Skip to content

Commit ffaf8c0

Browse files
jacobmsftjacobmsft
committed
minor fixes, added analyze_security script for windows and linux
1 parent d56dfb0 commit ffaf8c0

File tree

7 files changed

+121
-84
lines changed

7 files changed

+121
-84
lines changed

‎Dockerfile‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,9 +35,10 @@ RUN apt-get update && \
3535

3636
# Install .NET Core for tools/builds
3737
RUN cd /tmp && \
38-
wget -q https://packages.microsoft.com/config/ubuntu/18.04/packages-microsoft-prod.deb -O packages-microsoft-prod.deb && \
38+
wget https://packages.microsoft.com/config/ubuntu/20.04/packages-microsoft-prod.deb -O packages-microsoft-prod.deb && \
3939
dpkg -i packages-microsoft-prod.deb && \
40-
add-apt-repository universe && \
40+
apt-get update; \
41+
apt-get install -y apt-transport-https && \
4142
apt-get update && \
4243
rm packages-microsoft-prod.deb
4344
RUN apt-get install -y dotnet-sdk-3.1

‎README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,8 @@ to analyze and get a SARIF result file, you will have to run:
6060

6161
```
6262
$ docker run --rm --name codeql-container mcr.microsoft.com/codeql/codeql-container -v /dir/to/analyze:/opt/src -v /dir/for/results:/opt/results -e CODEQL_CLI_ARGS="database create --language=python /opt/src/source_db"
63-
$ docker run --rm --name codeql-container mcr.microsoft.com/codeql/codeql-container -v /dir/to/analyze:/opt/src -v /dir/for/results:/opt/results -e CODEQL_CLI_ARGS="database analyze --format=sarifv2 --output=/opt/results/issues.sarif /opt/src/source_db
63+
$ docker run --rm --name codeql-container mcr.microsoft.com/codeql/codeql-container -v /dir/to/analyze:/opt/src -v /dir/for/results:/opt/results -e CODEQL_CLI_ARGS=" database upgrade /opt/src/source_db"
64+
$ docker run --rm --name codeql-container mcr.microsoft.com/codeql/codeql-container -v /dir/to/analyze:/opt/src -v /dir/for/results:/opt/results -e CODEQL_CLI_ARGS="database analyze --format=sarifv2 --output=/opt/results/issues.sarif /opt/src/source_db"
6465
```
6566

6667
For more information on CodeQL and QL packs, please visit https://www.github.com/github/codeql.

‎container/get-latest-codeql-version.py‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
1-
#!/usr/bin/python3
2-
# get the parent directory of the script, to link libs
3-
4-
import os
5-
import sys
6-
7-
from libs.github import get_latest_github_repo_version
8-
9-
def main():
10-
latest_release = get_latest_github_repo_version("github/codeql-cli-binaries")
11-
print(latest_release.title)
12-
13-
main()
1+
#!/usr/bin/env python3
2+
# get the parent directory of the script, to link libs
3+
4+
import os
5+
import sys
6+
7+
from libs.github import get_latest_github_repo_version
8+
9+
def main():
10+
latest_release = get_latest_github_repo_version("github/codeql-cli-binaries")
11+
print(latest_release.title)
12+
13+
main()

‎container/setup.py‎

Lines changed: 4 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
1-
#!/usr/bin/python3
2-
1+
#!/usr/bin/env python3
32
import os
43
import sys
54
import argparse
@@ -10,31 +9,23 @@
109

1110
CODEQL_HOME = get_env_variable('CODEQL_HOME')
1211

13-
# should we update the local copy of codeql-cli if a new version is available?
14-
CHECK_LATEST_CODEQL_CLI = get_env_variable('CHECK_LATEST_CODEQL_CLI', True)
15-
16-
# should we update the local copy of codeql queries if a new version is available?
17-
CHECK_LATEST_QUERIES = get_env_variable('CHECK_LATEST_QUERIES', True)
18-
19-
# if we are downloading new queries, should we precompile them
20-
PRECOMPILE_QUERIES = get_env_variable('PRECOMPILE_QUERIES', True)
21-
22-
2312
logger = getLogger('codeql-container-setup')
2413
logger.setLevel(INFO)
2514

2615
def parse_arguments():
2716

2817
parser = argparse.ArgumentParser(description='Setup codeql components.')
18+
# should we update the local copy of codeql-cli if a new version is available?
2919
parser.add_argument("-c", "--check-latest-cli", help="check the latest codeql-cli package available and install it",
3020
default=False, action="store_true")
21+
# should we update the local copy of codeql queries if a new version is available?
3122
parser.add_argument("-q", "--check-latest-queries", help="check the latest codeql queries available and install it",
3223
default=False, action="store_true")
3324
#(makes query execution faster, but building the container build slower).
3425
parser.add_argument("-p", "--precompile-latest-queries", help="if new queries were downloaded, precompile it",
3526
default=False, action="store_true")
36-
args = parser.parse_args()
3727

28+
args = parser.parse_args()
3829
return args
3930

4031
def setup():

‎container/startup.py‎

Lines changed: 56 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -1,55 +1,56 @@
1-
import os
2-
import sys
3-
from time import sleep
4-
from libs.utils import get_env_variable, check_output_wrapper, get_logger
5-
from libs.codeql import *
6-
7-
CODEQL_HOME = get_env_variable('CODEQL_HOME')
8-
9-
# should we update the local copy of codeql-cli if a new version is available?
10-
CHECK_LATEST_CODEQL_CLI = get_env_variable('CHECK_LATEST_CODEQL_CLI', True)
11-
12-
# should we update the local copy of codeql queries if a new version is available?
13-
CHECK_LATEST_QUERIES = get_env_variable('CHECK_LATEST_QUERIES', True)
14-
15-
# if we are downloading new queries, should we precompile them
16-
#(makes query execution faster, but building the container build slower).
17-
PRECOMPILE_QUERIES = get_env_variable('PRECOMPILE_QUERIES', True)
18-
19-
# ql packs, requested to run, if any
20-
CODEQL_CLI_ARGS = get_env_variable('CODEQL_CLI_ARGS', True)
21-
22-
# should we just exit after execution, or should we wait for user to stop container?
23-
WAIT_AFTER_EXEC = get_env_variable('WAIT_AFTER_EXEC', True)
24-
25-
def main():
26-
# do the setup, if requested
27-
scripts_dir = os.path.dirname(os.path.realpath(__file__)) # get the parent directory of the script
28-
setup_script_args = ''
29-
if CHECK_LATEST_CODEQL_CLI:
30-
setup_script_args += ' --check-latest-cli'
31-
if CHECK_LATEST_QUERIES:
32-
setup_script_args += ' --check-latest-queries'
33-
if PRECOMPILE_QUERIES:
34-
setup_script_args += ' --precompile-latest-queries'
35-
36-
run_result = check_output_wrapper(
37-
f"{scripts_dir}/setup.py {setup_script_args}",
38-
shell=True).decode("utf-8")
39-
40-
# what command did the user ask to run?
41-
if CODEQL_CLI_ARGS == False or CODEQL_CLI_ARGS == None or CODEQL_CLI_ARGS == ' ':
42-
# nothing to do
43-
logger.info("No argument passed in for codeql-cli, nothing to do. To perform some task, please set the CODEQL_CLI_ARGS environment variable to a valid argument..")
44-
else:
45-
codeql = CodeQL(CODEQL_HOME)
46-
run_result = codeql.execute_codeql_command(CODEQL_CLI_ARGS)
47-
print(run_result)
48-
49-
if WAIT_AFTER_EXEC:
50-
logger.info("Wait forever specified, waiting...")
51-
while True:
52-
sleep(10)
53-
54-
logger = get_logger()
55-
main()
1+
#!/usr/bin/env python3
2+
import os
3+
import sys
4+
from time import sleep
5+
from libs.utils import get_env_variable, check_output_wrapper, get_logger
6+
from libs.codeql import *
7+
8+
CODEQL_HOME = get_env_variable('CODEQL_HOME')
9+
10+
# should we update the local copy of codeql-cli if a new version is available?
11+
CHECK_LATEST_CODEQL_CLI = get_env_variable('CHECK_LATEST_CODEQL_CLI', True)
12+
13+
# should we update the local copy of codeql queries if a new version is available?
14+
CHECK_LATEST_QUERIES = get_env_variable('CHECK_LATEST_QUERIES', True)
15+
16+
# if we are downloading new queries, should we precompile them
17+
#(makes query execution faster, but building the container build slower).
18+
PRECOMPILE_QUERIES = get_env_variable('PRECOMPILE_QUERIES', True)
19+
20+
# ql packs, requested to run, if any
21+
CODEQL_CLI_ARGS = get_env_variable('CODEQL_CLI_ARGS', True)
22+
23+
# should we just exit after execution, or should we wait for user to stop container?
24+
WAIT_AFTER_EXEC = get_env_variable('WAIT_AFTER_EXEC', True)
25+
26+
def main():
27+
# do the setup, if requested
28+
scripts_dir = os.path.dirname(os.path.realpath(__file__)) # get the parent directory of the script
29+
setup_script_args = ''
30+
if CHECK_LATEST_CODEQL_CLI:
31+
setup_script_args += ' --check-latest-cli'
32+
if CHECK_LATEST_QUERIES:
33+
setup_script_args += ' --check-latest-queries'
34+
if PRECOMPILE_QUERIES:
35+
setup_script_args += ' --precompile-latest-queries'
36+
37+
run_result = check_output_wrapper(
38+
f"{scripts_dir}/setup.py {setup_script_args}",
39+
shell=True).decode("utf-8")
40+
41+
# what command did the user ask to run?
42+
if CODEQL_CLI_ARGS == False or CODEQL_CLI_ARGS == None or CODEQL_CLI_ARGS == ' ':
43+
# nothing to do
44+
logger.info("No valid argument passed in for codeql-cli, nothing to do. To perform some task, please set the CODEQL_CLI_ARGS environment variable to a valid argument...")
45+
else:
46+
codeql = CodeQL(CODEQL_HOME)
47+
run_result = codeql.execute_codeql_command(CODEQL_CLI_ARGS)
48+
print(run_result)
49+
50+
if WAIT_AFTER_EXEC:
51+
logger.info("Wait forever specified, waiting...")
52+
while True:
53+
sleep(10)
54+
55+
logger = get_logger()
56+
main()

‎scripts/unix/analyze_security.sh‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/bin/bash
2+
scriptname=$(basename "$0")
3+
inputfile=${1}
4+
outputfile=${2}
5+
6+
if [ "$#" -ne 2 ]; then
7+
echo "Please provide the folder to analyze, and the folder to store results"
8+
echo "Usage: ${scriptname} <folder to analyze> <folder to store result>"
9+
exit 1
10+
fi
11+
12+
#docker pull codeql/codeql-container
13+
docker run --rm --name codeql-container -v "${inputfile}:/opt/src" -v "${outputfile}:/opt/results" -e CODEQL_CLI_ARGS=database\ create\ --language=python\ /opt/src/source_db csteosstools.azurecr.io/codeql/codeql-container
14+
docker run --rm --name codeql-container -v "${inputfile}:/opt/src" -v "${outputfile}:/opt/results" -e CODEQL_CLI_ARGS=database\ upgrade\ /opt/src/source_db csteosstools.azurecr.io/codeql/codeql-container
15+
docker run --rm --name codeql-container -v ${inputfile}:/opt/src -v ${outputfile}:/opt/results -e CODEQL_CLI_ARGS=database\ analyze\ /opt/src/source_db\ --format=sarifv2\ --output=/opt/results/issues.sarif\ python-security-and-quality.qls csteosstools.azurecr.io/codeql/codeql-container
16+
17+
echo "If there were no errors in the execution, the results file should be located at ${2}/issues.sarif"

‎scripts/windows/analyze_security.bat‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
set scriptname=%0
2+
set inputfile=%1
3+
set outputfile=%2
4+
5+
@echo off
6+
setlocal enabledelayedexpansion
7+
8+
set argCount=0
9+
for %%x in (%*) do (
10+
set /A argCount+=1
11+
set "argVec[!argCount!]=%%~x"
12+
)
13+
14+
if %argCount% LSS 2 (
15+
echo "Please provide the folder to analyze, and the folder to store results"
16+
echo "Usage: %scriptname% <folder to analyze> <folder to store result>"
17+
exit /b 1
18+
)
19+
20+
rem docker pull codeql/codeql-container
21+
echo docker run --rm --name codeql-container -v "%inputfile%:/opt/src" -v "%outputfile%:/opt/results" -e CODEQL_CLI_ARGS="database create --language=python /opt/src/source_db" csteosstools.azurecr.io/codeql/codeql-container
22+
start /W /B docker run --rm --name codeql-container -v "%inputfile%:/opt/src" -v "%outputfile%:/opt/results" -e CODEQL_CLI_ARGS="database create --language=python /opt/src/source_db" csteosstools.azurecr.io/codeql/codeql-container
23+
echo docker run --rm --name codeql-container -v "%inputfile%:/opt/src" -v "%outputfile%:/opt/results" -e CODEQL_CLI_ARGS="database upgrade /opt/src/source_db" csteosstools.azurecr.io/codeql/codeql-container
24+
echo docker run --rm --name codeql-container -v "%inputfile%:/opt/src" -v "%outputfile%:/opt/results" -e CODEQL_CLI_ARGS="database analyze /opt/src/source_db --format=sarifv2 --output=/opt/results/issues.sarif python-security-and-quality.qls" csteosstools.azurecr.io/codeql/codeql-container
25+
26+
echo "If there were no errors in the execution, the results file should be located at %2/issues.sarif"

0 commit comments

Comments
 (0)