-
Notifications
You must be signed in to change notification settings - Fork 179
Expand file tree
/
Copy pathparser-wrapper.ts
More file actions
249 lines (226 loc) · 6.88 KB
/
parser-wrapper.ts
File metadata and controls
249 lines (226 loc) · 6.88 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
// SPDX-FileCopyrightText: the secureCodeBox authors
//
// SPDX-License-Identifier: Apache-2.0
import { Buffer } from "node:buffer";
import {
KubeConfig,
CustomObjectsApi,
setHeaderOptions,
PatchStrategy,
} from "@kubernetes/client-node";
// @ts-ignore: parsers are provided during the docker build of the acutal parsers.
import { parse } from "./parser/parser.js";
import {
validate,
addIdsAndDates,
addScanMetadata,
type Finding,
type Severity,
type Scan,
} from "./parser-utils.js";
const kc = new KubeConfig();
kc.loadFromCluster();
const k8sApi = kc.makeApiClient(CustomObjectsApi);
const scanName = process.env["SCAN_NAME"]!;
if (!scanName) {
console.error(
"Parser was started without `SCAN_NAME` environment variable set. This is normally done by the operator.",
);
console.error(
"If you are seeing this error during a normal scan execution please open up an issue..",
);
process.exit(1);
}
const namespace = process.env["NAMESPACE"]!;
if (!namespace) {
console.error(
"Parser was started without `NAMESPACE` environment variable set. This is normally done by the operator.",
);
console.error(
"If you are seeing this error during a normal scan execution please open up an issue..",
);
process.exit(1);
}
function severityCount(findings: Finding[], severity: Severity) {
return findings.filter(
({ severity: findingSeverity }) =>
findingSeverity.toUpperCase() === severity,
).length;
}
async function uploadResultToFileStorageService(
resultUploadUrl: string,
findingsWithIdsAndDates: Finding[],
) {
try {
const res = await fetch(resultUploadUrl, {
method: "PUT",
headers: { "content-type": "" },
body: JSON.stringify(findingsWithIdsAndDates),
});
if (!res.ok) {
const text = await res.text();
console.error(`Finding Upload Failed with Response Code: ${res.status}`);
console.error(`Error Response Body: ${text}`);
process.exit(1);
}
} catch (error) {
if (error.response) {
console.error(
`Finding Upload Failed with Response Code: ${error.response.status}`,
);
console.error(`Error Response Body: ${error.response.data}`);
} else if (error.request) {
console.error(
"No response received from FileStorage when uploading finding",
);
console.error(error);
} else {
console.log("Error", error.message);
}
process.exit(1);
}
}
async function updateScanStatus(findings: Finding[]) {
try {
const findingCategories = new Map();
for (const { category } of findings) {
if (findingCategories.has(category)) {
findingCategories.set(category, findingCategories.get(category) + 1);
} else {
findingCategories.set(category, 1);
}
}
await k8sApi.patchNamespacedCustomObjectStatus(
{
group: "execution.securecodebox.io",
version: "v1",
namespace,
plural: "scans",
name: scanName,
body: {
status: {
findings: {
count: findings.length,
severities: {
informational: severityCount(findings, "INFORMATIONAL"),
low: severityCount(findings, "LOW"),
medium: severityCount(findings, "MEDIUM"),
high: severityCount(findings, "HIGH"),
},
categories: Object.fromEntries(findingCategories.entries()),
},
},
},
},
setHeaderOptions("Content-Type", PatchStrategy.MergePatch),
);
console.log("Updated status successfully");
} catch (err) {
console.error("Failed to update Scan Status via the kubernetes api");
console.error(err);
process.exit(1);
}
}
async function extractScan(): Promise<Scan> {
try {
return await k8sApi.getNamespacedCustomObject({
group: "execution.securecodebox.io",
version: "v1",
plural: "scans",
name: scanName,
namespace,
});
} catch (err) {
console.error("Failed to get Scan from the kubernetes api");
console.error(err);
process.exit(1);
}
}
async function extractParseDefinition(scan: Scan) {
try {
return await k8sApi.getNamespacedCustomObject({
group: "execution.securecodebox.io",
version: "v1",
plural: "parsedefinitions",
name: scan.status.rawResultType,
namespace,
});
} catch (err) {
console.error("Failed to get ParseDefinition from the kubernetes api");
console.error(err);
process.exit(1);
}
}
async function fetchResultFile(resultFileUrl: string, contentType?: "Binary") {
try {
const response = await fetch(resultFileUrl, { method: "GET" });
if (!response.ok) {
throw new Error(
`Failed to fetch result file: ${response.status} ${response.statusText}`,
);
}
if (contentType === "Binary") {
return Buffer.from(await response.arrayBuffer());
} else {
return await response.text();
}
} catch (err) {
throw new Error(
`Failed to fetch result file from ${resultFileUrl}: ${err.message}`,
);
}
}
async function main() {
console.log("Starting Parser");
let scan = await extractScan();
let parseDefinition = await extractParseDefinition(scan);
const resultFileUrl = process.argv[2];
const resultUploadUrl = process.argv[3];
console.log("Fetching result file");
let data: string | Buffer<ArrayBufferLike> | null = null;
try {
data = await fetchResultFile(
resultFileUrl,
parseDefinition.spec.contentType,
);
} catch (error) {
console.error("Failed to fetch scan result file for parser:");
console.error(error);
process.exit(1);
}
console.log("Fetched result file");
let findings = [];
try {
findings = await parse(data, scan);
} catch (error) {
console.error("Parser failed with error:");
console.error(error);
process.exit(1);
}
console.log(`Transformed raw result file into ${findings.length} findings`);
console.log("Adding UUIDs and Dates to the findings");
const findingsWithIdsAndDates = addIdsAndDates(findings);
console.log("Adding scan metadata to the findings");
const findingsWithMetadata = addScanMetadata(findingsWithIdsAndDates, scan);
const crash_on_failed_validation =
process.env["CRASH_ON_FAILED_VALIDATION"] === "true";
console.log(
"Validating Findings. Environment variable CRASH_ON_FAILED_VALIDATION is set to %s",
crash_on_failed_validation,
);
try {
validate(findingsWithMetadata);
console.log("The Findings were successfully validated");
} catch (error) {
console.error("The Findings Validation failed with error(s):");
console.error(error);
if (crash_on_failed_validation) {
process.exit(1);
}
}
await updateScanStatus(findings);
console.log(`Uploading results to the file storage service`);
await uploadResultToFileStorageService(resultUploadUrl, findingsWithMetadata);
console.log(`Completed parser`);
}
main();