Skip to content

Services (Missconfiguration) scan for source code #815

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
attiasas wants to merge 26 commits into
base: dev
Choose a base branch
from
Open

Services (Missconfiguration) scan for source code #815

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
26 commits
Select commit Hold shift + click to select a range
b8f0f8e
Update require deps, add basic test data
attiasas Jul 28, 2026
6845baa
Add new flags and sub scan type
attiasas Jul 28, 2026
dd906ab
Add new services scanner
attiasas Jul 28, 2026
a3b70ec
Update config profile tests after dep update changes
attiasas Jul 28, 2026
b3f488f
Add scanner to JAS runner and pass to results
attiasas Jul 28, 2026
59e7203
move test data to required location
attiasas Jul 28, 2026
1a34136
Remove default '.git' exclude from scans so services can detect issues
attiasas Jul 28, 2026
6ca617d
Handle services violation
attiasas Jul 28, 2026
0df1137
Prepare for parsing Services results to all formats
attiasas Jul 28, 2026
0a94878
Handle parsing to SARIF format
attiasas Jul 28, 2026
ce5b161
Handle parsing to Simple-Json format
attiasas Jul 28, 2026
e42d92a
Handle parsing to Table format
attiasas Jul 28, 2026
af17630
Handle parsing to CycloneDx format
attiasas Jul 28, 2026
107fbd7
Handle parsing to Summary format
attiasas Jul 28, 2026
f86d462
Output services results
attiasas Jul 28, 2026
e7cd387
Merge remote-tracking branch 'upstream/dev' into services-sub-scan-so…
attiasas Jul 28, 2026
972c31f
Add test cover for changes
attiasas Jul 29, 2026
4e30a38
add more integration tests
attiasas Jul 29, 2026
8b911c5
Merge remote-tracking branch 'upstream/dev' into services-sub-scan-so…
attiasas Jul 29, 2026
19a015b
fix tests
attiasas Jul 29, 2026
af2658c
Fix more tests
attiasas Jul 29, 2026
de2d507
Merge remote-tracking branch 'upstream/dev' into services-sub-scan-so…
attiasas Jul 30, 2026
d9c749a
Update CDX id for services to match Secrets
attiasas Jul 30, 2026
cfe9b21
add status to simple json
attiasas Jul 30, 2026
0a535ad
update notes
attiasas Jul 30, 2026
1ffb829
update notes
attiasas Jul 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 14 additions & 14 deletions audit_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -513,9 +513,9 @@ func TestXrayAuditMultiProjects(t *testing.T) {
}
output := securityTests.PlatformCli.WithoutCredentials().RunCliCmdWithOutput(t, getAuditCmdArgs(params)...)
validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{
Total: &validations.TotalCount{Vulnerabilities: 43},
Total: &validations.TotalCount{Vulnerabilities: 49},
Vulnerabilities: &validations.VulnerabilityCount{
ValidateScan: &validations.ScanCount{Sca: 27, Sast: 1, Iac: 9, Secrets: 6},
ValidateScan: &validations.ScanCount{Sca: 27, Sast: 1, Iac: 9, Secrets: 6, Services: 6},
ValidateApplicabilityStatus: &validations.ApplicabilityStatusCount{Applicable: 3, NotCovered: 22, NotApplicable: 2},
},
})
Expand Down Expand Up @@ -783,9 +783,9 @@ func TestXrayAuditJasSimpleJson(t *testing.T) {
Format: format.SimpleJson,
})
validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{
Total: &validations.TotalCount{Vulnerabilities: 23},
Total: &validations.TotalCount{Vulnerabilities: 29},
Vulnerabilities: &validations.VulnerabilityCount{
ValidateScan: &validations.ScanCount{Sca: 7, Sast: 1, Iac: 9, Secrets: 6},
ValidateScan: &validations.ScanCount{Sca: 7, Sast: 1, Iac: 9, Secrets: 6, Services: 6},
ValidateApplicabilityStatus: &validations.ApplicabilityStatusCount{Applicable: 3, Undetermined: 1, NotCovered: 1, NotApplicable: 2},
},
})
Expand Down Expand Up @@ -813,9 +813,9 @@ func TestXrayAuditJasSimpleJsonWithOneThread(t *testing.T) {
Format: format.SimpleJson,
})
validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{
Total: &validations.TotalCount{Vulnerabilities: 23},
Total: &validations.TotalCount{Vulnerabilities: 29},
Vulnerabilities: &validations.VulnerabilityCount{
ValidateScan: &validations.ScanCount{Sca: 7, Sast: 1, Iac: 9, Secrets: 6},
ValidateScan: &validations.ScanCount{Sca: 7, Sast: 1, Iac: 9, Secrets: 6, Services: 6},
ValidateApplicabilityStatus: &validations.ApplicabilityStatusCount{Applicable: 3, Undetermined: 1, NotCovered: 1, NotApplicable: 2},
},
})
Expand Down Expand Up @@ -922,7 +922,7 @@ func TestXrayAuditNotEntitledForJasWithXrayUrl(t *testing.T) {
validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{
Total: &validations.TotalCount{Vulnerabilities: 8},
Vulnerabilities: &validations.VulnerabilityCount{
ValidateScan: &validations.ScanCount{Sca: 8, Sast: 0, Iac: 0, Secrets: 0},
ValidateScan: &validations.ScanCount{Sca: 8, Sast: 0, Iac: 0, Secrets: 0, Services: 0},
},
})
}
Expand All @@ -934,9 +934,9 @@ func TestXrayAuditJasSimpleJsonWithXrayUrl(t *testing.T) {
Format: format.SimpleJson,
})
validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{
Total: &validations.TotalCount{Vulnerabilities: 24},
Total: &validations.TotalCount{Vulnerabilities: 29},
Vulnerabilities: &validations.VulnerabilityCount{
ValidateScan: &validations.ScanCount{Sca: 7, Sast: 1, Iac: 9, Secrets: 6},
ValidateScan: &validations.ScanCount{Sca: 7, Sast: 1, Iac: 9, Secrets: 6, Services: 6},
ValidateApplicabilityStatus: &validations.ApplicabilityStatusCount{Applicable: 3, Undetermined: 1, NotCovered: 1, NotApplicable: 2},
},
})
Expand All @@ -951,9 +951,9 @@ func TestXrayAuditJasSimpleJsonWithCustomExclusions(t *testing.T) {
Format: format.SimpleJson,
})
validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{
Total: &validations.TotalCount{Vulnerabilities: 24},
Total: &validations.TotalCount{Vulnerabilities: 29},
Vulnerabilities: &validations.VulnerabilityCount{
ValidateScan: &validations.ScanCount{Sca: 7, Sast: 2, Iac: 9, Secrets: 6},
ValidateScan: &validations.ScanCount{Sca: 7, Sast: 2, Iac: 9, Secrets: 6, Services: 6},
ValidateApplicabilityStatus: &validations.ApplicabilityStatusCount{Applicable: 3, Undetermined: 1, NotCovered: 1, NotApplicable: 2},
},
})
Expand Down Expand Up @@ -993,7 +993,7 @@ func testAuditCommandNewSca(t *testing.T, params auditCommandTestParams, project
}
params.WithStaticSca = true
// No **/tests/** exclusion, we are scanning projects in the test resources path
params.CustomExclusion = []string{"*.git*", "*node_modules*", "*target*", "*venv*", "dist"}
params.CustomExclusion = []string{"*.git", "*node_modules*", "*target*", "*venv*", "dist"}
// Configure a new server named "default"
cleanUpHome := securityIntegrationTestUtils.UseTestHomeWithDefaultXrayConfig(t)
if params.Threads <= 0 {
Expand Down Expand Up @@ -1182,10 +1182,10 @@ func TestAuditNewScaCycloneDxPip(t *testing.T) {
)
assert.NoError(t, err)
validations.VerifyCycloneDxResults(t, output, validations.ValidationParams{
Total: &validations.TotalCount{Vulnerabilities: 22, BomComponents: 1 /*root*/ + 2 /*components*/ + 5 /*files (secrets)*/},
Total: &validations.TotalCount{Vulnerabilities: 28, BomComponents: 1 /*root*/ + 2 /*components*/ + 5 /*files (secrets)*/},
SbomComponents: &validations.SbomCount{Root: 1, Direct: 2},
Vulnerabilities: &validations.VulnerabilityCount{
ValidateScan: &validations.ScanCount{Sast: 2, Iac: 9, Secrets: 11},
ValidateScan: &validations.ScanCount{Sast: 2, Iac: 9, Secrets: 11, Services: 6},
},
})
}
Expand Down
15 changes: 9 additions & 6 deletions cli/docs/flags.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,12 +58,14 @@ const (
Iac = "iac"
Sast = "sast"
Secrets = "secrets"
Services = "services"
WithoutCA = "without-contextual-analysis"

auditSca = auditPrefix + Sca
auditIac = auditPrefix + Iac
auditSast = auditPrefix + Sast
auditSecrets = auditPrefix + Secrets
auditServices = auditPrefix + Services
auditWithoutCA = auditPrefix + WithoutCA
binarySca = scanPrefix + Sca
binarySecrets = scanPrefix + Secrets
Expand Down Expand Up @@ -210,7 +212,7 @@ var commandFlags = map[string][]string{
Url, XrayUrl, user, password, accessToken, ServerId, InsecureTls, scanProjectKey, Watches, RepoPath, Snippet, Sbom, Licenses, OutputFormat, ExcludeTestDeps,
useWrapperAudit, DepType, RequirementsFile, Fail, ExtendedTable, WorkingDirs, ExclusionsAudit, Mvn, Gradle, Npm,
Pnpm, Yarn, Go, Swift, Cocoapods, Nuget, Pip, Pipenv, Poetry, MinSeverity, FixableOnly, ThirdPartyContextualAnalysis, Threads,
auditSca, auditIac, auditSast, auditSecrets, auditWithoutCA, SecretValidation, ScanVuln, OutputDir, SkipAutoInstall, AllowPartialResults, MaxTreeDepth,
auditSca, auditIac, auditSast, auditSecrets, auditServices, auditWithoutCA, SecretValidation, ScanVuln, OutputDir, SkipAutoInstall, AllowPartialResults, MaxTreeDepth,
StaticSca, XrayLibPluginBinaryCustomPath, AnalyzerManagerCustomPath, UploadRtRepoPath, UseIncludedBuilds, AddSastRules,
},
UploadCdx: {
Expand All @@ -223,7 +225,7 @@ var commandFlags = map[string][]string{
scanProjectKey, Watches, Snippet, ScanVuln, Fail,
// Scan params
Threads, ExclusionsAudit, WorkingDirs, Workspace,
auditSca, auditIac, auditSast, auditSecrets, auditWithoutCA, SecretValidation, Sbom, UseConfigProfile,
auditSca, auditIac, auditSast, auditSecrets, auditServices, auditWithoutCA, SecretValidation, Sbom, UseConfigProfile,
// Output params
Licenses, OutputFormat, ExtendedTable, OutputDir, UploadRtRepoPath,
// Scan Logic params
Expand Down Expand Up @@ -359,10 +361,11 @@ var flagsMap = map[string]components.Flag{
binarySca: components.NewBoolFlag(Sca, fmt.Sprintf("Selective scanners mode: Execute SCA (Software Composition Analysis) sub-scan. Use --%s to run both SCA and Contextual Analysis. Use --%s --%s to to run SCA. Can be combined with --%s.", Sca, Sca, WithoutCA, Secrets)),
binarySecrets: components.NewBoolFlag(Secrets, fmt.Sprintf("Selective scanners mode: Execute Secrets sub-scan. Can be combined with --%s.", Sca)),
binaryWithoutCA: components.NewBoolFlag(WithoutCA, fmt.Sprintf("Selective scanners mode: Disable Contextual Analysis scanner after SCA. Relevant only with --%s flag.", Sca)),
auditSca: components.NewBoolFlag(Sca, fmt.Sprintf("Selective scanners mode: Execute SCA (Software Composition Analysis) sub-scan. Use --%s to run both SCA and Contextual Analysis. Use --%s --%s to to run SCA. Can be combined with --%s, --%s, --%s.", Sca, Sca, WithoutCA, Secrets, Sast, Iac)),
auditIac: components.NewBoolFlag(Iac, fmt.Sprintf("Selective scanners mode: Execute IaC sub-scan. Can be combined with --%s, --%s and --%s.", Sca, Secrets, Sast)),
auditSast: components.NewBoolFlag(Sast, fmt.Sprintf("Selective scanners mode: Execute SAST sub-scan. Can be combined with --%s, --%s and --%s.", Sca, Secrets, Iac)),
auditSecrets: components.NewBoolFlag(Secrets, fmt.Sprintf("Selective scanners mode: Execute Secrets sub-scan. Can be combined with --%s, --%s and --%s.", Sca, Sast, Iac)),
auditSca: components.NewBoolFlag(Sca, fmt.Sprintf("Selective scanners mode: Execute SCA (Software Composition Analysis) sub-scan. Use --%s to run both SCA and Contextual Analysis. Use --%s --%s to to run SCA. Can be combined with --%s, --%s, --%s and --%s.", Sca, Sca, WithoutCA, Secrets, Sast, Iac, Services)),
auditIac: components.NewBoolFlag(Iac, fmt.Sprintf("Selective scanners mode: Execute IaC sub-scan. Can be combined with --%s, --%s, --%s and --%s.", Sca, Secrets, Sast, Services)),
auditSast: components.NewBoolFlag(Sast, fmt.Sprintf("Selective scanners mode: Execute SAST sub-scan. Can be combined with --%s, --%s, --%s and --%s.", Sca, Secrets, Iac, Services)),
auditSecrets: components.NewBoolFlag(Secrets, fmt.Sprintf("Selective scanners mode: Execute Secrets sub-scan. Can be combined with --%s, --%s, --%s and --%s.", Sca, Sast, Iac, Services)),
auditServices: components.NewBoolFlag(Services, fmt.Sprintf("Selective scanners mode: Execute Services sub-scan. Can be combined with --%s, --%s, --%s and --%s.", Sca, Secrets, Sast, Iac)),
auditWithoutCA: components.NewBoolFlag(WithoutCA, fmt.Sprintf("Selective scanners mode: Disable Contextual Analysis scanner after SCA. Relevant only with --%s flag.", Sca)),
SecretValidation: components.NewBoolFlag(SecretValidation, fmt.Sprintf("Selective scanners mode: Triggers token validation on found secrets. Relevant only with --%s flag.", Secrets)),

Expand Down
4 changes: 2 additions & 2 deletions commands/audit/audit.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -293,14 +293,14 @@ func (auditCmd *AuditCommand) Run() (err error) {
func (auditCmd *AuditCommand) getResultWriter(cmdResults *results.SecurityCommandResults) *output.ResultsWriter {
var messages []string
if !cmdResults.Entitlements.Jas {
messages = []string{coreutils.PrintTitle("In addition to SCA, the ‘jf audit’ command supports the following Advanced Security scans: 'Contextual Analysis', 'Secrets Detection', 'IaC', and ‘SAST’.\nThese scans are available within Advanced Security license. Read more - ") + coreutils.PrintLink(utils.JasInfoURL)}
messages = []string{coreutils.PrintTitle("In addition to SCA, the ‘jf audit’ command supports the following Advanced Security scans: 'Contextual Analysis', 'Secrets Detection', 'IaC', 'Services', and ‘SAST’.\nThese scans are available within Advanced Security license. Read more - ") + coreutils.PrintLink(utils.JasInfoURL)}
}
if cmdResults.ResultsPlatformUrl != "" && auditCmd.gitContext != nil {
messages = append(messages, output.GetCommandResultsPlatformUrlMessage(cmdResults, true))
}
var tableNotes []string
if cmdResults.Entitlements.Jas && cmdResults.HasViolationContext() && len(cmdResults.ResultContext.GitRepoHttpsCloneUrl) == 0 {
tableNotes = []string{"Note: The following vulnerability violations are NOT supported by this audit:\n- Secrets\n- Infrastructure as Code (IaC)\n- Static Application Security Testing (SAST)"}
tableNotes = []string{"Note: The following vulnerability violations are NOT supported by this audit:\n- Secrets\n- Infrastructure as Code (IaC)\n- Services (Misconfiguration)\n- Static Application Security Testing (SAST)"}
}
return output.NewResultsWriter(cmdResults).
SetOutputFormat(auditCmd.OutputFormat()).
Expand Down
Loading
Loading