Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| package audit | ||
|
|
||
| import ( | ||
| "github.com/jfrog/jfrog-cli-security/utils/gitutils" | ||
| "github.com/jfrog/jfrog-cli-security/utils/results" | ||
| "github.com/jfrog/jfrog-client-go/utils/log" | ||
| ) | ||
|
|
||
| func filterResultsNotInDiff(scanResults *results.SecurityCommandResults, changes *gitutils.ChangesRelevantToScan) (onlyResultsInDiff *results.SecurityCommandResults) { | ||
| if changes == nil || !changes.HasFileChanges() { | ||
| log.Debug("No diff targets to filter results") | ||
| return scanResults | ||
| } | ||
| diffDescriptors := getDescriptorsFromDiff(changes.GetChangedFilesPaths()) | ||
| // Create a new results object with the same metadata | ||
| onlyResultsInDiff = results.NewCommandResults(scanResults.CmdType) | ||
| onlyResultsInDiff.CommandMetaData = scanResults.CommandMetaData | ||
| // Loop over the scan targets and filter out the results that are not in the diff | ||
| for _, target := range scanResults.Targets { | ||
| // Add scan target to the new results object with the same metadata and no results | ||
| filterTarget := onlyResultsInDiff.NewScanResults(target.ScanTarget) | ||
| filterTarget.Errors = target.Errors | ||
| // Go over the results and filter out the ones that are not in the diff | ||
| filterTarget.ScaResults = filterScaResultsNotInDiff(target.ScaResults, diffDescriptors) | ||
| filterTarget.JasResults = filterJasResultsNotInDiff(target.JasResults, changes) | ||
| } | ||
| return | ||
| } | ||
|
|
||
| func getDescriptorsFromDiff(diffTargets []string) (descriptors []string) { | ||
| for _, target := range diffTargets { | ||
| descriptors = append(descriptors, target) | ||
| } | ||
| return | ||
| } | ||
|
|
||
| // Filter SCA results that are not in the diff, if at least one SCA descriptor is in the diff, the target is in the diff | ||
| // TODO: when we can discover and match SCA issue to location at file level, we can improve filter capabilities | ||
| func filterScaResultsNotInDiff(scaResults *results.ScaScanResults, changedDescriptors []string) (filterResults *results.ScaScanResults) { | ||
| if len(changedDescriptors) == 0 { | ||
| log.Debug("No diff targets to filter SCA results") | ||
| return scaResults | ||
| } | ||
| log.Warn("Filtering SCA results based on diff is not fully supported yet, all SCA results at the file level are included if changed") | ||
| return scaResults | ||
| } | ||
|
|
||
| func filterJasResultsNotInDiff(jasResults *results.JasScansResults, changes *gitutils.ChangesRelevantToScan) (filterResults *results.JasScansResults) { | ||
| return jasResults | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,135 @@ | ||
| package gitutils | ||
|
|
||
| import ( | ||
| "fmt" | ||
|
|
||
| goDiff "github.com/go-git/go-git/v5/plumbing/format/diff" | ||
|
|
||
| "github.com/jfrog/gofrog/datastructures" | ||
| "github.com/jfrog/jfrog-client-go/utils/log" | ||
| ) | ||
|
|
||
| type ChangesRelevantToScan struct { | ||
| ChangedFiles []FileChanges | ||
| ChangedBinaries []string | ||
| } | ||
|
|
||
| func (c ChangesRelevantToScan) HasChanges() bool { | ||
| return c.HasFileChanges() || c.HasBinaryChanges() | ||
| } | ||
|
|
||
| func (c ChangesRelevantToScan) HasFileChanges() bool { | ||
| return len(c.ChangedFiles) > 0 | ||
| } | ||
|
|
||
| func (c ChangesRelevantToScan) HasBinaryChanges() bool { | ||
| return len(c.ChangedBinaries) > 0 | ||
| } | ||
|
|
||
| func (c ChangesRelevantToScan) GetChangedFilesPaths() (paths []string) { | ||
| for _, file := range c.ChangedFiles { | ||
| paths = append(paths, file.Path) | ||
| } | ||
| return | ||
| } | ||
|
|
||
| func (c ChangesRelevantToScan) GetFileChanges(path string) (changes *FileChanges) { | ||
| for _, file := range c.ChangedFiles { | ||
| if file.Path == path { | ||
| return &file | ||
| } | ||
| } | ||
| return | ||
| } | ||
|
|
||
| // FileChangeRanges represents the changes in the | ||
| type FileChanges struct { | ||
| Path string | ||
| Changes []Range | ||
| } | ||
|
|
||
| func (f FileChanges) String() string { | ||
| return fmt.Sprintf("%s: %v", f.Path, f.Changes) | ||
| } | ||
|
|
||
| func (f FileChanges) Contains(startRow, startCol, endRow, endCol int) bool { | ||
| for _, change := range f.Changes { | ||
| if change.Contains(startRow, startCol, endRow, endCol) { | ||
| return true | ||
| } | ||
| } | ||
| return false | ||
| } | ||
|
|
||
| func (f FileChanges) Overlaps(startRow, startCol, endRow, endCol int) bool { | ||
| for _, change := range f.Changes { | ||
| if change.Overlaps(startRow, startCol, endRow, endCol) { | ||
| return true | ||
| } | ||
| } | ||
| return false | ||
| } | ||
|
|
||
| type Range struct { | ||
| StartRow int | ||
| StartCol int | ||
| EndRow int | ||
| EndCol int | ||
| } | ||
|
|
||
| func (r Range) String() string { | ||
| return fmt.Sprintf("%d:%d-%d:%d", r.StartRow, r.StartCol, r.EndRow, r.EndCol) | ||
| } | ||
|
|
||
| // Contains checks if the range contains (fully) the given range | ||
| func (r Range) Contains(startRow, startCol, endRow, endCol int) bool { | ||
| return r.StartRow <= startRow && r.StartCol <= startCol && r.EndRow >= endRow && r.EndCol >= endCol | ||
| } | ||
|
|
||
| // Overlaps checks if the range overlaps (partially or fully) the given range | ||
| func (r Range) Overlaps(startRow, startCol, endRow, endCol int) bool { | ||
| return r.StartRow < endRow && r.EndRow > startRow && r.StartCol < endCol && r.EndCol > startCol | ||
| } | ||
|
|
||
| func detectRelevantChanges(filePatches []goDiff.FilePatch) (changes ChangesRelevantToScan, err error) { | ||
| binariesChanged := datastructures.MakeSet[string]() | ||
| // Go over the file patches and detect the relevant changes | ||
| for _, filePatch := range filePatches { | ||
| from, to := filePatch.Files() | ||
| fromPath := "" | ||
| if from != nil { | ||
| fromPath = from.Path() | ||
| } | ||
| toPath := "" | ||
| if to != nil { | ||
| toPath = to.Path() | ||
| } | ||
| log.Debug(fmt.Sprintf("Checking Diff between: %s (from) and %s (to)", fromPath, toPath)) | ||
| // Get the relevant changes for the file | ||
| if filePatch.IsBinary() { | ||
| // Binary file, only file path is relevant | ||
| binariesChanged.Add(to.Path()) | ||
| continue | ||
| } | ||
| if to == nil { | ||
| // Deleted file, not relevant to scan | ||
| continue | ||
| } | ||
| // Get the relevant changes in the file, if new file (from is nil) all the content is relevant | ||
| if fileChanges := processFileChunksForRelevantChanges(filePatch.Chunks(), from == nil); /*len(fileChanges) > 0*/ true { | ||
| changes.ChangedFiles = append(changes.ChangedFiles, FileChanges{Path: to.Path(), Changes: fileChanges}) | ||
| } | ||
| } | ||
| changes.ChangedBinaries = binariesChanged.ToSlice() | ||
| return | ||
| } | ||
|
|
||
| func processFileChunksForRelevantChanges(fileChunks []goDiff.Chunk, isNewFile bool) (changes []Range) { | ||
| // SARIF locations start at 1 | ||
| // row, col := 1, 1 | ||
| for _, diffChunk := range fileChunks { | ||
| chunkContent := diffChunk.Content() | ||
| log.Debug(fmt.Sprintf("Chunk (type = %d): \"%s\"", diffChunk.Type(), chunkContent)) | ||
| } | ||
| return | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| package gitutils | ||
|
|
||
| import ( | ||
| ) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.