corgea-cli 1.14.1__tar.gz → 1.14.2__tar.gz

{corgea_cli-1.14.1 → corgea_cli-1.14.2}/Cargo.lock

@@ -369,7 +369,7 @@ checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
 name = "corgea"
-version = "1.14.1"
+version = "1.14.2"
 dependencies = [
  "chrono",
  "clap",

{corgea_cli-1.14.1 → corgea_cli-1.14.2}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "corgea"
-version = "1.14.1"
+version = "1.14.2"
 edition = "2021"
 readme = "README.md"
 

{corgea_cli-1.14.1 → corgea_cli-1.14.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: corgea-cli
-Version: 1.14.1
+Version: 1.14.2
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers

{corgea_cli-1.14.1 → corgea_cli-1.14.2}/src/main.rs

@@ -16,6 +16,7 @@ mod scanners {
     pub mod blast;
     pub mod fortify;
     pub mod parsers;
+    pub mod report_paths;
 }
 mod utils {
     pub mod api;

{corgea_cli-1.14.1 → corgea_cli-1.14.2}/src/scan.rs

@@ -1,6 +1,7 @@
 use crate::cicd::*;
 use crate::log::debug;
 use crate::scanners::parsers::ScanParserFactory;
+use crate::scanners::report_paths;
 use crate::{utils, Config};
 use reqwest::header;
 use reqwest::Method;
@@ -58,14 +59,46 @@ fn find_corgea_policy_files(root: &Path) -> Vec<String> {
     found
 }
 
-fn merge_corgea_policy_files(mut paths: Vec<String>, root: &Path) -> Vec<String> {
+/// One file to send to `code-upload`.
+struct SourceUpload {
+    /// Sent as `path=`, exactly as the report wrote it. The engine matches the
+    /// report's paths against this, so it stays as written even when the file
+    /// itself was found somewhere else.
+    report_path: String,
+    /// Where the file actually is on this machine.
+    local_path: PathBuf,
+}
+
+/// Pair every path a report names with the file to read for it, and append the
+/// repo's `corgea.yaml` policy files.
+///
+/// The prefix search runs on the report's paths alone, before the policy files
+/// are added: those are found by walking `root`, so they always resolve, and
+/// one of them counting as a path that "already resolves" would call off the
+/// search for a report that matches nothing.
+fn plan_source_uploads(root: &Path, report_paths: &[String]) -> Vec<SourceUpload> {
+    let prefix = report_paths::find_report_path_prefix(root, report_paths);
+
+    let mut uploads: Vec<SourceUpload> = report_paths
+        .iter()
+        .map(|path| SourceUpload {
+            report_path: path.clone(),
+            local_path: report_paths::local_report_path(root, path, &prefix),
+        })
+        .collect();
+
     for yaml in find_corgea_policy_files(root) {
-        if !paths.iter().any(|path| path == &yaml) {
-            debug(&format!("Including repo policy file: {yaml}"));
-            paths.push(yaml);
+        if uploads.iter().any(|upload| upload.report_path == yaml) {
+            continue;
         }
+        debug(&format!("Including repo policy file: {yaml}"));
+        uploads.push(SourceUpload {
+            local_path: root.join(&yaml),
+            report_path: yaml,
+        });
     }
-    paths
+
+    uploads
 }
 
 pub fn run_command(base_cmd: &String, mut command: Command) -> String {
@@ -281,7 +314,7 @@ pub fn upload_scan(
     project_name: Option<String>,
 ) -> Option<ScanUploadResult> {
     let cwd = std::env::current_dir().unwrap_or_else(|_| PathBuf::from("."));
-    let paths = merge_corgea_policy_files(paths, &cwd);
+    let uploads = plan_source_uploads(&cwd, &paths);
     let in_ci = running_in_ci();
     let ci_platform = which_ci();
     let github_env_vars = get_github_env_vars();
@@ -331,11 +364,23 @@ pub fn upload_scan(
     let mut upload_error_count = 0;
     let mut platform_declined = false;
 
-    'files: for path in &paths {
-        if !Path::new(&path).exists() {
+    'files: for upload in &uploads {
+        let path = &upload.report_path;
+        let fp = upload.local_path.as_path();
+
+        if !fp.exists() {
+            // Name where the file was looked for whenever that is not the path
+            // in the report, so a prefix that resolved most of the report but
+            // not this path is visible rather than mystifying.
+            let looked_in = if fp.as_os_str() == path.as_str() {
+                String::new()
+            } else {
+                format!(" (looked for it at '{}')", fp.display())
+            };
             log::error!(
-                "Required file {} not found which is required for the scan, exiting.",
-                path
+                "Required file {}{} not found which is required for the scan, exiting.",
+                path,
+                looked_in
             );
             std::process::exit(1);
         }
@@ -349,7 +394,6 @@ pub fn upload_scan(
             base_url, api_base, run_id, path
         );
         debug(&format!("Uploading file: {}", path));
-        let fp = Path::new(&path);
 
         let mut attempts = 0;
         let mut success = false;
@@ -419,7 +463,7 @@ pub fn upload_scan(
     // Everything the aborted walk never attempted still counts as unsent, or
     // the closing summary would report one failure for a whole skipped tree.
     if platform_declined {
-        let distinct: HashSet<&String> = paths.iter().collect();
+        let distinct: HashSet<&String> = uploads.iter().map(|upload| &upload.report_path).collect();
         let unsent = distinct.len() - uploaded_paths.len();
         upload_error_count += unsent;
         log::warn!(
@@ -788,21 +832,109 @@ mod tests {
         );
     }
 
+    fn planned(root: &Path, report_paths: &[&str]) -> Vec<(String, String)> {
+        plan_source_uploads(
+            root,
+            &report_paths
+                .iter()
+                .map(|path| path.to_string())
+                .collect::<Vec<_>>(),
+        )
+        .into_iter()
+        .map(|upload| {
+            (
+                upload.report_path,
+                upload.local_path.to_string_lossy().into_owned(),
+            )
+        })
+        .collect()
+    }
+
     #[test]
-    fn merge_corgea_policy_files_appends_missing_and_skips_duplicates() {
+    fn plan_source_uploads_appends_policy_files_and_skips_duplicates() {
         let root = tempfile::tempdir().unwrap();
         write_policy(&root.path().join("corgea.yaml"));
+        let policy = root
+            .path()
+            .join("corgea.yaml")
+            .to_string_lossy()
+            .into_owned();
 
         assert_eq!(
-            merge_corgea_policy_files(vec!["src/source.py".into()], root.path()),
-            vec!["src/source.py".to_string(), "corgea.yaml".to_string()]
+            planned(root.path(), &["src/source.py"]),
+            vec![
+                ("src/source.py".to_string(), "src/source.py".to_string()),
+                ("corgea.yaml".to_string(), policy.clone()),
+            ]
+        );
+        assert_eq!(
+            planned(root.path(), &["src/source.py", "corgea.yaml"]),
+            vec![
+                ("src/source.py".to_string(), "src/source.py".to_string()),
+                ("corgea.yaml".to_string(), "corgea.yaml".to_string()),
+            ]
+        );
+    }
+
+    /// Only the file read from disk is rebased. `path=` keeps the report's own
+    /// path, because that is what the engine matches the report against.
+    #[test]
+    fn plan_source_uploads_rebases_the_local_file_but_not_the_uploaded_path() {
+        let root = tempfile::tempdir().unwrap();
+        for path in ["src/a.py", "src/b.py"] {
+            std::fs::create_dir_all(root.path().join(path).parent().unwrap()).unwrap();
+            std::fs::write(root.path().join(path), "x = 1\n").unwrap();
+        }
+
+        assert_eq!(
+            planned(
+                root.path(),
+                &["/builds/acme/repo/src/a.py", "/builds/acme/repo/src/b.py"]
+            ),
+            vec![
+                (
+                    "/builds/acme/repo/src/a.py".to_string(),
+                    root.path().join("src/a.py").to_string_lossy().into_owned(),
+                ),
+                (
+                    "/builds/acme/repo/src/b.py".to_string(),
+                    root.path().join("src/b.py").to_string_lossy().into_owned(),
+                ),
+            ]
+        );
+    }
+
+    /// A policy file found by walking the root always exists, so letting one
+    /// into the prefix search would report the whole report as already
+    /// matching and call the search off.
+    #[test]
+    fn plan_source_uploads_settles_the_prefix_before_adding_policy_files() {
+        let root = tempfile::tempdir().unwrap();
+        write_policy(&root.path().join("corgea.yaml"));
+        for path in ["src/a.py", "src/b.py"] {
+            std::fs::create_dir_all(root.path().join(path).parent().unwrap()).unwrap();
+            std::fs::write(root.path().join(path), "x = 1\n").unwrap();
+        }
+
+        let plan = planned(root.path(), &["ci/src/a.py", "ci/src/b.py"]);
+
+        assert_eq!(
+            plan[0],
+            (
+                "ci/src/a.py".to_string(),
+                root.path().join("src/a.py").to_string_lossy().into_owned(),
+            )
         );
         assert_eq!(
-            merge_corgea_policy_files(
-                vec!["src/source.py".into(), "corgea.yaml".into()],
+            plan[2],
+            (
+                "corgea.yaml".to_string(),
                 root.path()
+                    .join("corgea.yaml")
+                    .to_string_lossy()
+                    .into_owned(),
             ),
-            vec!["src/source.py".to_string(), "corgea.yaml".to_string()]
+            "the policy file is read from the root, never through the report's prefix"
         );
     }
 }

{corgea_cli-1.14.1 → corgea_cli-1.14.2}/src/scanners/fortify.rs

@@ -1,8 +1,9 @@
 use crate::scan::{upload_scan, ScanUploadResult};
 use crate::Config;
-use quick_xml::events::Event;
+use quick_xml::events::{BytesStart, Event};
 use quick_xml::reader::Reader;
 use quick_xml::XmlVersion;
+use std::collections::HashSet;
 use std::fs::File;
 use std::io;
 use std::io::{BufReader, Read};
@@ -68,6 +69,15 @@ pub fn parse(
     result
 }
 
+/// The raw FVDL and the source files the engine will look up for it.
+///
+/// A vulnerability can carry several `SourceLocation`s, where the earlier ones
+/// are the enclosing scope and only the last is the finding itself, and the
+/// engine reads that last one only. The earlier ones can sit in an unrelated
+/// tree -- Fortify records its own bundled libraries under
+/// `AppData/Local/Fortify/.../_fortify_libraries_/` -- which is not on the
+/// machine running the CLI, so collecting them aborted the upload of a report
+/// whose real files were all present.
 fn extract_file_path(scan_file: PathBuf) -> (String, Vec<String>) {
     let mut paths: Vec<String> = Vec::new();
 
@@ -84,6 +94,9 @@ fn extract_file_path(scan_file: PathBuf) -> (String, Vec<String>) {
 
     let mut buf = Vec::new();
     let mut in_vulnerability = false;
+    let mut seen = HashSet::new();
+    // The last SourceLocation seen in the current Vulnerability.
+    let mut selected: Option<String> = None;
 
     loop {
         match xml_reader.read_event_into(&mut buf) {
@@ -94,48 +107,15 @@ fn extract_file_path(scan_file: PathBuf) -> (String, Vec<String>) {
                 if tag_name == b"Vulnerability" {
                     in_vulnerability = true;
                 } else if tag_name == b"SourceLocation" && in_vulnerability {
-                    for attr_result in e.attributes() {
-                        match attr_result {
-                            Ok(attr) => {
-                                let attr_key = attr.key.as_ref();
-                                if attr_key == b"path" {
-                                    if let Ok(value) =
-                                        attr.normalized_value(XmlVersion::Implicit1_0)
-                                    {
-                                        let path_str = value.to_string();
-                                        if !paths.contains(&path_str) {
-                                            paths.push(path_str);
-                                        }
-                                    }
-                                }
-                            }
-                            Err(e) => println!("Error processing attribute: {}", e),
-                        }
+                    if let Some(path) = source_location_path(e) {
+                        selected = Some(path);
                     }
                 }
             }
             Ok(Event::Empty(ref e)) => {
-                let e_name = e.name();
-                let tag_name = e_name.as_ref();
-
-                if tag_name == b"SourceLocation" && in_vulnerability {
-                    for attr_result in e.attributes() {
-                        match attr_result {
-                            Ok(attr) => {
-                                let attr_key = attr.key.as_ref();
-                                if attr_key == b"path" {
-                                    if let Ok(value) =
-                                        attr.normalized_value(XmlVersion::Implicit1_0)
-                                    {
-                                        let path_str = value.to_string();
-                                        if !paths.contains(&path_str) {
-                                            paths.push(path_str);
-                                        }
-                                    }
-                                }
-                            }
-                            Err(e) => println!("Error processing attribute: {}", e),
-                        }
+                if e.name().as_ref() == b"SourceLocation" && in_vulnerability {
+                    if let Some(path) = source_location_path(e) {
+                        selected = Some(path);
                     }
                 }
             }
@@ -145,6 +125,12 @@ fn extract_file_path(scan_file: PathBuf) -> (String, Vec<String>) {
 
                 if tag_name == b"Vulnerability" {
                     in_vulnerability = false;
+
+                    if let Some(path) = selected.take() {
+                        if seen.insert(path.clone()) {
+                            paths.push(path);
+                        }
+                    }
                 }
             }
             Ok(Event::Eof) => break,
@@ -157,6 +143,23 @@ fn extract_file_path(scan_file: PathBuf) -> (String, Vec<String>) {
     (contents, paths)
 }
 
+/// The `path` attribute of a `SourceLocation`, with XML entities resolved.
+fn source_location_path(element: &BytesStart) -> Option<String> {
+    for attr_result in element.attributes() {
+        match attr_result {
+            Ok(attr) if attr.key.as_ref() == b"path" => {
+                if let Ok(value) = attr.normalized_value(XmlVersion::Implicit1_0) {
+                    return Some(value.to_string());
+                }
+            }
+            Ok(_) => {}
+            Err(e) => println!("Error processing attribute: {}", e),
+        }
+    }
+
+    None
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -176,6 +179,8 @@ mod tests {
   <Vulnerabilities>
     <Vulnerability>
       <SourceLocation path="src/start/a&amp;b.java"></SourceLocation>
+    </Vulnerability>
+    <Vulnerability>
       <SourceLocation path="src/empty/App.java" line="42"/>
     </Vulnerability>
     <Vulnerability>
@@ -204,4 +209,29 @@ mod tests {
              ignores the out-of-scope SourceLocation, and de-duplicates"
         );
     }
+
+    /// The engine reads the last SourceLocation of a vulnerability and no
+    /// other, so the earlier ones must not be uploaded: they can name Fortify's
+    /// own bundled libraries, which are not on the machine running the CLI and
+    /// used to abort the upload before any file was sent.
+    #[test]
+    fn extract_file_path_keeps_only_the_location_the_finding_is_reported_at() {
+        let fvdl = r#"<?xml version="1.0" encoding="UTF-8"?>
+<FVDL>
+  <Vulnerabilities>
+    <Vulnerability>
+      <SourceLocation path="C:/Users/dev/AppData/Local/Fortify/_fortify_libraries_/node/fs.d.ts" line="1"/>
+      <SourceLocation path="src/App.java" line="42"/>
+    </Vulnerability>
+  </Vulnerabilities>
+</FVDL>"#;
+
+        let mut tmp = tempfile::NamedTempFile::new().expect("create temp fvdl");
+        tmp.write_all(fvdl.as_bytes()).expect("write fvdl");
+        tmp.flush().expect("flush fvdl");
+
+        let (_, paths) = extract_file_path(tmp.path().to_path_buf());
+
+        assert_eq!(paths, vec!["src/App.java".to_string()]);
+    }
 }