@eurekadevsecops/radar 1.0.0

package/README.md

@@ -0,0 +1,43 @@
+<pre>
+               _            
+ _ __ __ _  __| | __ _ _ __ 
+| '__/ _` |/ _` |/ _` | '__|
+| | | (_| | (_| | (_| | |   
+|_|  \__,_|\__,_|\__,_|_|
+</pre>
+
+# Introduction
+
+radarctl is a command-line interface for Radar, an open-source orchestrator of security scanners. Radar is part of the Eureka DevSecOps platform.
+
+## Installation
+
+## Using a Package Manager
+
+#### [NPM](https://npmjs.com) (macOS, Linux, WSL)
+
+```bash
+npm install -g radar
+```
+
+## Downloading from GitHub
+
+Download the appropriate version from the [Releases](https://github.com/eurekadevsecops/radarctl/releases) page of the `radarctl` GitHub repository.
+
+## Getting Started
+
+Get familiar with built-in radar help pages:
+
+```bash
+radar help
+```
+
+Run a scan on the source code in the current working directory:
+
+```bash
+radar scan
+```
+
+## Contributing guide
+
+See [CONTRIBUTING.md](./CONTRIBUTING.md)

package/cli.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+
+// require('dotenv').config()
+const path = require('node:path')
+const plugins = { scanners: require(path.join(__dirname, 'src', 'plugins', 'scanners')) }
+const cli = require(path.join(__dirname, 'src')).build({ plugins })
+
+// Check for updates (not in browsers).
+cli.checkForUpdates()
+
+// Export the configured CLI module.
+module.exports = cli
+
+// Run the command given on the command line.
+cli.run().then((exitCode) => { process.exitCode = exitCode ?? 0 })

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@eurekadevsecops/radar",
+  "version": "1.0.0",
+  "description": "Radar is an open-source orchestrator of security scanners.",
+  "homepage": "https://www.eurekadevsecops.com/radar",
+  "keywords": [
+    "eureka",
+    "devsecops",
+    "radar",
+    "security",
+    "scanner",
+    "asoc",
+    "aspm"
+  ],
+  "license": "GPL-3.0-only",
+  "author": "Sasa Djolic <s.djolic@eurekadevsecops.com> (https://www.linkedin.com/in/sasadjolic/)",
+  "type": "commonjs",
+  "main": "cli.js",
+  "scripts": {
+    "test": "standard"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/EurekaDevSecOps/radarctl.git"
+  },
+  "dependencies": {
+    "@persistr/clif": "^1.11.0",
+    "@persistr/clif-plugin-settings": "^2.3.1",
+    "humanize-duration": "^3.33.0",
+    "smol-toml": "^1.4.1",
+    "tiny-spinner": "^2.0.5"
+  },
+  "devDependencies": {
+    "standard": "*"
+  }
+}

package/scanners/depscan/run.sh

@@ -0,0 +1,8 @@
+# Parameters:
+# $1 - Path to the source code folder that should be scanned
+# $2 - Path to the assets folder
+# $3 - Path to the output folder where scan results should be stored
+
+set -e
+docker run --rm -v $1:/app -v $2:/input -v $3:/output ghcr.io/owasp-dep-scan/dep-scan depscan --src /app --reports-dir /output/depscan --report-name depscan.sarif --report-template /input/sarif.j2 2>&1
+cp $3/depscan/depscan.sarif $3/depscan.sarif

package/scanners/depscan/sarif.j2

@@ -0,0 +1,90 @@
+{
+  "version": "2.1.0",
+  "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
+  "runs": [
+    {
+      "tool": {
+        "driver": {
+          "name": "{{ metadata.tools.components[1].name }}",
+          "semanticVersion": "{{ metadata.tools.components[1].version }}",
+          "informationUri": "https://github.com/owasp-dep-scan/dep-scan",
+          "properties": {
+            "protocol_version": "v1.0.0",
+            "scanner_name": "{{ metadata.tools.components[1].name }}",
+            "scanner_version": "{{ metadata.tools.components[1].version }}",
+            "db": "https://github.com/AppThreat/vulnerability-db",
+            "scan_mode": "source"
+          },
+          "rules": [ {% for vuln in vulnerabilities %}{% set package = vuln['bom-ref'].split(':')[1] %}
+            {
+              "id": "{{ vuln['bom-ref'] }}",
+              "shortDescription": {
+                "text": "Vulnerable pkg: {{ package }}\nCVE: {{ vuln.id }}\nFix: {{ vuln.recommendation }}\n\n{% for prop in vuln.properties %}{{ prop.name }}: {{ prop.value }}\n{% endfor %}"
+              },
+              "fullDescription": {
+                "text": {{ vuln.description | tojson }}
+              },
+              "help": {
+                "text": "{{ vuln.recommendation }}"
+              },
+              "helpUri": "{% if vuln.source and vuln.source.url %}{{ vuln.source.url }}{% elif vuln.id and 'NPM-' in vuln.id %}https://osv.dev/vulnerability/{{ vuln.id.split('/')[0] }}{% else %}https://unknownhelpuri.com{% endif %}",
+              "properties": {
+                "tags": [
+                    {% for prop in vuln.properties %}{% if 'Used' in prop.value -%}
+                    "{{ 'Used' }}",
+                    {% endif -%}{% if 'Reachable' in prop.value -%}
+                    "{{ 'Reachable' }}",
+                    {% endif -%}{% if 'Confirmed' in prop.value -%}
+                    "{{ 'Confirmed' }}",
+                    {% endif -%}{% if 'Exploits' in prop.value -%}
+                    "{{ 'Exploits' }}",
+                    {% endif -%}{% if 'PoC' in prop.value -%}
+                    "{{ 'PoC' }}",                   
+                    {% endif -%}{% if 'true' in prop.value and 'prioritized' in prop.name -%}
+                    "{{ 'Prioritized' }}",
+                    {% endif -%}{% endfor %}{% if 'MAL-' in vuln.id -%}
+                    "{{ 'Malware' }}",
+                    {% endif -%}"{{ vuln['id'] }}"
+                ]
+              }
+            }{% if not loop.last %},{% endif %}
+            {% endfor %}
+          ]
+        }
+      },
+      "results": [ {% for vuln in vulnerabilities %}{% set package = vuln['bom-ref'].split(':')[1] %}
+        {
+          "ruleId": "{{ vuln['bom-ref'] }}",
+          "level": {% if vuln.ratings[0].severity in ['critical','high'] -%}
+                    "{{ 'error' }}",
+                    {% endif -%}{% if vuln.ratings[0].severity in ['medium'] -%}
+                    "{{ 'warning' }}",
+                    {% endif -%}{% if vuln.ratings[0].severity in ['low'] -%}
+                    "{{ 'note' }}",
+                    {% endif -%}
+          "message": {
+            "text": "Vulnerability {{ vuln.id }} in pkg {{ package }}"
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "lockfile",
+                  "uriBaseId": "%SRCROOT%"
+                },
+                "region": {
+                  "startLine": 1
+                }
+              },
+              "message": {
+                "text": "Vulnerability {{ vuln.id }} in pkg {{ package }}"
+              }
+            }
+          ]
+        }
+        {% if not loop.last %},{% endif %}
+        {% endfor %}
+      ]
+    }
+  ]
+}

package/scanners/gitleaks/run.sh

@@ -0,0 +1,7 @@
+# Parameters:
+# $1 - Path to the source code folder that should be scanned
+# $2 - Path to the assets folder
+# $3 - Path to the output folder where scan results should be stored
+
+set -e
+docker run --rm -v $1:/app -v $2:/input -v $3:/output zricethezav/gitleaks dir -f sarif -r /output/gitleaks.sarif /app 2>&1