owasp-depscan 5.1.7__tar.gz → 5.2.0__tar.gz

{owasp-depscan-5.1.7/owasp_depscan.egg-info → owasp-depscan-5.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: owasp-depscan
-Version: 5.1.7
+Version: 5.2.0
 Summary: Fully open-source security audit for project dependencies based on known vulnerabilities and advisories.
 Author-email: Team AppThreat <cloud@appthreat.com>
 License: MIT

{owasp-depscan-5.1.7 → owasp-depscan-5.2.0}/depscan/cli.py

@@ -727,7 +727,14 @@ def main():
     """
     args = build_args()
     # declare variables that get initialized only conditionally
-    summary, vdr_file, bom_file, pkg_list, pkg_vulnerabilities, pkg_group_rows = None, None, None, None, None, None
+    (
+        summary,
+        vdr_file,
+        bom_file,
+        pkg_list,
+        pkg_vulnerabilities,
+        pkg_group_rows,
+    ) = (None, None, None, None, None, None)
     # Should we turn on the debug mode
     if args.enable_debug:
         os.environ["AT_DEBUG_MODE"] = "debug"
@@ -738,7 +745,11 @@ def main():
         print(LOGO)
     src_dir = args.src_dir_image
     if not src_dir or src_dir == ".":
-        src_dir = os.getcwd()
+        if src_dir == ".":
+            src_dir = os.getcwd()
+        # Try to infer from the bom file
+        elif args.bom and os.path.exists(args.bom):
+            src_dir = os.path.dirname(os.path.realpath(args.bom))
     reports_dir = args.reports_dir
     if args.csaf:
         toml_file_path = os.getenv(

{owasp-depscan-5.1.7 → owasp-depscan-5.2.0}/depscan/lib/analysis.py

@@ -25,7 +25,6 @@ from depscan.lib import config
 from depscan.lib.logger import LOG, console
 from depscan.lib.utils import max_version
 
-
 NEWLINE = "\\n"
 
 CWE_SPLITTER = re.compile(r"(?<=CWE-)[0-9]\d{0,5}", re.IGNORECASE)
@@ -225,6 +224,27 @@ def pkg_sub_tree(
     )
 
 
+def is_os_target_sw(package_issue):
+    """
+    Since we rely on NVD, we filter those target_sw that definitely belong to a language
+    """
+    if package_issue and package_issue["affected_location"].get("cpe_uri"):
+        all_parts = CPE_FULL_REGEX.match(
+            package_issue["affected_location"].get("cpe_uri")
+        )
+        if (
+            all_parts
+            and all_parts.group("target_sw") != "*"
+            and (
+                all_parts.group("target_sw") in config.LANG_PKG_TYPES.keys()
+                or all_parts.group("target_sw")
+                in config.LANG_PKG_TYPES.values()
+            )
+        ):
+            return False
+    return True
+
+
 @dataclass
 class PrepareVdrOptions:
     project_type: str
@@ -338,15 +358,43 @@ def prepare_vdr(options: PrepareVdrOptions):
         insights = []
         plain_insights = []
         purl_obj = None
-        vendor = None
-        if purl and purl.startswith("pkg:"):
+        vendor = package_issue["affected_location"].get("vendor")
+        # If the match was based on name and version alone then the alias might legitimately lack a full purl
+        # Such results are usually false positives but could yield good hits at times
+        # So, instead of suppressing fully we try our best to tune and reduce the FP
+        if not purl.startswith("pkg:"):
+            if options.project_type in config.OS_PKG_TYPES:
+                if vendor and (
+                    vendor in config.LANG_PKG_TYPES.values()
+                    or vendor in config.LANG_PKG_TYPES.keys()
+                ):
+                    fp_count += 1
+                    continue
+                # Some nvd data might match application CVEs for
+                # OS vendors which can be filtered
+                if not is_os_target_sw(package_issue):
+                    fp_count += 1
+                    continue
+        else:
             purl_obj = parse_purl(purl)
             if purl_obj:
                 version_used = purl_obj.get("version")
                 package_type = purl_obj.get("type")
                 qualifiers = purl_obj.get("qualifiers", {})
                 if package_type in config.OS_PKG_TYPES:
-                    vendor = package_issue["affected_location"].get("vendor")
+                    # Bug #208 - do not report application CVEs
+                    if vendor and (
+                        vendor in config.LANG_PKG_TYPES.values()
+                        or vendor in config.LANG_PKG_TYPES.keys()
+                    ):
+                        fp_count += 1
+                        continue
+                    if package_type and (
+                        package_type in config.LANG_PKG_TYPES.values()
+                        or package_type in config.LANG_PKG_TYPES.keys()
+                    ):
+                        fp_count += 1
+                        continue
                     if (
                         vendor
                         and oci_product_types
@@ -358,20 +406,9 @@ def prepare_vdr(options: PrepareVdrOptions):
                             continue
                         # Some nvd data might match application CVEs for
                         # OS vendors which can be filtered
-                        if package_issue["affected_location"].get("cpe_uri"):
-                            all_parts = CPE_FULL_REGEX.match(
-                                package_issue["affected_location"].get(
-                                    "cpe_uri"
-                                )
-                            )
-                            if (
-                                all_parts
-                                and all_parts.group("target_sw") != "*"
-                                and all_parts.group("target_sw")
-                                not in config.OS_PKG_TYPES
-                            ):
-                                fp_count += 1
-                                continue
+                        if not is_os_target_sw(package_issue):
+                            fp_count += 1
+                            continue
                         insights.append(
                             f"[#7C8082]:telescope: Vendor {vendor}[/#7C8082]"
                         )
@@ -659,8 +696,9 @@ def prepare_vdr(options: PrepareVdrOptions):
     # If the user doesn't want any table output return quickly
     if options.no_vuln_table:
         return pkg_vulnerabilities, pkg_group_rows
-    console.print()
-    console.print(table)
+    if pkg_vulnerabilities:
+        console.print()
+        console.print(table)
     if pkg_group_rows:
         psection = Markdown(
             """

{owasp-depscan-5.1.7 → owasp-depscan-5.2.0}/depscan/lib/config.py

@@ -196,9 +196,12 @@ LANG_PKG_TYPES = {
     "groovy": "maven",
     "kotlin": "maven",
     "scala": "maven",
+    "jenkins": "maven",
     "js": "npm",
     "javascript": "npm",
     "nodejs": "npm",
+    "node.js": "npm",
+    "npmjs": "npm",
     "go": "golang",
     "golang": "golang",
     "ruby": "gem",
@@ -206,6 +209,7 @@ LANG_PKG_TYPES = {
     "dotnet": "nuget",
     "csharp": "nuget",
     "rust": "cargo",
+    "crates": "cargo",
     "dart": "pub",
     "cpp": "conan",
     "clojure": "clojars",

{owasp-depscan-5.1.7 → owasp-depscan-5.2.0}/depscan/lib/explainer.py

@@ -42,7 +42,7 @@ def explain(
     if reachables_slices_file:
         with open(reachables_slices_file, "r", encoding="utf-8") as f:
             reachables_data = json.load(f)
-            if reachables_data:
+            if reachables_data and reachables_data.get("reachables"):
                 rsection = Markdown(
                     """## Reachable Flows
 
@@ -50,7 +50,9 @@ Below are some reachable flows identified by depscan. Use the provided tips to i
                 """
                 )
                 console.print(rsection)
-                explain_reachables(reachables_data, pkg_group_rows, project_type)
+                explain_reachables(
+                    reachables_data, pkg_group_rows, project_type
+                )
 
 
 def explain_reachables(reachables, pkg_group_rows, project_type):
@@ -75,7 +77,7 @@ def explain_reachables(reachables, pkg_group_rows, project_type):
         flow_tree, comment, source_sink_desc, has_check_tag = explain_flows(
             areach.get("flows"), areach.get("purls"), project_type
         )
-        if not source_sink_desc:
+        if not source_sink_desc or not flow_tree:
             continue
         rtable = Table(
             box=box.DOUBLE_EDGE,
@@ -111,7 +113,7 @@ def explain_reachables(reachables, pkg_group_rows, project_type):
         console.print(rsection)
 
 
-def flow_to_source_sink(flow, purls, project_type):
+def flow_to_source_sink(idx, flow, purls, project_type):
     """ """
     source_sink_desc = ""
     param_name = flow.get("name")
@@ -119,15 +121,23 @@ def flow_to_source_sink(flow, purls, project_type):
     param_str = "Parameter"
     if param_name == "this":
         param_name = ""
+    parent_file = flow.get("parentFileName", "")
+    parent_method = flow.get("parentMethodName", "")
     # Improve the labels based on the language
-    if re.search(".(js|ts|jsx|tsx|py|cs)$", flow.get("parentFileName", "")):
+    if re.search(".(js|ts|jsx|tsx|py|cs|php)$", parent_file):
         method_str = "function"
         param_str = "argument"
+        if parent_method in ("handleRequest",):
+            method_str = f"handler {method_str}"
+        elif parent_method in ("__construct", "__init"):
+            method_str = f"constructor"
+        elif project_type in ("php",) and parent_method.startswith("__"):
+            method_str = f"magic {method_str}"
     if flow.get("label") == "METHOD_PARAMETER_IN":
         if param_name:
-            source_sink_desc = f"""{param_str} [red]{param_name}[/red] :right_arrow_curving_left: to the {method_str} [bold]{flow.get('parentMethodName')}[/bold]"""
+            source_sink_desc = f"""{param_str} [red]{param_name}[/red] :right_arrow_curving_left: to the {method_str} [bold]{parent_method}[/bold]"""
         else:
-            source_sink_desc = f"""{method_str.capitalize()} [red]{flow.get('parentMethodName')}[/red] :right_arrow_curving_left:"""
+            source_sink_desc = f"""{method_str.capitalize()} [red]{parent_method}[/red] :right_arrow_curving_left:"""
     elif flow.get("label") == "CALL" and flow.get("isExternal"):
         method_full_name = flow.get("fullName", "")
         if not method_full_name.startswith("<"):
@@ -148,11 +158,14 @@ def flow_to_source_sink(flow, purls, project_type):
     ):
         source_sink_desc = "Flow starts from a callback function"
     elif (
-        "middleware" in source_sink_desc.lower() or "route" in source_sink_desc.lower()
+        "middleware" in source_sink_desc.lower()
+        or "route" in source_sink_desc.lower()
     ):
         source_sink_desc = "Flow starts from a middlware"
     elif len(purls) == 1:
-        source_sink_desc = f"{source_sink_desc} can be used to reach this package."
+        source_sink_desc = (
+            f"{source_sink_desc} can be used to reach this package."
+        )
     else:
         source_sink_desc = (
             f"{source_sink_desc} can be used to reach {len(purls)} packages."
@@ -165,7 +178,8 @@ def filter_tags(tags):
         tags = [
             atag
             for atag in tags.split(", ")
-            if atag not in ("RESOLVED_MEMBER", "UNKNOWN_METHOD", "UNKNOWN_TYPE_DECL")
+            if atag
+            not in ("RESOLVED_MEMBER", "UNKNOWN_METHOD", "UNKNOWN_TYPE_DECL")
         ]
         return ", ".join(tags)
     return tags
@@ -189,12 +203,16 @@ def flow_to_str(flow, project_type):
             param_name = ""
         node_desc = f'{flow.get("parentMethodName")}([red]{param_name}[/red]) :right_arrow_curving_left:'
         if tags:
-            node_desc = f"{node_desc}\n[bold]Tags:[/bold] [italic]{tags}[/italic]\n"
+            node_desc = (
+                f"{node_desc}\n[bold]Tags:[/bold] [italic]{tags}[/italic]\n"
+            )
     elif flow.get("label") == "IDENTIFIER":
         if node_desc.startswith("<"):
             node_desc = flow.get("name")
         if tags:
-            node_desc = f"{node_desc}\n[bold]Tags:[/bold] [italic]{tags}[/italic]\n"
+            node_desc = (
+                f"{node_desc}\n[bold]Tags:[/bold] [italic]{tags}[/italic]\n"
+            )
     if tags:
         for ctag in (
             "validation",
@@ -209,7 +227,11 @@ def flow_to_str(flow, project_type):
                 break
     if has_check_tag:
         node_desc = f"[green]{node_desc}[/green]"
-    return file_loc, f"""[gray37]{file_loc}[/gray37]{node_desc}""", has_check_tag
+    return (
+        file_loc,
+        f"""[gray37]{file_loc}[/gray37]{node_desc}""",
+        has_check_tag,
+    )
 
 
 def explain_flows(flows, purls, project_type):
@@ -226,7 +248,7 @@ def explain_flows(flows, purls, project_type):
     has_check_tag = False
     last_file_loc = None
     source_sink_desc = ""
-    for aflow in flows:
+    for idx, aflow in enumerate(flows):
         # For java, we are only interested in identifiers with tags to keep the flows simple to understand
         if (
             project_type in ("java", "jar", "android", "apk")
@@ -235,8 +257,12 @@ def explain_flows(flows, purls, project_type):
         ):
             continue
         if not source_sink_desc:
-            source_sink_desc = flow_to_source_sink(aflow, purls, project_type)
-        file_loc, flow_str, has_check_tag_flow = flow_to_str(aflow, project_type)
+            source_sink_desc = flow_to_source_sink(
+                idx, aflow, purls, project_type
+            )
+        file_loc, flow_str, has_check_tag_flow = flow_to_str(
+            aflow, project_type
+        )
         if last_file_loc == file_loc:
             continue
         last_file_loc = file_loc

{owasp-depscan-5.1.7 → owasp-depscan-5.2.0}/depscan/lib/normalize.py

@@ -194,7 +194,7 @@ def create_pkg_variations(pkg_dict):
         for nvar in list(name_aliases):
             pkg_list.append(
                 {
-                    "vendor": pkg_dict.get("vendor"),
+                    "vendor": pkg_dict.get("vendor"), # Could be none which is fine
                     "name": nvar,
                     "version": pkg_dict["version"],
                 }

{owasp-depscan-5.1.7 → owasp-depscan-5.2.0/owasp_depscan.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: owasp-depscan
-Version: 5.1.7
+Version: 5.2.0
 Summary: Fully open-source security audit for project dependencies based on known vulnerabilities and advisories.
 Author-email: Team AppThreat <cloud@appthreat.com>
 License: MIT

{owasp-depscan-5.1.7 → owasp-depscan-5.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "owasp-depscan"
-version = "5.1.7"
+version = "5.2.0"
 description = "Fully open-source security audit for project dependencies based on known vulnerabilities and advisories."
 authors = [
     {name = "Team AppThreat", email = "cloud@appthreat.com"},