Patrick Plate
367 lines
13 KiB
TypeScript
367 lines
13 KiB
TypeScript
import { parametersSchema as z, defineCustomTool, CustomToolContext } from "@roo-code/types"
|
|
// @ts-ignore - Node built-ins
|
|
import { spawn } from "child_process"
|
|
// @ts-ignore - Node built-ins
|
|
import { existsSync, mkdirSync, renameSync, createWriteStream, readFileSync, writeFileSync, WriteStream } from "fs"
|
|
// @ts-ignore - Node built-ins
|
|
import path from "path"
|
|
// @ts-ignore - Node built-ins
|
|
import { spawnSync } from "child_process"
|
|
|
|
export default defineCustomTool({
|
|
name: "snyk_scan",
|
|
description: "Run Snyk security scans (SCA + SAST) on a project and produce a Zusammenfassung JSON compatible with Sven's Copilot prompt chain. Requires `snyk` CLI authenticated locally.",
|
|
parameters: z.object({
|
|
projectRoot: z.string().describe("Absolute or relative path to the project root (must be a git repo)"),
|
|
mode: z.enum(["sca", "code", "both"]).optional().describe("Which scan(s) to run (default: both)"),
|
|
severityThreshold: z.enum(["low", "medium", "high", "critical"]).optional().describe("Severity threshold for SAST scan (default: low)"),
|
|
outputDir: z.string().optional().describe("Output directory for reports (default: <projectRoot>/.snyk-reports/<basename>)"),
|
|
includeIgnores: z.boolean().optional().describe("Pass --include-ignores to snyk (default: true)"),
|
|
timeoutSec: z.number().optional().describe("Overall timeout in seconds (default: 600)"),
|
|
}),
|
|
async execute(
|
|
{ projectRoot, mode = "both", severityThreshold = "low", outputDir, includeIgnores = true, timeoutSec = 600 },
|
|
context: CustomToolContext
|
|
) {
|
|
try {
|
|
// --- Resolve projectRoot ---
|
|
// @ts-ignore - task.cwd exists at runtime
|
|
const cwd = context?.task?.cwd ?? process.cwd()
|
|
const resolvedRoot = path.isAbsolute(projectRoot) ? projectRoot : path.resolve(cwd, projectRoot)
|
|
|
|
if (!existsSync(resolvedRoot)) {
|
|
return JSON.stringify({ ok: false, error: `Project root does not exist: ${resolvedRoot}` }, null, 2)
|
|
}
|
|
|
|
// --- Auth check ---
|
|
const whoami = spawnSync("snyk", ["whoami"], { encoding: "utf-8", timeout: 15_000 })
|
|
if (whoami.status !== 0) {
|
|
return JSON.stringify({ ok: false, error: "Snyk not authenticated. Run 'snyk auth' first." }, null, 2)
|
|
}
|
|
|
|
// --- Git branch ---
|
|
const gitBranch = spawnSync("git", ["-C", resolvedRoot, "rev-parse", "--abbrev-ref", "HEAD"], {
|
|
encoding: "utf-8",
|
|
timeout: 10_000,
|
|
})
|
|
if (gitBranch.status !== 0) {
|
|
return JSON.stringify({ ok: false, error: `Not a git repository: ${resolvedRoot}` }, null, 2)
|
|
}
|
|
const branch = (gitBranch.stdout || "").trim()
|
|
const branchSafe = branch.replace(/[/\\:*?"<>|]/g, "_")
|
|
|
|
// --- Timestamp ---
|
|
const now = new Date()
|
|
const pad = (n: number) => String(n).padStart(2, "0")
|
|
const timestamp = `${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())}_${pad(now.getHours())}-${pad(now.getMinutes())}-${pad(now.getSeconds())}`
|
|
|
|
// --- OutputDir resolution ---
|
|
const baseName = path.basename(resolvedRoot)
|
|
const resolvedOutputDir = outputDir
|
|
? (path.isAbsolute(outputDir) ? outputDir : path.resolve(cwd, outputDir))
|
|
: path.join(resolvedRoot, ".snyk-reports", baseName)
|
|
|
|
if (!existsSync(resolvedOutputDir)) {
|
|
mkdirSync(resolvedOutputDir, { recursive: true })
|
|
}
|
|
|
|
// --- File paths ---
|
|
const scaJsonPath = path.join(resolvedOutputDir, `snyk-sca_${branchSafe}_${timestamp}.json`)
|
|
const codeJsonPath = path.join(resolvedOutputDir, `snyk-code_${branchSafe}_${timestamp}.json`)
|
|
const summaryPath = path.join(resolvedOutputDir, `snyk-zusammenfassung_${branchSafe}_${timestamp}.json`)
|
|
|
|
const warnings: string[] = []
|
|
const commands: { sca: string | null; code: string | null } = { sca: null, code: null }
|
|
const exitCodes: { sca: number | null; code: number | null } = { sca: null, code: null }
|
|
|
|
// --- Maven Wrapper hack ---
|
|
const hasPom = existsSync(path.join(resolvedRoot, "pom.xml"))
|
|
const wrapperFiles: { original: string; backup: string }[] = []
|
|
|
|
function disableMavenWrapper() {
|
|
if (!hasPom) return
|
|
for (const candidate of ["mvnw", "mvnw.cmd"]) {
|
|
const original = path.join(resolvedRoot, candidate)
|
|
if (existsSync(original)) {
|
|
const backup = `${original}.snyk-disabled`
|
|
renameSync(original, backup)
|
|
wrapperFiles.push({ original, backup })
|
|
}
|
|
}
|
|
if (wrapperFiles.length > 0) {
|
|
warnings.push("Maven Wrapper temporarily disabled during scan")
|
|
}
|
|
}
|
|
|
|
function restoreMavenWrapper() {
|
|
for (const { original, backup } of wrapperFiles) {
|
|
if (existsSync(backup)) {
|
|
renameSync(backup, original)
|
|
}
|
|
}
|
|
}
|
|
|
|
// --- Spawn helper: stream stdout to file, capture for parsing ---
|
|
function runSnyk(args: string[], outPath: string, abortSignal: AbortSignal): Promise<{ exitCode: number; outputPath: string }> {
|
|
return new Promise((resolve, reject) => {
|
|
if (abortSignal.aborted) {
|
|
return reject(new Error("Timeout"))
|
|
}
|
|
|
|
const proc = spawn("snyk", args, {
|
|
cwd: resolvedRoot,
|
|
stdio: ["ignore", "pipe", "pipe"],
|
|
})
|
|
|
|
const ws: WriteStream = createWriteStream(outPath, { encoding: "utf-8" })
|
|
proc.stdout.pipe(ws)
|
|
// Also capture stderr into the same file (snyk mixes channels)
|
|
proc.stderr.pipe(ws, { end: false })
|
|
|
|
const onAbort = () => {
|
|
proc.kill("SIGTERM")
|
|
reject(new Error("Timeout"))
|
|
}
|
|
abortSignal.addEventListener("abort", onAbort, { once: true })
|
|
|
|
proc.on("error", (err: Error) => {
|
|
abortSignal.removeEventListener("abort", onAbort)
|
|
reject(err)
|
|
})
|
|
|
|
proc.on("close", (code: number | null) => {
|
|
abortSignal.removeEventListener("abort", onAbort)
|
|
ws.end(() => {
|
|
resolve({ exitCode: code ?? 1, outputPath: outPath })
|
|
})
|
|
})
|
|
})
|
|
}
|
|
|
|
// --- Exit code logic (port of Test-IsSnykFailure) ---
|
|
function isSnykFailure(exitCode: number, outputPath: string, scanMode: "SCA" | "CODE"): boolean {
|
|
if (exitCode === 0) return false
|
|
if (exitCode > 1) return true
|
|
|
|
// Exit 1 — usually means "findings detected". Parse to confirm.
|
|
let text: string
|
|
try {
|
|
text = readFileSync(outputPath, "utf-8")
|
|
} catch {
|
|
return true // Can't read output → treat as failure
|
|
}
|
|
|
|
let parsed: any
|
|
try {
|
|
parsed = JSON.parse(text)
|
|
} catch {
|
|
return true // Not valid JSON → failure
|
|
}
|
|
|
|
if (scanMode === "SCA") {
|
|
if (Array.isArray(parsed)) return false
|
|
if (parsed && typeof parsed === "object" && "error" in parsed) return true
|
|
return false
|
|
}
|
|
|
|
// CODE mode — SARIF format
|
|
if (parsed && typeof parsed === "object" && "runs" in parsed) return false
|
|
if (parsed && typeof parsed === "object" && "error" in parsed) return true
|
|
return true
|
|
}
|
|
|
|
// --- Run scans ---
|
|
const controller = new AbortController()
|
|
const timeoutHandle = setTimeout(() => controller.abort(), timeoutSec * 1000)
|
|
|
|
try {
|
|
disableMavenWrapper()
|
|
|
|
// SCA scan
|
|
if (mode === "sca" || mode === "both") {
|
|
const scaArgs = ["test", "--all-projects", "--json"]
|
|
if (includeIgnores) scaArgs.push("--include-ignores")
|
|
if (hasPom) scaArgs.push("--command=mvn")
|
|
commands.sca = `snyk ${scaArgs.join(" ")}`
|
|
|
|
const scaResult = await runSnyk(scaArgs, scaJsonPath, controller.signal)
|
|
exitCodes.sca = scaResult.exitCode
|
|
|
|
if (isSnykFailure(scaResult.exitCode, scaJsonPath, "SCA")) {
|
|
warnings.push(`SCA scan failed (exit ${scaResult.exitCode}). Check ${scaJsonPath}`)
|
|
}
|
|
}
|
|
|
|
// SAST scan
|
|
if (mode === "code" || mode === "both") {
|
|
const codeArgs = ["code", "test", ".", `--severity-threshold=${severityThreshold}`, "--json"]
|
|
if (includeIgnores) codeArgs.push("--include-ignores")
|
|
commands.code = `snyk ${codeArgs.join(" ")}`
|
|
|
|
const codeResult = await runSnyk(codeArgs, codeJsonPath, controller.signal)
|
|
exitCodes.code = codeResult.exitCode
|
|
|
|
if (isSnykFailure(codeResult.exitCode, codeJsonPath, "CODE")) {
|
|
warnings.push(`SAST scan failed (exit ${codeResult.exitCode}). Check ${codeJsonPath}`)
|
|
}
|
|
}
|
|
} finally {
|
|
clearTimeout(timeoutHandle)
|
|
restoreMavenWrapper()
|
|
}
|
|
|
|
// --- Build Zusammenfassung ---
|
|
function getGroupedSCA(jsonPath: string): any[] {
|
|
if (!existsSync(jsonPath)) return []
|
|
let raw: string
|
|
try { raw = readFileSync(jsonPath, "utf-8") } catch { return [] }
|
|
let data: any
|
|
try { data = JSON.parse(raw) } catch { return [] }
|
|
|
|
// Collect all vulnerabilities
|
|
let vulnerabilities: any[] = []
|
|
if (Array.isArray(data)) {
|
|
for (const project of data) {
|
|
if (project && Array.isArray(project.vulnerabilities)) {
|
|
vulnerabilities.push(...project.vulnerabilities)
|
|
}
|
|
}
|
|
} else if (data && Array.isArray(data.vulnerabilities)) {
|
|
vulnerabilities = data.vulnerabilities
|
|
}
|
|
|
|
if (vulnerabilities.length === 0) return []
|
|
|
|
// Group by id
|
|
const groups: Record<string, any[]> = {}
|
|
for (const vuln of vulnerabilities) {
|
|
const id = vuln.id || "unknown"
|
|
if (!groups[id]) groups[id] = []
|
|
groups[id].push(vuln)
|
|
}
|
|
|
|
const result: any[] = []
|
|
for (const [id, group] of Object.entries(groups)) {
|
|
const first = group[0]
|
|
result.push({
|
|
id,
|
|
title: first.title || "",
|
|
severity: first.severity || "unknown",
|
|
packageName: first.packageName || "",
|
|
version: first.version || "",
|
|
count: group.length,
|
|
type: "SCA",
|
|
})
|
|
}
|
|
|
|
// Sort by severity then id
|
|
const sevOrder: Record<string, number> = { critical: 0, high: 1, medium: 2, low: 3, unknown: 4 }
|
|
result.sort((a, b) => {
|
|
const sa = sevOrder[a.severity] ?? 4
|
|
const sb = sevOrder[b.severity] ?? 4
|
|
if (sa !== sb) return sa - sb
|
|
return a.id.localeCompare(b.id)
|
|
})
|
|
|
|
return result
|
|
}
|
|
|
|
function getGroupedSAST(jsonPath: string): any[] {
|
|
if (!existsSync(jsonPath)) return []
|
|
let raw: string
|
|
try { raw = readFileSync(jsonPath, "utf-8") } catch { return [] }
|
|
let data: any
|
|
try { data = JSON.parse(raw) } catch { return [] }
|
|
|
|
if (!data || !data.runs) return []
|
|
|
|
// Collect all results from all runs
|
|
let allResults: any[] = []
|
|
for (const run of data.runs) {
|
|
if (run && Array.isArray(run.results)) {
|
|
allResults.push(...run.results)
|
|
}
|
|
}
|
|
|
|
if (allResults.length === 0) return []
|
|
|
|
// Group by ruleId
|
|
const groups: Record<string, any[]> = {}
|
|
for (const result of allResults) {
|
|
const ruleId = result.ruleId || "unknown"
|
|
if (!groups[ruleId]) groups[ruleId] = []
|
|
groups[ruleId].push(result)
|
|
}
|
|
|
|
const output: any[] = []
|
|
for (const [ruleId, group] of Object.entries(groups)) {
|
|
const first = group[0]
|
|
const findings = group.map((r) => {
|
|
const loc = r.locations?.[0]?.physicalLocation
|
|
return {
|
|
file: loc?.artifactLocation?.uri || "",
|
|
line: loc?.region?.startLine || 0,
|
|
}
|
|
})
|
|
output.push({
|
|
id: ruleId,
|
|
title: first.message?.text || "",
|
|
severity: first.level || "warning",
|
|
count: group.length,
|
|
type: "SAST",
|
|
findings,
|
|
})
|
|
}
|
|
|
|
// Sort by severity then id
|
|
const sevOrder: Record<string, number> = { error: 0, warning: 1, note: 2 }
|
|
output.sort((a, b) => {
|
|
const sa = sevOrder[a.severity] ?? 3
|
|
const sb = sevOrder[b.severity] ?? 3
|
|
if (sa !== sb) return sa - sb
|
|
return a.id.localeCompare(b.id)
|
|
})
|
|
|
|
return output
|
|
}
|
|
|
|
const scaFindings = (mode === "sca" || mode === "both") ? getGroupedSCA(scaJsonPath) : []
|
|
const codeFindings = (mode === "code" || mode === "both") ? getGroupedSAST(codeJsonPath) : []
|
|
|
|
const summaryObj = {
|
|
branch,
|
|
timestamp,
|
|
baseDir: resolvedRoot,
|
|
project: {
|
|
project: baseName,
|
|
sca: scaFindings,
|
|
code: codeFindings,
|
|
},
|
|
}
|
|
|
|
// Write Zusammenfassung to disk
|
|
const summaryJson = JSON.stringify(summaryObj, null, 2)
|
|
writeFileSync(summaryPath, summaryJson, "utf-8")
|
|
|
|
// --- Return shape ---
|
|
return JSON.stringify({
|
|
ok: true,
|
|
command: commands,
|
|
branch,
|
|
timestamp,
|
|
outputDir: resolvedOutputDir,
|
|
files: {
|
|
sca: (mode === "sca" || mode === "both") ? scaJsonPath : null,
|
|
code: (mode === "code" || mode === "both") ? codeJsonPath : null,
|
|
summary: summaryPath,
|
|
},
|
|
summary: summaryObj,
|
|
exitCodes,
|
|
warnings,
|
|
}, null, 2)
|
|
} catch (err: any) {
|
|
return JSON.stringify({ ok: false, error: err.message ?? String(err) }, null, 2)
|
|
}
|
|
},
|
|
})
|