@eurekadevsecops/radar 1.7.0 → 1.7.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eurekadevsecops/radar",
-  "version": "1.7.0",
+  "version": "1.7.2",
   "description": "Radar is an open-source orchestrator of security scanners.",
   "homepage": "https://www.eurekadevsecops.com/radar",
   "keywords": [

package/scanners/gitleaks/about.toml

@@ -2,4 +2,5 @@ name = "gitleaks"
 title = "Gitleaks"
 description = "Detect secrets like passwords, API keys, and tokens in source code."
 categories = [ "SAST" ]
+default = true
 cmd = "${assets}/run.sh ${target} ${assets} ${output}"

package/scanners/grype/about.toml

@@ -2,4 +2,5 @@ name = "grype"
 title = "Grype"
 description = "A vulnerability scanner for container images and filesystems."
 categories = [ "SCA" ]
+default = true
 cmd = "${assets}/run.sh ${target} ${assets} ${output}"

package/scanners/opengrep/about.toml

@@ -2,4 +2,5 @@ name = "opengrep"
 title = "Opengrep"
 description = "Ultra-fast static analysis tool."
 categories = [ "SAST" ]
+default = true
 cmd = "${assets}/run.sh ${target} ${assets} ${output}"

package/src/commands/scan.js

@@ -33,7 +33,8 @@ module.exports = {
     a file on disk.
 
     Select which scanners to use with the SCANNERS and CATEGORIES options. If
-    neither option is specified, all scanners are run.
+    neither option is specified, all default scanners are run. You can see which
+    scanners are marked as defaults with the 'radar scanners' command.
 
     If you want to run all scanners of a certain type, such as SAST, SCA, or DAST,
     use the CATEGORIES option. All scanners are classified into categories and
@@ -46,7 +47,7 @@ module.exports = {
     specific list of scanners, comma-separated, in the SCANNERS option. Scanner 
     names passed into the SCANNERS option should match the scanner names returned 
     by the "scanners" command. To select all scanners across selected categories,
-    use the value 'all' for SCANNERS. Defaults to 'all'.
+    use the value 'all' for SCANNERS.
 
     You can specify both SCANNERS and CATEGORIES at the same time. This will run
     only those scanners that match both options. For example, if you specify the
@@ -93,7 +94,7 @@ module.exports = {
     args.TARGET ??= process.cwd()
     args.FORMAT ??= 'security'
     args.CATEGORIES ??= 'all'
-    args.SCANNERS ??= 'all'
+    args.SCANNERS ??= ''
 
     // Normalize and/or rewrite args and options.
     args.TARGET = path.resolve(path.normalize(args.TARGET))
@@ -108,6 +109,9 @@ module.exports = {
       if (unknownScanners.length > 1) throw new Error(`Unknown scanners: ${unknownScanners.join(', ')}`)
       else if (unknownScanners.length === 1) throw new Error(`Unknown scanner: ${unknownScanners[0]}`)
     }
+    else {
+      args.SCANNERS = availableScanners.filter(s => s.default).map(s => s.name).join(',')
+    }
     if (args.ESCALATE) args.ESCALATE.split(',').map(severity => {
       if (args.FORMAT === 'security' && severity !== 'moderate' && severity !== 'low') throw new Error(`Severity to escalate must be 'moderate' or 'low'`)
       if (args.FORMAT === 'sarif' && severity !== 'warning' && severity !== 'note') throw new Error(`Severity to escalate must be 'warning' or 'note'`)

package/src/commands/scanners.js

@@ -9,7 +9,7 @@ module.exports = {
   run: async (toolbox, args) => {
     const { log, scanners } = toolbox
     for (const scanner of scanners) {
-      log(`${scanner.name}: ${scanner.title} [${scanner.categories.join()}] - ${scanner.description}`)
+      log(`${scanner.name}: ${scanner.title} [${scanner.categories.join()}] - ${scanner.default ? '(default) ' : ''}${scanner.description}`)
     }
   }
 }

package/src/util/sarif/transforms/normalize.js

@@ -5,14 +5,18 @@ module.exports = (sarif, dir, git, root) => {
 
     // Record the source repo location and the relative target subfolder within the repo.
     run.originalUriBaseIds = {
-     "SOURCE": {
-        "uri": git.repo.url.https,
-        "description": "Source origin for the target being scanned (ie. git repo URL)."
+     SOURCE: {
+        uri: git.repo.url.https,
+        description: {
+          text: "Source origin for the target being scanned (ie. git repo URL)."
+        }
      },
-      "TARGET": {
-        "uri": `${path.relative(root, dir)}`,
-        "uriBaseId": "SOURCE",
-        "description": "Scan target (subfolder) within the source repo or folder."
+      TARGET: {
+        uri: `${path.relative(root, dir)}`,
+        uriBaseId: "SOURCE",
+        description: {
+          text: "Scan target (subfolder) within the source repo or folder."
+        }
       }
     }