@docupace/pipeline 1.0.121 → 1.0.122-connect.0

package/bin/xray.sh

@@ -1,253 +1,236 @@
 #!/usr/bin/env bash
-BASENAME="${BITBUCKET_REPO_SLUG}"
-SLACK_API="https://slack.com/api/chat.postMessage"
-INPUT_TABLE="xray.txt"
-INPUT_JSON="xray.json"
-
-# ------------------------------------------------
-# 1️⃣ Parse table to JSON (handle multi-line wrapping)
-# ------------------------------------------------
-
-awk '
-BEGIN {
-  print "["
-  in_vuln = 0
-}
-
-# Skip separator and header lines
-/^[┌├└]/ { next }
-/CVE.*SEVERITY.*DIRECT.*DEPENDENCY/ { next }
-
-# Process data rows
-/^│/ {
-  gsub(/^│ /, "")
-  gsub(/ *│ *$/, "")
-
-  n = split($0, fields, / *│ */)
-
-  # New vulnerability (has CVE in first column)
-  if (n >= 8 && fields[1] ~ /^CVE-/) {
-    # Output previous entry if exists
-    if (in_vuln) {
-      # Parse fixed versions
-      fixed_versions = "[]"
-      if (saved_fixed_raw != "") {
-        gsub(/\] *\[/, "][", saved_fixed_raw)
-        gsub(/\[/, "\"", saved_fixed_raw)
-        gsub(/\]/, "\"", saved_fixed_raw)
-        gsub(/"  *"/, "\", \"", saved_fixed_raw)
-        gsub(/""/, "\", \"", saved_fixed_raw)
-        fixed_versions = "[" saved_fixed_raw "]"
-      }
-
-      component_key = saved_type "://" saved_affected
-      direct_component = saved_type "://" saved_direct
-
-      print "    {"
-      print "      \"vulnerabilities\": [{"
-      print "        \"severity\": \"" saved_severity "\","
-      print "        \"cves\": [{\"cve\": \"" saved_cve "\"}],"
-      print "        \"components\": {"
-      print "          \"" component_key "\": {"
-      print "            \"impact_paths\": [[null, {\"component_id\": \"" direct_component "\"}]],"
-      print "            \"affected_version\": \"" saved_affected_ver "\","
-      print "            \"fixed_versions\": " fixed_versions
-      print "          }"
-      print "        }"
-      print "      }]"
-      print "    },"
-    }
+#
+# Posts Xray findings to Slack: a parent summary message and one thread reply
+# per finding (High and above, sorted Critical→High→Medium→Low).
+#
+# Reads simple-json files listed in /tmp/xray-report-args (written by the Xray
+# scan step), so it no longer depends on the fragile awk table parser.
+#
+# Required:
+#   XRAY_SLACK_TOKEN   — Slack bot token (xoxb-...)
+#   XRAY_SLACK_CHANNEL — channel ID or name, e.g. #security-alerts
+# Optional:
+#   XRAY_SLACK_MIN_SEVERITY  — lowest severity to thread (default: High)
+#                              Critical | High | Medium | Low
+#   XRAY_SLACK_NOTIFY_CLEAN  — set to "true" to post even when total=0
+#   BITBUCKET_REPO_SLUG, BITBUCKET_BUILD_NUMBER, BITBUCKET_BRANCH
+
+set -uo pipefail
 
-    in_vuln = 1
-
-    # Store new vulnerability
-    saved_cve = fields[1]
-    saved_severity = fields[2]
-    saved_direct = fields[3]
-
-    saved_affected = fields[5]
-    saved_affected_ver = fields[6]
-    saved_fixed_raw = fields[7]
-    saved_type = tolower(fields[8])
-  }
-  # Continuation line - append to previous field
-  else if (in_vuln && fields[1] == "" && fields[2] == "") {
-    if (fields[3] != "") {
-      saved_direct = saved_direct fields[3]
-    }
-    if (fields[5] != "") {
-      saved_affected = saved_affected fields[5]
-    }
-    if (fields[7] != "") {
-      saved_fixed_raw = saved_fixed_raw " " fields[7]
-    }
-  }
+SLACK_API="https://slack.com/api/chat.postMessage"
+BASENAME="${BITBUCKET_REPO_SLUG:-unknown}"
+MIN_SEV="${XRAY_SLACK_MIN_SEVERITY:-High}"
+REPORT_ARGS_FILE="${XRAY_REPORT_ARGS_FILE:-/tmp/xray-report-args}"
+
+# Map severity to a sort rank (lower = shown first).
+rank_of() {
+  case "$1" in
+    Critical) echo 0 ;;
+    High)     echo 1 ;;
+    Medium)   echo 2 ;;
+    Low)      echo 3 ;;
+    *)        echo 9 ;;
+  esac
 }
+MIN_RANK="$(rank_of "$MIN_SEV")"
 
-END {
-  if (in_vuln) {
-    # Output the last entry
-    fixed_versions = "[]"
-    if (saved_fixed_raw != "") {
-      gsub(/\] *\[/, "][", saved_fixed_raw)
-      gsub(/\[/, "\"", saved_fixed_raw)
-      gsub(/\]/, "\"", saved_fixed_raw)
-      gsub(/"  *"/, "\", \"", saved_fixed_raw)
-      gsub(/""/, "\", \"", saved_fixed_raw)
-      fixed_versions = "[" saved_fixed_raw "]"
-    }
+# ---------------------------------------------------------------------------
+# Collect findings from every simple-json file listed in the report-args file.
+# The step writes one "label:file" entry per completed scan.
+# ---------------------------------------------------------------------------
+TMP_JSONL="$(mktemp)"
+trap 'rm -f "$TMP_JSONL"' EXIT
 
-    component_key = saved_type "://" saved_affected
-    direct_component = saved_type "://" saved_direct
-
-    print "    {"
-    print "      \"vulnerabilities\": [{"
-    print "        \"severity\": \"" saved_severity "\","
-    print "        \"cves\": [{\"cve\": \"" saved_cve "\"}],"
-    print "        \"components\": {"
-    print "          \"" component_key "\": {"
-    print "            \"impact_paths\": [[null, {\"component_id\": \"" direct_component "\"}]],"
-    print "            \"affected_version\": \"" saved_affected_ver "\","
-    print "            \"fixed_versions\": " fixed_versions
-    print "          }"
-    print "        }"
-    print "      }]"
-    print "    }"
-  }
-  print "]"
-}
-' "$INPUT_TABLE" > "$INPUT_JSON"
-
-# Validate JSON
-if ! jq empty "$INPUT_JSON" 2>/dev/null; then
-  echo "❌ Failed to create valid JSON"
-  cat "$INPUT_JSON"
-  exit 1
+if [[ ! -s "$REPORT_ARGS_FILE" ]]; then
+  echo "No scan results file at ${REPORT_ARGS_FILE} — skipping Slack notification."
+  exit 0
 fi
 
-echo "✅ JSON created: $INPUT_JSON"
-
-# ------------------------------------------------
-# 2️⃣ Severity counts
-# ------------------------------------------------
-read CRITICAL HIGH MEDIUM LOW <<< $(
-jq -r '
-.[]
-| select(.vulnerabilities != null)
-| .vulnerabilities[]
-| .severity
-' "$INPUT_JSON" | awk '
-{ c[$1]++ }
-END {
-  print c["Critical"]+0, c["High"]+0, c["Medium"]+0, c["Low"]+0
-}'
-)
-
-echo "📊 Counts: Critical=$CRITICAL, High=$HIGH, Medium=$MEDIUM, Low=$LOW"
-
+while IFS= read -r arg; do
+  [[ -z "$arg" ]] && continue
+  scan_label="${arg%%:*}"
+  json_file="${arg#*:}"
+  if [[ ! -s "$json_file" ]] || ! jq empty "$json_file" >/dev/null 2>&1; then
+    echo "Skipping ${scan_label} (${json_file}): not produced or empty."
+    continue
+  fi
+
+  # Emit one JSONL record per finding. SCA rows have a package + CVEs; source-
+  # code rows (secrets, SAST, IaC) have a file path.
+  jq -c --arg scan "$scan_label" '
+    def sev: (.severity // "Unknown");
+
+    def sca_rows(rows; kind):
+      (rows // [])[] | {
+        scan:     $scan,
+        kind:     kind,
+        severity: sev,
+        rank:     (sev | if . == "Critical" then 0
+                         elif . == "High"   then 1
+                         elif . == "Medium" then 2
+                         elif . == "Low"    then 3
+                         else 9 end),
+        cve:      (((.cves // []) | map(.cve // empty) | first) // (.issueId // "N/A")),
+        cves_all: ((.cves // []) | map(.cve // empty)),
+        pkg:      ((.impactedPackageName // "N/A") + " " + (.impactedPackageVersion // "")),
+        fixed:    ((.fixedVersions // []) | join(", ")),
+        directs:  ((.components // []) | map(.name // empty) | unique | join(", ")),
+        path:     "",
+        line:     0
+      };
+
+    def code_rows(rows; kind):
+      (rows // [])[] | {
+        scan:     $scan,
+        kind:     kind,
+        severity: sev,
+        rank:     (sev | if . == "Critical" then 0
+                         elif . == "High"   then 1
+                         elif . == "Medium" then 2
+                         elif . == "Low"    then 3
+                         else 9 end),
+        cve:      (.ruleId // "N/A"),
+        cves_all: [],
+        pkg:      (.finding // .scannerShortDescription // "N/A"),
+        fixed:    "",
+        directs:  "",
+        path:     (.file // ""),
+        line:     (.startLine // 0)
+      };
+
+    [ sca_rows(.vulnerabilities;          "Vulnerability")
+    , sca_rows(.securityViolations;       "Security violation")
+    , sca_rows(.licensesViolations;       "License violation")
+    , sca_rows(.operationalRiskViolations;"Operational risk")
+    , code_rows(.secrets;                 "Secret")
+    , code_rows(.secretsViolations;       "Secret violation")
+    , code_rows(.sast;                    "SAST")
+    , code_rows(.sastViolations;          "SAST violation")
+    , code_rows(.iac;                     "IaC")
+    , code_rows(.iacViolations;           "IaC violation")
+    , code_rows(.maliciousCode;           "Malicious code")
+    ] | flatten | .[]
+  ' "$json_file" 2>/dev/null >> "$TMP_JSONL"
+done < "$REPORT_ARGS_FILE"
+
+# ---------------------------------------------------------------------------
+# Severity counts (all findings, not just the threaded subset).
+# ---------------------------------------------------------------------------
+count_sev() { jq -s --arg s "$1" '[.[]|select(.severity==$s)]|length' "$TMP_JSONL"; }
+CRITICAL=$(count_sev Critical)
+HIGH=$(count_sev High)
+MEDIUM=$(count_sev Medium)
+LOW=$(count_sev Low)
 TOTAL=$((CRITICAL + HIGH + MEDIUM + LOW))
-if [[ "$TOTAL" -eq 0 ]]; then
-  echo "✅ No vulnerabilities found, skipping Slack notification"
+
+echo "📊 Counts: Critical=${CRITICAL}, High=${HIGH}, Medium=${MEDIUM}, Low=${LOW}, Total=${TOTAL}"
+
+if [[ "$TOTAL" -eq 0 && "${XRAY_SLACK_NOTIFY_CLEAN:-false}" != "true" ]]; then
+  echo "✅ No vulnerabilities found, skipping Slack notification."
   exit 0
 fi
 
-# ------------------------------------------------
-# 3️⃣ Parent Slack message
-# ------------------------------------------------
-PARENT_PAYLOAD=$(jq -cn \
-  --arg channel "$XRAY_SLACK_CHANNEL" \
-  --arg project "$BASENAME" \
-  --argjson critical "$CRITICAL" \
+# ---------------------------------------------------------------------------
+# Parent summary message.
+# ---------------------------------------------------------------------------
+BUILD_LINK=""
+if [[ -n "${BITBUCKET_WORKSPACE:-}" && -n "${BITBUCKET_REPO_SLUG:-}" && -n "${BITBUCKET_BUILD_NUMBER:-}" ]]; then
+  BUILD_LINK="https://bitbucket.org/${BITBUCKET_WORKSPACE}/${BITBUCKET_REPO_SLUG}/pipelines/results/${BITBUCKET_BUILD_NUMBER}"
+fi
+BRANCH="${BITBUCKET_BRANCH:-}"
+
+PARENT_PAYLOAD="$(jq -cn \
+  --arg channel  "$XRAY_SLACK_CHANNEL" \
+  --arg project  "$BASENAME" \
+  --arg branch   "$BRANCH" \
+  --arg link     "$BUILD_LINK" \
+  --argjson crit "$CRITICAL" \
   --argjson high "$HIGH" \
-  --argjson medium "$MEDIUM" \
+  --argjson med  "$MEDIUM" \
+  --argjson low  "$LOW" \
   '{
     channel: $channel,
     blocks: [
-      { type: "header", text: { type: "plain_text", text: "🚨 Dependency Vulnerability Report" } },
-      { type: "section", text: { type: "mrkdwn", text: ("*Project:* " + $project) } },
-      { type: "section", text: { type: "mrkdwn", text: ("🔴 *Critical:* \($critical)    🔥 *High:* \($high)    🎃 *Medium:* \($medium)") } },
-      { type: "context", elements: [{ type: "mrkdwn", text: "Detailed findings are posted in the thread below 👇" }] },
+      { type: "header",
+        text: { type: "plain_text", text: "🚨 Xray Security Report" } },
+      { type: "section",
+        text: { type: "mrkdwn",
+          text: ("*Project:* " + $project
+                 + (if $branch != "" then ("  |  *Branch:* " + $branch) else "" end)) } },
+      { type: "section",
+        text: { type: "mrkdwn",
+          text: ("🔴 *Critical:* \($crit)    🔥 *High:* \($high)    🎃 *Medium:* \($med)    👻 *Low:* \($low)") } },
+      { type: "context",
+        elements: [{ type: "mrkdwn",
+          text: (if $link != ""
+                 then ("Detailed findings are in the thread below 👇  •  <" + $link + "|Pipeline run>")
+                 else "Detailed findings are in the thread below 👇"
+                 end) }] },
       { type: "divider" }
     ]
-  }')
+  }')"
 
-PARENT_RESPONSE=$(printf '%s' "$PARENT_PAYLOAD" | curl -s -X POST "$SLACK_API" \
+PARENT_RESPONSE="$(printf '%s' "$PARENT_PAYLOAD" | curl -s -X POST "$SLACK_API" \
   -H "Authorization: Bearer $XRAY_SLACK_TOKEN" \
   -H "Content-Type: application/json" \
-  --data @-)
+  --data @-)"
 
-THREAD_TS=$(echo "$PARENT_RESPONSE" | jq -r '.ts')
+THREAD_TS="$(printf '%s' "$PARENT_RESPONSE" | jq -r '.ts')"
 
 if [[ -z "$THREAD_TS" || "$THREAD_TS" == "null" ]]; then
-  echo "❌ Failed to create parent message"
-  echo "$PARENT_RESPONSE"
+  echo "❌ Failed to create parent Slack message:"
+  printf '%s\n' "$PARENT_RESPONSE" | head -5
   exit 1
 fi
 
-echo "✅ Parent message created. thread_ts=$THREAD_TS"
-
-# ------------------------------------------------
-# 4️⃣ Thread entries (sorted, CVE links)
-# ------------------------------------------------
-jq -r '
-def rank:
-  if . == "Critical" then 0
-  elif . == "High"   then 1
-  elif . == "Medium" then 2
-  elif . == "Low"    then 3
-  else 9 end;
-
-[
-  .[]
-  | select(.vulnerabilities != null)
-  | .vulnerabilities[]
-  | . as $v
-  | ($v.components | to_entries[]) as $comp
-  | ($v.cves // [{cve:"N/A"}])[]
-  | {
-      sev: $v.severity,
-      r: ($v.severity | rank),
-      text: "*<https://nvd.nist.gov/vuln/detail/\(.cve)|\(.cve)>*\n*Impacted:* `\(
-        $comp.key | sub("^[a-z]+://"; "")
-      )` v\(
-        $comp.value.affected_version // "N/A"
-      )\n*Fixed in:* \(
-        ($comp.value.fixed_versions // [])
-        | join(", ")
-        | if . == "" then "N/A" else . end
-      )\n*Direct dependencies:*\n• \(
-        $comp.value.impact_paths[0][1].component_id
-        | sub("^[a-z]+://"; "")
-      )"
-    }
-]
-| sort_by(.r)
-| .[]
-| [.sev, .text]
-| @tsv
-' "$INPUT_JSON" |
-while IFS=$'\t' read -r SEV TEXT; do
-
-  EMOJI="👻"
-  [[ "$SEV" == "Critical" ]] && EMOJI="🔴"
-  [[ "$SEV" == "High"     ]] && EMOJI="🔥"
-  [[ "$SEV" == "Medium"   ]] && EMOJI="🎃"
-
-  jq -cn \
-    --arg channel "$XRAY_SLACK_CHANNEL" \
-    --arg ts "$THREAD_TS" \
-    --arg body "$EMOJI *$SEV*\n$TEXT" \
-    '{
-      channel: $channel,
+echo "✅ Parent message created. thread_ts=${THREAD_TS}"
+
+# ---------------------------------------------------------------------------
+# Thread entries: one per finding at or above MIN_SEV, sorted by severity.
+# ---------------------------------------------------------------------------
+POSTED=0
+while IFS= read -r finding; do
+  [[ -z "$finding" ]] && continue
+
+  rank="$(printf '%s' "$finding" | jq -r '.rank')"
+  [[ "$rank" -gt "$MIN_RANK" ]] && continue
+
+  payload="$(printf '%s' "$finding" | jq -c \
+    --arg channel  "$XRAY_SLACK_CHANNEL" \
+    --arg ts       "$THREAD_TS" '
+    (if .severity == "Critical" then "🔴"
+     elif .severity == "High"   then "🔥"
+     elif .severity == "Medium" then "🎃"
+     else "👻" end) as $emoji |
+    # Link CVE IDs to NVD; fall back to plain text for rule IDs and non-CVE ids.
+    (if (.cves_all | length) > 0
+     then (.cves_all | map("<https://nvd.nist.gov/vuln/detail/\(.)|\(.)>") | join(", "))
+     else (.cve | if test("^CVE-") then "<https://nvd.nist.gov/vuln/detail/\(.)|\(.)>" else . end)
+     end) as $id_text |
+    ($emoji + " *" + .severity + "* — " + .scan + " (" + .kind + ")"
+     + "\n*ID:* " + $id_text
+     + "\n*Component:* `" + .pkg + "`"
+     + (if .fixed   != "" then "\n*Fixed in:* " + .fixed else "" end)
+     + (if .directs != "" then "\n*Via:* " + .directs   else "" end)
+     + (if .path    != "" then "\n*File:* `" + .path + (if .line > 0 then ":" + (.line|tostring) else "" end) + "`" else "" end)
+    ) as $body |
+    {
+      channel:   $channel,
       thread_ts: $ts,
       blocks: [{ type: "section", text: { type: "mrkdwn", text: $body } }]
-    }' | curl -s -X POST "$SLACK_API" \
-      -H "Authorization: Bearer $XRAY_SLACK_TOKEN" \
-      -H "Content-Type: application/json" \
-      --data @- > /dev/null
+    }
+  ')"
+
+  [[ -z "$payload" ]] && continue
+
+  printf '%s' "$payload" | curl -s -X POST "$SLACK_API" \
+    -H "Authorization: Bearer $XRAY_SLACK_TOKEN" \
+    -H "Content-Type: application/json" \
+    --data @- > /dev/null
 
+  POSTED=$((POSTED + 1))
   sleep 0.1
 
-done
+done < <(jq -s -c 'sort_by(.rank) | .[]' "$TMP_JSONL")
 
-echo "✅ All vulnerabilities posted to thread"
+echo "✅ Posted ${POSTED} finding(s) to thread."