Skip to content

🕸 Extend the Cascading-Scans Hook to generate custom labels or annotations for subsequent scans #430

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rfelber merged 12 commits into from
May 23, 2021
Merged

🕸 Extend the Cascading-Scans Hook to generate custom labels or annotations for subsequent scans #430

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
cebadbb
[dssh] Implement cascades.inheritLabels and cascades.inheritAnnotations
May 18, 2021
74b9c9e
[dssh] Implement CascadingRule.spec.scanLabels and CascadingRule.spec…
May 18, 2021
81e3cd1
[dssh] Make codeclimate happy
EndPositive May 18, 2021
09eace3
[dssh] Make codeclimate happy
EndPositive May 18, 2021
b84dcdd
[dssh] Add templating to CascadingRule.spec.scanLabels and CascadingR…
EndPositive May 18, 2021
cbd9140
[Operator] Add inheritLabels, inheritAnnotations, scanLabels and scan…
EndPositive May 21, 2021
ac53475
[DD] Add inheritLabels and inheritAnnotations to V1ScanSpecCascades
EndPositive May 21, 2021
937f08e
[dssh] Make codeclimate happy
EndPositive May 21, 2021
d63c17e
Merge branch 'main' into cascading_scans_custom_annotations
EndPositive May 21, 2021
26e3e9b
Merge branch 'main' into cascading_scans_custom_annotations
rfelber May 23, 2021
5eb1a07
Apply suggestions from code review
EndPositive May 23, 2021
cea7ed2
Merge branch 'main' into cascading_scans_custom_annotations
rfelber May 23, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
[dssh] Add templating to CascadingRule.spec.scanLabels and CascadingR… 
…ule.spec.scanLabels.
  • Loading branch information
@EndPositive
EndPositive committed May 18, 2021
commit b84dcdd70f76f5c91e57144528110bf95c7db727
47 changes: 47 additions & 0 deletions hooks/declarative-subsequent-scans/hook.test.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -737,3 +737,50 @@ test("should copy scanAnnotations from CascadingRule to cascading scan", () => {
cascadingScanDefinition.metadata.annotations[label] === value
)).toBe(true)
});

test("should properly parse template values in scanLabels and scanAnnotations", () => {
sslyzeCascadingRules[0].spec.scanAnnotations = {
k_one: "{{metadata.name}}",
k_two: "{{metadata.unknown_property}}",
k_three: "{{$.hostOrIP}}"
}

sslyzeCascadingRules[0].spec.scanLabels = {
k_one: "{{metadata.name}}",
k_two: "{{metadata.unknown_property}}",
k_three: "{{$.hostOrIP}}"
}

const findings = [
{
name: "Port 443 is open",
category: "Open Port",
attributes: {
state: "open",
hostname: "foobar.com",
port: 443,
service: "https"
}
}
];

const cascadedScans = getCascadingScans(
parentScan,
findings,
sslyzeCascadingRules
);

const { scanLabels, scanAnnotations } = cascadedScans[0]

// No snapshots as scanLabels/scanAnnotations can be in any order
const result = {
"k_one": "nmap-foobar.com",
"k_two": "",
"k_three": "foobar.com",
}

expect(scanLabels).toEqual(result)

expect(scanAnnotations).toEqual(result)
})

9 changes: 6 additions & 3 deletions hooks/declarative-subsequent-scans/hook.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
import { isMatch, isMatchWith, isString } from "lodash";
import { isMatch, isMatchWith, isString, mapValues } from "lodash";
import { isMatch as wildcardIsMatch } from "matcher";
import * as Mustache from "mustache";

Expand Down Expand Up @@ -92,6 +92,7 @@ export function getCascadingScans(

const templateArgs = {
...finding,
...parentScan,
// Attribute "$" hold special non finding helper attributes
$: {
hostOrIP:
Expand All @@ -108,8 +109,10 @@ export function getCascadingScans(
cascades: null,
generatedBy: cascadingRule.metadata.name,
env,
scanLabels: cascadingRule.spec.scanLabels === undefined ? {} : cascadingRule.spec.scanLabels,
scanAnnotations: cascadingRule.spec.scanAnnotations === undefined ? {} : cascadingRule.spec.scanAnnotations,
scanLabels: cascadingRule.spec.scanLabels === undefined ? {} :
mapValues(cascadingRule.spec.scanLabels, value => Mustache.render(value, templateArgs)),
scanAnnotations: cascadingRule.spec.scanAnnotations === undefined ? {} :
mapValues(cascadingRule.spec.scanAnnotations, value => Mustache.render(value, templateArgs)),
});
}
}
Expand Down