@eurekadevsecops/radar 1.6.1 → 1.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eurekadevsecops/radar",
-  "version": "1.6.1",
+  "version": "1.7.0",
   "description": "Radar is an open-source orchestrator of security scanners.",
   "homepage": "https://www.eurekadevsecops.com/radar",
   "keywords": [

package/scanners/depscan/run.sh

@@ -4,4 +4,15 @@
 # $3 - Path to the output folder where scan results should be stored
 
 set -e
-docker run --rm -v $1:/app -v $2:/input -v $3:/output ghcr.io/eurekadevsecops/radar-depscan 2>&1
+
+trap cleanup TERM INT
+
+cleanup()
+{
+  PID=$(cat $3/depscan.cid)
+  docker stop $PID
+  rm $3/depscan.cid
+  exit 1
+}
+
+docker run --cidfile $3/depscan.cid --rm -v $1:/app -v $2:/input -v $3:/output ghcr.io/eurekadevsecops/radar-depscan 2>&1

package/scanners/gitleaks/run.sh

@@ -4,4 +4,15 @@
 # $3 - Path to the output folder where scan results should be stored
 
 set -e
-docker run --rm -v $1:/app -v $2:/input -v $3:/output zricethezav/gitleaks dir --exit-code 0 -f sarif -r /output/gitleaks.sarif /app 2>&1
+
+trap cleanup TERM INT
+
+cleanup()
+{
+  PID=$(cat $3/gitleaks.cid)
+  docker stop $PID
+  rm $3/gitleaks.cid
+  exit 1
+}
+
+docker run --cidfile $3/gitleaks.cid --rm -v $1:/app -v $2:/input -v $3:/output zricethezav/gitleaks dir --exit-code 0 -f sarif -r /output/gitleaks.sarif /app 2>&1

package/scanners/grype/run.sh

@@ -4,4 +4,15 @@
 # $3 - Path to the output folder where scan results should be stored
 
 set -e
-docker run --rm -v $1:/app -v $2:/input -v $3:/output ghcr.io/eurekadevsecops/radar-grype 2>&1
+
+trap cleanup TERM INT
+
+cleanup()
+{
+  PID=$(cat $3/grype.cid)
+  docker stop $PID
+  rm $3/grype.cid
+  exit 1
+}
+
+docker run --cidfile $3/grype.cid --rm -v $1:/app -v $2:/input -v $3:/output ghcr.io/eurekadevsecops/radar-grype 2>&1

package/scanners/opengrep/run.sh

@@ -4,4 +4,15 @@
 # $3 - Path to the output folder where scan results should be stored
 
 set -e
-docker run --rm -v $1:/app -v $2:/input -v $3:/output ghcr.io/eurekadevsecops/radar-opengrep 2>&1
+
+trap cleanup TERM INT
+
+cleanup()
+{
+  PID=$(cat $3/opengrep.cid)
+  docker stop $PID
+  rm $3/opengrep.cid
+  exit 1
+}
+
+docker run --cidfile $3/opengrep.cid --rm -v $1:/app -v $2:/input -v $3:/output ghcr.io/eurekadevsecops/radar-opengrep 2>&1

package/src/commands/scan.js

@@ -150,8 +150,8 @@ module.exports = {
     }
 
     // Send telemetry: git metadata.
+    const metadata = git.metadata(target)
     if (telemetry.enabled && scanID) {
-      const metadata = git.metadata(target)
       await telemetry.send(`scans/:scanID/metadata`, { scanID }, { metadata })
       await telemetry.sendSensitive(`scans/:scanID/metadata`, { scanID }, { metadata })
     }
@@ -173,7 +173,7 @@ module.exports = {
 
     // Transform scan findings: treat warnings and notes as errors, and normalize location paths.
     if (escalations) results.sarif = SARIF.transforms.escalate(results.sarif, escalations)
-    SARIF.transforms.normalize(results.sarif, target)
+    SARIF.transforms.normalize(results.sarif, target, metadata, git.root(target))
 
     // Write findings to the destination SARIF file.
     if (outfile) fs.writeFileSync(outfile, JSON.stringify(results.sarif))

package/src/util/git/index.js

@@ -84,6 +84,23 @@ git rev-list --abbrev=4 --abbrev-commit --all | \
   }
 }
 
+function root(folder) {
+  try {
+    // Get the full OS path to the root of the repo.
+    const root = execSync('git rev-parse --show-toplevel', { cwd: folder }).toString().trim()
+    return root
+  } catch (error) {
+    return {
+      type: 'error',
+      error: {
+        code: 'E_GIT_METADATA',
+        details: error
+      }
+    }
+  }
+}
+
 module.exports = {
-  metadata
+  metadata,
+  root
 }

package/src/util/runner.js

@@ -11,16 +11,40 @@ const runAll = async ({ scanners, target, assets, outdir, quiet, log }) => {
   // Results will include the stdout log and the final combined SARIF object.
   const results = { log: '' }
 
-  // Run all scanners. This will produce one output SARIF file per scanner.
+  // Run all scanners (concurrently). This will produce one output SARIF file per scanner.
+  const jobs = []
+  const processes = []
   for (const scanner of scanners) {
-    results.log += await runScanner({ scanner, target, assets, outdir, quiet, log, display: {
+    jobs.push(runScanner(processes, { scanner, target, assets, outdir, quiet, log, display: {
       begin: () => scanner.name,
       progress: (label, duration) => `${scanner.name} [${humanize.duration(duration)}]`,
       success: (label) => label,
       error: (label) => label
-    }})
+    }}))
   }
 
+  // Wait for scanner runs to complete.
+  await Promise.all(jobs)
+    .then(async (result) => {
+      for (const job of jobs) {
+        results.log += await job
+      }
+    })
+    .catch((error) => {
+      // Early exit: If a job fails, kill all the other jobs. This ensures
+      // that the CLI doesn't hang waiting for all jobs to complete when
+      // we know already that the scan failed.
+      let exitCode = null
+      for (const p of processes) {
+        if (p.killed || p.exitCode !== null) {
+          exitCode = p.exitCode
+          continue
+        }
+        p.kill('SIGKILL')
+      }
+      if (exitCode) throw `Command exited with exit code ${exitCode}: ${error}`
+    })
+
   // Merge all output SARIF files into one and load it into a JS object.
   const consolidated = path.join(outdir, 'scan.sarif')
   await SARIF.transforms.merge(consolidated, scanners.map(s => path.join(outdir, `${s.name}.sarif`)))
@@ -29,7 +53,7 @@ const runAll = async ({ scanners, target, assets, outdir, quiet, log }) => {
   return results
 }
 
-const runScanner = async ({ scanner, target, assets, outdir, quiet, log, display }) => {
+const runScanner = async (processes, { scanner, target, assets, outdir, quiet, log, display }) => {
   let label = display.begin()
   const spinner = new Spinner()
   if (!quiet) spinner.start(label)
@@ -51,12 +75,19 @@ const runScanner = async ({ scanner, target, assets, outdir, quiet, log, display
     cmd = cmd.replaceAll('${output}', outdir)
     /* eslint-enable no-template-curly-in-string */
 
-    const { stdout } = await exec(cmd)
+    // Run the child process. Store the process information (like pid)
+    // in case we need to kill the process. Capture stdout log.
+    const promise = exec(cmd)
+    processes.push(promise.child)
+    const { stdout } = await promise
     runLog = stdout
 
     if (!quiet) spinner.success(display.success(label))
   } catch (error) {
-    if (!quiet) spinner.error(display.error(label))
+    // Display an error spinner, but if the child process
+    // was killed then don't display anything.
+    if (!quiet && !error.killed) spinner.error(display.error(label))
+    if (error.killed) spinner.stop()
 
     let message = `${error}`
     if (error.stdout) message += error.stdout

package/src/util/sarif/transforms/normalize.js

@@ -1,21 +1,33 @@
 const path = require('node:path')
-module.exports = (sarif, dir) => {
+module.exports = (sarif, dir, git, root) => {
   // Normalize findings.
   for (const run of sarif.runs) {
-    if (!run.results) continue
-    for (const result of run.results) {
 
-      // Find paths in the finding description and make them relative to the scan directory.
-      if (result?.message?.text) result.message.text = result.message.text.replace('/app/', '')
+    // Record the source repo location and the relative target subfolder within the repo.
+    run.originalUriBaseIds = {
+     "SOURCE": {
+        "uri": git.repo.url.https,
+        "description": "Source origin for the target being scanned (ie. git repo URL)."
+     },
+      "TARGET": {
+        "uri": `${path.relative(root, dir)}`,
+        "uriBaseId": "SOURCE",
+        "description": "Scan target (subfolder) within the source repo or folder."
+      }
+    }
 
-      // Make all physical locations for the result relative to the scan directory.
+    // Make all physical locations for the result relative to the scan directory.
+    if (!run.results) continue
+    for (const result of run.results) {
       for (const location of result.locations) {
         if (location.physicalLocation?.artifactLocation?.uri?.startsWith('/app')) {
           let file = path.relative('/app', location.physicalLocation.artifactLocation.uri)
+          if (result?.message?.text) result.message.text = result.message.text.replace(location.physicalLocation.artifactLocation.uri, file)
           location.physicalLocation.artifactLocation.uri = file
         }
         else if (location.physicalLocation?.artifactLocation?.uri?.startsWith('/')) {
           let file = path.relative('/', location.physicalLocation.artifactLocation.uri)
+          if (result?.message?.text) result.message.text = result.message.text.replace(location.physicalLocation.artifactLocation.uri, file)
           location.physicalLocation.artifactLocation.uri = file
         }
       }