Add Violations support for JAS scanners #241

eranturgeman · 2024-11-19T10:47:46Z

The pull request is targeting the dev branch.
The code has been validated to compile successfully by running go vet ./....
The code has been formatted properly using go fmt ./....
All static analysis checks passed.
All tests have passed. If this feature is not already covered by the tests, new tests have been added.
Updated the Contributing page / ReadMe page / CI Workflow files if needed.
All changes are detailed at the description. if not already covered at JFrog Documentation, new documentation have been added.

Depends on:

Add Git Repository Resource in Xray API's jfrog-client-go#1039

Add Support for JAS violations

1. Allow generating JAS violations in the scan by providing `watch`, `GitRepositoryKey`, or `project` attributes.

New violation resource GitRepositoryKey: the http/https git clone url of the repository the code related to. (The actual expected value is converted by removing the protocol)
Passing the violation context (new and old) variables to Xray (SCA scan) and to the analyzerManager (JAS scans)

2. Generating violations in all output formats (adding attributes to tables/structs where needed)

3. Violations should also be generated for binary scans that support JAS (passing the `project key` to the `analyzerManager`)

4. In Frogbot,`GitRepositoryKey` is always passed to the command, this means the user will start to see only violations and not vulnerabilities as the default behavior without supplying any arguments, to avoid breaking:

If audit command is supplied with GitRepositoryKey we will fetch the active watches on this resource, if non exists we will show vulnerabilities (only if the user did not request any other params like watches \ project key \ repo path...)

Additional changes

Adds a resultsContext struct to replace commonGraphScanParams to hold and handle all the attributes that can be used to generate results (watches, project key, git repo ....)
Fix Typos found in the repository
Adds an annotation for each sub-scan about its status: ScanResult[T interface{}].StatusCode (not performed = nil, completed = 0, failed != 0)
Improve validations, adding an option to test more specific counts, simplify tests in convertor_test.go
Bug Fix - display violations in binary scans (jf scan / jf docker scan) when --repo-path is present
Add project key tests when passing: JFROG_SECURITY_CLI_TESTS_JFROG_PLATFORM_PROJECT_KEY
Update AnalyzerManager version to 1.13.2

…dded the new parsed violations results to ApplicabilityScanManager.

…ew parsed violations results to IacScanManager.

…new parsed violations results to SastScanManager.

…e new parsed violations results to SecretScanManager.

…rabilities)

…ded relevant logs

…nces

…ts references

…rences

…methods for hte new struct

…o jas-violations-support

…canner cannot incur violations

…y commented at this point)

…o delete comments in results.go)

…rseCommandResults related to jas violations

…esults) + changed the names for Sca parsing methods

…all relevant references

github-actions · 2024-12-31T17:58:16Z

🐸 JFrog Frogbot

github-actions · 2024-12-31T18:19:33Z

Merging this branch will not change overall coverage

Impacted Packages	Coverage Δ	🤖
github.com/jfrog/jfrog-cli-security	0.00% (ø)
github.com/jfrog/jfrog-cli-security/cli	0.00% (ø)
github.com/jfrog/jfrog-cli-security/commands/audit	0.00% (ø)
github.com/jfrog/jfrog-cli-security/commands/audit/sca	0.00% (ø)
github.com/jfrog/jfrog-cli-security/commands/enrich	0.00% (ø)
github.com/jfrog/jfrog-cli-security/commands/scan	0.00% (ø)
github.com/jfrog/jfrog-cli-security/jas	0.00% (ø)
github.com/jfrog/jfrog-cli-security/jas/applicability	0.00% (ø)
github.com/jfrog/jfrog-cli-security/jas/iac	0.00% (ø)
github.com/jfrog/jfrog-cli-security/jas/runner	0.00% (ø)
github.com/jfrog/jfrog-cli-security/jas/sast	0.00% (ø)
github.com/jfrog/jfrog-cli-security/jas/secrets	0.00% (ø)
github.com/jfrog/jfrog-cli-security/tests	0.00% (ø)
github.com/jfrog/jfrog-cli-security/tests/utils	0.00% (ø)
github.com/jfrog/jfrog-cli-security/tests/utils/integration	0.00% (ø)
github.com/jfrog/jfrog-cli-security/utils	0.00% (ø)
github.com/jfrog/jfrog-cli-security/utils/formats	0.00% (ø)
github.com/jfrog/jfrog-cli-security/utils/formats/sarifutils	0.00% (ø)
github.com/jfrog/jfrog-cli-security/utils/results	0.00% (ø)
github.com/jfrog/jfrog-cli-security/utils/results/conversion	0.00% (ø)
github.com/jfrog/jfrog-cli-security/utils/results/conversion/sarifparser	0.00% (ø)
github.com/jfrog/jfrog-cli-security/utils/results/conversion/simplejsonparser	0.00% (ø)
github.com/jfrog/jfrog-cli-security/utils/results/conversion/summaryparser	0.00% (ø)
github.com/jfrog/jfrog-cli-security/utils/results/conversion/tableparser	0.00% (ø)
github.com/jfrog/jfrog-cli-security/utils/results/output	0.00% (ø)
github.com/jfrog/jfrog-cli-security/utils/techutils	0.00% (ø)
github.com/jfrog/jfrog-cli-security/utils/validations	0.00% (ø)
github.com/jfrog/jfrog-cli-security/utils/xray/scangraph	0.00% (ø)
github.com/jfrog/jfrog-cli-security/utils/xsc	0.00% (ø)

Coverage by file

Changed files (no unit tests)

Changed File	Coverage Δ	Total	Covered	Missed	🤖
github.com/jfrog/jfrog-cli-security/cli/scancommands.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/commands/audit/audit.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/commands/audit/auditparams.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/commands/audit/sca/common.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/commands/audit/scarunner.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/commands/enrich/enrich.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/commands/scan/buildscan.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/commands/scan/dockerscan.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/commands/scan/scan.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/jas/analyzermanager.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/jas/applicability/applicabilitymanager.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/jas/common.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/jas/iac/iacscanner.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/jas/runner/jasrunner.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/jas/sast/sastscanner.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/jas/secrets/secretsscanner.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/tests/config.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/tests/consts.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/tests/utils/integration/test_integrationutils.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/tests/utils/test_utils.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/auditbasicparams.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/formats/conversion.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/formats/sarifutils/sarifutils.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/formats/sarifutils/test_sarifutils.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/formats/simplejsonapi.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/formats/table.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/results/common.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/results/conversion/convertor.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/results/conversion/sarifparser/sarifparser.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/results/conversion/simplejsonparser/simplejsonparser.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/results/conversion/summaryparser/summaryparser.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/results/conversion/tableparser/tableparser.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/results/output/resultwriter.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/results/results.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/techutils/techutils.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/utils.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/validations/test_mocks.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/validations/test_validate_sarif.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/validations/test_validate_sca.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/validations/test_validate_simple_json.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/validations/test_validate_summary.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/validations/test_validation.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/xray/scangraph/params.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/xray/scangraph/scangraph.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/xsc/analyticsmetrics.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/xsc/configprofile.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/xsc/errorreport.go	0.00% (ø)	0	0	0
github.com/jfrog/jfrog-cli-security/utils/xsc/xscmanager.go	0.00% (ø)	0	0	0

Please note that the "Total", "Covered", and "Missed" counts above refer to code statements instead of lines of code. The value in brackets refers to the test coverage of that file in the old version of the code.

Changed unit test files

github.com/jfrog/jfrog-cli-security/audit_test.go
github.com/jfrog/jfrog-cli-security/commands/audit/audit_test.go
github.com/jfrog/jfrog-cli-security/jas/applicability/applicabilitymanager_test.go
github.com/jfrog/jfrog-cli-security/jas/common_test.go
github.com/jfrog/jfrog-cli-security/jas/iac/iacscanner_test.go
github.com/jfrog/jfrog-cli-security/jas/runner/jasrunner_test.go
github.com/jfrog/jfrog-cli-security/jas/sast/sastscanner_test.go
github.com/jfrog/jfrog-cli-security/jas/secrets/secretsscanner_test.go
github.com/jfrog/jfrog-cli-security/scans_test.go
github.com/jfrog/jfrog-cli-security/utils/results/conversion/convertor_test.go
github.com/jfrog/jfrog-cli-security/utils/results/conversion/sarifparser/sarifparser_test.go
github.com/jfrog/jfrog-cli-security/utils/results/conversion/simplejsonparser/simplejsonparser_test.go
github.com/jfrog/jfrog-cli-security/utils/xsc/analyticsmetrics_test.go
github.com/jfrog/jfrog-cli-security/xsc_test.go

eranturgeman added 18 commits November 17, 2024 17:23

comments

650cc2b

Added new field for violation results to ApplicabilityScanManager + a…

8c2e4bd

…dded the new parsed violations results to ApplicabilityScanManager.

Added new field for violation results to IacScanManager + added the n…

7a4f5a1

…ew parsed violations results to IacScanManager.

Added new field for violation results to SastScanManager + added the …

c664895

…new parsed violations results to SastScanManager.

Added new field for violation results to SecretScanManager + added th…

dcd923e

…e new parsed violations results to SecretScanManager.

added parsing and processing for violations results (similar to vulne…

03d0904

…rabilities)

updated all Run***Scan functions to return the violation results + ad…

a16d7f2

…ded relevant logs

simplified interface calls

8d3cd77

deleted un-used field from sastScanManager and fixed all tests refere…

2c0b972

…nces

deleted un-used field from applicabilityScanManager and fixed all tes…

748a9b0

…ts references

deleted un-used field from iacScanManager and fixed all tests references

20eba2b

deleted un-used field from SecretScanManager and fixed all tests refe…

1c43d27

…rences

fixed broken tests dur to changes

cc4720c

remove comment

6065dd2

simplified interface and added temp func for testing

bb89eec

adjusted all functions to new interface changes and logic changes

49617de

added new struct to replace the old JasScansResults and re-wrote all …

256064d

…methods for hte new struct

removed comment

5a7bf61

eranturgeman had a problem deploying to frogbot November 19, 2024 10:47 — with GitHub Actions Failure

Merge branch 'dev' of https://github.com/jfrog/jfrog-cli-security int…

88074b8

…o jas-violations-support

eranturgeman had a problem deploying to frogbot November 19, 2024 10:48 — with GitHub Actions Failure

eranturgeman marked this pull request as draft November 19, 2024 10:48

eranturgeman added the new feature Automatically generated release notes label Nov 19, 2024

eranturgeman added 7 commits November 19, 2024 14:40

updated applicability scanner to ignore violations logic since this s…

42b2fde

…canner cannot incur violations

comments

0698069

starting to replace all old JasScansResults references (struct is onl…

10e85c0

…y commented at this point)

replaced old functions usages and commented all old functions (need t…

586aaa3

…o delete comments in results.go)

fixing breaks after structs changes and started initial changes in pa…

1a9f913

…rseCommandResults related to jas violations

added a new parsing func for jas vuln & violations (parseRequiredJasR…

3173b9e

…esults) + changed the names for Sca parsing methods

changed name in Sast to SastVulnerabilities in SimpleJsonResults and …

638c075

…all relevant references

attiasas requested a deployment to frogbot December 26, 2024 16:55 — with GitHub Actions Waiting

attiasas added the safe to test Approve running integration tests on a pull request label Dec 26, 2024

github-actions bot removed the safe to test Approve running integration tests on a pull request label Dec 26, 2024

CR changes

5f98f16

attiasas requested a deployment to frogbot December 29, 2024 11:39 — with GitHub Actions Waiting

attiasas added the safe to test Approve running integration tests on a pull request label Dec 29, 2024

github-actions bot removed the safe to test Approve running integration tests on a pull request label Dec 29, 2024

fix tests

837e71b

attiasas requested a deployment to frogbot December 29, 2024 12:39 — with GitHub Actions Waiting

attiasas added the safe to test Approve running integration tests on a pull request label Dec 29, 2024

github-actions bot removed the safe to test Approve running integration tests on a pull request label Dec 29, 2024

fix tests

9b1129c

attiasas temporarily deployed to frogbot December 29, 2024 14:45 — with GitHub Actions Inactive

attiasas added the safe to test Approve running integration tests on a pull request label Dec 29, 2024

github-actions bot removed the safe to test Approve running integration tests on a pull request label Dec 29, 2024

update dependencies

afdee37

attiasas temporarily deployed to frogbot December 31, 2024 11:08 — with GitHub Actions Inactive

attiasas added the safe to test Approve running integration tests on a pull request label Dec 31, 2024

github-actions bot removed the safe to test Approve running integration tests on a pull request label Dec 31, 2024

hadarshjfrog approved these changes Dec 31, 2024

View reviewed changes

attiasas mentioned this pull request Dec 31, 2024

Fix and add tests for Jas Violations #273

Merged

7 tasks

attiasas added 2 commits December 31, 2024 20:53

Merge remote-tracking branch 'upstream/dev' into pr/eranturgeman/241

c9413f6

fix conflicts after merge

2f98e49

attiasas temporarily deployed to frogbot December 31, 2024 17:55 — with GitHub Actions Inactive

attiasas added the safe to test Approve running integration tests on a pull request label Dec 31, 2024

github-actions bot removed the safe to test Approve running integration tests on a pull request label Dec 31, 2024

attiasas merged commit fd5e5f3 into jfrog:dev Dec 31, 2024
56 checks passed

BrewTestBot mentioned this pull request Jan 7, 2025

jfrog-cli 2.73.0 Homebrew/homebrew-core#203512

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Violations support for JAS scanners #241

Add Violations support for JAS scanners #241

eranturgeman commented Nov 19, 2024 •

edited by attiasas

Loading

github-actions bot commented Dec 31, 2024

github-actions bot commented Dec 31, 2024

Changed files (no unit tests)

Changed unit test files

Add Violations support for JAS scanners #241

Add Violations support for JAS scanners #241

Conversation

eranturgeman commented Nov 19, 2024 • edited by attiasas Loading

Add Support for JAS violations

1. Allow generating JAS violations in the scan by providing watch, GitRepositoryKey, or project attributes.

2. Generating violations in all output formats (adding attributes to tables/structs where needed)

3. Violations should also be generated for binary scans that support JAS (passing the project key to the analyzerManager)

4. In Frogbot,GitRepositoryKey is always passed to the command, this means the user will start to see only violations and not vulnerabilities as the default behavior without supplying any arguments, to avoid breaking:

Additional changes

github-actions bot commented Dec 31, 2024

github-actions bot commented Dec 31, 2024

Merging this branch will not change overall coverage

Changed files (no unit tests)

Changed unit test files

eranturgeman commented Nov 19, 2024 •

edited by attiasas

Loading

1. Allow generating JAS violations in the scan by providing `watch`, `GitRepositoryKey`, or `project` attributes.

3. Violations should also be generated for binary scans that support JAS (passing the `project key` to the `analyzerManager`)

4. In Frogbot,`GitRepositoryKey` is always passed to the command, this means the user will start to see only violations and not vulnerabilities as the default behavior without supplying any arguments, to avoid breaking: