 'when file does not exist' do
+      subject {scanner.snippet_read('/tmp/qwuhasgnewhbeqwyegasdf', 10) }
+
+      it 'snippet[:read_success]' do
+        expect(subject[:read_success]).to be false;
+      end
+
+      it 'snippet[:evidence_line][:content]' do
+        expect(subject[:evidence_line][:content]).to eq ''
+      end
+
+      it 'snippet[:evidence_line][:hash]' do
+        expect(subject[:evidence_line][:hash]).to eq '';
+      end
+
+      it 'snippet[:evidence_full][:hash]' do
+        expect(subject[:evidence_full][:hash]).to eq '';
+      end
+    end
+
+    context 'when file exists and line is out of range' do
+      subject {scanner.snippet_read(filename, 50000) }
+
+      it 'snippet[:read_success]' do
+        expect(subject[:read_success]).to be false;
+      end
+
+      it 'snippet[:evidence_line][:content]' do
+        expect(subject[:evidence_line][:content]).to eq ''
+      end
+
+      it 'snippet[:evidence_line][:hash]' do
+        expect(subject[:evidence_line][:hash]).to eq '';
+      end
+
+      it 'snippet[:evidence_full][:hash]' do
+        expect(subject[:evidence_full][:hash]).to eq '';
+      end
+    end
+  end
+
+  describe 'snippet_read_range' do
+    context 'when file exists and start/end line is within range' do
+      subject {scanner.snippet_read_range(filename, 17, 18) }
+
+      it 'snippet[:read_success]' do
+        expect(subject[:read_success]).to be true;
+      end
+
+      it 'snippet[:evidence_line][:content]' do
+        expect(subject[:evidence_line][:content]).to eq "\t// Feedback for the end user\r\n\t$html .= \"<pre>{$cmd}</pre>\";\r\n";
+      end
+
+      it 'snippet[:evidence_line][:hash]' do
+        expect(subject[:evidence_line][:hash]).to eq '1beb122abba992b58df776523269522a6b0411679e991f62e2fa116db6d960ff';
+      end
+
+      it 'snippet[:evidence_full][:hash]' do
+        expect(subject[:evidence_full][:hash]).to eq '9a4a2ee8ed7a70956e9960036e036770499f48225f20c42bb8d21a2f40771dc6';
+      end
+    end
+
+    context 'when file does not exist' do
+      subject {scanner.snippet_read_range('/tmp/qwuhasgnewhbeqwyegasdf', 17, 18) }
+
+      it 'snippet[:read_success]' do
+        expect(subject[:read_success]).to be false;
+      end
+
+      it 'snippet[:evidence_line][:content]' do
+        expect(subject[:evidence_line][:content]).to eq ''
+      end
+
+      it 'snippet[:evidence_line][:hash]' do
+        expect(subject[:evidence_line][:hash]).to eq '';
+      end
+
+      it 'snippet[:evidence_full][:hash]' do
+        expect(subject[:evidence_full][:hash]).to eq '';
+      end
+    end
+
+    context 'when file exists and start/end line is out of range' do
+      subject {scanner.snippet_read_range(filename, 50000, 60000) }
+
+      it 'snippet[:read_success]' do
+        expect(subject[:read_success]).to be false;
+      end
+
+      it 'snippet[:evidence_line][:content]' do
+        expect(subject[:evidence_line][:content]).to eq ''
+      end
+
+      it 'snippet[:evidence_line][:hash]' do
+        expect(subject[:evidence_line][:hash]).to eq '';
+      end
+
+      it 'snippet[:evidence_full][:hash]' do
+        expect(subject[:evidence_full][:hash]).to eq '';
+      end
+    end
+  end
+end
+