Граф коммитов

493 Коммитов

Автор SHA1 Сообщение Дата
David Alcantar 6cac08af8a Update core-pipeline.yml for Azure Pipelines 2020-09-28 13:27:44 -07:00
David Alcantar d4308cc06b Update core-pipeline.yml 2020-09-28 13:10:13 -07:00
Guy Acosta 2953dc32da
Adds support for #299. Adds verify check on custom rules. (#302) 2020-09-27 23:55:30 -06:00
Guy Acosta df48b5cc94
Dependency package version updates (#301)
* Updates dependency packages -primary.  Removes leftover MultiExtractor reference #298.
2020-09-27 16:13:17 -06:00
Guy Acosta ffb7938d51
Fix for #297. Addresses issue but also improves html encoding flow to isolate safeguarding user input until html writer is called thus keeping the original unencoded values for json, text and even nuget callers for better readability in those cases and managing any transformations if needed. (#300) 2020-09-27 14:38:06 -06:00
Guy Acosta 913280fbf5
Completes work to enable null checks and nullable type definitions improving the bullet proofing generally. (#296) 2020-09-21 18:10:19 -06:00
Guy Acosta f715fdaaf2
Solid improvement on dependency identification and elimination of false pos #293 (#295) 2020-09-21 01:54:27 -06:00
Guy Acosta d05d5abe2c
Update core-pipeline.yml for Azure Pipelines (#294)
Changing connection to better reflect primary dev pushes.
2020-09-21 01:02:13 -06:00
Guy Acosta 79f4b09b4f
Fixes for #259, #278. Includes correction for unique tags option that was not functioning right due to clause misidentification. Improves code by reducing near redundant ScanResult structure to use MatchResult directly and avoid duplication. Adds back 3 test cases post OAT integration. (#292) 2020-09-20 23:55:29 -06:00
Guy Acosta 34ee51035b
Hashicorp vault rule misc (#290)
* Adds requested Hashicorp secrets vault detection and improves Azure key vault accuracy.  Adds detection and warning for unsupported tag preferences in features html report page.
2020-09-20 11:49:39 -06:00
Guy Acosta 0ed858700d
In some cases a file e.g. binary or other that is not wanted for a scan is opened to determine file type before being excluded. Fix is needed to resolve an issue. (#289) 2020-09-18 15:26:21 -06:00
Guy Acosta 92fbd95061
fix for bug #284 (#285)
* fix for bug #284

* Help update.
2020-09-14 13:47:39 -06:00
Guy Acosta 5568fc9d2b
Misc reg imp (#283)
* Replaces older DevSkim regex engine with Microsoft.CST.OAT.  4 unit test marked as ignore until final count of expected tags is met.

* Replaces older DevSkim regex engine with Microsoft.CST.OAT.  4 unit test marked as ignore until final count of expected tags is met.

* Fix affecting 1 unit test

* Completed RegexWithIndexOp for OAT operation to get index of matched pattern and cleanup.

* Fixed 1. mistaken identification of inline comment in TextContainer 2. Regex compilation interference with IgnoreCase option (?but verified) and 3. missing boundary property set for sample text as part of match details.

* Update RulesEngine/Ruleset.cs

Co-authored-by: Gabe Stocco <98900+gfs@users.noreply.github.com>

* Revised how to get the enumerated list of native rules.

* extra semi-colon

* null checks updated to ? and ?. and non-nullable arg checks removed as unnecessary now

* Simplified enumerable native rules get

* space nit

* Label improvement for issue #255 and minor table alignment.

* Work for Pedro FP in Liquid

Co-authored-by: Gabe Stocco <98900+gfs@users.noreply.github.com>
2020-09-11 01:08:03 -06:00
Guy Acosta 321e07bccd
Html align and language label improvement (#282)
* Replaces older DevSkim regex engine with Microsoft.CST.OAT.  4 unit test marked as ignore until final count of expected tags is met.

* Replaces older DevSkim regex engine with Microsoft.CST.OAT.  4 unit test marked as ignore until final count of expected tags is met.

* Fix affecting 1 unit test

* Completed RegexWithIndexOp for OAT operation to get index of matched pattern and cleanup.

* Fixed 1. mistaken identification of inline comment in TextContainer 2. Regex compilation interference with IgnoreCase option (?but verified) and 3. missing boundary property set for sample text as part of match details.

* Update RulesEngine/Ruleset.cs

Co-authored-by: Gabe Stocco <98900+gfs@users.noreply.github.com>

* Revised how to get the enumerated list of native rules.

* extra semi-colon

* null checks updated to ? and ?. and non-nullable arg checks removed as unnecessary now

* Simplified enumerable native rules get

* space nit

* Label improvement for issue #255 and minor table alignment.

Co-authored-by: Gabe Stocco <98900+gfs@users.noreply.github.com>
2020-09-07 20:00:51 -06:00
Guy Acosta fd93b122d6
Oat scan engine (#281)
* Replaces older DevSkim regex engine with Microsoft.CST.OAT.  4 unit test marked as ignore until final count of expected tags is met.

* Replaces older DevSkim regex engine with Microsoft.CST.OAT.  4 unit test marked as ignore until final count of expected tags is met.

* Fix affecting 1 unit test

* Completed RegexWithIndexOp for OAT operation to get index of matched pattern and cleanup.

* Fixed 1. mistaken identification of inline comment in TextContainer 2. Regex compilation interference with IgnoreCase option (?but verified) and 3. missing boundary property set for sample text as part of match details.

* Update RulesEngine/Ruleset.cs

Co-authored-by: Gabe Stocco <98900+gfs@users.noreply.github.com>

* Revised how to get the enumerated list of native rules.

* extra semi-colon

* null checks updated to ? and ?. and non-nullable arg checks removed as unnecessary now

* Simplified enumerable native rules get

* space nit

Co-authored-by: Gabe Stocco <98900+gfs@users.noreply.github.com>
2020-09-07 14:17:43 -06:00
Guy Acosta 2c681e6173
Fixes for #276 and #279 (#280)
* Fixes for #276 and #279

* Improve path fix

* Update AppInspector.CLI/Writers/AnalyzeHtmlWriter.cs

Co-authored-by: Gabe Stocco <98900+gfs@users.noreply.github.com>

* Update AppInspector.CLI/Writers/AnalyzeHtmlWriter.cs

Co-authored-by: Gabe Stocco <98900+gfs@users.noreply.github.com>

Co-authored-by: Gabe Stocco <98900+gfs@users.noreply.github.com>
2020-09-02 09:13:59 -06:00
Michael Scovetta 6e9480b37c
Bump RecursiveExtractor. (#275)
* Update JustRunIt.md

* Bump RecursiveExtractor.

* Don't fail on notice generator error.

* Remove extra continueOnError.

* Update sdl-job.yml

Co-authored-by: Gabe Stocco <98900+gfs@users.noreply.github.com>
Co-authored-by: Michael Scovetta <miscovet@microsoft.com>
Co-authored-by: David Alcantar <daalcant@microsoft.com>
2020-08-23 09:31:15 -06:00
David Alcantar 9b5136eb34 Update sdl-job.yml 2020-08-21 20:26:16 -07:00
Gabe Stocco 209b17a861
Update README.md (#274) 2020-08-18 09:02:06 -06:00
Guy Acosta 2254cf18b0
One html file (#271)
* Enhanced VSProject rules to read additional meta-data

* Fixes for #241 and #264 for generating a single html report file containing all local dependences that are proprietary.
2020-08-17 15:43:39 -06:00
Gabe Stocco dc5c946cc2
Update README.md (#272) 2020-08-17 10:51:56 -06:00
Guy Acosta 3aab082769
Enhanced VSProject rules to read additional meta-data (#270) 2020-08-13 18:48:18 -06:00
Guy Acosta 0d0b373126
Revert "Update index.html (#265)" (#269)
This reverts commit 5d194dc2b8.
2020-08-13 17:23:09 -06:00
David Alcantar 5d194dc2b8
Update index.html (#265) 2020-08-13 14:44:30 -06:00
Gabe Stocco 7ae11fa687
Update issue templates (#268) 2020-08-13 14:38:04 -06:00
Guy Acosta c4843d26aa
Lgtm alerts fix (#263)
* #258 Android Intents rule support (partial)

* LGTM alerts resolved regarding initialized var values that were not read/used.
2020-08-11 14:34:58 -06:00
Guy Acosta becc0dbfdf
#258 Android Intents rule support (#260) 2020-08-06 12:12:04 -06:00
Guy Acosta d18ddea15c
#253 - Few case insentitive modifiers were removed as unnecessary for specific API patterns. Couple of pattern corrections made also. (#256) 2020-08-03 10:55:09 -06:00
Guy Acosta 74a35628e2
Finalizes new model for separating processing of scan result adds from final results and adds sorting for languages. (#254) 2020-07-28 10:42:28 -06:00
Guy Acosta 4fbf6b1dda
Rust language added patterns (#252)
* Rust language added patterns

* PR review updates

* Removed unnecessary case insensitivity

* A few more case changes.

* Restore rule 38600

* comma missing in json
2020-07-28 09:16:34 -06:00
Guy Acosta fc352ff81a
Guyacosta/sorteddictionaries (#246)
* Changes result types to sorted to account for concurrent dictionaries and threaded adds which give an impression of inconsistent scan results.

* Corrects output of various types showing a byte value that has no user value from internal use of concurrentdictionaries for parallelism into sorted final list.

* Delete launchSettings.json

* Review comment fixes

* Final addback of exclusion list to ensure we don't miss any dependencies due to unique tag limit

* Few more inline declarations vs constructor.
2020-07-28 08:24:17 -06:00
Guy Acosta 20e195b3db
Update README.md
wiki link updates
2020-07-21 10:04:18 -06:00
Guy Acosta 5766ac4352
Update README.md 2020-07-16 11:47:53 -06:00
Guy Acosta 2e55d35a6c
Update README.md 2020-07-16 11:46:53 -06:00
Guy Acosta d2360ee6e6
Update README.md
Minor correction to exe name how-to for Windows.
2020-07-15 15:00:58 -06:00
Guy Acosta b77dce239a
Fix for #242 (#243) 2020-07-07 21:41:35 -06:00
David Alcantar c02c0b08ab Update Release Folder Paths 2020-06-29 12:57:47 -07:00
David Alcantar f3e03db665 Update core-pipeline.yml 2020-06-29 09:40:05 -07:00
David Alcantar 5876712e5b
Update Pipelines with Templates (#239)
* Update Pipelines with Templates

* Update Job Names

* Update core-pipeline.yml

* Remove Extra Spacing

* Update Linux/Mac Refs

* Update ReleaseVersion Tasks

* Move PreBuild to Template
2020-06-22 17:52:07 -06:00
Guy Acosta 7a39c21900
Removes old refs to project we no longer use. (#238) 2020-06-18 16:21:08 -07:00
Josh Brown-White 3d4eab1f1d
Update README.md (#236)
fixed typo
2020-06-17 13:12:59 -07:00
Michael Scovetta 50e36bdb11
Update references from master to main. (#232)
* Update references from master to main.

* Update publicReleaseRefSpec refs to main.

Co-authored-by: Guy Acosta <47648296+guyacosta@users.noreply.github.com>
2020-06-16 23:04:08 -07:00
Guy Acosta cb12e27264
Update README.md (#233)
Refresh official releases section and intro wording to improve value of initial description
2020-06-16 09:03:20 -07:00
Guy Acosta 62c2c1d846
Update BUILD.md 2020-06-16 08:57:40 -07:00
Guy Acosta 8452b00522
Mainrename (#231)
* Adds sdl only pipeline with codeinspector task+

* part of root rename
2020-06-16 07:31:07 -07:00
Guy Acosta 4c711d31a7
Adds sdl only pipeline with codeinspector task+ (#230) 2020-06-16 07:29:31 -07:00
Gabe Stocco 3f2bf3495a
Update dependencies (#227)
* Update dependencies

* Update AppInspector.Commands.csproj

Co-authored-by: David Alcantar <daalcant@microsoft.com>
2020-06-14 20:41:48 -07:00
Michael Scovetta ba0fbf9e67
Create SUPPORT.md (#225)
* Create SUPPORT.md

* Add SECURITY.md reference.
2020-06-01 10:25:17 -07:00
Gabe Stocco d63aa1f907
Use published version of multiextractor (#226)
* Switch to using official published multiextractor

* Remove unused sharpcompress dependency.

* Remove Fork of multiextractor
2020-05-30 16:20:15 -07:00
David Alcantar a66f774e79 Update core-pipeline.yml for Azure Pipelines 2020-05-29 14:57:12 -07:00