Release v1.0 - #138
Merged
Merged
Conversation
allow npm support
* rebase * save commit * Make GuardDog ignore lines in requirements that we can't parse and log a proper warning * apply review comments * apply review comments * Add python version pin for poetry and update README * Add missing project link to PyPI metadata (#97) * Add Type checking and enforce lint (#98) * start integrating type testing * start integrating type testing * type fixing * type fixing * revert previous change * revert previous change * revert previous change * revert previous change * revert previous change * type codebase * type codebase * type codebase * fight mypy * fix lint and enforce it in CI * CI concurency * add code quality instructions in README * use makefile * post rebase fixes * refactoring * support empty description for npm * handle domain part * lint fix * move release zero heuritics * typosquatting: I could not find an up to date list of most downloaded packages. We'll compute it from our mirror later * fix tests * add coverage in tests * add coverage in tests * resolve conflict * test stuff, not sure why coverage does not grow * fix coverage reporting * handle empty description * should be good? * start abstracting requirement scanner * add an integration test * fix scan local * handle conflict resolution * fix archive * handle local scan for npm * npm project scanner version 0 ok * add npm integration tests * add npm integration tests * add npm integration tests * add npm integration tests * add npm integration tests * add npm integration tests * add npm integration tests * save cli update * update cli * update cli * cli should be good - now need to think about the library usage * add tests * simplify cli * apply review comments * save before system update * add ignore path for git npm packages (for now) * update FIXMEs * fix lint * update README.md * update integration tests * refactor detectors * add PyYAML * Update guarddog/analyzer/analyzer.py Co-authored-by: Christophe Tafani-Dereeper <christophe.tafanidereeper@datadoghq.com> * Update guarddog/scanners/npm_project_scanner.py Co-authored-by: Christophe Tafani-Dereeper <christophe.tafanidereeper@datadoghq.com> * soft deprecation of old command * allow programmatic use of NPMPackageScanner * fix email heuristic * fix couple stuff * fix couple stuff * fix couple stuff * fix types * fix express case * fix eval rule * fix requirements * fix lint * replace json flag by reporter one * add extra case * reporter -> output-format * test sarif output * remove test sarif output * remove test sarif output * remove test * save * test current sarif on github * test current sarif on github * test current sarif on github * test current sarif on github * test current sarif on github * test current sarif on github * test current sarif on github * test current sarif on github * test with a more proper sarif? * trigger ci * trigger ci * trigger ci * trigger ci * test more rules details * test more rules details * test with markdown output * test with markdown output * test with markdown output * test with markdown output * update doc * update doc * update findings documentation * add npm corner cases * Update README.md * Update README.md * add ultimate npm corner case * remove artifact * todo pypi version now * npm support for sarif output * also test sarif on pypi * enable tests * enable tests * enable tests * fix lint and types * remove duplicate code * update documentation * update documentation * add sarif output tests * remove ci test * remove test sarif output * remove test * save * test current sarif on github * test current sarif on github * test current sarif on github * test current sarif on github * test current sarif on github * test current sarif on github * test current sarif on github * test current sarif on github * trigger ci * trigger ci * trigger ci * remove artifact * also test sarif on pypi * update documentation * remove ci test * Docker: bump to alpine 1.17 and fix missing package * Update requirements.txt * Use a distroless image * CI: Install dev requirements * Update guarddog/reporters/sarif.py Co-authored-by: Christophe Tafani-Dereeper <christophe.tafanidereeper@datadoghq.com> * apply review comments Co-authored-by: Zachary Allen <zack.allen@datadoghq.com> Co-authored-by: MW <117664996+materro@users.noreply.github.com> Co-authored-by: Christophe Tafani-Dereeper <christophe.tafanidereeper@datadoghq.com>
…e cleanup of processing whl files (#119) * Support scanning WHL files Co-authored-by: Zachary Allen <zack.allen@datadoghq.com> * Add source code heuristic to identify silent process execution Co-authored-by: Zachary Allen <zack.allen@datadoghq.com> * silent-process-execution: Unit tests and README Co-authored-by: Zachary Allen <zack.allen@datadoghq.com>
* npm heuristic: detect silent process execution (closes #122) * Update tests/analyzer/sourcecode/npm-silent-process-execution.js * Update guarddog/analyzer/sourcecode/npm-silent-process-execution.yml * npm heuristic: detect silent process execution, add import cases Co-authored-by: Vladimir de Turckheim <vdeturckheim@users.noreply.github.com>
* started to add npm typposquatter * update doc and add tests * update comment * fix typposquatting
* add rule based on https://www.mend.io/wp-content/media/2022/02/Mend-npm-Threat-Repot.pdf * fix rule eval js * update serialize-environment * Update tests/analyzer/sourcecode/serialize-environment.js * fix env accesses * fix issues * Add reference for new npm heuristic Co-authored-by: Christophe Tafani-Dereeper <christophe.tafanidereeper@datadoghq.com>
* save commit * save commit * save commit * v0 of missmatch files detector * update notes * update hash algorithm * fix issue in versionning * ignore egg_info in setup.cfg * save commit before mistakes are made * do not rely on github api * update version choice * highlight last issue * ensure we use a proper one * add analysis of new detector performances + updates * remove costly piece of the notebook * u[date notebook * move best candidate choice from 23% failure to 16% * fix repo missmatch issue * add a couple tests * fix code quality * add instructions for notebook * fix requirements * fix tests * remove run.py * add libgit2 to the docker * add libgit2 to the docker * add libgit2 to the docker * apply review comments * Typo: replace 'missmatch' by 'mismatch' in new heuristic * Rename detector and add docs * Add description of new heuristic to README * fix package name issue * fix issues Co-authored-by: Christophe Tafani-Dereeper <christophe.tafanidereeper@datadoghq.com>
* update banner with new logo * Update readme * Update logo Co-authored-by: Christophe Tafani-Dereeper <christophe.tafanidereeper@datadoghq.com>
* Rename npm rules with a 'npm-' prefix and add missing test file * Update tests/analyzer/sourcecode/npm-exec-base64.js --------- Co-authored-by: Vladimir de Turckheim <vdeturckheim@users.noreply.github.com>
* Change parallelism * Fix dockerfile and reprint JSON results * Upgrade semgrep * add hook * remove hook * linting * Add GitHub action to scan dependencies with GuardDog * Revert to old Semgrep version * CI scan: disable rule * Invoke Semgrep through subprocess.run instead of programmatic Python interface due to concurrency issue * whitelist finding * CI docs * Add logging and allow configuring parallelism through GUARDDOG_PARALLELISM * Log num of workers to stderr
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| face==20.1.1 ; python_version >= "3.10" and python_version < "4" | ||
| flake8==5.0.4 ; python_version >= "3.10" and python_version < "4" | ||
| future==0.18.2 ; python_version >= "3.10" and python_version < "4" | ||
| future==0.18.3 ; python_version >= "3.10" and python_version < "4" |
Check warning
Code scanning / GuardDog-pypi
GuardDog rule: shady-links
| ppft==1.7.6.6 ; python_version >= "3.10" and python_version < "4" | ||
| prettytable==3.6.0 ; python_version >= "3.10" and python_version < "4" | ||
| pycodestyle==2.9.1 ; python_version >= "3.10" and python_version < "4" | ||
| pycparser==2.21 ; python_version >= "3.10" and python_version < "4" |
Check warning
Code scanning / GuardDog-pypi
GuardDog rule: cmd-overwrite
| semantic-version==2.10.0 ; python_version >= "3.10" and python_version < "4" | ||
| semgrep==0.112.1 ; python_version >= "3.10" and python_version < "4" | ||
| setuptools==65.6.3 ; python_version >= "3.10" and python_version < "4" | ||
| setuptools==65.7.0 ; python_version >= "3.10" and python_version < "4" |
Check warning
Code scanning / GuardDog-pypi
GuardDog rule: shady-links
* Add logging and fix issue where multiple semgrep executions would happen when a rule is excluded or included explicitliy * keep writing workers messages to stderr to avoid messing with redirections
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.