owasp-depscan 4.2.7__py3-none-any.whl → 4.3.0__py3-none-any.whl

depscan/cli.py

@@ -4,6 +4,7 @@
 import argparse
 import json
 import os
+import sys
 import tempfile
 
 from quart import Quart, request
@@ -11,7 +12,6 @@ from rich.panel import Panel
 from rich.terminal_theme import MONOKAI
 from vdb.lib import config
 from vdb.lib import db as db_lib
-from vdb.lib.aqua import AquaSource
 from vdb.lib.config import data_dir
 from vdb.lib.gha import GitHubSource
 from vdb.lib.nvd import NvdSource
@@ -20,6 +20,7 @@ from vdb.lib.utils import parse_purl
 
 import oras.client
 
+from depscan.lib.csaf import export_csaf, write_toml
 from depscan.lib import privado, utils
 from depscan.lib.analysis import (
     PrepareVexOptions,
@@ -31,8 +32,18 @@ from depscan.lib.analysis import (
     summary_stats,
 )
 from depscan.lib.audit import audit, risk_audit, risk_audit_map, type_audit_map
-from depscan.lib.bom import create_bom, get_pkg_by_type, get_pkg_list, submit_bom
-from depscan.lib.config import UNIVERSAL_SCAN_TYPE, license_data_dir, spdx_license_list, vdb_database_url
+from depscan.lib.bom import (
+    create_bom,
+    get_pkg_by_type,
+    get_pkg_list,
+    submit_bom,
+)
+from depscan.lib.config import (
+    UNIVERSAL_SCAN_TYPE,
+    license_data_dir,
+    spdx_license_list,
+    vdb_database_url,
+)
 from depscan.lib.license import build_license_data, bulk_lookup
 from depscan.lib.logger import LOG, console
 from depscan.lib.utils import get_version
@@ -77,7 +88,15 @@ def build_args():
         action="store_true",
         default=False,
         dest="cache",
-        help="Cache vulnerability information in platform specific " "user_data_dir",
+        help="Cache vulnerability information in platform specific "
+        "user_data_dir",
+    )
+    parser.add_argument(
+        "--csaf",
+        action="store_true",
+        default=False,
+        dest="csaf",
+        help="Generate a CSAF",
     )
     parser.add_argument(
         "--sync",
@@ -92,12 +111,15 @@ def build_args():
         action="store_true",
         default=True,
         dest="suggest",
-        help="DEPRECATED: Suggest is the default mode for determining fix " "version.",
+        help="DEPRECATED: Suggest is the default mode for determining fix "
+        "version.",
     )
     parser.add_argument(
         "--risk-audit",
         action="store_true",
-        default=True if os.getenv("ENABLE_OSS_RISK", "") in ["true", "1"] else False,
+        default=True
+        if os.getenv("ENABLE_OSS_RISK", "") in ["true", "1"]
+        else False,
         dest="risk_audit",
         help="Perform package risk audit (slow operation). Npm only.",
     )
@@ -137,7 +159,9 @@ def build_args():
     )
     parser.add_argument(
         "--reports-dir",
-        default=os.getenv("DEPSCAN_REPORTS_DIR", os.path.join(os.getcwd(), "reports")),
+        default=os.getenv(
+            "DEPSCAN_REPORTS_DIR", os.path.join(os.getcwd(), "reports")
+        ),
         dest="reports_dir",
         help="Reports directory",
     )
@@ -264,7 +288,9 @@ def scan(db, project_type, pkg_list, suggest_mode):
         LOG.debug("Empty package search attempted!")
     else:
         LOG.debug("Scanning %d oss dependencies for issues", len(pkg_list))
-    results, pkg_aliases, purl_aliases = utils.search_pkgs(db, project_type, pkg_list)
+    results, pkg_aliases, purl_aliases = utils.search_pkgs(
+        db, project_type, pkg_list
+    )
     # pkg_aliases is a dict that can be used to find the original vendor and
     # package name This way we consistently use the same names used by the
     # caller irrespective of how the result was obtained
@@ -321,7 +347,9 @@ def scan(db, project_type, pkg_list, suggest_mode):
                 "Re-checking our suggestion to ensure there are no further "
                 "vulnerabilities"
             )
-            override_results, _, _ = utils.search_pkgs(db, project_type, sug_pkg_list)
+            override_results, _, _ = utils.search_pkgs(
+                db, project_type, sug_pkg_list
+            )
             if override_results:
                 new_sug_dict = suggest_version(override_results)
                 LOG.debug("Received override results: %s", new_sug_dict)
@@ -427,7 +455,7 @@ def summarise(
                                 bom_data["services"] = []
                             bom_data["services"].insert(0, pservice)
                     with open(vex_file, mode="w", encoding="utf-8") as vexfp:
-                        json.dump(bom_data, vexfp)
+                        json.dump(bom_data, vexfp, indent=4)
                         LOG.info("VEX file %s generated successfully", vex_file)
         except Exception:
             LOG.warning("Unable to generate VEX file for this scan")
@@ -453,8 +481,8 @@ async def cache():
     db = db_lib.get()
     if not db_lib.index_count(db["index_file"]):
         oras_client = oras.client.OrasClient()
-        paths_list = oras_client.pull(target = vdb_database_url, outdir = data_dir)
-        LOG.debug(f'VDB data is stored at: {paths_list}')
+        paths_list = oras_client.pull(target=vdb_database_url, outdir=data_dir)
+        LOG.debug(f"VDB data is stored at: {paths_list}")
         return {
             "error": "false",
             "message": "vulnerability database cached successfully",
@@ -551,7 +579,8 @@ async def run_scan():
         else:
             return {
                 "error": "true",
-                "message": "Unable to generate SBoM. Check your input path or " "url.",
+                "message": "Unable to generate SBoM. Check your input path or "
+                "url.",
             }, 500
 
 
@@ -562,7 +591,9 @@ def run_server(args):
     :param args: Command line arguments passed to the function.
     """
     print(at_logo)
-    console.print(f"Depscan server running on {args.server_host}:{args.server_port}")
+    console.print(
+        f"Depscan server running on {args.server_host}:{args.server_port}"
+    )
     app.config["CDXGEN_SERVER_URL"] = args.cdxgen_server
     app.run(
         host=args.server_host,
@@ -583,9 +614,24 @@ def main():
     if not args.no_banner:
         print(at_logo)
     src_dir = args.src_dir_image
-    if not src_dir:
+    if not src_dir or src_dir == ".":
         src_dir = os.getcwd()
     reports_dir = args.reports_dir
+    if args.csaf:
+        toml_file_path = os.path.join(src_dir, "csaf.toml")
+        if not os.path.exists(toml_file_path):
+            LOG.info("CSAF toml not found, creating template in %s", src_dir)
+            write_toml(toml_file_path)
+            LOG.info(
+                "Please fill out the toml with your details and rerun depscan."
+            )
+            LOG.info("Check out our CSAF documentation for an explanation of "
+                     "this feature. https://github.com/owasp-dep-scan/dep-scan"
+                     "/blob/master/contrib/CSAF_README.md")
+            LOG.info("If you're just checking out how our generator works, "
+                     "feel free to skip filling out the toml and just rerun "
+                     "depscan.")
+            sys.exit(0)
     # Detect the project types and perform the right type of scan
     if args.project_type:
         project_types_list = args.project_type.split(",")
@@ -623,7 +669,9 @@ def main():
     for project_type in project_types_list:
         results = []
         report_file = areport_file.replace(".json", f"-{project_type}.json")
-        risk_report_file = areport_file.replace(".json", f"-risk.{project_type}.json")
+        risk_report_file = areport_file.replace(
+            ".json", f"-risk.{project_type}.json"
+        )
         LOG.info("=" * 80)
         if args.bom and os.path.exists(args.bom):
             bom_file = args.bom
@@ -660,7 +708,9 @@ def main():
             license_report_file = os.path.join(
                 reports_dir, "license-" + project_type + ".json"
             )
-            analyse_licenses(project_type, licenses_results, license_report_file)
+            analyse_licenses(
+                project_type, licenses_results, license_report_file
+            )
         if project_type in risk_audit_map:
             if args.risk_audit:
                 console.print(
@@ -708,14 +758,16 @@ def main():
             try:
                 audit_results = audit(project_type, pkg_list)
                 if audit_results:
-                    LOG.debug("Remote audit yielded %d results", len(audit_results))
+                    LOG.debug(
+                        "Remote audit yielded %d results", len(audit_results)
+                    )
                     results = results + audit_results
             except Exception as e:
                 LOG.error("Remote audit was not successful")
                 LOG.error(e)
                 results = []
-        # In case of docker, bom, or universal type, check if there are any npm packages that can be
-        # audited remotely
+        # In case of docker, bom, or universal type, check if there are any
+        # npm packages that can be audited remotely
         if project_type in ("podman", "docker", "oci", "bom", "universal"):
             npm_pkg_list = get_pkg_by_type(pkg_list, "npm")
             if npm_pkg_list:
@@ -734,15 +786,23 @@ def main():
         if not db_lib.index_count(db["index_file"]):
             run_cacher = True
         else:
-            LOG.debug("Vulnerability database loaded from %s", config.vdb_bin_file)
+            LOG.debug(
+                "Vulnerability database loaded from %s", config.vdb_bin_file
+            )
 
         sources_list = [OSVSource(), NvdSource()]
         if os.environ.get("GITHUB_TOKEN"):
             sources_list.insert(0, GitHubSource())
         if run_cacher:
+            LOG.debug(
+                "About to download vdb from %s. This might take a while ...",
+                vdb_database_url,
+            )
             oras_client = oras.client.OrasClient()
-            paths_list = oras_client.pull(target = vdb_database_url, outdir = data_dir)
-            LOG.debug(f'VDB data is stored at: {paths_list}')
+            paths_list = oras_client.pull(
+                target=vdb_database_url, outdir=data_dir
+            )
+            LOG.debug("VDB data is stored at: %s", paths_list)
             run_cacher = False
         elif args.sync:
             for s in sources_list:
@@ -758,7 +818,12 @@ def main():
             db, project_type, pkg_list, args.suggest
         )
         if vdb_results:
-            results = results + vdb_results
+            results += vdb_results
+        if args.csaf:
+            new_res = []
+            for r in results:
+                new_res.append(r.to_dict())
+            export_csaf(new_res, src_dir, reports_dir)
         # Summarise and print results
         summarise(
             project_type,

depscan/lib/bom.py

@@ -38,7 +38,7 @@ def exec_tool(args, cwd=None, stdout=subprocess.PIPE):
             stderr=subprocess.STDOUT,
             cwd=cwd,
             env=os.environ.copy(),
-            shell=False,
+            shell=True if sys.platform == "win32" else False,
             encoding="utf-8",
         )
         LOG.debug(cp.stdout)
@@ -245,8 +245,8 @@ def resource_path(relative_path):
     return os.path.join(base_path, relative_path)
 
 
-def exec_cdxgen(bin=True):
-    if bin:
+def exec_cdxgen(use_bin=True):
+    if use_bin:
         cdxgen_cmd = os.environ.get("CDXGEN_CMD", "cdxgen")
         if not shutil.which(cdxgen_cmd):
             local_bin = resource_path(
@@ -269,7 +269,8 @@ def exec_cdxgen(bin=True):
                 return cdxgen_cmd
             except Exception:
                 return None
-
+        else:
+            return cdxgen_cmd
     else:
         # cdxgen_cmd = (
         #     os.environ.get("CDXGEN_CMD", "cdxgen")