21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
|
# File 'lib/paraxial/cli.rb', line 21
def scan
puts "[Paraxial] v#{Paraxial::VERSION} Scan starting..."
case check_rubocop_configuration
when :does_not_exist
puts '[Paraxial] .paraxial-rubocop.yml does not exist. This file is required for the scan to run, add:'
puts '.paraxial-rubocop.yml'
puts 'require:'
puts '- rubocop-erb'
puts ''
exit(1)
when :found_no_erb
puts '[Paraxial] .paraxial-rubocop.yml is missing rubocop-erb. To scan embedded Ruby files for security problems, add:'
puts '.paraxial-rubocop.yml'
puts 'require:'
puts '- rubocop-erb'
puts ''
when :found_with_erb
puts '[Paraxial] .paraxial-rubocop.yml is valid, .erb files will be scanned.'
end
paraxial_config = get_paraxial_configuration
if paraxial_config && paraxial_config["ignore-gems"]
puts '[Paraxial] .paraxial.yml configuration file found.'
puts '[Paraxial] Gems ignored by dependency scan:'
puts paraxial_config["ignore-gems"]
elsif paraxial_config == :error
puts '[Paraxial] .paraxial.yml file is not well formed and is being ignored.'
paraxial_config = false
elsif paraxial_config
puts '[Paraxial] .paraxial.yml does not define a valid configuration. Using default configuration.'
paraxial_config = false
elsif paraxial_config == false
puts '[Paraxial] .paraxial.yml configuration file was not found. Using default configuration.'
else
puts '[Paraxial] .paraxial.yml configuration is empty. Using default configuration.'
paraxial_config = false
end
if Paraxial::Helpers.get_api_key.nil?
puts '[Paraxial] Environment variable PARAXIAL_API_KEY not found'
else
github_app = options[:github_app]
install_id = options[:install_id]
repo_owner = options[:repo_owner]
repo_name = options[:repo_name]
pr_number = options[:pr_number]
exit_code = options[:exit_code]
cops = 'Paraxial,Security/Eval,Security/IoMethods,Security/JSONLoad,Security/MarshalLoad,Security/Open,Security/YAMLLoad'
rubo_config = '--config .paraxial-rubocop.yml'
if options[:debug_rubocop]
puts '[Paraxial] rubocop debug enabled'
rubocop = `rubocop --require paraxial --only #{cops} --disable-pending-cops --format json #{rubo_config} 2>/dev/null`
debug_rubocop = `rubocop --debug --require paraxial --only #{cops} --disable-pending-cops #{rubo_config} 2>&1`
puts debug_rubocop
else
rubocop = `rubocop --require paraxial --only #{cops} --disable-pending-cops --format json #{rubo_config}`
end
lockfile = File.read('./Gemfile.lock')
api_key = ENV['PARAXIAL_API_KEY']
uri = URI.parse(Paraxial::Helpers.get_paraxial_url + '/api/ruby_scan')
= { 'Content-Type': 'application/json' }
body = { rubocop: rubocop, lockfile: lockfile, api_key: api_key, paraxial_config: paraxial_config, timestamp: Paraxial.get_timestamp }
response = Net::HTTP.post(uri, body.to_json, )
m = JSON.parse(response.body)
if m['ok'].nil?
puts "[Paraxial] Upload failed, check if PARAXIAL_API_KEY is valid"
exit(1)
end
findings = m['ok']['findings']
puts
puts "[Paraxial] Scan count: #{findings.length}"
puts
findings.each do |finding|
puts finding
puts
end
puts "[Paraxial] Scan UUID #{m['ok']['scan_uuid']}"
puts "[Paraxial] Scan URL #{m['ok']['scan_url']}"
github_valid = (!!github_app and !!install_id and !!repo_owner and !!repo_name and !!pr_number)
if github_app and github_valid == false
puts '[Paraxial] --github_app missing arguments'
puts '[Paraxial] Required: --github_app, --install_id, --repo_owner, --repo_name, --pr_number'
elsif github_app and github_valid
uuid = m['ok']['scan_uuid']
if uuid
final_uuid = uuid.chomp('.')
censored_backend_map = {
'installation_id' => install_id,
'repository_owner' => repo_owner,
'repository_name' => repo_name,
'pull_request_number' => pr_number,
'scan_uuid' => final_uuid,
'api_key' => 'REDACTED'
}
cbms = JSON.pretty_generate(censored_backend_map)
puts "[Paraxial] GitHub hash: #{cbms}"
censored_backend_map['api_key'] = api_key
backend_map = censored_backend_map
parax_uri = URI.parse(Paraxial::Helpers.get_paraxial_url + '/api/github_app')
github_pr_url = "https://github.com/#{repo_owner}/#{repo_name}/pull/#{pr_number}"
rr = Net::HTTP.post(parax_uri, backend_map.to_json, )
puts "[Paraxial] parax_uri response: #{rr.body}"
puts "[Paraxial] #{github_pr_url}"
else
puts '[Paraxial] No scan UUID found'
end
else
:ok
end
if exit_code and (findings.length > 0)
exit(1)
end
end
end
|