trapline 0.1.1 → 0.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. checksums.yaml +4 -4
  2. data/lib/trapline/version.rb +1 -1
  3. metadata +47 -20
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 1aeb917336994882cf87d98ed316d3c9871fb9d8f6e6d50f8aa2e43d48c65d26
4
- data.tar.gz: e13692d03e5a92ed4bc5e5f83db9a80c9711ede23c16446f97314fc45ff762d4
3
+ metadata.gz: 7fdc8ed7dd098d60e8f4bfa89f9cf9df427c42a783cee43534888f7a9dd8b752
4
+ data.tar.gz: ed7d1ba3a99cf576e116ee476a0ee3d0b8ed31d0ba3405d8222f37b814713e8b
5
5
  SHA512:
6
- metadata.gz: a3039ee696861636c7c4a5da1c0200ba21402c69a988d734bac590816e13faab4cbb16f006ac7958fe5c046ed0b5ecaaaa52089fc5c3567d17f781fde7a162b3
7
- data.tar.gz: 6491205c985c206d645d091153f6028da743de58c303f0f3a4fbedaa90e03489fb8d350139cb5dcbc86100c0adf8b8674a7e1c44717674c19e7e7a636f843198
6
+ metadata.gz: b13b080b1d97c92f110d3ee32be22b77078646f92f99805aa198409b33922fefabf658b4c6e69005163e1630397135abb32a5b598f2fd805764f9b51fce82352
7
+ data.tar.gz: e91f788c8e736f70da61cfd6737f8f672743e83129a77ba3c2149af9acf9f74c7c00cade672f44d5b05e11ddae63b287b575c959095ce4c223ddbc7e72d15744
data/lib/trapline/version.rb CHANGED
@@ -1,5 +1,5 @@
1
1
  # frozen_string_literal: true
2
2
 
3
3
  module Trapline
4
- VERSION = "0.1.1"
4
+ VERSION = "0.1.3"
5
5
  end
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: trapline
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.1.1
4
+ version: 0.1.3
5
5
  platform: ruby
6
6
  authors:
7
7
  - Jose Augusto
@@ -45,25 +45,52 @@ dependencies:
45
45
  - !ruby/object:Gem::Version
46
46
  version: '13.0'
47
47
  description: |
48
- Trapline sets traps for vulnerable code: it takes you from a CVE to a tested
49
- opengrep/semgrep rule.
50
-
51
- The web editor validates the rule YAML as you type, runs it against test code
52
- and highlights each finding. You mark which lines must or must not match by
53
- clicking the margin or accepting results, and Trapline writes the ruleid/ok
54
- annotations for you, so the test file stays in the standard --test format
55
- that opengrep and semgrep read.
56
-
57
- Give it a CVE or GHSA id and it looks the advisory up in NVD and OSV, then
58
- drafts rules with test code: a template for the vulnerability class (CWE), a
59
- check for vulnerable runtime images (PHP, Python, Node.js, Ruby, Go, .NET) in
60
- Dockerfiles, Compose, Kubernetes, Helm and CI files, a rule that finds usage
61
- of the affected package, and a taint skeleton for 14 languages. Notes explain
62
- what was inferred and what still needs review.
63
-
64
- The CLI validates rules, runs their tests in CI and generates drafts. It runs
65
- standalone (trapline server), as a Rack app or mounted in Rails, with no
66
- runtime dependencies besides Ruby and the opengrep or semgrep binary.
48
+ Trapline is a web editor and CLI for writing and testing opengrep/semgrep
49
+ rules, plus a generator that turns a CVE into rule drafts with test code.
50
+ Test files stay in the standard --test format.
51
+
52
+ INSTALL
53
+
54
+ gem install trapline
55
+
56
+ Trapline needs an engine on your PATH, opengrep (recommended) or semgrep:
57
+
58
+ curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh | bash
59
+ pip install semgrep
60
+
61
+ The opengrep installer puts the binary in ~/.opengrep/cli/latest/. Add it to
62
+ your PATH or pass --engine-bin. Check the setup with:
63
+
64
+ trapline version
65
+
66
+ USAGE
67
+
68
+ Web editor (http://127.0.0.1:9292):
69
+
70
+ trapline server -r ./rules
71
+
72
+ Write the rule, paste vulnerable and fixed code, and click the margin to mark
73
+ the lines that must or must not match. Trapline writes the ruleid/ok
74
+ annotations and reruns as you type.
75
+
76
+ Rule drafts from a CVE or GHSA (looked up in NVD and OSV):
77
+
78
+ trapline cve CVE-2024-4577 # list the drafts
79
+ trapline cve CVE-2024-4577 --save --pick 2 -r ./rules
80
+
81
+ Validate and test rules (exits 1 on failure, for CI):
82
+
83
+ trapline validate --engine rules/*.yaml
84
+ trapline test -r ./rules
85
+ trapline run rules/my-rule.yaml app/models/user.rb
86
+
87
+ Rails: add gem "trapline" to the Gemfile, then
88
+
89
+ bin/rails generate trapline:install # editor at /trapline
90
+ bin/rails trapline:test
91
+
92
+ It also runs as a Rack app (run Trapline::Web::App.new in config.ru). No
93
+ runtime dependencies besides Ruby 3.3+ and the engine binary.
67
94
  email:
68
95
  - joseaugusto.881@outlook.com
69
96
  executables: