JFrog Advanced Security - Secrets & IaC scans #788

orto17 · 2023-05-21T09:20:00Z

All tests passed. If this feature is not already covered by the tests, I added new tests.
All static analysis checks passed.
This pull request is on the dev branch.
I used gofmt for formatting the code before submitting the pull request.

This PR includes the following:

Jas flow now contains three scans: applicability, secrets & Iac.
Final output include three tabels: xray vulnerabilities/violations, secrets & Iac.
The three scan will be executed as part of the audit command, and will be executed one after the other.
If user is not entitled for jas scan, jas results will not be printed.
If analyzer manager is not supporting one of the jas scans - the unsupported scan will be skipped, and execution continue as normal.

Output examples - table:

Output examples - simple-json:

…lity-column # Conflicts: # xray/commands/audit/generic/auditmanager.go # xray/commands/scan/buildscan.go # xray/formats/conversion.go # xray/formats/table.go # xray/utils/resultstable.go # xray/utils/resultstable_test.go # xray/utils/resultwriter.go

# Conflicts: # xray/commands/audit/generic/jas/applicabilityscanner.go # xray/commands/audit/generic/jas/generic.go

eyalbe4

I haven't finished going over the entire code yet, but I'm releasing what I have so far. Feel free to go ahead and implement my comments.

In addition to my inline comments:
Only commands should be under the commands or commands/audit package. Therefore, the ApplicabilityScanManager, IacScanManager, jasmanager.go and SecretScanManager should move to a new package named jas under jfrog-cli-core/xray/audit.

xray/commands/audit/applicabilitymanager.go

xray/commands/audit/iacscanner.go

xray/commands/audit/applicabilitymanager.go

xray/commands/audit/applicabilitymanager_test.go

# Conflicts: # xray/utils/analyzermanager.go # xray/utils/resultwriter.go

xray/audit/jas/applicabilitymanager.go

xray/audit/jas/iacscanner.go

xray/audit/jas/secretsscanner.go

xray/audit/jas/applicabilitymanager.go

xray/audit/jas/applicabilitymanager_test.go

xray/audit/jas/secretsscanner_test.go

xray/utils/analyzermanager.go

xray/utils/resultwriter.go

orto17 added 30 commits April 3, 2023 13:44

applicabilityscanner.go

88c3f7b

added app scan results to run audit

fd8ab72

added applicability result column to table

8a465b4

analyzer manager executer

67f0f9d

ConvertToApplicableTableValue

66cdf20

omit empty column implementation, second sort

8b6f0a1

with violations cves results

9ebb80b

technologies eligible for applicability scan

108e4ea

with dependency tree, fixed result writer test

7d9ed21

unit tests

8bedfb3

all unit tests for app scanner

2401d3f

updates after static analysis

8b3400f

with real path to analyzer manager, tests fixed

9bfdf3a

TestApplicabilityScanManager_ShouldRun_AllConditionsMet

c12b402

Smallfixes after review

2c29b86

analyzer manager set env variables

32ea54d

handle error code 31 from am

bb54ab7

secret scanner, print table

d9fe0aa

changes after Tal review

5b735e6

tech eligible for scan fix

0ca272d

secret scanner improvements

fb035ed

secret scanner improvements

182cb41

Merge branch 'Applicable-vulnerability-column' into secrets-scanner

eb108f8

# Conflicts: # xray/commands/audit/generic/jas/applicabilityscanner.go # xray/commands/audit/generic/jas/generic.go

secret scanner improvements

dc67147

tryExtractRelativePath

3a9d2d6

severity column design

2629f3d

table improvements, tests

6864666

added secrets to non table output

1682570

iac scanner

4ffe8bb

SkippedDirs

1beb1b6

orto17 had a problem deploying to frogbot May 31, 2023 08:30 — with GitHub Actions Failure

cmd.Process.Kill()

42ade5d

orto17 had a problem deploying to frogbot June 4, 2023 09:52 — with GitHub Actions Failure

fixed exec defer

87e02bd

orto17 had a problem deploying to frogbot June 5, 2023 11:05 — with GitHub Actions Failure

exit code const

11a26c4

orto17 had a problem deploying to frogbot June 6, 2023 06:49 — with GitHub Actions Failure

eyalbe4 added the new feature Automatically generated release notes label Jun 6, 2023

eyalbe4 requested changes Jun 6, 2023

View reviewed changes

updates after Eyal's review

134e36e

orto17 had a problem deploying to frogbot June 7, 2023 11:20 — with GitHub Actions Failure

updates after Eyal's review

aaafafb

orto17 had a problem deploying to frogbot June 7, 2023 11:22 — with GitHub Actions Failure

Merge remote-tracking branch 'upstream/dev' into secrets-scanner

537f7b2

# Conflicts: # xray/utils/analyzermanager.go # xray/utils/resultwriter.go

orto17 had a problem deploying to frogbot June 7, 2023 13:09 — with GitHub Actions Failure

fixed tests

8fb676d

orto17 had a problem deploying to frogbot June 7, 2023 13:33 — with GitHub Actions Failure

orto17 requested a review from eyalbe4 June 7, 2023 13:50

eyalbe4 changed the title ~~JAS Secrets & Iac Scans~~ JFrog Advanced Security - Secrets & Iac Scans Jun 7, 2023

eyalbe4 changed the title ~~JFrog Advanced Security - Secrets & Iac Scans~~ JFrog Advanced Security - Secrets & IaC Scans Jun 7, 2023

eyalbe4 changed the title ~~JFrog Advanced Security - Secrets & IaC Scans~~ JFrog Advanced Security - Secrets & IaC scans Jun 7, 2023

eyalbe4 requested changes Jun 11, 2023

View reviewed changes

changes after code review

eadb9c2

orto17 had a problem deploying to frogbot June 12, 2023 12:15 — with GitHub Actions Failure

Merge branch 'dev' into secrets-scanner

63a4ded

orto17 had a problem deploying to frogbot June 12, 2023 12:15 — with GitHub Actions Failure

orto17 requested a review from eyalbe4 June 12, 2023 12:27

eyalbe4 merged commit ce1271d into jfrog:dev Jun 13, 2023
1 check failed

p-linnane mentioned this pull request Jun 27, 2023

jfrog-cli 2.41.0 Homebrew/homebrew-core#135163

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

JFrog Advanced Security - Secrets & IaC scans #788

JFrog Advanced Security - Secrets & IaC scans #788

orto17 commented May 21, 2023 •

edited

Loading

eyalbe4 left a comment •

edited

Loading

JFrog Advanced Security - Secrets & IaC scans #788

JFrog Advanced Security - Secrets & IaC scans #788

Conversation

orto17 commented May 21, 2023 • edited Loading

eyalbe4 left a comment • edited Loading

Choose a reason for hiding this comment

orto17 commented May 21, 2023 •

edited

Loading

eyalbe4 left a comment •

edited

Loading