shield_ast 1.3.1 → 1.3.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 247e09e12b6a38c007410fc314f9f4582830b4efcdea6cf8517b626293943b4d
-  data.tar.gz: cb5cf723c2a68c549523a9aa80000f533936e71bb419a22ebbfaf19beb04a910
+  metadata.gz: 10303d978bc4075c8520765a20e7c2567417ef3f57b34d09ce333087a79e642d
+  data.tar.gz: 07bbfc2ffadf258e3ef0c241b03d6041616f61d6ee4de98cbf2e81cc5c523ab3
 SHA512:
-  metadata.gz: 967142208a50c569075d39b36b5cc77284f5bd855efc5fc4ead3d266b67a0b4d0c73aeac57344900dba1f9bbe54543322302bf9f350588de0ccd7f8c72bdd6fb
-  data.tar.gz: 81e19d8e42c2baa7c01af184204def0971b608deadaa007c9b2737deb10f56e462d042e78bd2aa8869779d0210267f0051e65dc3f422092eee131cd4834c9c3e
+  metadata.gz: 15aa323250b887ab2fbc48e65b7121d6788c4231f9c30b014bdb6fa5fe648218b63f22d754ac051c8f9dce504a93a24268d984b7ec1dd9953abe9e7942eb60d9
+  data.tar.gz: 421a506dc42faabdbe31749e57fcf9ccd8cda1124f77060f1147e8029e51ee9ed0154beb064129dd2111878405f9786a2c23f7b2312b7f14cf444da564da020e

data/README.md

@@ -1,4 +1,4 @@
-# Shield AST - Application Security Testing CLI
+# Shield AST - Application Security Testing
 
 [![Gem Version](https://badge.fury.io/rb/shield_ast.svg)](https://badge.fury.io/rb/shield_ast)
 [![Build Status](https://github.com/JAugusto42/shield_ast/actions/workflows/main.yml/badge.svg)](https://github.com/JAugusto42/shield_ast/actions)
@@ -41,9 +41,9 @@ ast [command] [options]
 - **`help`** – Displays this help message.
 
 ### Options
-- **`-s, --sast`** – Run SAST using [Semgrep](https://semgrep.dev).
+- **`-s, --sast`** – Run SAST using [Opengrep](https://www.opengrep.dev/).
 - **`-c, --sca`** – Run SCA using [OSV Scanner](https://osv.dev).
-- **`-i, --iac`** – Run IaC analysis using [Semgrep](https://semgrep.dev) with infrastructure rules.
+- **`-i, --iac`** – Run IaC analysis using [Opengrep](https://www.opengrep.dev/) with infrastructure rules.
 - **`-o, --output`** – Specify the output format (`json`, `sarif`, `console`).
 - **`-h, --help`** – Show this help message.
 - **`--version`** – Show the AST version.
@@ -99,9 +99,9 @@ ast report --output sarif
 ## 🛠 How It Works
 
 AST integrates well-known open-source scanners into a single CLI tool:
-- **SAST** – [Semgrep](https://semgrep.dev) for static code analysis
+- **SAST** – [Opengrep](https://www.opengrep.dev/) for static code analysis
 - **SCA** – [OSV Scanner](https://osv.dev) for dependency vulnerability scanning
-- **IaC** – [Semgrep](https://semgrep.dev) rules for Infrastructure as Code
+- **IaC** – [Opengrep](https://www.opengrep.dev/) rules for Infrastructure as Code
 
 This unified approach streamlines security testing, enabling developers to catch security issues earlier in the development process.
 

data/lib/shield_ast/iac.rb

@@ -4,11 +4,11 @@ require "json"
 require "open3"
 
 module ShieldAst
-  # Wraps the logic for running Infrastructure as Code (IaC) scans using Semgrep.
+  # Wraps the logic for running Infrastructure as Code (IaC) scans using Opengrep.
   class IaC
     def self.scan(path)
       cmd = [
-        "semgrep", "scan",
+        "opengrep", "scan",
         "--config", "r/terraform",
         "--config", "r/kubernetes",
         "--config", "r/docker",

data/lib/shield_ast/sast.rb

@@ -5,7 +5,7 @@ require "json"
 require "open3"
 
 module ShieldAst
-  # Wraps the logic for running SAST scan using Semgrep.
+  # Wraps the logic for running SAST scan using Opengrep.
   class SAST
     EXCLUDE_PATTERNS = %w[**/spec/ **/test/ **/tests/ **/features/ **/__tests__/ **/vendor/
                           **/node_modules/ **/*_spec.rb **/*_test.rb **/*.spec.js **/*.test.js
@@ -18,16 +18,16 @@ module ShieldAst
       if status.success?
         JSON.parse(stdout)
       else
-        warn "Semgrep SAST scan failed! Exit Code: #{status.exitstatus}\nError: #{stderr}"
+        warn "Opengrep SAST scan failed! Exit Code: #{status.exitstatus}\nError: #{stderr}"
         { "results" => [] }
       end
     rescue JSON::ParserError => e
-      warn "Failed to parse Semgrep SAST output: #{e.message}"
+      warn "Failed to parse Opengrep SAST output: #{e.message}"
       { "results" => [] }
     end
 
     def self.build_command(path)
-      base_cmd = %w[semgrep scan --config p/r2c-ci --config p/secrets --json --disable-version-check]
+      base_cmd = %w[opengrep scan --config p/r2c-ci --config p/secrets --json --disable-version-check]
 
       EXCLUDE_PATTERNS.each do |pattern|
         base_cmd.push("--exclude", pattern)

data/lib/shield_ast/sca.rb

@@ -21,7 +21,7 @@ module ShieldAst
         puts "Executing command: #{cmd}" if ENV["DEBUG"]
 
         output = `#{cmd} 2>&1`
-        exit_code = $?.exitstatus
+        exit_code = $CHILD_STATUS.exitstatus
 
         puts "Exit code: #{exit_code}" if ENV["DEBUG"]
         puts "Output: #{output}" if ENV["DEBUG"]
@@ -49,7 +49,7 @@ module ShieldAst
           puts "OSV Scanner non-result error (exit code: #{exit_code})"
           { "results" => [] }
         end
-      rescue => e
+      rescue StandardError => e
         puts "Error running OSV Scanner: #{e.message}"
         { "results" => [] }
       end
@@ -132,12 +132,11 @@ module ShieldAst
     end
 
     def self.extract_fixed_version(vuln)
-      if vuln["affected"] && vuln["affected"].is_a?(Array)
+      if vuln["affected"].is_a?(Array)
         vuln["affected"].each do |affected|
-          if affected["ranges"] && affected["ranges"].is_a?(Array)
+          if affected["ranges"].is_a?(Array)
             affected["ranges"].each do |range|
-              if range["events"] && range["events"].is_a?(Array)
-                # Look for "fixed" events
+              if range["events"].is_a?(Array)
                 fixed_event = range["events"].find { |event| event["fixed"] }
                 return fixed_event["fixed"] if fixed_event
               end

data/lib/shield_ast/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ShieldAst
-  VERSION = "1.3.1"
+  VERSION = "1.3.3"
 end

data/lib/shield_ast.rb

@@ -25,9 +25,9 @@ module ShieldAst
     def self.call(args)
       banner
 
-      unless scanner_exists?("osv-scanner") && scanner_exists?("semgrep")
+      unless scanner_exists?("osv-scanner") && scanner_exists?("opengrep")
         puts "\e[31m[!] ERROR:\e[0m Required tools not found."
-        puts "    Install: \e[33mosv-scanner\e[0m, \e[33msemgrep\e[0m"
+        puts "    Install: \e[33mosv-scanner\e[0m, \e[33mopengrep\e[0m"
         exit 1
       end
 
@@ -171,7 +171,7 @@ module ShieldAst
         puts "PDF report generated at: #{REPORT_PDF_FILE}"
       rescue StandardError => e
         puts "Error: Failed to generate PDF: #{e.message}"
-        puts "Error: Backtrace: #{e.backtrace.join("\n")}"
+        puts "Error: Backtrace: #{e.backtrace&.join("\n")}"
       end
     end
 
@@ -395,9 +395,9 @@ module ShieldAst
           report         Generates a report from the last scan in JSON or PDF format.
           help           Shows this help message.
         Options:
-          -s, --sast       Run Static Application Security Testing (SAST) with Semgrep.
+          -s, --sast       Run Static Application Security Testing (SAST) with Opengrep.
           -c, --sca        Run Software Composition Analysis (SCA) with OSV Scanner.
-          -i, --iac        Run Infrastructure as Code (IaC) analysis with Semgrep.
+          -i, --iac        Run Infrastructure as Code (IaC) analysis with Opengrep.
           -o, --output     Specify the output format for report (json or pdf, default: json).
           -h, --help       Show this help message.
           --version        Show the ast version.
@@ -413,14 +413,16 @@ module ShieldAst
     end
 
     def self.banner
-      yellow = "\e[33m"
+      gray = "\e[90m"
+      white = "\e[97m"
+      bold = "\e[1m"
       reset = "\e[0m"
-      version_string = "Shield AST - v#{ShieldAst::VERSION}"
-      line_length = 42
 
-      puts "#{yellow}┌" + "─" * line_length + "┐#{reset}"
-      puts "#{yellow}│#{reset} #{version_string.ljust(line_length - 1)}#{yellow}│#{reset}"
-      puts "#{yellow}└" + "─" * line_length + "┘#{reset}"
+      title = "Shield AST v#{ShieldAst::VERSION}"
+      line_char = "─"
+      line_segment = line_char * 10
+
+      puts "#{gray}#{line_segment}┤#{reset} #{bold}#{white}#{title}#{reset} #{gray}├#{line_segment}#{reset}"
       puts ""
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: shield_ast
 version: !ruby/object:Gem::Version
-  version: 1.3.1
+  version: 1.3.3
 platform: ruby
 authors:
 - Jose Augusto