Skip to content

Commit 7a27a37

Browse files
cx-daniel-greenspancx-daniel-greenspan
authored
Merge pull request #886 from CheckmarxDev/Support-ignore-realtime-iac-asca-containers
Support ignore in asca iac and contanires plus tests
2 parents 7496409 + 041c0fc commit 7a27a37

File tree

3 files changed

+159
-30
lines changed

3 files changed

+159
-30
lines changed

‎src/main/wrapper/CxWrapper.ts‎

Lines changed: 72 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -127,28 +127,39 @@ export class CxWrapper {
127127
return await exec.executeCommands(this.config.pathToExecutable, commands, CxConstants.SCAN_TYPE);
128128
}
129129

130-
async scanAsca(sourceFile: string, updateVersion = false, agent?: string | null): Promise<CxCommandOutput> {
131-
const commands: string[] = [CxConstants.CMD_SCAN, CxConstants.CMD_ASCA, CxConstants.SOURCE_FILE, sourceFile];
130+
async scanAsca(
131+
sourceFile: string,
132+
updateVersion = false,
133+
agent?: string | null,
134+
ignoredFilePath?: string
135+
): Promise<CxCommandOutput> {
136+
const commands: string[] = [
137+
CxConstants.CMD_SCAN,
138+
CxConstants.CMD_ASCA,
139+
CxConstants.SOURCE_FILE,
140+
sourceFile
141+
];
132142

133-
if (updateVersion) {
134-
commands.push(CxConstants.ASCA_UPDATE_VERSION);
135-
}
136-
if (agent) {
137-
commands.push(CxConstants.AGENT);
138-
commands.push(agent);
139-
}
140-
else {
141-
commands.push(CxConstants.AGENT);
142-
// if we don't send any parameter in the flag
143-
// then in the cli takes the default and this is not true
144-
commands.push('"js-wrapper"');
145-
}
143+
if (updateVersion) {
144+
commands.push(CxConstants.ASCA_UPDATE_VERSION);
145+
}
146146

147-
commands.push(...this.initializeCommands(false));
148-
const exec = new ExecutionService();
149-
return await exec.executeCommands(this.config.pathToExecutable, commands, CxConstants.SCAN_ASCA);
147+
if (agent) {
148+
commands.push(CxConstants.AGENT, agent);
149+
} else {
150+
commands.push(CxConstants.AGENT, '"js-wrapper"');
150151
}
151152

153+
if (ignoredFilePath) {
154+
commands.push(CxConstants.IGNORE__FILE_PATH, ignoredFilePath);
155+
}
156+
157+
commands.push(...this.initializeCommands(false));
158+
159+
const exec = new ExecutionService();
160+
return await exec.executeCommands(this.config.pathToExecutable, commands, CxConstants.SCAN_ASCA);
161+
}
162+
152163
async ossScanResults(sourceFile: string, ignoredFilePath?: string): Promise<CxCommandOutput> {
153164
const commands: string[] = [
154165
CxConstants.CMD_SCAN,
@@ -168,20 +179,53 @@ export class CxWrapper {
168179
return await exec.executeCommands(this.config.pathToExecutable, commands, CxConstants.SCAN_OSS);
169180
}
170181

171-
async containersRealtimeScanResults(sourceFile: string): Promise<CxCommandOutput> {
172-
const commands: string[] = [CxConstants.CMD_SCAN, CxConstants.CMD_CONTAINERS_REALTIME, CxConstants.SOURCE, sourceFile];
173-
commands.push(...this.initializeCommands(false));
174-
const exec = new ExecutionService();
175-
return await exec.executeCommands(this.config.pathToExecutable, commands, CxConstants.SCAN_CONTAINERS_REALTIME);
182+
async containersRealtimeScanResults(
183+
sourceFile: string,
184+
ignoredFilePath?: string
185+
): Promise<CxCommandOutput> {
186+
const commands: string[] = [
187+
CxConstants.CMD_SCAN,
188+
CxConstants.CMD_CONTAINERS_REALTIME,
189+
CxConstants.SOURCE,
190+
sourceFile
191+
];
192+
193+
if (ignoredFilePath) {
194+
commands.push(CxConstants.IGNORE__FILE_PATH);
195+
commands.push(ignoredFilePath);
176196
}
177197

178-
async iacRealtimeScanResults(sourceFile: string, engine: string): Promise<CxCommandOutput> {
179-
const commands: string[] = [CxConstants.CMD_SCAN, CxConstants.CMD_IAC_REALTIME, CxConstants.SOURCE, sourceFile, CxConstants.ENGINE, engine];
180-
commands.push(...this.initializeCommands(false));
181-
const exec = new ExecutionService();
182-
return await exec.executeCommands(this.config.pathToExecutable, commands, CxConstants.SCAN_IAC);
198+
commands.push(...this.initializeCommands(false));
199+
200+
const exec = new ExecutionService();
201+
return await exec.executeCommands(this.config.pathToExecutable, commands, CxConstants.SCAN_CONTAINERS_REALTIME);
202+
}
203+
204+
async iacRealtimeScanResults(
205+
sourceFile: string,
206+
engine: string,
207+
ignoredFilePath?: string
208+
): Promise<CxCommandOutput> {
209+
const commands: string[] = [
210+
CxConstants.CMD_SCAN,
211+
CxConstants.CMD_IAC_REALTIME,
212+
CxConstants.SOURCE,
213+
sourceFile,
214+
CxConstants.ENGINE,
215+
engine
216+
];
217+
218+
if (ignoredFilePath) {
219+
commands.push(CxConstants.IGNORE__FILE_PATH);
220+
commands.push(ignoredFilePath);
183221
}
184222

223+
commands.push(...this.initializeCommands(false));
224+
225+
const exec = new ExecutionService();
226+
return await exec.executeCommands(this.config.pathToExecutable, commands, CxConstants.SCAN_IAC);
227+
}
228+
185229
async secretsScanResults(sourceFile: string, ignoredFilePath?: string): Promise<CxCommandOutput> {
186230
const commands: string[] = [
187231
CxConstants.CMD_SCAN,

‎src/tests/ScanTest.test.ts‎

Lines changed: 70 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@ import { CxCommandOutput } from "../main/wrapper/CxCommandOutput";
33
import { CxParamType } from "../main/wrapper/CxParamType";
44
import { BaseTest } from "./BaseTest";
55
import {OssPackage} from "./data/ossTypes";
6+
import CxIacResult from "../main/iacRealtime/CxIac";
7+
import CxContainerRealtimeResult from "../main/containersRealtime/CxContainerRealtime";
8+
import CxAsca from '../main/asca/CxAsca';
69

710
describe("ScanCreate cases", () => {
811
const cxScanConfig = new BaseTest();
@@ -229,19 +232,84 @@ describe("ScanCreate cases", () => {
229232

230233
it('ScanContainersRealtime Successful case', async () => {
231234
const wrapper = new CxWrapper(cxScanConfig);
232-
const cxCommandOutput: CxCommandOutput = await wrapper.containersRealtimeScanResults("src/tests/data/Dockerfile");
235+
const cxCommandOutput: CxCommandOutput = await wrapper.containersRealtimeScanResults("src/tests/data/Dockerfile", "");
233236
console.log("Json object from scanContainersRealtime successful case: " + JSON.stringify(cxCommandOutput));
234237
expect(cxCommandOutput.payload).toBeDefined();
235238
expect(cxCommandOutput.exitCode).toBe(0);
236239
});
237240

238241
it.skip('ScanIacRealtime Successful case', async () => {
239242
const wrapper = new CxWrapper(cxScanConfig);
240-
const cxCommandOutput: CxCommandOutput = await wrapper.iacRealtimeScanResults("src/tests/data/Dockerfile", "docker");
243+
const cxCommandOutput: CxCommandOutput = await wrapper.iacRealtimeScanResults("src/tests/data/Dockerfile", "docker","");
241244
console.log("Json object from scanIacRealtime successful case: " + JSON.stringify(cxCommandOutput));
242245
expect(cxCommandOutput.payload).toBeDefined();
243246
expect(cxCommandOutput.exitCode).toBe(0);
244247
});
245248

249+
250+
251+
it.skip('ScanIacRealtime with ignore file should filter results', async () => {
252+
const wrapper = new CxWrapper(cxScanConfig);
253+
const sourceFile = "src/tests/data/Dockerfile";
254+
const ignoredFile = "src/tests/data/ignoredIacContainersAsca";
255+
256+
const cxCommandOutput: CxCommandOutput = await wrapper.iacRealtimeScanResults(sourceFile, "docker", ignoredFile);
257+
258+
expect(cxCommandOutput.exitCode).toBe(0);
259+
expect(cxCommandOutput.payload).toBeDefined();
260+
261+
const findings = CxIacResult.parseResult(cxCommandOutput.payload);
262+
263+
console.log("Filtered IAC findings:", findings);
264+
265+
expect(findings.length).toBe(3);
266+
});
267+
268+
269+
it.skip('ScanContainersRealtime with ignored image should filter result', async () => {
270+
const wrapper = new CxWrapper(cxScanConfig);
271+
const sourceFile = "tsc/tests/data/Dockerfile";
272+
const ignoredFile = "tsc/tests/data/ignoredIacContainersAsca.json";
273+
274+
const cxCommandOutput: CxCommandOutput = await wrapper.containersRealtimeScanResults(sourceFile, ignoredFile);
275+
276+
expect(cxCommandOutput.exitCode).toBe(0);
277+
expect(cxCommandOutput.payload).toBeDefined();
278+
279+
const parsedResults = CxContainerRealtimeResult.parseResult(cxCommandOutput.payload[0]);
280+
281+
console.log("Filtered container results:", parsedResults);
282+
283+
expect(parsedResults.length).toBe(0);
284+
});
285+
286+
it.skip('ScanAsca with ignore file should filter one result', async () => {
287+
const wrapper = new CxWrapper(cxScanConfig);
288+
289+
const sourcePath = "tsc/tests/data/python-vul-file.py";
290+
const ignoreFile = "tsc/tests/data/ignoredIacContainersAsca.json";
291+
292+
const cxCommandOutput: CxCommandOutput = await wrapper.scanAsca(
293+
sourcePath,
294+
false,
295+
null,
296+
ignoreFile
297+
);
298+
299+
expect(cxCommandOutput.exitCode).toBe(0);
300+
expect(cxCommandOutput.payload).toBeDefined();
301+
302+
const parsed = CxAsca.parseScan(cxCommandOutput.payload[0]);
303+
console.log("Filtered ASCA results:", parsed.scanDetails);
304+
305+
expect(parsed.status).toBe(true);
306+
expect(Array.isArray(parsed.scanDetails)).toBe(true);
307+
308+
309+
expect(parsed.scanDetails.length).toBe(5);
310+
});
311+
312+
313+
246314
});
247315

‎src/tests/data/ignoredIacContainersAsca.json‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
[
2+
{
3+
"FilePath": "src/tests/data/Dockerfile",
4+
"SimilarityID": "204fc29cbec21db48abe962c6ede10cfeced76de22128c5ffdde928f3a0455d3",
5+
"Title": "APT-GET Missing Flags To Avoid Manual Input"
6+
},
7+
{
8+
"ImageName": "openjdk",
9+
"ImageTag": "11.0.1-jre-slim-stretch",
10+
"FilePath": "Dockerfile"
11+
},
12+
{
13+
"FileName": "python-vul-file.py",
14+
"Line": 56,
15+
"RuleID": 4009
16+
}
17+
]

0 commit comments

Comments
 (0)