soos-io · SOOS-JAlvarez · Dec 12, 2023 · Dec 12, 2023 · Dec 12, 2023 · Dec 12, 2023
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -26,7 +26,7 @@
   },
   "homepage": "https://github.com/soos-io/soos-sast#readme",
   "dependencies": {
-    "@soos-io/api-client": "^0.2.7",
+    "@soos-io/api-client": "^0.2.9",
     "argparse": "^2.0.1",
     "tslib": "^2.6.2"
   },

diff --git a/src/constants.ts b/src/constants.ts
@@ -1,3 +1,3 @@
 export const SOOS_SAST_CONSTANTS = {
-  FilePatternRegex: /\.sarif\.json$/,
+  FilePattern: "**/*.sarif.json",
 };
diff --git a/src/index.ts b/src/index.ts
@@ -8,21 +8,16 @@ import {
   ScanType,
   soosLogger,
 } from "@soos-io/api-client";
-import {
-  getEnvVariable,
-  obfuscateProperties,
-  ensureEnumValue,
-  ensureValue,
-  ensureNonEmptyValue,
-} from "@soos-io/api-client/dist/utilities";
-import { ArgumentParser } from "argparse";
+import { obfuscateProperties, ensureValue } from "@soos-io/api-client/dist/utilities";
 import * as FileSystem from "fs";
 import * as Path from "path";
 import FormData from "form-data";
+import * as Glob from "glob";
 import { exit } from "process";
-import SOOSAnalysisApiClient from "@soos-io/api-client/dist/api/SOOSAnalysisApiClient";
-import { SOOS_SAST_CONSTANTS } from "./constants";
 import { version } from "../package.json";
+import AnalysisService from "@soos-io/api-client/dist/services/AnalysisService";
+import AnalysisArgumentParser from "@soos-io/api-client/dist/services/AnalysisArgumentParser";
+import { SOOS_SAST_CONSTANTS } from "./constants";
 
 interface SOOSSASTAnalysisArgs {
   apiKey: string;
@@ -34,159 +29,82 @@ interface SOOSSASTAnalysisArgs {
   buildVersion: string;
   clientId: string;
   commitHash: string;
+  directoriesToExclude: Array<string>;
+  filesToExclude: Array<string>;
   integrationName: IntegrationName;
   integrationType: IntegrationType;
   logLevel: LogLevel;
   operatingEnvironment: string;
   projectName: string;
   scriptVersion: string;
-  sastPath: string;
+  sourceCodePath: string;
   verbose: boolean;
 }
 
+interface ISastFile {
+  name: string;
+  path: string;
+}
+
 class SOOSSASTAnalysis {
   constructor(private args: SOOSSASTAnalysisArgs) {}
 
   static parseArgs(): SOOSSASTAnalysisArgs {
-    const parser = new ArgumentParser({ description: "SOOS SAST" });
-
-    parser.add_argument("--apiKey", {
-      help: "SOOS API Key - get yours from https://app.soos.io/integrate/sast",
-      default: getEnvVariable(SOOS_CONSTANTS.EnvironmentVariables.ApiKey),
-      required: false,
-    });
-
-    parser.add_argument("--apiURL", {
-      help: "SOOS API URL - Intended for internal use only, do not modify.",
-      default: "https://api.soos.io/api/",
-      required: false,
-      type: (value: string) => {
-        return ensureNonEmptyValue(value, "apiURL");
-      },
-    });
-
-    parser.add_argument("--appVersion", {
-      help: "App Version - Intended for internal use only.",
-      required: false,
-    });
-
-    parser.add_argument("--branchName", {
-      help: "The name of the branch from the SCM System.",
-      required: false,
-    });
-
-    parser.add_argument("--branchURI", {
-      help: "The URI to the branch from the SCM System.",
-      required: false,
-    });
-
-    parser.add_argument("--buildURI", {
-      help: "URI to CI build info.",
-      required: false,
-    });
-
-    parser.add_argument("--buildVersion", {
-      help: "Version of application build artifacts.",
-      required: false,
-    });
-
-    parser.add_argument("--clientId", {
-      help: "SOOS Client ID - get yours from https://app.soos.io/integrate/sast",
-      default: getEnvVariable(SOOS_CONSTANTS.EnvironmentVariables.ClientId),
-      required: false,
-    });
-
-    parser.add_argument("--commitHash", {
-      help: "The commit hash value from the SCM System.",
-      required: false,
-    });
-
-    parser.add_argument("--integrationName", {
-      help: "Integration Name - Intended for internal use only.",
-      required: false,
-      type: (value: string) => {
-        return ensureEnumValue(IntegrationName, value);
-      },
-      default: IntegrationName.SoosSast,
-    });
+    const analysisArgumentParser = AnalysisArgumentParser.create(ScanType.SAST);
 
-    parser.add_argument("--integrationType", {
-      help: "Integration Type - Intended for internal use only.",
-      required: false,
-      type: (value: string) => {
-        return ensureEnumValue(IntegrationType, value);
-      },
-      default: IntegrationType.Script,
-    });
+    analysisArgumentParser.addBaseScanArguments(
+      IntegrationName.SoosSast,
+      IntegrationType.Script,
+      version,
+    );
 
-    parser.add_argument("--logLevel", {
-      help: "Minimum level to show logs: PASS, IGNORE, INFO, WARN or FAIL.",
-      default: LogLevel.INFO,
+    analysisArgumentParser.argumentParser.add_argument("--sourceCodePath", {
+      help: "The path to start searching for SAST files.",
       required: false,
-      type: (value: string) => {
-        return ensureEnumValue(LogLevel, value);
-      },
-    });
-
-    parser.add_argument("--operatingEnvironment", {
-      help: "Set Operating environment for information purposes only.",
-      required: false,
-    });
-
-    parser.add_argument("--projectName", {
-      help: "Project Name - this is what will be displayed in the SOOS app.",
-      required: true,
-    });
-
-    parser.add_argument("--scriptVersion", {
-      help: "Script Version - Intended for internal use only.",
-      required: false,
-      default: version,
-    });
-
-    parser.add_argument("--verbose", {
-      help: "Enable verbose logging.",
-      action: "store_true",
-      default: false,
-      required: false,
-    });
-
-    parser.add_argument("sastPath", {
-      help: "The SAST File to scan (*.sarif.json), it could be the location of the file or the file itself. When location is specified only the first file found will be scanned.",
+      default: process.cwd(),
     });
 
+    // TODO wrap this method in AnalysisArgumentParser
     soosLogger.info("Parsing arguments");
-    return parser.parse_args();
+    return analysisArgumentParser.argumentParser.parse_args();
   }
 
   async runAnalysis(): Promise<void> {
+    const scanType = ScanType.SAST;
+
+    const sastFiles = await this.findSASTFiles(this.args.sourceCodePath);
+    if (sastFiles.length === 0) {
+      throw new Error("No SAST files found.");
+    }
+
+    const soosAnalysisService = AnalysisService.create(this.args.apiKey, this.args.apiURL);
+
     let projectHash: string | undefined;
     let branchHash: string | undefined;
     let analysisId: string | undefined;
-    const filePath = await this.findSASTFilePath();
-    const soosAnalysisApiClient = new SOOSAnalysisApiClient(this.args.apiKey, this.args.apiURL);
+
     try {
       soosLogger.info("Starting SOOS SAST Analysis");
       soosLogger.info(`Creating scan for project '${this.args.projectName}'...`);
       soosLogger.info(`Branch Name: ${this.args.branchName}`);
 
-      const result = await soosAnalysisApiClient.createScan({
+      const result = await soosAnalysisService.setupScan({
         clientId: this.args.clientId,
         projectName: this.args.projectName,
         commitHash: this.args.commitHash,
-        branch: this.args.branchName,
+        branchName: this.args.branchName,
         buildVersion: this.args.buildVersion,
         buildUri: this.args.buildUri,
         branchUri: this.args.branchUri,
         integrationType: this.args.integrationType,
         operatingEnvironment: this.args.operatingEnvironment,
         integrationName: this.args.integrationName,
         appVersion: this.args.appVersion,
-        scriptVersion: null,
-        contributingDeveloperAudit: undefined,
-        scanType: ScanType.SAST,
-        toolName: null,
-        toolVersion: null,
+        scanType,
+        scriptVersion: this.args.scriptVersion,
+        contributingDeveloperAudit: [], // TODO audit
+        toolName: undefined,
+        toolVersion: undefined,
       });
 
       projectHash = result.projectHash;
@@ -199,33 +117,31 @@ class SOOSSASTAnalysis {
       soosLogger.info("Scan created successfully.");
       soosLogger.logLineSeparator();
 
-      soosLogger.info("Uploading SAST File");
+      soosLogger.info("Uploading SAST Files");
 
-      const formData = await this.getSastAsFormData(filePath);
+      const formData = await this.getSastFilesAsFormData(sastFiles);
 
-      await soosAnalysisApiClient.uploadScanToolResult({
+      await soosAnalysisService.analysisApiClient.uploadScanToolResult({
         clientId: this.args.clientId,
         projectHash,
         branchHash,
-        scanType: ScanType.SAST,
+        scanType,
         scanId: analysisId,
         resultFile: formData,
       });
 
-      soosLogger.info(`Scan result uploaded successfully`);
-
       soosLogger.logLineSeparator();
       soosLogger.info(
-        `Analysis scan started successfully, to see the results visit: ${result.scanUrl}`,
+        `Scan results uploaded successfully. To see the results visit: ${result.scanUrl}`,
       );
     } catch (error) {
       if (projectHash && branchHash && analysisId)
-        await soosAnalysisApiClient.updateScanStatus({
+        await soosAnalysisService.updateScanStatus({
+          analysisId,
           clientId: this.args.clientId,
           projectHash,
           branchHash,
-          scanType: ScanType.SAST,
-          scanId: analysisId,
+          scanType,
           status: ScanStatus.Error,
           message: `Error while performing scan.`,
         });
@@ -234,40 +150,43 @@ class SOOSSASTAnalysis {
     }
   }
 
-  async getSastAsFormData(filePath: string): Promise<FormData> {
-    try {
-      const fileReadStream = FileSystem.createReadStream(filePath, {
+  async getSastFilesAsFormData(sastFiles: ISastFile[]): Promise<FormData> {
+    const formData = sastFiles.reduce((formDataAcc: FormData, sastFile, index) => {
+      const workingDirectory = this.args.sourceCodePath;
+      const fileParts = sastFile.path.replace(workingDirectory, "").split(Path.sep);
+      const parentFolder =
+        fileParts.length >= 2 ? fileParts.slice(0, fileParts.length - 1).join(Path.sep) : "";
+      const suffix = index > 0 ? index : "";
+      const fileReadStream = FileSystem.createReadStream(sastFile.path, {
         encoding: SOOS_CONSTANTS.FileUploads.Encoding,
       });
+      formDataAcc.append(`file${suffix}`, fileReadStream);
+      formDataAcc.append(`parentFolder${suffix}`, parentFolder);
 
-      const formData = new FormData();
-      formData.append("file", fileReadStream);
-      return formData;
-    } catch (error) {
-      soosLogger.error(`Error on getSastAsFormData: ${error}`);
-      throw error;
-    }
-  }
-
-  async findSASTFilePath(): Promise<string> {
-    const sastPathStat = await FileSystem.statSync(this.args.sastPath);
-
-    if (sastPathStat.isDirectory()) {
-      const files = await FileSystem.promises.readdir(this.args.sastPath);
-      const sastFile = files.find((file) => SOOS_SAST_CONSTANTS.FilePatternRegex.test(file));
+      return formDataAcc;
+    }, new FormData());
 
-      if (!sastFile) {
-        throw new Error("No SAST file found in the directory.");
-      }
+    return formData;
+  }
 
-      return Path.join(this.args.sastPath, sastFile);
-    }
+  async findSASTFiles(path: string): Promise<Array<ISastFile>> {
+    soosLogger.info(`Searching for SAST files from ${path}...`);
+    const pattern = `${path}/${SOOS_SAST_CONSTANTS.FilePattern}`;
+    const files = Glob.sync(pattern, {
+      nocase: true,
+    });
+    const matchingFiles = files
+      .map((x) => Path.resolve(x))
+      .map((f) => {
+        return {
+          name: Path.basename(f),
+          path: f,
+        };
+      });
 
-    if (!SOOS_SAST_CONSTANTS.FilePatternRegex.test(this.args.sastPath)) {
-      throw new Error("The file does not match the required SAST pattern.");
-    }
+    soosLogger.info(`${matchingFiles.length} files found matching pattern '${pattern}'.`);
 
-    return this.args.sastPath;
+    return matchingFiles;
   }
 
   static async createAndRun(): Promise<void> {