Skip to content

Commit 14d5b26

Browse files
tsuneztsunez
authored
Resolving vulnerabilities detected by Checkmarx: (#195)
* Resolving vulnerabilities detected by Checkmarx: * Denial_Of_Service_Resource_Exhaustion in configuration.go line 123 * SSRF in client.go line 221 * Vulnerability configuration.go * Golang lint fixes.
1 parent 65c4a5b commit 14d5b26

File tree

7 files changed

+36
-54
lines changed

7 files changed

+36
-54
lines changed

‎.circleci/config.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -197,7 +197,7 @@ jobs:
197197
name: Publish GitHub release
198198
command: |
199199
VERSION=$(./bin/cx version)
200-
VERSION="2.0.0_RC7"
200+
VERSION="2.0.0_RC8"
201201
ghr -t ${GITHUB_TOKEN} -u ${CIRCLE_PROJECT_USERNAME} -r ${CIRCLE_PROJECT_REPONAME} -c ${CIRCLE_SHA1} -delete ${VERSION} ./bin/
202202
- save_cache: # Store cache in the /go/pkg directory
203203
key: go-mod-v1-{{ checksum "go.sum" }}

‎internal/commands/configuration.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ func NewConfigCommand() *cobra.Command {
3030

3131
setCmd := &cobra.Command{
3232
Use: "set",
33-
Short: "Sets one of the configuration properties (cx_apikey, cx_base_uri, cx_base_auth_uri cx_ast_client_id, cx_ast_client_secret, cx_http_proxy)",
33+
Short: "Set configuration property (cx_apikey, cx_base_uri, cx_base_auth_uri cx_ast_client_id, cx_ast_client_secret, cx_http_proxy)",
3434
RunE: runSetValue(),
3535
}
3636
scanCmd.AddCommand(storValCmd, setCmd)

‎internal/commands/root.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -126,8 +126,8 @@ func NewAstCLI(
126126
scanCmd := NewScanCommand(scansWrapper, uploadsWrapper)
127127
projectCmd := NewProjectCommand(projectsWrapper)
128128
resultCmd := NewResultCommand(resultsWrapper)
129-
// Disable BFL until results are ready in AST.
130-
//bflCmd := NewBFLCommand(bflWrapper)
129+
// Disable BFL until ready in AST.
130+
// bflCmd := NewBFLCommand(bflWrapper)
131131
versionCmd := NewVersionCommand()
132132
authCmd := NewAuthCommand(authWrapper)
133133
utilsCmd := NewUtilsCommand(healthCheckWrapper, ssiWrapper, rmWrapper, logsWrapper, queriesWrapper, uploadsWrapper)
@@ -137,7 +137,7 @@ func NewAstCLI(
137137
projectCmd,
138138
resultCmd,
139139
versionCmd,
140-
//bflCmd,
140+
// bflCmd,
141141
authCmd,
142142
utilsCmd,
143143
configCmd,

‎internal/commands/utils.go

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package commands
22

33
import (
4+
"log"
45
"os"
56

67
"github.com/checkmarxDev/ast-cli/internal/wrappers"
@@ -23,9 +24,7 @@ func NewUtilsCommand(healthCheckWrapper wrappers.HealthCheckWrapper,
2324
rmCmd := NewSastResourcesCommand(rmWrapper)
2425
queriesCmd := NewQueryCommand(queriesWrapper, uploadsWrapper)
2526
logsCmd := NewLogsCommand(logsWrapper)
26-
//
27-
/// Complete command
28-
//
27+
2928
var completionCmd = &cobra.Command{
3029
Use: "completion [bash|zsh|fish|powershell]",
3130
Short: "Generate completion script",
@@ -72,15 +71,19 @@ func NewUtilsCommand(healthCheckWrapper wrappers.HealthCheckWrapper,
7271
ValidArgs: []string{"bash", "zsh", "fish", "powershell"},
7372
Args: cobra.ExactValidArgs(1),
7473
Run: func(cmd *cobra.Command, args []string) {
74+
var err error
7575
switch args[0] {
7676
case "bash":
77-
cmd.Root().GenBashCompletion(os.Stdout)
77+
err = cmd.Root().GenBashCompletion(os.Stdout)
7878
case "zsh":
79-
cmd.Root().GenZshCompletion(os.Stdout)
79+
err = cmd.Root().GenZshCompletion(os.Stdout)
8080
case "fish":
81-
cmd.Root().GenFishCompletion(os.Stdout, true)
81+
err = cmd.Root().GenFishCompletion(os.Stdout, true)
8282
case "powershell":
83-
cmd.Root().GenPowerShellCompletion(os.Stdout)
83+
err = cmd.Root().GenPowerShellCompletion(os.Stdout)
84+
}
85+
if err != nil {
86+
log.Fatal(err)
8487
}
8588
},
8689
}

‎internal/params/flags.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,5 +37,5 @@ const (
3737
)
3838

3939
const (
40-
Version = "2.0.0_RC7"
40+
Version = "2.0.0_RC8"
4141
)

‎internal/wrappers/client.go

Lines changed: 14 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ import (
44
"crypto/tls"
55
"encoding/json"
66
"fmt"
7-
"hash/fnv"
87
"io"
98
"io/ioutil"
109
"net/http"
@@ -41,8 +40,6 @@ type ClientCredentialsError struct {
4140
Description string `json:"error_description"`
4241
}
4342

44-
type credentialsCache map[uint64]*string
45-
4643
const failedToAuth = "Failed to authenticate - please provide an %s"
4744

4845
var usingProxyMsgDisplayed = false
@@ -84,7 +81,7 @@ func SendHTTPRequestByFullURL(method, fullURL string, body io.Reader, auth bool,
8481
return nil, err
8582
}
8683
if auth {
87-
req, err = enrichWithOath2Credentials(req)
84+
err = enrichWithOath2Credentials(req)
8885
if err != nil {
8986
return nil, err
9087
}
@@ -107,7 +104,7 @@ func SendHTTPRequestPasswordAuth(method, path string, body io.Reader, timeout ui
107104
return nil, err
108105
}
109106
req.Header.Add("content-type", "application/json")
110-
req, err = enrichWithPasswordCredentials(req, username, password, adminClientID, adminClientSecret)
107+
err = enrichWithPasswordCredentials(req, username, password, adminClientID, adminClientSecret)
111108
if err != nil {
112109
return nil, err
113110
}
@@ -146,7 +143,7 @@ func SendHTTPRequestWithQueryParams(method, path string, params map[string]strin
146143
q.Add(k, v)
147144
}
148145
req.URL.RawQuery = q.Encode()
149-
req, err = enrichWithOath2Credentials(req)
146+
err = enrichWithOath2Credentials(req)
150147
if err != nil {
151148
return nil, err
152149
}
@@ -160,7 +157,6 @@ func SendHTTPRequestWithQueryParams(method, path string, params map[string]strin
160157

161158
func getAuthURI() (string, error) {
162159
authPath := viper.GetString(commonParams.AstAuthenticationPathConfigKey)
163-
// authPath := "CX_AST_AUTHENTICATION_PATH"
164160
if authPath == "" {
165161
return "", errors.Errorf(fmt.Sprintf(failedToAuth, "authentication path"))
166162
}
@@ -178,49 +174,49 @@ func getAuthURI() (string, error) {
178174
return authURI, nil
179175
}
180176

181-
func enrichWithOath2Credentials(request *http.Request) (*http.Request, error) {
177+
func enrichWithOath2Credentials(request *http.Request) error {
182178
authURI, err := getAuthURI()
183179
if err != nil {
184-
return nil, err
180+
return err
185181
}
186182

187183
accessKeyID := viper.GetString(commonParams.AccessKeyIDConfigKey)
188184
accessKeySecret := viper.GetString(commonParams.AccessKeySecretConfigKey)
189185
astAPIKey := viper.GetString(commonParams.AstAPIKey)
190186

191187
if accessKeyID == "" && astAPIKey == "" {
192-
return nil, errors.Errorf(fmt.Sprintf(failedToAuth, "access key ID"))
188+
return errors.Errorf(fmt.Sprintf(failedToAuth, "access key ID"))
193189
} else if accessKeySecret == "" && astAPIKey == "" {
194-
return nil, errors.Errorf(fmt.Sprintf(failedToAuth, "access key secret"))
190+
return errors.Errorf(fmt.Sprintf(failedToAuth, "access key secret"))
195191
} else if astAPIKey == "" && accessKeyID == "" && accessKeySecret == "" {
196192
fmt.Println("API Key not found!")
197-
return nil, errors.Errorf(fmt.Sprintf(failedToAuth, "access API Key"))
193+
return errors.Errorf(fmt.Sprintf(failedToAuth, "access API Key"))
198194
}
199195

200196
accessToken, err := getClientCredentials(accessKeyID, accessKeySecret, astAPIKey, authURI)
201197
if err != nil {
202-
return nil, errors.Wrap(err, "failed to authenticate")
198+
return errors.Wrap(err, "failed to authenticate")
203199
}
204200

205201
request.Header.Add("Authorization", *accessToken)
206-
return request, nil
202+
return nil
207203
}
208204

209205
func enrichWithPasswordCredentials(request *http.Request, username, password,
210-
adminClientID, adminClientSecret string) (*http.Request, error) {
206+
adminClientID, adminClientSecret string) error {
211207
authURI, err := getAuthURI()
212208
if err != nil {
213-
return nil, err
209+
return err
214210
}
215211

216212
accessToken, err := getNewToken(getPasswordCredentialsPayload(username, password, adminClientID, adminClientSecret), authURI)
217213
if err != nil {
218-
return nil, errors.Wrap(errors.Wrap(err, "failed to get access token from auth server"),
214+
return errors.Wrap(errors.Wrap(err, "failed to get access token from auth server"),
219215
"failed to authenticate")
220216
}
221217

222218
request.Header.Add("Authorization", "Bearer "+*accessToken)
223-
return request, nil
219+
return nil
224220
}
225221

226222
func getClientCredentials(accessKeyID, accessKeySecret, astAPKey, authURI string) (*string, error) {
@@ -305,9 +301,3 @@ func getPasswordCredentialsPayload(username, password, adminClientID, adminClien
305301
return fmt.Sprintf("scope=openid&grant_type=password&username=%s&password=%s"+
306302
"&client_id=%s&client_secret=%s", username, password, adminClientID, adminClientSecret)
307303
}
308-
309-
func hash(s string) (uint64, error) {
310-
h := fnv.New64()
311-
_, err := h.Write([]byte(s))
312-
return h.Sum64(), err
313-
}

‎internal/wrappers/configuration.go

Lines changed: 6 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package wrappers
22

33
import (
44
"bufio"
5+
"flag"
56
"fmt"
67
"log"
78
"os"
@@ -92,7 +93,8 @@ func SetConfigProperty(propName, propValue string) {
9293
}
9394

9495
func LoadConfiguration() {
95-
profile := findProfile()
96+
profile := flag.String("profile", defaultProfileName, "Profile to load")
97+
flag.Parse()
9698
usr, err := user.Current()
9799
if err != nil {
98100
log.Fatal("Cannot file home directory.", err)
@@ -101,10 +103,11 @@ func LoadConfiguration() {
101103
verifyConfigDir(fullPath)
102104
viper.AddConfigPath(fullPath)
103105
configFile := "checkmarxcli"
104-
if profile != defaultProfileName {
106+
if *profile != defaultProfileName {
105107
configFile += "_"
106-
configFile += profile
108+
configFile += *profile
107109
}
110+
fmt.Println("using config file: ", configFile)
108111
viper.SetConfigName(configFile)
109112
viper.SetConfigType("yaml")
110113
_ = viper.ReadInConfig()
@@ -121,20 +124,6 @@ func verifyConfigDir(fullPath string) {
121124
}
122125
}
123126

124-
func findProfile() string {
125-
profileName := defaultProfileName
126-
for idx, b := range os.Args {
127-
if b == "--profile" {
128-
profileIdx := idx + 1
129-
if len(os.Args) > profileIdx {
130-
profileName = os.Args[profileIdx]
131-
fmt.Println("Using custom profile: ", profileName)
132-
}
133-
}
134-
}
135-
return profileName
136-
}
137-
138127
func ShowConfiguration() {
139128
fmt.Println("Current Effective Configuration")
140129

0 commit comments

Comments
 (0)