Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bug: Server mode - Scanning a GitHub repo not working #233

Closed
fkluthe opened this issue Jan 30, 2024 · 1 comment
Closed

Bug: Server mode - Scanning a GitHub repo not working #233

fkluthe opened this issue Jan 30, 2024 · 1 comment
Labels
bug Something isn't working

Comments

@fkluthe
Copy link

fkluthe commented Jan 30, 2024

Expected Behavior

Documented here: https://github.com/owasp-dep-scan/dep-scan?tab=readme-ov-file#server-mode

curl --json '{"url": "https://github.com/HooliCorp/vulnerable-aws-koa-app", "type": "js"}' http://0.0.0.0:7070/scan -i

should return 200 and report.

Actual Behavior

curl --json '{"url": "https://github.com/HooliCorp/vulnerable-aws-koa-app", "type": "js"}' http://0.0.0.0:7070/scan -i

returns

HTTP/1.1 500 
content-type: text/html; charset=utf-8
content-length: 265
date: Tue, 30 Jan 2024 12:23:39 GMT
server: hypercorn-h11

<!doctype html>
<html lang=en>
<title>500 Internal Server Error</title>
<h1>Internal Server Error</h1>
<p>The server encountered an internal error and was unable to complete your request. Either the server is overloaded or there is an error in the application.</p>

with error:

depscan-1  | [2024-01-30 12:21:57 +0000] [1] [INFO] 172.19.0.1:56362 GET /cache 1.1 - - 201375591
depscan-1  | ERROR [2024-01-30 12:23:39,365] Exception on request POST /scan
depscan-1  | Traceback (most recent call last):
depscan-1  |   File "/usr/local/lib/python3.11/site-packages/quart/app.py", line 1376, in handle_request
depscan-1  |     return await self.full_dispatch_request(request_context)
depscan-1  |            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
depscan-1  |   File "/usr/local/lib/python3.11/site-packages/quart/app.py", line 1414, in full_dispatch_request
depscan-1  |     result = await self.handle_user_exception(error)
depscan-1  |              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
depscan-1  |   File "/usr/local/lib/python3.11/site-packages/quart/app.py", line 1007, in handle_user_exception
depscan-1  |     raise error
depscan-1  |   File "/usr/local/lib/python3.11/site-packages/quart/app.py", line 1412, in full_dispatch_request
depscan-1  |     result = await self.dispatch_request(request_context)
depscan-1  |              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
depscan-1  |   File "/usr/local/lib/python3.11/site-packages/quart/app.py", line 1506, in dispatch_request
depscan-1  |     return await self.ensure_async(handler)(**request_.view_args)
depscan-1  |            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
depscan-1  |   File "/opt/dep-scan/depscan/cli.py", line 622, in run_scan
depscan-1  |     if os.path.isdir(path):
depscan-1  |        ^^^^^^^^^^^^^^^^^^^
depscan-1  |   File "<frozen genericpath>", line 42, in isdir
depscan-1  | TypeError: stat: path should be string, bytes, os.PathLike or integer, not NoneType
depscan-1  | [2024-01-30 12:23:39 +0000] [1] [INFO] 172.19.0.1:64790 POST /scan 1.1 500 265 31761779

Steps to Reproduce

Checkout: https://github.com/owasp-dep-scan/dep-scan/releases/tag/v5.2.4
Adjust:
https://github.com/owasp-dep-scan/dep-scan/blob/release/6.x/docker-compose.yml#L9-L10
https://github.com/owasp-dep-scan/dep-scan/blob/release/6.x/docker-compose.yml#L18-L19
Eg

 - /home/terkel/workspace/dockerapp_empty:/app
 - /home/terkel/workspace/dockertmp_empty:/tmp

Ramp up:
docker compose up

Execute as documented:
curl http://0.0.0.0:7070/cache
curl` --json '{"url": "https://github.com/HooliCorp/vulnerable-aws-koa-app", "type": "js"}' http://0.0.0.0:7070/scan -i

Additional Information

From docker https://github.com/owasp-dep-scan/dep-scan?tab=readme-ov-file#scanning-projects-locally-docker-container

docker run --rm -v $PWD:/app ghcr.io/owasp-dep-scan/dep-scan --purl https://github.com/HooliCorp/vulnerable-aws-koa-app --reports-dir /app/reports

Is also not working, but iam not sure if i use it correctly.
@fkluthe fkluthe added the bug Something isn't working label Jan 30, 2024
@prabhu prabhu mentioned this issue Jan 30, 2024
Merged
@prabhu
Copy link
Member

prabhu commented Jan 30, 2024 •
edited
Loading

Thanks @fkluthe. Invocation with url is only allowed in server mode when cdxgen is also running in server mode. I will try to improve the experience, but for now, manually clone the repo and invoke depscan with the path and --src argument.

Can you test the PR branch below, please?

#234

prabhu added a commit that referenced this issue Jan 30, 2024
@prabhu
Fixes #233 in v6
4816011 
Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>
@prabhu prabhu mentioned this issue Jan 30, 2024
Merged
@prabhu prabhu closed this as completed in b525587 Jan 30, 2024
prabhu added a commit that referenced this issue Feb 29, 2024
@prabhu @cerrussell @almaz045
Let's make 6.x the default (#265)
12fdf01 
* Clarify bounty targets in insights (#220)

* Clarify bounty targets in insights

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Update pyproject.toml

Signed-off-by: prabhu <prabhu@appthreat.com>

---------

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>
Signed-off-by: prabhu <prabhu@appthreat.com>

* Do not cancel action runs (#228)

* Do not cancel action runs

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Reduce duplicate runs

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

---------

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Update java version (#229)

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Fix oras-py version

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Publish release images

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Fixes #233 in v6 (#235)

* Fixes #233 in v6

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Let's drop support for > 3.10

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

---------

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Check sponsorship for github actions, update workflows (#237)

* Update workflow actions.

Signed-off-by: Caroline Russell <caroline@appthreat.dev>

* Check for sponsorship when using the depscan action on GitHub.

Signed-off-by: Caroline Russell <caroline@appthreat.dev>

---------

Signed-off-by: Caroline Russell <caroline@appthreat.dev>

* Fix AttributeError raised when env variable not present.

Signed-off-by: Caroline Russell <caroline@appthreat.dev>

* Switch to tar xz version for v6 (#240)

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Expand the scope of npm alias to search for vendor with the name npm (#243)

* Expand the scope of npm alias to search for vendor with the name npm

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Lint fixes

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

---------

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Improves sub-tree display (#244)

* Improves sub-tree display

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Try using the default vdb home

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

---------

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Trim CI. Fixes a CSAF error (#251)

* Fixes #248 in v6

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Fixes #248 in v6

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

---------

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Support for gem with platform name in the version number (#253)

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Corrects scenario where no src_dir is set - 6.x (#246)

* Corrects scenario where no src_dir is set.

Signed-off-by: Caroline Russell <caroline@appthreat.dev>

* Bugfix for NoneType.

Signed-off-by: Caroline Russell <caroline@appthreat.dev>

* Bugfix in process_suggestions.

Signed-off-by: Caroline Russell <caroline@appthreat.dev>

---------

Signed-off-by: Caroline Russell <caroline@appthreat.dev>

* Use nodejs 20 LTS (#255)

* Use nodejs 20 LTS

Signed-off-by: prabhu <prabhu@appthreat.com>

* Print node version

Signed-off-by: prabhu <prabhu@appthreat.com>

---------

Signed-off-by: prabhu <prabhu@appthreat.com>

* fix KeyError in purl and version (#261)

ignore components without purl and version

* PR# 263 for v6 (#264)

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Added more alias for js audit (#268)

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

---------

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>
Signed-off-by: prabhu <prabhu@appthreat.com>
Signed-off-by: Caroline Russell <caroline@appthreat.dev>
Co-authored-by: Caroline Russell <caroline@appthreat.dev>
Co-authored-by: almaz045 <63047433+almaz045@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@prabhu @fkluthe