Skip to content

Commit ac30b34

Browse files
hadarshjfroghadarshjfrog
authored
Add 'dist' to the default exclusion patterns (#248)
1 parent e54708a commit ac30b34

File tree

5 files changed

+124
-15
lines changed

5 files changed

+124
-15
lines changed

Diff for: ‎audit_test.go

+47-12
Original file line numberDiff line numberDiff line change
@@ -544,29 +544,38 @@ func addDummyPackageDescriptor(t *testing.T, hasPackageJson bool) {
544544
// JAS
545545

546546
func TestXrayAuditSastCppFlagSimpleJson(t *testing.T) {
547-
output := testXrayAuditJas(t, securityTests.PlatformCli, filepath.Join("package-managers", "c"), "3", false, true)
547+
output := testXrayAuditJas(t, securityTests.PlatformCli, filepath.Join("package-managers", "c"), "3", false, true, false, "")
548+
validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{
549+
Vulnerabilities: 1,
550+
Sast: 1,
551+
})
552+
}
553+
func TestXrayAuditSastCSharpFlagSimpleJson(t *testing.T) {
554+
// Placeholder until C# Sast is implemented
555+
t.Skip()
556+
output := testXrayAuditJas(t, securityTests.PlatformCli, filepath.Join("package-managers", "dotnet", "dotnet-single"), "3", false, false, true, "")
548557
validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{
549558
Vulnerabilities: 1,
550559
Sast: 1,
551560
})
552561
}
553562

554563
func TestXrayAuditWithoutSastCppFlagSimpleJson(t *testing.T) {
555-
output := testXrayAuditJas(t, securityTests.PlatformCli, filepath.Join("package-managers", "c"), "3", false, false)
564+
output := testXrayAuditJas(t, securityTests.PlatformCli, filepath.Join("package-managers", "c"), "3", false, false, false, "")
556565
// verify no results for Sast
557566
validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{})
558567
}
559568

560569
func TestXrayAuditJasMissingContextSimpleJson(t *testing.T) {
561-
output := testXrayAuditJas(t, securityTests.PlatformCli, filepath.Join("package-managers", "maven", "missing-context"), "3", false, false)
570+
output := testXrayAuditJas(t, securityTests.PlatformCli, filepath.Join("package-managers", "maven", "missing-context"), "3", false, false, false, "")
562571
validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{MissingContext: 1})
563572
}
564573

565574
func TestXrayAuditNotEntitledForJas(t *testing.T) {
566575
integration.InitAuditGeneralTests(t, scangraph.GraphScanMinXrayVersion)
567576
cliToRun, cleanUp := integration.InitTestWithMockCommandOrParams(t, false, getNoJasAuditMockCommand)
568577
defer cleanUp()
569-
output := testXrayAuditJas(t, cliToRun, filepath.Join("jas", "jas"), "3", false, false)
578+
output := testXrayAuditJas(t, cliToRun, filepath.Join("jas", "jas"), "3", false, false, false, "")
570579
validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{Vulnerabilities: 8})
571580
}
572581

@@ -587,7 +596,7 @@ func getNoJasAuditMockCommand() components.Command {
587596
}
588597

589598
func TestXrayAuditJasSimpleJson(t *testing.T) {
590-
output := testXrayAuditJas(t, securityTests.PlatformCli, filepath.Join("jas", "jas"), "3", false, false)
599+
output := testXrayAuditJas(t, securityTests.PlatformCli, filepath.Join("jas", "jas"), "3", false, false, false, "")
591600
validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{
592601
Sast: 1,
593602
Iac: 9,
@@ -603,12 +612,12 @@ func TestXrayAuditJasSimpleJson(t *testing.T) {
603612

604613
func TestXrayAuditJasSimpleJsonWithTokenValidation(t *testing.T) {
605614
integration.InitAuditGeneralTests(t, jasutils.DynamicTokenValidationMinXrayVersion)
606-
output := testXrayAuditJas(t, securityTests.PlatformCli, filepath.Join("jas", "jas"), "3", true, false)
615+
output := testXrayAuditJas(t, securityTests.PlatformCli, filepath.Join("jas", "jas"), "3", true, false, false, "")
607616
validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{Vulnerabilities: 5, Inactive: 5})
608617
}
609618

610619
func TestXrayAuditJasSimpleJsonWithOneThread(t *testing.T) {
611-
output := testXrayAuditJas(t, securityTests.PlatformCli, filepath.Join("jas", "jas"), "1", false, false)
620+
output := testXrayAuditJas(t, securityTests.PlatformCli, filepath.Join("jas", "jas"), "1", false, false, false, "")
612621
validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{
613622
Sast: 1,
614623
Iac: 9,
@@ -623,7 +632,7 @@ func TestXrayAuditJasSimpleJsonWithOneThread(t *testing.T) {
623632
}
624633

625634
func TestXrayAuditJasSimpleJsonWithConfig(t *testing.T) {
626-
output := testXrayAuditJas(t, securityTests.PlatformCli, filepath.Join("jas", "jas-config"), "3", false, false)
635+
output := testXrayAuditJas(t, securityTests.PlatformCli, filepath.Join("jas", "jas-config"), "3", false, false, false, "")
627636
validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{
628637
Secrets: 1,
629638

@@ -636,11 +645,11 @@ func TestXrayAuditJasSimpleJsonWithConfig(t *testing.T) {
636645
}
637646

638647
func TestXrayAuditJasNoViolationsSimpleJson(t *testing.T) {
639-
output := testXrayAuditJas(t, securityTests.PlatformCli, filepath.Join("package-managers", "npm", "npm"), "3", false, false)
648+
output := testXrayAuditJas(t, securityTests.PlatformCli, filepath.Join("package-managers", "npm", "npm"), "3", false, false, false, "")
640649
validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{Vulnerabilities: 1, NotApplicable: 1})
641650
}
642651

643-
func testXrayAuditJas(t *testing.T, testCli *coreTests.JfrogCli, project string, threads string, validateSecrets, validateSastCpp bool) string {
652+
func testXrayAuditJas(t *testing.T, testCli *coreTests.JfrogCli, project string, threads string, validateSecrets bool, validateSastCpp bool, validateSastCSharp bool, customExclusion string) string {
644653
integration.InitAuditGeneralTests(t, scangraph.GraphScanMinXrayVersion)
645654
_, cleanUp := securityTestUtils.CreateTestProjectEnvAndChdir(t, filepath.Join(filepath.FromSlash(securityTests.GetTestResourcesPath()), filepath.Join("projects", project)))
646655
defer cleanUp()
@@ -655,6 +664,13 @@ func testXrayAuditJas(t *testing.T, testCli *coreTests.JfrogCli, project string,
655664
unsetEnv := clientTests.SetEnvWithCallbackAndAssert(t, "JFROG_SAST_ENABLE_CPP", "1")
656665
defer unsetEnv()
657666
}
667+
if validateSastCSharp {
668+
unsetEnv := clientTests.SetEnvWithCallbackAndAssert(t, "JFROG_SAST_ENABLE_CS", "1")
669+
defer unsetEnv()
670+
}
671+
if len(customExclusion) != 0 {
672+
args = append(args, "--exclusions", customExclusion)
673+
}
658674
return testCli.WithoutCredentials().RunCliCmdWithOutput(t, args...)
659675
}
660676

@@ -714,7 +730,7 @@ func TestAuditOnEmptyProject(t *testing.T) {
714730
func TestXrayAuditNotEntitledForJasWithXrayUrl(t *testing.T) {
715731
cliToRun, cleanUp := integration.InitTestWithMockCommandOrParams(t, true, getNoJasAuditMockCommand)
716732
defer cleanUp()
717-
output := testXrayAuditJas(t, cliToRun, filepath.Join("jas", "jas"), "3", false, false)
733+
output := testXrayAuditJas(t, cliToRun, filepath.Join("jas", "jas"), "3", false, false, false, "")
718734
// Verify that scan results are printed
719735
validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{Vulnerabilities: 8})
720736
// Verify that JAS results are not printed
@@ -723,7 +739,7 @@ func TestXrayAuditNotEntitledForJasWithXrayUrl(t *testing.T) {
723739

724740
func TestXrayAuditJasSimpleJsonWithXrayUrl(t *testing.T) {
725741
cliToRun := integration.GetTestCli(cli.GetJfrogCliSecurityApp(), true)
726-
output := testXrayAuditJas(t, cliToRun, filepath.Join("jas", "jas"), "3", false, false)
742+
output := testXrayAuditJas(t, cliToRun, filepath.Join("jas", "jas"), "3", false, false, false, "")
727743
validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{
728744
Sast: 1,
729745
Iac: 9,
@@ -736,3 +752,22 @@ func TestXrayAuditJasSimpleJsonWithXrayUrl(t *testing.T) {
736752
NotApplicable: 2,
737753
})
738754
}
755+
756+
// custom excluded folders
757+
758+
func TestXrayAuditJasSimpleJsonWithCustomExclusions(t *testing.T) {
759+
cliToRun := integration.GetTestCli(cli.GetJfrogCliSecurityApp(), true)
760+
761+
output := testXrayAuditJas(t, cliToRun, filepath.Join("jas", "jas"), "3", false, false, false, "non_existing_folder")
762+
validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{
763+
Sast: 2,
764+
Iac: 9,
765+
Secrets: 6,
766+
767+
Vulnerabilities: 8,
768+
Applicable: 3,
769+
Undetermined: 1,
770+
NotCovered: 1,
771+
NotApplicable: 2,
772+
})
773+
}

Diff for: ‎commands/audit/sca/common_test.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ func TestGetExcludePattern(t *testing.T) {
3636
{
3737
name: "Test no exclude pattern recursive",
3838
params: func() *utils.AuditBasicParams { return (&utils.AuditBasicParams{}).SetIsRecursiveScan(true) },
39-
expected: "(^.*\\.git.*$)|(^.*node_modules.*$)|(^.*target.*$)|(^.*venv.*$)|(^.*test.*$)",
39+
expected: "(^.*\\.git.*$)|(^.*node_modules.*$)|(^.*target.*$)|(^.*venv.*$)|(^.*test.*$)|(^dist$)",
4040
},
4141
{
4242
name: "Test exclude pattern not recursive",
@@ -50,7 +50,7 @@ func TestGetExcludePattern(t *testing.T) {
5050
{
5151
name: "Test no exclude pattern",
5252
params: func() *utils.AuditBasicParams { return &utils.AuditBasicParams{} },
53-
expected: "(^.*\\.git.*$)|(^.*node_modules.*$)|(^.*target.*$)|(^.*venv.*$)|(^.*test.*$)",
53+
expected: "(^.*\\.git.*$)|(^.*node_modules.*$)|(^.*target.*$)|(^.*venv.*$)|(^.*test.*$)|(^dist$)",
5454
},
5555
}
5656

Diff for: ‎tests/testdata/projects/jas/jas/sast/flask_webgoat/dist/init_file_to_ignore.py

+54
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# Copy of __init__ - inside the dist folder - which we expect not to be scanned
2+
3+
import os
4+
import sqlite3
5+
from pathlib import Path
6+
7+
from flask import Flask, g
8+
9+
DB_FILENAME = "database.db"
10+
11+
12+
def query_db(query, args=(), one=False, commit=False):
13+
with sqlite3.connect(DB_FILENAME) as conn:
14+
# vulnerability: Sensitive Data Exposure
15+
conn.set_trace_callback(print)
16+
cur = conn.cursor().execute(query, args)
17+
if commit:
18+
conn.commit()
19+
return cur.fetchone() if one else cur.fetchall()
20+
21+
22+
def create_app():
23+
app = Flask(__name__)
24+
# jfrog-ignore - disable secrets scan findings
25+
app.secret_key = "aeZ1iwoh2ree2mo0Eereireong4baitixaixu5Ee"
26+
27+
db_path = Path(DB_FILENAME)
28+
if db_path.exists():
29+
db_path.unlink()
30+
31+
conn = sqlite3.connect(DB_FILENAME)
32+
create_table_query = """CREATE TABLE IF NOT EXISTS user
33+
(id INTEGER PRIMARY KEY, username TEXT, password TEXT, access_level INTEGER)"""
34+
conn.execute(create_table_query)
35+
36+
insert_admin_query = """INSERT INTO user (id, username, password, access_level)
37+
VALUES (1, 'admin', 'admin', 0)"""
38+
conn.execute(insert_admin_query)
39+
conn.commit()
40+
conn.close()
41+
42+
with app.app_context():
43+
from . import actions
44+
from . import auth
45+
from . import status
46+
from . import ui
47+
from . import users
48+
49+
app.register_blueprint(actions.bp)
50+
app.register_blueprint(auth.bp)
51+
app.register_blueprint(status.bp)
52+
app.register_blueprint(ui.bp)
53+
app.register_blueprint(users.bp)
54+
return app

Diff for: ‎tests/testdata/projects/package-managers/dotnet/dotnet-single/sample_sast_vulnerability.cs

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
using System;
2+
using System.IO;
3+
using System.Web;
4+
5+
public class TaintedPathHandler : IHttpHandler
6+
{
7+
public void ProcessRequest(HttpContext ctx)
8+
{
9+
String path = ctx.Request.QueryString["path"];
10+
// BAD: This could read any file on the filesystem.
11+
ctx.Response.Write(File.ReadAllText(path));
12+
13+
// BAD: This could still read any file on the filesystem.
14+
ctx.Response.Write(File.ReadAllText("/home/user/" + path));
15+
16+
// GOOD: MapPath ensures the path is safe to read from.
17+
string safePath = ctx.Request.MapPath(path, ctx.Request.ApplicationPath, false);
18+
ctx.Response.Write(File.ReadAllText(safePath));
19+
}
20+
}

Diff for: ‎utils/utils.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ var (
3333
// Exclude pattern for files.
3434
DefaultJasExcludePatterns = []string{"**/.git/**", "**/*test*/**", "**/*venv*/**", NodeModulesPattern, "**/target/**", "**/dist/**"}
3535
// Exclude pattern for directories.
36-
DefaultScaExcludePatterns = []string{"*.git*", "*node_modules*", "*target*", "*venv*", "*test*"}
36+
DefaultScaExcludePatterns = []string{"*.git*", "*node_modules*", "*target*", "*venv*", "*test*", "dist"}
3737
)
3838

3939
const (

0 commit comments

Comments
 (0)