Skip to content

Add matched-finding id to cascading scan annotations #514

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rfelber merged 5 commits into from
Jul 3, 2021
Merged

Add matched-finding id to cascading scan annotations #514

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
41e9989
Cascading Scans: update getCascadingScanDefinition argument list to b…
EndPositive Jun 22, 2021
7aac0aa
Cascading Scans: add finding ID to cascadedScan
EndPositive Jun 22, 2021
b1a2f6d
Cascading Scans: add finding ID test
EndPositive Jun 22, 2021
f1c3d9b
Merge branch 'secureCodeBox:main' into cascading-scan-finding-id
EndPositive Jun 30, 2021
896e6e5
Merge branch 'main' into cascading-scan-finding-id
rfelber Jul 3, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
261 changes: 166 additions & 95 deletions hooks/cascading-scans/hook.test.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,8 +80,18 @@ test("Should create subsequent scans for open HTTPS ports (NMAP findings)", () =
expect(cascadedScans).toMatchInlineSnapshot(`
Array [
Object {
"cascades": null,
"cascades": Object {},
"env": undefined,
"finding": Object {
"attributes": Object {
"hostname": "foobar.com",
"port": 443,
"service": "https",
"state": "open",
},
"category": "Open Port",
"name": "Port 443 is open",
},
"generatedBy": "tls-scans",
"name": "sslyze-foobar.com-tls-scans",
"parameters": Array [
Expand Down Expand Up @@ -143,8 +153,19 @@ test("Should not try to do magic to the scan name if its something random", () =
expect(cascadedScans).toMatchInlineSnapshot(`
Array [
Object {
"cascades": null,
"cascades": Object {},
"env": undefined,
"finding": Object {
"attributes": Object {
"hostname": undefined,
"ip_address": "10.42.42.42",
"port": 443,
"service": "https",
"state": "open",
},
"category": "Open Port",
"name": "Port 443 is open",
},
"generatedBy": "tls-scans",
"name": "foobar.com-tls-scans",
"parameters": Array [
Expand Down Expand Up @@ -210,8 +231,18 @@ test("Should not crash when the annotations are not set", () => {
expect(cascadedScans).toMatchInlineSnapshot(`
Array [
Object {
"cascades": null,
"cascades": Object {},
"env": undefined,
"finding": Object {
"attributes": Object {
"hostname": "foobar.com",
"port": 443,
"service": "https",
"state": "open",
},
"category": "Open Port",
"name": "Port 443 is open",
},
"generatedBy": "tls-scans",
"name": "sslyze-foobar.com-tls-scans",
"parameters": Array [
Expand Down Expand Up @@ -256,7 +287,7 @@ test("Should copy ENV fields from cascadingRule to created scan", () => {
expect(cascadedScans).toMatchInlineSnapshot(`
Array [
Object {
"cascades": null,
"cascades": Object {},
"env": Array [
Object {
"name": "FOOBAR",
Expand All @@ -268,6 +299,16 @@ test("Should copy ENV fields from cascadingRule to created scan", () => {
},
},
],
"finding": Object {
"attributes": Object {
"hostname": "foobar.com",
"port": 443,
"service": "https",
"state": "open",
},
"category": "Open Port",
"name": "Port 443 is open",
},
"generatedBy": "tls-scans",
"name": "sslyze-foobar.com-tls-scans",
"parameters": Array [
Expand Down Expand Up @@ -332,8 +373,18 @@ test("Should allow wildcards in cascadingRules", () => {
expect(cascadedScans).toMatchInlineSnapshot(`
Array [
Object {
"cascades": null,
"cascades": Object {},
"env": undefined,
"finding": Object {
"attributes": Object {
"hostname": "foobar.com",
"port": 8443,
"service": "https-alt",
"state": "open",
},
"category": "Open Port",
"name": "Port 8443 is open",
},
"generatedBy": "tls-scans",
"name": "sslyze-foobar.com-tls-scans",
"parameters": Array [
Expand Down Expand Up @@ -375,17 +426,8 @@ test("should not copy labels if inheritLabels is set to false", () => {
sslyzeCascadingRules
);

for (const { name, scanType, parameters, generatedBy, env, scanLabels, scanAnnotations } of cascadedScans) {
const cascadingScanDefinition = getCascadingScanDefinition({
name,
parentScan: parentScan,
generatedBy,
scanType,
parameters,
env,
scanLabels,
scanAnnotations
});
for (const cascadedScan of cascadedScans) {
const cascadingScanDefinition = getCascadingScanDefinition(cascadedScan, parentScan);

expect(Object.entries(parentScan.metadata.labels).every(([label, value]) =>
cascadingScanDefinition.metadata.labels[label] === value
Expand Down Expand Up @@ -419,17 +461,8 @@ test("should copy labels if inheritLabels is not set", () => {
sslyzeCascadingRules
);

for (const { name, scanType, parameters, generatedBy, env, scanLabels, scanAnnotations } of cascadedScans) {
const cascadingScanDefinition = getCascadingScanDefinition({
name,
parentScan: parentScan,
generatedBy,
scanType,
parameters,
env,
scanLabels,
scanAnnotations
});
for (const cascadedScan of cascadedScans) {
const cascadingScanDefinition = getCascadingScanDefinition(cascadedScan, parentScan);

expect(Object.entries(parentScan.metadata.labels).every(([label, value]) =>
cascadingScanDefinition.metadata.labels[label] === value
Expand Down Expand Up @@ -465,17 +498,8 @@ test("should copy labels if inheritLabels is set to true", () => {
sslyzeCascadingRules
);

for (const { name, scanType, parameters, generatedBy, env, scanLabels, scanAnnotations } of cascadedScans) {
const cascadingScanDefinition = getCascadingScanDefinition({
name,
parentScan: parentScan,
generatedBy,
scanType,
parameters,
env,
scanLabels,
scanAnnotations
});
for (const cascadedScan of cascadedScans) {
const cascadingScanDefinition = getCascadingScanDefinition(cascadedScan, parentScan);

expect(Object.entries(parentScan.metadata.labels).every(([label, value]) =>
cascadingScanDefinition.metadata.labels[label] === value
Expand Down Expand Up @@ -509,17 +533,8 @@ test("should not copy annotations if inheritAnnotations is set to false", () =>
sslyzeCascadingRules
);

for (const { name, scanType, parameters, generatedBy, env, scanLabels, scanAnnotations } of cascadedScans) {
const cascadingScanDefinition = getCascadingScanDefinition({
name,
parentScan: parentScan,
generatedBy,
scanType,
parameters,
env,
scanLabels,
scanAnnotations
});
for (const cascadedScan of cascadedScans) {
const cascadingScanDefinition = getCascadingScanDefinition(cascadedScan, parentScan);

expect(Object.entries(parentScan.metadata.annotations).every(([label, value]) =>
cascadingScanDefinition.metadata.annotations[label] === value
Expand Down Expand Up @@ -552,17 +567,8 @@ test("should copy annotations if inheritAnnotations is not set", () => {
sslyzeCascadingRules
);

for (const { name, scanType, parameters, generatedBy, env, scanLabels, scanAnnotations } of cascadedScans) {
const cascadingScanDefinition = getCascadingScanDefinition({
name,
parentScan: parentScan,
generatedBy,
scanType,
parameters,
env,
scanLabels,
scanAnnotations
});
for (const cascadedScan of cascadedScans) {
const cascadingScanDefinition = getCascadingScanDefinition(cascadedScan, parentScan);

expect(Object.entries(parentScan.metadata.annotations).every(([label, value]) =>
cascadingScanDefinition.metadata.annotations[label] === value
Expand Down Expand Up @@ -596,17 +602,8 @@ test("should copy annotations if inheritAnnotations is set to true", () => {
sslyzeCascadingRules
);

for (const { name, scanType, parameters, generatedBy, env, scanLabels, scanAnnotations } of cascadedScans) {
const cascadingScanDefinition = getCascadingScanDefinition({
name,
parentScan: parentScan,
generatedBy,
scanType,
parameters,
env,
scanLabels,
scanAnnotations
});
for (const cascadedScan of cascadedScans) {
const cascadingScanDefinition = getCascadingScanDefinition(cascadedScan, parentScan);

expect(Object.entries(parentScan.metadata.annotations).every(([label, value]) =>
cascadingScanDefinition.metadata.annotations[label] === value
Expand Down Expand Up @@ -639,13 +636,23 @@ test("should copy scanLabels from CascadingRule to cascading scan", () => {
sslyzeCascadingRules
);

const { name, scanType, parameters, generatedBy, env, scanLabels, scanAnnotations } = cascadedScans[0]
const cascadedScan = cascadedScans[0]

expect(cascadedScans).toMatchInlineSnapshot(`
Array [
Object {
"cascades": null,
"cascades": Object {},
"env": undefined,
"finding": Object {
"attributes": Object {
"hostname": "foobar.com",
"port": 443,
"service": "https",
"state": "open",
},
"category": "Open Port",
"name": "Port 443 is open",
},
"generatedBy": "tls-scans",
"name": "sslyze-foobar.com-tls-scans",
"parameters": Array [
Expand All @@ -662,16 +669,7 @@ test("should copy scanLabels from CascadingRule to cascading scan", () => {
]
`);

const cascadingScanDefinition = getCascadingScanDefinition({
name,
parentScan: parentScan,
generatedBy,
scanType,
parameters,
env,
scanLabels,
scanAnnotations
});
const cascadingScanDefinition = getCascadingScanDefinition(cascadedScan, parentScan);

expect(Object.entries(sslyzeCascadingRules[0].spec.scanLabels).every(([label, value]) =>
cascadingScanDefinition.metadata.labels[label] === value
Expand Down Expand Up @@ -703,13 +701,23 @@ test("should copy scanAnnotations from CascadingRule to cascading scan", () => {
sslyzeCascadingRules
);

const { name, scanType, parameters, generatedBy, env, scanLabels, scanAnnotations } = cascadedScans[0]
const cascadedScan = cascadedScans[0]

expect(cascadedScans).toMatchInlineSnapshot(`
Array [
Object {
"cascades": null,
"cascades": Object {},
"env": undefined,
"finding": Object {
"attributes": Object {
"hostname": "foobar.com",
"port": 443,
"service": "https",
"state": "open",
},
"category": "Open Port",
"name": "Port 443 is open",
},
"generatedBy": "tls-scans",
"name": "sslyze-foobar.com-tls-scans",
"parameters": Array [
Expand All @@ -726,16 +734,7 @@ test("should copy scanAnnotations from CascadingRule to cascading scan", () => {
]
`);

const cascadingScanDefinition = getCascadingScanDefinition({
name,
parentScan: parentScan,
generatedBy,
scanType,
parameters,
env,
scanLabels,
scanAnnotations
});
const cascadingScanDefinition = getCascadingScanDefinition(cascadedScan, parentScan);

expect(Object.entries(sslyzeCascadingRules[0].spec.scanAnnotations).every(([label, value]) =>
cascadingScanDefinition.metadata.annotations[label] === value
Expand Down Expand Up @@ -788,3 +787,75 @@ test("should properly parse template values in scanLabels and scanAnnotations",
expect(scanAnnotations).toEqual(result)
})

test("should copy proper finding ID into annotations", () => {
const findings = [
{
name: "Port 12345 is open",
category: "Open Port",
attributes: {
state: "open",
hostname: "foobar.com",
port: 12345,
service: "unknown"
},
id: "random-id"
},
{
name: "Port 443 is open",
category: "Open Port",
attributes: {
state: "open",
hostname: "foobar.com",
port: 443,
service: "https"
},
id: "f0c718bd-9987-42c8-2259-73794e61dd5a"
}
];

const cascadedScans = getCascadingScans(
parentScan,
findings,
sslyzeCascadingRules
);

const cascadedScan = cascadedScans[0]

expect(cascadedScans).toMatchInlineSnapshot(`
Array [
Object {
"cascades": Object {},
"env": undefined,
"finding": Object {
"attributes": Object {
"hostname": "foobar.com",
"port": 443,
"service": "https",
"state": "open",
},
"category": "Open Port",
"id": "f0c718bd-9987-42c8-2259-73794e61dd5a",
"name": "Port 443 is open",
},
"generatedBy": "tls-scans",
"name": "sslyze-foobar.com-tls-scans",
"parameters": Array [
"--regular",
"foobar.com:443",
],
"scanAnnotations": Object {},
"scanLabels": Object {},
"scanType": "sslyze",
},
]
`);

const cascadingScanDefinition = getCascadingScanDefinition(cascadedScan, parentScan);

expect(Object.entries(cascadingScanDefinition.metadata.annotations).every(([label, value]) => {
if (label === "cascading.securecodebox.io/matched-finding") {
return value === "f0c718bd-9987-42c8-2259-73794e61dd5a";
} else return true;
}
)).toBe(true)
});
Loading