From c9467115e66b8ed6fe8bd34227ed92c4f3c0750a Mon Sep 17 00:00:00 2001 From: Johannes Zahn Date: Fri, 20 Aug 2021 09:33:08 +0200 Subject: [PATCH 01/12] add env variable to crash on failed validation Signed-off-by: Johannes Zahn --- tests/integration/helpers.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tests/integration/helpers.js b/tests/integration/helpers.js index 66fafae9a5..a8aac489a2 100644 --- a/tests/integration/helpers.js +++ b/tests/integration/helpers.js @@ -124,6 +124,10 @@ async function scan(name, scanType, parameters = [], timeout = 180) { spec: { scanType, parameters, + env: [{ + name : "CRASH_ON_FAILED_VALIDATION", + value : "true" + }] }, }; From d703be1489d20332c33f8c72752a44c8093b7a51 Mon Sep 17 00:00:00 2001 From: Johannes Zahn Date: Fri, 20 Aug 2021 09:59:35 +0200 Subject: [PATCH 02/12] log crash on failed validation envb variable Signed-off-by: Johannes Zahn --- parser-sdk/nodejs/parser-wrapper.js | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/parser-sdk/nodejs/parser-wrapper.js b/parser-sdk/nodejs/parser-wrapper.js index ea7b8d94b0..c9878942b8 100644 --- a/parser-sdk/nodejs/parser-wrapper.js +++ b/parser-sdk/nodejs/parser-wrapper.js @@ -135,13 +135,15 @@ async function main() { console.log("Adding UUIDs and Dates to the findings"); const findingsWithIdsAndDates = addIdsAndDates(findings); - console.log("Validating Findings"); + const crash_on_failed_validation = process.env["CRASH_ON_FAILED_VALIDATION"] === "true" + console.log("Validating Findings. Environment variable CRASH_ON_FAILED_VALIDATION is set to {}", crash_on_failed_validation); try { await validate(findings); + console.log("The Findings were successfully validated") } catch (error) { - console.error("Findings Validation failed with error:"); + console.error("The Findings Validation failed with error(s):"); console.error(error); - if (process.env["CRASH_ON_FAILED_VALIDATION"] === "true") { + if (crash_on_failed_validation) { process.exit(1); } } From d0b54abecfa9530344cc434f97a64efe79a40f2d Mon Sep 17 00:00:00 2001 From: Johannes Zahn Date: Fri, 20 Aug 2021 12:24:14 +0200 Subject: [PATCH 03/12] Revert "add env variable to crash on failed validation" This reverts commit c9467115e66b8ed6fe8bd34227ed92c4f3c0750a. Signed-off-by: Johannes Zahn --- tests/integration/helpers.js | 4 ---- 1 file changed, 4 deletions(-) diff --git a/tests/integration/helpers.js b/tests/integration/helpers.js index a8aac489a2..66fafae9a5 100644 --- a/tests/integration/helpers.js +++ b/tests/integration/helpers.js @@ -124,10 +124,6 @@ async function scan(name, scanType, parameters = [], timeout = 180) { spec: { scanType, parameters, - env: [{ - name : "CRASH_ON_FAILED_VALIDATION", - value : "true" - }] }, }; From cf2d130539afebeb731f1db31741c5f820c0b622 Mon Sep 17 00:00:00 2001 From: Johannes Zahn Date: Fri, 20 Aug 2021 12:44:53 +0200 Subject: [PATCH 04/12] add crash on failed validation to parse definition in CI Signed-off-by: Johannes Zahn --- .github/workflows/ci.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 566c975f04..d70cdfe926 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -899,7 +899,9 @@ jobs: --set="scanner.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/scanner-gitleaks" \ --set="scanner.image.tag=sha-$(git rev-parse --short HEAD)" \ --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-gitleaks" \ - --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" + --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" cd tests/integration/ npx jest --ci --color scanner/gitleaks.test.js From 6145e05d2c9396168dcc529fd50e2e50ee69eb4c Mon Sep 17 00:00:00 2001 From: Johannes Zahn Date: Mon, 23 Aug 2021 15:13:47 +0200 Subject: [PATCH 05/12] use test scan to make sure invalid findings make tests fail Signed-off-by: Johannes Zahn --- .github/workflows/ci.yaml | 17 +++++++++++++++ scanners/test-scan/parser/parser.js | 21 +++++++++++++++++-- .../generic/findings-validation.test.js | 19 +++++++++++++++++ 3 files changed, 55 insertions(+), 2 deletions(-) create mode 100644 tests/integration/generic/findings-validation.test.js diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index d70cdfe926..8a334a6038 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -825,6 +825,23 @@ jobs: # This steps should include Integration tests which are not related to a Specific Scanner + # ---- Gerneral Testing | Findings Validation ---- + + - name: "Parser should fail on invalid Findings" + run: | + helm -n integration-tests install test-scan ./scanners/test-scan/ \ + --set="scanner.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/scanner-test-scan" \ + --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-test-scan" \ + --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" \ + --set="scanner.image.tag=sha-$(git rev-parse --short HEAD)" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" \ + --set="parser.env[1].name=PRODUCE_INVALID_FINDINGS" \ + --set-string="parser.env[1].value=true" + cd tests/integration/ + npx jest --ci --color generic/findings-validation.test.js + helm -n integration-tests uninstall test-scan + # ---- General Testing | ReadAndWrite Hook ---- - name: "Throws NoScanDefinition Error Integration Tests" diff --git a/scanners/test-scan/parser/parser.js b/scanners/test-scan/parser/parser.js index df84292b1f..48822705ac 100644 --- a/scanners/test-scan/parser/parser.js +++ b/scanners/test-scan/parser/parser.js @@ -3,8 +3,24 @@ // SPDX-License-Identifier: Apache-2.0 async function parse() { - return [ - { + if (process.env.PRODUCE_INVALID_FINDINGS === "true"){ + return [ + { + //missing name and category to be a valid finding + description: "Found a host", + location: "hostname", + severity: "INFORMATIONAL", + osi_layer: "NETWORK", + attributes: { + ip_address: "ip address", + hostname: "hostname", + operating_system: "osNmap", + }, + } + ] + } + else{ + return [{ name: "Test read-write-hook service", description: `Port is using protocol.`, category: "Open Port", @@ -40,6 +56,7 @@ async function parse() { }, }, ]; + } } module.exports.parse = parse; diff --git a/tests/integration/generic/findings-validation.test.js b/tests/integration/generic/findings-validation.test.js new file mode 100644 index 0000000000..3382493928 --- /dev/null +++ b/tests/integration/generic/findings-validation.test.js @@ -0,0 +1,19 @@ +// SPDX-FileCopyrightText: 2021 iteratec GmbH +// +// SPDX-License-Identifier: Apache-2.0 + +const { scan } = require("../helpers"); + +jest.retryTimes(3); + +test( + "Parser must fail on invalid findings", + async () => { + await expect( + scan("invalid-findings-test-scan", "test-scan", [], 90) + ).rejects.toThrow( + `Scan failed with description "Failed to run the Parser. This is likely a Bug, we would like to know about. Please open up a Issue on GitHub."` + ); + }, + 3 * 60 * 1000 +); From 0d67530ba4d66932b121bc2192a00b5bca6a9e04 Mon Sep 17 00:00:00 2001 From: Johannes Zahn Date: Mon, 23 Aug 2021 15:19:30 +0200 Subject: [PATCH 06/12] fix code climate issues Signed-off-by: Johannes Zahn --- scanners/test-scan/parser/parser.js | 90 +++++++++++++++-------------- 1 file changed, 48 insertions(+), 42 deletions(-) diff --git a/scanners/test-scan/parser/parser.js b/scanners/test-scan/parser/parser.js index 48822705ac..6651eba7ff 100644 --- a/scanners/test-scan/parser/parser.js +++ b/scanners/test-scan/parser/parser.js @@ -3,48 +3,16 @@ // SPDX-License-Identifier: Apache-2.0 async function parse() { - if (process.env.PRODUCE_INVALID_FINDINGS === "true"){ - return [ - { - //missing name and category to be a valid finding - description: "Found a host", - location: "hostname", - severity: "INFORMATIONAL", - osi_layer: "NETWORK", - attributes: { - ip_address: "ip address", - hostname: "hostname", - operating_system: "osNmap", - }, - } - ] - } - else{ - return [{ - name: "Test read-write-hook service", - description: `Port is using protocol.`, - category: "Open Port", - location: `tcp://rw-hook-test:80`, - osi_layer: "NETWORK", - severity: "INFORMATIONAL", - attributes: { - port: 80, - state: "Open", - ip_address: "host ip address", - mac_address: "hostInfo.mac", - protocol: "openPort.protocol", - hostname: "hostInfo.hostname", - method: "openPort.method", - operating_system: "hostInfo.osNmap", - service: "openPort.service", - serviceProduct: "openPort.serviceProduct", - serviceVersion: "openPort.serviceVersion", - scripts: "openPort.scriptOutputs", - }, - }, + if (process.env.PRODUCE_INVALID_FINDINGS === "true") + return getValidFindings() + else + return getInvalidFindings() +} + +function getValidFindings(){ + return [ { - name: `Host: hostname`, - category: "Host", + //missing name and category to be a valid finding description: "Found a host", location: "hostname", severity: "INFORMATIONAL", @@ -54,9 +22,47 @@ async function parse() { hostname: "hostname", operating_system: "osNmap", }, + } + ] +} + +function getInvalidFindings(){ + return [{ + name: "Test read-write-hook service", + description: `Port is using protocol.`, + category: "Open Port", + location: `tcp://rw-hook-test:80`, + osi_layer: "NETWORK", + severity: "INFORMATIONAL", + attributes: { + port: 80, + state: "Open", + ip_address: "host ip address", + mac_address: "hostInfo.mac", + protocol: "openPort.protocol", + hostname: "hostInfo.hostname", + method: "openPort.method", + operating_system: "hostInfo.osNmap", + service: "openPort.service", + serviceProduct: "openPort.serviceProduct", + serviceVersion: "openPort.serviceVersion", + scripts: "openPort.scriptOutputs", + }, + }, + { + name: `Host: hostname`, + category: "Host", + description: "Found a host", + location: "hostname", + severity: "INFORMATIONAL", + osi_layer: "NETWORK", + attributes: { + ip_address: "ip address", + hostname: "hostname", + operating_system: "osNmap", }, + }, ]; - } } module.exports.parse = parse; From ea448d24b23d74d8de670a05650c6a3d6b0f079d Mon Sep 17 00:00:00 2001 From: Johannes Zahn Date: Mon, 23 Aug 2021 15:43:51 +0200 Subject: [PATCH 07/12] copy findings schema to docker container Signed-off-by: Johannes Zahn --- parser-sdk/nodejs/Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/parser-sdk/nodejs/Dockerfile b/parser-sdk/nodejs/Dockerfile index aa37dec5a3..9ec956b7cb 100644 --- a/parser-sdk/nodejs/Dockerfile +++ b/parser-sdk/nodejs/Dockerfile @@ -14,6 +14,7 @@ WORKDIR /home/app/parser-wrapper/ COPY --from=build --chown=app:app /home/app/node_modules/ ./node_modules/ COPY --chown=app:app ./parser-wrapper.js ./parser-wrapper.js COPY --chown=app:app ./parser-utils.js ./parser-utils.js +COPY --chown=app:app ./findings-schema.json ./findings-schema.json USER 1001 ENV NODE_ENV ${NODE_ENV:-production} ENTRYPOINT ["node", "/home/app/parser-wrapper/parser-wrapper.js"] From 858d89c835a0cd452b2fc28b88b354660335c662 Mon Sep 17 00:00:00 2001 From: Johannes Zahn Date: Tue, 24 Aug 2021 07:20:21 +0200 Subject: [PATCH 08/12] validate the findings with ids and dates Signed-off-by: Johannes Zahn --- parser-sdk/nodejs/parser-wrapper.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/parser-sdk/nodejs/parser-wrapper.js b/parser-sdk/nodejs/parser-wrapper.js index c9878942b8..6eb6fae537 100644 --- a/parser-sdk/nodejs/parser-wrapper.js +++ b/parser-sdk/nodejs/parser-wrapper.js @@ -138,7 +138,7 @@ async function main() { const crash_on_failed_validation = process.env["CRASH_ON_FAILED_VALIDATION"] === "true" console.log("Validating Findings. Environment variable CRASH_ON_FAILED_VALIDATION is set to {}", crash_on_failed_validation); try { - await validate(findings); + await validate(findingsWithIdsAndDates); console.log("The Findings were successfully validated") } catch (error) { console.error("The Findings Validation failed with error(s):"); From 072264608bac564725b3430500a79d20d8a52d3c Mon Sep 17 00:00:00 2001 From: Johannes Zahn Date: Tue, 24 Aug 2021 07:35:40 +0200 Subject: [PATCH 09/12] validate findings in all tests where scans are involved Signed-off-by: Johannes Zahn --- .github/workflows/ci.yaml | 70 +++++++++++++++++++++++++++++---------- 1 file changed, 52 insertions(+), 18 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 8a334a6038..8f6b776a7d 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -837,7 +837,7 @@ jobs: --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ --set-string="parser.env[0].value=true" \ --set="parser.env[1].name=PRODUCE_INVALID_FINDINGS" \ - --set-string="parser.env[1].value=true" + --set-string="parser.env[1].value=true" cd tests/integration/ npx jest --ci --color generic/findings-validation.test.js helm -n integration-tests uninstall test-scan @@ -864,7 +864,9 @@ jobs: --set="scanner.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/scanner-test-scan" \ --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-test-scan" \ --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" \ - --set="scanner.image.tag=sha-$(git rev-parse --short HEAD)" + --set="scanner.image.tag=sha-$(git rev-parse --short HEAD)" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" cd tests/integration/ npx jest --ci --color generic/read-write-hook.test.js helm -n integration-tests uninstall test-scan update-category update-severity @@ -877,7 +879,9 @@ jobs: --set="scanner.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/scanner-test-scan" \ --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-test-scan" \ --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" \ - --set="scanner.image.tag=sha-$(git rev-parse --short HEAD)" + --set="scanner.image.tag=sha-$(git rev-parse --short HEAD)" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" helm -n integration-tests install http-webhook ./demo-targets/http-webhook helm -n integration-tests install ro-hook ./hooks/generic-webhook/ \ --set="hook.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/hook-generic-webhook" \ @@ -918,7 +922,7 @@ jobs: --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-gitleaks" \ --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" \ --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ - --set-string="parser.env[0].value=true" + --set-string="parser.env[0].value=true" cd tests/integration/ npx jest --ci --color scanner/gitleaks.test.js @@ -930,7 +934,9 @@ jobs: --set="scanner.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/scanner-kube-hunter" \ --set="scanner.image.tag=sha-$(git rev-parse --short HEAD)" \ --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-kube-hunter" \ - --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" + --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" cd tests/integration/ npx jest --ci --color scanner/kube-hunter.test.js @@ -945,7 +951,9 @@ jobs: --set="scanner.image.tag=sha-$(git rev-parse --short HEAD)" \ --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-kubeaudit" \ --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" \ - --set="kubeauditScope=cluster" + --set="kubeauditScope=cluster" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" cd tests/integration/ npx jest --ci --color scanner/kubeaudit.test.js kubectl delete namespace kubeaudit-tests @@ -959,7 +967,9 @@ jobs: --set="scanner.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/scanner-ncrack" \ --set="scanner.image.tag=sha-$(git rev-parse --short HEAD)" \ --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-ncrack" \ - --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" + --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" cd tests/integration/ npx jest --ci --color scanner/ncrack.test.js @@ -972,7 +982,9 @@ jobs: --set="scanner.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/scanner-nikto" \ --set="scanner.image.tag=sha-$(git rev-parse --short HEAD)" \ --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-nikto" \ - --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" + --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" cd tests/integration/ npx jest --ci --color scanner/nikto.test.js @@ -985,7 +997,9 @@ jobs: --set="scanner.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/scanner-nmap" \ --set="scanner.image.tag=sha-$(git rev-parse --short HEAD)" \ --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-nmap" \ - --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" + --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" cd tests/integration/ npx jest --ci --color scanner/nmap.test.js @@ -997,7 +1011,9 @@ jobs: --set="scanner.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/scanner-test-scan" \ --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-test-scan" \ --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" \ - --set="scanner.image.tag=sha-$(git rev-parse --short HEAD)" + --set="scanner.image.tag=sha-$(git rev-parse --short HEAD)" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" helm -n integration-tests install http-webhook ./demo-targets/http-webhook --wait helm -n integration-tests install notification-hook ./hooks/notification --values tests/integration/hooks/__testFiles__/notification-values.yaml \ @@ -1015,7 +1031,9 @@ jobs: kubectl -n integration-tests delete scans --all helm -n integration-tests install ssh-scan ./scanners/ssh-scan/ \ --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" \ - --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-ssh-scan" + --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-ssh-scan" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" cd tests/integration/ npx jest --ci --color scanner/ssh-scan.test.js @@ -1026,7 +1044,9 @@ jobs: kubectl -n integration-tests delete scans --all helm -n integration-tests install sslyze ./scanners/sslyze/ \ --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" \ - --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-sslyze" + --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-sslyze" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" cd tests/integration/ npx jest --ci --color scanner/sslyze.test.js @@ -1037,7 +1057,9 @@ jobs: kubectl -n integration-tests delete scans --all helm -n integration-tests install wpscan ./scanners/wpscan/ \ --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-wpscan" \ - --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" + --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" cd tests/integration/ npx jest --ci --color scanner/wpscan.test.js @@ -1048,7 +1070,9 @@ jobs: kubectl -n integration-tests delete scans --all helm -n integration-tests install zap ./scanners/zap/ \ --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" \ - --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-zap" + --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-zap" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" cd tests/integration/ npx jest --ci --color scanner/zap.test.js @@ -1063,7 +1087,9 @@ jobs: --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-zap" \ --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" \ --set="scanner.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/scanner-zap-advanced" \ - --set="scanner.image.tag=sha-$(git rev-parse --short HEAD)" + --set="scanner.image.tag=sha-$(git rev-parse --short HEAD)" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" kubectl apply -f ./scanners/zap-advanced/examples/integration-tests/scantype-configMap.yaml -n integration-tests cd tests/integration/ npx jest --ci --color scanner/zap-advanced.test.js @@ -1084,7 +1110,9 @@ jobs: --set="scanner.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/scanner-nmap" \ --set="scanner.image.tag=sha-$(git rev-parse --short HEAD)" \ --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-nmap" \ - --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" + --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" # Install ncrack printf "root\nadmin\n" > users.txt printf "THEPASSWORDYOUCREATED\n123456\npassword\n" > passwords.txt @@ -1094,6 +1122,8 @@ jobs: --set="scanner.image.tag=sha-$(git rev-parse --short HEAD)" \ --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-ncrack" \ --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" \ --values - scanner: extraVolumes: @@ -1129,11 +1159,15 @@ jobs: --set="scanner.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/scanner-nmap" \ --set="scanner.image.tag=sha-$(git rev-parse --short HEAD)" \ --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-nmap" \ - --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" + --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" # Install sslyze helm -n cascading-tests install sslyze ./scanners/sslyze/ --wait \ --set="parser.image.repository=docker.io/${{ env.DOCKER_NAMESPACE }}/parser-sslyze" \ - --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" + --set="parser.image.tag=sha-$(git rev-parse --short HEAD)" \ + --set="parser.env[0].name=CRASH_ON_FAILED_VALIDATION" \ + --set-string="parser.env[0].value=true" # Actually run the tests cd tests/integration/ npx jest --ci --color scanner/cascade-nmap-sslyze.test.js From 33e0047c744a7dcc0a3acb90ffc617a2d1279ae6 Mon Sep 17 00:00:00 2001 From: Johannes Zahn Date: Tue, 24 Aug 2021 07:42:28 +0200 Subject: [PATCH 10/12] fix string formatting issues Signed-off-by: Johannes Zahn --- parser-sdk/nodejs/parser-wrapper.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/parser-sdk/nodejs/parser-wrapper.js b/parser-sdk/nodejs/parser-wrapper.js index 6eb6fae537..14a3a95c9a 100644 --- a/parser-sdk/nodejs/parser-wrapper.js +++ b/parser-sdk/nodejs/parser-wrapper.js @@ -136,7 +136,7 @@ async function main() { const findingsWithIdsAndDates = addIdsAndDates(findings); const crash_on_failed_validation = process.env["CRASH_ON_FAILED_VALIDATION"] === "true" - console.log("Validating Findings. Environment variable CRASH_ON_FAILED_VALIDATION is set to {}", crash_on_failed_validation); + console.log("Validating Findings. Environment variable CRASH_ON_FAILED_VALIDATION is set to %s", crash_on_failed_validation); try { await validate(findingsWithIdsAndDates); console.log("The Findings were successfully validated") From 56ab4c800a655898ac1fe0429ef95094a0bef12d Mon Sep 17 00:00:00 2001 From: Johannes Zahn Date: Tue, 24 Aug 2021 07:47:14 +0200 Subject: [PATCH 11/12] fix bug with invalid findings in test-scann Signed-off-by: Johannes Zahn --- scanners/test-scan/parser/parser.js | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scanners/test-scan/parser/parser.js b/scanners/test-scan/parser/parser.js index 6651eba7ff..11bebfb989 100644 --- a/scanners/test-scan/parser/parser.js +++ b/scanners/test-scan/parser/parser.js @@ -3,10 +3,10 @@ // SPDX-License-Identifier: Apache-2.0 async function parse() { - if (process.env.PRODUCE_INVALID_FINDINGS === "true") - return getValidFindings() + if (process.env["PRODUCE_INVALID_FINDINGS"] === "true") + return getInvalidFindings() else - return getInvalidFindings() + return getValidFindings() } function getValidFindings(){ From cb1d9ce910916e618a5ebd45897f1008296db41b Mon Sep 17 00:00:00 2001 From: Johannes Zahn Date: Tue, 24 Aug 2021 07:49:36 +0200 Subject: [PATCH 12/12] fix bug due to naming error Signed-off-by: Johannes Zahn --- scanners/test-scan/parser/parser.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scanners/test-scan/parser/parser.js b/scanners/test-scan/parser/parser.js index 11bebfb989..4cbce4c981 100644 --- a/scanners/test-scan/parser/parser.js +++ b/scanners/test-scan/parser/parser.js @@ -9,7 +9,7 @@ async function parse() { return getValidFindings() } -function getValidFindings(){ +function getInvalidFindings(){ return [ { //missing name and category to be a valid finding @@ -26,7 +26,7 @@ function getValidFindings(){ ] } -function getInvalidFindings(){ +function getValidFindings(){ return [{ name: "Test read-write-hook service", description: `Port is using protocol.`,