def __scan(file_path):
for rule in self.blacklist_rule:
flag = rule.verify(file_path)
if flag:
rule.get_info(file_path)
if project.web_url:
report = '{0}/blob/{1}/{2}#L{3}'.format(
project.web_url, project.branch, file_path,
rule.start_line)
else:
report = ''
author, author_email = get_git_author(
project.get_last_author(file_path))
vuln = Vulnerability(
task_id=project.task_id,
rule_key=rule.key,
risk_id=rule.risk_id,
title=rule.name,
file=file_path,
author=author,
author_email=author_email,
hash=project.get_last_commit(),
start_line=rule.start_line,
end_line=rule.end_line,
report=report,
code_example=rule.code_example,
engine=self.key,
)
vuln_key = hash_md5('{0}_{1}_{2}'.format(
file_path, rule.id, rule.start_line))
if vuln_key not in kb.result[project.key]:
kb.result[project.key][vuln_key] = vuln.info
project.logger.debug(
'[PluginScanner] {0}'.format(vuln))
def test_upload_file_and_download_file(self):
file_name = '{0}.txt'.format(hash_md5('{0}'.format(time.time())))
file_path = os.path.join(BASEDIR, 'tests', 'data', 'tmp', file_name)
file_content = 'ftp test.'
make_dir(os.path.join(BASEDIR, 'tests', 'data', 'tmp'))
with open(file_path, 'wb') as fp:
fp.write(file_content.encode('utf-8'))
self.assertTrue(os.path.isfile(file_path))
ftp = FTPWork(
host=FTPWorkTestCase.host,
port=FTPWorkTestCase.port,
username=FTPWorkTestCase.username,
password=FTPWorkTestCase.password,
)
# test upload
self.assertTrue(ftp.upload_file(file_path, file_name))
# test download
save_file_local_path = os.path.join(BASEDIR, 'tests', 'data', 'tmp', 'ftp_download.txt')
ftp.download_file(save_file_local_path, file_name)
self.assertTrue(os.path.isfile(save_file_local_path))
with open(file_path, 'rb') as fp:
c = fp.read()
self.assertEqual(file_content, c.decode('utf-8'))
# test delete
self.assertTrue(ftp.delete_file(file_name))
clean_dir(os.path.join(BASEDIR, 'tests', 'data', 'tmp'))
def __create_issue(self, project, issue):
"""
:param project:
:param issue:
:return:
"""
try:
if not issue and not isinstance(issue, dict):
return
start_line, end_line = 1, 1
if 'textRange' in issue and ('startLine' in issue['textRange']
or 'endLine' in issue['textRange']):
start_line = issue['textRange']['startLine']
end_line = issue['textRange']['endLine']
_, filename = issue['component'].split(':')
author, author_email = get_git_author(
project.get_last_author(filename))
report_detail_url = '{0}component?id={1}&line={2}'.format(
self._api_domain, issue['component'], start_line)
code_segment = get_line_content(
file=os.path.join(project.scan_path, filename),
start_line=start_line +
int(project.evidence_start_line_offset),
count=project.evidence_count)
vuln = Vulnerability(
task_id=project.task_id,
risk_id=get_risk_by_severity(issue['severity']),
rule_key=issue['rule'],
category=issue['type'],
title=issue['message'],
file=filename,
author=author,
author_email=author_email,
hash=project.get_last_commit(),
start_line=start_line,
end_line=end_line,
report=report_detail_url,
code_example=''.join(code_segment),
engine=self.key,
)
vuln_key = hash_md5('{0}_{1}_{2}'.format(filename, issue['rule'],
start_line))
if vuln_key not in kb.result[project.key]:
kb.result[project.key][vuln_key] = vuln.info
except Exception as ex:
import traceback
traceback.print_exc()
project.logger.error(ex)
def __scan(file_path):
for rule in self.blacklist_rule:
flag, _ = rule.verify(reference_value=file_path)
project.logger.debug(
"[RuleScanner] rule: [{0}], file: [{1}]".format(
rule, file_path))
if flag:
relative_path = file_path.replace(project.scan_path, "")
project.logger.info(
"[RuleScanner] [Blacklist] [+] Found '{0}' vulnerability in '{1}' file."
.format(rule.name, relative_path))
info = rule.get_info(match_content=_,
origin_file=file_path)
if project.web_url:
report = '{0}/blob/{1}{2}#L{3}'.format(
project.web_url, project.branch, relative_path,
info['start_line'])
else:
report = ''
author, author_email = get_git_author(
project.get_last_author(file_path))
vuln = Vulnerability(
task_id=project.task_id,
rule_key=rule.key,
risk_id=rule.risk_id,
title=rule.name,
file=relative_path,
author=author,
author_email=author_email,
hash=project.get_last_commit(),
start_line=info['start_line'],
end_line=info['end_line'],
report=report,
code_example=info['code_example'],
evidence_content=_,
engine=self.key,
)
vuln_key = hash_md5('{0}_{1}_{2}'.format(
file_path, rule.id, info['start_line']))
if vuln_key not in kb.result[project.key]:
kb.result[project.key][vuln_key] = vuln.info
project.logger.debug('[RuleScanner] {0}'.format(vuln))
def start_component(self, project):
"""
:param project:
:return:
"""
project.logger.info(
"[RuleScanner] Begin to perform rule-based component vulnerability analysis..."
)
same_result = []
for rule in self.component_rule:
project.logger.debug("[RuleScanner] Test '{0}' rule...".format(
rule.name))
for component in project.statistics['depends']:
flag, _ = rule.verify(component_name=component['name'],
version=component['version'],
group_id=component['tag'])
msg = "[RuleScanner] group_id: [{0}], component name: [{1}], component version: [{2}], status: [{3}], " \
"result: [{4}]".format(component['tag'], component['name'], component['version'], flag, _)
project.logger.debug(msg)
if flag:
origin_file = component['origin']
# include find vuln
if component[
'parent_origin'] and project.component_same_vuln_merge_enable:
key = '{0}_{1}'.format(rule.key,
component['parent_origin'])
if key in same_result:
continue
else:
origin_file = component['parent_origin']
same_result.append(key)
else: # origin find vuln
key = '{0}_{1}'.format(rule.key, component['origin'])
same_result.append(key)
project.logger.info(
"[RuleScanner] [Component] [+] Found '{0}' vulnerability."
.format(rule.name))
info = rule.get_info(match_content=_,
origin_file=os.path.join(
project.scan_path,
component['origin']),
evidence_start_line_offset=project.
evidence_start_line_offset,
evidence_count=project.evidence_count)
if project.web_url:
report = '{0}/blob/{1}/{2}#L{3}'.format(
project.web_url, project.branch, origin_file,
info['start_line'])
else:
report = ''
author, author_email = get_git_author(
project.get_last_author(component['origin']))
vuln = Vulnerability(
task_id=project.task_id,
rule_key=rule.key,
risk_id=rule.risk_id,
title=rule.name,
file=origin_file,
author=author,
author_email=author_email,
hash=project.get_last_commit(),
start_line=info['start_line'],
end_line=info['end_line'],
report=report,
code_example=info['code_example'],
evidence_content=_,
engine=self.key,
)
vuln_key = hash_md5('{0}_{1}_{2}'.format(
component['origin'], rule.id, info['start_line']))
if vuln_key not in kb.result[project.key]:
kb.result[project.key][vuln_key] = vuln.info
project.logger.debug('[RuleScanner] {0}'.format(vuln))
project.logger.info("[RuleScanner] Rule component scan completed.")