From 8abfd634124c42a005d27a9937c0a16540b648aa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?= Date: Tue, 31 Mar 2020 21:00:56 +0200 Subject: [PATCH 01/11] reduce image size, format Dockerfile MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Thomas Sjögren --- Dockerfile | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/Dockerfile b/Dockerfile index 1823df4..5c23661 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,16 +1,15 @@ -FROM python:3.5-alpine +FROM python:3.6-alpine -RUN apk add --no-cache nmap nmap-scripts git -COPY requirements.txt / -RUN pip install --no-cache-dir -r requirements.txt - -RUN git clone https://github.com/vulnersCom/nmap-vulners /usr/share/nmap/scripts/vulners && nmap --script-updatedb -RUN mkdir /shared - -COPY run.sh output_report.py gcp_push.py aws_push.py / +COPY aws_push.py gcp_push.py output_report.py requirements.txt run.sh / COPY contrib /contrib COPY shared /shared -RUN chmod +x /run.sh +RUN apk add --no-cache nmap nmap-scripts git && \ + pip install --no-cache-dir -r requirements.txt && \ + git clone https://github.com/vulnersCom/nmap-vulners \ + /usr/share/nmap/scripts/vulners && \ + nmap --script-updatedb && \ + apk del git && \ + chmod +x /run.sh -ENTRYPOINT ["/run.sh"] +ENTRYPOINT ["/bin/sh","-c","/run.sh"] From f6aacdcfdf359c6cf9192f92b73b75cf23eb0316 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?= Date: Tue, 31 Mar 2020 21:01:53 +0200 Subject: [PATCH 02/11] build w/o cache, drop privileges and remove containers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Thomas Sjögren --- Makefile | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/Makefile b/Makefile index cfd1d30..2e1c71f 100644 --- a/Makefile +++ b/Makefile @@ -1,15 +1,15 @@ -build : - docker build -t flan_scan . +build : + docker build --no-cache -t flan_scan . container_name = flan_$(shell date +'%s') -start : - docker run --name $(container_name) -v "$(CURDIR)/shared:/shared:Z" flan_scan +start : + docker run --rm --cap-drop=all --cap-add=NET_RAW --name $(container_name) -v "$(CURDIR)/shared:/shared:Z" flan_scan md : - docker run --name $(container_name) -v "$(CURDIR)/shared:/shared:Z" -e format=md flan_scan + docker run --rm --cap-drop=all --cap-add=NET_RAW --name $(container_name) -v "$(CURDIR)/shared:/shared:Z" -e format=md flan_scan html : - docker run --name $(container_name) -v "$(CURDIR)/shared:/shared:Z" -e format=html flan_scan + docker run --rm --cap-drop=all --cap-add=NET_RAW --name $(container_name) -v "$(CURDIR)/shared:/shared:Z" -e format=html flan_scan json : - docker run --name $(container_name) -v "$(CURDIR)/shared:/shared:Z" -e format=json flan_scan \ No newline at end of file + docker run --rm --cap-drop=all --cap-add=NET_RAW --name $(container_name) -v "$(CURDIR)/shared:/shared:Z" -e format=json flan_scan From 254aa264b1e67ca355fd029ce7c59b720ecb865b Mon Sep 17 00:00:00 2001 From: dekanfrus Date: Tue, 28 Apr 2020 09:56:12 -0500 Subject: [PATCH 03/11] Update README.md Fixed minor typo --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index cb9eaa5..d6dd1ed 100644 --- a/README.md +++ b/README.md @@ -47,7 +47,7 @@ $ nmap -sV -oX /shared/xml_files -oN - -v1 $@ --script=vulners/vulners.nse From 431d89b66ce0f576ee5241d0b723a69e144a2c90 Mon Sep 17 00:00:00 2001 From: sudneo Date: Wed, 12 Aug 2020 16:32:07 +0300 Subject: [PATCH 04/11] Fixes uncaught exception --- contrib/parsers/flan_xml_parser.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/contrib/parsers/flan_xml_parser.py b/contrib/parsers/flan_xml_parser.py index 5254921..e0e0b43 100644 --- a/contrib/parsers/flan_xml_parser.py +++ b/contrib/parsers/flan_xml_parser.py @@ -85,7 +85,10 @@ def parse_port(self, ip_addr: str, port: Dict[str, Any]): if port['state']['@state'] == 'closed': return - app_name = self.get_app_name(port['service']) + try: + app_name = self.get_app_name(port['service']) + except KeyError: + app_name = "unknown" port_num = port['@portid'] new_app = app_name not in self.results self.results[app_name].locations[ip_addr].append(port_num) From 9cf8f59b54bcf137f60863b961eb971d22551800 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?= Date: Sat, 27 Feb 2021 23:05:56 +0100 Subject: [PATCH 05/11] add .dockerignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Thomas Sjögren --- .dockerignore | 1 + 1 file changed, 1 insertion(+) create mode 100644 .dockerignore diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 0000000..6b8710a --- /dev/null +++ b/.dockerignore @@ -0,0 +1 @@ +.git From 5077c92072b364341ad2b202b9dd6d93f490ab28 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?= Date: Sat, 27 Feb 2021 23:06:13 +0100 Subject: [PATCH 06/11] bump to python:3.9-alpine MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Thomas Sjögren --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 5c23661..9cdde85 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM python:3.6-alpine +FROM python:3.9-alpine COPY aws_push.py gcp_push.py output_report.py requirements.txt run.sh / COPY contrib /contrib From 17906f8a8a9a1d4a10336965ae68fce955ad628d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?= Date: Sat, 27 Feb 2021 23:06:32 +0100 Subject: [PATCH 07/11] specify Dockerfile MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Thomas Sjögren --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 2e1c71f..babe21d 100644 --- a/Makefile +++ b/Makefile @@ -1,5 +1,5 @@ build : - docker build --no-cache -t flan_scan . + docker build --no-cache -t flan_scan -f Dockerfile . container_name = flan_$(shell date +'%s') start : From 07e865291e193d6d6befab273b38cb340b0599b8 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 20 Mar 2021 03:08:35 +0000 Subject: [PATCH 08/11] Bump jinja2 from 2.10.3 to 2.11.3 Bumps [jinja2](https://github.com/pallets/jinja) from 2.10.3 to 2.11.3. - [Release notes](https://github.com/pallets/jinja/releases) - [Changelog](https://github.com/pallets/jinja/blob/master/CHANGES.rst) - [Commits](https://github.com/pallets/jinja/compare/2.10.3...2.11.3) Signed-off-by: dependabot[bot] --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index aced391..6a5b6d4 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,4 +1,4 @@ xmltodict==0.12.0 google-cloud-storage==1.23.0 boto3==1.12.15 -Jinja2==2.10.3 \ No newline at end of file +Jinja2==2.11.3 \ No newline at end of file From c9865f91a7d4173ad000d52c73537c5b1dc01623 Mon Sep 17 00:00:00 2001 From: katherine Date: Wed, 21 Apr 2021 21:00:27 -0400 Subject: [PATCH 09/11] Added in extrafloats and maxdeadcycles per PR #36 --- contrib/report_builders/latex_report_builder.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/contrib/report_builders/latex_report_builder.py b/contrib/report_builders/latex_report_builder.py index 6889910..f7ef197 100644 --- a/contrib/report_builders/latex_report_builder.py +++ b/contrib/report_builders/latex_report_builder.py @@ -109,6 +109,8 @@ def _append(self, text: str): \usepackage{hyperref} \usepackage{fontawesome} \usepackage{listings} +\extrafloats{600} +\maxdeadcycles 600 \lstset{ basicstyle=\small\ttfamily, columns=flexible, From c61377ae90e2a57ff1b696ac5c14c2607052aefa Mon Sep 17 00:00:00 2001 From: Yen Chuang Date: Fri, 25 Feb 2022 19:39:58 -0600 Subject: [PATCH 10/11] fix markupsafe dependency issue --- requirements.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 6a5b6d4..1e00ad8 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,4 +1,5 @@ xmltodict==0.12.0 google-cloud-storage==1.23.0 boto3==1.12.15 -Jinja2==2.11.3 \ No newline at end of file +Jinja2==2.11.3 +markupsafe==2.0.1 \ No newline at end of file From 6588b07751f14180ba151842458b97510490fa58 Mon Sep 17 00:00:00 2001 From: Hrushikesh Deshpande Date: Thu, 19 Sep 2024 21:54:05 -0400 Subject: [PATCH 11/11] Adding semgrep yaml file --- .github/workflows/semgrep.yml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 .github/workflows/semgrep.yml diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml new file mode 100644 index 0000000..c821e5a --- /dev/null +++ b/.github/workflows/semgrep.yml @@ -0,0 +1,25 @@ + +on: + pull_request: {} + workflow_dispatch: {} + push: + branches: + - main + - master + schedule: + - cron: '0 0 * * *' +name: Semgrep config +jobs: + semgrep: + name: semgrep/ci + runs-on: ubuntu-20.04 + env: + SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }} + SEMGREP_URL: https://cloudflare.semgrep.dev + SEMGREP_APP_URL: https://cloudflare.semgrep.dev + SEMGREP_VERSION_CHECK_URL: https://cloudflare.semgrep.dev/api/check-version + container: + image: returntocorp/semgrep + steps: + - uses: actions/checkout@v3 + - run: semgrep ci