owasp-depscan 5.1.8__py3-none-any.whl → 5.2.0__py3-none-any.whl

depscan/cli.py

@@ -727,7 +727,14 @@ def main():
     """
     args = build_args()
     # declare variables that get initialized only conditionally
-    summary, vdr_file, bom_file, pkg_list, pkg_vulnerabilities, pkg_group_rows = None, None, None, None, None, None
+    (
+        summary,
+        vdr_file,
+        bom_file,
+        pkg_list,
+        pkg_vulnerabilities,
+        pkg_group_rows,
+    ) = (None, None, None, None, None, None)
     # Should we turn on the debug mode
     if args.enable_debug:
         os.environ["AT_DEBUG_MODE"] = "debug"
@@ -738,7 +745,11 @@ def main():
         print(LOGO)
     src_dir = args.src_dir_image
     if not src_dir or src_dir == ".":
-        src_dir = os.getcwd()
+        if src_dir == ".":
+            src_dir = os.getcwd()
+        # Try to infer from the bom file
+        elif args.bom and os.path.exists(args.bom):
+            src_dir = os.path.dirname(os.path.realpath(args.bom))
     reports_dir = args.reports_dir
     if args.csaf:
         toml_file_path = os.getenv(

depscan/lib/explainer.py

@@ -42,7 +42,7 @@ def explain(
     if reachables_slices_file:
         with open(reachables_slices_file, "r", encoding="utf-8") as f:
             reachables_data = json.load(f)
-            if reachables_data:
+            if reachables_data and reachables_data.get("reachables"):
                 rsection = Markdown(
                     """## Reachable Flows
 
@@ -50,7 +50,9 @@ Below are some reachable flows identified by depscan. Use the provided tips to i
                 """
                 )
                 console.print(rsection)
-                explain_reachables(reachables_data, pkg_group_rows, project_type)
+                explain_reachables(
+                    reachables_data, pkg_group_rows, project_type
+                )
 
 
 def explain_reachables(reachables, pkg_group_rows, project_type):
@@ -75,7 +77,7 @@ def explain_reachables(reachables, pkg_group_rows, project_type):
         flow_tree, comment, source_sink_desc, has_check_tag = explain_flows(
             areach.get("flows"), areach.get("purls"), project_type
         )
-        if not source_sink_desc:
+        if not source_sink_desc or not flow_tree:
             continue
         rtable = Table(
             box=box.DOUBLE_EDGE,
@@ -111,7 +113,7 @@ def explain_reachables(reachables, pkg_group_rows, project_type):
         console.print(rsection)
 
 
-def flow_to_source_sink(flow, purls, project_type):
+def flow_to_source_sink(idx, flow, purls, project_type):
     """ """
     source_sink_desc = ""
     param_name = flow.get("name")
@@ -119,15 +121,23 @@ def flow_to_source_sink(flow, purls, project_type):
     param_str = "Parameter"
     if param_name == "this":
         param_name = ""
+    parent_file = flow.get("parentFileName", "")
+    parent_method = flow.get("parentMethodName", "")
     # Improve the labels based on the language
-    if re.search(".(js|ts|jsx|tsx|py|cs)$", flow.get("parentFileName", "")):
+    if re.search(".(js|ts|jsx|tsx|py|cs|php)$", parent_file):
         method_str = "function"
         param_str = "argument"
+        if parent_method in ("handleRequest",):
+            method_str = f"handler {method_str}"
+        elif parent_method in ("__construct", "__init"):
+            method_str = f"constructor"
+        elif project_type in ("php",) and parent_method.startswith("__"):
+            method_str = f"magic {method_str}"
     if flow.get("label") == "METHOD_PARAMETER_IN":
         if param_name:
-            source_sink_desc = f"""{param_str} [red]{param_name}[/red] :right_arrow_curving_left: to the {method_str} [bold]{flow.get('parentMethodName')}[/bold]"""
+            source_sink_desc = f"""{param_str} [red]{param_name}[/red] :right_arrow_curving_left: to the {method_str} [bold]{parent_method}[/bold]"""
         else:
-            source_sink_desc = f"""{method_str.capitalize()} [red]{flow.get('parentMethodName')}[/red] :right_arrow_curving_left:"""
+            source_sink_desc = f"""{method_str.capitalize()} [red]{parent_method}[/red] :right_arrow_curving_left:"""
     elif flow.get("label") == "CALL" and flow.get("isExternal"):
         method_full_name = flow.get("fullName", "")
         if not method_full_name.startswith("<"):
@@ -148,11 +158,14 @@ def flow_to_source_sink(flow, purls, project_type):
     ):
         source_sink_desc = "Flow starts from a callback function"
     elif (
-        "middleware" in source_sink_desc.lower() or "route" in source_sink_desc.lower()
+        "middleware" in source_sink_desc.lower()
+        or "route" in source_sink_desc.lower()
     ):
         source_sink_desc = "Flow starts from a middlware"
     elif len(purls) == 1:
-        source_sink_desc = f"{source_sink_desc} can be used to reach this package."
+        source_sink_desc = (
+            f"{source_sink_desc} can be used to reach this package."
+        )
     else:
         source_sink_desc = (
             f"{source_sink_desc} can be used to reach {len(purls)} packages."
@@ -165,7 +178,8 @@ def filter_tags(tags):
         tags = [
             atag
             for atag in tags.split(", ")
-            if atag not in ("RESOLVED_MEMBER", "UNKNOWN_METHOD", "UNKNOWN_TYPE_DECL")
+            if atag
+            not in ("RESOLVED_MEMBER", "UNKNOWN_METHOD", "UNKNOWN_TYPE_DECL")
         ]
         return ", ".join(tags)
     return tags
@@ -189,12 +203,16 @@ def flow_to_str(flow, project_type):
             param_name = ""
         node_desc = f'{flow.get("parentMethodName")}([red]{param_name}[/red]) :right_arrow_curving_left:'
         if tags:
-            node_desc = f"{node_desc}\n[bold]Tags:[/bold] [italic]{tags}[/italic]\n"
+            node_desc = (
+                f"{node_desc}\n[bold]Tags:[/bold] [italic]{tags}[/italic]\n"
+            )
     elif flow.get("label") == "IDENTIFIER":
         if node_desc.startswith("<"):
             node_desc = flow.get("name")
         if tags:
-            node_desc = f"{node_desc}\n[bold]Tags:[/bold] [italic]{tags}[/italic]\n"
+            node_desc = (
+                f"{node_desc}\n[bold]Tags:[/bold] [italic]{tags}[/italic]\n"
+            )
     if tags:
         for ctag in (
             "validation",
@@ -209,7 +227,11 @@ def flow_to_str(flow, project_type):
                 break
     if has_check_tag:
         node_desc = f"[green]{node_desc}[/green]"
-    return file_loc, f"""[gray37]{file_loc}[/gray37]{node_desc}""", has_check_tag
+    return (
+        file_loc,
+        f"""[gray37]{file_loc}[/gray37]{node_desc}""",
+        has_check_tag,
+    )
 
 
 def explain_flows(flows, purls, project_type):
@@ -226,7 +248,7 @@ def explain_flows(flows, purls, project_type):
     has_check_tag = False
     last_file_loc = None
     source_sink_desc = ""
-    for aflow in flows:
+    for idx, aflow in enumerate(flows):
         # For java, we are only interested in identifiers with tags to keep the flows simple to understand
         if (
             project_type in ("java", "jar", "android", "apk")
@@ -235,8 +257,12 @@ def explain_flows(flows, purls, project_type):
         ):
             continue
         if not source_sink_desc:
-            source_sink_desc = flow_to_source_sink(aflow, purls, project_type)
-        file_loc, flow_str, has_check_tag_flow = flow_to_str(aflow, project_type)
+            source_sink_desc = flow_to_source_sink(
+                idx, aflow, purls, project_type
+            )
+        file_loc, flow_str, has_check_tag_flow = flow_to_str(
+            aflow, project_type
+        )
         if last_file_loc == file_loc:
             continue
         last_file_loc = file_loc

{owasp_depscan-5.1.8.dist-info → owasp_depscan-5.2.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: owasp-depscan
-Version: 5.1.8
+Version: 5.2.0
 Summary: Fully open-source security audit for project dependencies based on known vulnerabilities and advisories.
 Author-email: Team AppThreat <cloud@appthreat.com>
 License: MIT

{owasp_depscan-5.1.8.dist-info → owasp_depscan-5.2.0.dist-info}/RECORD

@@ -1,12 +1,12 @@
 depscan/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-depscan/cli.py,sha256=K9lG1iQOPqWTrcXoclv4T0Ee6QPgQfJkZIC9bN-bt3c,37477
+depscan/cli.py,sha256=HqKHaclGIUcDAUHfqVU57EWD1_apcSt_VCsj3CSQHBI,37726
 depscan/lib/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 depscan/lib/analysis.py,sha256=fb2dcPERqsmNB4MxWzATJrBP_wJReA-QM6goGvyGtX8,57977
 depscan/lib/audit.py,sha256=6GmHOkhDYY1LCIRd-wUSrSISh6_IFR5PhOopPJIQTeE,1318
 depscan/lib/bom.py,sha256=Dkd8AX2ann6FhBeSMvSx86cuq9VEmNPss1Zlziy28aE,16306
 depscan/lib/config.py,sha256=NJHPzNChbADTBjEFEyiRDGhurK7FAIDrf0Omk1jhpXY,14346
 depscan/lib/csaf.py,sha256=B9aigxVn7fis_lF15wPfTgieADTcqYE-XDabTt281Ag,81724
-depscan/lib/explainer.py,sha256=yRCEroeNCSj_bUQXqwUkLHV3l7eSJvTYoms9T1CDgGk,9282
+depscan/lib/explainer.py,sha256=gSBNMxwyr1s_2v0GY-k3Ds5B92LMeCrqJF5P9nsW934,9966
 depscan/lib/github.py,sha256=h6e_12xLwspXJbt_7lW6vuHaqgJQgyFSRCLrfUndCH4,1697
 depscan/lib/license.py,sha256=y4-WZuD2MOunKaLd2EJGcSYP6s3Lp_dgssdzhcl9eEM,2332
 depscan/lib/logger.py,sha256=TZkxVN2a5g2g0nOlrIodJWaDhTFT6JLtR1vR4fPSMgs,1605
@@ -64,9 +64,9 @@ vendor/choosealicense.com/_licenses/vim.txt,sha256=d5GQjXB328L8EBkhKgxcjk344D3K7
 vendor/choosealicense.com/_licenses/wtfpl.txt,sha256=BxXeubkvQm32MDmlZsBcbzJzBpR5kWgw0JxSR9d7f3k,948
 vendor/choosealicense.com/_licenses/zlib.txt,sha256=e6dfCeLhxD3NCnIkY4cVIagRaWdRvencjNhHZ1APvpc,1678
 vendor/spdx/json/licenses.json,sha256=_Vz_aACEg-giVk08ZBQLqB5Z3AnSWZmdD9I22ID3QNs,275192
-owasp_depscan-5.1.8.dist-info/LICENSE,sha256=oQnCbnZtJ_NLDdOLc-rVY1D1N0RNWLHPpYXcc77xzSo,1073
-owasp_depscan-5.1.8.dist-info/METADATA,sha256=sTw9ek5AN2MRSii_rv484SH1tXplLLVy5V4X7WfPyiQ,27661
-owasp_depscan-5.1.8.dist-info/WHEEL,sha256=oiQVh_5PnQM0E3gPdiz09WCNmwiHDMaGer_elqB3coM,92
-owasp_depscan-5.1.8.dist-info/entry_points.txt,sha256=FxQKHFWZTfKU2eBxHPFRxwhSNexntYygYhquykS8zxA,69
-owasp_depscan-5.1.8.dist-info/top_level.txt,sha256=qbHOZvNU2dXANv946hMdP2vOi0ESQB5t2ZY5ktKtXvQ,15
-owasp_depscan-5.1.8.dist-info/RECORD,,
+owasp_depscan-5.2.0.dist-info/LICENSE,sha256=oQnCbnZtJ_NLDdOLc-rVY1D1N0RNWLHPpYXcc77xzSo,1073
+owasp_depscan-5.2.0.dist-info/METADATA,sha256=FHjLTHGP80qxtTka0p5qjgp1LIuiQGy25RFWlDIgNOY,27661
+owasp_depscan-5.2.0.dist-info/WHEEL,sha256=oiQVh_5PnQM0E3gPdiz09WCNmwiHDMaGer_elqB3coM,92
+owasp_depscan-5.2.0.dist-info/entry_points.txt,sha256=FxQKHFWZTfKU2eBxHPFRxwhSNexntYygYhquykS8zxA,69
+owasp_depscan-5.2.0.dist-info/top_level.txt,sha256=qbHOZvNU2dXANv946hMdP2vOi0ESQB5t2ZY5ktKtXvQ,15
+owasp_depscan-5.2.0.dist-info/RECORD,,