vulnerability pretty printer

Author: northdpole

components/reporters/vulnerability-logger/README.md

@@ -0,0 +1,5 @@
+# vulnerability logger
+
+This development helper component implements a [reporter](https://github.com/smithy-security/smithy/blob/main/sdk/component/component.go). The purpose of this logger is to print vulnerabilities in a cli with the fields that current smithy cares about instead of printing the whole of OCSF.
+
+To test this component, you can run any example workflow that uses it, e.g. bandit.

components/reporters/vulnerability-logger/cmd/main.go

@@ -0,0 +1,45 @@
+package main
+
+import (
+	"context"
+	"log"
+	"os"
+	"time"
+
+	"github.com/go-errors/errors"
+
+	"github.com/smithy-security/smithy/sdk/component"
+
+	"github.com/smithy-security/private-components/components/reporters/vulnerability-logger/internal/reporter"
+)
+
+func main() {
+	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Minute)
+	defer cancel()
+
+	if err := Main(ctx); err != nil {
+		log.Fatalf("unexpected error: %v", err)
+	}
+}
+
+func Main(ctx context.Context, opts ...component.RunnerOption) error {
+	opts = append(opts, component.RunnerWithComponentName("vulnerability-logger"))
+	cfg, err := reporter.NewConfig(reporter.WithStream(os.Stdout)) // Default to stdout if no stream is provided
+	if err != nil {
+		return errors.Errorf("could not create config: %w", err)
+	}
+
+	rpt, err := reporter.NewVulnReporter(cfg)
+	if err != nil {
+		return errors.Errorf("could not create reporter: %w", err)
+	}
+	if err := component.RunReporter(
+		ctx,
+		rpt,
+		opts...,
+	); err != nil {
+		return errors.Errorf("could not run reporter: %w", err)
+	}
+
+	return nil
+}

components/reporters/vulnerability-logger/component.yaml

@@ -0,0 +1,7 @@
+name: vulnerability-logger
+description: "Logs what matters from findings in JSON format"
+type: reporter
+steps:
+  - name: vulnerability-logger
+    image: components/reporters/vulnerability-logger
+    executable: /bin/app

components/reporters/vulnerability-logger/internal/reporter/reporter.go

@@ -0,0 +1,221 @@
+package reporter
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"time"
+
+	"github.com/go-errors/errors"
+	"github.com/jonboulle/clockwork"
+	"google.golang.org/protobuf/encoding/protojson"
+
+	vf "github.com/smithy-security/smithy/sdk/component/vulnerability-finding"
+	ocsffindinginfo "github.com/smithy-security/smithy/sdk/gen/ocsf_ext/finding_info/v1"
+)
+
+type (
+	Config struct {
+		stream io.Writer
+		clock  clockwork.Clock
+	}
+
+	vulnReporter struct {
+		cfg *Config
+	}
+
+	vCode struct {
+		Path      string
+		LineRange string
+		Fix       string
+		Cwe       string
+	}
+	vPkg struct {
+		Purl          string
+		FoundLoc      string
+		Remediation   string
+		Cve           string
+		ExploitExists bool
+	}
+	vEnrichment struct {
+		Provider       string
+		Value          string
+		EnrichmentName string
+		Type           string
+	}
+	vDatasource struct {
+		TargetType string
+		Uri        string
+		RepoURL    string
+		Reference  string
+		Purl       string
+		WebsiteUri string
+		Tag        string
+	}
+	smithyFinding struct {
+		Confidence  string
+		CreatedAt   time.Time
+		Uid         string
+		Enrichments []*vEnrichment
+		Title       string
+		Datasources []*vDatasource
+		Description string
+		Severity    string
+		Code        []vCode
+		Pkg         []vPkg
+		Vendor      string
+		ProductName string
+	}
+)
+
+const errCouldNotGetEnvVarStr = "could not get environment variable value %q: %w"
+
+type ConfigOption func(*Config)
+
+// WithStream sets the output stream for the reporter.
+func WithStream(w io.Writer) ConfigOption {
+	return func(cfg *Config) {
+		cfg.stream = w
+	}
+}
+
+// WithClock allows customising the underlying clock.
+func WithClock(clock clockwork.Clock) ConfigOption {
+	return func(cfg *Config) {
+		cfg.clock = clock
+	}
+}
+
+// NewConfig initializes the reporter's Config from env and applies functional options.
+func NewConfig(opts ...ConfigOption) (*Config, error) {
+	var (
+		cfg = &Config{}
+	)
+
+	for _, opt := range opts {
+		opt(cfg)
+	}
+	if cfg.stream == nil {
+		cfg.stream = os.Stdout // Default to stdout if no stream is provided
+	}
+	return cfg, nil
+}
+
+// NewVulnReporter returns a new json logger.
+func NewVulnReporter(cfg *Config) (vulnReporter, error) {
+	if cfg == nil {
+		return vulnReporter{}, errors.New("config is nil")
+	}
+
+	return vulnReporter{
+		cfg: cfg,
+	}, nil
+}
+
+// Report logs the findings in json format.
+func (j vulnReporter) Report(
+	ctx context.Context,
+	findings []*vf.VulnerabilityFinding,
+) error {
+
+	for _, finding := range findings {
+		fields, err := j.getWhatWeCareAbout(ctx, finding)
+		if err != nil {
+			return errors.Errorf("could not extract what we care about: %w", err)
+		}
+
+		b, err := json.Marshal(&fields)
+		if err != nil {
+			return errors.Errorf("could not json marshal cV: %w", err)
+		}
+		if _, err := io.WriteString(j.cfg.stream, string(b)); err != nil {
+			return errors.Errorf("could not write json output: %w", err)
+		}
+	}
+
+	return nil
+}
+
+func (j vulnReporter) getWhatWeCareAbout(_ context.Context, finding *vf.VulnerabilityFinding) (*smithyFinding, error) {
+	cV := smithyFinding{}
+	cV.Confidence = finding.Finding.GetConfidenceId().String()
+	cV.Enrichments = make([]*vEnrichment, 0)
+	for _, e := range finding.Finding.GetEnrichments() {
+		cV.Enrichments = append(cV.Enrichments, &vEnrichment{
+			Provider:       e.GetProvider(),
+			Value:          e.GetValue(),
+			EnrichmentName: e.GetName(),
+			Type:           e.GetType(),
+		})
+	}
+	cV.Title = finding.Finding.GetFindingInfo().GetTitle()
+	ds := finding.Finding.GetFindingInfo().GetDataSources()
+	for _, datasource := range ds {
+		datas := ocsffindinginfo.DataSource{}
+		if err := protojson.Unmarshal([]byte(datasource), &datas); err != nil {
+			return nil, errors.Errorf("could not json unmarshal finding: %w", err)
+		}
+		cV.Datasources = append(cV.Datasources, &vDatasource{
+			TargetType: datas.GetTargetType().String(),
+			Uri:        datas.GetUri().GetPath(),
+			RepoURL:    datas.GetSourceCodeMetadata().GetRepositoryUrl(),
+			Reference:  datas.GetSourceCodeMetadata().GetReference(),
+			Purl:       datas.GetOciPackageMetadata().GetPackageUrl(),
+			Tag:        datas.GetOciPackageMetadata().GetTag(),
+			WebsiteUri: datas.GetWebsiteMetadata().GetUrl(),
+		})
+	}
+	cV.Description = finding.Finding.GetMessage()
+	cV.Severity = finding.Finding.GetSeverityId().String()
+	cV.Code = make([]vCode, 0)
+	cV.Pkg = make([]vPkg, 0)
+	cV.Uid = finding.Finding.FindingInfo.GetUid()
+	if finding.Finding.FindingInfo.CreatedTime != nil {
+		cV.CreatedAt = time.Unix(*finding.Finding.FindingInfo.CreatedTime, 0)
+	}
+
+	for _, v := range finding.Finding.Vulnerabilities {
+		for _, ac := range v.AffectedCode {
+			var c vCode
+			if ac.File != nil {
+				c.Path = *ac.File.Path
+			}
+			if ac != nil && ac.StartLine != nil && ac.EndLine != nil {
+				c.LineRange = fmt.Sprintf("%d-%d", *ac.StartLine, *ac.EndLine)
+			}
+			if ac.Remediation != nil {
+				c.Fix = ac.Remediation.GetDesc()
+			}
+			if v.Cwe != nil {
+				c.Cwe = v.Cwe.GetUid()
+			}
+			cV.Code = append(cV.Code, c)
+		}
+		for _, ap := range v.AffectedPackages {
+			var p vPkg
+			if ap.Purl != nil {
+				p.Purl = *ap.Purl
+			}
+			if ap.Path != nil {
+				p.FoundLoc = *ap.Path
+				p.Remediation = ap.Remediation.GetDesc()
+			}
+			if v.Cve != nil {
+				p.Cve = v.Cve.GetUid()
+			}
+			if v.IsExploitAvailable != nil {
+				p.ExploitExists = *v.IsExploitAvailable
+			}
+			cV.Pkg = append(cV.Pkg, p)
+		}
+		cV.Vendor = v.GetVendorName()
+	}
+
+	if finding.Finding.GetFindingInfo() != nil {
+		cV.ProductName = finding.Finding.GetFindingInfo().GetProductUid()
+	}
+
+	return &cV, nil
+}