Merge pull request #15 from nearform/add-docker-support

Add docker support

.gitignore

@@ -3,3 +3,4 @@ gammaray
 dist
 debug.test
 *.log
+*.orig

.travis.yml

@@ -3,7 +3,11 @@ go:
   - 1.9
 
 go_import_path: github.com/nearform/gammaray
+sudo: required
 
+services:
+  - docker
+
 before_install:
   - export PATH="$PATH:$GOPATH/bin"
   - curl https://raw.githubusercontent.com/golang/dep/master/install.sh | sh

Gopkg.toml

@@ -25,18 +25,18 @@
   name = "github.com/docker/docker"
   version = "1.13.1"
 
-[[constraint]]
-  branch = "v25"
-  name = "gopkg.in/libgit2/git2go.v25"
-
-[[constraint]]
-  name = "github.com/mholt/archiver"
-  version = "2.0.0"
-
 [[constraint]]
   name = "github.com/Masterminds/semver"
   version = "1.4.2"
 
 [[constraint]]
   name = "github.com/google/go-cmp"
   version = "0.2.0"
+
+[[constraint]]
+  name = "github.com/jaffee/commandeer"
+  version = "0.1.0"
+
+[[constraint]]
+  name = "github.com/gen2brain/go-unarr"
+  revision = "2adf16213a3c6333c47708458fe777f9e193e396"

Makefile

@@ -15,7 +15,11 @@ install:
 	go get github.com/golang/dep
 	dep ensure
 
-dev-install: install
+build-test-docker-images:
+	docker build test_data/hello-world/ -t gammaray-test-hello-world:1.0.0
+	docker build test_data/insecure-project/ -t gammaray-test-insecure-project:1.0.0
+
+dev-install: install build-test-docker-images
 	go get -u github.com/mgechev/revive
 	go get -u github.com/mna/pigeon
 
@@ -26,6 +30,10 @@ test:
 	go test -v -race ./...
 	go vet ./...
 
+coverage:
+	go test -v -race -cover ./...
+	go vet ./...
+
 ci-test: test
 	goveralls
 

analyzer/analyzer.go

@@ -0,0 +1,113 @@
+package analyzer
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/nearform/gammaray/pathrunner"
+	"github.com/nearform/gammaray/vulnfetcher"
+	"github.com/nearform/gammaray/vulnfetcher/nodeswg"
+	"github.com/nearform/gammaray/vulnfetcher/ossvulnfetcher"
+)
+
+// OSSIndexURL URL for OSSIndex. Is not a hardcoded value to facilitate testing.
+const OSSIndexURL = "https://ossindex.net/api/v3/component-report"
+const nodeswgURL = "https://github.com/nodejs/security-wg/archive/master.zip"
+
+// Analyze analyzes a path to an installed (npm install) node package
+func Analyze(path string) (vulnfetcher.VulnerabilityReport, error) {
+	fmt.Println("Will scan folder <", path, ">")
+	packageList, err := pathrunner.Walk(path)
+	if err != nil {
+		return nil, err
+	}
+
+	// keep only valid packages
+	var packages []pathrunner.NodePackage
+	for _, pkg := range packageList {
+		if pkg.Name == "" {
+			log.Print("Ignoring package with empty name")
+			continue
+		}
+		if pkg.Version == "" {
+			pkg.Version = "*"
+		}
+		packages = append(packages, pkg)
+	}
+
+	ossFetcher := ossvulnfetcher.New(OSSIndexURL)
+	err = ossFetcher.Fetch()
+	if err != nil {
+		return nil, err
+	}
+
+	nodeswgFetcher := nodeswg.New(nodeswgURL)
+	err = nodeswgFetcher.Fetch()
+	if err != nil {
+		return nil, err
+	}
+
+	vulnerabilitiesOSS, err := ossFetcher.TestAll(packages)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(vulnerabilitiesOSS) > 0 {
+		fmt.Println("🚨 Some vulnerabilities found by OSS Index")
+		var pkg string
+		var pkgversion string
+		for _, vulnerability := range vulnerabilitiesOSS {
+			if vulnerability.Package != pkg && vulnerability.PackageVersion != pkgversion {
+				fmt.Printf("\t📦 Package: %s (%s)\n", vulnerability.Package, vulnerability.PackageVersion)
+			}
+			pkg = vulnerability.Package
+			pkgversion = vulnerability.PackageVersion
+
+			fmt.Printf("\t\t- Vulnerability (OSS Index):\n")
+			fmt.Printf("\t\t\tCVE: %s\n\t\t\tCWE: %s\n\t\t\tTitle: %s\n\t\t\tDescription: %s\n\t\t\tMore Info: [%s]\n",
+				vulnerability.CVE,
+				vulnerability.CWE,
+				vulnerability.Title,
+				vulnerability.Description,
+				vulnerability.References,
+			)
+		}
+	} else {
+		fmt.Println("✅ No Vulnerability found by OSS Index")
+	}
+
+	vulnerabilitiesNodeSWG, err := nodeswgFetcher.TestAll(packages)
+	if err != nil {
+		return nil, err
+	}
+	if len(vulnerabilitiesNodeSWG) > 0 {
+		fmt.Println("🚨 Some vulnerabilities found by Node Security Working Group")
+		var pkg string
+		var pkgversion string
+		for _, vulnerability := range vulnerabilitiesNodeSWG {
+			if vulnerability.Package != pkg && vulnerability.PackageVersion != pkgversion {
+				fmt.Printf("\t📦 Package: %s (%s)\n", vulnerability.Package, vulnerability.PackageVersion)
+			}
+			pkg = vulnerability.Package
+			pkgversion = vulnerability.PackageVersion
+			fmt.Printf("\t\t- Vulnerability (Node Security Working Group):\n")
+			fmt.Printf("\t\t\tCVE: %s\n\t\t\tTitle: %s\n\t\t\tVersions: %s\n\t\t\tFixed: %s\n\t\t\tDescription: %s\n\t\t\tMore Info: [%s]\n",
+				vulnerability.CVE,
+				vulnerability.Title,
+				vulnerability.Versions,
+				vulnerability.Fixed,
+				vulnerability.Description,
+				vulnerability.References,
+			)
+		}
+	} else {
+		fmt.Println("✅ No Vulnerability found by Node Security Working Group")
+	}
+
+	report := vulnfetcher.VulnerabilityReport{
+		"OSSIndex": vulnerabilitiesOSS,
+		"NodeSWG":  vulnerabilitiesNodeSWG,
+	}
+
+	return report, nil
+}

analyzer/analyzer_test.go

@@ -0,0 +1,40 @@
+package analyzer
+
+import (
+	"log"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func TestHelloWorld(t *testing.T) {
+	vulns, err := Analyze("../test_data/hello-world")
+	if err != nil {
+		panic(err)
+	}
+	numVulns := 0
+	for provider, vulnList := range vulns {
+		numVulns += len(vulnList)
+		log.Print(provider, "> ", len(vulnList), " vulnerabilities:\n", vulnList)
+	}
+	if diff := cmp.Diff(numVulns, 0); diff != "" {
+		t.Errorf("TestHelloWorld: vulnerabilities : (-got +want)\n%s", diff)
+	}
+}
+
+func TestInsecureProject(t *testing.T) {
+	vulns, err := Analyze("../test_data/insecure-project")
+	if err != nil {
+		panic(err)
+	}
+
+	for provider, vulnList := range vulns {
+		providerVulns := len(vulnList)
+		log.Print(provider, "> ", providerVulns, " vulnerabilities:\n", vulnList)
+		// both OSSIndex and NodeSWG report bassmaster-1.0.0 and its dep hoek-1.5.2
+		if diff := cmp.Diff(providerVulns, 2); diff != "" {
+			t.Errorf("TestInsecureProject: %s vulnerabilities : (-got +want)\n%s", provider, diff)
+		}
+	}
+
+}