class ScaBox::Scanner
Constants
- DEFAULT_SOLUTION
Attributes
description[R]
issues[R]
name[R]
support[R]
timeout[R]
Public Class Methods
new(params)
click to toggle source
# File lib/scabox_sdk/scanner.rb, line 18 def initialize(params) @name = params[:name] @description = params[:description] @support = params[:support] @issues = [] @timeout = 200 * 60 enable_color(true) end
Public Instance Methods
add_issue(issue)
click to toggle source
# File lib/scabox_sdk/scanner.rb, line 67 def add_issue(issue) issue[:plugin] = name issue[:cve] = [] if issue[:cve].nil? issue[:cve] = [issue[:cve]] if issue[:cve].kind_of?(String) issue[:references] = [] if issue[:references].nil? issue[:title] = build_title(issue) if issue[:title].nil? issue[:discovery_method] = '' if issue[:discovery_method].nil? issue[:description] = issue[:title] if issue[:description].nil? issue[:severity] = "undefined" if issue[:severity].nil? issue[:references] = [issue[:references]] if issue[:references].kind_of?(String) issue[:solution] = DEFAULT_SOLUTION if issue[:solution].nil? hash_data = [ issue[:path], issue[:component], issue[:version], issue[:title], issue[:description], issue[:cve].sort.join(":") ] issue[:hash_issue] = Digest::SHA256.hexdigest(hash_data.join(':')) @issues << issue end
build_title(issue)
click to toggle source
# File lib/scabox_sdk/scanner.rb, line 93 def build_title(issue) title = "Vulnerability" if issue[:cve].length > 0 title = issue[:cve].sort.join(',') end title end
check_info_flag()
click to toggle source
# File lib/scabox_sdk/scanner.rb, line 27 def check_info_flag if @opts.info puts info exit 0 end end
check_output_flag()
click to toggle source
# File lib/scabox_sdk/scanner.rb, line 34 def check_output_flag if @opts.output.nil? and @opts.output_stdout == false print_error("Neither -o nor --output-stdout passed") exit 1 end end
enable_color(enabled=true)
click to toggle source
# File lib/scabox_sdk/scanner.rb, line 55 def enable_color(enabled=true) @color = enabled end
filename_for_plugin(suffix='.json')
click to toggle source
# File lib/scabox_sdk/scanner.rb, line 173 def filename_for_plugin(suffix='.json') time_s = Time.now.strftime("%Y%m%d%H%M%S") filename = "#{name}_#{time_s}#{suffix}" filename end
gen_random_tmp_filename(suffix = '')
click to toggle source
# File lib/scabox_sdk/scanner.rb, line 198 def gen_random_tmp_filename(suffix = '') File.join(Dir.tmpdir, "#{SecureRandom.urlsafe_base64}#{suffix}") end
gen_random_tmp_filename_json()
click to toggle source
# File lib/scabox_sdk/scanner.rb, line 202 def gen_random_tmp_filename_json gen_random_tmp_filename('.json') end
get_code_version()
click to toggle source
# File lib/scabox_sdk/scanner.rb, line 101 def get_code_version code_version = [] Dir.chdir @opts.codebase do # git show-ref --head --heads --tags | grep $(git rev-parse HEAD) stdout_str, stderr_str, status = Open3.capture3('/usr/bin/git', 'rev-parse', 'HEAD') return code_version if stderr_str.include? 'fatal' || status != 0 head_hash = stdout_str.chomp stdout_str, status = Open3.capture2('/usr/bin/git', 'show-ref', '--head', '--heads', '--tags') return code_version if status != 0 stdout_str.each_line do |line| line = line.chomp if line.include? head_hash code_version << line end end end code_version end
info(as_json=true)
click to toggle source
# File lib/scabox_sdk/scanner.rb, line 59 def info(as_json=true) data = {name: @name, description: @description, support: @support} if as_json data = JSON.pretty_generate(data) end data end
parse_json_from_file(filename)
click to toggle source
# File lib/scabox_sdk/scanner.rb, line 190 def parse_json_from_file(filename) content = nil if File.exist?(filename) content = parse_json_from_str(File.read(filename)) end content end
parse_json_from_str(s)
click to toggle source
# File lib/scabox_sdk/scanner.rb, line 179 def parse_json_from_str(s) content = nil unless s.nil? begin content = JSON.parse(s) rescue JSON::ParserError end end content end
save_results()
click to toggle source
# File lib/scabox_sdk/scanner.rb, line 124 def save_results print_normal("Issues found: #{@issues.length}") unless @issues.empty? if @opts.format == :json code_version = [] code_version = get_code_version unless @opts.codebase.nil? json_output = {'type': 'sca', 'code_version': code_version, 'issues': @issues} output = JSON.pretty_generate(json_output) else output = txt_output end if (!@opts.output.nil?) File.open(@opts.output, 'wb') {|file| file.write(output) } print_normal("Output saved: #{@opts.output}") end if (@opts.output_stdout) puts output end end end
start_scan()
click to toggle source
# File lib/scabox_sdk/scanner.rb, line 41 def start_scan starting_time = Process.clock_gettime(Process::CLOCK_MONOTONIC) print_title("Running #{name}...") cmd = prepare_command @cmd_output, status = run_cmd(cmd) normalize_result save_results ending_time = Process.clock_gettime(Process::CLOCK_MONOTONIC) elapsed_time = Time.at(ending_time - starting_time).utc.strftime('%H:%M:%S') print_normal("Time elapsed: #{elapsed_time}") end
txt_output()
click to toggle source
# File lib/scabox_sdk/scanner.rb, line 149 def txt_output sep = "=" * 100 output = '' @issues.each do |i| #pp i #puts "\n\n" output << "Hash Issue: #{i[:hash_issue]}\n" output << "Plugin: #{i[:plugin]}\n" output << "Path: #{i[:path]}\n" output << "Component: #{i[:component]}\n" output << "Version: #{i[:version]}\n" output << "Discovery Method #{i[:discovery_method]}\n" output << "Title: #{i[:title]}\n" output << "Description: #{i[:description].gsub("\n", "")}\n" output << "Solution: #{i[:solution].gsub("\n", "")}\n" output << "Severity: #{i[:severity]}\n" output << "CVE: #{i[:cve].join(', ')}\n" output << "References:\n#{i[:references].join("\n")}\n" output << "#{sep}\n\n" end output end