Module: PWN::Plugins::Semgrep

Defined in:
lib/pwn/plugins/semgrep.rb

Overview

semgrep wrapper feeding SAST-shaped findings.

Class Method Summary collapse

Class Method Details

.authors ⇒ Object 



38
39
40
 
# File 'lib/pwn/plugins/semgrep.rb', line 38

public_class_method def self.authors
  "AUTHOR(S):\n  0day Inc. <[email protected]>\n"
end

.help ⇒ Object 



42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
 
# File 'lib/pwn/plugins/semgrep.rb', line 42

public_class_method def self.help
  puts "USAGE:
    # List host binaries this module expects to be installed.
    #{self}.required_bins

    # Run semgrep --json and map results into finding hashes.
    #{self}.scan(
      path: 'optional - directory or file to scan (defaults to .)',
      target: 'optional - alias for path',
      config: 'optional - semgrep --config value (e.g. auto or p/owasp-top-ten)'
    )

    # Print the AUTHOR(S) string for this module.
    #{self}.authors
  "
  constants.sort
end

.required_bins ⇒ Object 



10
11
12
 
# File 'lib/pwn/plugins/semgrep.rb', line 10

public_class_method def self.required_bins
  %w[semgrep]
end

.scan(opts = {}) ⇒ Object 



14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
 
# File 'lib/pwn/plugins/semgrep.rb', line 14

public_class_method def self.scan(opts = {})
  PWN::Plugins::PreflightChecker.require_bin!(name: 'semgrep')
  target = opts[:path] || opts[:target] || '.'
  cmd = ['semgrep', '--json', '--quiet']
  cmd += ['--config', opts[:config].to_s] if opts[:config]
  cmd << target.to_s
  stdout, stderr, status = Open3.capture3(*cmd)
  parsed = begin
    JSON.parse(stdout)
  rescue JSON::ParserError
    {}
  end
  findings = Array(parsed['results']).map do |r|
    {
      title: r['check_id'],
      severity: r.dig('extra', 'severity'),
      path: r['path'],
      line: r.dig('start', 'line'),
      message: r.dig('extra', 'message')
    }
  end
  { findings: findings, stderr: stderr, exit: status.exitstatus }
end