44 "context"
55 "errors"
66 "fmt"
7+ "github.com/jfrog/gofrog/datastructures"
78 "os"
89 "os/exec"
910 "path/filepath"
@@ -53,13 +54,13 @@ func scanPullRequest(repoConfig *utils.Repository, client vcsclient.VcsClient) e
5354 }
5455
5556 // Audit PR code
56- vulnerabilitiesRows , err := auditPullRequest (repoConfig , client )
57+ vulnerabilitiesRows , iacRows , err := auditPullRequest (repoConfig , client )
5758 if err != nil {
5859 return err
5960 }
6061
6162 // Create a pull request message
62- message := createPullRequestMessage (vulnerabilitiesRows , repoConfig .OutputWriter )
63+ message := createPullRequestMessage (vulnerabilitiesRows , iacRows , repoConfig .OutputWriter )
6364
6465 // Add comment to the pull request
6566 if err = client .AddPullRequestComment (context .Background (), repoConfig .RepoOwner , repoConfig .RepoName , message , repoConfig .PullRequestID ); err != nil {
@@ -73,8 +74,9 @@ func scanPullRequest(repoConfig *utils.Repository, client vcsclient.VcsClient) e
7374 return err
7475}
7576
76- func auditPullRequest (repoConfig * utils.Repository , client vcsclient.VcsClient ) ([]formats.VulnerabilityOrViolationRow , error ) {
77+ func auditPullRequest (repoConfig * utils.Repository , client vcsclient.VcsClient ) ([]formats.VulnerabilityOrViolationRow , []formats. IacSecretsRow , error ) {
7778 var vulnerabilitiesRows []formats.VulnerabilityOrViolationRow
79+ var iacRows []formats.IacSecretsRow
7880 for i := range repoConfig .Projects {
7981 scanDetails := utils .NewScanDetails (client , & repoConfig .Server , & repoConfig .Git ).
8082 SetProject (& repoConfig .Projects [i ]).
@@ -84,32 +86,50 @@ func auditPullRequest(repoConfig *utils.Repository, client vcsclient.VcsClient)
8486 SetFixableOnly (repoConfig .FixableOnly )
8587 sourceResults , err := auditSource (scanDetails )
8688 if err != nil {
87- return nil , err
89+ return nil , nil , err
8890 }
8991 repoConfig .SetEntitledForJas (sourceResults .ExtendedScanResults .EntitledForJas )
9092 if repoConfig .IncludeAllVulnerabilities {
9193 log .Info ("Frogbot is configured to show all vulnerabilities" )
9294 allIssuesRows , err := getScanVulnerabilitiesRows (sourceResults )
9395 if err != nil {
94- return nil , err
96+ return nil , nil , err
9597 }
9698 vulnerabilitiesRows = append (vulnerabilitiesRows , allIssuesRows ... )
99+ iacRows = append (iacRows , xrayutils .PrepareIacs (sourceResults .ExtendedScanResults .IacScanResults )... )
97100 continue
98101 }
99102 // Audit target code
100103 scanDetails .SetFailOnInstallationErrors (* repoConfig .FailOnSecurityIssues ).SetBranch (repoConfig .Branches [0 ])
101104 targetResults , err := auditTarget (scanDetails )
102105 if err != nil {
103- return nil , err
106+ return nil , nil , err
104107 }
105108 newIssuesRows , err := createNewIssuesRows (targetResults , sourceResults )
106109 if err != nil {
107- return nil , err
110+ return nil , nil , err
108111 }
109112 vulnerabilitiesRows = append (vulnerabilitiesRows , newIssuesRows ... )
113+ iacRows = append (iacRows , createNewIacRows (targetResults .ExtendedScanResults .IacScanResults , sourceResults .ExtendedScanResults .IacScanResults )... )
110114 }
111115 log .Info ("Xray scan completed" )
112- return vulnerabilitiesRows , nil
116+ return vulnerabilitiesRows , iacRows , nil
117+ }
118+
119+ func createNewIacRows (targetIacResults , sourceIacResults []xrayutils.IacOrSecretResult ) []formats.IacSecretsRow {
120+ targetIacRows := xrayutils .PrepareIacs (targetIacResults )
121+ sourceIacRows := xrayutils .PrepareIacs (sourceIacResults )
122+ targetIacVulnerabilitiesKeys := datastructures .MakeSet [string ]()
123+ for _ , row := range targetIacRows {
124+ targetIacVulnerabilitiesKeys .Add (row .File + row .Text )
125+ }
126+ var addedIacVulnerabilities []formats.IacSecretsRow
127+ for _ , row := range sourceIacRows {
128+ if ! targetIacVulnerabilitiesKeys .Exists (row .File + row .Text ) {
129+ addedIacVulnerabilities = append (addedIacVulnerabilities , row )
130+ }
131+ }
132+ return addedIacVulnerabilities
113133}
114134
115135// Verify that the 'frogbot' GitHub environment was properly configured on the repository
@@ -339,9 +359,9 @@ func getUniqueID(vulnerability formats.VulnerabilityOrViolationRow) string {
339359 return vulnerability .ImpactedDependencyName + vulnerability .ImpactedDependencyVersion + vulnerability .IssueId
340360}
341361
342- func createPullRequestMessage (vulnerabilitiesRows []formats.VulnerabilityOrViolationRow , writer utils.OutputWriter ) string {
343- if len (vulnerabilitiesRows ) == 0 {
362+ func createPullRequestMessage (vulnerabilitiesRows []formats.VulnerabilityOrViolationRow , iacRows []formats. IacSecretsRow , writer utils.OutputWriter ) string {
363+ if len (vulnerabilitiesRows ) == 0 && len ( iacRows ) == 0 {
344364 return writer .NoVulnerabilitiesTitle () + utils .JasMsg (writer .EntitledForJas ()) + writer .Footer ()
345365 }
346- return writer .VulnerabiltiesTitle () + writer .Content (vulnerabilitiesRows ) + utils .JasMsg (writer .EntitledForJas ()) + writer .Footer ()
366+ return writer .VulnerabiltiesTitle (true ) + writer .VulnerabilitiesContent (vulnerabilitiesRows ) + writer . IacContent ( iacRows ) + utils .JasMsg (writer .EntitledForJas ()) + writer .Footer ()
347367}
0 commit comments