jenkins/sap-jenkins-library
1
0
Fork 0
mirror of https://github.com/SAP/jenkins-library.git synced 2024-12-12 10:55:20 +02:00
Code Issues Releases Activity

fix(codeqlExecuteScan): changed audit report format (#4474)

Browse Source 
Co-authored-by: sumeet patil <sumeet.patil@sap.com>
This commit is contained in:
Daria Kuznetsova 2023-07-19 15:46:05 +02:00 committed by GitHub
parent b703995917
commit e117067a66
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 33 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
cmd/codeqlExecuteScan.go
View File

@ -340,10 +340,12 @@ func runCodeqlExecuteScan(config *codeqlExecuteScanOptions, telemetryData *telem
reports = append(reports, paths...)
if config.CheckForCompliance {
unaudited := scanResults.Total - scanResults.Audited
if unaudited > config.VulnerabilityThresholdTotal {
msg := fmt.Sprintf("Your repository %v with ref %v is not compliant. Total unaudited issues are %v which is greater than the VulnerabilityThresholdTotal count %v", repoUrl, repoInfo.ref, unaudited, config.VulnerabilityThresholdTotal)
return reports, errors.Errorf(msg)
for _, scanResult := range scanResults {
unaudited := scanResult.Total - scanResult.Audited
if unaudited > config.VulnerabilityThresholdTotal {
msg := fmt.Sprintf("Your repository %v with ref %v is not compliant. Total unaudited issues are %v which is greater than the VulnerabilityThresholdTotal count %v", repoUrl, repoInfo.ref, unaudited, config.VulnerabilityThresholdTotal)
return reports, errors.Errorf(msg)
}
}
}
}

17
pkg/codeql/codeql.go
View File

@ -33,17 +33,17 @@ type CodeqlScanAuditInstance struct {
alertListoptions github.AlertListOptions
}
func (codeqlScanAudit *CodeqlScanAuditInstance) GetVulnerabilities(analyzedRef string) (CodeqlScanning, error) {
func (codeqlScanAudit *CodeqlScanAuditInstance) GetVulnerabilities(analyzedRef string) ([]CodeqlFindings, error) {
apiUrl := getApiUrl(codeqlScanAudit.serverUrl)
ctx, client, err := sapgithub.NewClient(codeqlScanAudit.token, apiUrl, "", codeqlScanAudit.trustedCerts)
if err != nil {
return CodeqlScanning{}, err
return []CodeqlFindings{}, err
}
return getVulnerabilitiesFromClient(ctx, client.CodeScanning, analyzedRef, codeqlScanAudit)
}
func getVulnerabilitiesFromClient(ctx context.Context, codeScanning githubCodeqlScanningService, analyzedRef string, codeqlScanAudit *CodeqlScanAuditInstance) (CodeqlScanning, error) {
func getVulnerabilitiesFromClient(ctx context.Context, codeScanning githubCodeqlScanningService, analyzedRef string, codeqlScanAudit *CodeqlScanAuditInstance) ([]CodeqlFindings, error) {
page := 1
audited := 0
totalAlerts := 0
@ -60,7 +60,7 @@ func getVulnerabilitiesFromClient(ctx context.Context, codeScanning githubCodeql
alerts, response, err := codeScanning.ListAlertsForRepo(ctx, codeqlScanAudit.owner, codeqlScanAudit.repository, &alertOptions)
if err != nil {
return CodeqlScanning{}, err
return []CodeqlFindings{}, err
}
page = response.NextPage
@ -81,9 +81,12 @@ func getVulnerabilitiesFromClient(ctx context.Context, codeScanning githubCodeql
}
}
codeqlScanning := CodeqlScanning{}
codeqlScanning.Total = totalAlerts
codeqlScanning.Audited = audited
auditAll := CodeqlFindings{
ClassificationName: "Audit All",
Total: totalAlerts,
Audited: audited,
}
codeqlScanning := []CodeqlFindings{auditAll}
return codeqlScanning, nil
}

12
pkg/codeql/codeql_test.go
View File

@ -71,8 +71,10 @@ func TestGetVulnerabilitiesFromClient(t *testing.T) {
codeqlScanAuditInstance := NewCodeqlScanAuditInstance("", "", "testRepo1", "", []string{})
codeScanning, err := getVulnerabilitiesFromClient(ctx, &ghCodeqlScanningMock, "ref", &codeqlScanAuditInstance)
assert.NoError(t, err)
assert.Equal(t, 3, codeScanning.Total)
assert.Equal(t, 1, codeScanning.Audited)
assert.NotEmpty(t, codeScanning)
assert.Equal(t, 1, len(codeScanning))
assert.Equal(t, 3, codeScanning[0].Total)
assert.Equal(t, 1, codeScanning[0].Audited)
})
t.Run("Success with pagination results", func(t *testing.T) {
@ -80,8 +82,10 @@ func TestGetVulnerabilitiesFromClient(t *testing.T) {
codeqlScanAuditInstance := NewCodeqlScanAuditInstance("", "", "testRepo2", "", []string{})
codeScanning, err := getVulnerabilitiesFromClient(ctx, &ghCodeqlScanningMock, "ref", &codeqlScanAuditInstance)
assert.NoError(t, err)
assert.Equal(t, 140, codeScanning.Total)
assert.Equal(t, 80, codeScanning.Audited)
assert.NotEmpty(t, codeScanning)
assert.Equal(t, 1, len(codeScanning))
assert.Equal(t, 140, codeScanning[0].Total)
assert.Equal(t, 80, codeScanning[0].Audited)
})
t.Run("Error", func(t *testing.T) {

17
pkg/codeql/reporting.go
View File

@ -10,16 +10,17 @@ import (
)
type CodeqlAudit struct {
ToolName string `json:"toolName"`
RepositoryUrl string `json:"repositoryUrl"`
RepositoryReferenceUrl string `json:"repositoryReferenceUrl"` //URL of PR or Branch where scan was performed
CodeScanningLink string `json:"codeScanningLink"`
ScanResults CodeqlScanning `json:"scanResults"`
ToolName string `json:"toolName"`
RepositoryUrl string `json:"repositoryUrl"`
RepositoryReferenceUrl string `json:"repositoryReferenceUrl"` //URL of PR or Branch where scan was performed
CodeScanningLink string `json:"codeScanningLink"`
ScanResults []CodeqlFindings `json:"findings"`
}
type CodeqlScanning struct {
Total int `json:"total"`
Audited int `json:"audited"`
type CodeqlFindings struct {
ClassificationName string `json:"classificationName"`
Total int `json:"total"`
Audited int `json:"audited"`
}
func WriteJSONReport(jsonReport CodeqlAudit, modulePath string) ([]piperutils.Path, error) {