Skip to content

Commit 77424b1

Browse files
cyberchen1995cyberchen1995
authored
Merge pull request #41 from XmirrorSecurity/master
[pull] master from XmirrorSecurity:master
2 parents 3fbc359 + 2c09408 commit 77424b1

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+1384
-48
lines changed

‎.github/workflows/run_opensca_scan.yml

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: OpenSCA Scan
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
pull_request:
8+
branches:
9+
- master
10+
workflow_dispatch:
11+
12+
13+
jobs:
14+
opensca_scan:
15+
name: OpenSCA Scan
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: Checkout
19+
uses: actions/checkout@v4
20+
with:
21+
sparse-checkout: |
22+
cmd/
23+
opensca/
24+
go.mod
25+
main.go
26+
- name: Run OpenSCA Scan
27+
uses: XmirrorSecurity/opensca-scan-action@v1
28+
with:
29+
token: ${{ secrets.OPENSCA_TOKEN }}
30+
proj: ${{ secrets.OPENSCA_PROJECT_ID }}
31+
need-artifact: true
32+
out: "outputs/results.json,outputs/result.html"

‎README.md

+24-20
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@
6161

6262
## 下载安装
6363

64-
1. 从 [github](https://github.com/XmirrorSecurity/OpenSCA-cli/releases) 或 [gitee](https://gitee.com/XmirrorSecurity/OpenSCA-cli/releases) 下载对应系统架构的可执行文件压缩包
64+
1. 从 [github](https://github.com/XmirrorSecurity/OpenSCA-cli/releases) 或 [gitee](https://gitee.com/XmirrorSecurity/OpenSCA-cli/releases) 或 [gitcode](https://gitcode.com/XmirrorSecurity/OpenSCA-cli/releases) 下载对应系统架构的可执行文件压缩包
6565

6666
2. 或者下载源码编译(需要 `go 1.18` 及以上版本)
6767

@@ -70,10 +70,14 @@
7070
git clone https://github.com/XmirrorSecurity/OpenSCA-cli.git opensca && cd opensca && go build
7171
// gitee linux/mac
7272
git clone https://gitee.com/XmirrorSecurity/OpenSCA-cli.git opensca && cd opensca && go build
73+
// gitcode linux/mac
74+
git clone https://gitcode.com/XmirrorSecurity/OpenSCA-cli.git opensca && cd opensca && go build
7375
// github windows
7476
git clone https://github.com/XmirrorSecurity/OpenSCA-cli.git opensca ; cd opensca ; go build
7577
// gitee windows
7678
git clone https://gitee.com/XmirrorSecurity/OpenSCA-cli.git opensca ; cd opensca ; go build
79+
// gitcode windows
80+
git clone https://gitcode.com/XmirrorSecurity/OpenSCA-cli.git opensca ; cd opensca ; go build
7781
```
7882

7983
默认生成当前系统架构的程序，如需生成其他系统架构可配置环境变量后编译
@@ -191,25 +195,25 @@ docker run -ti --rm -v ${PWD}:/src opensca/opensca-cli -token ${put_your_token_h
191195

192196
### 漏洞库字段说明
193197

194-
| 字段 | 描述 | 是否必填 |
195-
| :------------------ | :-------------------------------- | :------- |
196-
| `vendor` | 组件厂商 | 否 |
197-
| `product` | 组件名 | 是 |
198-
| `version` | 漏洞影响版本 | 是 |
199-
| `language` | 组件语言 | 是 |
200-
| `name` | 漏洞名 | 否 |
201-
| `id` | 自定义编号 | 是 |
202-
| `cve_id` | cve 编号 | 否 |
203-
| `cnnvd_id` | cnnvd 编号 | 否 |
204-
| `cnvd_id` | cnvd 编号 | 否 |
205-
| `cwe_id` | cwe 编号 | 否 |
206-
| `description` | 漏洞描述 | 否 |
207-
| `description_en` | 漏洞英文描述 | 否 |
208-
| `suggestion` | 漏洞修复建议 | 否 |
209-
| `attack_type` | 攻击方式 | 否 |
210-
| `release_date` | 漏洞发布日期 | 否 |
211-
| `security_level_id` | 漏洞风险评级(1~4 风险程度递减) | 否 |
212-
| `exploit_level_id` | 漏洞利用评级(0:不可利用,1:可利用) | 否 |
198+
| 字段 | 描述 | 是否必填 |
199+
| :------------------ | :--------------------------------------- | :------- |
200+
| `vendor` | 组件厂商 | 否 |
201+
| `product` | 组件名 | 是 |
202+
| `version` | 漏洞影响版本(必须为范围，不能填单个版本) | 是 |
203+
| `language` | 组件语言 | 是 |
204+
| `name` | 漏洞名 | 否 |
205+
| `id` | 自定义编号 | 是 |
206+
| `cve_id` | cve 编号 | 否 |
207+
| `cnnvd_id` | cnnvd 编号 | 否 |
208+
| `cnvd_id` | cnvd 编号 | 否 |
209+
| `cwe_id` | cwe 编号 | 否 |
210+
| `description` | 漏洞描述 | 否 |
211+
| `description_en` | 漏洞英文描述 | 否 |
212+
| `suggestion` | 漏洞修复建议 | 否 |
213+
| `attack_type` | 攻击方式 | 否 |
214+
| `release_date` | 漏洞发布日期 | 否 |
215+
| `security_level_id` | 漏洞风险评级(1~4 风险程度递减) | 否 |
216+
| `exploit_level_id` | 漏洞利用评级(0:不可利用,1:可利用) | 否 |
213217

214218
本地漏洞库中`language`字段设定值包含`java、javascript、golang、rust、php、ruby、python`
215219

‎cmd/format/dpsbom.go

+117
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
package format
2+
3+
import (
4+
"archive/zip"
5+
"crypto/md5"
6+
"crypto/sha1"
7+
"crypto/sha256"
8+
"encoding/hex"
9+
"encoding/json"
10+
"errors"
11+
"fmt"
12+
"hash"
13+
"io"
14+
"path/filepath"
15+
"strings"
16+
17+
"github.com/xmirrorsecurity/opensca-cli/v3/cmd/detail"
18+
"github.com/xmirrorsecurity/opensca-cli/v3/opensca/model"
19+
)
20+
21+
func DpSbomZip(report Report, out string) {
22+
zipFile := out
23+
if !strings.HasSuffix(out, ".zip") {
24+
zipFile = out + ".zip"
25+
}
26+
jsonName := filepath.Base(out)
27+
if !strings.HasSuffix(jsonName, ".json") {
28+
jsonName = jsonName + ".json"
29+
}
30+
outWrite(zipFile, func(w io.Writer) error {
31+
doc := pdSbomDoc(report)
32+
if doc.Hashes.HashFile == "" {
33+
return errors.New("hash file is required")
34+
}
35+
36+
var h hash.Hash
37+
switch strings.ToLower(doc.Hashes.Algorithm) {
38+
case "sha-256":
39+
h = sha256.New()
40+
case "sha-1":
41+
h = sha1.New()
42+
case "md5":
43+
h = md5.New()
44+
case "":
45+
return errors.New("hash algorithm is required")
46+
default:
47+
return fmt.Errorf("unsupported hash algorithm: %s", doc.Hashes.Algorithm)
48+
}
49+
50+
tojson := func(w io.Writer) error {
51+
encoder := json.NewEncoder(w)
52+
encoder.SetIndent("", " ")
53+
return encoder.Encode(doc)
54+
}
55+
56+
zipfile := zip.NewWriter(w)
57+
defer zipfile.Close()
58+
59+
sbomfile, err := zipfile.Create(jsonName)
60+
if err != nil {
61+
return err
62+
}
63+
err = tojson(sbomfile)
64+
if err != nil {
65+
return err
66+
}
67+
68+
hashfile, err := zipfile.Create(doc.Hashes.HashFile)
69+
if err != nil {
70+
return err
71+
}
72+
err = tojson(h)
73+
if err != nil {
74+
return err
75+
}
76+
hashstr := hex.EncodeToString(h.Sum(nil)[:])
77+
hashfile.Write([]byte(hashstr))
78+
79+
return nil
80+
})
81+
}
82+
83+
func pdSbomDoc(report Report) *model.DpSbomDocument {
84+
85+
doc := model.NewDpSbomDocument(report.TaskInfo.AppName, "opensca-cli")
86+
87+
report.DepDetailGraph.ForEach(func(n *detail.DepDetailGraph) bool {
88+
89+
if n.Name == "" {
90+
return true
91+
}
92+
93+
lics := []string{}
94+
for _, lic := range n.Licenses {
95+
lics = append(lics, lic.ShortName)
96+
}
97+
doc.AppendComponents(func(dsp *model.DpSbomPackage) {
98+
dsp.Identifier.Purl = n.Purl()
99+
dsp.Name = n.Name
100+
dsp.Version = n.Version
101+
dsp.License = lics
102+
})
103+
104+
children := []string{}
105+
for _, c := range n.Children {
106+
if c.Name == "" {
107+
continue
108+
}
109+
children = append(children, c.Purl())
110+
}
111+
doc.AppendDependencies(n.Purl(), children)
112+
113+
return true
114+
})
115+
116+
return doc
117+
}

‎cmd/format/save.go

+10
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,12 @@ func Save(report Report, output string) {
3939
switch filepath.Ext(out) {
4040
case ".html":
4141
Html(genReport(report), out)
42+
case ".zip":
43+
if strings.HasSuffix(out, ".dpsbom.zip") {
44+
DpSbomZip(report, out)
45+
} else {
46+
Json(genReport(report), out)
47+
}
4248
case ".json":
4349
if strings.HasSuffix(out, ".spdx.json") {
4450
SpdxJson(report, out)
@@ -48,9 +54,13 @@ func Save(report Report, output string) {
4854
CycloneDXJson(report, out)
4955
} else if strings.HasSuffix(out, ".swid.json") {
5056
SwidJson(report, out)
57+
} else if strings.HasSuffix(out, ".dpsbom.json") {
58+
DpSbomZip(report, out)
5159
} else {
5260
Json(genReport(report), out)
5361
}
62+
case ".dpsbom":
63+
DpSbomZip(report, out)
5464
case ".dsdx":
5565
Dsdx(report, out)
5666
case ".spdx":

‎cmd/format/statis.go

+8-7
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ import (
77
)
88

99
// Statis 统计概览信息
10-
func Statis(report Report) string {
10+
func Statis(report Report) (string, string) {
1111

1212
// 组件风险统计 key:0代表组件总数
1313
depStatic := map[int]int{
@@ -50,10 +50,11 @@ func Statis(report Report) string {
5050

5151
return true
5252
})
53-
54-
return fmt.Sprintf("Components:%d C:%d H:%d M:%d L:%d\n"+
55-
"Vulnerabilities:%d C:%d H:%d M:%d L:%d",
56-
depStatic[0], depStatic[1], depStatic[2], depStatic[3], depStatic[4],
57-
vulStatic[0], vulStatic[1], vulStatic[2], vulStatic[3], vulStatic[4],
58-
)
53+
if vulStatic[0] != 0 {
54+
return fmt.Sprintf("Components:%d C:%d H:%d M:%d L:%d",
55+
depStatic[0], depStatic[1], depStatic[2], depStatic[3], depStatic[4]),
56+
fmt.Sprintf("\nVulnerabilities:%d C:%d H:%d M:%d L:%d",
57+
vulStatic[0], vulStatic[1], vulStatic[2], vulStatic[3], vulStatic[4])
58+
}
59+
return fmt.Sprintf("Components: %d", depStatic[0]), ""
5960
}

‎cmd/ui/ui.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -93,8 +93,9 @@ func OpenUI(report format.Report) {
9393
}
9494

9595
func TaskInfo(report format.Report) *tview.TextView {
96+
dep, vul := format.Statis(report)
9697
info := tview.NewTextView().
97-
SetText(format.Statis(report))
98+
SetText(fmt.Sprintf("%s\n%s", dep, vul))
9899
info.SetTextColor(tcell.ColorBlue)
99100
return info
100101
}

‎docs/Contributing_Guideline-v1.0.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -78,4 +78,4 @@ We appreciate all the contributions to OpenSCA.
7878

7979
Thanks again for your interest in OpenSCA and your support for our solution to open source vulnerabilities.
8080

81-
For the Chinese version of our contributing guideline, please check [贡献指南（中文版）v1.0](./Contributing_Guideline-v1.0-zh_CN.md)。
81+
For the Chinese version of our contributing guideline, please check [贡献指南(中文版)v1.0](./Contributing_Guideline-v1.0-zh_CN.md)。

0 commit comments

Comments
 (0)