snyk 1.977.0 → 1.978.0

package/dist/cli/917.index.js

@@ -3640,6 +3640,7 @@ const iac_output_1 = __webpack_require__(68145);
 const iac_output_2 = __webpack_require__(68145);
 const json_2 = __webpack_require__(27019);
 const errors_1 = __webpack_require__(87198);
+const sarif_1 = __webpack_require__(87999);
 function buildOutput({ scanResult, testSpinner, projectName, orgSettings, options, }) {
     if (scanResult.results) {
         testSpinner === null || testSpinner === void 0 ? void 0 : testSpinner.succeed(iac_output_1.spinnerSuccessMessage);
@@ -3647,18 +3648,37 @@ function buildOutput({ scanResult, testSpinner, projectName, orgSettings, option
     else {
         testSpinner === null || testSpinner === void 0 ? void 0 : testSpinner.stop();
     }
-    const response = buildTextOutput({ scanResult, projectName, orgSettings });
+    const { responseData, jsonData, sarifData } = buildTestCommandResultData({
+        scanResult,
+        projectName,
+        orgSettings,
+        options,
+    });
+    if (options.json || options.sarif) {
+        return types_1.TestCommandResult.createJsonTestCommandResult(responseData, jsonData, sarifData);
+    }
+    return types_1.TestCommandResult.createHumanReadableTestCommandResult(responseData, jsonData, sarifData);
+}
+exports.buildOutput = buildOutput;
+function buildTestCommandResultData({ scanResult, projectName, orgSettings, options, }) {
+    let responseData = '';
     const jsonData = json_2.jsonStringifyLargeObject(json_1.convertEngineToJsonResults({
         results: scanResult,
         projectName,
         orgSettings,
     }));
+    const sarifData = json_2.jsonStringifyLargeObject(sarif_1.convertEngineToSarifResults(scanResult));
     if (options.json) {
-        return types_1.TestCommandResult.createJsonTestCommandResult(jsonData, jsonData, '');
+        responseData = jsonData;
+    }
+    else if (options.sarif) {
+        responseData = sarifData;
     }
-    return types_1.TestCommandResult.createHumanReadableTestCommandResult(response, jsonData, '');
+    else {
+        responseData = buildTextOutput({ scanResult, projectName, orgSettings });
+    }
+    return { responseData, jsonData, sarifData };
 }
-exports.buildOutput = buildOutput;
 const SEPARATOR = '\n-------------------------------------------------------\n';
 function buildTextOutput({ scanResult, projectName, orgSettings, }) {
     let response = '';
@@ -3692,6 +3712,171 @@ function buildTextOutput({ scanResult, projectName, orgSettings, }) {
 }
 
 
+/***/ }),
+
+/***/ 87999:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.convertEngineToSarifResults = void 0;
+const url_1 = __webpack_require__(78835);
+const marked_1 = __webpack_require__(30970);
+const path = __webpack_require__(85622);
+const upperFirst = __webpack_require__(90039);
+const camelCase = __webpack_require__(76884);
+const version_1 = __webpack_require__(38217);
+const sarif_output_1 = __webpack_require__(5034);
+const git_1 = __webpack_require__(82421);
+// Used to reference the base path in results.
+const PROJECT_ROOT_KEY = 'PROJECTROOT';
+function convertEngineToSarifResults(scanResult) {
+    let repoRoot;
+    try {
+        repoRoot = git_1.getRepositoryRoot() + '/';
+    }
+    catch {
+        repoRoot = path.join(process.cwd(), '/'); // the slash at the end is required, otherwise the artifactLocation.uri starts with a slash
+    }
+    const tool = {
+        driver: {
+            name: 'Snyk IaC',
+            fullName: 'Snyk Infrastructure as Code',
+            version: version_1.getVersion(),
+            informationUri: 'https://docs.snyk.io/products/snyk-infrastructure-as-code',
+            rules: extractReportingDescriptor(scanResult.results),
+        },
+    };
+    return {
+        $schema: 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json',
+        version: '2.1.0',
+        runs: [
+            {
+                // https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html#_Toc34317498
+                originalUriBaseIds: {
+                    [PROJECT_ROOT_KEY]: {
+                        uri: url_1.pathToFileURL(repoRoot).href,
+                        description: {
+                            text: 'The root directory for all project files.',
+                        },
+                    },
+                },
+                tool,
+                automationDetails: {
+                    id: 'snyk-iac',
+                },
+                results: mapSnykIacTestResultsToSarifResults(scanResult.results),
+            },
+        ],
+    };
+}
+exports.convertEngineToSarifResults = convertEngineToSarifResults;
+function extractReportingDescriptor(results) {
+    const rules = {};
+    if (!(results === null || results === void 0 ? void 0 : results.vulnerabilities)) {
+        return Object.values(rules);
+    }
+    results.vulnerabilities.forEach((vulnerability) => {
+        if (rules[vulnerability.rule.id]) {
+            return;
+        }
+        const tags = ['security']; // switch to rules.labels once `snyk-iac-test` includes this info
+        rules[vulnerability.rule.id] = {
+            id: vulnerability.rule.id,
+            name: upperFirst(camelCase(vulnerability.rule.title)).replace(/ /g, ''),
+            shortDescription: {
+                text: `${upperFirst(vulnerability.severity)} severity - ${vulnerability.rule.title}`,
+            },
+            fullDescription: {
+                text: vulnerability.rule.description,
+            },
+            help: {
+                text: renderMarkdown(vulnerability.remediation),
+                markdown: vulnerability.remediation,
+            },
+            defaultConfiguration: {
+                level: sarif_output_1.getIssueLevel(vulnerability.severity),
+            },
+            properties: {
+                tags,
+                problem: {
+                    severity: vulnerability.severity,
+                },
+            },
+            helpUri: `https://snyk.io/security-rules/${vulnerability.rule.id}`,
+        };
+    });
+    return Object.values(rules);
+}
+function renderMarkdown(markdown) {
+    const renderer = {
+        em(text) {
+            return text;
+        },
+        strong(text) {
+            return text;
+        },
+        link(text) {
+            return text;
+        },
+        blockquote(quote) {
+            return quote;
+        },
+        list(body) {
+            return body;
+        },
+        listitem(text) {
+            return text;
+        },
+        paragraph(text) {
+            return text;
+        },
+        codespan(text) {
+            return text;
+        },
+        code(code) {
+            return code;
+        },
+        heading(text) {
+            return `${text}\n`;
+        },
+    };
+    marked_1.marked.use({ renderer });
+    return marked_1.marked.parse(markdown);
+}
+function mapSnykIacTestResultsToSarifResults(results) {
+    const result = [];
+    if (!(results === null || results === void 0 ? void 0 : results.vulnerabilities)) {
+        return result;
+    }
+    results.vulnerabilities.forEach((vulnerability) => {
+        result.push({
+            ruleId: vulnerability.rule.id,
+            message: {
+                text: `This line contains a potential ${vulnerability.severity} severity misconfiguration`,
+            },
+            locations: [
+                {
+                    physicalLocation: {
+                        artifactLocation: {
+                            uri: vulnerability.resource.file,
+                            uriBaseId: PROJECT_ROOT_KEY,
+                        },
+                        // We exclude the `region` key when the line number is missing or -1.
+                        // https://docs.oasis-open.org/sarif/sarif/v2.0/csprd02/sarif-v2.0-csprd02.html#_Toc10127873
+                        region: {
+                            startLine: vulnerability.resource.line,
+                        },
+                    },
+                },
+            ],
+        });
+    });
+    return result;
+}
+
+
 /***/ }),
 
 /***/ 50277: