zupit / horusec Goto Github PK

View Code? Open in Web Editor NEW

1.1K 50.0 179.0 75.81 MB

Horusec is an open source tool that improves identification of vulnerabilities in your project with just one command.

Home Page: https://horusec.io/

License: Apache License 2.0

Makefile 0.28% Dockerfile 0.50% Shell 1.12% Go 98.10%

sast java kotlin golang python ruby terraform netcore security security-development

horusec's Introduction

2. Getting started

2.1. Requirements

2.2. Installation

3. Usage

3.1. CLI Usage

3.2. Using Docker

3.3. Older versions

3.4. Using Horusec-Web application

3.5. Using Visual Studio Code

3.6. Using the Pipeline

About

Horusec is an open source tool that performs a static code analysis to identify security flaws during the development process. Currently, the languages for analysis are C#, Java, Kotlin, Python, Ruby, Golang, Terraform, Javascript, Typescript, Kubernetes, PHP, C, HTML, JSON, Dart, Elixir, Shell, Nginx. The tool has options to search for key leaks and security flaws in all your project's files, as well as in Git history. Horusec can be used by the developer through the CLI and by the DevSecOps team on CI /CD mats.

Check out our Documentation, you will see the complete list of tools and languages Horusec performs analysis.

See an Output example:

Getting started

Requirements

Docker

You need Docker installed in your machine in order to run Horusec with all the tools we use. If you don't have Docker, we have a flag -D true that will disable the dependency, but it also loses much of the analysis power. We recommend using it with Docker.

If you enable commit authors -G true, there is also a git dependency.

Installing Horusec

Mac or Linux

make install

curl -fsSL https://raw.githubusercontent.com/ZupIT/horusec/master/deployments/scripts/install.sh | bash -s latest

Check the installation

horusec version

Windows

amd64

curl -k "https://github.com/ZupIT/horusec/releases/latest/download/horusec_win_amd64.exe" -o "./horusec.exe" -L

arm64

curl -k "https://github.com/ZupIT/horusec/releases/latest/download/horusec_win_arm64.exe" -o "./horusec.exe" -L

Check the installation

./horusec.exe version

And more

You can find all binaries with versions in our releases page.
For more details on how to install, check out the documentation

Usage

CLI Usage

To use horusec-cli and check the application's vulnerabilities, use the following command:

horusec start -p .

When horusec starts an analysis, it creates a folder called .horusec. This folder is the basis for not changing your code. We recommend you to add the line .horusec into your .gitignore file so that this folder does not need to be sent to your git server.

Using Docker

It is possible to use Horusec through a docker image horuszup/horusec-cli:latest.

Run the following command to do it:

docker run -v /var/run/docker.sock:/var/run/docker.sock -v $(pwd):/src horuszup/horusec-cli:latest horusec start -p /src -P $(pwd)

We created a volume containing the project -v $(pwd):/src.

With the docker image we ended up having two paths where the project can be found.

The -p flag will represent the project path inside the container, in our example /src. The -P flag will represent the project outside the container, in our example is represented by $(pwd), will be also needed to pass the project path to mount the volume -v $(pwd):/src.

Older versions

Horusec's v1 is still available.

WARNING: The endpoint with v1 will be deprecated, please upgrade your CLI to v2. Check out more details in the documentation.

Mac or Linux

curl -fsSL https://horusec.io/bin/install.sh | bash -s latest

Windows

curl "https://horusec.io/bin/latest/win_x64/horusec.exe" -o "./horusec.exe" && ./horusec.exe version

The older binaries can be found at this endpoint, including the latest version of v1 v1.10.3.
As of v2, binaries will no longer be distributed by this endpoint, and you can find in the releases page.

Using Horusec-Web application

Manage your vulnerabilities through our web interface. You can have a dashboard of metrics about your vulnerabilities, control of false positives, authorization token, update of vulnerabilities and much more. See the web application section to keep reading about it.

Check out the example below, it is sending an analysis to Horusec web services:

horusec start -p <PATH_TO_YOUR_PROJECT> -a <YOUR_AUTHORIZATION_TOKEN>

Check out the tutorial on how to create an authorization token through Horusec Manager Web Service.

WARNING: Our web services was moved to a new repository. You need to upgrade to v2, check out how to migrate from v1 to v2.

Using Visual Studio Code

You can analyze your project using Horusec's Visual Studio Code extension. For more information, check out the documentation.

Using the Pipeline

You can perform an analysis of your project before you hold deployment in your environment by ensuring maximum security in your organization. For more information, check out the documentation:

Features

See below:

Analyzes simultaneously 18 languages with 20 different security tools to increase accuracy;
Search for their historical git by secrets and other contents exposed;
Your analysis can be fully configurable, see all CLI available resources.

Documentation

You can find Horusec's documentation on our website.

Roadmap

We have a project roadmap, you can contribute with us!

Horusec has other repositories, check them out:

Contributing

Feel free to use, recommend improvements, or contribute to new implementations.

Check out our contributing guide to learn about our development process, how to suggest bugfixes and improvements.

Developer Certificate of Origin - DCO

This is a security layer for the project and for the developers. It is mandatory.

Follow one of these two methods to add DCO to your commits:

1. Command line Follow the steps: Step 1: Configure your local git environment adding the same name and e-mail configured at your GitHub account. It helps to sign commits manually during reviews and suggestions.

git config --global user.name “Name”
git config --global user.email “[email protected]”

Step 2: Add the Signed-off-by line with the '-s' flag in the git commit command:

$ git commit -s -m "This is my commit message"

2. GitHub website

You can also manually sign your commits during GitHub reviews and suggestions, follow the steps below:

Step 1: When the commit changes box opens, manually type or paste your signature in the comment box, see the example:

Signed-off-by: Name < e-mail address >

For this method, your name and e-mail must be the same registered on your GitHub account.

Code of Conduct

Please follow the Code of Conduct in all your interactions with our project.

License

Apache License 2.0.

Community

Feel free to reach out to us at:

GitHub Issues
If you have any questions or ideas, let's chat in our Zup Open Source Forum.

This project exists thanks to all the contributors. You rock! ❤️ 🚀

horusec's People

Contributors

Stargazers

Watchers

Forkers

matheusnetozup jeandersonbc ng29 fike claranobre darwinaraujozup rafastavares luanalvesdaniel dcleme17 halex2018 camanducci alcmagalhaes dhyeivesrodovalhozup gleytonlima isgasho vishalrmn forkkit atrio-emc leogsouza jessica-tw masterscott gh0st0ne rafaelmedeiroszup xkhahuss rajivraj hkzj sashka3076 plusxp chennqqi jr69ss org-mars manas-embold vinodg7289 kartfran zhzhdoai jywah brunobva filipi86 iurialveszup rodrigotoledo7 lucasmenezesds matheusalcantarazup sasg asergioch ghislainadon latkes trendingtechnology woshizilong wibisana-kargo ssejzer otaviojava sumodgeorge wahello assisjoao moacybarros maykerh brunoduruzup danrleysa kelsoncarmozinezup silvanoeng cckuok lineuve mavalu22 arturobatistute amandaveredas faelribeiro22 nanikjava satyendra22 fernandonsc5 developgo tiago-marques rodrigobeavis dearrudam lucasbrunozup dittrichlucas vikrantllc filipemelo wanderer163 silocityit iancardosozup asa1997 yusufozturk borgessaulo ne0z gmwshz oliveirafelipezup arrudalabs anthturner luiguip edermanoel94 magnologan wiliansilvazup guilhermepaulozup adam88morris nathanmartinszup nathansousa beatrizbezerrazup-zz gicampoy gustavomarinhozup cyberindia1

horusec's Issues

Testar utilizar workdir do SDK do docker ao invés de utilizar comando "cd" nas imagens

Estudar análise simbólica de código

dynamic rules from API

Horusec manager rules form screen
CLI load rules from API

Fix horusec-manager vulnerabilities

Add Spotbugs for Java/Kotlin

What would you like to be added: Spotbugs is probably the most reliable opensource tool to scan Java code, this might be added here

Why is this needed: To improve Java quality scan

Workspace flow in horusec-manager.

Replace the organization flow with the new Workspaces flow in horusec-manager

Bugs found in tests

[ ] Error when format output security code scan in project Brew or symfony
[ ] Error when format output horusec-leaks in project Brew or gitlabhq
[ ] Error when bind project horusec
[ ] Error when run horusec-kubernetes and killed without get output
[ ] Error when project is bigger consummer max memory and cpu enable

Improve false positive UX

Set a vulnerability as false positive from the vscode plugin

Dashboard (https://horusec.zup.com.br/)

The documentation refers to a dashboard where you can see your reports, it points to https://horusec.zup.com.br/

However this site returns a 403 - forbidden. Is there any way to see the report generated?

Thanks

Criar testes e2e da CLI rodando no windows

Unit tests for rules using horusec-engine

What would you like to be added:
In the rules package that is currently in the https://github.com/ZupIT/horusec/tree/master/development-kit/pkg/enums/engine/advisories location, there is no unit test to validate whether the rule is valid or not.

Why is this needed:
Ensuring good code quality

Adicionar health check e logs para serviço com grpc

Add C/C++ support

Add horusec-cli C/C++ support, you can use following some of these instructions:
Using horusec-engine:

Add NodeJS support

What would you like to be added:

Add horode-cli NodeJS support, you can use following some of these instructions:
Using horusec-engine:
* https://github.com/ZupIT/horusec/blob/master/HOWTO.md#adding-new-tool-using-horusec-engine
Using existing tool:
* https://github.com/ZupIT/horusec/blob/master/HOWTO.md#adding-security-tool

Building docker scan images in Azure DevOps: ## [error] Docker exec fail with exit code 127

What happened:
I'm trying to use the image: horuszup / horusec-cli in my Azure DevOps pipeline.
However the error occurs: "## [error] Docker exec fail with exit code 127"

How to reproduce it (as minimally and precisely as possible):
The code I am using in my yaml is basic:
"trigger:

master
jobs:
job: horusec_security
pool:
vmImage: 'ubuntu-latest'
container:
image: 'horuszup / horusec-cli' "

Anything else we need to know?:
Setting up Yaml in Azure DevOps

Environment:

Horusec version (use horusec version): Latest
Operating System: ubuntu-latest and ubustu-16.04
Network plugin / Tool and version (if this is a network-related / tool bug):
Others:

Parametrizar as imagens utilizadas para análise na CLI

Parametrizar registry das imagens docker
Parametrizar versão das imagens docker

sugestão: my-registry/my-image:version

Link to open file with vulnerability

What would you like to be added:
Add link of file with vulnerability when print output in terminal

File to edit
https://github.com/ZupIT/horusec/blob/master/horusec-cli/internal/controllers/printresults/print_results.go#L241

Custom Docker versions

What happened:
When running horusec on a machine that is using Microsofts fork of moby (Azure Kubernetes Service, GitHub Actions etc) it will fail because they use other versions.

It would be great if we either could make it configurable (skip version check) or that we add a specific check for the Docker version marked with the prefix "+azure".

What you expected to happen:
When running horusec on a machine with Microsoft fork, it won't start:

2020-11-01T14:44:47.9096474Z + docker --version
2020-11-01T14:44:47.9322280Z Docker version 3.0.13+azure, build dd360c7c0de8d9132a3965db6a59d3ae74f43ba7
2020-11-01T14:44:47.9330681Z + horusec start -p=./ -e=true
2020-11-01T14:44:48.0425625Z time="2020-11-01T14:44:48Z" level=error msg="{HORUSEC_CLI} Your docker version is below of: " error=19.3
2020-11-01T14:44:48.0426489Z time="2020-11-01T14:44:48Z" level=info msg="{HORUSEC_CLI} If your docker is not installed check in docs of how to install in:\n\t\thttps://docs.docker.com/get-docker\n\t"
2020-11-01T14:44:48.0427682Z time="2020-11-01T14:44:48Z" level=panic msg="{HORUSEC_CLI} Missing required DOCKER in min. version 19.03 to start" error="check the requirements for run and try again"
2020-11-01T14:44:48.0448274Z panic: (*logrus.Entry) 0xc000362310
2020-11-01T14:44:48.0448426Z 
2020-11-01T14:44:48.0449000Z goroutine 1 [running]:
2020-11-01T14:44:48.0449589Z github.com/sirupsen/logrus.Entry.log(0xc00011c000, 0xc0005be240, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
2020-11-01T14:44:48.0450066Z 	/home/wilian/go/src/github.com/ZupIT/horusec/vendor/github.com/sirupsen/logrus/entry.go:255 +0x325
2020-11-01T14:44:48.0450391Z github.com/sirupsen/logrus.(*Entry).Log(0xc0003622a0, 0x0, 0xc0005a9da8, 0x1, 0x1)
2020-11-01T14:44:48.0450705Z 	/home/wilian/go/src/github.com/ZupIT/horusec/vendor/github.com/sirupsen/logrus/entry.go:283 +0xf0
2020-11-01T14:44:48.0451009Z github.com/sirupsen/logrus.(*Entry).Panic(0xc0003622a0, 0xc0005a9da8, 0x1, 0x1)
2020-11-01T14:44:48.0451299Z 	/home/wilian/go/src/github.com/ZupIT/horusec/vendor/github.com/sirupsen/logrus/entry.go:321 +0x55
2020-11-01T14:44:48.0452245Z github.com/ZupIT/horusec/development-kit/pkg/utils/logger.LogPanicWithLevel(0xc6283c, 0x44, 0xdd6680, 0xc000060390, 0x0, 0x0, 0x0, 0x0)
2020-11-01T14:44:48.0452789Z 	/home/wilian/go/src/github.com/ZupIT/horusec/development-kit/pkg/utils/logger/logger.go:99 +0x125
2020-11-01T14:44:48.0453311Z github.com/ZupIT/horusec/horusec-cli/internal/controllers/requirements.(*Requirements).ValidateDocker(0xc0005a9f68)
2020-11-01T14:44:48.0453872Z 	/home/wilian/go/src/github.com/ZupIT/horusec/horusec-cli/internal/controllers/requirements/requirements.go:43 +0x8b
2020-11-01T14:44:48.0454332Z main.main()
2020-11-01T14:44:48.0454969Z 	/home/wilian/go/src/github.com/ZupIT/horusec/horusec-cli/cmd/horusec/main.go:60 +0x49
2020-11-01T14:44:48.0483833Z 
2020-11-01T14:44:48.0534364Z ##[error]Bash exited with code '2'.
2020-11-01T14:44:48.0547725Z ##[section]Finishing: Code scan

How to reproduce it (as minimally and precisely as possible):
In my case this happens on Azure Kubernetes Service, but may also be possible to reproduce on GitHub Actions.

Anything else we need to know?:
Read about it here: https://github.community/t/what-really-is-docker-3-0-6/16171/2

Environment:

Horusec version (use horusec version): 1.4.0
Operating System: Ubuntu 18.04
Network plugin / Tool and version (if this is a network-related / tool bug): N/A
Others: N/A

Building docker scan images locally

Hy guys!
I've tested my project after updating horusec-cli to v1.4.2
And it's works like a charm!

But I have a question.
What should i do to forse cli to build scan images locally without requesting to your dockerhub repo?

What would you like to be added:
Feature to build scan images locally...

Why is this needed:
It can be useful for some companies in order to increase the level of security...

By the way, if you show me the vector,
I think, i can do it by myself.
I not very well in GO, but i have some expirence in Python.
So i want to try!

Many thanks in advance!

improve leaks rules to decrease the amount of false positive reported

Replace moment.js to date-fns

improve log rules

Add NetCore 3.x rules using horusec-engine

What would you like to be added:

Create a horusec-netcore3 for horus-cli by following this instructions:
https://github.com/ZupIT/horusec/blob/master/HOWTO.md#adding-new-tool-using-horusec-engine

Allow passing false positives as an array in the horusec-config.json file

Summary
Currently, the horusec-config.json file allows the ReferenceHashes of the false positives to be passed through horusecCliFalsePositiveHashes key. But the documentation specifies that they are separated by a comma in a single string, making this string very long if they have many false positives.
It would be interesting if it were possible to pass an array of strings instead of a single string.

What would you like to be added:
Allow passing false positives as an array in the horusec-config.json file

Why is this needed:
To facilitate readability and maintenance of the horusec-config.json file

test

What happened:

What you expected to happen:

How to reproduce it (as minimally and precisely as possible):

Anything else we need to know?:

Environment:

Horusec version (use horusec version):
Operating System:
Network plugin / Tool and version (if this is a network-related / tool bug):
Others:

Bash support

https://github.com/koalaman/shellcheck
https://github.com/shellspec/shellspec
https://github.com/Vimjas/vint

re-estimar caso ferramentas não atenda nossas necessidades

horusec-cli default flag

What happened:

The folder selected is: [/home/my_project_folder]. Proceed? [Y/n]: YY
ERRO[0001] {HORUSEC_CLI} Error when ask if can run prompt question  error="{HORUSEC_CLI} Operation was canceled by user"
Error: {HORUSEC_CLI} Operation was canceled by user

What you expected to happen:
The command UI can't set the option, just accept a new option or choose deafult method when no options is setted.

How to reproduce it (as minimally and precisely as possible):
just make install and horusec start in my project.

Anything else we need to know?:
Probably something is wrong with the Command UI pkg.

Environment:

Horusec version (use horusec version): 1.4.0
Operating System: Arch Manjaro

Scan failed with traceback

Hello, guys!
Firsly, I want to say, what you have done awesome work!
UI like a space)

What happened:
But I have trouble, while using your horusec-cli tool.
I was scannig my java project, containig such patter:

    case ZERO_OR_ONE: {
        // If repetition is 0 or 1 (optional), then check if next byte is a 0, which means field is absent or 1, which means
        // field is present. Otherwise, throw an Exception.
        final int nextByte = in.read();
        if (nextByte == -1) {
            throw new EOFException("Unexpected End-of-File when attempting to read Repetition value for field '" + field.getFieldName() + "'");
        }
        if (nextByte == 0) {
            return null;
        }
        if (nextByte != 1) {
            throw new IOException("Invalid Boolean value found when reading 'Repetition' of field '" + field.getFieldName() + "'. Expected 0 or 1 but got " + (nextByte & 0xFF));
    }

So, my scan
horusec start -p=/horusec/horusec/test-trouble --log-level debug
faild after testig mentiond lines with this traceback:

user@pc:/horusec/horusec$ horusec start -p="/horusec/horusec/test-trouble" --log-level debug
DEBU[0000] {HORUSEC_CLI} The current configuration for this analysis are:{
  "ConfigFilePath": "/horusec/horusec/horusec-config.json",
  "HorusecAPIUri": "http://localhost:8000",
  "TimeoutInSecondsRequest": 300,
  "IsTimeout": false,
  "TimeoutInSecondsAnalysis": 600,
  "MonitorRetryInSeconds": 15,
  "RepositoryAuthorization": "00000000-0000-0000-0000-000000000000",
  "PrintOutputType": "text",
  "JSONOutputFilePath": "",
  "TypesOfVulnerabilitiesToIgnore": "",
  "FilesOrPathsToIgnore": "**/e2e/**, **/examples/**, **/*.toml, **/*_test.go, **/*_mock.go, **/*README.md, **/development-kit/pkg/enums/engine/advisories/**, **/horusec-lp/.cache/**, **/horusec-lp/public/**, **/deployments/docker-compose*, **/horusec-cli/cmd/horusec/start/analysis/*",
  "ReturnErrorIfFoundVulnerability": false,
  "ProjectPath": "/horusec/horusec/test-trouble",
  "WorkDir": {
    "go": [],
    "netCore": [],
    "ruby": [],
    "python": [],
    "java": [],
    "kotlin": [],
    "javaScript": [],
    "leaks": [],
    "hcl": []
  },
  "FilterPath": "",
  "EnableGitHistoryAnalysis": false,
  "CertInsecureSkipVerify": false,
  "CertPath": "",
  "EnableCommitAuthor": false,
  "RepositoryName": "",
  "FalsePositiveHashes": "a3661718648379e90547895725ad5e1d8021aa48f105ae236427972957a2705f, b17a7ef9ebf374c594700c1bfbf9d3594de68f0fc23af6171269f1f629a8abcf, 0870cfa59cfe7ef087e45762ce1d66cb6fdc85196323fcfae2e90167f242e4b3, df6ef9f4024c6e04bb13de530110e419fefdc0c4370c1e4c04a5a757af799401, 3198f2595d15ba1a01174329c944e3af9f7b3a7af7914e857eb9b82684633236, b85977d0bc430b00f17bc9f431d70b272110afea2549ee41bf03369bf99572d2, 312a4ee6b6b74a8c667e6f907568d9feaa0f0a69091f322abbcdf0562b9a3914, a452ff6d2565d67f118c80866a38a25871606751421347211b8932eb55aed85b, 3a0c53aae9a54d01e97417f2e495ca74c1f8874b0e4805fc622e50f7633838a8",
  "RiskAcceptHashes": "ba56b6e4ac8f790026b82a488c5624d7e2d6f6dd60584a9375c3c8948b608dbf, 2ce87bddc40e085562618f441750eeefe3cffc79d0b05b2e07a98f644c55b2c5, e2eaa19612eed0124b1fec396f8d41381c618c677c2025fc07c1cd0ccbe92b3c, 2b156198552b17c44bab579d68b8cb4204789859ef69a37a7a11e65667cbc66f, 0ffc51a6b0187bec02837cb1e8dddfa05519e83d861af3fbd553bc4d0fbe852d, 4294bf00b848d82c4e012f45e0747996eb75109e089a626af930580a7a179ea4, 4c7ad6feac210f7c447cd65756e08dd5df96d4070545cdc76c5bfaec846b8fe7, de76819bfffe3282f388c1db1421b6378c2a1e450d058d1fb64d6dc1177703b6, f48ffee4aa54549ef31150fbcd75a28e62a17d4b890859dd90cf2f52c34aa936, fa41e0534388707279458969d1dcdb58ff932357660e8855d2bb4170fdbcb391"
} 
DEBU[0000] {HORUSEC_CLI} The file ou folder was ignored to send analysis:[/horusec/horusec/test-trouble/src/.horusec/223de0af-15c0-44f5-b9dd-67aa4a995aa0] 
DEBU[0000] {HORUSEC_CLI} The file ou folder was ignored to send analysis:[/horusec/horusec/test-trouble/src/.horusec/223de0af-15c0-44f5-b9dd-67aa4a995aa0/.horusec] 
DEBU[0000] {HORUSEC_CLI} The file ou folder was ignored to send analysis:[/horusec/horusec/test-trouble/src/.horusec/223de0af-15c0-44f5-b9dd-67aa4a995aa0/bug.java] 
DEBU[0000] {HORUSEC_CLI} The file ou folder was ignored to send analysis:[/horusec/horusec/test-trouble/src/.horusec/223de0af-15c0-44f5-b9dd-67aa4a995aa0/output-223de0af-15c0-44f5-b9dd-67aa4a995aa0.json] 

WARN[0000] {HORUSEC_CLI} When starting the analysis WE SKIP A TOTAL OF 4 FILES that are not considered to be analyzed. To see more details use flag --log-level=debug 

WARN[0000] {HORUSEC_CLI} PLEASE DON'T REMOVE ".horusec" FOLDER BEFORE THE ANALYSIS FINISH! Don’t worry, we’ll remove it after the analysis ends automatically! Project sent to folder in location: [/horusec/horusec/test-trouble/.horusec/56da7ee3-873e-49d3-9e33-d0d2aebce069] 

INFO[0000] Hold on! Horusec still analysis your code. Timeout in: 600s 
DEBU[0000] {HORUSEC_CLI} Running HorusecJava in analysisID: [56da7ee3-873e-49d3-9e33-d0d2aebce069] 
DEBU[0000] {HORUSEC_CLI} Running HorusecLeaks in analysisID: [56da7ee3-873e-49d3-9e33-d0d2aebce069] 
DEBU[0000] {HORUSEC_CLI} Docker pull new image: [map[analysisId:56da7ee3-873e-49d3-9e33-d0d2aebce069 image:horuszup/horusec-leaks:v0.2.3]] 
DEBU[0000] {HORUSEC_CLI} Docker pull new image: [map[analysisId:56da7ee3-873e-49d3-9e33-d0d2aebce069 image:horuszup/horusec-java:v0.3.3]] 
DEBU[0000] {HORUSEC_CLI} Docker download new image with success: [map[analysisId:56da7ee3-873e-49d3-9e33-d0d2aebce069 image:horuszup/horusec-java:v0.3.3]] 
DEBU[0000] {HORUSEC_CLI} Docker download new image with success: [map[analysisId:56da7ee3-873e-49d3-9e33-d0d2aebce069 image:horuszup/horusec-leaks:v0.2.3]] 
DEBU[0000] {HORUSEC_CLI} Docker create new container: [map[analysisId:56da7ee3-873e-49d3-9e33-d0d2aebce069 containerId:cf8745ade3f37011b40f145bbf56f88de8a04b54a8a22499a869de46c14cc61d image:horuszup/horusec-java:v0.3.3]] 
DEBU[0000] {HORUSEC_CLI} Docker wait container up...[map[analysisId:56da7ee3-873e-49d3-9e33-d0d2aebce069 containerId:cf8745ade3f37011b40f145bbf56f88de8a04b54a8a22499a869de46c14cc61d image:]] 
DEBU[0000] {HORUSEC_CLI} Docker create new container: [map[analysisId:56da7ee3-873e-49d3-9e33-d0d2aebce069 containerId:fe383e274bba0bb9ebcf6a2d034f24643c385b5bbc676a0a1d68e1d54febfe0a image:horuszup/horusec-leaks:v0.2.3]] 
DEBU[0000] {HORUSEC_CLI} Docker wait container up...[map[analysisId:56da7ee3-873e-49d3-9e33-d0d2aebce069 containerId:fe383e274bba0bb9ebcf6a2d034f24643c385b5bbc676a0a1d68e1d54febfe0a image:]] 
DEBU[0000] {HORUSEC_CLI} Docker read container output: [map[analysisId:56da7ee3-873e-49d3-9e33-d0d2aebce069 image:horuszup/horusec-leaks:v0.2.3]] 
DEBU[0001] {HORUSEC_CLI} Docker read container output: [map[analysisId:56da7ee3-873e-49d3-9e33-d0d2aebce069 image:horuszup/horusec-java:v0.3.3]] 
DEBU[0005] {HORUSEC_CLI} Docker Finished analysis with SUCCESS: [map[analysisId:56da7ee3-873e-49d3-9e33-d0d2aebce069 image:horuszup/horusec-leaks:v0.2.3]] 
DEBU[0005] {HORUSEC_CLI} HorusecLeaks is finished in analysisID: [56da7ee3-873e-49d3-9e33-d0d2aebce069] 
DEBU[0005] {HORUSEC_CLI} When format Output it's Empty![map[tool:HorusecLeaks]] 
DEBU[0006] {HORUSEC_CLI} Docker Finished analysis with SUCCESS: [map[analysisId:56da7ee3-873e-49d3-9e33-d0d2aebce069 image:horuszup/horusec-java:v0.3.3]] 
DEBU[0006] {HORUSEC_CLI} HorusecJava is finished in analysisID: [56da7ee3-873e-49d3-9e33-d0d2aebce069] 
panic: runtime error: slice bounds out of range [168:165]

goroutine 29 [running]:
github.com/ZupIT/horusec/horusec-cli/internal/services/formatters.(*Service).GetCodeWithMaxCharacters(0xc0004ec700, 0xc000fcc0b0, 0xa5, 0xa8, 0xc, 0xc000ffdb80)
	/home/wilian/go/src/github.com/ZupIT/horusec/horusec-cli/internal/services/formatters/service.go:147 +0x97
github.com/ZupIT/horusec/horusec-cli/internal/services/formatters/java/horusecjava.(*Formatter).setupVulnerabilitiesSeverities(0xc0004f8880, 0xc000f66400, 0x1, 0x4, 0x0, 0xc00110e370)
	/home/wilian/go/src/github.com/ZupIT/horusec/horusec-cli/internal/services/formatters/java/horusecjava/formatter.go:119 +0x15a
github.com/ZupIT/horusec/horusec-cli/internal/services/formatters/java/horusecjava.(*Formatter).setOutputInHorusecAnalysis(0xc0004f8880, 0xc000f66400, 0x1, 0x4, 0xc000f66400, 0x1)
	/home/wilian/go/src/github.com/ZupIT/horusec/horusec-cli/internal/services/formatters/java/horusecjava/formatter.go:96 +0x8a
github.com/ZupIT/horusec/horusec-cli/internal/services/formatters/java/horusecjava.(*Formatter).formatOutput(0xc0004f8880, 0xc00015c400, 0x388, 0xb946d4, 0xb)
	/home/wilian/go/src/github.com/ZupIT/horusec/horusec-cli/internal/services/formatters/java/horusecjava/formatter.go:82 +0x24d
github.com/ZupIT/horusec/horusec-cli/internal/services/formatters/java/horusecjava.(*Formatter).startHorusecJavaAnalysis(0xc0004f8880, 0x0, 0x0, 0x0, 0x0)
	/home/wilian/go/src/github.com/ZupIT/horusec/horusec-cli/internal/services/formatters/java/horusecjava/formatter.go:58 +0x23e
github.com/ZupIT/horusec/horusec-cli/internal/services/formatters/java/horusecjava.(*Formatter).StartAnalysis(0xc0004f8880, 0x0, 0x0)
	/home/wilian/go/src/github.com/ZupIT/horusec/horusec-cli/internal/services/formatters/java/horusecjava/formatter.go:44 +0x45
created by github.com/ZupIT/horusec/horusec-cli/internal/controllers/analyser.(*Analyser).detectVulnerabilityJava
	/home/wilian/go/src/github.com/ZupIT/horusec/horusec-cli/internal/controllers/analyser/analyser.go:209 +0x85

What you expected to happen:

I suppose this is not normal behavior.

How to reproduce it (as minimally and precisely as possible):

You should try to scan mentiont pattern.

Anything else we need to know?:

I think no

Environment:

Horusec version (use horusec version):

user@pc:/horusec/horusec$ horusec version
Actual version installed of the horusec is: v1.4.1

Operating System:
ubuntu 20.04 lts
Network plugin / Tool and version (if this is a network-related / tool bug):
No
Others:
No

horusec rules test landing page

Add PHP support

Add horusec-cli PHP support, you can use following some of these instructions:
Using horusec-engine:

Or integrate the existed option:

https://github.com/FloeDesignTechnologies/phpcs-security-audit

Horusec CI/CD

What happened:
When running horusec in Github actions I don't have an option to send the result to another database. I know that the flag -u=analysis_engine_address point for a remote engine, but I just want to point to a database, the analysis can be done in the pipeline.

teste

Java code with hardcoded credentials

What happened:

We are evaluating horusec using a Java project that have hardcoded credentials on it. When we run the analysis, horusec did not warned us the use of hardcoded credentials on our java file. Maybe we are missing some configuration, so I'm opening this issue to discuss the code below and to understand if it should be reported as a security issue by the horusec analysis.

This is the code with hardcoded credentials:

@Slf4j
@Service
public class ExampleService {

    private static final String P = "testhorusecpwd";

    private final ExampleFactory exampleFactory;

    public ExampleService(ExampleFactory exampleFactory) {
        this.exampleFactory = exampleFactory;
    }

    public ExampleResponse create(ExampleRequest request) {
        Example example = exampleFactory.toExample(request);

        ClientRequest clientRequest = exampleFactory.toClientRequest(example);

        ExampleResponse exampleResponse = new ExampleResponse();
        exampleResponse.setMessage(String.format("Document '%s' sent to Kafka", clientRequest.getCpf()));

        String url = "jdbc:mysql://localhost/test";
        String u = "horusroot";

        try {
            getConn(url, u, P);
        } catch (SQLException e) {
            log.error(e.getMessage());
        }

        return exampleResponse;
    }

    public static void getConn(String url, String v, String q) throws SQLException {
        DriverManager.getConnection(url, v, q);
    }
}

In this example we are setting a plain text password and using it to open a database connection. Shouldn't horusec identify these lines as a security issue?

Environment:

Horusec version: 1.5.0
Operating System: Ubuntu 18.04

Change an organization's description

When changing an organization's description, it is not being saved to the backend.

Note: It only happens when you edit an existing description, when you delete it.

Makefile scripts not interpreting env variables

What happened:
Horusec reported a hardcoded password in a Makefile that was using an external env variable. One example error below:

Language: Leaks
Severity: HIGH
Line: 19
Column: 11
SecurityTool: HorusecLeaks
Confidence: HIGH
File: Makefile
Code: GIT_REMOTE=***github.com/ZupIT/ritchie-cli
Details: Password found in a hardcoded URL
A password was found in a hardcoded URL, this can lead to not only the leak of this password but also a failure point to some more sophisticated CSRF and SSRF attacks. Check CWE-352 (https://cwe.mitre.org/data/definitions/352.html) and CWE-918 (https://cwe.mitre.org/data/definitions/918.html) for more details.
Type: Vulnerability
ReferenceHash: e6b6b327efae6f8f8a846b603f143cbaad7c1c288b7f58b41605097e6e8456f5

The actual code implementation is
GIT_REMOTE=https://$(GIT_USERNAME):$(GIT_PASSWORD)@github.com/ZupIT/ritchie-cli
Where GIT_PASSWORD is not previously declared anywhere in the project

What you expected to happen:
Injected env variables should not present a security risk

How to reproduce it (as minimally and precisely as possible):
Create a makefile that exposes a url with password substituted by an env
i.e.: GIT_REMOTE=https://$(GIT_USERNAME):$(GIT_PASSWORD)@github.com/ZupIT/ritchie-cli

Environment:

Horusec version (use horusec version): v1-5-0
Operating System: Linux x64
Network plugin / Tool and version (if this is a network-related / tool bug):
Others:

Test Leaks engine rules

What would you like to be added:

Create tests for Leaks analyse rules
https://github.com/ZupIT/horusec/blob/master/development-kit/pkg/engines/leaks/rules/rules_test.go

Horusec Github Actions

Some tools for GitHub actions show errors separate by line and can point to the specific line in the code, I do'nt know who it's wokin the github actions, but if anyone give me direction, I can work in this issue.

Today running horusec -e="true" give just one error in the action and it's not so good for read.

Adding Table of Content to Readme.md

What would you like to be added:

The idea for Adding Table of Content to Readme.md to add additional enhancement and readability to the docs file.

Why is this needed:

TOC is very useful to hop between the docs/info of the readme and avoids useless scrolling.

@nathanmartinszup / @wiliansilvazup do assign this issue to me after approval :)

Test Java engine rules

What would you like to be added:

Create tests for java analyse rules

https://github.com/ZupIT/horusec/blob/master/development-kit/pkg/engines/java/rules/rules_test.go

Verificar documentação de variáveis de ambiente do horusec-manager

Linkify the url of details of vulnerabilities in horusec-manager.

Add dependency analysis support

https://snyk.io/vuln

Melhorar forma de passar variáveis de ambiente para o horusec-manager

Test Kotlin engine rules

What would you like to be added:

Create tests for Kotlin analyse rules
https://github.com/ZupIT/horusec/blob/master/development-kit/pkg/engines/kotlin/rules/rules_test.go

Semantic Analysis

What happened:

We're evaluating Horusec, conducting tests in order to understand how we can implement the solution in our project.
According to what had already been treated through: #159
We were reported that the solution works with syntactic analysis, but doesn't include semantic analysis.
Important is the possibility of semantic analysis so that it is possible to identify and "correlate" variables.

Example:

Is there a roadmap or target date for the semantic analysis to be covered?

Environment:

Horusec version: 1.5.0
Operating System: Ubuntu 18.04

git clone https://github.com/ZupIT/horusec.git
make install**:

Anything else we need to know?:

Environment:

Horusec version (use horusec version): 1.6.1
Operating System: Ubuntu 20.04.1 kernel 5.4.0-1029-aws
Others: docker-compose 1.25.0 , docker 20.10.1

zupit / horusec Goto Github PK

horusec's Introduction

Table of contents

1. About

2. Getting started

2.1. Requirements

2.2. Installation

3. Usage

3.1. CLI Usage

3.2. Using Docker

3.3. Older versions

3.4. Using Horusec-Web application

3.5. Using Visual Studio Code

3.6. Using the Pipeline

4. Documentation

5. Roadmap

6. Contributing

7. Code of Conduct

8. License

9. Community

About

See an Output example:

Getting started

Requirements

Installing Horusec

Mac or Linux

Check the installation

Windows

Check the installation

And more

Usage

CLI Usage

Using Docker

Older versions

Mac or Linux

Windows

Using Horusec-Web application

Using Visual Studio Code

Using the Pipeline

Features

Documentation

Roadmap

Contributing

Developer Certificate of Origin - DCO

Code of Conduct

License

Community

horusec's People

Contributors

Stargazers

Watchers

Forkers

horusec's Issues

Recommend Projects

Recommend Topics

Recommend Org