socketsecurity 1.0.42__tar.gz → 1.0.47__tar.gz

{socketsecurity-1.0.42/socketsecurity.egg-info → socketsecurity-1.0.47}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: socketsecurity
-Version: 1.0.42
+Version: 1.0.47
 Summary: Socket Security CLI for CI/CD
 Author-email: Douglas Coburn <douglas@socket.dev>
 Maintainer-email: Douglas Coburn <douglas@socket.dev>
@@ -31,7 +31,7 @@ The Socket Security CLI was created to enable integrations with other tools like
 ```` shell
 socketcli [-h] [--api_token API_TOKEN] [--repo REPO] [--branch BRANCH] [--committer COMMITTER] [--pr_number PR_NUMBER]
                  [--commit_message COMMIT_MESSAGE] [--default_branch] [--target_path TARGET_PATH] [--scm {api,github,gitlab}] [--sbom-file SBOM_FILE]
-                 [--commit-sha COMMIT_SHA] [--generate-license GENERATE_LICENSE] [-v] [--enable-debug] [--enable-json] [--disable-overview]
+                 [--commit-sha COMMIT_SHA] [--generate-license GENERATE_LICENSE] [-v] [--enable-debug] [--enable-json] [--enable-sarif] [--disable-overview]
                  [--disable-security-issue] [--files FILES] [--ignore-commit-files] [--timeout]
 ````
 
@@ -57,6 +57,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | --commit-sha             |                | False    |         | The commit hash for the commit                                                                                                                                                                                                |
 | --generate-license       |                | False    | False   | If enabled with `--sbom-file` will include license details                                                                                                                                                                    |
 | --enable-json            |                | False    | False   | If enabled will change the console output format to JSON                                                                                                                                                                      |
+| --enable-sarif           |                | False    | False   | If enabled will change the console output format to SARIF                                                                                                                                                                     |                  
 | --disable-overview       |                | False    | False   | If enabled will disable Dependency Overview comments                                                                                                                                                                          |
 | --disable-security-issue |                | False    | False   | If enabled will disable Security Issue Comments                                                                                                                                                                               |
 | --files                  |                | False    |         | If provided in the format of `["file1", "file2"]` will be used to determine if there have been supported file changes. This is used if it isn't a git repo and you would like to only run if it supported files have changed. |

{socketsecurity-1.0.42 → socketsecurity-1.0.47}/README.md

@@ -7,7 +7,7 @@ The Socket Security CLI was created to enable integrations with other tools like
 ```` shell
 socketcli [-h] [--api_token API_TOKEN] [--repo REPO] [--branch BRANCH] [--committer COMMITTER] [--pr_number PR_NUMBER]
                  [--commit_message COMMIT_MESSAGE] [--default_branch] [--target_path TARGET_PATH] [--scm {api,github,gitlab}] [--sbom-file SBOM_FILE]
-                 [--commit-sha COMMIT_SHA] [--generate-license GENERATE_LICENSE] [-v] [--enable-debug] [--enable-json] [--disable-overview]
+                 [--commit-sha COMMIT_SHA] [--generate-license GENERATE_LICENSE] [-v] [--enable-debug] [--enable-json] [--enable-sarif] [--disable-overview]
                  [--disable-security-issue] [--files FILES] [--ignore-commit-files] [--timeout]
 ````
 
@@ -33,6 +33,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | --commit-sha             |                | False    |         | The commit hash for the commit                                                                                                                                                                                                |
 | --generate-license       |                | False    | False   | If enabled with `--sbom-file` will include license details                                                                                                                                                                    |
 | --enable-json            |                | False    | False   | If enabled will change the console output format to JSON                                                                                                                                                                      |
+| --enable-sarif           |                | False    | False   | If enabled will change the console output format to SARIF                                                                                                                                                                     |                  
 | --disable-overview       |                | False    | False   | If enabled will disable Dependency Overview comments                                                                                                                                                                          |
 | --disable-security-issue |                | False    | False   | If enabled will disable Security Issue Comments                                                                                                                                                                               |
 | --files                  |                | False    |         | If provided in the format of `["file1", "file2"]` will be used to determine if there have been supported file changes. This is used if it isn't a git repo and you would like to only run if it supported files have changed. |

{socketsecurity-1.0.42 → socketsecurity-1.0.47}/socketsecurity/__init__.py

@@ -1,2 +1,2 @@
 __author__ = 'socket.dev'
-__version__ = '1.0.42'
+__version__ = '1.0.47'

{socketsecurity-1.0.42 → socketsecurity-1.0.47}/socketsecurity/core/messages.py

@@ -1,5 +1,9 @@
 import json
+import os
+import re
+import json
 
+from pathlib import Path
 from mdutils import MdUtils
 from socketsecurity.core.classes import Diff, Purl, Issue
 from prettytable import PrettyTable
@@ -7,6 +11,263 @@ from prettytable import PrettyTable
 
 class Messages:
 
+    @staticmethod
+    def map_severity_to_sarif(severity: str) -> str:
+        """
+        Map Socket severity levels to SARIF levels (GitHub code scanning).
+        
+        'low' -> 'note'
+        'medium' or 'middle' -> 'warning'
+        'high' or 'critical' -> 'error'
+        """
+        severity_mapping = {
+            "low": "note",
+            "medium": "warning",
+            "middle": "warning",  # older data might say "middle"
+            "high": "error",
+            "critical": "error",
+        }
+        return severity_mapping.get(severity.lower(), "note")
+
+    @staticmethod
+    def find_line_in_file(packagename: str, packageversion: str, manifest_file: str) -> tuple:
+        """
+        Finds the line number and snippet of code for the given package/version in a manifest file.
+        Returns a 2-tuple: (line_number, snippet_or_message).
+
+        Supports:
+          1) JSON-based manifest files (package-lock.json, Pipfile.lock, composer.lock)
+             - Locates a dictionary entry with the matching package & version
+             - Does a rough line-based search to find the actual line in the raw text
+          2) Text-based (requirements.txt, package.json, yarn.lock, etc.)
+             - Uses compiled regex patterns to detect a match line by line
+        """
+        # Extract just the file name to detect manifest type
+        file_type = Path(manifest_file).name
+
+        # ----------------------------------------------------
+        # 1) JSON-based manifest files
+        # ----------------------------------------------------
+        if file_type in ["package-lock.json", "Pipfile.lock", "composer.lock"]:
+            try:
+                # Read entire file so we can parse JSON and also do raw line checks
+                with open(manifest_file, "r", encoding="utf-8") as f:
+                    raw_text = f.read()
+
+                # Attempt JSON parse
+                data = json.loads(raw_text)
+
+                # In practice, you may need to check data["dependencies"], data["default"], etc.
+                # This is an example approach.
+                packages_dict = (
+                    data.get("packages")
+                    or data.get("default")
+                    or data.get("dependencies")
+                    or {}
+                )
+
+                found_key = None
+                found_info = None
+                # Locate a dictionary entry whose 'version' matches
+                for key, value in packages_dict.items():
+                    # For NPM package-lock, keys might look like "node_modules/axios"
+                    if key.endswith(packagename) and "version" in value:
+                        if value["version"] == packageversion:
+                            found_key = key
+                            found_info = value
+                            break
+
+                if found_key and found_info:
+                    # Search lines to approximate the correct line number
+                    needle_key = f'"{found_key}":'               # e.g. "node_modules/axios":
+                    needle_version = f'"version": "{packageversion}"'
+                    lines = raw_text.splitlines()
+                    best_line = 1
+                    snippet = None
+
+                    for i, line in enumerate(lines, start=1):
+                        if (needle_key in line) or (needle_version in line):
+                            best_line = i
+                            snippet = line.strip()
+                            break  # On first match, stop
+
+                    # If we found an approximate line, return it; else fallback to line 1
+                    if best_line > 0 and snippet:
+                        return best_line, snippet
+                    else:
+                        return 1, f'"{found_key}": {found_info}'
+                else:
+                    return 1, f"{packagename} {packageversion} (not found in {manifest_file})"
+
+            except (FileNotFoundError, json.JSONDecodeError):
+                return 1, f"Error reading {manifest_file}"
+
+        # ----------------------------------------------------
+        # 2) Text-based / line-based manifests
+        # ----------------------------------------------------
+        # Define a dictionary of patterns for common manifest types
+        search_patterns = {
+            "package.json":         rf'"{packagename}":\s*"{packageversion}"',
+            "yarn.lock":            rf'{packagename}@{packageversion}',
+            "pnpm-lock.yaml":       rf'"{re.escape(packagename)}"\s*:\s*\{{[^}}]*"version":\s*"{re.escape(packageversion)}"',
+            "requirements.txt":     rf'^{re.escape(packagename)}\s*(?:==|===|!=|>=|<=|~=|\s+)?\s*{re.escape(packageversion)}(?:\s*;.*)?$',
+            "pyproject.toml":       rf'{packagename}\s*=\s*"{packageversion}"',
+            "Pipfile":              rf'"{packagename}"\s*=\s*"{packageversion}"',
+            "go.mod":               rf'require\s+{re.escape(packagename)}\s+{re.escape(packageversion)}',
+            "go.sum":               rf'{re.escape(packagename)}\s+{re.escape(packageversion)}',
+            "pom.xml":              rf'<artifactId>{re.escape(packagename)}</artifactId>\s*<version>{re.escape(packageversion)}</version>',
+            "build.gradle":         rf'implementation\s+"{re.escape(packagename)}:{re.escape(packageversion)}"',
+            "Gemfile":              rf'gem\s+"{re.escape(packagename)}",\s*"{re.escape(packageversion)}"',
+            "Gemfile.lock":         rf'\s+{re.escape(packagename)}\s+\({re.escape(packageversion)}\)',
+            ".csproj":              rf'<PackageReference\s+Include="{re.escape(packagename)}"\s+Version="{re.escape(packageversion)}"\s*/>',
+            ".fsproj":              rf'<PackageReference\s+Include="{re.escape(packagename)}"\s+Version="{re.escape(packageversion)}"\s*/>',
+            "paket.dependencies":   rf'nuget\s+{re.escape(packagename)}\s+{re.escape(packageversion)}',
+            "Cargo.toml":           rf'{re.escape(packagename)}\s*=\s*"{re.escape(packageversion)}"',
+            "build.sbt":            rf'"{re.escape(packagename)}"\s*%\s*"{re.escape(packageversion)}"',
+            "Podfile":              rf'pod\s+"{re.escape(packagename)}",\s*"{re.escape(packageversion)}"',
+            "Package.swift":        rf'\.package\(name:\s*"{re.escape(packagename)}",\s*url:\s*".*?",\s*version:\s*"{re.escape(packageversion)}"\)',
+            "mix.exs":              rf'\{{:{re.escape(packagename)},\s*"{re.escape(packageversion)}"\}}',
+            "composer.json":        rf'"{re.escape(packagename)}":\s*"{re.escape(packageversion)}"',
+            "conanfile.txt":        rf'{re.escape(packagename)}/{re.escape(packageversion)}',
+            "vcpkg.json":           rf'"{re.escape(packagename)}":\s*"{re.escape(packageversion)}"',
+        }
+
+        # If no specific pattern is found for this file name, fallback to a naive approach
+        searchstring = search_patterns.get(file_type, rf'{re.escape(packagename)}.*{re.escape(packageversion)}')
+
+        try:
+            # Read file lines and search for a match
+            with open(manifest_file, 'r', encoding="utf-8") as file:
+                lines = [line.rstrip("\n") for line in file]
+                for line_number, line_content in enumerate(lines, start=1):
+                    # For Python conditional dependencies, ignore everything after first ';'
+                    line_main = line_content.split(";", 1)[0].strip()
+
+                    # Use a case-insensitive regex search
+                    if re.search(searchstring, line_main, re.IGNORECASE):
+                        return line_number, line_content.strip()
+
+        except FileNotFoundError:
+            return 1, f"{manifest_file} not found"
+        except Exception as e:
+            return 1, f"Error reading {manifest_file}: {e}"
+
+        return 1, f"{packagename} {packageversion} (not found)"
+
+    @staticmethod
+    def get_manifest_type_url(manifest_file: str, pkg_name: str, pkg_version: str) -> str:
+        """
+        Determine the correct URL path based on the manifest file type.
+        """
+        manifest_to_url_prefix = {
+            "package.json": "npm",
+            "package-lock.json": "npm",
+            "yarn.lock": "npm",
+            "pnpm-lock.yaml": "npm",
+            "requirements.txt": "pypi",
+            "pyproject.toml": "pypi",
+            "Pipfile": "pypi",
+            "go.mod": "go",
+            "go.sum": "go",
+            "pom.xml": "maven",
+            "build.gradle": "maven",
+            ".csproj": "nuget",
+            ".fsproj": "nuget",
+            "paket.dependencies": "nuget",
+            "Cargo.toml": "cargo",
+            "Gemfile": "rubygems",
+            "Gemfile.lock": "rubygems",
+            "composer.json": "composer",
+            "vcpkg.json": "vcpkg",
+        }
+
+        file_type = Path(manifest_file).name
+        url_prefix = manifest_to_url_prefix.get(file_type, "unknown")
+        return f"https://socket.dev/{url_prefix}/package/{pkg_name}/alerts/{pkg_version}"
+
+    @staticmethod
+    def create_security_comment_sarif(diff) -> dict:
+        """
+        Create SARIF-compliant output from the diff report, including dynamic URL generation
+        based on manifest type and improved <br/> formatting for GitHub SARIF display.
+        """
+        sarif_data = {
+            "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
+            "version": "2.1.0",
+            "runs": [
+                {
+                    "tool": {
+                        "driver": {
+                            "name": "Socket Security",
+                            "informationUri": "https://socket.dev",
+                            "rules": []
+                        }
+                    },
+                    "results": []
+                }
+            ]
+        }
+
+        rules_map = {}
+        results_list = []
+
+        for alert in diff.new_alerts:
+            pkg_name = alert.pkg_name
+            pkg_version = alert.pkg_version
+            rule_id = f"{pkg_name}=={pkg_version}"
+            severity = alert.severity
+
+            # Generate the correct URL for the alert based on manifest type
+            introduced_list = alert.introduced_by
+            manifest_file = introduced_list[0][1] if introduced_list and isinstance(introduced_list[0], list) else alert.manifests or "requirements.txt"
+            socket_url = Messages.get_manifest_type_url(manifest_file, pkg_name, pkg_version)
+
+            # Prepare descriptions with <br/> replacements
+            short_desc = f"{alert.props.get('note', '')}<br/><br/>Suggested Action:<br/>{alert.suggestion}<br/><a href=\"{socket_url}\">{socket_url}</a>"
+            full_desc = f"{alert.title} - {alert.description.replace('\r\n', '<br/>')}"
+
+            # Identify the line and snippet in the manifest file
+            line_number, line_content = Messages.find_line_in_file(pkg_name, pkg_version, manifest_file)
+            if line_number < 1:
+                line_number = 1  # Ensure SARIF compliance
+
+            # Create the rule if not already defined
+            if rule_id not in rules_map:
+                rules_map[rule_id] = {
+                    "id": rule_id,
+                    "name": f"{pkg_name}=={pkg_version}",
+                    "shortDescription": {"text": f"Alert generated for {rule_id} by Socket Security"},
+                    "fullDescription": {"text": full_desc},
+                    "helpUri": socket_url,
+                    "defaultConfiguration": {
+                        "level": Messages.map_severity_to_sarif(severity)
+                    },
+                }
+
+            # Add the SARIF result
+            result_obj = {
+                "ruleId": rule_id,
+                "message": {"text": short_desc},
+                "locations": [
+                    {
+                        "physicalLocation": {
+                            "artifactLocation": {"uri": manifest_file},
+                            "region": {
+                                "startLine": line_number,
+                                "snippet": {"text": line_content},
+                            },
+                        }
+                    }
+                ],
+            }
+            results_list.append(result_obj)
+
+        # Attach rules and results
+        sarif_data["runs"][0]["tool"]["driver"]["rules"] = list(rules_map.values())
+        sarif_data["runs"][0]["results"] = results_list
+
+        return sarif_data
+
     @staticmethod
     def create_security_comment_json(diff: Diff) -> dict:
         scan_failed = False

{socketsecurity-1.0.42 → socketsecurity-1.0.47}/socketsecurity/socketcli.py

@@ -170,6 +170,14 @@ parser.add_argument(
     type=float
 )
 
+parser.add_argument(
+    '--enable-sarif',
+    help='Enable SARIF output of results instead of table or JSON format',
+    action='store_true',
+    default=False
+)
+
+
 def output_console_comments(diff_report: Diff, sbom_file_name: str = None) -> None:
     if diff_report.id != "NO_DIFF_RAN":
         console_security_comment = Messages.create_console_security_alert_table(diff_report)
@@ -188,6 +196,25 @@ def output_console_comments(diff_report: Diff, sbom_file_name: str = None) -> No
         else:
             log.info("No New Security issues detected by Socket Security")
 
+def output_console_sarif(diff_report: Diff, sbom_file_name: str = None) -> None:
+    """
+    Generate SARIF output from the diff report and save it to a file.
+    """
+    if diff_report.id != "NO_DIFF_RAN":
+        # Generate the SARIF structure using Messages
+        console_security_comment = Messages.create_security_comment_sarif(diff_report)
+        
+        # Save the SARIF output to the specified SBOM file name or fallback to a default
+        save_sbom_file(diff_report, sbom_file_name)
+        # Print the SARIF output to the console in JSON format
+        print(json.dumps(console_security_comment, indent=2))
+
+        # Handle exit codes based on alert severity
+        if not report_pass(diff_report) and not blocking_disabled:
+            sys.exit(1)
+        elif len(diff_report.new_alerts) > 0 and not blocking_disabled:
+            # Warning alerts without blocking
+            sys.exit(5)
 
 def output_console_json(diff_report: Diff, sbom_file_name: str = None) -> None:
     if diff_report.id != "NO_DIFF_RAN":
@@ -257,6 +284,7 @@ def main_code():
     sbom_file = arguments.sbom_file
     license_mode = arguments.generate_license
     enable_json = arguments.enable_json
+    enable_sarif = arguments.enable_sarif
     disable_overview = arguments.disable_overview
     disable_security_issue = arguments.disable_security_issue
     ignore_commit_files = arguments.ignore_commit_files
@@ -401,7 +429,10 @@ def main_code():
         else:
             log.info("Starting non-PR/MR flow")
             diff = core.create_new_diff(target_path, params, workspace=target_path, no_change=no_change)
-        if enable_json:
+        if enable_sarif:
+            log.debug("Outputting SARIF Results")
+            output_console_sarif(diff, sbom_file)
+        elif enable_json:
             log.debug("Outputting JSON Results")
             output_console_json(diff, sbom_file)
         else:
@@ -410,7 +441,11 @@ def main_code():
         log.info("API Mode")
         diff: Diff
         diff = core.create_new_diff(target_path, params, workspace=target_path, no_change=no_change)
-        if enable_json:
+        if enable_sarif:
+            log.debug("Outputting SARIF Results")
+            output_console_sarif(diff, sbom_file)
+        elif enable_json:
+            log.debug("Outputting JSON Results")
             output_console_json(diff, sbom_file)
         else:
             output_console_comments(diff, sbom_file)

{socketsecurity-1.0.42 → socketsecurity-1.0.47/socketsecurity.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: socketsecurity
-Version: 1.0.42
+Version: 1.0.47
 Summary: Socket Security CLI for CI/CD
 Author-email: Douglas Coburn <douglas@socket.dev>
 Maintainer-email: Douglas Coburn <douglas@socket.dev>
@@ -31,7 +31,7 @@ The Socket Security CLI was created to enable integrations with other tools like
 ```` shell
 socketcli [-h] [--api_token API_TOKEN] [--repo REPO] [--branch BRANCH] [--committer COMMITTER] [--pr_number PR_NUMBER]
                  [--commit_message COMMIT_MESSAGE] [--default_branch] [--target_path TARGET_PATH] [--scm {api,github,gitlab}] [--sbom-file SBOM_FILE]
-                 [--commit-sha COMMIT_SHA] [--generate-license GENERATE_LICENSE] [-v] [--enable-debug] [--enable-json] [--disable-overview]
+                 [--commit-sha COMMIT_SHA] [--generate-license GENERATE_LICENSE] [-v] [--enable-debug] [--enable-json] [--enable-sarif] [--disable-overview]
                  [--disable-security-issue] [--files FILES] [--ignore-commit-files] [--timeout]
 ````
 
@@ -57,6 +57,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | --commit-sha             |                | False    |         | The commit hash for the commit                                                                                                                                                                                                |
 | --generate-license       |                | False    | False   | If enabled with `--sbom-file` will include license details                                                                                                                                                                    |
 | --enable-json            |                | False    | False   | If enabled will change the console output format to JSON                                                                                                                                                                      |
+| --enable-sarif           |                | False    | False   | If enabled will change the console output format to SARIF                                                                                                                                                                     |                  
 | --disable-overview       |                | False    | False   | If enabled will disable Dependency Overview comments                                                                                                                                                                          |
 | --disable-security-issue |                | False    | False   | If enabled will disable Security Issue Comments                                                                                                                                                                               |
 | --files                  |                | False    |         | If provided in the format of `["file1", "file2"]` will be used to determine if there have been supported file changes. This is used if it isn't a git repo and you would like to only run if it supported files have changed. |