Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Audit SCA recursive scan #2283

Merged
merged 18 commits into from
Nov 5, 2023
Merged

Audit SCA recursive scan #2283

Show file tree
Hide file tree
Changes from 9 commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
3fcc4fa
Audit SCA recursive scan
attiasas Oct 24, 2023
8c8c373
format
attiasas Oct 24, 2023
ea7842b
fix tests
attiasas Oct 24, 2023
02fe6b0
remove recursive flag
attiasas Oct 24, 2023
9b2417b
remove recursive flag
attiasas Oct 24, 2023
cc693ba
update default exclusion flag info
attiasas Oct 24, 2023
580b13b
Merge remote-tracking branch 'upstream/dev' into add_recursive_audit
attiasas Oct 25, 2023
481fc9d
ad relative exclusion
attiasas Oct 25, 2023
5846a0b
update core
attiasas Oct 25, 2023
8147342
Merge branch 'dev' into add_recursive_audit
eyalbe4 Nov 1, 2023
16f9806
review changes
attiasas Nov 1, 2023
11a95fd
Merge remote-tracking branch 'upstream/dev' into add_recursive_audit
attiasas Nov 1, 2023
2e131f3
Merge remote-tracking branch 'origin/add_recursive_audit' into add_re…
attiasas Nov 1, 2023
1b13f49
update core after changes
attiasas Nov 2, 2023
3bbf9ad
fix go mod
attiasas Nov 5, 2023
d01f1cf
update go mod
attiasas Nov 5, 2023
fead4f2
update go mod
attiasas Nov 5, 2023
1a70683
Merge remote-tracking branch 'upstream/dev' into add_recursive_audit
attiasas Nov 5, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,8 +131,8 @@ require (

// replace github.com/jfrog/build-info-go => github.com/jfrog/build-info-go v1.8.9-0.20231019085746-e1b192457664

// replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 v2.31.1-0.20231019090648-a85aaa5fe352
replace github.com/jfrog/jfrog-cli-core/v2 => github.com/attiasas/jfrog-cli-core/v2 v2.0.0-20231025121833-1772407e9154

// replace github.com/jfrog/gofrog => github.com/jfrog/gofrog v1.2.6-0.20230418122323-2bf299dd6d27

// replace github.com/jfrog/jfrog-client-go => github.com/jfrog/jfrog-client-go dev
replace github.com/jfrog/jfrog-client-go => github.com/attiasas/jfrog-client-go v0.0.0-20231025121226-04e810f6f34a
8 changes: 4 additions & 4 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,10 @@ github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkE
github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0 h1:jfIu9sQUG6Ig+0+Ap1h4unLjW6YQJpKZVmUzxsD4E/Q=
github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0/go.mod h1:t2tdKJDJF9BV14lnkjHmOQgcvEKgtqs5a1N3LNdJhGE=
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
github.com/attiasas/jfrog-cli-core/v2 v2.0.0-20231025121833-1772407e9154 h1:f0XkLpEwZZVtT/EWyJ3peCeYtoZHXGsU45fsSgmla1w=
github.com/attiasas/jfrog-cli-core/v2 v2.0.0-20231025121833-1772407e9154/go.mod h1:v3rOOvoKtIa2D9ry68ZRfo6sx+bEB7pd49AqnsAfZRg=
github.com/attiasas/jfrog-client-go v0.0.0-20231025121226-04e810f6f34a h1:yto6FgxR7sT2twmbYbpTfBJDdaz305KksXscZbYSRTY=
github.com/attiasas/jfrog-client-go v0.0.0-20231025121226-04e810f6f34a/go.mod h1:fuxhYzWEkA16+ZV5cP/BJUGjA3SXVKbBoDmb8ZS6J4g=
github.com/bradleyjkemp/cupaloy/v2 v2.8.0 h1:any4BmKE+jGIaMpnU8YgH/I2LPiLBufr6oMMlVBbn9M=
github.com/buger/jsonparser v1.1.1 h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs=
github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
Expand Down Expand Up @@ -243,10 +247,6 @@ github.com/jfrog/gofrog v1.3.1 h1:QqAwQXCVReT724uga1AYqG/ZyrNQ6f+iTxmzkb+YFQk=
github.com/jfrog/gofrog v1.3.1/go.mod h1:IFMc+V/yf7rA5WZ74CSbXe+Lgf0iApEQLxRZVzKRUR0=
github.com/jfrog/jfrog-apps-config v1.0.1 h1:mtv6k7g8A8BVhlHGlSveapqf4mJfonwvXYLipdsOFMY=
github.com/jfrog/jfrog-apps-config v1.0.1/go.mod h1:8AIIr1oY9JuH5dylz2S6f8Ym2MaadPLR6noCBO4C22w=
github.com/jfrog/jfrog-cli-core/v2 v2.45.4 h1:IHwL2RQ0VwibUCPLFtCm53tMrO1ZOmSkf6Kt2o3iD3U=
github.com/jfrog/jfrog-cli-core/v2 v2.45.4/go.mod h1:5rTYHinkg5k2ALHYROR3AnE2mMQ22SFZF5dwew1sgco=
github.com/jfrog/jfrog-client-go v1.34.3 h1:kDfw3FUQQvOsTKFqonIgLlziez6CSX80xCYZIH9YYcg=
github.com/jfrog/jfrog-client-go v1.34.3/go.mod h1:fuxhYzWEkA16+ZV5cP/BJUGjA3SXVKbBoDmb8ZS6J4g=
github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
github.com/jszwec/csvutil v1.8.0 h1:G7vS2LGdpZZDH1HmHeNbxOaJ/ZnJlpwGFvOkTkJzzNk=
Expand Down
3 changes: 2 additions & 1 deletion scan/cli.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -259,7 +259,8 @@ func createAuditCmd(c *cli.Context) (*audit.AuditCommand, error) {
SetPrintExtendedTable(c.Bool(cliutils.ExtendedTable)).
SetMinSeverityFilter(minSeverity).
SetFixableOnly(c.Bool(cliutils.FixableOnly)).
SetThirdPartyApplicabilityScan(c.Bool(cliutils.ThirdPartyContextualAnalysis))
SetThirdPartyApplicabilityScan(c.Bool(cliutils.ThirdPartyContextualAnalysis)).
SetExclusions(cliutils.GetStringsArrFlagValue(c, "exclusions"))

if c.String("watches") != "" {
auditCmd.SetWatches(splitByCommaAndTrim(c.String("watches")))
Expand Down
19 changes: 12 additions & 7 deletions utils/cliutils/commandsflags.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -494,6 +494,7 @@ const (
RequirementsFile = "requirements-file"
watches = "watches"
workingDirs = "working-dirs"
ExclusionsAudit = auditPrefix + exclusions
repoPath = "repo-path"
licenses = "licenses"
vuln = "vuln"
Expand Down Expand Up @@ -1380,6 +1381,10 @@ var flagsMap = map[string]cli.Flag{
Name: workingDirs,
Usage: "[Optional] A comma-separated list of relative working directories, to determine audit targets locations.` `",
},
ExclusionsAudit: cli.StringFlag{
Name: exclusions,
Usage: "[Default: *node_modules*;*target*;*venv*;*test*] Semicolon-separated list of exclusions. Exclusions can include the * and the ? wildcards.` `",
attiasas marked this conversation as resolved.
Show resolved Hide resolved
},
ExtendedTable: cli.BoolFlag{
Name: ExtendedTable,
Usage: "[Default: false] Set to true if you'd like the table to include extended fields such as 'CVSS' & 'Xray Issue Id'. Ignored if provided 'format' is not 'table'.` `",
Expand Down Expand Up @@ -2016,25 +2021,25 @@ var commandFlags = map[string][]string{
},
Audit: {
xrUrl, user, password, accessToken, serverId, InsecureTls, Project, watches, repoPath, licenses, xrOutput, ExcludeTestDeps,
useWrapperAudit, DepType, RequirementsFile, fail, ExtendedTable, workingDirs, Mvn, Gradle, Npm, Yarn, Go, Nuget, Pip, Pipenv, Poetry, MinSeverity, FixableOnly, ThirdPartyContextualAnalysis,
useWrapperAudit, DepType, RequirementsFile, fail, ExtendedTable, workingDirs, ExclusionsAudit, Mvn, Gradle, Npm, Yarn, Go, Nuget, Pip, Pipenv, Poetry, MinSeverity, FixableOnly, ThirdPartyContextualAnalysis,
},
AuditMvn: {
xrUrl, user, password, accessToken, serverId, InsecureTls, Project, watches, repoPath, licenses, xrOutput, fail, ExtendedTable, useWrapperAudit,
xrUrl, user, password, accessToken, serverId, InsecureTls, Project, ExclusionsAudit, watches, repoPath, licenses, xrOutput, fail, ExtendedTable, useWrapperAudit,
},
AuditGradle: {
xrUrl, user, password, accessToken, serverId, ExcludeTestDeps, useWrapperAudit, Project, watches, repoPath, licenses, xrOutput, fail, ExtendedTable,
xrUrl, user, password, accessToken, serverId, ExcludeTestDeps, ExclusionsAudit, useWrapperAudit, Project, watches, repoPath, licenses, xrOutput, fail, ExtendedTable,
},
AuditNpm: {
xrUrl, user, password, accessToken, serverId, DepType, Project, watches, repoPath, licenses, xrOutput, fail, ExtendedTable,
xrUrl, user, password, accessToken, serverId, DepType, Project, ExclusionsAudit, watches, repoPath, licenses, xrOutput, fail, ExtendedTable,
},
AuditGo: {
xrUrl, user, password, accessToken, serverId, Project, watches, repoPath, licenses, xrOutput, fail, ExtendedTable,
xrUrl, user, password, accessToken, serverId, Project, ExclusionsAudit, watches, repoPath, licenses, xrOutput, fail, ExtendedTable,
},
AuditPip: {
xrUrl, user, password, accessToken, serverId, RequirementsFile, Project, watches, repoPath, licenses, xrOutput, fail, ExtendedTable,
xrUrl, user, password, accessToken, serverId, RequirementsFile, Project, ExclusionsAudit, watches, repoPath, licenses, xrOutput, fail, ExtendedTable,
},
AuditPipenv: {
xrUrl, user, password, accessToken, serverId, Project, watches, repoPath, licenses, xrOutput, ExtendedTable,
xrUrl, user, password, accessToken, serverId, Project, ExclusionsAudit, watches, repoPath, licenses, xrOutput, ExtendedTable,
},
XrScan: {
xrUrl, user, password, accessToken, serverId, specFlag, threads, scanRecursive, scanRegexp, scanAnt,
Expand Down