qa360 1.0.4 → 1.1.1

package/dist/core/adapters/semgrep-sast.js

@@ -0,0 +1,322 @@
+/**
+ * QA360 Semgrep SAST Adapter (Socle OOTB)
+ * Static Application Security Testing with configurable severity thresholds
+ */
+import { spawn } from 'child_process';
+import { existsSync } from 'fs';
+import { join } from 'path';
+import { SecurityRedactor } from '../security/redactor.js';
+export class SemgrepSastAdapter {
+    redactor;
+    constructor() {
+        this.redactor = SecurityRedactor.forLogs();
+    }
+    /**
+     * Execute Semgrep SAST scan
+     */
+    async runSastScan(config) {
+        try {
+            console.log(`🔍 Running Semgrep SAST scan (${config.paths?.join(', ') || 'default paths'})`);
+            // Check if Semgrep is available
+            const availability = await SemgrepSastAdapter.isAvailable();
+            if (!availability.available) {
+                return {
+                    success: false,
+                    findings: [],
+                    summary: this.getDefaultSummary(),
+                    thresholds: this.getDefaultThresholds(config.security),
+                    error: availability.error
+                };
+            }
+            // Execute Semgrep
+            const result = await this.executeSemgrep(config);
+            return result;
+        }
+        catch (error) {
+            return {
+                success: false,
+                findings: [],
+                summary: this.getDefaultSummary(),
+                thresholds: this.getDefaultThresholds(config.security),
+                error: this.redactor.redact(error instanceof Error ? error.message : 'Unknown error')
+            };
+        }
+    }
+    /**
+     * Execute Semgrep command
+     */
+    async executeSemgrep(config) {
+        return new Promise((resolve) => {
+            let output = '';
+            let error = '';
+            const rules = config.rules || ['auto'];
+            const paths = config.paths || ['.'];
+            const args = [
+                '--config', rules.join(','),
+                '--json',
+                '--no-git-ignore', // Include all files
+                '--timeout', '60',
+                ...paths
+            ];
+            // Add custom config if specified
+            if (config.configFile && existsSync(join(config.workingDir, config.configFile))) {
+                args.unshift('--config', config.configFile);
+            }
+            const child = spawn('semgrep', args, {
+                cwd: config.workingDir,
+                stdio: ['ignore', 'pipe', 'pipe']
+            });
+            const timeout = setTimeout(() => {
+                child.kill('SIGKILL');
+                resolve({
+                    success: false,
+                    findings: [],
+                    summary: this.getDefaultSummary(),
+                    thresholds: this.getDefaultThresholds(config.security),
+                    error: `Semgrep scan timed out after ${config.timeout || 120000}ms`
+                });
+            }, config.timeout || 120000);
+            if (child.stdout) {
+                child.stdout.on('data', (data) => {
+                    output += data.toString();
+                });
+            }
+            if (child.stderr) {
+                child.stderr.on('data', (data) => {
+                    error += data.toString();
+                });
+            }
+            child.on('close', (code) => {
+                clearTimeout(timeout);
+                // Semgrep returns 0 for no findings, 1 for findings, 2+ for errors
+                if (code === 0 || code === 1) {
+                    const result = this.parseSemgrepResults(output, config);
+                    resolve(result);
+                }
+                else {
+                    resolve({
+                        success: false,
+                        findings: [],
+                        summary: this.getDefaultSummary(),
+                        thresholds: this.getDefaultThresholds(config.security),
+                        error: this.redactor.redact(error || `Semgrep exited with code ${code}`),
+                        rawOutput: this.redactor.redact(output)
+                    });
+                }
+            });
+            child.on('error', (err) => {
+                clearTimeout(timeout);
+                resolve({
+                    success: false,
+                    findings: [],
+                    summary: this.getDefaultSummary(),
+                    thresholds: this.getDefaultThresholds(config.security),
+                    error: `Failed to start Semgrep: ${err.message}`
+                });
+            });
+        });
+    }
+    /**
+     * Parse Semgrep JSON results
+     */
+    parseSemgrepResults(output, config) {
+        try {
+            const jsonData = JSON.parse(output);
+            const findings = [];
+            // Parse findings from results
+            if (jsonData.results && Array.isArray(jsonData.results)) {
+                for (const result of jsonData.results) {
+                    const finding = {
+                        ruleId: result.check_id || 'unknown',
+                        severity: this.mapSeverity(result.extra?.severity || 'INFO'),
+                        message: result.extra?.message || result.message || 'Security issue detected',
+                        file: result.path || 'unknown',
+                        line: result.start?.line || 0,
+                        column: result.start?.col || 0,
+                        code: result.extra?.lines ? result.extra.lines.trim() : undefined,
+                        fix: result.extra?.fix ? result.extra.fix.trim() : undefined
+                    };
+                    findings.push(finding);
+                }
+            }
+            // Calculate summary
+            const summary = this.calculateSummary(findings);
+            // Check thresholds
+            const thresholds = this.checkThresholds(summary, config.security);
+            // Determine success based on thresholds
+            const success = thresholds.sast_max_high.passed;
+            const junit = this.generateJUnit(findings, success);
+            return {
+                success,
+                findings: findings.map(f => ({
+                    ...f,
+                    message: this.redactor.redact(f.message),
+                    code: f.code ? this.redactor.redact(f.code) : undefined,
+                    fix: f.fix ? this.redactor.redact(f.fix) : undefined
+                })),
+                summary,
+                thresholds,
+                rawOutput: this.redactor.redact(output),
+                junit
+            };
+        }
+        catch (error) {
+            return {
+                success: false,
+                findings: [],
+                summary: this.getDefaultSummary(),
+                thresholds: this.getDefaultThresholds(config.security),
+                error: `Failed to parse Semgrep results: ${error}`,
+                rawOutput: this.redactor.redact(output)
+            };
+        }
+    }
+    /**
+     * Map Semgrep severity to standard levels
+     */
+    mapSeverity(severity) {
+        const sev = severity.toUpperCase();
+        if (sev === 'ERROR' || sev === 'HIGH')
+            return 'ERROR';
+        if (sev === 'WARNING' || sev === 'MEDIUM')
+            return 'WARNING';
+        return 'INFO';
+    }
+    /**
+     * Calculate findings summary
+     */
+    calculateSummary(findings) {
+        const summary = {
+            total: findings.length,
+            critical: 0,
+            high: 0,
+            medium: 0,
+            low: 0,
+            info: 0
+        };
+        for (const finding of findings) {
+            switch (finding.severity) {
+                case 'ERROR':
+                    summary.high++;
+                    break;
+                case 'WARNING':
+                    summary.medium++;
+                    break;
+                case 'INFO':
+                    summary.info++;
+                    break;
+            }
+        }
+        return summary;
+    }
+    /**
+     * Check security thresholds
+     */
+    checkThresholds(summary, security) {
+        const maxHigh = security?.sast?.max_high ?? 0; // Default: strict (0 high findings)
+        return {
+            sast_max_high: {
+                passed: summary.high <= maxHigh,
+                actual: summary.high,
+                budget: maxHigh
+            }
+        };
+    }
+    /**
+     * Generate JUnit XML
+     */
+    generateJUnit(findings, success) {
+        const timestamp = new Date().toISOString();
+        const failures = findings.filter(f => f.severity === 'ERROR').length;
+        let junit = `<?xml version="1.0" encoding="UTF-8"?>
+<testsuite name="Semgrep SAST Scan" tests="1" failures="${success ? 0 : 1}" time="0" timestamp="${timestamp}">
+  <testcase name="SAST Security Scan" time="0">
+`;
+        if (!success) {
+            junit += `    <failure message="Security issues found">
+High severity findings: ${findings.filter(f => f.severity === 'ERROR').length}
+Medium severity findings: ${findings.filter(f => f.severity === 'WARNING').length}
+Total findings: ${findings.length}
+
+Top findings:
+${findings.slice(0, 5).map(f => `- ${f.ruleId}: ${f.message} (${f.file}:${f.line})`).join('\n')}
+    </failure>
+`;
+        }
+        junit += `  </testcase>
+</testsuite>`;
+        return junit;
+    }
+    /**
+     * Get default summary structure
+     */
+    getDefaultSummary() {
+        return {
+            total: 0,
+            critical: 0,
+            high: 0,
+            medium: 0,
+            low: 0,
+            info: 0
+        };
+    }
+    /**
+     * Get default thresholds
+     */
+    getDefaultThresholds(security) {
+        return {
+            sast_max_high: {
+                passed: true,
+                actual: 0,
+                budget: security?.sast?.max_high ?? 0
+            }
+        };
+    }
+    /**
+     * Check if Semgrep is available
+     */
+    static async isAvailable() {
+        return new Promise((resolve) => {
+            const child = spawn('semgrep', ['--version'], { stdio: 'pipe' });
+            child.on('close', (code) => {
+                resolve({
+                    available: code === 0,
+                    error: code !== 0 ? 'Semgrep not found. Install with: pip install semgrep' : undefined
+                });
+            });
+            child.on('error', () => {
+                resolve({
+                    available: false,
+                    error: 'Semgrep not found. Install with: pip install semgrep'
+                });
+            });
+        });
+    }
+    /**
+     * Validate SAST configuration
+     */
+    static validateConfig(config) {
+        const errors = [];
+        if (!config.workingDir || !existsSync(config.workingDir)) {
+            errors.push('SAST scan requires valid working directory');
+        }
+        if (config.paths) {
+            for (const path of config.paths) {
+                const fullPath = join(config.workingDir, path);
+                if (!existsSync(fullPath)) {
+                    errors.push(`SAST scan path not found: ${path}`);
+                }
+            }
+        }
+        if (config.configFile) {
+            const configPath = join(config.workingDir, config.configFile);
+            if (!existsSync(configPath)) {
+                errors.push(`Semgrep config file not found: ${config.configFile}`);
+            }
+        }
+        return {
+            valid: errors.length === 0,
+            errors
+        };
+    }
+}

package/dist/core/adapters/zap-dast.d.ts

@@ -0,0 +1,134 @@
+/**
+ * QA360 ZAP DAST Adapter (Sécurité Réelle)
+ * OWASP ZAP baseline scan for dynamic application security testing
+ */
+import { PackSecurity } from '../types/pack-v1.js';
+export interface ZapDastConfig {
+    targetUrl: string;
+    security?: PackSecurity;
+    timeout?: number;
+    scanType?: 'baseline' | 'full' | 'api';
+    contextFile?: string;
+    excludeUrls?: string[];
+    includeUrls?: string[];
+    authScript?: string;
+    configFile?: string;
+}
+export interface ZapAlert {
+    pluginid: string;
+    alertRef: string;
+    alert: string;
+    name: string;
+    riskcode: string;
+    confidence: string;
+    riskdesc: string;
+    desc: string;
+    instances: Array<{
+        uri: string;
+        method: string;
+        param: string;
+        attack: string;
+        evidence: string;
+        otherinfo: string;
+    }>;
+    count: string;
+    solution: string;
+    otherinfo: string;
+    reference: string;
+    cweid: string;
+    wascid: string;
+    sourceid: string;
+}
+export interface ZapDastResult {
+    success: boolean;
+    alerts: ZapAlert[];
+    summary: {
+        total: number;
+        high: number;
+        medium: number;
+        low: number;
+        informational: number;
+        by_category: Record<string, number>;
+    };
+    budgetCheck: {
+        high_passed: boolean;
+        critical_passed: boolean;
+        medium_passed: boolean;
+    };
+    targetUrl: string;
+    scanDuration: number;
+    error?: string;
+    rawOutput?: string;
+    reportPath?: string;
+    junit?: string;
+    errorCode?: string;
+}
+export declare class ZapDastAdapter {
+    private redactor;
+    private workingDir;
+    constructor(workingDir?: string);
+    /**
+     * Execute ZAP DAST scan
+     */
+    runDastScan(config: ZapDastConfig): Promise<ZapDastResult>;
+    /**
+     * Validate URL format
+     */
+    private isValidUrl;
+    /**
+     * Execute ZAP scanner
+     */
+    private executeZapScan;
+    /**
+     * Check if Docker should be used for ZAP
+     */
+    private shouldUseDocker;
+    /**
+     * Build ZAP command arguments
+     */
+    private buildZapArgs;
+    /**
+     * Parse ZAP scan results
+     */
+    private parseZapResults;
+    /**
+     * Fallback mock scan when ZAP not available
+     */
+    private fallbackMockScan;
+    /**
+     * Calculate alerts summary
+     */
+    private calculateSummary;
+    /**
+     * Generate budget check based on security config
+     */
+    private generateBudgetCheck;
+    /**
+     * Get empty summary structure
+     */
+    private getEmptySummary;
+    /**
+     * Get default budget check structure
+     */
+    private getDefaultBudgetCheck;
+    /**
+     * Generate JUnit XML report
+     */
+    private generateJUnit;
+    /**
+     * Validate ZAP scan configuration
+     */
+    static validateConfig(config: ZapDastConfig): {
+        valid: boolean;
+        errors: string[];
+    };
+    /**
+     * Check if ZAP is available (Docker or local)
+     */
+    static isAvailable(): Promise<{
+        available: boolean;
+        method?: 'docker' | 'local';
+        error?: string;
+    }>;
+}
+//# sourceMappingURL=zap-dast.d.ts.map

package/dist/core/adapters/zap-dast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zap-dast.d.ts","sourceRoot":"","sources":["../../../src/core/adapters/zap-dast.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGnD,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,KAAK,CAAC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,KAAK,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CAAC;IACH,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,QAAQ,EAAE,CAAC;IACnB,OAAO,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACrC,CAAC;IACF,WAAW,EAAE;QACX,WAAW,EAAE,OAAO,CAAC;QACrB,eAAe,EAAE,OAAO,CAAC;QACzB,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;IACF,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAmB;IACnC,OAAO,CAAC,UAAU,CAAS;gBAEf,UAAU,GAAE,MAAsB;IAK9C;;OAEG;IACG,WAAW,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAwChE;;OAEG;IACH,OAAO,CAAC,UAAU;IASlB;;OAEG;YACW,cAAc;IA6E5B;;OAEG;IACH,OAAO,CAAC,eAAe;IAWvB;;OAEG;IACH,OAAO,CAAC,YAAY;IAuDpB;;OAEG;IACH,OAAO,CAAC,eAAe;IAiEvB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAgBxB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IA+BxB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAU3B;;OAEG;IACH,OAAO,CAAC,eAAe;IAWvB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAQ7B;;OAEG;IACH,OAAO,CAAC,aAAa;IA0BrB;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE;IA2BlF;;OAEG;WACU,WAAW,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAuCzG"}