search

pumasecurity / puma-scan

Puma Scan is a software security Visual Studio extension that provides real time, continuous source code analysis as development teams write code. Vulnerabilities are immediately displayed in the development environment as spell check and compiler warnings, preventing security bugs from entering your applications.
https://www.pumascan.com
Mozilla Public License 2.0
443 stars 82 forks source link

Using RoslynSDKgenerator jar is not getting created #59

Closed sodeshpa closed 5 years ago

sodeshpa commented 5 years ago

Unable to generate jar for PUMA Rules C:\SONAR\SonarQube.Roslyn.SDK-2.0>RoslynSonarQubePluginGenerator.exe /a:Puma.Security.Rules:2.1.0 /acceptLicenses

Output: C:\SONAR\SonarQube.Roslyn.SDK-2.0>RoslynSonarQubePluginGenerator.exe /a:Puma.Security.Rules:2.1.0 /acceptLicenses Roslyn Analyzer Plugin Generator for SonarQube 2.0.0.0 Maximum supported Roslyn version: 2.8.0.0 Minimum supported SonarQube version: 6.7 (highest version tested against: 7.3-alpha1) [DEBUG] Parsed NuGet reference. Id: Puma.Security.Rules, version: 2.1.0 [DEBUG] Fetching NuGet config files... [DEBUG] Enabled package sources: [DEBUG] https://www.nuget.org/api/v2/, machine-wide: False [DEBUG] C:\SONAR\SonarQube.Roslyn.SDK-2.0, machine-wide: False Attempting to locate package with id 'Puma.Security.Rules' [DEBUG] Number of packages located: 12 [DEBUG] Package versions: 2.0.0.1 1.0.2 1.0.6 1.0.7 1.0.0 1.0.5 1.0.1 2.0.0 1.0.3 1.0.4 2.1.0 - latest version 2.1.0 - latest version

[NuGet] Attempting to resolve dependency 'Microsoft.CodeAnalysis (≥ 2.9.0)'. [NuGet] Attempting to resolve dependency 'Microsoft.CodeAnalysis.CSharp.Workspaces (= 2.9.0)'. [NuGet] Attempting to resolve dependency 'Microsoft.CodeAnalysis.CSharp (= 2.9.0)'. [NuGet] Attempting to resolve dependency 'Microsoft.CodeAnalysis.Common (= 2.9.0)'. [NuGet] Attempting to resolve dependency 'Microsoft.CodeAnalysis.Analyzers (≥ 2.6.1)'. [NuGet] Attempting to resolve dependency 'System.AppContext (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Collections (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'Microsoft.NETCore.Platforms (≥ 1.1.0)'. [NuGet] Attempting to resolve dependency 'Microsoft.NETCore.Targets (≥ 1.1.0)'. [NuGet] Attempting to resolve dependency 'System.Runtime (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Resources.ResourceManager (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Globalization (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Reflection (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.IO (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Text.Encoding (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Threading.Tasks (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Reflection.Primitives (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Threading (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Collections.Concurrent (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Diagnostics.Debug (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Diagnostics.Tracing (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Runtime.Extensions (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Collections.Immutable (≥ 1.5.0)'. [NuGet] Attempting to resolve dependency 'NETStandard.Library (≥ 1.6.1)'. [NuGet] Attempting to resolve dependency 'System.Diagnostics.Tools (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Linq (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Linq.Expressions (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Reflection.Emit.ILGeneration (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Reflection.Emit.Lightweight (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Reflection.Extensions (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Reflection.TypeExtensions (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Diagnostics.Contracts (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.ObjectModel (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Reflection.Emit (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Net.Primitives (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Runtime.Handles (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Text.Encoding.Extensions (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Text.RegularExpressions (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Xml.ReaderWriter (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.IO.FileSystem (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.IO.FileSystem.Primitives (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Runtime.InteropServices (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Threading.Tasks.Extensions (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Xml.XDocument (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.IO.Compression (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'runtime.native.System.IO.Compression (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Buffers (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'runtime.native.System (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Net.Http (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Diagnostics.DiagnosticSource (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Security.Cryptography.X509Certificates (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Security.Cryptography.Algorithms (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Security.Cryptography.Primitives (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Security.Cryptography.Encoding (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'runtime.native.System.Security.Cryptography.OpenSsl (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography.OpenSsl (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.OpenSsl (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'runtime.rhel.7-x64.runtime.native.System.Security.Cryptography.OpenSsl (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'runtime.native.System.Security.Cryptography.Apple (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.Apple (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Runtime.Numerics (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Globalization.Calendars (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Security.Cryptography.Cng (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'runtime.native.System.Net.Http (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Security.Cryptography.Csp (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Security.Cryptography.OpenSsl (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Runtime.WindowsRuntime (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'Microsoft.Win32.Primitives (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Globalization.Extensions (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Runtime.InteropServices.RuntimeInformation (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Threading.Timer (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Console (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.IO.Compression.ZipFile (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Net.Sockets (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Diagnostics.FileVersionInfo (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Reflection.Metadata (≥ 1.4.1)'. [NuGet] Attempting to resolve dependency 'System.Diagnostics.StackTrace (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Dynamic.Runtime (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Reflection.Metadata (≥ 1.6.0)'. [NuGet] Attempting to resolve dependency 'System.Text.Encoding.CodePages (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Threading.Tasks.Parallel (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Threading.Thread (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.ValueTuple (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Xml.XmlDocument (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Xml.XPath.XDocument (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'System.Xml.XPath (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'Microsoft.CodeAnalysis.Workspaces.Common (= 2.9.0)'. [NuGet] Attempting to resolve dependency 'System.Composition (≥ 1.0.31)'. [NuGet] Attempting to resolve dependency 'System.Composition.AttributedModel (≥ 1.0.31)'. [NuGet] Attempting to resolve dependency 'System.Composition.Convention (≥ 1.0.31)'. [NuGet] Attempting to resolve dependency 'System.Composition.Hosting (≥ 1.0.31)'. [NuGet] Attempting to resolve dependency 'System.Composition.Runtime (≥ 1.0.31)'. [NuGet] Attempting to resolve dependency 'System.Composition.TypedParts (≥ 1.0.31)'. [NuGet] Attempting to resolve dependency 'System.Linq.Parallel (≥ 4.3.0)'. [NuGet] Attempting to resolve dependency 'SQLitePCLRaw.bundle_green (≥ 1.1.2)'. [NuGet] Attempting to resolve dependency 'SQLitePCLRaw.core (≥ 1.1.2)'. [NuGet] Attempting to resolve dependency 'SQLitePCLRaw.provider.e_sqlite3.android (≥ 1.1.2)'. [NuGet] Attempting to resolve dependency 'SQLitePCLRaw.lib.e_sqlite3.android (≥ 1.1.2)'. [NuGet] Attempting to resolve dependency 'SQLitePCLRaw.provider.sqlite3.ios_unified (≥ 1.1.2)'. [NuGet] Attempting to resolve dependency 'SQLitePCLRaw.provider.e_sqlite3.macos (≥ 1.1.2)'. [NuGet] Attempting to resolve dependency 'SQLitePCLRaw.lib.e_sqlite3.osx (≥ 1.1.2)'. [NuGet] Attempting to resolve dependency 'SQLitePCLRaw.provider.e_sqlite3.wpa81 (≥ 1.1.2)'. [NuGet] Attempting to resolve dependency 'SQLitePCLRaw.lib.e_sqlite3.v120_wp81 (≥ 1.1.2)'. [NuGet] Attempting to resolve dependency 'SQLitePCLRaw.provider.e_sqlite3.wp80 (≥ 1.1.2)'. [NuGet] Attempting to resolve dependency 'SQLitePCLRaw.lib.e_sqlite3.v110_wp80 (≥ 1.1.2)'. [NuGet] Attempting to resolve dependency 'SQLitePCLRaw.provider.e_sqlite3.win8 (≥ 1.1.2)'. [NuGet] Attempting to resolve dependency 'SQLitePCLRaw.lib.e_sqlite3.v110 (≥ 1.1.2)'. [NuGet] Attempting to resolve dependency 'SQLitePCLRaw.provider.e_sqlite3.win81 (≥ 1.1.2)'. [NuGet] Attempting to resolve dependency 'SQLitePCLRaw.lib.e_sqlite3.v120 (≥ 1.1.2)'. [NuGet] Attempting to resolve dependency 'SQLitePCLRaw.provider.e_sqlite3.uwp10 (≥ 1.1.2)'. [NuGet] Attempting to resolve dependency 'SQLitePCLRaw.lib.e_sqlite3.v140 (≥ 1.1.2)'. [NuGet] Attempting to resolve dependency 'SQLitePCLRaw.provider.e_sqlite3.net35 (≥ 1.1.2)'. [NuGet] Attempting to resolve dependency 'SQLitePCLRaw.lib.e_sqlite3.v110_xp (≥ 1.1.2)'. [NuGet] Attempting to resolve dependency 'SQLitePCLRaw.lib.e_sqlite3.linux (≥ 1.1.2)'. [NuGet] Attempting to resolve dependency 'SQLitePCLRaw.provider.e_sqlite3.net40 (≥ 1.1.2)'. [NuGet] Attempting to resolve dependency 'SQLitePCLRaw.provider.e_sqlite3.net45 (≥ 1.1.2)'. [NuGet] Attempting to resolve dependency 'SQLitePCLRaw.provider.e_sqlite3.netstandard11 (≥ 1.1.2)'. [NuGet] Attempting to resolve dependency 'Microsoft.CodeAnalysis.VisualBasic.Workspaces (= 2.9.0)'. [NuGet] Attempting to resolve dependency 'Microsoft.CodeAnalysis.VisualBasic (= 2.9.0)'. Failed to install package: External packages cannot depend on packages that target projects. Check that there are released versions of the package, or specify a pre-release version identifier. Can you please check why

ejohn20 commented 5 years ago

This looks like the culprit:

Output:
C:\SONAR\SonarQube.Roslyn.SDK-2.0>RoslynSonarQubePluginGenerator.exe /a:Puma.Security.Rules:2.1.0 /acceptLicenses
Roslyn Analyzer Plugin Generator for SonarQube 2.0.0.0
Maximum supported Roslyn version: 2.8.0.0

Our analyzers are using the .NET Compiler API (Roslyn) 2.9.

sodeshpa commented 5 years ago

So , could you tell me how to generate JAR for PUMA , googled around but do not find any way ..

Thanks

ejohn20 commented 5 years ago

Are you referring to a JAR file for Java? If so, I'm unaware of a way to do this. They are completely different technologies.

sodeshpa commented 5 years ago

yes ..But Roslyn sdk generator provides a mechanism to generate JAR from .net nupakge,

ejohn20 commented 5 years ago

This sounds like a question for the sonarqube-roslyn-sdk repository. I see that you have opened an issue over there: https://github.com/SonarSource/sonarqube-roslyn-sdk/issues/111. We've not done this with Puma before, but would be happy to document this path when you figure it out in our Wiki.

ejohn20 commented 5 years ago

Regarding your other questions:

For R&D purposes, I am writing a test analyzer based on PUMA ModeAnalyzer, SO I have created a sample project , and extracted few classes from PUMA project. The dll got built but the package was not created. Is it ok if I share demo project with you or I am ok to have short call as well.

I would suggest creating a new Analyzer + CodeFix project in Visual Studio. That will have the correct set up to automatically build the NuGet package. Then, you can drop in the new analyzers.

I am looking for analyzer for web.config without updating csproj with additionalfile tag. This is where I found PUMA and doing R&D around it.

Details here: https://github.com/dotnet/roslyn/issues/11097. To my knowledge, there is no way to scan additional files without modifying the .csproj file. You can add this line using a script automatically before scanning if you can't modify the file permanently.