@eurekadevsecops/radar 1.6.2 → 1.7.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eurekadevsecops/radar",
-  "version": "1.6.2",
+  "version": "1.7.1",
   "description": "Radar is an open-source orchestrator of security scanners.",
   "homepage": "https://www.eurekadevsecops.com/radar",
   "keywords": [

package/scanners/depscan/run.sh

@@ -4,4 +4,15 @@
 # $3 - Path to the output folder where scan results should be stored
 
 set -e
-docker run --rm -v $1:/app -v $2:/input -v $3:/output ghcr.io/eurekadevsecops/radar-depscan 2>&1
+
+trap cleanup TERM INT
+
+cleanup()
+{
+  PID=$(cat $3/depscan.cid)
+  docker stop $PID
+  rm $3/depscan.cid
+  exit 1
+}
+
+docker run --cidfile $3/depscan.cid --rm -v $1:/app -v $2:/input -v $3:/output ghcr.io/eurekadevsecops/radar-depscan 2>&1

package/scanners/gitleaks/run.sh

@@ -4,4 +4,15 @@
 # $3 - Path to the output folder where scan results should be stored
 
 set -e
-docker run --rm -v $1:/app -v $2:/input -v $3:/output zricethezav/gitleaks dir --exit-code 0 -f sarif -r /output/gitleaks.sarif /app 2>&1
+
+trap cleanup TERM INT
+
+cleanup()
+{
+  PID=$(cat $3/gitleaks.cid)
+  docker stop $PID
+  rm $3/gitleaks.cid
+  exit 1
+}
+
+docker run --cidfile $3/gitleaks.cid --rm -v $1:/app -v $2:/input -v $3:/output zricethezav/gitleaks dir --exit-code 0 -f sarif -r /output/gitleaks.sarif /app 2>&1

package/scanners/grype/run.sh

@@ -4,4 +4,15 @@
 # $3 - Path to the output folder where scan results should be stored
 
 set -e
-docker run --rm -v $1:/app -v $2:/input -v $3:/output ghcr.io/eurekadevsecops/radar-grype 2>&1
+
+trap cleanup TERM INT
+
+cleanup()
+{
+  PID=$(cat $3/grype.cid)
+  docker stop $PID
+  rm $3/grype.cid
+  exit 1
+}
+
+docker run --cidfile $3/grype.cid --rm -v $1:/app -v $2:/input -v $3:/output ghcr.io/eurekadevsecops/radar-grype 2>&1

package/scanners/opengrep/run.sh

@@ -4,4 +4,15 @@
 # $3 - Path to the output folder where scan results should be stored
 
 set -e
-docker run --rm -v $1:/app -v $2:/input -v $3:/output ghcr.io/eurekadevsecops/radar-opengrep 2>&1
+
+trap cleanup TERM INT
+
+cleanup()
+{
+  PID=$(cat $3/opengrep.cid)
+  docker stop $PID
+  rm $3/opengrep.cid
+  exit 1
+}
+
+docker run --cidfile $3/opengrep.cid --rm -v $1:/app -v $2:/input -v $3:/output ghcr.io/eurekadevsecops/radar-opengrep 2>&1

package/src/util/runner.js

@@ -11,16 +11,40 @@ const runAll = async ({ scanners, target, assets, outdir, quiet, log }) => {
   // Results will include the stdout log and the final combined SARIF object.
   const results = { log: '' }
 
-  // Run all scanners. This will produce one output SARIF file per scanner.
+  // Run all scanners (concurrently). This will produce one output SARIF file per scanner.
+  const jobs = []
+  const processes = []
   for (const scanner of scanners) {
-    results.log += await runScanner({ scanner, target, assets, outdir, quiet, log, display: {
+    jobs.push(runScanner(processes, { scanner, target, assets, outdir, quiet, log, display: {
       begin: () => scanner.name,
       progress: (label, duration) => `${scanner.name} [${humanize.duration(duration)}]`,
       success: (label) => label,
       error: (label) => label
-    }})
+    }}))
   }
 
+  // Wait for scanner runs to complete.
+  await Promise.all(jobs)
+    .then(async (result) => {
+      for (const job of jobs) {
+        results.log += await job
+      }
+    })
+    .catch((error) => {
+      // Early exit: If a job fails, kill all the other jobs. This ensures
+      // that the CLI doesn't hang waiting for all jobs to complete when
+      // we know already that the scan failed.
+      let exitCode = null
+      for (const p of processes) {
+        if (p.killed || p.exitCode !== null) {
+          exitCode = p.exitCode
+          continue
+        }
+        p.kill('SIGKILL')
+      }
+      if (exitCode) throw `Command exited with exit code ${exitCode}: ${error}`
+    })
+
   // Merge all output SARIF files into one and load it into a JS object.
   const consolidated = path.join(outdir, 'scan.sarif')
   await SARIF.transforms.merge(consolidated, scanners.map(s => path.join(outdir, `${s.name}.sarif`)))
@@ -29,7 +53,7 @@ const runAll = async ({ scanners, target, assets, outdir, quiet, log }) => {
   return results
 }
 
-const runScanner = async ({ scanner, target, assets, outdir, quiet, log, display }) => {
+const runScanner = async (processes, { scanner, target, assets, outdir, quiet, log, display }) => {
   let label = display.begin()
   const spinner = new Spinner()
   if (!quiet) spinner.start(label)
@@ -51,12 +75,19 @@ const runScanner = async ({ scanner, target, assets, outdir, quiet, log, display
     cmd = cmd.replaceAll('${output}', outdir)
     /* eslint-enable no-template-curly-in-string */
 
-    const { stdout } = await exec(cmd)
+    // Run the child process. Store the process information (like pid)
+    // in case we need to kill the process. Capture stdout log.
+    const promise = exec(cmd)
+    processes.push(promise.child)
+    const { stdout } = await promise
     runLog = stdout
 
     if (!quiet) spinner.success(display.success(label))
   } catch (error) {
-    if (!quiet) spinner.error(display.error(label))
+    // Display an error spinner, but if the child process
+    // was killed then don't display anything.
+    if (!quiet && !error.killed) spinner.error(display.error(label))
+    if (error.killed) spinner.stop()
 
     let message = `${error}`
     if (error.stdout) message += error.stdout

package/src/util/sarif/transforms/normalize.js

@@ -5,14 +5,18 @@ module.exports = (sarif, dir, git, root) => {
 
     // Record the source repo location and the relative target subfolder within the repo.
     run.originalUriBaseIds = {
-     "SOURCE": {
-        "uri": git.repo.url.https,
-        "description": "Source origin for the target being scanned (ie. git repo URL)."
+     SOURCE: {
+        uri: git.repo.url.https,
+        description: {
+          text: "Source origin for the target being scanned (ie. git repo URL)."
+        }
      },
-      "TARGET": {
-        "uri": `${path.relative(root, dir)}`,
-        "uriBaseId": "SOURCE",
-        "description": "Scan target (subfolder) within the source repo or folder."
+      TARGET: {
+        uri: `${path.relative(root, dir)}`,
+        uriBaseId: "SOURCE",
+        description: {
+          text: "Scan target (subfolder) within the source repo or folder."
+        }
       }
     }