Пример #1
0
        private async Task RunAsync(Options options)
        {
            // select output destination and format
            SelectOutput(options.OutputFile);
            IOutputBuilder outputBuilder = SelectFormat(options.Format ?? OutputFormat.text.ToString());

            if (options.Targets is IList <string> targetList && targetList.Count > 0)
            {
                foreach (string?target in targetList)
                {
                    try
                    {
                        PackageURL?   purl          = new PackageURL(target);
                        HealthMetrics?healthMetrics = CheckHealth(purl).Result;
                        if (healthMetrics == null)
                        {
                            Logger.Debug($"Cannot compute Health for {purl}");
                        }
                        else
                        {
                            AppendOutput(outputBuilder, purl, healthMetrics);
                        }
                    }
                    catch (Exception ex)
                    {
                        Logger.Warn("Error processing {0}: {1}", target, ex.Message);
                    }
                }
                outputBuilder.PrintOutput();
            }
            RestoreOutput();
        }
Пример #2
0
        /// <summary>
        ///     Convert charactersticTool results into output format
        /// </summary>
        /// <param name="outputBuilder"> </param>
        /// <param name="purl"> </param>
        /// <param name="results"> </param>
        private void AppendOutput(IOutputBuilder outputBuilder, PackageURL purl, double riskLevel)
        {
            switch (currentOutputFormat)
            {
            case OutputFormat.sarifv1:
            case OutputFormat.sarifv2:
                outputBuilder.AppendOutput(GetSarifResults(purl, riskLevel));
                break;

            case OutputFormat.text:
            default:
                string?riskDescription = "low";
                if (riskLevel > 0.50)
                {
                    riskDescription = "medium";
                }
                if (riskLevel > 0.80)
                {
                    riskDescription = "high";
                }
                if (riskLevel > 0.90)
                {
                    riskDescription = "very high";
                }

                outputBuilder.AppendOutput(new string[] { $"Risk Level: {riskLevel:N2} ({riskDescription})" });
                break;
            }
        }
Пример #3
0
        private async Task RunAsync(Options options)
        {
            // select output destination and format
            SelectOutput(options.OutputFile);
            IOutputBuilder outputBuilder = SelectFormat(options.Format);

            if (options.Targets is IList <string> targetList && targetList.Count > 0)
            {
                foreach (var target in targetList)
                {
                    try
                    {
                        var purl    = new PackageURL(target);
                        var results = FindSource(purl).Result.ToList();
                        results.Sort((b, a) => a.Value.CompareTo(b.Value));
                        AppendOutput(outputBuilder, purl, results);
                    }
                    catch (Exception ex)
                    {
                        Logger.Warn("Error processing {0}: {1}", target, ex.Message);
                    }
                }
                outputBuilder.PrintOutput();
            }
            RestoreOutput();
        }
Пример #4
0
        public Game(int height, int width, int mines)
        {
            var BoardBuilder = Injector.StartUp.InjectionContainer.GetInstance <IBoardBuilder>();

            Board = BoardBuilder.Build(height, width, mines);

            Output = Injector.StartUp.InjectionContainer.GetInstance <IOutputBuilder>();
        }
Пример #5
0
 public bool TryGetOutputBuilder(string name, out IOutputBuilder outputBuilder)
 {
     if (string.IsNullOrWhiteSpace(name))
     {
         throw new ArgumentNullException(nameof(name));
     }
     return(_outputBuilders.TryGetValue(name, out outputBuilder));
 }
Пример #6
0
        public async Task Check_Sarif(string purl, string targetResult)
        {
            // for initialization
            FindSourceTool tool = new FindSourceTool();

            RepoSearch searchTool = new RepoSearch();
            var        results    = await searchTool.ResolvePackageLibraryAsync(new PackageURL(purl));

            List <Result> sarifResults = new List <Result>();

            foreach (var result in results)
            {
                var confidence = result.Value * 100.0;

                Result sarifResult = new Result()
                {
                    Message = new Message()
                    {
                        Text = $"https://github.com/{result.Key.Namespace}/{result.Key.Name}"
                    },
                    Kind      = ResultKind.Informational,
                    Level     = FailureLevel.None,
                    Rank      = confidence,
                    Locations = SarifOutputBuilder.BuildPurlLocation(new PackageURL(purl))
                };

                sarifResults.Add(sarifResult);
            }

            IOutputBuilder outputBuilder = OutputBuilderFactory.CreateOutputBuilder("sarifv2");

            outputBuilder.AppendOutput(sarifResults);
            string   sarifJSON = outputBuilder.GetOutput();
            SarifLog sarif     = JsonConvert.DeserializeObject <SarifLog>(sarifJSON);

            Assert.IsNotNull(sarif);

            var sarifRun = sarif.Runs.FirstOrDefault();

            Assert.IsNotNull(sarifRun?.Tool.Driver.Name);

            // make sure atleast one of the result repos match the actual one
            bool found = false;

            if (sarifRun != null)
            {
                foreach (var result in sarifRun.Results)
                {
                    if (result.Message.Text == targetResult)
                    {
                        found = true;
                    }
                }
            }
            Assert.IsTrue(found);
        }
        public IRule Build()
        {
            if (_successor == null)
            {
                _successor = new NullRule();
            }
            if (_outputBuilder == null)
            {
                _outputBuilder = new NullOutputBuilder();
            }

            return(CreateConcrete(_break, _successor, _outputBuilder));
        }
Пример #8
0
        /// <summary>
        ///     Convert findSourceTool results into output format
        /// </summary>
        /// <param name="outputBuilder"> </param>
        /// <param name="purl"> </param>
        /// <param name="results"> </param>
        private void AppendOutput(IOutputBuilder outputBuilder, PackageURL purl, List <KeyValuePair <PackageURL, double> > results)
        {
            switch (currentOutputFormat)
            {
            case OutputFormat.text:
            default:
                outputBuilder.AppendOutput(GetTextResults(results));
                break;

            case OutputFormat.sarifv1:
            case OutputFormat.sarifv2:
                outputBuilder.AppendOutput(GetSarifResults(purl, results));
                break;
            }
        }
Пример #9
0
        public static IRule Create(IOutputBuilder outputBuilder)
        {
            var by15RuleBuilder    = new DivisibleBy15RuleBuilder().RedirectResultTo(outputBuilder);
            var by3RuleBuilder     = new DivisibleBy3RuleBuilder().RedirectResultTo(outputBuilder);
            var by5RuleBuilder     = new DivisibleBy5RuleBuilder().RedirectResultTo(outputBuilder);
            var integerRuleBuilder = new IntegerRuleBuilder().RedirectResultTo(outputBuilder);
            var endOfChain         = new NullRule();

            integerRuleBuilder.ContinueWith(endOfChain);
            by5RuleBuilder.BreakIfApplied().ContinueWith(integerRuleBuilder.Build());
            by3RuleBuilder.BreakIfApplied().ContinueWith(by5RuleBuilder.Build());
            by15RuleBuilder.BreakIfApplied().ContinueWith(by3RuleBuilder.Build());

            return(by15RuleBuilder.Build());
        }
Пример #10
0
        /// <summary>
        ///     Convert charactersticTool results into output format
        /// </summary>
        /// <param name="outputBuilder"> </param>
        /// <param name="purl"> </param>
        /// <param name="results"> </param>
        private void AppendOutput(IOutputBuilder outputBuilder, PackageURL purl, Dictionary <string, AnalyzeResult?> analysisResults, Options opts)
        {
            switch (currentOutputFormat)
            {
            case OutputFormat.text:
            default:
                outputBuilder.AppendOutput(GetTextResults(purl, analysisResults));
                break;

            case OutputFormat.sarifv1:
            case OutputFormat.sarifv2:
                outputBuilder.AppendOutput(GetSarifResults(purl, analysisResults, opts));
                break;
            }
        }
Пример #11
0
        private void AppendOutput(IOutputBuilder outputBuilder, PackageURL purl, HealthMetrics healthMetrics)
        {
            switch (currentOutputFormat)
            {
            case OutputFormat.text:
            default:
                outputBuilder.AppendOutput(new List <string>()
                {
                    $"Health for {purl} (via {purl})",
                    healthMetrics.ToString()
                });
                break;

            case OutputFormat.sarifv1:
            case OutputFormat.sarifv2:
                outputBuilder.AppendOutput(healthMetrics.toSarif());
                break;
            }
        }
Пример #12
0
        private async Task RunAsync(Options options)
        {
            // select output destination and format
            SelectOutput(options.OutputFile);
            IOutputBuilder outputBuilder = SelectFormat(options.Format);

            // Support for --verbose
            if (options.Verbose)
            {
                NLog.Config.LoggingRule?consoleLog = LogManager.Configuration.FindRuleByName("consoleLog");
                consoleLog.SetLoggingLevels(LogLevel.Trace, LogLevel.Fatal);
            }

            if (options.Targets is IList <string> targetList && targetList.Count > 0)
            {
                foreach (string?target in targetList)
                {
                    try
                    {
                        bool       useCache          = options.UseCache == true;
                        PackageURL?purl              = new PackageURL(target);
                        string     downloadDirectory = options.DownloadDirectory == "." ? System.IO.Directory.GetCurrentDirectory() : options.DownloadDirectory;
                        double     riskLevel         = CalculateRisk(purl,
                                                                     downloadDirectory,
                                                                     useCache,
                                                                     !options.NoHealth).Result;
                        AppendOutput(outputBuilder, purl, riskLevel);
                    }
                    catch (Exception ex)
                    {
                        Logger.Warn("Error processing {0}: {1}", target, ex.Message);
                    }
                    outputBuilder.PrintOutput();
                }

                RestoreOutput();
            }
        }
Пример #13
0
        public Parser(
            string template,
            IParseProcessor parseProcessor,
            IOutputBuilder <T> outputBuilder)
        {
            DMP = new diff_match_patch()
            {
                Diff_Timeout = 0,
            };

            ParseProcessor = parseProcessor;
            OutputBuilder  = outputBuilder;

            TokenNames = new List <string>();

            Template = Regex.Replace(template, "{{(\\w*?)}}", m =>
            {
                TokenNames.Add(m.Groups[1].Value);
                return(TemplateToken);
            });

            Template = ParseProcessor.Preprocess(Template, TemplateToken);
        }
Пример #14
0
        public async Task <(string output, int numSquats)> RunAsync(Options options)
        {
            IOutputBuilder outputBuilder = SelectFormat(options.Format);
            var            foundSquats   = 0;

            foreach (var target in options.Targets ?? Array.Empty <string>())
            {
                var purl = new PackageURL(target);
                if (purl.Name is not null && purl.Type is not null)
                {
                    var manager = ProjectManagerFactory.CreateProjectManager(purl, null);
                    if (manager is not null)
                    {
                        var mutationsDict = gen.Mutate(purl.Name);

                        foreach ((var candidate, var rules) in mutationsDict)
                        {
                            if (options.SleepDelay > 0)
                            {
                                Thread.Sleep(options.SleepDelay);
                            }
                            // Nuget will match "microsoft.cst.oat." against "Microsoft.CST.OAT" but these are the same package
                            // For nuget in particular we filter out this case
                            if (manager is NuGetProjectManager)
                            {
                                if (candidate.EndsWith('.'))
                                {
                                    if (candidate.Equals($"{purl.Name}.", StringComparison.InvariantCultureIgnoreCase))
                                    {
                                        continue;
                                    }
                                }
                            }
                            var candidatePurl = new PackageURL(purl.Type, candidate);
                            try
                            {
                                var versions = await manager.EnumerateVersions(candidatePurl);

                                if (versions.Any())
                                {
                                    foundSquats++;
                                    if (!options.Quiet)
                                    {
                                        Logger.Info($"{candidate} package exists. Potential squat. {JsonConvert.SerializeObject(rules)}");
                                    }
                                    if (outputBuilder is SarifOutputBuilder sarob)
                                    {
                                        SarifResult sarifResult = new SarifResult()
                                        {
                                            Message = new Message()
                                            {
                                                Text = $"Potential Squat candidate { candidate }.",
                                                Id   = "oss-find-squats"
                                            },
                                            Kind      = ResultKind.Review,
                                            Level     = FailureLevel.None,
                                            Locations = SarifOutputBuilder.BuildPurlLocation(candidatePurl),
                                        };
                                        foreach (var tag in rules)
                                        {
                                            sarifResult.Tags.Add(tag);
                                        }
                                        sarob.AppendOutput(new SarifResult[] { sarifResult });
                                    }
                                    else if (outputBuilder is StringOutputBuilder strob)
                                    {
                                        var rulesString = string.Join(',', rules);
                                        strob.AppendOutput(new string[] { $"Potential Squat candidate '{ candidate }' detected. Generated by { rulesString }.{Environment.NewLine}" });
                                    }
                                    else
                                    {
                                        var rulesString = string.Join(',', rules);
                                        if (!options.Quiet)
                                        {
                                            Logger.Info($"Potential Squat candidate '{ candidate }' detected. Generated by { rulesString }.");
                                        }
                                    }
                                }
                            }
                            catch (Exception e)
                            {
                                Logger.Trace($"Could not enumerate versions. Package {candidate} likely doesn't exist. {e.Message}:{e.StackTrace}");
                            }
                        }
                    }
                }
            }

            return(outputBuilder.GetOutput(), foundSquats);
        }
Пример #15
0
        /// <summary>
        ///     Main entrypoint for the download program.
        /// </summary>
        /// <param name="args"> parameters passed in from the user </param>
        private static async Task Main(string[] args)
        {
            DetectCryptographyTool detectCryptographyTool = new DetectCryptographyTool();

            Logger.Info($"Microsoft OSS Gadget - {TOOL_NAME} {VERSION}");

            detectCryptographyTool.ParseOptions(args);

            // select output destination and format
            detectCryptographyTool.SelectOutput((string?)detectCryptographyTool.Options["output-file"] ?? "");
            IOutputBuilder outputBuilder = detectCryptographyTool.SelectFormat((string?)detectCryptographyTool.Options["format"] ?? "text");

            if (detectCryptographyTool.Options["target"] is IList <string> targetList && targetList.Count > 0)
            {
                var sb = new StringBuilder();
                foreach (var target in targetList)
                {
                    sb.Clear();
                    try
                    {
                        List <IssueRecord>?results = null;
                        if (target.StartsWith("pkg:", StringComparison.InvariantCulture))
                        {
                            var purl = new PackageURL(target);
                            results = await(detectCryptographyTool.AnalyzePackage(purl,
                                                                                  (string?)detectCryptographyTool.Options["download-directory"] ?? string.Empty,
                                                                                  (bool?)detectCryptographyTool.Options["use-cache"] == true) ??
                                            Task.FromResult(new List <IssueRecord>()));
                        }
                        else if (Directory.Exists(target))
                        {
                            results = await(detectCryptographyTool.AnalyzeDirectory(target) ??
                                            Task.FromResult(new List <IssueRecord>()));
                        }
                        else if (File.Exists(target))
                        {
                            string?targetDirectoryName = null;
                            while (targetDirectoryName == null || Directory.Exists(targetDirectoryName))
                            {
                                targetDirectoryName = Path.Combine(Path.GetTempPath(), Path.GetRandomFileName());
                            }
                            var projectManager = ProjectManagerFactory.CreateBaseProjectManager(targetDirectoryName);

#pragma warning disable SCS0018 // Path traversal: injection possible in {1} argument passed to '{0}'
                            var path = await projectManager.ExtractArchive("temp", File.ReadAllBytes(target));

#pragma warning restore SCS0018 // Path traversal: injection possible in {1} argument passed to '{0}'

                            results = await(detectCryptographyTool.AnalyzeDirectory(path) ??
                                            Task.FromResult(new List <IssueRecord>()));;

                            // Clean up after ourselves
                            try
                            {
                                if (targetDirectoryName != null)
                                {
                                    Directory.Delete(targetDirectoryName, true);
                                }
                            }
                            catch (Exception ex)
                            {
                                Logger.Warn("Unable to delete {0}: {1}", targetDirectoryName, ex.Message);
                            }
                        }

                        if (results == null)
                        {
                            Logger.Warn("Error generating results, was null.");
                        }
                        else if (!results.Any())
                        {
                            sb.AppendLine($"[ ] {target} - This software package does NOT appear to implement cryptography.");
                        }
                        else
                        {
                            var shortTags = results.SelectMany(r => r.Issue.Rule.Tags ?? Array.Empty <string>())
                                            .Distinct()
                                            .Where(t => t.StartsWith("Cryptography.Implementation."))
                                            .Select(t => t.Replace("Cryptography.Implementation.", ""));
                            var otherTags = results.SelectMany(r => r.Issue.Rule.Tags ?? Array.Empty <string>())
                                            .Distinct()
                                            .Where(t => !t.StartsWith("Cryptography.Implementation."));

                            if (shortTags.Any())
                            {
                                sb.AppendLine($"[X] {target} - This software package appears to implement {string.Join(", ", shortTags)}.");
                            }

                            if (otherTags.Contains("Cryptography.GenericImplementation.HighDensityOperators"))
                            {
                                sb.AppendLine($"[X] {target} - This software package has a high-density of cryptographic operators.");
                            }
                            else
                            {
                                sb.AppendLine($"[ ] {target} - This software package does NOT have a high-density of cryptographic operators.");
                            }

                            if (otherTags.Contains("Cryptography.GenericImplementation.CryptographicWords"))
                            {
                                sb.AppendLine($"[X] {target} - This software package contains words that suggest cryptography.");
                            }
                            else
                            {
                                sb.AppendLine($"[ ] {target} - This software package does NOT contains words that suggest cryptography.");
                            }

                            if ((bool?)detectCryptographyTool.Options["verbose"] == true)
                            {
                                var items = results.GroupBy(k => k.Issue.Rule.Name).OrderByDescending(k => k.Count());
                                foreach (var item in items)
                                {
                                    sb.AppendLine();
                                    sb.AppendLine($"There were {item.Count()} finding(s) of type [{item.Key}].");

                                    foreach (var result in results)
                                    {
                                        if (result.Issue.Rule.Name == item.Key)
                                        {
                                            sb.AppendLine($" {result.Filename}:");
                                            if (result.Issue.Rule.Id == "_CRYPTO_DENSITY")
                                            {
                                                // No excerpt for cryptogrpahic density
                                                // TODO: We stuffed the density in the unused 'Description' field. This is code smell.
                                                sb.AppendLine($"  | The maximum cryptographic density is {result.Issue.Rule.Description}.");
                                            }
                                            else
                                            {
                                                // Show the excerpt
                                                foreach (var line in result.TextSample.Split(new char[] { '\n', '\r' }))
                                                {
                                                    if (!string.IsNullOrWhiteSpace(line))
                                                    {
                                                        sb.AppendLine($"  | {line.Trim()}");
                                                    }
                                                }
                                            }
                                            sb.AppendLine();
                                        }
                                    }
                                }
                            }

                            if (Logger.IsDebugEnabled)
                            {
                                foreach (var result in results)
                                {
                                    Logger.Debug($"Result: {result.Filename} {result.Issue.Rule.Name} {result.TextSample}");
                                }
                            }
                        }
                        Console.WriteLine(sb.ToString());
                    }
                    catch (Exception ex)
                    {
                        Logger.Warn(ex, "Error processing {0}: {1}", target, ex.Message);
                        Logger.Warn(ex.StackTrace);
                    }
                }
            }
            else
            {
                Logger.Warn("No target provided; nothing to analyze.");
                DetectCryptographyTool.ShowUsage();
                Environment.Exit(1);
            }
        }
Пример #16
0
 public App(IOutputBuilder outputBuilder, ITestRngService testRng)
 {
     _outputBuilder = outputBuilder;
     _testRng       = testRng;
 }
Пример #17
0
 protected override void VisitOutput(IFragmentBuilder parent, IQueryGraphBuilder graph, IOutputBuilder expression)
 {
     throw new NotImplementedException();
 }
Пример #18
0
 protected override void VisitOutput(IFragmentBuilder parent, IQueryGraphBuilder graph, IOutputBuilder expression)
 {
     this.Push(new SQLiteSelectWriter(parent, graph, this.Database, this, this.Parameters));
     this.Peek.Write(expression);
     this.Pop();
 }
Пример #19
0
 protected override IRule CreateConcrete(bool breakable, IRule successor, IOutputBuilder outputBuilder)
 {
     return(new DivisibleBy3Rule(breakable, successor, outputBuilder));
 }
Пример #20
0
        /// <summary>
        /// Main entrypoint for the download program.
        /// </summary>
        /// <param name="args">parameters passed in from the user</param>
        private static async Task Main(string[] args)
        {
            ShowToolBanner();

            DetectCryptographyTool detectCryptographyTool = new DetectCryptographyTool();

            detectCryptographyTool.ParseOptions(args);

            // select output destination and format
            detectCryptographyTool.SelectOutput((string?)detectCryptographyTool.Options["output-file"] ?? "");
            IOutputBuilder outputBuilder = detectCryptographyTool.SelectFormat((string?)detectCryptographyTool.Options["format"] ?? "text");

            if (detectCryptographyTool.Options["target"] is IList <string> targetList && targetList.Count > 0)
            {
                StringBuilder?sb = new StringBuilder();
                foreach (string?target in targetList)
                {
                    sb.Clear();
                    try
                    {
                        List <IssueRecord>?results = null;
                        if (target.StartsWith("pkg:", StringComparison.InvariantCulture))
                        {
                            PackageURL?purl = new PackageURL(target);
                            results = await(detectCryptographyTool.AnalyzePackage(purl,
                                                                                  (string?)detectCryptographyTool.Options["download-directory"] ?? string.Empty,
                                                                                  (bool?)detectCryptographyTool.Options["use-cache"] == true) ??
                                            Task.FromResult(new List <IssueRecord>()));
                        }
                        else if (System.IO.Directory.Exists(target))
                        {
                            results = await(detectCryptographyTool.AnalyzeDirectory(target) ??
                                            Task.FromResult(new List <IssueRecord>()));
                        }
                        else if (File.Exists(target))
                        {
                            string?targetDirectoryName = null;
                            while (targetDirectoryName == null || System.IO.Directory.Exists(targetDirectoryName))
                            {
                                targetDirectoryName = Path.Combine(Path.GetTempPath(), Path.GetRandomFileName());
                            }

                            string?path = await ArchiveHelper.ExtractArchiveAsync(targetDirectoryName, Path.GetFileName(target), File.OpenRead(target));

                            results = await detectCryptographyTool.AnalyzeDirectory(path);

                            // Clean up after ourselves
                        }
                        else
                        {
                            Logger.Warn($"{target} was neither a Package URL, directory, nor a file.");
                            continue;
                        }

                        if (results == null)
                        {
                            Logger.Warn("No results were generated.");
                            continue;
                        }
                        else
                        {
                            sb.AppendLine("Summary Results:");

                            sb.AppendLine(Blue("Cryptographic Implementations:"));
                            IOrderedEnumerable <string>?implementations = results.SelectMany(r => r.Issue.Rule.Tags ?? Array.Empty <string>())
                                                                          .Distinct()
                                                                          .Where(t => t.StartsWith("Cryptography.Implementation."))
                                                                          .Select(t => t.Replace("Cryptography.Implementation.", ""))
                                                                          .OrderBy(s => s);
                            if (implementations.Any())
                            {
                                foreach (string?tag in implementations)
                                {
                                    sb.AppendLine(Bright.Blue($" * {tag}"));
                                }
                            }
                            else
                            {
                                sb.AppendLine(Bright.Black("  No implementations found."));
                            }

                            sb.AppendLine();
                            sb.AppendLine(Red("Cryptographic Library References:"));
                            IOrderedEnumerable <string>?references = results.SelectMany(r => r.Issue.Rule.Tags ?? Array.Empty <string>())
                                                                     .Distinct()
                                                                     .Where(t => t.StartsWith("Cryptography.Reference."))
                                                                     .Select(t => t.Replace("Cryptography.Reference.", ""))
                                                                     .OrderBy(s => s);

                            if (references.Any())
                            {
                                foreach (string?tag in references)
                                {
                                    sb.AppendLine(Bright.Red($" * {tag}"));
                                }
                            }
                            else
                            {
                                sb.AppendLine(Bright.Black("  No library references found."));
                            }

                            sb.AppendLine();
                            sb.AppendLine(Green("Other Cryptographic Characteristics:"));
                            IOrderedEnumerable <string>?characteristics = results.SelectMany(r => r.Issue.Rule.Tags ?? Array.Empty <string>())
                                                                          .Distinct()
                                                                          .Where(t => t.Contains("Crypto", StringComparison.InvariantCultureIgnoreCase) &&
                                                                                 !t.StartsWith("Cryptography.Implementation.") &&
                                                                                 !t.StartsWith("Cryptography.Reference."))
                                                                          .Select(t => t.Replace("Cryptography.", ""))
                                                                          .OrderBy(s => s);
                            if (characteristics.Any())
                            {
                                foreach (string?tag in characteristics)
                                {
                                    sb.AppendLine(Bright.Green($" * {tag}"));
                                }
                            }
                            else
                            {
                                sb.AppendLine(Bright.Black("  No additional characteristics found."));
                            }

                            if ((bool?)detectCryptographyTool.Options["verbose"] == true)
                            {
                                IOrderedEnumerable <IGrouping <string, IssueRecord> >?items = results.GroupBy(k => k.Issue.Rule.Name).OrderByDescending(k => k.Count());
                                foreach (IGrouping <string, IssueRecord>?item in items)
                                {
                                    sb.AppendLine();
                                    sb.AppendLine($"There were {item.Count()} finding(s) of type [{item.Key}].");

                                    foreach (IssueRecord?result in results)
                                    {
                                        if (result.Issue.Rule.Name == item.Key)
                                        {
                                            sb.AppendLine($" {result.Filename}:");
                                            if (result.Issue.Rule.Id == "_CRYPTO_DENSITY")
                                            {
                                                // No excerpt for cryptographic density
                                                // TODO: We stuffed the density in the unused 'Description' field. This is code smell.
                                                sb.AppendLine($"  | The maximum cryptographic density is {result.Issue.Rule.Description}.");
                                            }
                                            else
                                            {
                                                // Show the excerpt
                                                foreach (string?line in result.TextSample.Split(new char[] { '\n', '\r' }))
                                                {
                                                    if (!string.IsNullOrWhiteSpace(line))
                                                    {
                                                        sb.AppendLine($"  | {line.Trim()}");
                                                    }
                                                }
                                            }
                                            sb.AppendLine();
                                        }
                                    }
                                }
                            }

                            if (Logger.IsDebugEnabled)
                            {
                                foreach (IssueRecord?result in results)
                                {
                                    Logger.Debug($"Result: {result.Filename} {result.Issue.Rule.Name} {result.TextSample}");
                                }
                            }
                        }
                        Console.WriteLine(sb.ToString());
                    }
                    catch (Exception ex)
                    {
                        Logger.Warn(ex, "Error processing {0}: {1}", target, ex.Message);
                        Logger.Warn(ex.StackTrace);
                    }
                }
            }
            else
            {
                Logger.Warn("No target provided; nothing to analyze.");
                DetectCryptographyTool.ShowUsage();
                Environment.Exit(1);
            }
        }
Пример #21
0
 protected override void VisitOutput(IFragmentBuilder parent, IQueryGraphBuilder graph, IOutputBuilder expression)
 {
     //Nothing to do.
 }
 public DivisibleBy5Rule(bool breakable, IRule successor, IOutputBuilder outputBuilder)
     : base(breakable, successor)
 {
     _outputBuilder = outputBuilder;
 }
Пример #23
0
        protected override void VisitOutput(IFragmentBuilder parent, IQueryGraphBuilder graph, IOutputBuilder expression)
        {
            var sequence = GetExpressions(expression).ToArray();

            foreach (var element in sequence)
            {
                expression.Expressions.Remove(element);
                expression.AddCase(
                    expression.CreateCaseCondition(
                        element, expression.CreateConstant(1)
                        ),
                    expression.CreateCaseCondition(expression.CreateConstant(0))
                    ).Alias = element.Alias;
            }
        }
 public IRuleBuilder RedirectResultTo(IOutputBuilder outputBuilder)
 {
     _outputBuilder = outputBuilder;
     return(this);
 }
Пример #25
0
        public async Task <List <Dictionary <string, AnalyzeResult?> > > RunAsync(Options options)
        {
            // select output destination and format
            SelectOutput(options.OutputFile);
            IOutputBuilder outputBuilder = SelectFormat(options.Format);

            List <Dictionary <string, AnalyzeResult?> >?finalResults = new List <Dictionary <string, AnalyzeResult?> >();

            if (options.Targets is IList <string> targetList && targetList.Count > 0)
            {
                foreach (string?target in targetList)
                {
                    try
                    {
                        if (target.StartsWith("pkg:"))
                        {
                            PackageURL?purl = new PackageURL(target);
                            string     downloadDirectory = options.DownloadDirectory == "." ? System.IO.Directory.GetCurrentDirectory() : options.DownloadDirectory;
                            Dictionary <string, AnalyzeResult?>?analysisResult = await AnalyzePackage(options, purl,
                                                                                                      downloadDirectory,
                                                                                                      options.UseCache == true);

                            AppendOutput(outputBuilder, purl, analysisResult, options);
                            finalResults.Add(analysisResult);
                        }
                        else if (System.IO.Directory.Exists(target))
                        {
                            AnalyzeResult?analysisResult = await AnalyzeDirectory(options, target);

                            if (analysisResult != null)
                            {
                                Dictionary <string, AnalyzeResult?>?analysisResults = new Dictionary <string, AnalyzeResult?>()
                                {
                                    { target, analysisResult }
                                };
                                PackageURL?purl = new PackageURL("generic", target);
                                AppendOutput(outputBuilder, purl, analysisResults, options);
                            }
                            finalResults.Add(new Dictionary <string, AnalyzeResult?>()
                            {
                                { target, analysisResult }
                            });
                        }
                        else if (File.Exists(target))
                        {
                            AnalyzeResult?analysisResult = await AnalyzeFile(options, target);

                            if (analysisResult != null)
                            {
                                Dictionary <string, AnalyzeResult?>?analysisResults = new Dictionary <string, AnalyzeResult?>()
                                {
                                    { target, analysisResult }
                                };
                                PackageURL?purl = new PackageURL("generic", target);
                                AppendOutput(outputBuilder, purl, analysisResults, options);
                            }
                            finalResults.Add(new Dictionary <string, AnalyzeResult?>()
                            {
                                { target, analysisResult }
                            });
                        }
                        else
                        {
                            Logger.Warn("Package or file identifier was invalid.");
                        }
                    }
                    catch (Exception ex)
                    {
                        Logger.Warn(ex, "Error processing {0}: {1}", target, ex.Message);
                    }
                }
                outputBuilder.PrintOutput();
            }

            RestoreOutput();
            return(finalResults);
        }
Пример #26
0
 public IntegerRule(bool breakable, IRule successor, IOutputBuilder outputBuilder)
     : base(breakable, successor)
 {
     _outputBuilder = outputBuilder;
 }
 protected abstract IRule CreateConcrete(bool breakable, IRule successor, IOutputBuilder outputBuilder);
Пример #28
0
 protected abstract void VisitOutput(IFragmentBuilder parent, IQueryGraphBuilder graph, IOutputBuilder expression);