From 37f43a7094de62f07646a7a0905b01ed55af50b9 Mon Sep 17 00:00:00 2001 From: Juho Nurminen Date: Thu, 7 May 2020 13:05:49 +0300 Subject: [PATCH] Move Dependency-Check configs to a separate repo (#14497) --- .circleci/config.yml | 12 ++++-- dependency-suppression.xml | 80 -------------------------------------- scripts/depcheck-alert.sh | 63 ------------------------------ 3 files changed, 9 insertions(+), 146 deletions(-) delete mode 100644 dependency-suppression.xml delete mode 100755 scripts/depcheck-alert.sh diff --git a/.circleci/config.yml b/.circleci/config.yml index dbd90f9140d..42580c4367e 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -54,6 +54,9 @@ jobs: steps: - attach_workspace: at: ~/mattermost/ + - run: + name: Checkout config + command: cd .. && git clone https://github.com/mattermost/security-automation-config - run: name: Install Go command: sudo apt-get update && sudo apt-get install golang @@ -71,14 +74,17 @@ jobs: - run: name: Run OWASP Dependency-Check Analyzer command: | - ~/.owasp/dependency-check/bin/dependency-check.sh --data << parameters.cve_data_directory >> \ - --format ALL --noupdate --enableExperimental --suppression ./dependency-suppression.xml \ + ~/.owasp/dependency-check/bin/dependency-check.sh \ + --data << parameters.cve_data_directory >> --format ALL --noupdate --enableExperimental \ + --propertyfile ../security-automation-config/dependency-check/dependencycheck.properties \ + --suppression ../security-automation-config/dependency-check/suppression.xml \ + --suppression ../security-automation-config/dependency-check/suppression.$CIRCLE_PROJECT_REPONAME.xml \ --scan './**/*' || true - owasp/collect_reports: persist_to_workspace: false - run: name: Post results to Mattermost - command: ./scripts/depcheck-alert.sh + command: go run ../security-automation-config/dependency-check/post_results.go # TODO: enable this step when the i18n-extract works with mattermost-server only # and not depend on both mm-server/enterprise diff --git a/dependency-suppression.xml b/dependency-suppression.xml deleted file mode 100644 index f909a5f0773..00000000000 --- a/dependency-suppression.xml +++ /dev/null @@ -1,80 +0,0 @@ - - - - - ^pkg:golang/golang\.org/x/crypto@.*$ - CVE-2019-11840 - - - - ^pkg:golang/github\.com/go\-sql\-driver/mysql@.*$ - cpe:/a:mysql:mysql - - - - ^pkg:golang/github\.com/.*$ - cpe:/a:github:github - - - - ^pkg:golang/github\.com/prometheus/client_model@.*$ - cpe:/a:prometheus:prometheus - - - - ^pkg:golang/github\.com/coreos/etcd@.*$ - CVE-2018-16886 - - - - ^pkg:golang/golang\.org/x/tools@.*$ - cpe:/a:data-tools_project:data_tools - - - - ^pkg:golang/golang\.org/x/crypto@.*$ - CVE-2017-3204 - - - - ^pkg:golang/golang\.org/x/crypto@.*$ - cpe:/a:ssh:ssh - - - - ^pkg:golang/github\.com/buger/jsonparser@.*$ - CVE-2020-10675 - - - - ^pkg:golang/golang\.org/x/tools@.*$ - cpe:/a:data_tools_project:data_tools - - - - ^pkg:javascript/jquery@.*$ - Regex in its jQuery.htmlPrefilter sometimes may introduce XSS - - diff --git a/scripts/depcheck-alert.sh b/scripts/depcheck-alert.sh deleted file mode 100755 index 8f8e78c08d4..00000000000 --- a/scripts/depcheck-alert.sh +++ /dev/null @@ -1,63 +0,0 @@ -#!/usr/bin/env bash -# This is a script to post alerts about new Dependency-Check -# findings to the community server - -# Get artifacts from CircleCI -report_artifacts=$(curl -s https://circleci.com/api/v1.1/project/gh/$CIRCLE_PROJECT_USERNAME/$CIRCLE_PROJECT_REPONAME/$CIRCLE_BUILD_NUM/artifacts) -json_url=$(echo $report_artifacts | jq -r 'map(select(.path == "Reports/OWASP/dependency-check-report.json").url)[0]') -json_report=$(curl -sL $json_url) - -# Anything new? -vulnerability_count=$(echo $json_report | jq '[.dependencies[]?.vulnerabilities[]?.name]|length') -if [ $vulnerability_count -ne 0 ] -then - if [ $vulnerability_count -gt 1 ] - then - alert_message="$vulnerability_count new findings" - else - alert_message="New finding" - fi - alert_message="$alert_message in \`$CIRCLE_PROJECT_REPONAME\` CircleCI build [#$CIRCLE_BUILD_NUM]($CIRCLE_BUILD_URL)" - if [ -z "$CIRCLE_PULL_REQUEST" ] - then - alert_message="$alert_message\n\n" - else - alert_message="$alert_message, triggered by $CIRCLE_PULL_REQUEST\n\n" - fi - alert_message="$alert_message|Dependency|CPEs|CVEs|Severity|\n|----------|----|----|--------|\n" - html_url=$(echo $report_artifacts | jq -r 'map(select(.path == "Reports/OWASP/dependency-check-report.html").url)[0]') - - # Build the rows of the summary table - vulnerable_dependencies=($(echo $json_report | jq -r '[.dependencies[]?]|map(select(.vulnerabilities).fileName)[]')) - for dependency in ${vulnerable_dependencies[@]} - do - json_dependency=$(echo $json_report | jq -r '[.dependencies[]?]|map(select(.fileName=="'$dependency'"))[]') - index=$(echo $json_report | jq '[.dependencies[]?]|map(.fileName)|index("'$dependency'")+1') - sha1=$(echo $json_dependency | jq -r '.sha1') - # The SHA-1 is set on the JSON report only for non-virtual dependencies - # Calculation for virtual dependencies is analyzer-specific - if [ $sha1 = 'null' ] - then - evidence_source=$(echo $json_dependency | jq -r '.evidenceCollected|.vendorEvidence+.productEvidence+.versionEvidence|map(.source)|unique[0]') - if [ $evidence_source = 'Gopkg.lock' ] - then - sha1=($(echo $json_dependency | jq -r '.packages[0].id' | tr -d '\n' | sha1sum)) - else - sha1=($(echo $json_dependency | jq -r '.filePath' | tr -d '\n' | sha1sum)) - fi - fi - dependency_url="$html_url#l${index}_$sha1" - cpes=$(echo $json_dependency | jq -r '.vulnerabilityIds|select(.)|map("`"+.id+"`")|join(", ")') - cves=$(echo $json_dependency | jq -r '.vulnerabilities|select(.)|map("[`"+.name+"`](http://web.nvd.nist.gov/view/vuln/detail?vulnId="+.name+")")|join(", ")') - severities=$(echo $json_dependency | jq '.vulnerabilities|select(.)|map(.severity)|unique') - severity=$(echo $severities | jq -r 'if contains(["HIGH"]) then "`HIGH`" elif contains(["MEDIUM"]) then "`MEDIUM`" elif contains(["LOW"]) then "`LOW`" else "`Unknown`" end') - alert_message="$alert_message|[$dependency]"'('$dependency_url')'"|$cpes|$cves|$severity|\n" - done - alert_message=$alert_message'\nView the full report [here]('$html_url')' - alert_message=$alert_message' or [edit suppressions](https://github.com/'$CIRCLE_PROJECT_USERNAME'/'$CIRCLE_PROJECT_REPONAME'/edit/master/dependency-suppression.xml).' - - # Post to Mattermost - curl -s -X POST -d 'payload={"username": "Dependency-Check", "icon_url": "https://www.mattermost.org/wp-content/uploads/2016/04/icon.png", "text": - "'"$alert_message"'" - }' "$SAST_WEBHOOK_URL" -fi