merge + fixs

tiagobcx · tiagobcx · commit 3bbc094c6302 · 2022-08-29T10:19:28.000+01:00
diff --git a/.github/workflows/ast-scan.yml b/.github/workflows/ast-scan.yml
@@ -1,6 +1,6 @@
 name: Checkmarx AST Scan
 
-on: [ pull_request, workflow_dispatch ]
+on: [ workflow_dispatch ]
 
 jobs:
   cx-scan:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -7,7 +7,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - name: Use Node.js 14
-        uses: actions/setup-node@v3.4.0
+        uses: actions/setup-node@v3.4.1
         with:
           node-version: 14
           registry-url: https://npm.pkg.github.com/
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -14,7 +14,7 @@ jobs:
           fetch-depth: 0
       - name: Set env
         run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
-      - uses: actions/setup-node@v3.4.0
+      - uses: actions/setup-node@v3.4.1
         with:
           node-version: 10
           registry-url: https://npm.pkg.github.com/
diff --git a/checkmarx-ast-cli.version b/checkmarx-ast-cli.version
@@ -1 +1 @@
-2.0.21
+2.0.25
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@CheckmarxDev/ast-cli-javascript-wrapper",
-  "version": "0.0.55",
+  "version": "0.0.56",
   "description": "AST CLI Javascript wrapper",
   "main": "dist/main/wrapper/CxWrapper.js",
   "typings": "dist/main/wrapper/CxWrapper.d.ts",
@@ -9,11 +9,11 @@
     "README.md"
   ],
   "dependencies": {
-    "log4js": "^6.6.0"
+    "log4js": "^6.6.1"
   },
   "scripts": {
     "build": "tsc",
-    "postbuild": "copyfiles -u 1 src/main/wrapper/resources/cx* dist/",
+    "postbuild": "copyfiles -u 1 src/main/wrapper/resources/cx* dist/;copyfiles -u 1 src/tests/data/* dist/;",
     "lint": "eslint . --ext .ts",
     "lint-and-fix": "eslint . --ext .ts --fix",
     "test": "copyfiles -u 1 src/tests/data/* dist/; tsc && jest --runInBand --coverage"
@@ -27,15 +27,15 @@
   "homepage": "https://github.com/CheckmarxDev/ast-cli-javascript-wrapper#readme",
   "devDependencies": {
     "@types/jest": "^27.5.0",
-    "@types/node": "^18.0.3",
-    "@typescript-eslint/eslint-plugin": "^5.30.6",
-    "@typescript-eslint/parser": "^5.30.6",
+    "@types/node": "^18.7.13",
+    "@typescript-eslint/eslint-plugin": "^5.35.1",
+    "@typescript-eslint/parser": "^5.35.1",
     "copyfiles": "^2.4.1",
-    "eslint": "^8.19.0",
+    "eslint": "^8.22.0",
     "jest": "^26.6.3",
-    "jest-cli": "28.1.2",
+    "jest-cli": "29.0.0",
     "ts-jest": "^26.0.0",
-    "typescript": "^4.7.4"
+    "typescript": "^4.8.2"
   },
   "publishConfig": {
     "registry": "https://npm.pkg.github.com"
diff --git a/src/main/remediation/CxKicsRemediation.ts b/src/main/remediation/CxKicsRemediation.ts
@@ -0,0 +1,14 @@
+export default class CxKicsRemediation {
+    availableRemediation: string;
+    appliedRemediation: string;
+
+    constructor(availableRemediation: string,appliedRemediation: string) {
+        this.availableRemediation = availableRemediation;
+        this.appliedRemediation = appliedRemediation;
+    }
+
+    static parseKicsRemediation(resultObject: any): CxKicsRemediation {
+        const output: CxKicsRemediation = new CxKicsRemediation(resultObject.available_remediation_count,resultObject.applied_remediation_count);
+        return output;
+    }
+}
diff --git a/src/main/results/CxCvss.ts b/src/main/results/CxCvss.ts
@@ -0,0 +1,23 @@
+export default class CxCvss {
+    version:string;
+    attackVector:string;
+    availability:string;
+    confidentiality:string;
+    attackComplexity:string;
+    integrityImpact:string;
+    scope:string;
+    privilegesRequired:string;
+    userInteraction:string;
+
+    constructor(version: string,attackVector: string,availability: string,confidentiality: string,attackComplexity:string,integrityImpact:string,scope:string,privilegesRequired:string,userInteraction:string) {
+        this.version = version;
+        this.attackVector = attackVector;
+        this.availability = availability;
+        this.confidentiality = confidentiality;
+        this.attackComplexity = attackComplexity;
+        this.integrityImpact = integrityImpact;
+        this.scope = scope;
+        this.privilegesRequired = privilegesRequired;
+        this.userInteraction = userInteraction;
+    }
+}
diff --git a/src/main/results/CxData.ts b/src/main/results/CxData.ts
@@ -0,0 +1,29 @@
+import CxPackageData from "./CxPackageData";
+import CxScaPackageData from "./CxScaPackageData";
+import CxNode from "./CxNode";
+
+export default class CxData {
+    packageData:  CxPackageData[];
+    packageIdentifier: string;
+    scaPackageData: CxScaPackageData;
+    queryId: string;
+    queryName: string;
+    group: string;
+    resultHash: string;
+    languageName: string;
+    nodes: CxNode[];
+    recommendedVersion: string;
+
+    constructor(packageData: CxPackageData[],packageIdentifier: string,scaPackageData: CxScaPackageData,queryId: string,queryName: string,group: string,resultHash: string,languageName: string,nodes: CxNode[],recommendedVersion:string) {
+        this.packageData = packageData;
+        this.packageIdentifier = packageIdentifier;
+        this.scaPackageData = scaPackageData;
+        this.queryId = queryId;
+        this.queryName = queryName;
+        this.group = group;
+        this.resultHash = resultHash;
+        this.languageName = languageName;
+        this.nodes = nodes;
+        this.recommendedVersion=recommendedVersion;
+    }
+}
diff --git a/src/main/results/CxDependencyPaths.ts b/src/main/results/CxDependencyPaths.ts
@@ -0,0 +1,6 @@
+export default class CxDependencyPaths {
+    id: string;
+    name: string;
+    version: string;
+    isDevelopment: boolean;
+}
diff --git a/src/main/results/CxNode.ts b/src/main/results/CxNode.ts
@@ -0,0 +1,31 @@
+export default class CxNode {
+    id: string;
+    line: number;
+    name: string;
+    column: number;
+    length: number;
+    method: string;
+    nodeID: number;
+    domType: string;
+    fileName: string;
+    fullName: string;
+    typeName: string;
+    methodLine: number;
+    definitions: string;
+
+    constructor(id: string,line: number,name: string,column: number,length: number,method: string,nodeID: number,domType: string,fileName: string,fullName:string,typeName: string,methodLine: number,definitions: string) {
+        this.id = id;
+        this.line = line;
+        this.name = name;
+        this.column = column;
+        this.length = length;
+        this.method = method;
+        this.nodeID = nodeID;
+        this.domType = domType;
+        this.fileName = fileName;
+        this.fullName = fullName;
+        this.typeName = typeName;
+        this.methodLine = methodLine;
+        this.definitions = definitions;
+    }
+}
diff --git a/src/main/results/CxPackageData.ts b/src/main/results/CxPackageData.ts
@@ -0,0 +1,11 @@
+export default class CxPackageData {
+    comment: string;
+    type: string;
+    url: string;
+
+    constructor(comment: string,type: string,url: string) {
+        this.comment = comment;
+        this.type = type;
+        this.url = url;
+    }
+}
diff --git a/src/main/results/CxResult.ts b/src/main/results/CxResult.ts
@@ -1,3 +1,6 @@
+import CxData from "./CxData";
+import CxVulnerabilityDetails from "./CxVulnerabilityDetails";
+
 export default class CxResult {
     type: string;
     id: string;
@@ -10,7 +13,25 @@ export default class CxResult {
     foundAt: string;
     firstScanId: string;
     description: string;
-    data: any = {};
+    data: CxData;
     comments: any = {};
-    vulnerabilityDetails:object = {};
-}
+    vulnerabilityDetails:CxVulnerabilityDetails;
+
+    constructor(type: string,id: string,status: string,similarityId: string,state: string,severity: string,created: string,firstFoundAt: string,foundAt: string,firstScanId:string,description: string,data: CxData,comments: any,vulnerabilityDetails: CxVulnerabilityDetails) {
+        this.type = type;
+        this.id = id;
+        this.status = status;
+        this.similarityId = similarityId;
+        this.state = state;
+        this.severity = severity;
+        this.created = created;
+        this.firstFoundAt = firstFoundAt;
+        this.foundAt = foundAt;
+        this.firstScanId = firstScanId;
+        this.description = description;
+        this.data = data;
+        this.comments = comments;
+        this.vulnerabilityDetails = vulnerabilityDetails;
+    }
+}
+
diff --git a/src/main/results/CxScaPackageData.ts b/src/main/results/CxScaPackageData.ts
@@ -0,0 +1,17 @@
+import CxDependencyPaths from "./CxDependencyPaths";
+
+export default class CxScaPackageData {
+    id: string;
+    locations: string [];
+    dependencyPaths: CxDependencyPaths [];
+    outdated: boolean;
+    fixLink:string
+
+    constructor(id: string,locations: string [],dependencyPaths: CxDependencyPaths [],outdated: boolean,fixLink:string) {
+        this.id = id;
+        this.locations = locations;
+        this.dependencyPaths = dependencyPaths;
+        this.outdated = outdated;
+        this.fixLink = fixLink;
+    }
+}
diff --git a/src/main/results/CxVulnerabilityDetails.ts b/src/main/results/CxVulnerabilityDetails.ts
@@ -0,0 +1,17 @@
+import CxCvss from "./CxCvss";
+
+export default class CxVulnerabilityDetails {
+    cweId: number;
+    cvss: CxCvss;
+    compliances: string[];
+    cvssScore:number;
+    cveName:string;
+
+    constructor(cweId: number,cvss: CxCvss,compliances: string[],cvssScore: number,cveName:string) {
+        this.cweId = cweId;
+        this.cvss = cvss;
+        this.compliances = compliances;
+        this.cvssScore = cvssScore;
+        this.cveName = cveName;
+    }
+}
diff --git a/src/main/wrapper/CxConstants.ts b/src/main/wrapper/CxConstants.ts
@@ -15,6 +15,16 @@ export enum CxConstants {
     TENANT = "--tenant",
     BASE_URI = "--base-uri",
     BASE_AUTH_URI = "--base-auth-uri",
+    CMD_UTILS = "utils",
+    CMD_REMEDIATION = "remediation",
+    SUB_CMD_REMEDIATION_KICS = "kics",
+    SUB_CMD_REMEDIATION_SCA = "sca",
+    KICS_REMEDIATION_RESULTS_FILE = "--results-file",
+    KICS_REMEDIATION_KICS_FILE = "--kics-files",
+    KICS_REMEDIATION_SIMILARITY_IDS = "--similarity-ids",
+    SCA_REMEDIATION_PACKAGE_FILE = "--package-file",
+    SCA_REMEDIATION_PACKAGE = "--package",
+    SCA_REMEDIATION_PACKAGE_VERSION = "--package-version",
     CMD_AUTH = "auth",
     SUB_CMD_VALIDATE = "validate",
     CMD_PROJECT = "project",
@@ -57,16 +67,14 @@ export enum CxConstants {
     CODE_BASHING_TYPE = "CxCodeBashing",
     KICS_REALTIME_TYPE = "CxKicsRealTime",
     LEARN_MORE_DESCRIPTIONS_TYPE = "CxLearnMoreDescriptions",
+    KICS_REMEDIATION_TYPE = "CxKicsRemediation",
     BFL_TYPE = "CxBFL",
     SAST = "sast",
     LANGUAGE = "--language",
     VULNERABILITY_TYPE = "--vulnerability-type",
     CWE_ID = "--cwe-id",
-
     SEVERITY_HIGH = "high",
     SEVERITY_MEDIUM = "medium",
     STATE_CONFIRMED = "confirmed",
-
-    CMD_UTILS = "utils",
     CMD_LEARN_MORE = "learn-more"
 }
diff --git a/src/main/wrapper/CxWrapper.ts b/src/main/wrapper/CxWrapper.ts
@@ -247,12 +247,35 @@ export class CxWrapper {
         return exec.executeKicsCommands(this.config.pathToExecutable, commands, CxConstants.KICS_REALTIME_TYPE);
     }
 
+
     async learnMore(queryId: string){
         const commands: string[] = [CxConstants.CMD_UTILS,CxConstants.CMD_LEARN_MORE,CxConstants.QUERY_ID,queryId]
         commands.push(...this.initializeCommands(true))
         const exec = new ExecutionService();
         return exec.executeCommands(this.config.pathToExecutable, commands, CxConstants.LEARN_MORE_DESCRIPTIONS_TYPE);
     }
+
+    async kicsRemediation(resultsFile: string, kicsFile:string, engine:string,similarityIds?: string):Promise<[Promise<CxCommandOutput>,any]>  {
+        const commands: string[] = [CxConstants.CMD_UTILS, CxConstants.CMD_REMEDIATION,CxConstants.SUB_CMD_REMEDIATION_KICS,CxConstants.KICS_REMEDIATION_RESULTS_FILE, resultsFile, CxConstants.KICS_REMEDIATION_KICS_FILE, kicsFile];
+        if(engine.length>0){
+            commands.push(CxConstants.ENGINE,engine)
+        }
+        if(similarityIds){
+            commands.push(CxConstants.KICS_REMEDIATION_SIMILARITY_IDS,similarityIds)
+        }
+        commands.push(...this.initializeCommands(false));
+        const exec = new ExecutionService();
+        return exec.executeKicsCommands(this.config.pathToExecutable, commands, CxConstants.KICS_REMEDIATION_TYPE);
+    }
+
+    async scaRemediation(packageFile: string, packages:string, packageVersion:string): Promise<CxCommandOutput>  {
+        const commands: string[] = [CxConstants.CMD_UTILS, CxConstants.CMD_REMEDIATION,CxConstants.SUB_CMD_REMEDIATION_SCA,CxConstants.SCA_REMEDIATION_PACKAGE_FILE, packageFile,CxConstants.SCA_REMEDIATION_PACKAGE, packages,CxConstants.SCA_REMEDIATION_PACKAGE_VERSION,packageVersion];
+        commands.push(...this.initializeCommands(false));
+        const exec = new ExecutionService();
+        return exec.executeCommands(this.config.pathToExecutable, commands);
+    }
+
+
     getIndexOfBflNode(bflNodes: CxBFL[], resultNodes: any[]): number {
 
         const bflNodeNotFound = -1;
diff --git a/src/main/wrapper/ExecutionService.ts b/src/main/wrapper/ExecutionService.ts
@@ -12,6 +12,14 @@ import spawner = require('child_process');
 import CxKicsRealTime from "../kicsRealtime/CxKicsRealTime";
 import CxLearnMoreDescriptions from "../learnmore/CxLearnMoreDescriptions";
 import {CxConstants} from "./CxConstants";
+import CxData from "../results/CxData";
+import CxScaPackageData from "../results/CxScaPackageData";
+import CxVulnerabilityDetails from "../results/CxVulnerabilityDetails";
+import CxCvss from "../results/CxCvss";
+import CxNode from "../results/CxNode";
+import CxPackageData from "../results/CxPackageData";
+import CxKicsRemediation from "../remediation/CxKicsRemediation";
+
 
 
 
@@ -146,7 +154,11 @@ export class ExecutionService {
                   const learnMore = CxLearnMoreDescriptions.parseLearnMoreDescriptionsResponse(resultObject);
                   cxCommandOutput.payload = [learnMore];
                   break;
-                default:
+              case CxConstants.KICS_REMEDIATION_TYPE:
+                  const kicsRemediationOutput = CxKicsRemediation.parseKicsRemediation(resultObject)
+                  cxCommandOutput.payload = [kicsRemediationOutput]
+                  break;
+               default:
                   cxCommandOutput.payload = resultObject;
               }
             }
@@ -186,7 +198,19 @@ export class ExecutionService {
         if(fileExtension.includes("json")){
             const read_json = JSON.parse(read.replace(/:([0-9]{15,}),/g, ':"$1",'));
             if (read_json.results){
-                const r : CxResult[] = read_json.results.map((member:any)=>{return Object.assign( new CxResult(),member);});
+                const r : CxResult[] = read_json.results.map((member:any)=>{
+                    const cxScaPackageData = new CxScaPackageData(member.data.scaPackageData?.id,member.data.scaPackageData?.locations,member.data.scaPackageData?.dependencyPaths,member.data.scaPackageData?.outdated,member.data.scaPackageData?.fixLink);
+                    const cvss = new CxCvss(member.vulnerabilityDetails.cvss.version,member.vulnerabilityDetails.cvss.attackVector,member.vulnerabilityDetails.cvss.availability,member.vulnerabilityDetails.cvss.confidentiality,member.vulnerabilityDetails.cvss.attackComplexity,member.vulnerabilityDetails.cvss.integrityImpact,member.vulnerabilityDetails.cvss.scope,member.vulnerabilityDetails.cvss.privilegesRequired,member.vulnerabilityDetails.cvss.userInteraction);
+                    const cxVulnerabilityDetails = new CxVulnerabilityDetails(member.vulnerabilityDetails.cweId,cvss,member.vulnerabilityDetails.compliances,member.vulnerabilityDetails.cvssScore,member.vulnerabilityDetails.cveName);
+                    const nodes:CxNode[]=member.data.nodes?.map((node:any)=>{
+                        return new CxNode(node.id,node.line,node.name,node.column,node.length,node.method,node.nodeID,node.domType,node.fileName,node.fullName,node.typeName,node.methodLine,node.definitions)
+                    });
+                    const cxPackageData:CxPackageData[]=member.data.packageData?.map((packages:any)=>{
+                        return new CxPackageData(packages.comment,packages.type,packages.url);
+                    });
+                    const data = new CxData(cxPackageData,member.data.packageIdentifier,cxScaPackageData,member.data.queryId,member.data.queryName,member.data.group,member.data.resultHash,member.data.languageName,nodes,member.data.recommendedVersion);
+                    return new CxResult(member.type,member.id,member.status,member.similarityId,member.state,member.severity,member.created,member.firstFoundAt,member.foundAt,member.firstScanId,member.description,data,member.comments,cxVulnerabilityDetails);
+                });
                 cxCommandOutput.payload = r;
             }
             else{
diff --git a/src/main/wrapper/resources/cx-linux b/src/main/wrapper/resources/cx-linux
diff --git a/src/main/wrapper/resources/cx-mac b/src/main/wrapper/resources/cx-mac
diff --git a/src/main/wrapper/resources/cx.exe b/src/main/wrapper/resources/cx.exe
diff --git a/src/tests/RemediationTest.test.ts b/src/tests/RemediationTest.test.ts
diff --git a/src/tests/data/package.json b/src/tests/data/package.json
diff --git a/src/tests/data/positive1.tf b/src/tests/data/positive1.tf
diff --git a/src/tests/data/results.json b/src/tests/data/results.json
