owasp-depscan 5.2.4__tar.gz → 5.2.6__tar.gz

{owasp-depscan-5.2.4/owasp_depscan.egg-info → owasp-depscan-5.2.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: owasp-depscan
-Version: 5.2.4
+Version: 5.2.6
 Summary: Fully open-source security audit for project dependencies based on known vulnerabilities and advisories.
 Author-email: Team AppThreat <cloud@appthreat.com>
 License: MIT
@@ -20,7 +20,7 @@ Classifier: Topic :: Utilities
 Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: appthreat-vulnerability-db==5.5.10
+Requires-Dist: appthreat-vulnerability-db==5.6.1
 Requires-Dist: defusedxml
 Requires-Dist: oras==0.1.26
 Requires-Dist: PyYAML

{owasp-depscan-5.2.4 → owasp-depscan-5.2.6}/depscan/cli.py

@@ -542,12 +542,15 @@ async def run_scan():
     results = []
     db = db_lib.get()
     profile = "generic"
+    deep = False
     if q.get("url"):
         url = q.get("url")
     if q.get("path"):
         path = q.get("path")
     if q.get("multiProject"):
         multi_project = q.get("multiProject", "").lower() in ("true", "1")
+    if q.get("deep"):
+        deep = q.get("deep", "").lower() in ("true", "1")
     if q.get("type"):
         project_type = q.get("type")
     if q.get("profile"):
@@ -562,6 +565,11 @@ async def run_scan():
                 "true",
                 "1",
             )
+        if not deep and params.get("deep"):
+            deep = params.get("deep", "").lower() in (
+                "true",
+                "1",
+            )
         if not project_type and params.get("type"):
             project_type = params.get("type")
         if not profile and params.get("profile"):
@@ -619,7 +627,8 @@ async def run_scan():
         path = tmp_bom_file.name
 
     # Path points to a project directory
-    if os.path.isdir(path):
+    # Bug# 233. Path could be a url
+    if url or (path and os.path.isdir(path)):
         with tempfile.NamedTemporaryFile(
             delete=False, suffix=".bom.json"
         ) as bfp:
@@ -627,7 +636,7 @@ async def run_scan():
                 project_type,
                 bfp.name,
                 path,
-                True,
+                deep,
                 {
                     "url": url,
                     "path": path,

{owasp-depscan-5.2.4 → owasp-depscan-5.2.6}/depscan/lib/bom.py

@@ -94,7 +94,9 @@ def get_licenses(ele):
     """
     license_list = []
     namespace = "{http://cyclonedx.org/schema/bom/1.5}"
-    for data in ele.findall(f"{namespace}licenses/{namespace}license/{namespace}id"):
+    for data in ele.findall(
+        f"{namespace}licenses/{namespace}license/{namespace}id"
+    ):
         license_list.append(data.text)
     if not license_list:
         for data in ele.findall(
@@ -179,9 +181,13 @@ def get_pkg_list_json(jsonfile):
                                 licenses.append(license_obj.get("id"))
                             elif license_obj.get("name"):
                                 licenses.append(
-                                    cleanup_license_string(license_obj.get("name"))
+                                    cleanup_license_string(
+                                        license_obj.get("name")
+                                    )
                                 )
-                    pkgs.append({**comp, "vendor": vendor, "licenses": licenses})
+                    pkgs.append(
+                        {**comp, "vendor": vendor, "licenses": licenses}
+                    )
         except Exception:
             # Ignore json errors
             pass
@@ -225,7 +231,9 @@ def get_pkg_by_type(pkg_list, pkg_type):
     if not pkg_list:
         return []
     return [
-        pkg for pkg in pkg_list if pkg.get("purl", "").startswith("pkg:" + pkg_type)
+        pkg
+        for pkg in pkg_list
+        if pkg.get("purl", "").startswith("pkg:" + pkg_type)
     ]
 
 
@@ -322,7 +330,9 @@ def create_bom(project_type, bom_file, src_dir=".", deep=False, options={}):
             project_type = "universal"
         if not src_dir and options.get("path"):
             src_dir = options.get("path")
-        with httpx.Client(http2=True, base_url=cdxgen_server, timeout=180) as client:
+        with httpx.Client(
+            http2=True, base_url=cdxgen_server, timeout=180
+        ) as client:
             sbom_url = f"{cdxgen_server}/sbom"
             LOG.debug("Invoking cdxgen server at %s", sbom_url)
             try:
@@ -340,7 +350,9 @@ def create_bom(project_type, bom_file, src_dir=".", deep=False, options={}):
                     try:
                         json_response = r.json()
                         if json_response:
-                            with open(bom_file, mode="w", encoding="utf-8") as fp:
+                            with open(
+                                bom_file, mode="w", encoding="utf-8"
+                            ) as fp:
                                 json.dump(json_response, fp)
                             return os.path.exists(bom_file)
                     except Exception as je:
@@ -378,12 +390,15 @@ def create_bom(project_type, bom_file, src_dir=".", deep=False, options={}):
         args.append(options.get("profile"))
         if options.get("profile") != "generic":
             LOG.debug("BOM Profile: %s", options.get("profile"))
-    args.append(src_dir)
+    # Bug #233 - Source directory could be None when working with url
+    if src_dir:
+        args.append(src_dir)
     if cdxgen_cmd:
         exec_tool(
             args,
             src_dir
             if project_type not in ("docker", "oci", "container")
+            and src_dir
             and os.path.isdir(src_dir)
             else None,
         )
@@ -405,10 +420,14 @@ def submit_bom(reports_dir, threatdb_params):
         if not threatdb_server.endswith("/import"):
             threatdb_server = f"{threatdb_server}/import"
         login_url = threatdb_server.replace("/import", "/login")
-        with httpx.Client(http2=True, base_url=threatdb_server, timeout=180) as client:
+        with httpx.Client(
+            http2=True, base_url=threatdb_server, timeout=180
+        ) as client:
             token = threatdb_params.get("threatdb_token")
             if not token:
-                LOG.debug("Attempting to retrieve access token from %s", login_url)
+                LOG.debug(
+                    "Attempting to retrieve access token from %s", login_url
+                )
                 r = client.post(
                     login_url,
                     json={

{owasp-depscan-5.2.4 → owasp-depscan-5.2.6/owasp_depscan.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: owasp-depscan
-Version: 5.2.4
+Version: 5.2.6
 Summary: Fully open-source security audit for project dependencies based on known vulnerabilities and advisories.
 Author-email: Team AppThreat <cloud@appthreat.com>
 License: MIT
@@ -20,7 +20,7 @@ Classifier: Topic :: Utilities
 Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: appthreat-vulnerability-db==5.5.10
+Requires-Dist: appthreat-vulnerability-db==5.6.1
 Requires-Dist: defusedxml
 Requires-Dist: oras==0.1.26
 Requires-Dist: PyYAML

{owasp-depscan-5.2.4 → owasp-depscan-5.2.6}/owasp_depscan.egg-info/requires.txt

@@ -1,4 +1,4 @@
-appthreat-vulnerability-db==5.5.10
+appthreat-vulnerability-db==5.6.1
 defusedxml
 oras==0.1.26
 PyYAML

{owasp-depscan-5.2.4 → owasp-depscan-5.2.6}/pyproject.toml

@@ -1,12 +1,12 @@
 [project]
 name = "owasp-depscan"
-version = "5.2.4"
+version = "5.2.6"
 description = "Fully open-source security audit for project dependencies based on known vulnerabilities and advisories."
 authors = [
     {name = "Team AppThreat", email = "cloud@appthreat.com"},
 ]
 dependencies = [
-    "appthreat-vulnerability-db==5.5.10",
+    "appthreat-vulnerability-db==5.6.1",
     "defusedxml",
     "oras==0.1.26",
     "PyYAML",