@paretools/security 0.8.5 → 0.9.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/tools/gitleaks.d.ts.map +1 -1
- package/dist/tools/gitleaks.js +84 -2
- package/dist/tools/gitleaks.js.map +1 -1
- package/dist/tools/semgrep.d.ts.map +1 -1
- package/dist/tools/semgrep.js +91 -9
- package/dist/tools/semgrep.js.map +1 -1
- package/dist/tools/trivy.d.ts.map +1 -1
- package/dist/tools/trivy.js +93 -5
- package/dist/tools/trivy.js.map +1 -1
- package/package.json +2 -2
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"gitleaks.d.ts","sourceRoot":"","sources":["../../src/tools/gitleaks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;
|
|
1
|
+
{"version":3,"file":"gitleaks.d.ts","sourceRoot":"","sources":["../../src/tools/gitleaks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAgBzE,6DAA6D;AAC7D,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,QA+KrD"}
|
package/dist/tools/gitleaks.js
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { z } from "zod";
|
|
2
|
-
import { compactDualOutput, run, INPUT_LIMITS, assertAllowedRoot } from "@paretools/shared";
|
|
2
|
+
import { compactDualOutput, run, INPUT_LIMITS, assertAllowedRoot, assertNoFlagInjection, } from "@paretools/shared";
|
|
3
3
|
import { parseGitleaksJson } from "../lib/parsers.js";
|
|
4
4
|
import { formatGitleaksScan, compactGitleaksScanMap, formatGitleaksScanCompact, } from "../lib/formatters.js";
|
|
5
5
|
import { GitleaksScanResultSchema } from "../schemas/index.js";
|
|
@@ -14,6 +14,32 @@ export function registerGitleaksTool(server) {
|
|
|
14
14
|
.max(INPUT_LIMITS.PATH_MAX)
|
|
15
15
|
.optional()
|
|
16
16
|
.describe("Repository path to scan (default: cwd)"),
|
|
17
|
+
redact: z
|
|
18
|
+
.boolean()
|
|
19
|
+
.optional()
|
|
20
|
+
.default(true)
|
|
21
|
+
.describe("Redact raw secrets in output (--redact). Defaults to true to prevent secret leakage to LLM context."),
|
|
22
|
+
config: z
|
|
23
|
+
.string()
|
|
24
|
+
.max(INPUT_LIMITS.PATH_MAX)
|
|
25
|
+
.optional()
|
|
26
|
+
.describe("Path to custom gitleaks rule file (--config)"),
|
|
27
|
+
baselinePath: z
|
|
28
|
+
.string()
|
|
29
|
+
.max(INPUT_LIMITS.PATH_MAX)
|
|
30
|
+
.optional()
|
|
31
|
+
.describe("Path to baseline report for differential scanning (--baseline-path)"),
|
|
32
|
+
logOpts: z
|
|
33
|
+
.string()
|
|
34
|
+
.max(INPUT_LIMITS.STRING_MAX)
|
|
35
|
+
.optional()
|
|
36
|
+
.describe("Git log options for scanning specific commit ranges/time windows (--log-opts, e.g., '--since=2024-01-01')"),
|
|
37
|
+
enableRule: z
|
|
38
|
+
.array(z.string().max(INPUT_LIMITS.SHORT_STRING_MAX))
|
|
39
|
+
.max(INPUT_LIMITS.ARRAY_MAX)
|
|
40
|
+
.optional()
|
|
41
|
+
.default([])
|
|
42
|
+
.describe("Enable specific rules by ID (--enable-rule, e.g., ['aws-access-key'])"),
|
|
17
43
|
noGit: z
|
|
18
44
|
.boolean()
|
|
19
45
|
.optional()
|
|
@@ -24,6 +50,23 @@ export function registerGitleaksTool(server) {
|
|
|
24
50
|
.optional()
|
|
25
51
|
.default(false)
|
|
26
52
|
.describe("Enable verbose output from gitleaks"),
|
|
53
|
+
followSymlinks: z
|
|
54
|
+
.boolean()
|
|
55
|
+
.optional()
|
|
56
|
+
.describe("Follow symbolic links during scan (--follow-symlinks)"),
|
|
57
|
+
maxTargetMegabytes: z
|
|
58
|
+
.number()
|
|
59
|
+
.optional()
|
|
60
|
+
.describe("Skip files larger than this size in MB (--max-target-megabytes)"),
|
|
61
|
+
logLevel: z
|
|
62
|
+
.string()
|
|
63
|
+
.max(INPUT_LIMITS.SHORT_STRING_MAX)
|
|
64
|
+
.optional()
|
|
65
|
+
.describe("Log level for gitleaks output (--log-level, e.g. 'debug', 'info', 'warn', 'error')"),
|
|
66
|
+
exitCode: z
|
|
67
|
+
.number()
|
|
68
|
+
.optional()
|
|
69
|
+
.describe("Exit code when findings are detected (--exit-code)"),
|
|
27
70
|
compact: z
|
|
28
71
|
.boolean()
|
|
29
72
|
.optional()
|
|
@@ -31,16 +74,55 @@ export function registerGitleaksTool(server) {
|
|
|
31
74
|
.describe("Auto-compact when structured output exceeds raw CLI tokens. Set false to always get full schema."),
|
|
32
75
|
},
|
|
33
76
|
outputSchema: GitleaksScanResultSchema,
|
|
34
|
-
}, async ({ path, noGit, verbose, compact }) => {
|
|
77
|
+
}, async ({ path, redact, config, baselinePath, logOpts, enableRule, noGit, verbose, followSymlinks, maxTargetMegabytes, logLevel, exitCode, compact, }) => {
|
|
78
|
+
if (config)
|
|
79
|
+
assertNoFlagInjection(config, "config");
|
|
80
|
+
if (baselinePath)
|
|
81
|
+
assertNoFlagInjection(baselinePath, "baselinePath");
|
|
82
|
+
if (logOpts)
|
|
83
|
+
assertNoFlagInjection(logOpts, "logOpts");
|
|
84
|
+
if (logLevel)
|
|
85
|
+
assertNoFlagInjection(logLevel, "logLevel");
|
|
86
|
+
for (const r of enableRule ?? []) {
|
|
87
|
+
assertNoFlagInjection(r, "enableRule");
|
|
88
|
+
}
|
|
35
89
|
const cwd = path || process.cwd();
|
|
36
90
|
assertAllowedRoot(cwd, "security");
|
|
37
91
|
const args = ["detect", "--report-format", "json", "--report-path", "/dev/stdout"];
|
|
92
|
+
// Default to redacting secrets to prevent leakage
|
|
93
|
+
if (redact !== false) {
|
|
94
|
+
args.push("--redact");
|
|
95
|
+
}
|
|
96
|
+
if (config) {
|
|
97
|
+
args.push("--config", config);
|
|
98
|
+
}
|
|
99
|
+
if (baselinePath) {
|
|
100
|
+
args.push("--baseline-path", baselinePath);
|
|
101
|
+
}
|
|
102
|
+
if (logOpts) {
|
|
103
|
+
args.push("--log-opts", logOpts);
|
|
104
|
+
}
|
|
105
|
+
for (const r of enableRule ?? []) {
|
|
106
|
+
args.push("--enable-rule", r);
|
|
107
|
+
}
|
|
38
108
|
if (noGit) {
|
|
39
109
|
args.push("--no-git");
|
|
40
110
|
}
|
|
41
111
|
if (verbose) {
|
|
42
112
|
args.push("--verbose");
|
|
43
113
|
}
|
|
114
|
+
if (followSymlinks) {
|
|
115
|
+
args.push("--follow-symlinks");
|
|
116
|
+
}
|
|
117
|
+
if (maxTargetMegabytes !== undefined) {
|
|
118
|
+
args.push("--max-target-megabytes", String(maxTargetMegabytes));
|
|
119
|
+
}
|
|
120
|
+
if (logLevel) {
|
|
121
|
+
args.push("--log-level", logLevel);
|
|
122
|
+
}
|
|
123
|
+
if (exitCode !== undefined) {
|
|
124
|
+
args.push("--exit-code", String(exitCode));
|
|
125
|
+
}
|
|
44
126
|
args.push("--source", cwd);
|
|
45
127
|
// gitleaks exits with code 1 when findings are detected, which is not an error
|
|
46
128
|
const result = await run("gitleaks", args, { cwd, timeout: 300_000 });
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"gitleaks.js","sourceRoot":"","sources":["../../src/tools/gitleaks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,
|
|
1
|
+
{"version":3,"file":"gitleaks.js","sourceRoot":"","sources":["../../src/tools/gitleaks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iBAAiB,EACjB,GAAG,EACH,YAAY,EACZ,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,6DAA6D;AAC7D,MAAM,UAAU,oBAAoB,CAAC,MAAiB;IACpD,MAAM,CAAC,YAAY,CACjB,UAAU,EACV;QACE,KAAK,EAAE,2BAA2B;QAClC,WAAW,EACT,0KAA0K;QAC5K,WAAW,EAAE;YACX,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC;iBAC1B,QAAQ,EAAE;iBACV,QAAQ,CAAC,wCAAwC,CAAC;YACrD,MAAM,EAAE,CAAC;iBACN,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,IAAI,CAAC;iBACb,QAAQ,CACP,qGAAqG,CACtG;YACH,MAAM,EAAE,CAAC;iBACN,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC;iBAC1B,QAAQ,EAAE;iBACV,QAAQ,CAAC,8CAA8C,CAAC;YAC3D,YAAY,EAAE,CAAC;iBACZ,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC;iBAC1B,QAAQ,EAAE;iBACV,QAAQ,CAAC,qEAAqE,CAAC;YAClF,OAAO,EAAE,CAAC;iBACP,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC;iBAC5B,QAAQ,EAAE;iBACV,QAAQ,CACP,2GAA2G,CAC5G;YACH,UAAU,EAAE,CAAC;iBACV,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;iBACpD,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;iBAC3B,QAAQ,EAAE;iBACV,OAAO,CAAC,EAAE,CAAC;iBACX,QAAQ,CAAC,uEAAuE,CAAC;YACpF,KAAK,EAAE,CAAC;iBACL,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,KAAK,CAAC;iBACd,QAAQ,CACP,qFAAqF,CACtF;YACH,OAAO,EAAE,CAAC;iBACP,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,KAAK,CAAC;iBACd,QAAQ,CAAC,qCAAqC,CAAC;YAClD,cAAc,EAAE,CAAC;iBACd,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CAAC,uDAAuD,CAAC;YACpE,kBAAkB,EAAE,CAAC;iBAClB,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,iEAAiE,CAAC;YAC9E,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,gBAAgB,CAAC;iBAClC,QAAQ,EAAE;iBACV,QAAQ,CACP,oFAAoF,CACrF;YACH,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,oDAAoD,CAAC;YACjE,OAAO,EAAE,CAAC;iBACP,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,IAAI,CAAC;iBACb,QAAQ,CACP,kGAAkG,CACnG;SACJ;QACD,YAAY,EAAE,wBAAwB;KACvC,EACD,KAAK,EAAE,EACL,IAAI,EACJ,MAAM,EACN,MAAM,EACN,YAAY,EACZ,OAAO,EACP,UAAU,EACV,KAAK,EACL,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,QAAQ,EACR,QAAQ,EACR,OAAO,GACR,EAAE,EAAE;QACH,IAAI,MAAM;YAAE,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,YAAY;YAAE,qBAAqB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QACtE,IAAI,OAAO;YAAE,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,QAAQ;YAAE,qBAAqB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,UAAU,IAAI,EAAE,EAAE,CAAC;YACjC,qBAAqB,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAClC,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAEnC,MAAM,IAAI,GAAa,CAAC,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;QAE7F,kDAAkD;QAClD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,UAAU,IAAI,EAAE,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAE3B,+EAA+E;QAC/E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEtE,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAEhE,OAAO,iBAAiB,CACtB,IAAI,EACJ,SAAS,EACT,kBAAkB,EAClB,sBAAsB,EACtB,yBAAyB,EACzB,OAAO,KAAK,KAAK,CAClB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"semgrep.d.ts","sourceRoot":"","sources":["../../src/tools/semgrep.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAgBzE,4DAA4D;AAC5D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,
|
|
1
|
+
{"version":3,"file":"semgrep.d.ts","sourceRoot":"","sources":["../../src/tools/semgrep.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAgBzE,4DAA4D;AAC5D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,QA2LpD"}
|
package/dist/tools/semgrep.js
CHANGED
|
@@ -16,15 +16,54 @@ export function registerSemgrepTool(server) {
|
|
|
16
16
|
.default(["."])
|
|
17
17
|
.describe("File patterns or paths to scan (default: ['.'])"),
|
|
18
18
|
config: z
|
|
19
|
-
.
|
|
20
|
-
.max(INPUT_LIMITS.SHORT_STRING_MAX)
|
|
19
|
+
.union([
|
|
20
|
+
z.string().max(INPUT_LIMITS.SHORT_STRING_MAX),
|
|
21
|
+
z.array(z.string().max(INPUT_LIMITS.SHORT_STRING_MAX)).max(INPUT_LIMITS.ARRAY_MAX),
|
|
22
|
+
])
|
|
21
23
|
.optional()
|
|
22
24
|
.default("auto")
|
|
23
|
-
.describe('Semgrep config/ruleset (e.g
|
|
25
|
+
.describe('Semgrep config/ruleset(s). String or string[] for multiple configs (e.g., "auto", "p/security-audit", ["p/owasp-top-ten", "p/cwe-top-25"]). Default: "auto"'),
|
|
24
26
|
severity: z
|
|
25
27
|
.enum(["INFO", "WARNING", "ERROR"])
|
|
26
28
|
.optional()
|
|
27
29
|
.describe("Severity filter. Default: all severities"),
|
|
30
|
+
exclude: z
|
|
31
|
+
.array(z.string().max(INPUT_LIMITS.PATH_MAX))
|
|
32
|
+
.max(INPUT_LIMITS.ARRAY_MAX)
|
|
33
|
+
.optional()
|
|
34
|
+
.default([])
|
|
35
|
+
.describe("Glob patterns to exclude from scanning (--exclude)"),
|
|
36
|
+
include: z
|
|
37
|
+
.array(z.string().max(INPUT_LIMITS.PATH_MAX))
|
|
38
|
+
.max(INPUT_LIMITS.ARRAY_MAX)
|
|
39
|
+
.optional()
|
|
40
|
+
.default([])
|
|
41
|
+
.describe("Glob patterns to include in scanning (--include)"),
|
|
42
|
+
excludeRule: z
|
|
43
|
+
.array(z.string().max(INPUT_LIMITS.SHORT_STRING_MAX))
|
|
44
|
+
.max(INPUT_LIMITS.ARRAY_MAX)
|
|
45
|
+
.optional()
|
|
46
|
+
.default([])
|
|
47
|
+
.describe("Rule IDs to suppress (--exclude-rule, for known false positives)"),
|
|
48
|
+
baselineCommit: z
|
|
49
|
+
.string()
|
|
50
|
+
.max(INPUT_LIMITS.SHORT_STRING_MAX)
|
|
51
|
+
.optional()
|
|
52
|
+
.describe("Baseline commit for differential scanning in PR workflows (--baseline-commit)"),
|
|
53
|
+
dataflowTraces: z
|
|
54
|
+
.boolean()
|
|
55
|
+
.optional()
|
|
56
|
+
.describe("Include dataflow traces for taint analysis findings (--dataflow-traces)"),
|
|
57
|
+
autofix: z.boolean().optional().describe("Automatically apply suggested fixes (--autofix)"),
|
|
58
|
+
dryrun: z
|
|
59
|
+
.boolean()
|
|
60
|
+
.optional()
|
|
61
|
+
.describe("Preview autofix changes without applying them (--dryrun)"),
|
|
62
|
+
maxTargetBytes: z
|
|
63
|
+
.number()
|
|
64
|
+
.optional()
|
|
65
|
+
.describe("Maximum file size in bytes to scan, skip larger files (--max-target-bytes)"),
|
|
66
|
+
jobs: z.number().optional().describe("Number of parallel jobs for scanning (--jobs)"),
|
|
28
67
|
path: z
|
|
29
68
|
.string()
|
|
30
69
|
.max(INPUT_LIMITS.PATH_MAX)
|
|
@@ -37,25 +76,68 @@ export function registerSemgrepTool(server) {
|
|
|
37
76
|
.describe("Auto-compact when structured output exceeds raw CLI tokens. Set false to always get full schema."),
|
|
38
77
|
},
|
|
39
78
|
outputSchema: SemgrepScanResultSchema,
|
|
40
|
-
}, async ({ patterns, config, severity, path, compact }) => {
|
|
79
|
+
}, async ({ patterns, config, severity, exclude, include, excludeRule, baselineCommit, dataflowTraces, autofix, dryrun, maxTargetBytes, jobs, path, compact, }) => {
|
|
41
80
|
const cwd = path || process.cwd();
|
|
42
81
|
assertAllowedRoot(cwd, "security");
|
|
82
|
+
// Normalize config to array
|
|
83
|
+
const configs = config ? (Array.isArray(config) ? config : [config]) : ["auto"];
|
|
43
84
|
// Validate inputs against flag injection
|
|
44
|
-
|
|
45
|
-
assertNoFlagInjection(
|
|
85
|
+
for (const c of configs) {
|
|
86
|
+
assertNoFlagInjection(c, "config");
|
|
87
|
+
}
|
|
46
88
|
for (const p of patterns) {
|
|
47
89
|
assertNoFlagInjection(p, "patterns");
|
|
48
90
|
}
|
|
91
|
+
for (const e of exclude ?? []) {
|
|
92
|
+
assertNoFlagInjection(e, "exclude");
|
|
93
|
+
}
|
|
94
|
+
for (const i of include ?? []) {
|
|
95
|
+
assertNoFlagInjection(i, "include");
|
|
96
|
+
}
|
|
97
|
+
for (const r of excludeRule ?? []) {
|
|
98
|
+
assertNoFlagInjection(r, "excludeRule");
|
|
99
|
+
}
|
|
100
|
+
if (baselineCommit)
|
|
101
|
+
assertNoFlagInjection(baselineCommit, "baselineCommit");
|
|
49
102
|
const args = ["scan", "--json", "--quiet"];
|
|
50
|
-
|
|
51
|
-
args.push("--config",
|
|
103
|
+
for (const c of configs) {
|
|
104
|
+
args.push("--config", c);
|
|
52
105
|
}
|
|
53
106
|
if (severity) {
|
|
54
107
|
args.push("--severity", severity);
|
|
55
108
|
}
|
|
109
|
+
for (const e of exclude ?? []) {
|
|
110
|
+
args.push("--exclude", e);
|
|
111
|
+
}
|
|
112
|
+
for (const i of include ?? []) {
|
|
113
|
+
args.push("--include", i);
|
|
114
|
+
}
|
|
115
|
+
for (const r of excludeRule ?? []) {
|
|
116
|
+
args.push("--exclude-rule", r);
|
|
117
|
+
}
|
|
118
|
+
if (baselineCommit) {
|
|
119
|
+
args.push("--baseline-commit", baselineCommit);
|
|
120
|
+
}
|
|
121
|
+
if (dataflowTraces) {
|
|
122
|
+
args.push("--dataflow-traces");
|
|
123
|
+
}
|
|
124
|
+
if (autofix) {
|
|
125
|
+
args.push("--autofix");
|
|
126
|
+
}
|
|
127
|
+
if (dryrun) {
|
|
128
|
+
args.push("--dryrun");
|
|
129
|
+
}
|
|
130
|
+
if (maxTargetBytes !== undefined) {
|
|
131
|
+
args.push("--max-target-bytes", String(maxTargetBytes));
|
|
132
|
+
}
|
|
133
|
+
if (jobs !== undefined) {
|
|
134
|
+
args.push("--jobs", String(jobs));
|
|
135
|
+
}
|
|
56
136
|
args.push(...patterns);
|
|
57
137
|
const result = await run("semgrep", args, { cwd, timeout: 300_000 });
|
|
58
|
-
|
|
138
|
+
// Use first config for display; join all for the structured output
|
|
139
|
+
const configDisplay = configs.join(",");
|
|
140
|
+
const data = parseSemgrepJson(result.stdout, configDisplay);
|
|
59
141
|
const rawOutput = (result.stdout + "\n" + result.stderr).trim();
|
|
60
142
|
return compactDualOutput(data, rawOutput, formatSemgrepScan, compactSemgrepScanMap, formatSemgrepScanCompact, compact === false);
|
|
61
143
|
});
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"semgrep.js","sourceRoot":"","sources":["../../src/tools/semgrep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iBAAiB,EACjB,GAAG,EACH,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,MAAiB;IACnD,MAAM,CAAC,YAAY,CACjB,SAAS,EACT;QACE,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,2KAA2K;QAC7K,WAAW,EAAE;YACX,QAAQ,EAAE,CAAC;iBACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;iBAC5C,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;iBAC3B,QAAQ,EAAE;iBACV,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;iBACd,QAAQ,CAAC,iDAAiD,CAAC;YAC9D,MAAM,EAAE,CAAC;iBACN,MAAM,EAAE;
|
|
1
|
+
{"version":3,"file":"semgrep.js","sourceRoot":"","sources":["../../src/tools/semgrep.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iBAAiB,EACjB,GAAG,EACH,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAE9D,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,MAAiB;IACnD,MAAM,CAAC,YAAY,CACjB,SAAS,EACT;QACE,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,2KAA2K;QAC7K,WAAW,EAAE;YACX,QAAQ,EAAE,CAAC;iBACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;iBAC5C,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;iBAC3B,QAAQ,EAAE;iBACV,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;iBACd,QAAQ,CAAC,iDAAiD,CAAC;YAC9D,MAAM,EAAE,CAAC;iBACN,KAAK,CAAC;gBACL,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,gBAAgB,CAAC;gBAC7C,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;aACnF,CAAC;iBACD,QAAQ,EAAE;iBACV,OAAO,CAAC,MAAM,CAAC;iBACf,QAAQ,CACP,6JAA6J,CAC9J;YACH,QAAQ,EAAE,CAAC;iBACR,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;iBAClC,QAAQ,EAAE;iBACV,QAAQ,CAAC,0CAA0C,CAAC;YACvD,OAAO,EAAE,CAAC;iBACP,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;iBAC5C,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;iBAC3B,QAAQ,EAAE;iBACV,OAAO,CAAC,EAAE,CAAC;iBACX,QAAQ,CAAC,oDAAoD,CAAC;YACjE,OAAO,EAAE,CAAC;iBACP,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;iBAC5C,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;iBAC3B,QAAQ,EAAE;iBACV,OAAO,CAAC,EAAE,CAAC;iBACX,QAAQ,CAAC,kDAAkD,CAAC;YAC/D,WAAW,EAAE,CAAC;iBACX,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;iBACpD,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;iBAC3B,QAAQ,EAAE;iBACV,OAAO,CAAC,EAAE,CAAC;iBACX,QAAQ,CAAC,kEAAkE,CAAC;YAC/E,cAAc,EAAE,CAAC;iBACd,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,gBAAgB,CAAC;iBAClC,QAAQ,EAAE;iBACV,QAAQ,CACP,+EAA+E,CAChF;YACH,cAAc,EAAE,CAAC;iBACd,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CAAC,yEAAyE,CAAC;YACtF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;YAC3F,MAAM,EAAE,CAAC;iBACN,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CAAC,0DAA0D,CAAC;YACvE,cAAc,EAAE,CAAC;iBACd,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,4EAA4E,CAAC;YACzF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;YACrF,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC;iBAC1B,QAAQ,EAAE;iBACV,QAAQ,CAAC,kCAAkC,CAAC;YAC/C,OAAO,EAAE,CAAC;iBACP,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,IAAI,CAAC;iBACb,QAAQ,CACP,kGAAkG,CACnG;SACJ;QACD,YAAY,EAAE,uBAAuB;KACtC,EACD,KAAK,EAAE,EACL,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,OAAO,EACP,OAAO,EACP,WAAW,EACX,cAAc,EACd,cAAc,EACd,OAAO,EACP,MAAM,EACN,cAAc,EACd,IAAI,EACJ,IAAI,EACJ,OAAO,GACR,EAAE,EAAE;QACH,MAAM,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAClC,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAEnC,4BAA4B;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAEhF,yCAAyC;QACzC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,qBAAqB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,qBAAqB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACvC,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YAC9B,qBAAqB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YAC9B,qBAAqB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC;YAClC,qBAAqB,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,cAAc;YAAE,qBAAqB,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QAE5E,MAAM,IAAI,GAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAErD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC3B,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC5B,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC5B,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAED,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAEvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAErE,mEAAmE;QACnE,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAEhE,OAAO,iBAAiB,CACtB,IAAI,EACJ,SAAS,EACT,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,EACxB,OAAO,KAAK,KAAK,CAClB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"trivy.d.ts","sourceRoot":"","sources":["../../src/tools/trivy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;
|
|
1
|
+
{"version":3,"file":"trivy.d.ts","sourceRoot":"","sources":["../../src/tools/trivy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAYzE,0DAA0D;AAC1D,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,QA8LlD"}
|
package/dist/tools/trivy.js
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { z } from "zod";
|
|
2
|
-
import { compactDualOutput, run, INPUT_LIMITS, assertAllowedRoot } from "@paretools/shared";
|
|
2
|
+
import { compactDualOutput, run, INPUT_LIMITS, assertAllowedRoot, assertNoFlagInjection, } from "@paretools/shared";
|
|
3
3
|
import { parseTrivyJson } from "../lib/parsers.js";
|
|
4
4
|
import { formatTrivyScan, compactTrivyScanMap, formatTrivyScanCompact } from "../lib/formatters.js";
|
|
5
5
|
import { TrivyScanResultSchema } from "../schemas/index.js";
|
|
@@ -19,14 +19,61 @@ export function registerTrivyTool(server) {
|
|
|
19
19
|
.default("image")
|
|
20
20
|
.describe('Scan type: "image" for container images, "fs" for filesystem, "config" for IaC misconfigurations'),
|
|
21
21
|
severity: z
|
|
22
|
-
.
|
|
22
|
+
.union([
|
|
23
|
+
z.enum(["UNKNOWN", "LOW", "MEDIUM", "HIGH", "CRITICAL"]),
|
|
24
|
+
z
|
|
25
|
+
.array(z.enum(["UNKNOWN", "LOW", "MEDIUM", "HIGH", "CRITICAL"]))
|
|
26
|
+
.max(INPUT_LIMITS.ARRAY_MAX),
|
|
27
|
+
])
|
|
23
28
|
.optional()
|
|
24
|
-
.describe(
|
|
29
|
+
.describe('Severity filter. Single value or array for CSV (e.g., ["CRITICAL", "HIGH"]). Default: all severities'),
|
|
30
|
+
scanners: z
|
|
31
|
+
.array(z.enum(["vuln", "misconfig", "secret", "license"]))
|
|
32
|
+
.max(INPUT_LIMITS.ARRAY_MAX)
|
|
33
|
+
.optional()
|
|
34
|
+
.default([])
|
|
35
|
+
.describe('Scanner types to enable (--scanners, e.g., ["vuln", "misconfig"]). Default: all'),
|
|
36
|
+
vulnType: z
|
|
37
|
+
.array(z.enum(["os", "library"]))
|
|
38
|
+
.max(INPUT_LIMITS.ARRAY_MAX)
|
|
39
|
+
.optional()
|
|
40
|
+
.default([])
|
|
41
|
+
.describe('Vulnerability types to scan (--vuln-type, e.g., ["os", "library"]). Default: all'),
|
|
42
|
+
skipDirs: z
|
|
43
|
+
.array(z.string().max(INPUT_LIMITS.PATH_MAX))
|
|
44
|
+
.max(INPUT_LIMITS.ARRAY_MAX)
|
|
45
|
+
.optional()
|
|
46
|
+
.default([])
|
|
47
|
+
.describe("Directories to skip during scanning (--skip-dirs)"),
|
|
48
|
+
skipFiles: z
|
|
49
|
+
.array(z.string().max(INPUT_LIMITS.PATH_MAX))
|
|
50
|
+
.max(INPUT_LIMITS.ARRAY_MAX)
|
|
51
|
+
.optional()
|
|
52
|
+
.default([])
|
|
53
|
+
.describe("Files to skip during scanning (--skip-files)"),
|
|
54
|
+
platform: z
|
|
55
|
+
.string()
|
|
56
|
+
.max(INPUT_LIMITS.SHORT_STRING_MAX)
|
|
57
|
+
.optional()
|
|
58
|
+
.describe('Platform for multi-arch image scanning (--platform, e.g., "linux/amd64")'),
|
|
59
|
+
ignorefile: z
|
|
60
|
+
.string()
|
|
61
|
+
.max(INPUT_LIMITS.PATH_MAX)
|
|
62
|
+
.optional()
|
|
63
|
+
.describe("Path to custom .trivyignore file (--ignorefile)"),
|
|
25
64
|
ignoreUnfixed: z
|
|
26
65
|
.boolean()
|
|
27
66
|
.optional()
|
|
28
67
|
.default(false)
|
|
29
68
|
.describe("Only show vulnerabilities with known fixes"),
|
|
69
|
+
exitCode: z
|
|
70
|
+
.number()
|
|
71
|
+
.optional()
|
|
72
|
+
.describe("Exit code when vulnerabilities are found (--exit-code)"),
|
|
73
|
+
skipDbUpdate: z
|
|
74
|
+
.boolean()
|
|
75
|
+
.optional()
|
|
76
|
+
.describe("Skip vulnerability database update for faster scans (--skip-db-update)"),
|
|
30
77
|
path: z
|
|
31
78
|
.string()
|
|
32
79
|
.max(INPUT_LIMITS.PATH_MAX)
|
|
@@ -39,16 +86,57 @@ export function registerTrivyTool(server) {
|
|
|
39
86
|
.describe("Auto-compact when structured output exceeds raw CLI tokens. Set false to always get full schema."),
|
|
40
87
|
},
|
|
41
88
|
outputSchema: TrivyScanResultSchema,
|
|
42
|
-
}, async ({ target, scanType, severity, ignoreUnfixed, path, compact }) => {
|
|
89
|
+
}, async ({ target, scanType, severity, scanners, vulnType, skipDirs, skipFiles, platform, ignorefile, ignoreUnfixed, exitCode, skipDbUpdate, path, compact, }) => {
|
|
90
|
+
assertNoFlagInjection(target, "target");
|
|
91
|
+
if (platform)
|
|
92
|
+
assertNoFlagInjection(platform, "platform");
|
|
93
|
+
if (ignorefile)
|
|
94
|
+
assertNoFlagInjection(ignorefile, "ignorefile");
|
|
95
|
+
for (const d of skipDirs ?? []) {
|
|
96
|
+
assertNoFlagInjection(d, "skipDirs");
|
|
97
|
+
}
|
|
98
|
+
for (const f of skipFiles ?? []) {
|
|
99
|
+
assertNoFlagInjection(f, "skipFiles");
|
|
100
|
+
}
|
|
43
101
|
const cwd = path || process.cwd();
|
|
44
102
|
assertAllowedRoot(cwd, "security");
|
|
45
103
|
const args = [scanType, "--format", "json", "--quiet"];
|
|
104
|
+
// Handle severity as single value or CSV array
|
|
46
105
|
if (severity) {
|
|
47
|
-
|
|
106
|
+
const severityStr = Array.isArray(severity) ? severity.join(",") : severity;
|
|
107
|
+
args.push("--severity", severityStr);
|
|
108
|
+
}
|
|
109
|
+
// Scanners (comma-separated)
|
|
110
|
+
if (scanners && scanners.length > 0) {
|
|
111
|
+
args.push("--scanners", scanners.join(","));
|
|
112
|
+
}
|
|
113
|
+
// Vulnerability types (comma-separated)
|
|
114
|
+
if (vulnType && vulnType.length > 0) {
|
|
115
|
+
args.push("--vuln-type", vulnType.join(","));
|
|
116
|
+
}
|
|
117
|
+
// Skip directories
|
|
118
|
+
for (const d of skipDirs ?? []) {
|
|
119
|
+
args.push("--skip-dirs", d);
|
|
120
|
+
}
|
|
121
|
+
// Skip files
|
|
122
|
+
for (const f of skipFiles ?? []) {
|
|
123
|
+
args.push("--skip-files", f);
|
|
124
|
+
}
|
|
125
|
+
if (platform) {
|
|
126
|
+
args.push("--platform", platform);
|
|
127
|
+
}
|
|
128
|
+
if (ignorefile) {
|
|
129
|
+
args.push("--ignorefile", ignorefile);
|
|
48
130
|
}
|
|
49
131
|
if (ignoreUnfixed) {
|
|
50
132
|
args.push("--ignore-unfixed");
|
|
51
133
|
}
|
|
134
|
+
if (exitCode !== undefined) {
|
|
135
|
+
args.push("--exit-code", String(exitCode));
|
|
136
|
+
}
|
|
137
|
+
if (skipDbUpdate) {
|
|
138
|
+
args.push("--skip-db-update");
|
|
139
|
+
}
|
|
52
140
|
args.push(target);
|
|
53
141
|
const result = await run("trivy", args, { cwd, timeout: 300_000 });
|
|
54
142
|
const data = parseTrivyJson(result.stdout, target, scanType);
|
package/dist/tools/trivy.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"trivy.js","sourceRoot":"","sources":["../../src/tools/trivy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,
|
|
1
|
+
{"version":3,"file":"trivy.js","sourceRoot":"","sources":["../../src/tools/trivy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iBAAiB,EACjB,GAAG,EACH,YAAY,EACZ,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACpG,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,0DAA0D;AAC1D,MAAM,UAAU,iBAAiB,CAAC,MAAiB;IACjD,MAAM,CAAC,YAAY,CACjB,OAAO,EACP;QACE,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EACT,kNAAkN;QACpN,WAAW,EAAE;YACX,MAAM,EAAE,CAAC;iBACN,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC;iBAC1B,QAAQ,CAAC,iEAAiE,CAAC;YAC9E,QAAQ,EAAE,CAAC;iBACR,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;iBAC/B,QAAQ,EAAE;iBACV,OAAO,CAAC,OAAO,CAAC;iBAChB,QAAQ,CACP,kGAAkG,CACnG;YACH,QAAQ,EAAE,CAAC;iBACR,KAAK,CAAC;gBACL,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;gBACxD,CAAC;qBACE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;qBAC/D,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;aAC/B,CAAC;iBACD,QAAQ,EAAE;iBACV,QAAQ,CACP,sGAAsG,CACvG;YACH,QAAQ,EAAE,CAAC;iBACR,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;iBACzD,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;iBAC3B,QAAQ,EAAE;iBACV,OAAO,CAAC,EAAE,CAAC;iBACX,QAAQ,CACP,iFAAiF,CAClF;YACH,QAAQ,EAAE,CAAC;iBACR,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;iBAChC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;iBAC3B,QAAQ,EAAE;iBACV,OAAO,CAAC,EAAE,CAAC;iBACX,QAAQ,CACP,kFAAkF,CACnF;YACH,QAAQ,EAAE,CAAC;iBACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;iBAC5C,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;iBAC3B,QAAQ,EAAE;iBACV,OAAO,CAAC,EAAE,CAAC;iBACX,QAAQ,CAAC,mDAAmD,CAAC;YAChE,SAAS,EAAE,CAAC;iBACT,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;iBAC5C,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;iBAC3B,QAAQ,EAAE;iBACV,OAAO,CAAC,EAAE,CAAC;iBACX,QAAQ,CAAC,8CAA8C,CAAC;YAC3D,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,gBAAgB,CAAC;iBAClC,QAAQ,EAAE;iBACV,QAAQ,CAAC,0EAA0E,CAAC;YACvF,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC;iBAC1B,QAAQ,EAAE;iBACV,QAAQ,CAAC,iDAAiD,CAAC;YAC9D,aAAa,EAAE,CAAC;iBACb,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,KAAK,CAAC;iBACd,QAAQ,CAAC,4CAA4C,CAAC;YACzD,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,wDAAwD,CAAC;YACrE,YAAY,EAAE,CAAC;iBACZ,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CAAC,wEAAwE,CAAC;YACrF,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC;iBAC1B,QAAQ,EAAE;iBACV,QAAQ,CAAC,kCAAkC,CAAC;YAC/C,OAAO,EAAE,CAAC;iBACP,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,OAAO,CAAC,IAAI,CAAC;iBACb,QAAQ,CACP,kGAAkG,CACnG;SACJ;QACD,YAAY,EAAE,qBAAqB;KACpC,EACD,KAAK,EAAE,EACL,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,UAAU,EACV,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,IAAI,EACJ,OAAO,GACR,EAAE,EAAE;QACH,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACxC,IAAI,QAAQ;YAAE,qBAAqB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC1D,IAAI,UAAU;YAAE,qBAAqB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAChE,KAAK,MAAM,CAAC,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YAC/B,qBAAqB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACvC,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,SAAS,IAAI,EAAE,EAAE,CAAC;YAChC,qBAAqB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAClC,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAEnC,MAAM,IAAI,GAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAEjE,+CAA+C;QAC/C,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC5E,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACvC,CAAC;QAED,6BAA6B;QAC7B,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,CAAC;QAED,wCAAwC;QACxC,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/C,CAAC;QAED,mBAAmB;QACnB,KAAK,MAAM,CAAC,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QAC9B,CAAC;QAED,aAAa;QACb,KAAK,MAAM,CAAC,IAAI,SAAS,IAAI,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAElB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEnE,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAEhE,OAAO,iBAAiB,CACtB,IAAI,EACJ,SAAS,EACT,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,OAAO,KAAK,KAAK,CAClB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@paretools/security",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.9.0",
|
|
4
4
|
"mcpName": "io.github.Dave-London/pare-security",
|
|
5
5
|
"description": "MCP server for security scanning (Trivy, Semgrep, Gitleaks) with structured, token-efficient output",
|
|
6
6
|
"license": "MIT",
|
|
@@ -57,7 +57,7 @@
|
|
|
57
57
|
"dependencies": {
|
|
58
58
|
"@modelcontextprotocol/sdk": "^1.26.0",
|
|
59
59
|
"zod": "^4.3.6",
|
|
60
|
-
"@paretools/shared": "0.
|
|
60
|
+
"@paretools/shared": "0.9.0"
|
|
61
61
|
},
|
|
62
62
|
"devDependencies": {
|
|
63
63
|
"@types/node": "^25.2.3",
|