ikanban 0.4.8 → 0.5.0

package/scanners/ikanban-dastscan.py

@@ -250,7 +250,8 @@ def finding_key(url: str, rule: str, title: str, kind: str = "dast") -> str:
 
 
 def findings_payload(url: str, findings: list, kind: str = "dast") -> list:
-    return [{
+    """The findings --publish files; every text field through scrub_text (plan 5 X2)."""
+    return [scrub_finding({
         "finding_key": finding_key(url, f["rule"], f["title"], kind),
         "owasp_category": CATEGORY,
         "severity": f["severity"].capitalize(),
@@ -258,7 +259,7 @@ def findings_payload(url: str, findings: list, kind: str = "dast") -> list:
         "location_file": f["location"][:500] or None,
         "location_lines": None,
         "remediation": " ".join(x for x in (f["detail"], f["remediation"]) if x),
-    } for f in findings]
+    }) for f in findings]
 
 
 def build_report(url: str, findings: list, skipped: list, ran: list, mode: str = "ZAP baseline, passive",
@@ -445,9 +446,21 @@ def add_work_dir_arg(ap):
     ap.add_argument("--work-dir", default=os.environ.get("IKANBAN_SCAN_DIR", ""),
                     help="Folder for this scan's files (or IKANBAN_SCAN_DIR; default "
                          "<repository>/.iKanban/scans)")
+    ap.add_argument("--print-report", action="store_true",
+                    help="Print the full report on stdout (under the ikanban CLI stdout otherwise shows the "
+                         "counts and `ikanban scans show <id>`)")
 
 
 def scan_work_dir(scanner: str, base: Path, override: str = "") -> Path:
+    # Plan 5 X3: the ikanban CLI hands over a private temp folder (IKANBAN_SCAN_DIR) and the scan id
+    # (IKANBAN_SCAN_ID). That folder is this run's folder; the CLI seals it into ~/.ikanban/scans.
+    cli_dir = os.environ.get("IKANBAN_SCAN_DIR", "")
+    if override and cli_dir and os.environ.get("IKANBAN_SCAN_ID") and (
+            Path(override).expanduser().resolve() == Path(cli_dir).expanduser().resolve()):
+        run_dir = Path(cli_dir).expanduser().resolve()
+        run_dir.mkdir(mode=0o700, parents=True, exist_ok=True)
+        os.chmod(run_dir, 0o700)
+        return run_dir
     scans = Path(override).expanduser().resolve() if override else base / ".iKanban" / "scans"
     scans.mkdir(parents=True, exist_ok=True)
     ignore = scans / ".gitignore"
@@ -473,14 +486,72 @@ def slug(text: str) -> str:
     return re.sub(r"[^A-Za-z0-9._-]+", "_", text).strip("_")[:80] or "x"
 
 
+# ── scrub_text: identical in every scanner (test_scrub_text.py compares the copies) ──────────
+# Plan 5 X2-T1: every text field of every finding passes through scrub_text before it leaves this
+# machine. A secret keeps its first 4 characters; a home folder becomes ~. The server scrubs again.
+_SCRUB_CUT = (
+    re.compile(r"-{5}BEGIN [A-Z ]*PRIVATE KEY-{5}.*?(?:-{5}END [A-Z ]*PRIVATE KEY-{5}|\Z)", re.S),
+    re.compile(r"\b(?:AKIA|ASIA)[0-9A-Z]{16}\b"),
+    re.compile(r"\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b"),
+    re.compile(r"\bgithub_pat_[A-Za-z0-9_]{22,}\b"),
+    re.compile(r"\bglpat-[A-Za-z0-9_-]{20,}\b"),
+    re.compile(r"\bxox[abposr]-[A-Za-z0-9-]{10,}\b"),
+    re.compile(r"\b(?:sk|rk)_live_[A-Za-z0-9]{20,}\b"),
+    re.compile(r"\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{24,}\b"),
+    re.compile(r"\bwhsec_[A-Za-z0-9]{16,}\b"),
+    re.compile(r"\bAIza[0-9A-Za-z_-]{35}\b"),
+    re.compile(r"\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b"),
+    re.compile(r"\bvk_[A-Za-z0-9_-]{8,}"),
+)
+_SCRUB_ASSIGNED = re.compile(
+    r"(?i)(\b(?:aws_secret_access_key|aws_session_token|client_secret|secret_key|private_key|api[_-]?key|"
+    r"access[_-]?token|auth[_-]?token|token|password|passwd|pwd|secret)\b[\"']?\s*[:=]\s*[\"']?)([^\s\"',;&]+)")
+_SCRUB_BEARER = re.compile(r"(?i)(\b(?:bearer|basic)\s+)([A-Za-z0-9._~+/=-]{12,})")
+_SCRUB_URL_CREDS = re.compile(r"(\b[a-z][a-z0-9+.-]*://[^\s/:@]+:)([^\s@/]+)(@)")
+_SCRUB_HOME = re.compile(r"(?<![\w.-])(?:[A-Za-z]:\\[Uu]sers\\|/Users/|/home/)[^\\/\s\"'<>]+")
+
+
+def scrub_text(text) -> str:
+    """Secrets, iKanban keys, tokens, AWS and GitHub keys, private key blocks and home folders
+    cut from one text. None becomes ""."""
+    if text is None:
+        return ""
+    text = str(text)
+    for rx in _SCRUB_CUT:
+        text = rx.sub(lambda m: m.group(0)[:4] + "…[hidden]", text)
+    text = _SCRUB_ASSIGNED.sub(
+        lambda m: m.group(1) + "[hidden]" if len(m.group(2)) >= 8 or any(c.isdigit() for c in m.group(2))
+        else m.group(0), text)
+    text = _SCRUB_BEARER.sub(lambda m: m.group(1) + "[hidden]", text)
+    text = _SCRUB_URL_CREDS.sub(lambda m: m.group(1) + "[hidden]" + m.group(3), text)
+    home = str(Path.home())
+    if home and home not in ("/", "\\") and home in text:
+        text = text.replace(home, "~")
+    return _SCRUB_HOME.sub("~", text)
+
+
+def scrub_finding(value):
+    """scrub_text on every string in a finding, through nested dicts and lists; other values stay."""
+    if isinstance(value, str):
+        return scrub_text(value)
+    if isinstance(value, dict):
+        return {k: scrub_finding(v) for k, v in value.items()}
+    if isinstance(value, list):
+        return [scrub_finding(v) for v in value]
+    return value
+
+
+# ── end scrub_text ──
+
+
 # ── Pipelines (plan 11 H12, owner): with --task, the scan shows in that task's Pipelines view ──
 # Same calls as `ikanban pipeline` (vibe-cli/lib/pipeline.js → routes/pipeline.rs): an event
 # "running" at the start, "passed" / "failed" / "skipped" at the end with a one-line detail,
-# then the report as log chunks. A plan without Pipelines (402) or any error never fails the scan.
+# then that line as the log (plan 5: never the report). A plan without Pipelines (402) or any error never fails the scan.
 _UUID = re.compile(r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", re.I)
 # Every iKanban scanner reports into one named lane, not the server's "legacy" lane.
 PIPE_RUN = "security-scan"
-PIPE_CHUNK = 15 * 1024  # the server takes 16 KB per chunk
+PIPE_CHUNK = 15 * 1024  # the server takes 16 KB per log line
 LAST_RUN = {"report": "", "detail": "", "skipped": False}
 
 
@@ -500,39 +571,40 @@ def summary_detail(counts: dict, total: int, skipped: list) -> str:
 
 
 def mask_report(text: str) -> str:
-    """The report is masked already; mask again before it leaves for Pipelines."""
+    """scrub_text before a line leaves for Pipelines, plus a scanner's own rules (scrub_report)."""
+    text = scrub_text(text)
     scrub = globals().get("scrub_report")
-    if scrub:
-        return scrub(text)[0]
-    text = re.sub(r"\bvk_[A-Za-z0-9_-]{8,}", lambda m: m.group(0)[:4] + "…[hidden]", text)
-    home = str(Path.home())
-    return text.replace(home, "~") if home and home != "/" else text
-
-
-def log_chunks(text: str) -> list:
-    """Whole lines, each chunk under PIPE_CHUNK bytes (a longer single line is cut)."""
-    chunks, cur = [], ""
-    for line in text.splitlines(keepends=True):
-        while len(line.encode()) > PIPE_CHUNK:
-            head = line.encode()[:PIPE_CHUNK].decode(errors="ignore")
-            chunks.append(head)
-            line = line[len(head):]
-        if len((cur + line).encode()) > PIPE_CHUNK:
-            chunks.append(cur)
-            cur = ""
-        cur += line
-    if cur:
-        chunks.append(cur)
-    return chunks
+    return scrub(text)[0] if scrub else text
+
+
+def show_report(md: str, summary: str, print_report: bool = False) -> None:
+    """Plan 5 X3: under the ikanban CLI (IKANBAN_SCAN_ID set) stdout gets the counts and where the
+    full report is stored; the body only with --print-report. A plain python run prints the body."""
+    scan_id = os.environ.get("IKANBAN_SCAN_ID", "")
+    if scan_id and not print_report:
+        print(summary)
+        print(f"Full report: ikanban scans show {scan_id}")
+    else:
+        print(md)
+
+
+def scan_files_note(work: Path) -> str:
+    """Where this run's files are: the encrypted store under the CLI, else the run folder."""
+    scan_id = os.environ.get("IKANBAN_SCAN_ID", "")
+    return f"scan files: sealed into ~/.ikanban/scans as {scan_id}" if scan_id else f"scan files: {work}"
+
+
 
 # The running Pipeline (set by run_main with --task). Owner: Pipelines showed nothing while a
-# scan ran, so each step also sends one line as it starts and ends; the full report follows at the end.
+# scan ran, so each step also sends one line as it starts and ends; the one-line summary follows at the end.
 # Progress lines are fixed status text: never raw tool output or an error body (it can carry
 # secrets or text an attacker wrote). Those stay on local stderr and in the masked report.
 PIPE = None
 
 
 def progress(text: str) -> None:
+    if os.environ.get("IKANBAN_SCAN_ID") and "--json" not in sys.argv:
+        print(text, flush=True)  # Plan 5: under the CLI stdout shows progress, not the report
     if PIPE:
         PIPE.log(text)
 
@@ -593,8 +665,10 @@ class Pipeline:
         self._post("pipeline-events", {"task": self.task, "stage": self.stage, "status": status,
                                        "run": PIPE_RUN, "source": "laptop", "actor": f"ikanban-{self.stage}",
                                        "detail": detail[:300] or None})
-        for chunk in log_chunks(mask_report(LAST_RUN["report"])):
-            self._post("pipeline-logs", {"task": self.task, "run": PIPE_RUN, "stage": self.stage, "text": chunk})
+        # Plan 5 X1-T2: the summary only; the report stays on the machine that ran the scan.
+        summary = f"{self.stage} {status}" + (f": {detail[:300]}" if detail else "")
+        self._post("pipeline-logs", {"task": self.task, "run": PIPE_RUN, "stage": self.stage,
+                                     "text": mask_report(summary) + "\n"})
 
 
 def run_main(stage, main_fn, argv=None):
@@ -644,7 +718,7 @@ def main(argv=None):
     ap.add_argument("--rate", type=int, default=None, metavar="N",
                     help="Most requests per second ZAP sends to the target (ZAP's Network rate limit). "
                          f"Default {DEFAULT_API_RATE} for an active API scan, no limit otherwise; 0 = no limit")
-    ap.add_argument("--publish", action="store_true", help="File the report and findings into iKanban")
+    ap.add_argument("--publish", action="store_true", help="File the findings into iKanban (the full report stays on this machine)")
     ap.add_argument("--team", default=os.environ.get("IKANBAN_TEAM_ID", ""),
                     help="Team UUID (or IKANBAN_TEAM_ID); always needed, to check the URL is registered")
     ap.add_argument("--base-url", default=os.environ.get("IKANBAN_BASE_URL", "https://api.i-kanban.com"))
@@ -742,18 +816,12 @@ def main(argv=None):
         print(json.dumps({"url": url, "total": total, "counts": counts, "skipped": bool(skipped_why),
                           "complete": report is not None and not incomplete}, indent=2))
     else:
-        print(md)
+        show_report(md, LAST_RUN["detail"], args.print_report)
     sys.stdout.flush()
-    print(f"scan files: {work}", file=sys.stderr)
+    print(scan_files_note(work), file=sys.stderr)
 
     if args.publish:
-        ok, info = api("POST", "/security/scan-reports", args.base_url, args.token,
-                       {"team_id": args.team, "title": f"{'API scan' if kind == 'api' else 'DAST scan'} — {url} — "
-                        f"{datetime.now(timezone.utc):%Y-%m-%d %H:%M} UTC", "content": md})
-        print(f"\npublished: {(info or {}).get('id', '')}" if ok else f"\npublish FAILED: {info}",
-              file=sys.stderr)
-        if not ok:
-            return 2
+        # Plan 5 X1: findings only; the report stays on this machine.
         if report is None:
             print("ZAP did not run: nothing filed or closed", file=sys.stderr)
         else: