Services sub scan source code

audit_test.go

@@ -513,9 +513,9 @@ func TestXrayAuditMultiProjects(t *testing.T) {
 	}
 	output := securityTests.PlatformCli.WithoutCredentials().RunCliCmdWithOutput(t, getAuditCmdArgs(params)...)
 	validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{
-		Total: &validations.TotalCount{Vulnerabilities: 43},
+		Total: &validations.TotalCount{Vulnerabilities: 49},
 		Vulnerabilities: &validations.VulnerabilityCount{
-			ValidateScan:                &validations.ScanCount{Sca: 27, Sast: 1, Iac: 9, Secrets: 6},
+			ValidateScan:                &validations.ScanCount{Sca: 27, Sast: 1, Iac: 9, Secrets: 6, Services: 6},
 			ValidateApplicabilityStatus: &validations.ApplicabilityStatusCount{Applicable: 3, NotCovered: 22, NotApplicable: 2},
 		},
 	})
@@ -783,9 +783,9 @@ func TestXrayAuditJasSimpleJson(t *testing.T) {
 		Format: format.SimpleJson,
 	})
 	validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{
-		Total: &validations.TotalCount{Vulnerabilities: 23},
+		Total: &validations.TotalCount{Vulnerabilities: 29},
 		Vulnerabilities: &validations.VulnerabilityCount{
-			ValidateScan:                &validations.ScanCount{Sca: 7, Sast: 1, Iac: 9, Secrets: 6},
+			ValidateScan:                &validations.ScanCount{Sca: 7, Sast: 1, Iac: 9, Secrets: 6, Services: 6},
 			ValidateApplicabilityStatus: &validations.ApplicabilityStatusCount{Applicable: 3, Undetermined: 1, NotCovered: 1, NotApplicable: 2},
 		},
 	})
@@ -813,9 +813,9 @@ func TestXrayAuditJasSimpleJsonWithOneThread(t *testing.T) {
 		Format:  format.SimpleJson,
 	})
 	validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{
-		Total: &validations.TotalCount{Vulnerabilities: 23},
+		Total: &validations.TotalCount{Vulnerabilities: 29},
 		Vulnerabilities: &validations.VulnerabilityCount{
-			ValidateScan:                &validations.ScanCount{Sca: 7, Sast: 1, Iac: 9, Secrets: 6},
+			ValidateScan:                &validations.ScanCount{Sca: 7, Sast: 1, Iac: 9, Secrets: 6, Services: 6},
 			ValidateApplicabilityStatus: &validations.ApplicabilityStatusCount{Applicable: 3, Undetermined: 1, NotCovered: 1, NotApplicable: 2},
 		},
 	})
@@ -922,7 +922,7 @@ func TestXrayAuditNotEntitledForJasWithXrayUrl(t *testing.T) {
 	validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{
 		Total: &validations.TotalCount{Vulnerabilities: 8},
 		Vulnerabilities: &validations.VulnerabilityCount{
-			ValidateScan: &validations.ScanCount{Sca: 8, Sast: 0, Iac: 0, Secrets: 0},
+			ValidateScan: &validations.ScanCount{Sca: 8, Sast: 0, Iac: 0, Secrets: 0, Services: 0},
 		},
 	})
 }
@@ -934,9 +934,9 @@ func TestXrayAuditJasSimpleJsonWithXrayUrl(t *testing.T) {
 		Format: format.SimpleJson,
 	})
 	validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{
-		Total: &validations.TotalCount{Vulnerabilities: 24},
+		Total: &validations.TotalCount{Vulnerabilities: 29},
 		Vulnerabilities: &validations.VulnerabilityCount{
-			ValidateScan:                &validations.ScanCount{Sca: 7, Sast: 1, Iac: 9, Secrets: 6},
+			ValidateScan:                &validations.ScanCount{Sca: 7, Sast: 1, Iac: 9, Secrets: 6, Services: 6},
 			ValidateApplicabilityStatus: &validations.ApplicabilityStatusCount{Applicable: 3, Undetermined: 1, NotCovered: 1, NotApplicable: 2},
 		},
 	})
@@ -951,9 +951,9 @@ func TestXrayAuditJasSimpleJsonWithCustomExclusions(t *testing.T) {
 		Format:          format.SimpleJson,
 	})
 	validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{
-		Total: &validations.TotalCount{Vulnerabilities: 24},
+		Total: &validations.TotalCount{Vulnerabilities: 29},
 		Vulnerabilities: &validations.VulnerabilityCount{
-			ValidateScan:                &validations.ScanCount{Sca: 7, Sast: 2, Iac: 9, Secrets: 6},
+			ValidateScan:                &validations.ScanCount{Sca: 7, Sast: 2, Iac: 9, Secrets: 6, Services: 6},
 			ValidateApplicabilityStatus: &validations.ApplicabilityStatusCount{Applicable: 3, Undetermined: 1, NotCovered: 1, NotApplicable: 2},
 		},
 	})
@@ -993,7 +993,7 @@ func testAuditCommandNewSca(t *testing.T, params auditCommandTestParams, project
 	}
 	params.WithStaticSca = true
 	// No **/tests/** exclusion, we are scanning projects in the test resources path
-	params.CustomExclusion = []string{"*.git*", "*node_modules*", "*target*", "*venv*", "dist"}
+	params.CustomExclusion = []string{"*.git", "*node_modules*", "*target*", "*venv*", "dist"}
 	// Configure a new server named "default"
 	cleanUpHome := securityIntegrationTestUtils.UseTestHomeWithDefaultXrayConfig(t)
 	if params.Threads <= 0 {
@@ -1182,10 +1182,10 @@ func TestAuditNewScaCycloneDxPip(t *testing.T) {
 	)
 	assert.NoError(t, err)
 	validations.VerifyCycloneDxResults(t, output, validations.ValidationParams{
-		Total:          &validations.TotalCount{Vulnerabilities: 22, BomComponents: 1 /*root*/ + 2 /*components*/ + 5 /*files (secrets)*/},
+		Total:          &validations.TotalCount{Vulnerabilities: 28, BomComponents: 1 /*root*/ + 2 /*components*/ + 5 /*files (secrets)*/},
 		SbomComponents: &validations.SbomCount{Root: 1, Direct: 2},
 		Vulnerabilities: &validations.VulnerabilityCount{
-			ValidateScan: &validations.ScanCount{Sast: 2, Iac: 9, Secrets: 11},
+			ValidateScan: &validations.ScanCount{Sast: 2, Iac: 9, Secrets: 11, Services: 6},
 		},
 	})
 }

cli/docs/flags.go

@@ -58,12 +58,14 @@ const (
 	Iac       = "iac"
 	Sast      = "sast"
 	Secrets   = "secrets"
+	Services  = "services"
 	WithoutCA = "without-contextual-analysis"
 
 	auditSca        = auditPrefix + Sca
 	auditIac        = auditPrefix + Iac
 	auditSast       = auditPrefix + Sast
 	auditSecrets    = auditPrefix + Secrets
+	auditServices   = auditPrefix + Services
 	auditWithoutCA  = auditPrefix + WithoutCA
 	binarySca       = scanPrefix + Sca
 	binarySecrets   = scanPrefix + Secrets
@@ -210,7 +212,7 @@ var commandFlags = map[string][]string{
 		Url, XrayUrl, user, password, accessToken, ServerId, InsecureTls, scanProjectKey, Watches, RepoPath, Snippet, Sbom, Licenses, OutputFormat, ExcludeTestDeps,
 		useWrapperAudit, DepType, RequirementsFile, Fail, ExtendedTable, WorkingDirs, ExclusionsAudit, Mvn, Gradle, Npm,
 		Pnpm, Yarn, Go, Swift, Cocoapods, Nuget, Pip, Pipenv, Poetry, MinSeverity, FixableOnly, ThirdPartyContextualAnalysis, Threads,
-		auditSca, auditIac, auditSast, auditSecrets, auditWithoutCA, SecretValidation, ScanVuln, OutputDir, SkipAutoInstall, AllowPartialResults, MaxTreeDepth,
+		auditSca, auditIac, auditSast, auditSecrets, auditServices, auditWithoutCA, SecretValidation, ScanVuln, OutputDir, SkipAutoInstall, AllowPartialResults, MaxTreeDepth,
 		StaticSca, XrayLibPluginBinaryCustomPath, AnalyzerManagerCustomPath, UploadRtRepoPath, UseIncludedBuilds, AddSastRules,
 	},
 	UploadCdx: {
@@ -223,7 +225,7 @@ var commandFlags = map[string][]string{
 		scanProjectKey, Watches, Snippet, ScanVuln, Fail,
 		// Scan params
 		Threads, ExclusionsAudit, WorkingDirs, Workspace,
-		auditSca, auditIac, auditSast, auditSecrets, auditWithoutCA, SecretValidation, Sbom, UseConfigProfile,
+		auditSca, auditIac, auditSast, auditSecrets, auditServices, auditWithoutCA, SecretValidation, Sbom, UseConfigProfile,
 		// Output params
 		Licenses, OutputFormat, ExtendedTable, OutputDir, UploadRtRepoPath,
 		// Scan Logic params
@@ -359,10 +361,11 @@ var flagsMap = map[string]components.Flag{
 	binarySca:                     components.NewBoolFlag(Sca, fmt.Sprintf("Selective scanners mode: Execute SCA (Software Composition Analysis) sub-scan. Use --%s to run both SCA and Contextual Analysis. Use --%s --%s to to run SCA. Can be combined with --%s.", Sca, Sca, WithoutCA, Secrets)),
 	binarySecrets:                 components.NewBoolFlag(Secrets, fmt.Sprintf("Selective scanners mode: Execute Secrets sub-scan. Can be combined with --%s.", Sca)),
 	binaryWithoutCA:               components.NewBoolFlag(WithoutCA, fmt.Sprintf("Selective scanners mode: Disable Contextual Analysis scanner after SCA. Relevant only with --%s flag.", Sca)),
-	auditSca:                      components.NewBoolFlag(Sca, fmt.Sprintf("Selective scanners mode: Execute SCA (Software Composition Analysis) sub-scan. Use --%s to run both SCA and Contextual Analysis. Use --%s --%s to to run SCA. Can be combined with --%s, --%s, --%s.", Sca, Sca, WithoutCA, Secrets, Sast, Iac)),
-	auditIac:                      components.NewBoolFlag(Iac, fmt.Sprintf("Selective scanners mode: Execute IaC sub-scan. Can be combined with --%s, --%s and --%s.", Sca, Secrets, Sast)),
-	auditSast:                     components.NewBoolFlag(Sast, fmt.Sprintf("Selective scanners mode: Execute SAST sub-scan. Can be combined with --%s, --%s and --%s.", Sca, Secrets, Iac)),
-	auditSecrets:                  components.NewBoolFlag(Secrets, fmt.Sprintf("Selective scanners mode: Execute Secrets sub-scan. Can be combined with --%s, --%s and --%s.", Sca, Sast, Iac)),
+	auditSca:                      components.NewBoolFlag(Sca, fmt.Sprintf("Selective scanners mode: Execute SCA (Software Composition Analysis) sub-scan. Use --%s to run both SCA and Contextual Analysis. Use --%s --%s to to run SCA. Can be combined with --%s, --%s, --%s and --%s.", Sca, Sca, WithoutCA, Secrets, Sast, Iac, Services)),
+	auditIac:                      components.NewBoolFlag(Iac, fmt.Sprintf("Selective scanners mode: Execute IaC sub-scan. Can be combined with --%s, --%s, --%s and --%s.", Sca, Secrets, Sast, Services)),
+	auditSast:                     components.NewBoolFlag(Sast, fmt.Sprintf("Selective scanners mode: Execute SAST sub-scan. Can be combined with --%s, --%s, --%s and --%s.", Sca, Secrets, Iac, Services)),
+	auditSecrets:                  components.NewBoolFlag(Secrets, fmt.Sprintf("Selective scanners mode: Execute Secrets sub-scan. Can be combined with --%s, --%s, --%s and --%s.", Sca, Sast, Iac, Services)),
+	auditServices:                 components.NewBoolFlag(Services, fmt.Sprintf("Selective scanners mode: Execute Services sub-scan. Can be combined with --%s, --%s, --%s and --%s.", Sca, Secrets, Sast, Iac)),
 	auditWithoutCA:                components.NewBoolFlag(WithoutCA, fmt.Sprintf("Selective scanners mode: Disable Contextual Analysis scanner after SCA. Relevant only with --%s flag.", Sca)),
 	SecretValidation:              components.NewBoolFlag(SecretValidation, fmt.Sprintf("Selective scanners mode: Triggers token validation on found secrets. Relevant only with --%s flag.", Secrets)),
 

commands/audit/audit_test.go

@@ -711,6 +711,7 @@ func TestAuditWithConfigProfile(t *testing.T) {
 		expectedCaNotCovered    int
 		expectedCaNotApplicable int
 		expectedSastIssues      int
+		expectedServicesIssues  int
 		expectedSecretsIssues   int
 		expectedIacIssues       int
 	}{
@@ -739,6 +740,9 @@ func TestAuditWithConfigProfile(t *testing.T) {
 						IacScannerConfig: services.IacScannerConfig{
 							EnableIacScan: false,
 						},
+						ServicesScannerConfig: services.ServicesScannerConfig{
+							EnableServicesScan: false,
+						},
 					},
 				}},
 			},
@@ -770,6 +774,9 @@ func TestAuditWithConfigProfile(t *testing.T) {
 						IacScannerConfig: services.IacScannerConfig{
 							EnableIacScan: false,
 						},
+						ServicesScannerConfig: services.ServicesScannerConfig{
+							EnableServicesScan: false,
+						},
 					},
 				}},
 			},
@@ -800,6 +807,9 @@ func TestAuditWithConfigProfile(t *testing.T) {
 						IacScannerConfig: services.IacScannerConfig{
 							EnableIacScan: false,
 						},
+						ServicesScannerConfig: services.ServicesScannerConfig{
+							EnableServicesScan: false,
+						},
 					},
 				}},
 			},
@@ -831,10 +841,13 @@ func TestAuditWithConfigProfile(t *testing.T) {
 						IacScannerConfig: services.IacScannerConfig{
 							EnableIacScan: false,
 						},
+						ServicesScannerConfig: services.ServicesScannerConfig{
+							EnableServicesScan: false,
+						},
 					},
 				}},
 			},
-			expectedSecretsIssues: 16,
+			expectedSecretsIssues: 17,
 		},
 		{
 			name:        "Secrets scanner is enabled with exclusions",
@@ -862,10 +875,13 @@ func TestAuditWithConfigProfile(t *testing.T) {
 						IacScannerConfig: services.IacScannerConfig{
 							EnableIacScan: false,
 						},
+						ServicesScannerConfig: services.ServicesScannerConfig{
+							EnableServicesScan: false,
+						},
 					},
 				}},
 			},
-			expectedSecretsIssues: 7,
+			expectedSecretsIssues: 8,
 		},
 		{
 			name:        "Enable only Sast scanner",
@@ -892,6 +908,9 @@ func TestAuditWithConfigProfile(t *testing.T) {
 						IacScannerConfig: services.IacScannerConfig{
 							EnableIacScan: false,
 						},
+						ServicesScannerConfig: services.ServicesScannerConfig{
+							EnableServicesScan: false,
+						},
 					},
 				}},
 			},
@@ -923,6 +942,9 @@ func TestAuditWithConfigProfile(t *testing.T) {
 						IacScannerConfig: services.IacScannerConfig{
 							EnableIacScan: false,
 						},
+						ServicesScannerConfig: services.ServicesScannerConfig{
+							EnableServicesScan: false,
+						},
 					},
 				}},
 			},
@@ -953,6 +975,9 @@ func TestAuditWithConfigProfile(t *testing.T) {
 						IacScannerConfig: services.IacScannerConfig{
 							EnableIacScan: true,
 						},
+						ServicesScannerConfig: services.ServicesScannerConfig{
+							EnableServicesScan: false,
+						},
 					},
 				}},
 			},
@@ -984,11 +1009,78 @@ func TestAuditWithConfigProfile(t *testing.T) {
 							EnableIacScan:   true,
 							ExcludePatterns: []string{"**/*iac/gcp*/**"},
 						},
+						ServicesScannerConfig: services.ServicesScannerConfig{
+							EnableServicesScan: false,
+						},
 					},
 				}},
 			},
 			expectedIacIssues: 0,
 		},
+		{
+			name:        "Enable only Services scanner",
+			testDirPath: filepath.Join("..", "..", "tests", "testdata", "projects", "jas", "jas"),
+			configProfile: services.ConfigProfile{
+				ProfileName: "only-services",
+				Modules: []services.Module{{
+					ModuleId:     1,
+					ModuleName:   "only-services-module",
+					PathFromRoot: ".",
+					ScanConfig: services.ScanConfig{
+						ScaScannerConfig: services.ScaScannerConfig{
+							EnableScaScan: false,
+						},
+						ContextualAnalysisScannerConfig: services.CaScannerConfig{
+							EnableCaScan: false,
+						},
+						SastScannerConfig: services.SastScannerConfig{
+							EnableSastScan: false,
+						},
+						IacScannerConfig: services.IacScannerConfig{
+							EnableIacScan: false,
+						},
+						ServicesScannerConfig: services.ServicesScannerConfig{
+							EnableServicesScan: true,
+						},
+					},
+				}},
+			},
+			expectedServicesIssues: 6,
+		},
+		{
+			name:        "Services scanner is enabled with exclusions",
+			testDirPath: filepath.Join("..", "..", "tests", "testdata", "projects", "jas", "jas"),
+			configProfile: services.ConfigProfile{
+				ProfileName: "services-with-exclusions",
+				Modules: []services.Module{{
+					ModuleId:     1,
+					ModuleName:   "services-with-exclusions-module",
+					PathFromRoot: ".",
+					ScanConfig: services.ScanConfig{
+						ServicesScannerConfig: services.ServicesScannerConfig{
+							EnableServicesScan: true,
+							ExcludePatterns:    []string{"**/*.git*/**"},
+						},
+						ScaScannerConfig: services.ScaScannerConfig{
+							EnableScaScan: false,
+						},
+						ContextualAnalysisScannerConfig: services.CaScannerConfig{
+							EnableCaScan: false,
+						},
+						SastScannerConfig: services.SastScannerConfig{
+							EnableSastScan: false,
+						},
+						SecretsScannerConfig: services.SecretsScannerConfig{
+							EnableSecretsScan: false,
+						},
+						IacScannerConfig: services.IacScannerConfig{
+							EnableIacScan: false,
+						},
+					},
+				}},
+			},
+			expectedServicesIssues: 0,
+		},
 		{
 			name:        "Enable All Scanners",
 			testDirPath: filepath.Join("..", "..", "tests", "testdata", "projects", "jas", "jas"),
@@ -1014,13 +1106,17 @@ func TestAuditWithConfigProfile(t *testing.T) {
 						IacScannerConfig: services.IacScannerConfig{
 							EnableIacScan: true,
 						},
+						ServicesScannerConfig: services.ServicesScannerConfig{
+							EnableServicesScan: true,
+						},
 					},
 				}},
 			},
-			expectedSastIssues:    2,
-			expectedSecretsIssues: 16,
-			expectedIacIssues:     9,
-			expectedCaNotCovered:  15,
+			expectedServicesIssues: 6,
+			expectedSastIssues:     2,
+			expectedSecretsIssues:  17,
+			expectedIacIssues:      9,
+			expectedCaNotCovered:   15,
 		},
 		{
 			name:        "All scanners enabled but some with exclude patterns",
@@ -1049,19 +1145,23 @@ func TestAuditWithConfigProfile(t *testing.T) {
 						IacScannerConfig: services.IacScannerConfig{
 							EnableIacScan: true,
 						},
+						ServicesScannerConfig: services.ServicesScannerConfig{
+							EnableServicesScan: true,
+						},
 					},
 				}},
 			},
-			expectedSastIssues:    0,
-			expectedSecretsIssues: 7,
-			expectedIacIssues:     9,
-			expectedCaNotCovered:  15,
+			expectedServicesIssues: 6,
+			expectedSastIssues:     0,
+			expectedSecretsIssues:  8,
+			expectedIacIssues:      9,
+			expectedCaNotCovered:   15,
 		},
 	}
 	assert.NoError(t, securityTestUtils.PrepareAnalyzerManagerResource())
 	for _, testcase := range testcases {
 		t.Run(testcase.name, func(t *testing.T) {
-			mockServer, serverDetails, _ := validations.XrayServer(t, validations.MockServerParams{XrayVersion: utils.EntitlementsMinVersion, XscVersion: services.ConfigProfileMinXscVersion})
+			mockServer, serverDetails, _ := validations.XrayServer(t, validations.MockServerParams{XrayVersion: services.ConfigProfileNewSchemaMinXrayVersion, XscVersion: services.ConfigProfileMinXscVersion})
 			defer mockServer.Close()
 
 			tempProjectPath, cleanUp := securityTestUtils.CreateTestProjectInTempDir(t, testcase.testDirPath)
@@ -1101,9 +1201,9 @@ func TestAuditWithConfigProfile(t *testing.T) {
 			validations.ValidateCommandSummaryOutput(t, validations.ValidationParams{
 				Actual:            summary,
 				ExactResultsMatch: true,
-				Total:             &validations.TotalCount{Vulnerabilities: testcase.expectedSastIssues + testcase.expectedSecretsIssues + testcase.expectedIacIssues + scaResultsCount},
+				Total:             &validations.TotalCount{Vulnerabilities: testcase.expectedSastIssues + testcase.expectedSecretsIssues + testcase.expectedIacIssues + scaResultsCount + testcase.expectedServicesIssues},
 				Vulnerabilities: &validations.VulnerabilityCount{
-					ValidateScan:                &validations.ScanCount{Sca: scaResultsCount, Sast: testcase.expectedSastIssues, Secrets: testcase.expectedSecretsIssues, Iac: testcase.expectedIacIssues},
+					ValidateScan:                &validations.ScanCount{Sca: scaResultsCount, Sast: testcase.expectedSastIssues, Secrets: testcase.expectedSecretsIssues, Iac: testcase.expectedIacIssues, Services: testcase.expectedServicesIssues},
 					ValidateApplicabilityStatus: &validations.ApplicabilityStatusCount{Applicable: testcase.expectedCaApplicable, NotApplicable: testcase.expectedCaNotApplicable, NotCovered: testcase.expectedCaNotCovered, Undetermined: testcase.expectedCaUndetermined},
 				},
 			})