@reason.co/vunlscan

Vunlscan

v0.0.1

This is an internal Reason tool for vunl scanning.

It will generate a PDF that you can save to artifacts and then pass onto client.

Add to your pipeline

image: msquare/bitbucket-nodejs

if you have an install step, set NPM_TOKEN in your ev's and then run the below before NPM install

    - printf "//`node -p \"require('url').parse(process.env.NPM_REGISTRY_URL || 'https://registry.npmjs.org').host\"`/:_authToken=${NPM_TOKEN}\nregistry=${NPM_REGISTRY_URL:-https://registry.npmjs.org}\n" >> ~/.npmrc

then add a script to run with your required config

# NPM_TOKEN="MAKE SURE THIS IS IN ENV VARS" # add this if you dont have an install step 
lasttag=$(git describe --abbrev=0 --tags) # abbrev'd - or whatever you want your version to be
whitelistpath=$(pwd)/packages/@project/componenet/audit-whitelist.json
scanpathpath=$(pwd)/packages/@project/componenet/retail-insights-app
projectname="App name here"

vunlscan --scanpath="$scanpathpath" --version="$lasttag" --whitelist="$whitelistpath" --projectname="$projectname"

What is a 'audit-whitelist.json' ?

This is a whitelist file to accept vulnerabilities.

For OSS vulnerabilities, you need to put in the ID (from output) and description (why it is whitelisted), if it needs to be hidden from the report, set "hide" to true.

For HawkEye vulnerabilities, you add a _hawk node and it's ID and description (why it is whitelisted).

If there are items (that are not hidden) in the whitelist, it will add an appendix to the report.

{
  "node": [
    {
      "id": "61538021-1545-4bc3-a154-15b7441d11c3",
      "description": "False negative captured by node environment - Set this to hide:true",
      "hide": true
    },
    ...
  ],
  "_hawk": [
    {
      "id": "files-secrets-.env-58",
      "description": "Env file does not contain any sensitive information"
    }
  ]
}
```