Skip to content

Commit 51aa8aa

Browse files
GriffinMBGriffinMB
committed
Add sarif output for action integration
1 parent 83a3107 commit 51aa8aa

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+391
-92
lines changed

‎lib/mix/tasks/sobelow.ex

+5
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,11 @@ defmodule Mix.Tasks.Sobelow do
107107

108108
@aliases [v: :verbose, r: :root, i: :ignore, d: :details, f: :format]
109109

110+
# For escript entry
111+
def main(argv) do
112+
run(argv)
113+
end
114+
110115
def run(argv) do
111116
{opts, _, _} = OptionParser.parse(argv, aliases: @aliases, switches: @switches)
112117

‎lib/sobelow.ex

+26-4
Original file line numberDiff line numberDiff line change
@@ -135,13 +135,16 @@ defmodule Sobelow do
135135

136136
defp print_output() do
137137
details =
138-
case format() do
138+
case output_format() do
139139
"json" ->
140140
FindingLog.json(@v)
141141

142142
"quiet" ->
143143
FindingLog.quiet()
144144

145+
"sarif" ->
146+
FindingLog.sarif(@v)
147+
145148
_ ->
146149
nil
147150
end
@@ -195,7 +198,7 @@ defmodule Sobelow do
195198
if is_nil(mod) do
196199
MixIO.error("A valid module was not selected.")
197200
else
198-
apply(mod, :details, [])
201+
apply(mod, :details, []) |> IO.ANSI.Docs.print([])
199202
end
200203
end
201204

@@ -206,7 +209,7 @@ defmodule Sobelow do
206209
def log_finding(details, %Finding{} = finding) do
207210
if loggable?(finding.fingerprint, finding.confidence) do
208211
Fingerprint.put(finding.fingerprint)
209-
FindingLog.add(details, finding.confidence)
212+
FindingLog.add({details, finding}, finding.confidence)
210213
end
211214
end
212215

@@ -217,7 +220,19 @@ defmodule Sobelow do
217220

218221
def all_details() do
219222
@submodules
220-
|> Enum.each(&apply(&1, :details, []))
223+
|> Enum.map(&apply(&1, :details, []))
224+
|> List.flatten()
225+
|> Enum.each(&IO.ANSI.Docs.print(&1, []))
226+
end
227+
228+
def rules() do
229+
@submodules
230+
|> Enum.flat_map(&apply(&1, :rules, []))
231+
end
232+
233+
def finding_modules() do
234+
@submodules
235+
|> Enum.flat_map(&apply(&1, :finding_modules, []))
221236
end
222237

223238
def save_config(conf_file) do
@@ -261,6 +276,13 @@ defmodule Sobelow do
261276
end
262277

263278
def format() do
279+
case get_env(:format) do
280+
"sarif" -> "json"
281+
format -> format
282+
end
283+
end
284+
285+
def output_format() do
264286
get_env(:format)
265287
end
266288

‎lib/sobelow/ci.ex

+1-1
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,6 @@ defmodule Sobelow.CI do
2626
end
2727

2828
def details() do
29-
IO.ANSI.Docs.print(@moduledoc, [])
29+
@moduledoc
3030
end
3131
end

‎lib/sobelow/ci/os.ex

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
defmodule Sobelow.CI.OS do
2+
@uid 1
3+
@finding_type "CI.OS: Command Injection in `:os.cmd`"
4+
25
use Sobelow.Finding
3-
@finding_type "Command Injection in `:os.cmd`"
46

57
def run(fun, meta_file) do
68
confidence = if !meta_file.is_controller?, do: :low

‎lib/sobelow/ci/system.ex

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
defmodule Sobelow.CI.System do
2+
@uid 2
3+
@finding_type "CI.System: Command Injection in `System.cmd`"
4+
25
use Sobelow.Finding
3-
@finding_type "Command Injection in `System.cmd`"
46

57
def run(fun, meta_file) do
68
confidence = if !meta_file.is_controller?, do: :low

‎lib/sobelow/config/csp.ex

+5-1
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,12 @@ defmodule Sobelow.Config.CSP do
2828
$ mix sobelow -i Config.CSP
2929
"""
3030
alias Sobelow.Config
31-
use Sobelow.Finding
31+
32+
@uid 3
3233
@finding_type "Config.CSP: Missing Content-Security-Policy"
3334

35+
use Sobelow.Finding
36+
3437
def run(router) do
3538
meta_file = Parse.ast(router) |> Parse.get_meta_funs()
3639
finding = Finding.init(@finding_type, Utils.normalize_path(router))
@@ -100,6 +103,7 @@ defmodule Sobelow.Config.CSP do
100103
finding
101104
| vuln_source: :put_secure_browser_headers,
102105
vuln_line_no: Parse.get_fun_line(plug),
106+
vuln_col_no: Parse.get_fun_column(plug),
103107
fun_source: pipeline,
104108
fun_name: pipeline_name,
105109
confidence: confidence

‎lib/sobelow/config/csrf.ex

+5-1
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,12 @@ defmodule Sobelow.Config.CSRF do
1818
$ mix sobelow -i Config.CSRF
1919
"""
2020
alias Sobelow.Config
21-
use Sobelow.Finding
21+
22+
@uid 5
2223
@finding_type "Config.CSRF: Missing CSRF Protections"
2324

25+
use Sobelow.Finding
26+
2427
def run(router) do
2528
finding = Finding.init(@finding_type, Utils.normalize_path(router))
2629

@@ -38,6 +41,7 @@ defmodule Sobelow.Config.CSRF do
3841
finding
3942
| vuln_source: pipeline_name,
4043
vuln_line_no: Parse.get_fun_line(pipeline),
44+
vuln_col_no: Parse.get_fun_column(pipeline),
4145
fun_source: pipeline,
4246
fun_name: pipeline_name,
4347
confidence: :high

‎lib/sobelow/config/csrf_route.ex

+5-1
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,13 @@ defmodule Sobelow.Config.CSRFRoute do
2424
"""
2525

2626
alias Sobelow.Parse
27+
28+
@uid 4
29+
@finding_type "Config.CSRFRoute: CSRF via Action Reuse"
30+
2731
use Sobelow.Finding
2832

2933
@state_changing_methods [:post, :put, :patch, :delete]
30-
@finding_type "Config.CSRFRoute: CSRF via Action Reuse"
3134

3235
def run(router) do
3336
finding = Finding.init(@finding_type, Utils.normalize_path(router))
@@ -65,6 +68,7 @@ defmodule Sobelow.Config.CSRFRoute do
6568
finding
6669
| vuln_source: fun,
6770
vuln_line_no: Parse.get_fun_line(fun),
71+
vuln_col_no: Parse.get_fun_column(fun),
6872
fun_name: get_action(fun),
6973
confidence: :high
7074
}

‎lib/sobelow/config/cswh.ex

+4-1
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,11 @@ defmodule Sobelow.Config.CSWH do
1313
1414
$ mix sobelow -i Config.CSWH
1515
"""
16-
use Sobelow.Finding
16+
@uid 6
1717
@finding_type "Config.CSWH: Cross-Site Websocket Hijacking"
1818

19+
use Sobelow.Finding
20+
1921
def run(endpoint) do
2022
Parse.ast(endpoint)
2123
|> Parse.get_funs_of_type(:socket)
@@ -58,6 +60,7 @@ defmodule Sobelow.Config.CSWH do
5860
finding
5961
| vuln_source: :highlight_all,
6062
vuln_line_no: Parse.get_fun_line(socket),
63+
vuln_col_no: Parse.get_fun_column(socket),
6164
fun_source: socket
6265
}
6366
|> Finding.fetch_fingerprint()

‎lib/sobelow/config/headers.ex

+5-1
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,12 @@ defmodule Sobelow.Config.Headers do
1616
$ mix sobelow -i Config.Headers
1717
"""
1818
alias Sobelow.Config
19-
use Sobelow.Finding
19+
20+
@uid 7
2021
@finding_type "Config.Headers: Missing Secure Browser Headers"
2122

23+
use Sobelow.Finding
24+
2225
def run(router) do
2326
finding = Finding.init(@finding_type, Utils.normalize_path(router))
2427

@@ -36,6 +39,7 @@ defmodule Sobelow.Config.Headers do
3639
finding
3740
| vuln_source: pipeline_name,
3841
vuln_line_no: Parse.get_fun_line(pipeline),
42+
vuln_col_no: Parse.get_fun_column(pipeline),
3943
fun_source: pipeline,
4044
fun_name: pipeline_name,
4145
confidence: :high

‎lib/sobelow/config/hsts.ex

+5-1
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,12 @@ defmodule Sobelow.Config.HSTS do
1111
$ mix sobelow -i Config.HSTS
1212
"""
1313
alias Sobelow.Config
14-
use Sobelow.Finding
14+
15+
@uid 8
1516
@finding_type "Config.HSTS: HSTS Not Enabled"
1617

18+
use Sobelow.Finding
19+
1720
def run(dir_path, configs) do
1821
Enum.each(configs, fn conf ->
1922
path = dir_path <> conf
@@ -41,6 +44,7 @@ defmodule Sobelow.Config.HSTS do
4144
fun_source: nil,
4245
vuln_source: reason,
4346
vuln_line_no: 0,
47+
vuln_col_no: 0,
4448
confidence: :medium
4549
}
4650
|> Finding.fetch_fingerprint()

‎lib/sobelow/config/https.ex

+5-1
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,12 @@ defmodule Sobelow.Config.HTTPS do
1313
$ mix sobelow -i Config.HTTPS
1414
"""
1515
alias Sobelow.Config
16-
use Sobelow.Finding
16+
17+
@uid 9
1718
@finding_type "Config.HTTPS: HTTPS Not Enabled"
1819

20+
use Sobelow.Finding
21+
1922
def run(dir_path, configs) do
2023
path = dir_path <> "prod.exs"
2124

@@ -43,6 +46,7 @@ defmodule Sobelow.Config.HTTPS do
4346
fun_source: nil,
4447
vuln_source: reason,
4548
vuln_line_no: 0,
49+
vuln_col_no: 0,
4650
confidence: :high
4751
}
4852
|> Finding.fetch_fingerprint()

‎lib/sobelow/config/secrets.ex

+8-3
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,12 @@ defmodule Sobelow.Config.Secrets do
1515
$ mix sobelow -i Config.Secrets
1616
"""
1717
alias Sobelow.Config
18-
use Sobelow.Finding
18+
19+
@uid 10
1920
@finding_type "Config.Secrets: Hardcoded Secret"
2021

22+
use Sobelow.Finding
23+
2124
def run(dir_path, configs) do
2225
Enum.each(configs, fn conf ->
2326
path = dir_path <> conf
@@ -60,7 +63,7 @@ defmodule Sobelow.Config.Secrets do
6063
def is_env_var?(_), do: false
6164

6265
defp add_finding(file, line_no, fun, key, val) do
63-
vuln_line_no = get_vuln_line(file, line_no, val)
66+
{vuln_line_no, vuln_line_col} = get_vuln_line(file, line_no, val)
6467

6568
finding =
6669
%Finding{
@@ -69,6 +72,7 @@ defmodule Sobelow.Config.Secrets do
6972
fun_source: fun,
7073
vuln_source: :highlight_all,
7174
vuln_line_no: vuln_line_no,
75+
vuln_col_no: vuln_line_col,
7276
confidence: :high
7377
}
7478
|> Finding.fetch_fingerprint()
@@ -117,7 +121,8 @@ defmodule Sobelow.Config.Secrets do
117121

118122
defp get_vuln_line({:@, _, [{:sobelow_secret, _, _}]} = ast, acc) do
119123
line_no = Parse.get_fun_line(ast)
120-
{ast, [line_no | acc]}
124+
line_col = Parse.get_fun_column(ast)
125+
{ast, [{line_no, line_col} | acc]}
121126
end
122127

123128
defp get_vuln_line(ast, acc), do: {ast, acc}

‎lib/sobelow/dos/binary_to_atom.ex

+3-2
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,11 @@ defmodule Sobelow.DOS.BinToAtom do
1111
1212
$ mix sobelow -i DOS.BinToAtom
1313
"""
14-
use Sobelow.Finding
15-
14+
@uid 11
1615
@finding_type "DOS.BinToAtom: Unsafe atom interpolation"
1716

17+
use Sobelow.Finding
18+
1819
def run(fun, meta_file) do
1920
confidence = if !meta_file.is_controller?, do: :low
2021

‎lib/sobelow/dos/list_to_atom.ex

+3-1
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,11 @@ defmodule Sobelow.DOS.ListToAtom do
1111
1212
$ mix sobelow -i DOS.ListToAtom
1313
"""
14-
use Sobelow.Finding
14+
@uid 12
1515
@finding_type "DOS.ListToAtom: Unsafe `List.to_atom`"
1616

17+
use Sobelow.Finding
18+
1719
def run(fun, meta_file) do
1820
confidence = if !meta_file.is_controller?, do: :low
1921

‎lib/sobelow/dos/string_to_atom.ex

+3-1
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,11 @@ defmodule Sobelow.DOS.StringToAtom do
1111
1212
$ mix sobelow -i DOS.StringToAtom
1313
"""
14-
use Sobelow.Finding
14+
@uid 13
1515
@finding_type "DOS.StringToAtom: Unsafe `String.to_atom`"
1616

17+
use Sobelow.Finding
18+
1719
def run(fun, meta_file) do
1820
confidence = if !meta_file.is_controller?, do: :low
1921

0 commit comments

Comments
 (0)