public static IEnumerable <Project> GetProjects(CxRestContext ctx, CancellationToken token)
{
try
{
using (var client = ctx.Json.CreateSastClient())
using (var projects = client.GetAsync(
CxRestContext.MakeUrl(ctx.Url, URL_SUFFIX), token).Result)
{
if (token.IsCancellationRequested)
{
return(null);
}
if (!projects.IsSuccessStatusCode)
{
throw new InvalidOperationException(projects.ReasonPhrase);
}
using (var sr = new StreamReader
(projects.Content.ReadAsStreamAsync().Result))
using (var jtr = new JsonTextReader(sr))
{
JToken jt = JToken.Load(jtr);
return(new ProjectReader(jt, ctx, token));
}
}
}
catch (HttpRequestException hex)
{
_log.Error("Communication error.", hex);
throw hex;
}
}
public static GenStatus GetReportGenerationStatus(CxRestContext ctx,
CancellationToken token, String reportId)
{
try
{
using (var client = ctx.Json.CreateSastClient())
{
using (var scanReportStatus = client.GetAsync(
CxRestContext.MakeUrl(ctx.Url,
String.Format(URL_SUFFIX, reportId)), token).Result)
{
if (!scanReportStatus.IsSuccessStatusCode)
{
return(GenStatus.None);
}
using (var sr = new StreamReader
(scanReportStatus.Content.ReadAsStreamAsync().Result))
using (var jtr = new JsonTextReader(sr))
{
JToken jt = JToken.Load(jtr);
return(ReadStatus(jt));
}
}
}
}
catch (HttpRequestException hex)
{
_log.Error("Communication error.", hex);
throw hex;
}
}
public static ViolatedPolicyCollection GetViolations(CxRestContext ctx,
CancellationToken token, int projectId, PolicyCollection policies)
{
try
{
using (var client = ctx.Json.CreateMnoClient())
using (var violationsPayload = client.GetAsync(CxRestContext.MakeUrl(ctx.MnoUrl,
String.Format(URL_SUFFIX, projectId)), token).Result)
{
if (!violationsPayload.IsSuccessStatusCode)
{
throw new InvalidOperationException
($"Unable to retrieve rule violations for project {projectId}.");
}
using (var sr = new StreamReader
(violationsPayload.Content.ReadAsStreamAsync().Result))
using (var jtr = new JsonTextReader(sr))
{
JToken jt = JToken.Load(jtr);
return(ParseViolatedRules(policies, projectId, jt));
}
}
}
catch (HttpRequestException hex)
{
_log.Error("Communication error.", hex);
throw hex;
}
}
public static PolicyCollection GetAllPolicies(CxRestContext ctx,
CancellationToken token)
{
try
{
using (var client = ctx.Json.CreateMnoClient())
using (var policyPayload = client.GetAsync(CxRestContext.MakeUrl(ctx.MnoUrl,
POLICY_LIST_URL_SUFFIX), token).Result)
{
if (!policyPayload.IsSuccessStatusCode)
{
throw new InvalidOperationException
("Unable to retrieve policies.");
}
JToken jt = JToken.Load(new JsonTextReader(new StreamReader
(policyPayload.Content.ReadAsStreamAsync().Result)));
return(ParsePolicies(ctx, token, jt));
}
}
catch (HttpRequestException hex)
{
_log.Error("Communication error.", hex);
throw hex;
}
}
public CxRestContext build()
{
if (_url == null)
{
throw new InvalidOperationException("Endpoint URL was not specified.");
}
if (_user == null)
{
throw new InvalidOperationException("Username was not specified.");
}
if (_pass == null)
{
throw new InvalidOperationException("Password was not specified.");
}
CxRestContext retVal = new CxRestContext()
{
SastToken = GetLoginToken(_url, _user, _pass, SAST_SCOPE, _validate),
MNOToken = GetLoginToken(_url, _user, _pass, $"{MNO_SCOPE} {SAST_SCOPE}", _validate),
Url = _url,
MnoUrl = String.IsNullOrEmpty(_mnoUrl) ? _url : _mnoUrl,
ValidateSSL = _validate,
Timeout = new TimeSpan(0, 0, _timeout)
};
retVal.Json = new ClientFactory("application/json", retVal);
retVal.Xml = new ClientFactory("application/xml", retVal);
return(retVal);
}
public static IEnumerable <int> GetPolicyIdsForProject(CxRestContext ctx,
CancellationToken token, int projectId)
{
try
{
using (var client = ctx.Json.CreateMnoClient())
using (var policyPayload = client.GetAsync(CxRestContext.MakeUrl(ctx.MnoUrl,
String.Format(PROJECT_POLICY_URL_SUFFIX, projectId)), token).Result)
{
if (!policyPayload.IsSuccessStatusCode)
{
throw new InvalidOperationException
($"Unable to retrieve policies for project {projectId}.");
}
JToken jt = JToken.Load(new JsonTextReader(new StreamReader
(policyPayload.Content.ReadAsStreamAsync().Result)));
LinkedList <int> policyIds = new LinkedList <int>();
using (JTokenReader reader = new JTokenReader(jt))
while (JsonUtils.MoveToNextProperty(reader, "id"))
{
policyIds.AddLast(Convert.ToInt32(((JProperty)reader.CurrentToken).Value));
}
return(policyIds);
}
}
catch (HttpRequestException hex)
{
_log.Error("Communication error.", hex);
throw hex;
}
}
public static ScanSummary GetReport(CxRestContext ctx, CancellationToken token,
String scanId)
{
try
{
String url = CxRestContext.MakeUrl(ctx.Url, URL_SUFFIX, new Dictionary <String, String>()
{
{ "scanId", Convert.ToString(scanId) }
});
using (var client = ctx.Json.CreateSastClient())
using (var scanSummary = client.GetAsync(url, token).Result)
{
if (!scanSummary.IsSuccessStatusCode)
{
throw new InvalidOperationException(scanSummary.ReasonPhrase);
}
using (var sr = new StreamReader
(scanSummary.Content.ReadAsStreamAsync().Result))
using (var jtr = new JsonTextReader(sr))
{
JToken jt = JToken.Load(jtr);
return(ParseScanSummary(jt));
}
}
}
catch (HttpRequestException hex)
{
_log.Error("Communication error.", hex);
throw hex;
}
}
public static IEnumerable <RuleDescriptor> GetRulesForPolicy(CxRestContext ctx,
CancellationToken token, int policyId)
{
try
{
using (var client = ctx.Json.CreateMnoClient())
using (var rulePayload = client.GetAsync(CxRestContext.MakeUrl(ctx.MnoUrl,
String.Format(URL_SUFFIX, policyId)), token).Result)
{
if (!rulePayload.IsSuccessStatusCode)
{
throw new InvalidOperationException
($"Unable to retrieve rules for policy {policyId}.");
}
using (var sr = new StreamReader
(rulePayload.Content.ReadAsStreamAsync().Result))
using (var jtr = new JsonTextReader(sr))
{
JToken jt = JToken.Load(jtr);
return(ParseRules(ctx, token, jt));
}
}
}
catch (HttpRequestException hex)
{
_log.Error("Communication error.", hex);
throw hex;
}
}
public static Stream GetVulnerabilities(CxRestContext ctx,
CancellationToken token, String reportId)
{
try
{
using (var client = ctx.Xml.CreateSastClient())
{
var reportPayload = client.GetAsync(CxRestContext.MakeUrl(ctx.Url,
String.Format(URL_SUFFIX, reportId)), token).Result;
if (!reportPayload.IsSuccessStatusCode)
{
throw new InvalidOperationException($"Unable to retrieve report {reportId}." +
$" Response reason is {reportPayload.ReasonPhrase}.");
}
return(reportPayload.Content.ReadAsStreamAsync().Result);
}
}
catch (HttpRequestException hex)
{
_log.Error("Communication error.", hex);
throw hex;
}
}
internal ProjectReader(JToken json, CxRestContext ctx, CancellationToken token)
{
_json = json;
_ctx = ctx;
_reader = new JTokenReader(_json);
_token = token;
}
private static IEnumerable <RuleDescriptor> ParseRules(CxRestContext ctx,
CancellationToken token, JToken rulePayload)
{
using (var reader = new JTokenReader(rulePayload))
{
LinkedList <RuleDescriptor> rules = new LinkedList <RuleDescriptor>();
while (JsonUtils.MoveToNextProperty(reader, "ruleId"))
{
RuleDescriptor rule = new RuleDescriptor()
{
RuleId = Convert.ToInt32(((JProperty)reader.CurrentToken).Value)
};
if (!JsonUtils.MoveToNextProperty(reader, "name"))
{
continue;
}
rule.Name = ((JProperty)reader.CurrentToken).Value.ToString();
if (!JsonUtils.MoveToNextProperty(reader, "description"))
{
continue;
}
rule.Description = ((JProperty)reader.CurrentToken).Value.ToString();
if (!JsonUtils.MoveToNextProperty(reader, "scanType"))
{
continue;
}
rule.ScanProduct = ((JProperty)reader.CurrentToken).Value.ToString();
if (!JsonUtils.MoveToNextProperty(reader, "ruleType"))
{
continue;
}
rule.RuleType = ((JProperty)reader.CurrentToken).Value.ToString();
if (!JsonUtils.MoveToNextProperty(reader, "createdOn"))
{
continue;
}
rule.CreatedOn = JsonUtils.UtcEpochTimeToDateTime
(Convert.ToInt64(((JProperty)reader.CurrentToken).Value) / 1000);
rules.AddLast(rule);
}
return(rules);
}
}
public static IEnumerable <Scan> GetScans(CxRestContext ctx, CancellationToken token,
ScanStatus specificStatus)
{
try
{
String url = null;
if (specificStatus != ScanStatus.All)
{
url = CxRestContext.MakeUrl(ctx.Url, URL_SUFFIX, new Dictionary <string, string>()
{
{ "scanStatus", specificStatus.ToString() }
}
);
}
else
{
url = CxRestContext.MakeUrl(ctx.Url, URL_SUFFIX);
}
using (var client = ctx.Json.CreateSastClient())
{
using (var scans = client.GetAsync(url, token).Result)
{
if (token.IsCancellationRequested)
{
return(null);
}
if (!scans.IsSuccessStatusCode)
{
throw new InvalidOperationException(scans.ReasonPhrase);
}
using (var sr = new StreamReader
(scans.Content.ReadAsStreamAsync().Result))
using (var jtr = new JsonTextReader(sr))
{
JToken jt = JToken.Load(jtr);
return(new ScansReader(jt));
}
}
}
}
catch (HttpRequestException hex)
{
_log.Error("Communication error.", hex);
throw hex;
}
}
public static bool CalculateViolations(CxRestContext ctx,
CancellationToken token, int projectId)
{
try
{
using (var client = ctx.Json.CreateMnoClient())
using (var calculationResponse = client.PostAsync(CxRestContext.MakeUrl(ctx.MnoUrl,
String.Format(URL_SUFFIX, projectId)), null, token).Result)
return(calculationResponse.StatusCode == HttpStatusCode.Created);
}
catch (HttpRequestException hex)
{
_log.Error("Communication error.", hex);
throw hex;
}
}
private static PolicyCollection ParsePolicies(CxRestContext ctx,
CancellationToken token, JToken policyPayload)
{
PolicyCollection result = new PolicyCollection();
using (JTokenReader reader = new JTokenReader(policyPayload))
while (JsonUtils.MoveToNextProperty(reader, "id"))
{
PolicyDescriptor policy = new PolicyDescriptor()
{
PolicyId = Convert.ToInt32(((JProperty)reader.CurrentToken).Value)
};
if (!JsonUtils.MoveToNextProperty(reader, "name"))
{
continue;
}
policy.Name = ((JProperty)reader.CurrentToken).Value.ToString();
if (!JsonUtils.MoveToNextProperty(reader, "description"))
{
continue;
}
policy.Description = ((JProperty)reader.CurrentToken).Value.ToString();
if (!JsonUtils.MoveToNextProperty(reader, "isActive"))
{
continue;
}
policy.isActive = Convert.ToBoolean(((JProperty)reader.CurrentToken).Value);
if (!JsonUtils.MoveToNextProperty(reader, "createdOn"))
{
continue;
}
policy.CreatedOn = JsonUtils.UtcEpochTimeToDateTime
(Convert.ToInt64(((JProperty)reader.CurrentToken).Value) / 1000);
var rules = CxMnoPolicyRules.GetRulesForPolicy(ctx, token, policy.PolicyId);
policy.AddRule(rules);
result.AddPolicy(policy);
}
return(result);
}
public static IEnumerable <Scan> GetScans(CxRestContext ctx, CancellationToken token,
int projectId)
{
try
{
String url = CxRestContext.MakeUrl(ctx.Url, URL_SUFFIX, new Dictionary <String, String>()
{
{ "projectId", Convert.ToString(projectId) },
{ "itemsPerPage", "5000" }
});
using (var client = ctx.Json.CreateSastClient())
using (var scans = client.GetAsync(url, token).Result)
{
if (token.IsCancellationRequested)
{
return(null);
}
// If no OSA license, result is 403. Return an empty set of scans.
if (scans.StatusCode == System.Net.HttpStatusCode.Forbidden)
{
return(new ScansReader());
}
if (!scans.IsSuccessStatusCode)
{
throw new InvalidOperationException(scans.ReasonPhrase);
}
using (var sr = new StreamReader
(scans.Content.ReadAsStreamAsync().Result))
using (var jtr = new JsonTextReader(sr))
{
JToken jt = JToken.Load(jtr);
return(new ScansReader(jt, projectId));
}
}
}
catch (HttpRequestException hex)
{
_log.Error("Communication error.", hex);
throw hex;
}
}
public static String GetGeneratedReportId(CxRestContext ctx, CancellationToken token,
String scanId, ReportTypes type)
{
try
{
using (var client = ctx.Json.CreateSastClient())
{
var dict = new Dictionary <String, String>()
{
{ "reportType", type.ToString() },
{ "scanId", scanId }
};
using (var payload = new FormUrlEncodedContent(dict))
{
using (var scanReportTicket = client.PostAsync(
CxRestContext.MakeUrl(ctx.Url, URL_SUFFIX), payload).Result)
{
if (!scanReportTicket.IsSuccessStatusCode)
{
throw new InvalidOperationException
($"Scan report generation request for scan {scanId} returned " +
$"{scanReportTicket.StatusCode}");
}
using (var sr = new StreamReader
(scanReportTicket.Content.ReadAsStreamAsync().Result))
using (var jtr = new JsonTextReader(sr))
{
JToken jt = JToken.Load(jtr);
return(ReadReportId(jt));
}
}
}
}
}
catch (HttpRequestException hex)
{
_log.Error("Communication error.", hex);
throw hex;
}
}
public static String GetProjectPoliciesSingleField(CxRestContext ctx,
CancellationToken token, int projectId)
{
using (var client = ctx.Json.CreateMnoClient())
{
using (var policyPayload = client.GetAsync(CxRestContext.MakeUrl(ctx.MnoUrl,
String.Format(PROJECT_POLICY_URL_SUFFIX, projectId)), token).Result)
{
if (!policyPayload.IsSuccessStatusCode)
{
throw new InvalidOperationException
($"Unable to retrieve policies for project {projectId}.");
}
JToken jt = JToken.Load(new JsonTextReader(new StreamReader
(policyPayload.Content.ReadAsStreamAsync().Result)));
return(GetFlatPolicyNames(jt));
}
}
}
public static Stream GetXmlReport(CxRestContext ctx, CancellationToken token, String scanId)
{
try
{
String reportId = CxSastGenerateScanReport.GetGeneratedReportId(ctx, token, scanId);
CxSastScanReportGenStatus.GenStatus status = CxSastScanReportGenStatus.GenStatus.None;
DateTime quitTime = DateTime.Now.Add(ctx.Timeout);
do
{
Task.Delay(DELAY_MS, token);
status = CxSastScanReportGenStatus.GetReportGenerationStatus(ctx, token, reportId);
if (DateTime.Now.CompareTo(quitTime) > 0)
{
_log.Warn($"Failed to retrive scan " +
$"report {reportId} for scan id {scanId}. " +
$"Vulnerability details will not be available.");
break;
}
} while (status != CxSastScanReportGenStatus.GenStatus.Created);
if (status == CxSastScanReportGenStatus.GenStatus.Created)
{
_log.Debug($"Report Id {reportId} for scan id {scanId} created.");
var report = CxSastDownloadReport.GetVulnerabilities(ctx, token, reportId);
return(report);
}
else
{
throw new InvalidDataException("XML report stream is invalid.");
}
}
catch (HttpRequestException hex)
{
_log.Error("Communication error.", hex);
throw hex;
}
}
public static IEnumerable <Library> GetLibraries(CxRestContext ctx, CancellationToken token,
String scanId)
{
try
{
String url = CxRestContext.MakeUrl(ctx.Url, URL_SUFFIX, new Dictionary <String, String>()
{
{ "scanId", Convert.ToString(scanId) }
});
using (var client = ctx.Json.CreateSastClient())
{
var libraries = client.GetAsync(url, token).Result;
if (token.IsCancellationRequested)
{
return(null);
}
if (!libraries.IsSuccessStatusCode)
{
throw new InvalidOperationException(libraries.ReasonPhrase);
}
using (var sr = new StreamReader
(libraries.Content.ReadAsStreamAsync().Result))
using (var jtr = new JsonTextReader(sr))
{
JToken jt = JToken.Load(jtr);
return(new LibrariesReader(jt));
}
}
}
catch (HttpRequestException hex)
{
_log.Error("Communication error.", hex);
throw hex;
}
}
public static ScanSettings GetScanSettings(CxRestContext ctx, CancellationToken token, int projectId)
{
try
{
String restUrl = CxRestContext.MakeUrl(ctx.Url, URL_SUFFIX);
using (var client = ctx.Json.CreateSastClient())
using (var settings = client.GetAsync(CxRestContext.MakeUrl(restUrl,
Convert.ToString(projectId)), token).Result)
{
if (token.IsCancellationRequested)
{
return(null);
}
if (!settings.IsSuccessStatusCode)
{
throw new InvalidOperationException(settings.ReasonPhrase);
}
using (var sr = new StreamReader
(settings.Content.ReadAsStreamAsync().Result))
using (var jtr = new JsonTextReader(sr))
{
JToken jt = JToken.Load(jtr);
return(new ScanSettings(jt));
}
}
}
catch (HttpRequestException hex)
{
_log.Error("Communication error.", hex);
throw hex;
}
}
public static IEnumerable <Scan> GetScans(CxRestContext ctx, CancellationToken token)
{
return(GetScans(ctx, token, ScanStatus.All));
}
internal ClientFactory(String mediaType, CxRestContext ctx)
{
Context = ctx;
MediaType = mediaType;
}
public static String GetGeneratedReportId(CxRestContext ctx, CancellationToken token, String scanId)
{
return(GetGeneratedReportId(ctx, token, scanId, ReportTypes.XML));
}
public static Stream GetVulnerabilities(CxRestContext ctx,
CancellationToken token, String reportId)
{
try
{
int retryCount = 0;
while (retryCount < RETRY_MAX)
{
using (var client = ctx.Xml.CreateSastClient())
{
if (retryCount > 0)
{
int delay = RETRY_DELAY_MS * retryCount;
_log.Info($"Waiting {delay}ms before retrying download of report {reportId}");
Task.Delay(delay, token);
}
try
{
var reportPayload = client.GetAsync(CxRestContext.MakeUrl(ctx.Url,
String.Format(URL_SUFFIX, reportId)), token).Result;
if (!reportPayload.IsSuccessStatusCode)
{
_log.Warn($"Unable to retrieve XML report {reportId}. Response status [{reportPayload.StatusCode}:{reportPayload.ReasonPhrase}]." +
$" Attempt #{retryCount + 1} of {RETRY_MAX}.");
retryCount++;
continue;
}
return(reportPayload.Content.ReadAsStreamAsync().Result);
}
catch (AggregateException aex)
{
_log.Warn($"Multiple exceptions caught attempting to retrieve XML report {reportId} during " +
$"attempt #{retryCount + 1} of {RETRY_MAX}.");
_log.Warn("BEGIN exception report");
int exCount = 0;
aex.Handle((x) =>
{
_log.Warn($"Exception #{++exCount}", x);
return(true);
});
_log.Warn("END exception report");
retryCount++;
}
catch (Exception ex)
{
_log.Warn($"Exception caught attempting to retrieve XML report {reportId} during " +
$"attempt #{retryCount + 1} of {RETRY_MAX}.", ex);
retryCount++;
}
}
}
}
catch (HttpRequestException hex)
{
_log.Error("Communication error.", hex);
throw hex;
}
throw new InvalidOperationException($"Unable to retrieve XML report {reportId}.");
}
public void Dispose()
{
_reader = null;
_ctx = null;
}
