owasp-depscan 5.1.3__py3-none-any.whl → 5.1.5__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of owasp-depscan might be problematic. Click here for more details.
- depscan/cli.py +12 -93
- depscan/lib/analysis.py +325 -169
- depscan/lib/config.py +113 -5
- depscan/lib/csaf.py +1327 -1451
- depscan/lib/logger.py +8 -4
- depscan/lib/orasclient.py +127 -0
- {owasp_depscan-5.1.3.dist-info → owasp_depscan-5.1.5.dist-info}/METADATA +43 -4
- {owasp_depscan-5.1.3.dist-info → owasp_depscan-5.1.5.dist-info}/RECORD +12 -11
- {owasp_depscan-5.1.3.dist-info → owasp_depscan-5.1.5.dist-info}/LICENSE +0 -0
- {owasp_depscan-5.1.3.dist-info → owasp_depscan-5.1.5.dist-info}/WHEEL +0 -0
- {owasp_depscan-5.1.3.dist-info → owasp_depscan-5.1.5.dist-info}/entry_points.txt +0 -0
- {owasp_depscan-5.1.3.dist-info → owasp_depscan-5.1.5.dist-info}/top_level.txt +0 -0
depscan/lib/logger.py
CHANGED
|
@@ -35,7 +35,6 @@ console = Console(
|
|
|
35
35
|
log_time=False,
|
|
36
36
|
log_path=False,
|
|
37
37
|
theme=custom_theme,
|
|
38
|
-
width=int(os.getenv("COLUMNS", "270")),
|
|
39
38
|
color_system="256",
|
|
40
39
|
force_terminal=True,
|
|
41
40
|
highlight=True,
|
|
@@ -57,11 +56,16 @@ logging.basicConfig(
|
|
|
57
56
|
],
|
|
58
57
|
)
|
|
59
58
|
LOG = logging.getLogger(__name__)
|
|
60
|
-
for _ in ("httpx", "oras"):
|
|
61
|
-
logging.getLogger(_).disabled = True
|
|
62
59
|
|
|
63
60
|
# Set logging level
|
|
64
|
-
if
|
|
61
|
+
if (
|
|
62
|
+
os.getenv("SCAN_DEBUG_MODE") == "debug"
|
|
63
|
+
or os.getenv("AT_DEBUG_MODE") == "debug"
|
|
64
|
+
):
|
|
65
65
|
LOG.setLevel(logging.DEBUG)
|
|
66
66
|
|
|
67
67
|
DEBUG = logging.DEBUG
|
|
68
|
+
|
|
69
|
+
for log_name, log_obj in logging.Logger.manager.loggerDict.items():
|
|
70
|
+
if log_name != __name__:
|
|
71
|
+
log_obj.disabled = True
|
|
@@ -0,0 +1,127 @@
|
|
|
1
|
+
import os
|
|
2
|
+
import shutil
|
|
3
|
+
import subprocess
|
|
4
|
+
import tarfile
|
|
5
|
+
import tempfile
|
|
6
|
+
|
|
7
|
+
import oras.client
|
|
8
|
+
import oras.provider
|
|
9
|
+
from oras.logger import setup_logger
|
|
10
|
+
from vdb.lib.config import data_dir
|
|
11
|
+
|
|
12
|
+
from depscan.lib.config import vdb_database_url, vdb_rafs_database_url
|
|
13
|
+
from depscan.lib.logger import LOG
|
|
14
|
+
|
|
15
|
+
setup_logger(quiet=True, debug=False)
|
|
16
|
+
|
|
17
|
+
|
|
18
|
+
class VdbDistributionRegistry(oras.provider.Registry):
|
|
19
|
+
"""
|
|
20
|
+
We override the default registry to make things compatible with ghcr. Without this, the below error is thrown.
|
|
21
|
+
|
|
22
|
+
jsonschema.exceptions.ValidationError: Additional properties are not allowed ('artifactType' was unexpected)
|
|
23
|
+
"""
|
|
24
|
+
|
|
25
|
+
def get_manifest(self, container, allowed_media_type=None):
|
|
26
|
+
"""
|
|
27
|
+
Retrieve a manifest for a package.
|
|
28
|
+
|
|
29
|
+
:param container: parsed container URI
|
|
30
|
+
:type container: oras.container.Container or str
|
|
31
|
+
:param allowed_media_type: one or more allowed media types
|
|
32
|
+
:type allowed_media_type: str
|
|
33
|
+
"""
|
|
34
|
+
if not allowed_media_type:
|
|
35
|
+
allowed_media_type = [oras.defaults.default_manifest_media_type]
|
|
36
|
+
headers = {"Accept": ";".join(allowed_media_type)}
|
|
37
|
+
|
|
38
|
+
get_manifest = f"{self.prefix}://{container.manifest_url()}" # type: ignore
|
|
39
|
+
response = self.do_request(get_manifest, "GET", headers=headers)
|
|
40
|
+
self._check_200_response(response)
|
|
41
|
+
manifest = response.json()
|
|
42
|
+
return manifest
|
|
43
|
+
|
|
44
|
+
|
|
45
|
+
def download_rafs_based_image():
|
|
46
|
+
rafs_image_downloaded, paths_list = False, None
|
|
47
|
+
nydus_image_command = shutil.which("nydus-image", mode=os.X_OK)
|
|
48
|
+
if nydus_image_command is not None:
|
|
49
|
+
LOG.info(
|
|
50
|
+
"About to download the vulnerability database from %s. This might take a while ...",
|
|
51
|
+
vdb_rafs_database_url,
|
|
52
|
+
)
|
|
53
|
+
|
|
54
|
+
try:
|
|
55
|
+
oras_client = oras.client.OrasClient(
|
|
56
|
+
registry=VdbDistributionRegistry()
|
|
57
|
+
)
|
|
58
|
+
rafs_data_dir = tempfile.TemporaryDirectory()
|
|
59
|
+
paths_list = oras_client.pull(
|
|
60
|
+
target=vdb_rafs_database_url,
|
|
61
|
+
outdir=rafs_data_dir.name,
|
|
62
|
+
allowed_media_type=[],
|
|
63
|
+
overwrite=True,
|
|
64
|
+
)
|
|
65
|
+
|
|
66
|
+
if (
|
|
67
|
+
paths_list
|
|
68
|
+
and os.path.exists(
|
|
69
|
+
os.path.join(rafs_data_dir.name, "data.rafs")
|
|
70
|
+
)
|
|
71
|
+
and os.path.exists(
|
|
72
|
+
os.path.join(rafs_data_dir.name, "meta.rafs")
|
|
73
|
+
)
|
|
74
|
+
):
|
|
75
|
+
nydus_download_command = [
|
|
76
|
+
f"{nydus_image_command}",
|
|
77
|
+
"unpack",
|
|
78
|
+
"--blob",
|
|
79
|
+
os.path.join(rafs_data_dir.name, "data.rafs"),
|
|
80
|
+
"--output",
|
|
81
|
+
os.path.join(data_dir, "vdb.tar"),
|
|
82
|
+
"--bootstrap",
|
|
83
|
+
os.path.join(rafs_data_dir.name, "meta.rafs"),
|
|
84
|
+
]
|
|
85
|
+
_ = subprocess.run(
|
|
86
|
+
nydus_download_command,
|
|
87
|
+
check=True,
|
|
88
|
+
stdout=subprocess.DEVNULL,
|
|
89
|
+
stderr=subprocess.DEVNULL,
|
|
90
|
+
)
|
|
91
|
+
if os.path.exists(os.path.join(data_dir, "vdb.tar")):
|
|
92
|
+
rafs_image_downloaded = True
|
|
93
|
+
with tarfile.open(
|
|
94
|
+
os.path.join(data_dir, "vdb.tar"), "r"
|
|
95
|
+
) as tar:
|
|
96
|
+
tar.extractall(path=data_dir)
|
|
97
|
+
os.remove(os.path.join(data_dir, "vdb.tar"))
|
|
98
|
+
else:
|
|
99
|
+
raise FileNotFoundError("vdb.tar not found")
|
|
100
|
+
else:
|
|
101
|
+
raise FileNotFoundError("data.rafs or meta.rafs not found")
|
|
102
|
+
|
|
103
|
+
except Exception:
|
|
104
|
+
LOG.info(
|
|
105
|
+
"Unable to pull the vulnerability database (rafs image) from %s. Trying to pull the non-rafs-based VDB image.",
|
|
106
|
+
vdb_rafs_database_url,
|
|
107
|
+
)
|
|
108
|
+
rafs_image_downloaded = False
|
|
109
|
+
|
|
110
|
+
return rafs_image_downloaded, data_dir
|
|
111
|
+
|
|
112
|
+
|
|
113
|
+
def download_image():
|
|
114
|
+
rafs_image_downloaded, paths_list = download_rafs_based_image()
|
|
115
|
+
if rafs_image_downloaded:
|
|
116
|
+
return paths_list
|
|
117
|
+
LOG.info(
|
|
118
|
+
"About to download the vulnerability database from %s. This might take a while ...",
|
|
119
|
+
vdb_database_url,
|
|
120
|
+
)
|
|
121
|
+
oras_client = oras.client.OrasClient(registry=VdbDistributionRegistry())
|
|
122
|
+
return oras_client.pull(
|
|
123
|
+
target=vdb_database_url,
|
|
124
|
+
outdir=data_dir,
|
|
125
|
+
allowed_media_type=[],
|
|
126
|
+
overwrite=True,
|
|
127
|
+
)
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.1
|
|
2
2
|
Name: owasp-depscan
|
|
3
|
-
Version: 5.1.
|
|
3
|
+
Version: 5.1.5
|
|
4
4
|
Summary: Fully open-source security audit for project dependencies based on known vulnerabilities and advisories.
|
|
5
5
|
Author-email: Team AppThreat <cloud@appthreat.com>
|
|
6
6
|
License: MIT
|
|
@@ -20,7 +20,7 @@ Classifier: Topic :: Utilities
|
|
|
20
20
|
Requires-Python: >=3.8
|
|
21
21
|
Description-Content-Type: text/markdown
|
|
22
22
|
License-File: LICENSE
|
|
23
|
-
Requires-Dist: appthreat-vulnerability-db >=5.5.
|
|
23
|
+
Requires-Dist: appthreat-vulnerability-db >=5.5.8
|
|
24
24
|
Requires-Dist: defusedxml
|
|
25
25
|
Requires-Dist: oras
|
|
26
26
|
Requires-Dist: PyYAML
|
|
@@ -30,6 +30,8 @@ Requires-Dist: PyGithub
|
|
|
30
30
|
Requires-Dist: toml
|
|
31
31
|
Requires-Dist: pdfkit
|
|
32
32
|
Requires-Dist: Jinja2
|
|
33
|
+
Requires-Dist: packageurl-python
|
|
34
|
+
Requires-Dist: cvss
|
|
33
35
|
Provides-Extra: dev
|
|
34
36
|
Requires-Dist: black ; extra == 'dev'
|
|
35
37
|
Requires-Dist: flake8 ; extra == 'dev'
|
|
@@ -46,6 +48,38 @@ OWASP dep-scan is a next-generation security and risk audit tool based on known
|
|
|
46
48
|
[](https://github.com/owasp-dep-scan/dep-scan/actions/workflows/pythonpublish.yml)
|
|
47
49
|
[](https://discord.gg/pF4BYWEJcS)
|
|
48
50
|
|
|
51
|
+
## Contents
|
|
52
|
+
|
|
53
|
+
- [Features](#features)
|
|
54
|
+
- [Vulnerability Data sources](#vulnerability-data-sources)
|
|
55
|
+
- [Linux distros](#linux-distros)
|
|
56
|
+
- [Usage](#usage)
|
|
57
|
+
- [OCI Artifacts via ORAS cli](#oci-artifacts-via-oras-cli)
|
|
58
|
+
- [Single binary executables](#single-binary-executables)
|
|
59
|
+
- [Server mode](#server-mode)
|
|
60
|
+
- [Scanning projects locally (Python version)](#scanning-projects-locally-python-version)
|
|
61
|
+
- [Scanning containers locally (Python version)](#scanning-containers-locally-python-version)
|
|
62
|
+
- [Scanning projects locally (Docker container)](#scanning-projects-locally-docker-container)
|
|
63
|
+
- [Supported languages and package format](#supported-languages-and-package-format)
|
|
64
|
+
- [Reachability analysis](#reachability-analysis)
|
|
65
|
+
- [Example analysis for a Java project](#example-analysis-for-a-java-project)
|
|
66
|
+
- [Example analysis for a JavaScript project](#example-analysis-for-a-javascript-project)
|
|
67
|
+
- [Customization through environment variables](#customization-through-environment-variables)
|
|
68
|
+
- [GitHub Security Advisory](#github-security-advisory)
|
|
69
|
+
- [Suggest mode](#suggest-mode)
|
|
70
|
+
- [Package Risk audit](#package-risk-audit)
|
|
71
|
+
- [Automatic adjustment](#automatic-adjustment)
|
|
72
|
+
- [Configuring weights](#configuring-weights)
|
|
73
|
+
- [Live OS scan](#live-os-scan)
|
|
74
|
+
- [License scan](#license-scan)
|
|
75
|
+
- [Kubernetes and Cloud apps](#kubernetes-and-cloud-apps)
|
|
76
|
+
- [PDF reports](#pdf-reports)
|
|
77
|
+
- [Custom reports](#custom-reports)
|
|
78
|
+
- [Performance tuning](#performance-tuning)
|
|
79
|
+
- [Use nydus to speed up the initial vdb download](#use-nydus-to-speed-up-the-initial-vdb-download)
|
|
80
|
+
- [Discord support](#discord-support)
|
|
81
|
+
- [License](#license)
|
|
82
|
+
|
|
49
83
|
## Features
|
|
50
84
|
|
|
51
85
|
- Scan most application code - local repos, Linux container images, Kubernetes manifests, and OS - to identify known CVEs with prioritization
|
|
@@ -98,15 +132,18 @@ Use [ORAS cli](https://oras.land/docs/) to download the vulnerability database f
|
|
|
98
132
|
export VDB_HOME=depscan
|
|
99
133
|
mkdir -p $VDB_HOME
|
|
100
134
|
oras pull ghcr.io/appthreat/vdb:v5 -o $VDB_HOME
|
|
135
|
+
# oras pull ghcr.io/appthreat/vdb-10y:v5 -o $VDB_HOME
|
|
101
136
|
oras pull ghcr.io/owasp-dep-scan/depscan:v4 -o $VDB_HOME
|
|
102
137
|
```
|
|
103
138
|
|
|
139
|
+
Use `vdb-10y` which is a larger database with vulnerability data spanning the last 10 years from 2014. In contrast, vdb with a starting year of 2018 is appropriate for most users.
|
|
140
|
+
|
|
104
141
|
### Single binary executables
|
|
105
142
|
|
|
106
143
|
Download the executable binary for your operating system from the [releases page](https://github.com/owasp-dep-scan/depscan-bin/releases). These binary bundle the following:
|
|
107
144
|
|
|
108
|
-
- dep-scan with Python 3.
|
|
109
|
-
- cdxgen with Node.js
|
|
145
|
+
- dep-scan with Python 3.11
|
|
146
|
+
- cdxgen with Node.js 21
|
|
110
147
|
- cdxgen binary plugins
|
|
111
148
|
|
|
112
149
|
```bash
|
|
@@ -355,6 +392,8 @@ depscan --profile research -t js -i <source directory> --reports-dir <reports di
|
|
|
355
392
|
The following environment variables can be used to customise the behaviour.
|
|
356
393
|
|
|
357
394
|
- VDB_HOME - Directory to use for caching database. For docker based execution, this directory should get mounted as a volume from the host
|
|
395
|
+
- VDB_DATABASE_URL - Vulnerability DB URL. Defaults to: ghcr.io/appthreat/vdb:v5
|
|
396
|
+
- USE_VDB_10Y - Set to true to use the larger 10 year vulnerability database. Default download url: ghcr.io/appthreat/vdb-10y:v5
|
|
358
397
|
|
|
359
398
|
## GitHub Security Advisory
|
|
360
399
|
|
|
@@ -1,16 +1,17 @@
|
|
|
1
1
|
depscan/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
2
|
-
depscan/cli.py,sha256
|
|
2
|
+
depscan/cli.py,sha256=-dax3GEQOB2qoVZDi8v85IeP08ZBKbjEbwQWjyXGOWs,37332
|
|
3
3
|
depscan/lib/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
4
|
-
depscan/lib/analysis.py,sha256=
|
|
4
|
+
depscan/lib/analysis.py,sha256=PQveVwiPgxG1-th3lxuyzs-LZNyga0qBy7ZsoyuB1SI,56340
|
|
5
5
|
depscan/lib/audit.py,sha256=6GmHOkhDYY1LCIRd-wUSrSISh6_IFR5PhOopPJIQTeE,1318
|
|
6
6
|
depscan/lib/bom.py,sha256=Dkd8AX2ann6FhBeSMvSx86cuq9VEmNPss1Zlziy28aE,16306
|
|
7
|
-
depscan/lib/config.py,sha256=
|
|
8
|
-
depscan/lib/csaf.py,sha256=
|
|
7
|
+
depscan/lib/config.py,sha256=fxSXio_VhXAJ0HiYyLwtQn10kAm8t4VjoWg-eFcKiA8,14253
|
|
8
|
+
depscan/lib/csaf.py,sha256=B9aigxVn7fis_lF15wPfTgieADTcqYE-XDabTt281Ag,81724
|
|
9
9
|
depscan/lib/explainer.py,sha256=yRCEroeNCSj_bUQXqwUkLHV3l7eSJvTYoms9T1CDgGk,9282
|
|
10
10
|
depscan/lib/github.py,sha256=h6e_12xLwspXJbt_7lW6vuHaqgJQgyFSRCLrfUndCH4,1697
|
|
11
11
|
depscan/lib/license.py,sha256=y4-WZuD2MOunKaLd2EJGcSYP6s3Lp_dgssdzhcl9eEM,2332
|
|
12
|
-
depscan/lib/logger.py,sha256=
|
|
12
|
+
depscan/lib/logger.py,sha256=TZkxVN2a5g2g0nOlrIodJWaDhTFT6JLtR1vR4fPSMgs,1605
|
|
13
13
|
depscan/lib/normalize.py,sha256=iZZylivfc15lQo4_yU0d_8CWlOFUnAIa512PSH46yrQ,10643
|
|
14
|
+
depscan/lib/orasclient.py,sha256=MfbQXGf9g4NpfrqeuEy-YMzZA56Hc7TqyGG35hy55Qk,4495
|
|
14
15
|
depscan/lib/pkg_query.py,sha256=Hlf3LypsL7EF309HevcfhdjAOPDZbN1XRQOmjQpnxlI,20082
|
|
15
16
|
depscan/lib/utils.py,sha256=fAG6eTRqEvmmbPOsMBdgQzaKo4KWAYdijRgn-_MX6t8,14428
|
|
16
17
|
vendor/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
@@ -63,9 +64,9 @@ vendor/choosealicense.com/_licenses/vim.txt,sha256=d5GQjXB328L8EBkhKgxcjk344D3K7
|
|
|
63
64
|
vendor/choosealicense.com/_licenses/wtfpl.txt,sha256=BxXeubkvQm32MDmlZsBcbzJzBpR5kWgw0JxSR9d7f3k,948
|
|
64
65
|
vendor/choosealicense.com/_licenses/zlib.txt,sha256=e6dfCeLhxD3NCnIkY4cVIagRaWdRvencjNhHZ1APvpc,1678
|
|
65
66
|
vendor/spdx/json/licenses.json,sha256=_Vz_aACEg-giVk08ZBQLqB5Z3AnSWZmdD9I22ID3QNs,275192
|
|
66
|
-
owasp_depscan-5.1.
|
|
67
|
-
owasp_depscan-5.1.
|
|
68
|
-
owasp_depscan-5.1.
|
|
69
|
-
owasp_depscan-5.1.
|
|
70
|
-
owasp_depscan-5.1.
|
|
71
|
-
owasp_depscan-5.1.
|
|
67
|
+
owasp_depscan-5.1.5.dist-info/LICENSE,sha256=oQnCbnZtJ_NLDdOLc-rVY1D1N0RNWLHPpYXcc77xzSo,1073
|
|
68
|
+
owasp_depscan-5.1.5.dist-info/METADATA,sha256=2VrkxZGayUZUYJq41kBWGabC4IW2QZ0myJmFatNOYdo,27489
|
|
69
|
+
owasp_depscan-5.1.5.dist-info/WHEEL,sha256=oiQVh_5PnQM0E3gPdiz09WCNmwiHDMaGer_elqB3coM,92
|
|
70
|
+
owasp_depscan-5.1.5.dist-info/entry_points.txt,sha256=FxQKHFWZTfKU2eBxHPFRxwhSNexntYygYhquykS8zxA,69
|
|
71
|
+
owasp_depscan-5.1.5.dist-info/top_level.txt,sha256=qbHOZvNU2dXANv946hMdP2vOi0ESQB5t2ZY5ktKtXvQ,15
|
|
72
|
+
owasp_depscan-5.1.5.dist-info/RECORD,,
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|