@comate/zulu 1.2.1-beta.2 → 1.3.0

package/comate-engine/assets/skills/code-security/scripts/parse_scan_result.py

@@ -0,0 +1,301 @@
+#!/usr/bin/env python3
+"""
+扫描结果解析与展示工具 - 解析 scan_result.json 文件，输出标准化漏洞报告。
+
+用法:
+    python3 parse_scan_result.py --scan-result <扫描结果文件路径> [--output-dir <输出目录>]
+
+输出:
+    1. 标准输出打印 Markdown 格式漏洞报告（供直接展示给用户）
+    2. 在输出目录生成 parsed_result.json，包含结构化漏洞数据（供后续修复脚本使用）
+
+parsed_result.json 格式:
+    {
+        "total": 10,
+        "common_count": 7,
+        "sensitive_count": 3,
+        "bundle_hash": "xxx",
+        "common_vuls": [ ... ],
+        "sensitive_vuls": [ ... ]
+    }
+
+每个漏洞条目包含:
+    {
+        "ruleID": "codescan_java_mybatis-java_sqli",
+        "name": "Sql 注入漏洞",
+        "description": "...",
+        "suggestion": "...",
+        "level": "ERROR",
+        "level_cn": "严重",
+        "file": "src/main/java/...",
+        "startLine": 12,
+        "endLine": 12,
+        "hash": "abc123...",
+        "is_sensitive": false,
+        "codeFlows": [ {"file": "...", "line": 63, "message": "..."}, ... ]
+    }
+"""
+
+import argparse
+from collections import OrderedDict
+import json
+import os
+import sys
+
+
+LEVEL_MAP = {
+    "ERROR": "严重",
+    "WARNING": "高危",
+    "NOTE": "中危",
+    "NONE": "低危",
+}
+
+# 等级排序优先级（越小越严重）
+LEVEL_PRIORITY = {
+    "ERROR": 0,
+    "WARNING": 1,
+    "NOTE": 2,
+    "NONE": 3,
+}
+
+
+def parse_scan_result(scan_result):
+    # type: (dict) -> dict
+    """解析扫描结果，返回结构化漏洞数据。"""
+    data = scan_result.get("data", {})
+    runs = data.get("sarif", {}).get("runs", []) or data.get("runs", [])
+
+    # 提取 bundleHash（由 scan_vulnerability.py 写入顶层）
+    bundle_hash = scan_result.get("bundleHash", "")
+
+    # 建立 ruleID -> rule 映射
+    rule_map = {}
+    for run in runs:
+        tool = run.get("tool", {})
+        # 兼容 rules 在 tool 或 tool.driver 下
+        rules = tool.get("rules", []) or tool.get("driver", {}).get("rules", [])
+        for rule in rules:
+            rule_id = rule.get("id", "")
+            if rule_id:
+                rule_map[rule_id] = rule
+
+    # 解析漏洞结果
+    common_vuls = []
+    sensitive_vuls = []
+
+    for run in runs:
+        results = run.get("results", []) or run.get("result", [])
+        for result in results:
+            rule_id = result.get("ruleID", "") or result.get("ruleId", "")
+            rule = rule_map.get(rule_id, {})
+
+            # 基础信息
+            name = rule.get("name", rule_id)
+            description = rule.get("description", "") or result.get("message", {}).get("text", "")
+            suggestion = rule.get("suggestion", "")
+            level_config = rule.get("defaultConfiguration", {})
+            level = level_config.get("level", "NONE") if level_config else "NONE"
+            level_cn = LEVEL_MAP.get(level, "低危")
+            vul_hash = result.get("properties", {}).get("hash", "")
+
+            # 位置信息
+            locations = result.get("locations", [])
+            file_uri = ""
+            start_line = 0
+            end_line = 0
+            if locations:
+                phys = locations[0].get("physicalLocation", {})
+                artifact = phys.get("artifactLocation", {})
+                file_uri = artifact.get("uri", "")
+                region = artifact.get("region", {})
+                start_line = region.get("startLine", 0)
+                end_line = region.get("endLine", start_line)
+
+            # 数据流信息
+            code_flows_raw = result.get("codeFlows", [])
+            code_flows = []
+            if code_flows_raw:
+                thread_flows = code_flows_raw[0].get("threadFlows", [])
+                if thread_flows:
+                    for loc_wrapper in thread_flows[0].get("locations", []):
+                        loc = loc_wrapper.get("location", {})
+                        loc_phys = loc.get("physicalLocation", {})
+                        loc_file = loc_phys.get("artifactLocation", {}).get("uri", "")
+                        loc_region = loc_phys.get("region", {})
+                        loc_line = loc_region.get("startLine", 0)
+                        loc_msg = loc.get("message", {}).get("text", "")
+                        code_flows.append({
+                            "file": loc_file,
+                            "line": loc_line,
+                            "message": loc_msg,
+                        })
+
+            is_sensitive = "sensitive" in rule_id.lower()
+
+            vul_entry = {
+                "ruleID": rule_id,
+                "name": name,
+                "description": description,
+                "suggestion": suggestion,
+                "level": level,
+                "level_cn": level_cn,
+                "file": file_uri,
+                "startLine": start_line,
+                "endLine": end_line,
+                "hash": vul_hash,
+                "is_sensitive": is_sensitive,
+                "codeFlows": code_flows,
+            }
+
+            if is_sensitive:
+                sensitive_vuls.append(vul_entry)
+            else:
+                common_vuls.append(vul_entry)
+
+    # 按严重程度排序
+    def sort_key(v):
+        return (LEVEL_PRIORITY.get(v["level"], 99), v["file"], v["startLine"])
+
+    common_vuls.sort(key=sort_key)
+    sensitive_vuls.sort(key=sort_key)
+
+    return {
+        "total": len(common_vuls) + len(sensitive_vuls),
+        "common_count": len(common_vuls),
+        "sensitive_count": len(sensitive_vuls),
+        "bundle_hash": bundle_hash,
+        "common_vuls": common_vuls,
+        "sensitive_vuls": sensitive_vuls,
+    }
+
+
+def _file_basename(file_path):
+    # type: (str) -> str
+    return os.path.basename(file_path) if file_path else ""
+
+
+def format_vul_report(vuls, title="漏洞报告"):
+    # type: (list, str) -> str
+    """将漏洞列表按类型分组格式化为 Markdown 报告。
+
+    同一 ruleID 的漏洞归为一组，描述/等级/修复建议只展示一次，
+    漏洞位置列表化展示，数据流用 <details> 折叠。
+    """
+    if not vuls:
+        return ""
+
+    # 按 ruleID 分组，保持原有排序
+    groups = OrderedDict()  # type: OrderedDict[str, list]
+    for vul in vuls:
+        rule_id = vul["ruleID"]
+        if rule_id not in groups:
+            groups[rule_id] = []
+        groups[rule_id].append(vul)
+
+    lines = ["**{}**\n".format(title)]
+
+    for group_idx, (rule_id, group_vuls) in enumerate(groups.items(), 1):
+        rep = group_vuls[0]  # 取第一个作为代表获取公共信息
+        count = len(group_vuls)
+        count_suffix = "（{} 处）".format(count) if count > 1 else ""
+
+        lines.append("{}. **{}**{}".format(group_idx, rep["name"], count_suffix))
+        if rep["description"]:
+            lines.append("- **漏洞描述**：{}".format(rep["description"]))
+        lines.append("- **漏洞等级**：{}".format(rep["level_cn"]))
+        if rep["suggestion"]:
+            lines.append("- **修复建议**：{}".format(rep["suggestion"]))
+
+        # 漏洞位置列表
+        lines.append("- **漏洞位置**：")
+        for vul in group_vuls:
+            fname = _file_basename(vul["file"])
+            loc_label = "{}:{}".format(fname, vul["startLine"]) if fname else "未知位置"
+            loc_link = "[{}]({}#L{})".format(loc_label, vul["file"], vul["startLine"]) if vul["file"] else loc_label
+            lines.append("    - {}".format(loc_link))
+
+            # 数据流折叠展示
+            if vul["codeFlows"]:
+                lines.append("      <details><summary>数据流</summary>\n")
+                for hop_idx, hop in enumerate(vul["codeFlows"], 1):
+                    hop_fname = _file_basename(hop["file"])
+                    hop_label = "{}:{}".format(hop_fname, hop["line"]) if hop_fname else "未知"
+                    hop_link = "[{}]({}#L{})".format(hop_label, hop["file"], hop["line"]) if hop["file"] else hop_label
+                    hop_msg = hop.get("message", "")
+                    if hop_msg:
+                        lines.append("      {}. {} — {}".format(hop_idx, hop_link, hop_msg))
+                    else:
+                        lines.append("      {}. {}".format(hop_idx, hop_link))
+                lines.append("\n      </details>")
+        lines.append("")
+
+    return "\n".join(lines)
+
+
+def format_full_report(parsed):
+    # type: (dict) -> str
+    """生成完整的展示报告（包含两类漏洞）。"""
+    parts = []
+
+    if parsed["common_count"] > 0 and parsed["sensitive_count"] > 0:
+        parts.append("扫描发现 **{}** 个普通漏洞和 **{}** 个硬编码漏洞。\n".format(
+            parsed["common_count"], parsed["sensitive_count"]))
+    elif parsed["common_count"] > 0:
+        parts.append("扫描发现 **{}** 个普通漏洞。\n".format(parsed["common_count"]))
+    elif parsed["sensitive_count"] > 0:
+        parts.append("扫描发现 **{}** 个硬编码漏洞。\n".format(parsed["sensitive_count"]))
+    else:
+        parts.append("扫描完成，未发现漏洞。\n")
+        return "\n".join(parts)
+
+    if parsed["common_vuls"]:
+        parts.append(format_vul_report(parsed["common_vuls"], "普通漏洞报告"))
+
+    if parsed["sensitive_vuls"]:
+        parts.append(format_vul_report(parsed["sensitive_vuls"], "硬编码漏洞报告"))
+
+    return "\n".join(parts)
+
+
+def main():
+    """
+    主函数入口，解析命令行参数并处理扫描结果
+
+    Args:
+        无（通过命令行参数 --scan-result 和 --output-dir 传入）
+
+    Returns:
+        无（结果直接输出到标准输出和文件）
+    """
+    parser = argparse.ArgumentParser(description="扫描结果解析与展示工具")
+    parser.add_argument("--scan-result", required=True, help="扫描结果文件路径 (scan_result.json)")
+    parser.add_argument("--output-dir", default=None, help="结构化结果输出目录，默认与输入文件同目录")
+    args = parser.parse_args()
+
+    # 读取扫描结果
+    try:
+        with open(args.scan_result, "r", encoding="utf-8") as f:
+            scan_result = json.load(f)
+    except Exception as e:
+        print("错误: 读取扫描结果失败 {}: {}".format(args.scan_result, e), file=sys.stderr)
+        sys.exit(1)
+
+    # 解析
+    parsed = parse_scan_result(scan_result)
+
+    # 输出 Markdown 报告到标准输出
+    report = format_full_report(parsed)
+    print(report)
+
+    # 保存结构化 JSON
+    # 默认输出到输入文件同目录，自然跟随项目隔离
+    output_dir = args.output_dir or os.path.dirname(os.path.abspath(args.scan_result))
+    os.makedirs(output_dir, exist_ok=True)
+    output_file = os.path.join(output_dir, "parsed_result.json")
+    with open(output_file, "w", encoding="utf-8") as f:
+        json.dump(parsed, f, ensure_ascii=False, indent=2)
+    print(output_file, file=sys.stderr)
+
+
+if __name__ == "__main__":
+    main()

package/comate-engine/assets/skills/code-security/scripts/repair_vulnerability.py

@@ -0,0 +1,261 @@
+#!/usr/bin/env python3
+"""
+漏洞修复工具 - 根据扫描结果修复指定文件的漏洞。
+
+用法:
+    python3 repair_vulnerability.py --root-path <项目目录> --username <用户名> --parsed-result <parsed_result.json路径>
+    python3 repair_vulnerability.py --root-path <项目目录> --username <用户名> --vulnerability-info '<漏洞信息JSON>'
+
+支持两种输入方式（二选一）:
+    --parsed-result: 直接传入 parsed_result.json 路径，脚本自动提取普通漏洞并构建修复信息
+    --vulnerability-info: 传入漏洞信息 JSON 字符串
+
+流程:
+    1. 解析漏洞信息，计算待修复文件的哈希
+    2. 调用修复接口
+    3. 如有缺失文件则上传后重试
+    4. 返回包含 diff_content 的修复结果
+"""
+
+import argparse
+import base64
+import hashlib
+import json
+import logging
+import os
+import sys
+import time
+import uuid
+from typing import Dict, List, Tuple
+
+import http_client  # noqa: F401 (triggers shared logging config)
+
+HOST = "https://comate-sec.baidu-int.com"
+
+USERNAME = ""
+USER_ID = ""
+
+logger = logging.getLogger("repair")
+
+
+def build_headers():
+    # type: () -> Dict[str, str]
+    return {
+        "Comate-Username": USERNAME,
+        "Comate-User-Id": USER_ID,
+        "SAST-Request-ID": str(uuid.uuid4()),
+    }
+
+
+def calc_sha256(file_path):
+    # type: (str) -> str
+    sha256_hash = hashlib.sha256()
+    with open(file_path, "rb") as f:
+        for chunk in iter(lambda: f.read(4096), b""):
+            sha256_hash.update(chunk)
+    return sha256_hash.hexdigest()
+
+
+def read_file_content(file_path):
+    # type: (str) -> str
+    """读取文件内容，二进制文件用 base64 编码。"""
+    try:
+        with open(file_path, "r", encoding="utf-8") as f:
+            return f.read()
+    except UnicodeDecodeError:
+        with open(file_path, "rb") as f:
+            return base64.b64encode(f.read()).decode("ascii")
+
+
+def diff_file_content(file_path, new_content):
+    # type: (str, str) -> str
+    """比较原文件与修复后内容，返回 {from_content, to_content} JSON。"""
+    with open(file_path, "r", encoding="utf-8") as f:
+        old_content = f.read()
+
+    old_lines = old_content.split("\n")
+    new_lines = new_content.split("\n")
+
+    from_parts = []  # type: List[str]
+    to_parts = []  # type: List[str]
+
+    oi, ni = 0, 0
+    while oi < len(old_lines) and ni < len(new_lines):
+        if old_lines[oi] == new_lines[ni]:
+            oi += 1
+            ni += 1
+        else:
+            from_parts.append(old_lines[oi] + "\n")
+            to_parts.append(new_lines[ni] + "\n")
+            oi += 1
+            ni += 1
+
+    while oi < len(old_lines):
+        from_parts.append(old_lines[oi] + "\n")
+        oi += 1
+
+    while ni < len(new_lines):
+        to_parts.append(new_lines[ni] + "\n")
+        ni += 1
+
+    return json.dumps(
+        {"from_content": "".join(from_parts), "to_content": "".join(to_parts)},
+        ensure_ascii=False,
+        indent=2,
+    )
+
+
+def upload_files_for_repair(root_path, missing_files):
+    # type: (str, List[str]) -> None
+    """上传修复过程中缺失的文件。"""
+    payload = {"files": {}}
+    for name in missing_files:
+        file_path = os.path.join(root_path, name)
+        try:
+            content = read_file_content(file_path)
+            file_hash = calc_sha256(file_path)
+            payload["files"][name] = {"hash": file_hash, "content": content}
+        except Exception as e:
+            print("警告: 读取文件失败 {}: {}".format(file_path, e), file=sys.stderr)
+
+    http_client.put("{}/api/v1/upload".format(HOST), headers=build_headers(), json_body=payload)
+
+
+def repair_vulnerability(root_path, vulnerability_info):
+    # type: (str, Dict) -> Dict
+    """执行漏洞修复，返回包含 diff 的修复结果。"""
+    # 计算待修复文件的哈希
+    for file_info in vulnerability_info.get("files", []):
+        file_path = os.path.join(root_path, file_info["name"])
+        if os.path.isfile(file_path):
+            file_info["hash"] = calc_sha256(file_path)
+
+    repair_type = vulnerability_info.get("type", 2)
+    file_count = len(vulnerability_info.get("files", []))
+    logger.info("repair start: type=%d, files=%d", repair_type, file_count)
+    api_url = "{}/api/v2/repair_file".format(HOST)
+    print("开始修复...", file=sys.stderr)
+
+    while True:
+        result = http_client.post(
+            api_url,
+            headers=build_headers(),
+            json_body=vulnerability_info,
+        )
+
+        # 如有缺失文件，先上传
+        missing = result.get("data", {}).get("missingFiles", [])
+        if missing:
+            print("上传缺失文件: {} 个".format(len(missing)), file=sys.stderr)
+            upload_files_for_repair(root_path, missing)
+            time.sleep(3)
+            continue
+
+        # status != 0 表示完成
+        if result.get("status") != 0:
+            # 生成 diff
+            files_data = result.get("data", {}).get("files", [])
+            for file_data in files_data:
+                repaired_content = file_data.get("repairedContent", "")
+                if repaired_content:
+                    file_path = os.path.join(root_path, file_data["name"])
+                    if os.path.isfile(file_path):
+                        diff_json = diff_file_content(file_path, repaired_content)
+                        file_data["diff_content"] = diff_json
+                    # 置空防止泄露完整源码
+                    file_data["repairedContent"] = ""
+            return result
+
+        print("修复中，等待结果...", file=sys.stderr)
+        time.sleep(3)
+
+
+def build_vulnerability_info(parsed):
+    # type: (dict) -> dict
+    """从 parsed_result.json 构建修复接口所需的 vulnerability-info。"""
+    bundle_hash = parsed.get("bundle_hash", "")
+    common_vuls = parsed.get("common_vuls", [])
+
+    file_map = {}  # type: dict
+    for vul in common_vuls:
+        fname = vul.get("file", "")
+        if not fname:
+            continue
+        if fname not in file_map:
+            file_map[fname] = {"name": fname, "vulList": []}
+        file_map[fname]["vulList"].append({
+            "ruleID": vul.get("ruleID", ""),
+            "line": vul.get("startLine", 0),
+            "hash": vul.get("hash", ""),
+        })
+
+    return {
+        "files": list(file_map.values()),
+        "type": 2,
+        "extra": {
+            "bundleHash": bundle_hash,
+        },
+    }
+
+
+def main():
+    global USERNAME, USER_ID
+    parser = argparse.ArgumentParser(description="代码安全漏洞修复工具")
+    parser.add_argument("--root-path", required=True, help="项目根目录")
+    parser.add_argument("--username", required=True, help="Comate 用户名")
+    parser.add_argument("--vulnerability-info", default=None, help="漏洞信息 JSON 字符串")
+    parser.add_argument("--parsed-result", default=None, 
+                        help="解析结果文件路径 (parsed_result.json)，与 --vulnerability-info 二选一")
+    parser.add_argument("--output-dir", default=None, help="结果输出目录，默认为 skill 临时目录")
+    args = parser.parse_args()
+
+    if not args.vulnerability_info and not args.parsed_result:
+        print("错误: 必须提供 --vulnerability-info 或 --parsed-result 之一", file=sys.stderr)
+        sys.exit(1)
+
+    USERNAME = args.username
+    USER_ID = hashlib.md5(USERNAME.encode("utf-8")).hexdigest()[:12]
+
+    logger.info("repair_vulnerability start: username=%s, root_path=%s", USERNAME, args.root_path)
+
+    root_path = os.path.realpath(args.root_path)
+    if not os.path.isdir(root_path):
+        print("错误: 目录不存在 {}".format(root_path), file=sys.stderr)
+        sys.exit(1)
+
+    # 默认输出到 skill 临时目录，按项目路径隔离子目录避免并发冲突
+    skill_dir = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+    project_name = os.path.basename(root_path)
+    path_hash = hashlib.md5(root_path.encode("utf-8")).hexdigest()[:8]
+    default_output = os.path.join(skill_dir, ".tmp", "{}_{}".format(project_name, path_hash))
+    output_dir = os.path.realpath(args.output_dir) if args.output_dir else default_output
+    os.makedirs(output_dir, exist_ok=True)
+
+    if args.parsed_result:
+        try:
+            with open(args.parsed_result, "r", encoding="utf-8") as f:
+                parsed = json.load(f)
+        except Exception as e:
+            print("错误: 读取解析结果失败 {}: {}".format(args.parsed_result, e), file=sys.stderr)
+            sys.exit(1)
+        if not parsed.get("common_vuls"):
+            print("无普通漏洞需要修复", file=sys.stderr)
+            sys.exit(0)
+        vulnerability_info = build_vulnerability_info(parsed)
+    else:
+        try:
+            vulnerability_info = json.loads(args.vulnerability_info)
+        except json.JSONDecodeError as e:
+            print("错误: 漏洞信息 JSON 解析失败: {}".format(e), file=sys.stderr)
+            sys.exit(1)
+
+    result = repair_vulnerability(root_path, vulnerability_info)
+
+    output_file = os.path.join(output_dir, "repair_result.json")
+    with open(output_file, "w", encoding="utf-8") as f:
+        json.dump(result, f, ensure_ascii=False, indent=2)
+    print(output_file)
+
+
+if __name__ == "__main__":
+    main()