Adding business logic for reachability enricher - leveraging atom.

components/enrichers/reachability/internal/atom/purl/purl.go

@@ -0,0 +1,143 @@
+package purl
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+// Parser allows to extract information from purls - https://github.com/package-url/purl-spec.
+type Parser struct {
+	matcherPurlPkg             *regexp.Regexp
+	matcherPurlTrailingVersion *regexp.Regexp
+	matcherPurlVersion         *regexp.Regexp
+}
+
+func NewParser() (*Parser, error) {
+	purlPkg, err := regexp.Compile(`(?P<p1>[^/:]+/(?P<p2>[^/]+))(?:(?:.|/)v\d+)?@`)
+	if err != nil {
+		return nil, fmt.Errorf("failed to compile purl pkg regex: %w", err)
+	}
+	purlTrailingVersion, err := regexp.Compile(`[./]v\d+@`)
+	if err != nil {
+		return nil, fmt.Errorf("failed to compile purl trailing version regex: %w", err)
+	}
+	purlVersion, err := regexp.Compile(`@(?P<v1>v?(?P<v2>[\d.]+){1,3})(?P<ext>[^?\s]+)?`)
+	if err != nil {
+		return nil, fmt.Errorf("failed to compile purl version regex: %w", err)
+	}
+
+	return &Parser{
+		matcherPurlPkg:             purlPkg,
+		matcherPurlTrailingVersion: purlTrailingVersion,
+		matcherPurlVersion:         purlVersion,
+	}, nil
+}
+
+// ParsePurl extracts pkg:version matches from the supplied purl.
+func (p *Parser) ParsePurl(purl string) ([]string, error) {
+	purl = p.matcherPurlTrailingVersion.ReplaceAllString(purl, "$1@")
+
+	var (
+		result   []string
+		pkgs     []string
+		versions []string
+	)
+
+	if match := p.matcherPurlVersion.FindStringSubmatch(purl); len(match) > 0 {
+		versions = p.parsePurlVersions(match)
+	}
+
+	if match := p.matcherPurlPkg.FindStringSubmatch(purl); len(match) > 0 {
+		pkgs = p.parsePurlPkgs(match)
+	}
+
+	for _, pkg := range pkgs {
+		for _, version := range versions {
+			result = append(result, fmt.Sprintf("%s:%s", pkg, version))
+		}
+	}
+
+	return p.removeDuplicates(result), nil
+}
+
+func (p *Parser) parsePurlVersions(matches []string) []string {
+	if len(matches) == 0 {
+		return make([]string, 0)
+	}
+
+	var (
+		pattern  = p.matcherPurlVersion
+		versions []string
+		// Creating a map to ensure uniqueness
+		versionSet = make(map[string]struct{})
+
+		// Assuming the named groups are in the match
+		vers1 = matches[pattern.SubexpIndex("v1")]
+		vers2 = matches[pattern.SubexpIndex("v2")]
+		ext   = matches[pattern.SubexpIndex("ext")]
+	)
+
+	// Adding the basic versions
+	versionSet[vers1] = struct{}{}
+	versionSet[vers2] = struct{}{}
+
+	// Adding the extended versions if ext exists
+	if ext != "" {
+		versionSet[vers1+ext] = struct{}{}
+		versionSet[vers2+ext] = struct{}{}
+	}
+
+	// Converting the map to a slice
+	for version := range versionSet {
+		versions = append(versions, version)
+	}
+
+	return versions
+}
+
+func (p *Parser) parsePurlPkgs(matches []string) []string {
+	var (
+		pattern = p.matcherPurlPkg
+		// Creating a map to ensure uniqueness
+		pkgSet         = make(map[string]struct{})
+		pkgs           []string
+		pkgStrReplacer = strings.NewReplacer(
+			// replaces "pypi/" with "".
+			"pypi/", "",
+			// replaces "npm/" with "".
+			"npm/", "",
+			// replaces "%40/" with "@".
+			"%40", "@",
+		)
+	)
+
+	// Adding the packages
+	pkgSet[matches[pattern.SubexpIndex("p1")]] = struct{}{}
+	pkgSet[matches[pattern.SubexpIndex("p2")]] = struct{}{}
+
+	// Converting the map to a slice and cleaning up the packages
+	for pkg := range pkgSet {
+		pkgs = append(pkgs, pkgStrReplacer.Replace(pkg))
+	}
+
+	return pkgs
+}
+
+func (p *Parser) removeDuplicates(matches []string) []string {
+	var (
+		result      []string
+		encountered = make(map[string]struct{})
+	)
+
+	for match := range matches {
+		_, ok := encountered[matches[match]]
+		if ok {
+			continue
+		}
+		encountered[matches[match]] = struct{}{}
+		result = append(result, matches[match])
+	}
+
+	return result
+}

components/enrichers/reachability/internal/atom/purl/purl_test.go

@@ -0,0 +1,17 @@
+package purl_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/ocurity/dracon/components/enrichers/reachability/internal/atom/purl"
+)
+
+func TestNewParser(t *testing.T) {
+	t.Run("should return new parser with valid matchers", func(t *testing.T) {
+		p, err := purl.NewParser()
+		require.NoError(t, err)
+		require.NotNil(t, p)
+	})
+}

components/enrichers/reachability/internal/atom/reader.go

@@ -0,0 +1,150 @@
+package atom
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"os"
+	"strings"
+
+	"github.com/jmespath/go-jmespath"
+
+	"github.com/ocurity/dracon/components/enrichers/reachability/internal/atom/purl"
+	"github.com/ocurity/dracon/components/enrichers/reachability/internal/logging"
+)
+
+type (
+	// Reader is responsible for managing how to read atom files and understand their contents.
+	Reader struct {
+		atomFilePath string
+		purlParser   *purl.Parser
+	}
+
+	// ReachablePurls maps reachable purls based on the report.
+	ReachablePurls map[string]struct{}
+
+	// Reachables is a slice of Reachable.
+	Reachables []Reachable
+
+	// Response maps the content of an atom reachability report in json format.
+	Response struct {
+		Reachables Reachables `json:"reachables"`
+	}
+
+	// Reachable represents an atom reachable result.
+	Reachable struct {
+		Flows []Flows  `json:"flows"`
+		Purls []string `json:"purls"`
+	}
+
+	// Flows describes the flows on how to reach such reachable.
+	Flows struct {
+		ID                    int    `json:"id"`
+		Label                 string `json:"label"`
+		Name                  string `json:"name"`
+		FullName              string `json:"fullName"`
+		Signature             string `json:"signature"`
+		IsExternal            bool   `json:"isExternal"`
+		Code                  string `json:"code"`
+		TypeFullName          string `json:"typeFullName"`
+		ParentMethodName      string `json:"parentMethodName"`
+		ParentMethodSignature string `json:"parentMethodSignature"`
+		ParentFileName        string `json:"parentFileName"`
+		ParentPackageName     string `json:"parentPackageName"`
+		ParentClassName       string `json:"parentClassName"`
+		LineNumber            int    `json:"lineNumber"`
+		ColumnNumber          int    `json:"columnNumber"`
+		Tags                  string `json:"tags"`
+	}
+)
+
+// NewReader returns a new atom file reader.
+func NewReader(atomFilePath string, purlParser *purl.Parser) (*Reader, error) {
+	switch {
+	case atomFilePath == "":
+		return nil, errors.New("invalid empty atom file path")
+	case purlParser == nil:
+		return nil, errors.New("invalid nil purl parser")
+	}
+
+	return &Reader{
+		atomFilePath: atomFilePath,
+		purlParser:   purlParser,
+	}, nil
+}
+
+// Read deserialises the json content of the provided atom file into Reachables format.
+func (r *Reader) Read(ctx context.Context) (*Response, error) {
+	b, err := os.ReadFile(r.atomFilePath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read atom file: %w", err)
+	}
+
+	logging.FromContext(ctx).Debug("sample atom file contents", slog.String("payload", string(b)))
+
+	var res Response
+	if err := json.Unmarshal(b, &res); err != nil {
+		return nil, fmt.Errorf("failed to unmarshal atom response: %w", err)
+	}
+
+	return &res, nil
+}
+
+// ReachablePurls finds all the reachable purls presents in the atom reachability result.
+func (r *Reader) ReachablePurls(ctx context.Context, reachables *Response) (ReachablePurls, error) {
+	logger := logging.FromContext(ctx)
+
+	rawPurls, err := jmespath.Search("reachables[].purls[]", reachables)
+	if err != nil {
+		return nil, fmt.Errorf("failed to search reachable purls: %w", err)
+	}
+
+	purls, ok := rawPurls.([]any)
+	if !ok {
+		logger.Error(
+			"invalid raw reachable purl. Expected an array",
+			slog.Any("raw_purls", rawPurls),
+		)
+		return nil, errors.New("invalid raw reachable purl. Expected an array")
+	}
+
+	uniquePurls := make(map[string]struct{})
+	for idx, p := range purls {
+		ps, ok := p.(string)
+		if !ok {
+			logger.Error(
+				"unexpected purl type, expected a string. Continuing...",
+				slog.Any("purl", p),
+				slog.Int("index", idx),
+			)
+			continue
+		}
+		uniquePurls[ps] = struct{}{}
+	}
+
+	finalPurls := make(ReachablePurls)
+	for p := range uniquePurls {
+		parsedPurls, err := r.purlParser.ParsePurl(p)
+		if err != nil {
+			logger.Error(
+				"could not parse purl. Continuing...",
+				slog.Any("purl", p),
+			)
+			continue
+		}
+
+		for _, pp := range parsedPurls {
+			finalPurls[pp] = struct{}{}
+		}
+	}
+
+	return finalPurls, nil
+}
+
+func (rp ReachablePurls) IsPurlReachable(purl string) bool {
+	purl = strings.ToLower(purl)
+	_, ok := rp[purl]
+	return ok
+}

components/enrichers/reachability/internal/atom/reader_test.go

@@ -0,0 +1,55 @@
+package atom_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/ocurity/dracon/components/enrichers/reachability/internal/atom"
+	"github.com/ocurity/dracon/components/enrichers/reachability/internal/atom/purl"
+)
+
+func TestNewReader(t *testing.T) {
+	purlParser, err := purl.NewParser()
+	require.NoError(t, err)
+
+	for _, tt := range []struct {
+		testCase     string
+		atomFilePath string
+		purlParser   *purl.Parser
+		expectsErr   bool
+	}{
+		{
+			testCase:     "it returns an error because the supplied atom file is empty",
+			atomFilePath: "",
+			purlParser:   purlParser,
+			expectsErr:   true,
+		},
+		{
+			testCase:     "it returns an error because the supplied purl parser is nil",
+			atomFilePath: "/some/path",
+			purlParser:   nil,
+			expectsErr:   true,
+		},
+		{
+			testCase:     "it returns a reader",
+			atomFilePath: "/some/path",
+			purlParser:   purlParser,
+			expectsErr:   false,
+		},
+	} {
+		t.Run(tt.testCase, func(t *testing.T) {
+			t.Parallel()
+
+			r, err := atom.NewReader(tt.atomFilePath, tt.purlParser)
+			if tt.expectsErr {
+				assert.Error(t, err)
+				assert.Nil(t, r)
+			} else {
+				assert.NoError(t, err)
+				assert.NotNil(t, r)
+			}
+		})
+	}
+}