ShiftLeftSecurity / sast-scan

Scan is a free & Open Source DevSecOps tool for performing static analysis based security testing of your applications and its dependencies. CI and Git friendly.
https://discord.gg/DCNxzaeUpd
Apache License 2.0
790 stars 110 forks source link

Regression in .sastscanrc behavior for scan_type #326

Closed erichs closed 3 years ago

erichs commented 3 years ago

Versions 1.15.8 and previous support setting scan_type in a local .sastscanrc and Versions 2.0.0+ do not.

Given a local .sastscanrc (pulled from test/data/.sastscanrc):

{
    "build_break_rules": {
        "default": { "max_critical": 0, "max_high": 0, "max_medium": 0 }
    },
    "scan_tools_args_map": {
        "go": ["echo", "hello", "world"]
    },
    "scan_type": "credscan,java"
}

The following commands demonstrate the regression:

❯ docker run --rm -e SCAN_DEBUG_MODE=debug -e "WORKSPACE=${PWD}" -v ${PWD}:/app shiftleft/scan:v1.15.8 scan --mode ci --src /app 

███████╗ ██████╗ █████╗ ███╗   ██╗
██╔════╝██╔════╝██╔══██╗████╗  ██║
███████╗██║     ███████║██╔██╗ ██║
╚════██║██║     ██╔══██║██║╚██╗██║
███████║╚██████╗██║  ██║██║ ╚████║
╚══════╝ ╚═════╝╚═╝  ╚═╝╚═╝  ╚═══╝

[18:46:54] INFO     Scanning /app using plugins ['credscan', 'java'] 
...

^^^ Expected scan types seen

❯ docker run --rm -e SCAN_DEBUG_MODE=debug -e "WORKSPACE=${PWD}" -v ${PWD}:/app shiftleft/scan:v2.0.0 scan --mode ci --src /app 

███████╗ ██████╗ █████╗ ███╗   ██╗
██╔════╝██╔════╝██╔══██╗████╗  ██║
███████╗██║     ███████║██╔██╗ ██║
╚════██║██║     ██╔══██║██║╚██╗██║
███████║╚██████╗██║  ██║██║ ╚████║
╚══════╝ ╚═════╝╚═╝  ╚═╝╚═╝  ╚═══╝

[18:47:36] INFO     Scanning /app using plugins ['credscan', 'ts', 'nodejs', 'dockerfile', 'terraform', 'yaml', 'bash', 'depscan']          

^^^ auto-detected scan types, ignored scan_type setting of local config

erichs commented 3 years ago

Amazing! Ty, sir.