Skip to content

Add Analyzer subcommand

Lucas Charlesrequested to merge
expose-analyze-subcommand into master

What does this MR do?

It looks like we were missing an implementation for the analyze subcommand. This adds the command, bringing functionality up to date with the docs and allowing /analyzer analyze to be ran directly (if supported by the specific analyzer) to see the output of a given analyzer.

This can be really useful when convert functions need to be updated as the raw analyzer output of wrapper tools may change and require exploration to update correctly.

Example usage (using tslint):

❯ docker run --rm   --volume "$PWD"/test/fixtures:/tmp/project   --env CI_PROJECT_DIR=/tmp/project   analyzer   /analyzer
NAME:
   analyzer - TSLint analyzer for GitLab SAST

USAGE:
   analyzer [global options] command [command options] [arguments...]

VERSION:
   0.0.0

AUTHOR:
   GitLab

COMMANDS:
     run, r      Run the analyzer on detected project and generate a compatible artifact
     search, s   Search for compatible projects and return project directory
     analyze, a  Analyze detected project and generate report
     convert, c  Convert analyzer output to a compatible artifact
     help, h     Shows a list of commands or help for one command

GLOBAL OPTIONS:
   --help, -h     show help
   --version, -v  print the version

❯ docker run --rm   --volume "$PWD"/test/fixtures:/tmp/project   --env CI_PROJECT_DIR=/tmp/project   analyzer   /analyzer search /tmp/project
/tmp/project/src

❯ docker run --rm   --volume "$PWD"/test/fixtures:/tmp/project   --env CI_PROJECT_DIR=/tmp/project   analyzer   /analyzer analyze /tmp/project/src
[{"endPosition":{"character":12,"line":7,"position":209},"failure":"eval with argument of type Identifier","name":"main.ts","ruleName":"tsr-detect-eval-with-expression","ruleSeverity":"WARNING","startPosition":{"character":0,"line":7,"position":197}},{"end
Position":{"character":47,"line":14,"position":433},"failure":"Found non-literal argument to RegExp Constructor","name":"main.ts","ruleName":"tsr-detect-non-literal-regexp","ruleSeverity":"WARNING","startPosition":{"character":23,"line":14,"position":409}}
,{"endPosition":{"character":12,"line":3,"position":92},"failure":"Found non-literal argument in require","name":"main.ts","ruleName":"tsr-detect-non-literal-require","ruleSeverity":"WARNING","startPosition":{"character":0,"line":3,"position":80}},{"endPos
ition":{"character":21,"line":29,"position":906},"failure":"Potential timing attack on the right side of expression","name":"main.ts","ruleName":"tsr-detect-possible-timing-attacks","ruleSeverity":"WARNING","startPosition":{"character":4,"line":29,"positio
n":889}},{"endPosition":{"character":32,"line":10,"position":288},"failure":"Unsafe Regular Expression","name":"main.ts","ruleName":"tsr-detect-unsafe-regexp","ruleSeverity":"WARNING","startPosition":{"character":22,"line":10,"position":278}},{"endPosition
":{"character":21,"line":19,"position":584},"failure":"Markup escaping disabled","name":"main.ts","ruleName":"tsr-disable-mustache-escape","ruleSeverity":"WARNING","startPosition":{"character":0,"line":19,"position":563}},{"endPosition":{"character":27,"li
ne":24,"position":769},"failure":"Found Element.innerHTML with non-literal value","name":"main.ts","ruleName":"tsr-detect-html-injection","ruleSeverity":"WARNING","startPosition":{"character":0,"line":24,"position":742}}]

What are the relevant issue numbers?

Does this MR meet the acceptance criteria?

Merge request reports