Vunlscan

v0.0.4

This is an internal Reason tool for vunl scanning.

It will generate a PDF that you can save to artifacts and then pass onto client.

Add to your pipeline

Because Vunlscan is a private npm package you need to set an NPM_TOKEN environment variable and configure npm to use it. Create a file called .npmrc in your project with the following contents:

//registry.npmjs.org/:_authToken=${NPM_TOKEN}

The variable in this file is literal and should not be replaced with the token. Now you can set NPM_TOKEN via Bitbucket's repository variables or manually in your pipeline file with export NPM_TOKEN=...

Then add a script to run with your required config:

# NPM_TOKEN="MAKE SURE THIS IS IN ENV VARS" # add this if you dont have an install step 
lasttag=$(git describe --abbrev=0 --tags) # abbrev'd - or whatever you want your version to be
whitelistpath=$(pwd)/packages/@project/componenet/audit-whitelist.json
scanpathpath=$(pwd)/packages/@project/componenet/retail-insights-app
projectname="App name here"

vunlscan --scanpath="$scanpathpath" --version="$lasttag" --whitelist="$whitelistpath" --projectname="$projectname"

You will need to run your pipeline with an Image that supports x11

image: msquare/bitbucket-nodejs

What is a 'audit-whitelist.json' ?

This is a whitelist file to accept vulnerabilities.

For OSS vulnerabilities, you need to put in the ID (from output) and description (why it is whitelisted), if it needs to be hidden from the report, set "hide" to true.

For HawkEye vulnerabilities, you add a _hawk node and it's ID and description (why it is whitelisted).

If there are items (that are not hidden) in the whitelist, it will add an appendix to the report.

{
  "node": [
    {
      "id": "61538021-1545-4bc3-a154-15b7441d11c3",
      "description": "False negative captured by node environment - Set this to hide:true",
      "hide": true
    },
    ...
  ],
  "_hawk": [
    {
      "id": "files-secrets-.env-58",
      "description": "Env file does not contain any sensitive information"
    },
    {
      "offender": "some-file.js",
      "description": "Or you can exclude a file"
    }
  ]
}