Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
if self.target[0:len(tgc)] == tgc:
target_mode = TARGET_MODE_GIT
if os.path.isfile(self.target):
target_mode = TARGET_MODE_FILE
try:
if self.target.split('.')[-1] in Config('upload', 'extensions').value.split('|'):
target_mode = TARGET_MODE_COMPRESS
except AttributeError as e:
logger.critical('Please config the config file copy from the config.template file')
if os.path.isdir(self.target):
target_mode = TARGET_MODE_FOLDER
if target_mode is None:
logger.critical('[PARSE-ARGS] [-t ] can\'t empty!')
exit()
logger.debug('[PARSE-ARGS] Target Mode: {mode}'.format(mode=target_mode))
return target_mode
if 'windows' in platform.platform().lower():
logger.critical('Nonsupport Windows!!!')
if args.host is not None and args.port is not None:
try:
if not int(args.port) <= 65535:
logger.critical('port must be 0-65535.')
exit()
except ValueError as e:
logger.critical('port must be 0-65535')
exit()
logger.debug('[INIT] start RESTful Server...')
api.start(args.host, args.port, args.debug)
else:
logger.debug('[INIT] start scanning...')
# Native CLI mode
if args.sid is None:
a_sid = get_sid(args.target, True)
data = {
'status': 'running',
'report': ''
}
Running(a_sid).status(data)
else:
# API call CLI mode
a_sid = args.sid
cli.start(args.target, args.format, args.output, args.special_rules, a_sid, args.dels)
t2 = time.time()
logger.info('[INIT] Done! Consume Time:{ct}s'.format(ct=t2 - t1))
except Exception as e:
# Is function's param
regex_function_param = r'(function\s*\w+\s*\(.*{0})'.format(re.escape(param_name))
regex_function_param_result = re.findall(regex_function_param, param_block_code)
if len(regex_function_param_result) >= 1:
self.param_value = regex_function_param_result[0]
logger.debug("[AST] Is function's param: `Yes`")
return True, self.data
logger.debug("[AST] Is function's param: `No`")
# Is assign CONST
uc_rule = r'{0}\s?=\s?([A-Z_]*)'.format(re.escape(param_name))
uc_rule_result = re.findall(uc_rule, param_block_code)
if len(uc_rule_result) >= 1:
logger.debug("[AST] Is assign CONST: Yes `{0} = {1}`".format(param_name, uc_rule_result[0]))
return False, self.data
logger.debug("[AST] Is assign CONST: `No`")
# Is assign string
regex_assign_string = self.regex[self.language]['assign_string'].format(re.escape(param_name))
string = re.findall(regex_assign_string, param_block_code)
if len(string) >= 1 and string[0] != '':
logger.debug("[AST] Is assign string: `Yes`")
return False, self.data
logger.debug("[AST] Is assign string: `No`")
return True, self.data
else:
if self.language == 'java':
# Java variable didn't have `$`
param_block_code = self.block_code(0)
if param_block_code is False:
logger.debug("Can't get block code")
return True, self.data
def _requirements(self):
requirements_txt = os.path.join(self.target_directory, 'requirements.txt')
logger.debug(requirements_txt)
if os.path.isfile(requirements_txt):
requirements = parse_requirements(requirements_txt, session=False)
self.requirements = [req.name.strip().lower() for req in requirements]
logger.debug('requirements modules count: {count} ({modules})'.format(count=len(self.requirements),
modules=','.join(self.requirements)))
else:
logger.debug('requirements.txt not found!')
self.requirements = []
block_end = 10000
functions = self.functions()
if functions:
for function_name, function_value in functions.items():
if int(function_value['start']) < int(self.line) < int(function_value['end']):
in_this_function = '<---- {0}'.format(self.line)
if block_position == 0:
block_start = function_value['start']
block_end = int(self.line) - 1
elif block_position == 1:
block_start = int(self.line)
block_end = int(function_value['end']) - 1
elif block_position == 3:
block_start = function_value['start']
block_end = function_value['end']
logger.debug("[AST] [FUNCTION] {0} ({1} - {2}) {3}".format(function_name, function_value['start'], function_value['end'], in_this_function))
else:
if block_position == 0:
block_start = 1
block_end = int(self.line) - 1
elif block_position == 1:
block_start = int(self.line) + 1
block_end = sum(1 for l in open(self.file_path))
elif block_position == 3:
block_start = 1
block_end = sum(1 for l in open(self.file_path))
logger.debug("[AST] Not function anything `function`, will split file")
# get param block code
line_rule = "{0},{1}p".format(block_start, block_end)
code = File(self.file_path).lines(line_rule)
logger.debug('[AST] [BLOCK-CODE-LINES] {0} - {1}p'.format(block_start, block_end))
return code
logger.debug("[AST] Is assign string: `No`")
return True, self.data
else:
if self.language == 'java':
# Java variable didn't have `$`
param_block_code = self.block_code(0)
if param_block_code is False:
logger.debug("Can't get block code")
return True, self.data
logger.debug("[AST] Block code: ```{language}\r\n{code}```".format(language=self.language, code=param_block_code))
regex_assign_string = self.regex[self.language]['assign_string'].format(re.escape(param_name))
string = re.findall(regex_assign_string, param_block_code)
if len(string) >= 1 and string[0] != '':
logger.debug("[AST] Is assign string: `Yes`")
return False, self.data
logger.debug("[AST] Is assign string: `No`")
# Is assign out data
regex_get_param = r'String\s{0}\s=\s\w+\.getParameter(.*)'.format(re.escape(param_name))
get_param = re.findall(regex_get_param, param_block_code)
if len(get_param) >= 1 and get_param[0] != '':
logger.debug("[AST] Is assign out data: `Yes`")
return False, self.data
logger.debug("[AST] Is assign out data: `No`")
return True, self.data
logger.debug("[AST] Not Java/PHP, can't parse ({l})".format(l=self.language))
return False, self.data
else:
logger.debug("[AST] Can't get `param`, check built-in rule")
return False, self.data
def dependency_scan(self, root):
"""
根据三方依赖识别项目使用框架类型
:param root:
:return:
"""
framework_infos = self.dependency_framework(root)
dependencies = Dependencies(self.target_directory)
dependencies_info = dependencies.get_framework
dependencies_info = list(set(dependencies_info))
for frame_name in framework_infos:
for rule in framework_infos[frame_name]['rule']:
for dependency in dependencies_info:
if rule in dependency:
logger.debug("Find the project's framework may be:" + frame_name)
return frame_name
return None
# const.py
self.repair_code = None
self.repair_code_init = 0
self.repair_code_fixed = 1
self.repair_code_not_exist_file = 4000
self.repair_code_special_file = 4001
self.repair_code_whitelist = 4002
self.repair_code_test_file = 4003
self.repair_code_annotation = 4004
self.repair_code_modify = 4005
self.repair_code_empty_code = 4006
self.repair_code_const_file = 4007
self.repair_code_third_party = 4008
self.method = None
logger.debug("""[CVI-{cvi}] [VERIFY-VULNERABILITY] ({index})
> File: `{file}:{line}`
> Code: `{code}`
> Match2: `{m2}({m2b})`
> Repair: `{r}({rb})`""".format(
cvi=single_rule['id'],
index=index,
file=self.file_path.replace(self.target_directory, ''),
line=self.line_number,
code=self.code_content,
m2=self.rule_match2,
m2b=self.rule_match2_block,
r=self.rule_repair,
rb=self.repair_block))
def write_to_file(target, sid, output_format='', filename=None):
"""
Export scan result to file.
:param target: scan target
:param sid: scan sid
:param output_format: output format
:param filename: filename to save
:return:
"""
if not filename:
logger.debug('[EXPORT] No filename given, nothing exported.')
return False
scan_data_file = os.path.join(running_path, '{sid}_data'.format(sid=sid))
with open(scan_data_file, 'r') as f:
scan_data = json.load(f).get('result')
os.chdir(export_path)
scan_data['target'] = target
if output_format == '' or output_format == 'stream':
logger.info('Vulnerabilities\n' + str(dict_to_pretty_table(scan_data.get('vulnerabilities'))))
elif output_format == 'json' or output_format == 'JSON':
try:
if not os.path.exists(filename):
with open(filename, 'w', encoding='utf-8') as f: