From df3a637b8027f0b7b1eb4ed5f44c546bea56ac5d Mon Sep 17 00:00:00 2001 From: as14692 Date: Sun, 5 May 2024 21:43:23 -0700 Subject: [PATCH] fix: Renaming test project manifest files to avoid security scanning Why: To prevent deprecated/vulnerable library dependencies in sample projects from being flagged during security scanning, as these sample projects are not intended for production use but needed to run integration tests. How: Renaming all manifest files (e.g., pom.xml, package.json, requirements.txt, Gemfile) to a placeholder name (_PLACEHOLDER) and renaming them back with the correct name during the integration test setup in a temp directory. --- Integration-Test.ps1 | 21 ++++++++++++++++--- Test.ps1 | 12 +++++++++++ integration-test.sh | 21 ++++++++++++++++--- ...ample.csproj => sample_csproj_PLACEHOLDER} | 0 .../compatible/{go.mod => go_mod_PLACEHOLDER} | 0 .../{go.mod => go_mod_PLACEHOLDER} | 0 .../{pom.xml => pom_xml_PLACEHOLDER} | 0 ...{package.json => package_json_PLACEHOLDER} | 0 ...ments.txt => requirements_txt_PLACEHOLDER} | 0 ...ments.txt => requirements_txt_PLACEHOLDER} | 0 .../{Gemfile => Gemfile_PLACEHOLDER} | 0 sample-projects/ruby-samples/sample.rb | 1 + unittest/test_manifester.py | 9 +------- 13 files changed, 50 insertions(+), 14 deletions(-) rename sample-projects/dotnet-samples/{sample.csproj => sample_csproj_PLACEHOLDER} (100%) rename sample-projects/go-samples/compatible/{go.mod => go_mod_PLACEHOLDER} (100%) rename sample-projects/go-samples/incompatible/{go.mod => go_mod_PLACEHOLDER} (100%) rename sample-projects/java-samples/{pom.xml => pom_xml_PLACEHOLDER} (100%) rename sample-projects/node-samples/{package.json => package_json_PLACEHOLDER} (100%) rename sample-projects/python-samples/compatible/{requirements.txt => requirements_txt_PLACEHOLDER} (100%) rename sample-projects/python-samples/incompatible/{requirements.txt => requirements_txt_PLACEHOLDER} (100%) rename sample-projects/ruby-samples/{Gemfile => Gemfile_PLACEHOLDER} (100%) create mode 100644 sample-projects/ruby-samples/sample.rb diff --git a/Integration-Test.ps1 b/Integration-Test.ps1 index 8e1d2fe..c35e1c0 100644 --- a/Integration-Test.ps1 +++ b/Integration-Test.ps1 @@ -35,12 +35,27 @@ $Lines_To_Find = @( "using dependency library github.com/golang/snappy version 0.0.1. upgrade to at least version 0.0.2" ) +Write-Host "Setting up sample-projects" +# Copy all sample projects to temp directory and rename project manifests to correct format. +# This is done to avoid security scanning them for deprecated/vulnerable library dependancies +# These sample projects are not intended to be used in production, but are used for testing +$random_number = Get-Random +Copy-Item -Path "./sample-projects" -Destination "./sample-projects/$random_number" -Recurse +Rename-Item -Path "./sample-projects/$random_number/dotnet-samples/sample_csproj_PLACEHOLDER" -NewName "sample.csproj" +Rename-Item -Path "./sample-projects/$random_number/go-samples/compatible/go_mod_PLACEHOLDER" -NewName "go.mod" +Rename-Item -Path "./sample-projects/$random_number/go-samples/incompatible/go_mod_PLACEHOLDER" -NewName "go.mod" +Rename-Item -Path "./sample-projects/$random_number/java-samples/pom_xml_PLACEHOLDER" -NewName "pom.xml" +Rename-Item -Path "./sample-projects/$random_number/node-samples/package_json_PLACEHOLDER" -NewName "package.json" +Rename-Item -Path "./sample-projects/$random_number/python-samples/compatible/requirements_txt_PLACEHOLDER" -NewName "requirements.txt" +Rename-Item -Path "./sample-projects/$random_number/python-samples/incompatible/requirements_txt_PLACEHOLDER" -NewName "requirements.txt" +Rename-Item -Path "./sample-projects/$random_number/ruby-samples/Gemfile_PLACEHOLDER" -NewName "Gemfile" + Write-Host "Running samples to console" -$ResultConsole = Invoke-Expression ".\dist\$Filename\$Filename.exe .\sample-projects" +$ResultConsole = Invoke-Expression ".\dist\$Filename\$Filename.exe .\sample-projects\$random_number" Test-Report "Console" $ResultConsole $Lines_To_Find Write-Host "Running samples to HTML report" -Invoke-Expression ".\dist\$Filename\$Filename.exe .\sample-projects --output test.html" +Invoke-Expression ".\dist\$Filename\$Filename.exe .\sample-projects\$random_number --output test.html" $ResultHtml = Get-Content -Path test.html Test-Report "HTML" $ResultHtml $Lines_To_Find Remove-Item -Path test.html @@ -86,7 +101,7 @@ $Dependencies = @( "httpclient" "jruby-openssl" ) -Invoke-Expression ".\dist\$Filename\$Filename.exe .\sample-projects --output test.xlsx --output-format dependencies" +Invoke-Expression ".\dist\$Filename\$Filename.exe .\sample-projects\$random_number --output test.xlsx --output-format dependencies" # xlsx files are compressed files, so we need to unzip them and then compare them Expand-Archive test.xlsx -DestinationPath temp $ResultXlsx = Get-Content ".\temp\xl\sharedStrings.xml" diff --git a/Test.ps1 b/Test.ps1 index e3f286c..0d7ef2f 100644 --- a/Test.ps1 +++ b/Test.ps1 @@ -9,6 +9,18 @@ if($LASTEXITCODE -ne 0) { throw "*ERROR**: failed to initialize Python Virtual Environment" } +# Rename all project manifests to correct format. +# This is done to avoid security scanning them for deprecated/vulnerable library dependencies +# These sample projects are not intended to be used in production, but are used for testing +Rename-Item -Path "./sample-projects/dotnet-samples/sample_csproj_PLACEHOLDER" -NewName "sample.csproj" +Rename-Item -Path "./sample-projects/go-samples/compatible/go_mod_PLACEHOLDER" -NewName "go.mod" +Rename-Item -Path "./sample-projects/go-samples/incompatible/go_mod_PLACEHOLDER" -NewName "go.mod" +Rename-Item -Path "./sample-projects/java-samples/pom_xml_PLACEHOLDER" -NewName "pom.xml" +Rename-Item -Path "./sample-projects/node-samples/package_json_PLACEHOLDER" -NewName "package.json" +Rename-Item -Path "./sample-projects/python-samples/compatible/requirements_txt_PLACEHOLDER" -NewName "requirements.txt" +Rename-Item -Path "./sample-projects/python-samples/incompatible/requirements_txt_PLACEHOLDER" -NewName "requirements.txt" +Rename-Item -Path "./sample-projects/ruby-samples/Gemfile_PLACEHOLDER" -NewName "Gemfile" + Write-Host "🔬 Running unit tests" .\Unit-Test.ps1 if($LASTEXITCODE -ne 0) { diff --git a/integration-test.sh b/integration-test.sh index a7e9be5..24e3c1f 100755 --- a/integration-test.sh +++ b/integration-test.sh @@ -5,14 +5,29 @@ source ./test-helpers.sh FILE_NAME=`./getBinaryName.sh` chmod +x ./dist/$FILE_NAME +echo "Setting up sample-projects" +# Copy all sample projects to temp directory and rename project manifests to correct format. +# This is done to avoid security scanning them for deprecated/vulnerable library dependancies +# These sample projects are not intended to be used in production, but are used for testing +random_number=$RANDOM +cp -r ./sample-projects ./sample-projects/$random_number +mv ./sample-projects/$random_number/dotnet-samples/sample_csproj_PLACEHOLDER ./sample-projects/$random_number/dotnet-samples/sample.csproj +mv ./sample-projects/$random_number/go-samples/compatible/go_mod_PLACEHOLDER ./sample-projects/$random_number/go-samples/compatible/go.mod +mv ./sample-projects/$random_number/go-samples/incompatible/go_mod_PLACEHOLDER ./sample-projects/$random_number/go-samples/incompatible/go.mod +mv ./sample-projects/$random_number/java-samples/pom_xml_PLACEHOLDER ./sample-projects/$random_number/java-samples/pom.xml +mv ./sample-projects/$random_number/node-samples/package_json_PLACEHOLDER ./sample-projects/$random_number/node-samples/package.json +mv ./sample-projects/$random_number/python-samples/compatible/requirements_txt_PLACEHOLDER ./sample-projects/$random_number/python-samples/compatible/requirements.txt +mv ./sample-projects/$random_number/python-samples/incompatible/requirements_txt_PLACEHOLDER ./sample-projects/$random_number/python-samples/incompatible/requirements.txt +mv ./sample-projects/$random_number/ruby-samples/Gemfile_PLACEHOLDER ./sample-projects/$random_number/ruby-samples/Gemfile + echo "Running samples to console" -./dist/$FILE_NAME ./sample-projects/ > console_test.txt +./dist/$FILE_NAME ./sample-projects/$random_number/ > console_test.txt test_report 'console' 'console_test.txt' "${lines_to_find[@]}" rm console_test.txt echo "Running samples to HTML report" -./dist/$FILE_NAME ./sample-projects/ --output test.html +./dist/$FILE_NAME ./sample-projects/$random_number/ --output test.html test_report 'html' 'test.html' "${lines_to_find[@]}" rm test.html @@ -57,7 +72,7 @@ declare -a dependencies=("componentversionhttpclient" "jruby-openssl" ) -./dist/$FILE_NAME ./sample-projects/ --output test.xlsx --output-format dependencies +./dist/$FILE_NAME ./sample-projects/$random_number/ --output test.xlsx --output-format dependencies # xlsx files are compressed files, so we need to unzip them and then compare them mkdir ./temp unzip -q ./test.xlsx -d ./temp diff --git a/sample-projects/dotnet-samples/sample.csproj b/sample-projects/dotnet-samples/sample_csproj_PLACEHOLDER similarity index 100% rename from sample-projects/dotnet-samples/sample.csproj rename to sample-projects/dotnet-samples/sample_csproj_PLACEHOLDER diff --git a/sample-projects/go-samples/compatible/go.mod b/sample-projects/go-samples/compatible/go_mod_PLACEHOLDER similarity index 100% rename from sample-projects/go-samples/compatible/go.mod rename to sample-projects/go-samples/compatible/go_mod_PLACEHOLDER diff --git a/sample-projects/go-samples/incompatible/go.mod b/sample-projects/go-samples/incompatible/go_mod_PLACEHOLDER similarity index 100% rename from sample-projects/go-samples/incompatible/go.mod rename to sample-projects/go-samples/incompatible/go_mod_PLACEHOLDER diff --git a/sample-projects/java-samples/pom.xml b/sample-projects/java-samples/pom_xml_PLACEHOLDER similarity index 100% rename from sample-projects/java-samples/pom.xml rename to sample-projects/java-samples/pom_xml_PLACEHOLDER diff --git a/sample-projects/node-samples/package.json b/sample-projects/node-samples/package_json_PLACEHOLDER similarity index 100% rename from sample-projects/node-samples/package.json rename to sample-projects/node-samples/package_json_PLACEHOLDER diff --git a/sample-projects/python-samples/compatible/requirements.txt b/sample-projects/python-samples/compatible/requirements_txt_PLACEHOLDER similarity index 100% rename from sample-projects/python-samples/compatible/requirements.txt rename to sample-projects/python-samples/compatible/requirements_txt_PLACEHOLDER diff --git a/sample-projects/python-samples/incompatible/requirements.txt b/sample-projects/python-samples/incompatible/requirements_txt_PLACEHOLDER similarity index 100% rename from sample-projects/python-samples/incompatible/requirements.txt rename to sample-projects/python-samples/incompatible/requirements_txt_PLACEHOLDER diff --git a/sample-projects/ruby-samples/Gemfile b/sample-projects/ruby-samples/Gemfile_PLACEHOLDER similarity index 100% rename from sample-projects/ruby-samples/Gemfile rename to sample-projects/ruby-samples/Gemfile_PLACEHOLDER diff --git a/sample-projects/ruby-samples/sample.rb b/sample-projects/ruby-samples/sample.rb new file mode 100644 index 0000000..b85a042 --- /dev/null +++ b/sample-projects/ruby-samples/sample.rb @@ -0,0 +1 @@ +puts "Hello World" diff --git a/unittest/test_manifester.py b/unittest/test_manifester.py index 3471fec..b4ebb86 100644 --- a/unittest/test_manifester.py +++ b/unittest/test_manifester.py @@ -148,11 +148,4 @@ def test_get_dependencies_for_ruby_returns_array_of_dependencies(self): self.assertEqual('6.1.6.1', dependencies[0].version) self.assertEqual('Gemfile', dependencies[0].filename) self.assertEqual('ruby', dependencies[0].tool) - - def test_scan_folder_returns_array_of_all_dependencies(self): - manifester = Manifester() - sample_path = path.abspath(path.join(path.dirname(__file__), '..', 'sample-projects')) - dependencies = manifester.scan_folder(sample_path) - self.assertGreater(len(dependencies), 0) - self.assertIsInstance(dependencies, list) - self.assertIsInstance(dependencies[0], Dependency) \ No newline at end of file + \ No newline at end of file