tool.py

import os
import importlib
import subprocess
from colorama import init, deinit, Fore, Back, Style
from framework.helpers import split_by_file_extension
from framework.resources.language_detector import get_language
from framework.resources.library_detector import get_libraries
from framework.resources.types import ResourceType

TOOL_DIR = 'vulnerability_tool'
GIT_COMMAND = "git diff-index -z --cached HEAD --name-only"
DEBUG = True

fake_file_name = 'src/header.py'
fake_contents = """
	import React from requests 'react';let createReactClass = require('create-react-class');//credits to toggle css:
	https://stackoverflow.com/questions/39846282/how-to-add-the-text-on-and-off-to-toggle-buttonlet Header = createReactClass({
	sortIdeas: function() {      this.props.sortIdeas();    },    filterTag: function(tag) {this.props.filterTag(tag);    },
"""

def format_file_to_module(file_name):
	# Skip module init files.
	if "__init__" in file_name:
		return None

	# Skip over ".pyc" files.
	if get_language(file_name) != ResourceType.PYTHON:
		return None

	file_name, file_extension = split_by_file_extension(file_name)

	module_name = file_name.replace("/", ".")
	return "%s.%s" % (TOOL_DIR, module_name)

def run_module(module, kwargs):
	test_name, test_desc, status, msg = module.validate(**kwargs)
	if status == "PASS":
		display_color = Fore.GREEN
	elif status == "WARN":
		display_color = Fore.YELLOW
	elif status == "FAIL":
		display_color = Fore.RED
	else:
		return True

	if status != "PASS":
		print(display_color + status + Style.RESET_ALL + "\t" + test_name)
		print(test_desc)
		print(display_color + msg)
	elif DEBUG:
		print(display_color + status + Style.RESET_ALL + "\t" + test_name)

	return status == "PASS" or status == "WARN"

def list_project_files():
	project_file_paths = []
	for dir_, _, files in os.walk("."):
		if "vulnerability_tool" in dir_:
			continue

		if ".git" in dir_:
			continue

		for file_name in files:
			rel_dir = os.path.relpath(dir_, ".")
			project_file_paths.append(os.path.join(rel_dir, file_name))
	return project_file_paths

def get_vulnerability_modules():
	module_names = []
	for dir_, _, files in os.walk(TOOL_DIR):
		if "vulnerability_modules" not in dir_:
			continue

		# print("directory", dir_)
		for file_name in files:
			# print("file name", file_name)
			rel_dir = os.path.relpath(dir_, TOOL_DIR)
			rel_file = os.path.join(rel_dir, file_name)
			module_name = format_file_to_module(rel_file)
			if module_name:
				module_names.append(module_name)

	module_names = [module_name for module_name in module_names if "vulnerability_modules" in module_name]
	# print("all found modules", module_names)
	imported_modules = map(importlib.import_module, module_names)
	return imported_modules


def check_file(target_file_name, target_file_contents, project_file_paths, vulnerability_modules):
	# print("Tool was called.")
	target_file = [target_file_name, target_file_contents]
	passing = True
	detected_language = get_language(target_file_name)
	detected_libraries = get_libraries(detected_language, target_file_contents)
	detected_language_and_libraries = [detected_language] + detected_libraries
	if DEBUG:
		print("Scanning file: %s" % (Fore.MAGENTA + target_file_name))
		print("Detected languages and libraries: %s" % Style.BRIGHT + ", ".join([s.value for s in detected_language_and_libraries]))
	kwargs = {
		"file": target_file,
		"languages_and_libraries": detected_language_and_libraries,
		"project_file_paths": project_file_paths
	}
	for module in vulnerability_modules:
		passing = run_module(module, kwargs) and passing

	return passing

def is_file(string):
    return string.find(".") != -1

def fetch_project_files():
	project_file_paths = []
	for dir_, _, file_names in os.walk("."):
		if ".git" in dir_:
			continue

		if "vulnerability_tool" in dir_:
			continue

		if "dist" in dir_ or "public" in dir_:
			continue

		for file_name in file_names:
			if ".png" in file_name:
				continue

			rel_dir = os.path.relpath(dir_, ".")
			project_file_paths.append(os.path.join(rel_dir, file_name))
	return project_file_paths

def fetch_commited_files():
    command = GIT_COMMAND.split()
    popen = subprocess.Popen(['git', 'diff', '--cached', '--name-status'], stdout=subprocess.PIPE)
    out, err = popen.communicate()
    if err:
        print("There was an error in getting the commited files: %s", err)

    out = out.decode('utf-8')
    files = list(filter(is_file, out.split()))
    return files

# For language/libary detection.
def read_file(file_path):
    content = ""
    with open(file_path, "r") as file:
        content = file.read().split("\n")
    return content

# Checks whether this is a test, or production code.
def is_test(file_name):
	return "test" in file_name or "tests" in file_name

def run_tool(all_files=False):
	# Initialize colorama (for Windows systems)
	init(autoreset=True)
	passing = True
	project_file_paths = list_project_files()
	vulnerability_modules = get_vulnerability_modules()
	if all_files:
		scan_files = fetch_project_files()
	else:
		scan_files = fetch_commited_files()
	for file_name in scan_files:
		if is_test(file_name):
			continue

		file_contents = read_file(file_name)
		passing = (check_file(file_name, file_contents, project_file_paths, vulnerability_modules)
				   and passing)
		print("")

	if DEBUG and passing:
		print(Fore.GREEN + "All vulnerability checks passed successfully.")
	deinit()
	return True if passing else False