vulns.go

package main

import (
	"encoding/json"
	"fmt"
	"log"

	"github.com/michael-go/go-jsn/jsn"
)

// IssuesFilter is the top level filter type of filtering Snyk response
type IssuesFilter struct {
	Filters Filter `json:"filters"`
}

type score struct {
	Min int `json:"min"`
	Max int `json:"max"`
}

type Priority struct {
	Score score `json:"score"`
}

// Filter allows to filter on severity, type, ignore or patched vuln
type Filter struct {
	Severities      []string `json:"severities"`
	ExploitMaturity []string `json:"exploitMaturity,omitempty"`
	Priority        Priority `json:"priority"`
	Types           []string `json:"types"`
	Ignored         bool     `json:"ignored"`
	Patched         bool     `json:"patched"`
	isUpgradable    bool     `json:"isUpgradable"`
}

func getVulnsWithoutTicket(flags flags, projectID string, maturityFilter []string, tickets map[string]string, customDebug debug) (map[string]interface{}, string, error) {

	body := IssuesFilter{
		Filter{
			Severities: []string{"high"},
			Types:      []string{"vuln", "license"},
			Priority:   Priority{score{Min: 0, Max: 1000}},
			Ignored:    false,
			Patched:    false,
		},
	}
	if flags.optionalFlags.issueType != "all" && flags.optionalFlags.issueType != "" {
		body.Filters.Types = []string{flags.optionalFlags.issueType}
	}
	switch flags.optionalFlags.severity {
	case "critical":
		body.Filters.Severities = []string{"critical"}
	case "high":
		body.Filters.Severities = []string{"critical", "high"}
	case "medium":
		body.Filters.Severities = []string{"critical", "high", "medium"}
	case "low":
		body.Filters.Severities = []string{"critical", "high", "medium", "low"}
	default:
		log.Fatalln("Unexpected severity threshold")
	}
	if len(maturityFilter) > 0 {
		body.Filters.ExploitMaturity = maturityFilter
	}

	body.Filters.Priority.Score.Min = 0
	body.Filters.Priority.Score.Max = 1000
	if flags.optionalFlags.priorityScoreThreshold > 0 {
		body.Filters.Priority.Score.Min = flags.optionalFlags.priorityScoreThreshold
	}

	marshalledBody, err := json.Marshal(body)

	if err != nil {
		message := fmt.Sprintf(" *** ERROR *** IAC projects are not supported by this tool, skipping this project")
		writeErrorFile("getVulnsWithoutTicket", message, customDebug)
		customDebug.Debug(" *** ERROR *** IAC projects are not supported by this tool, skipping this project")
	}

	responseAggregatedData, err := makeSnykAPIRequest("POST", flags.mandatoryFlags.endpointAPI+"/v1/org/"+flags.mandatoryFlags.orgID+"/project/"+projectID+"/aggregated-issues", flags.mandatoryFlags.apiToken, marshalledBody, customDebug)
	if err != nil {
		message := fmt.Sprintf("*** ERROR *** Could not get aggregated data from %s org %s project %s, skipping this project", flags.mandatoryFlags.endpointAPI, flags.mandatoryFlags.orgID, projectID)
		writeErrorFile("getVulnsWithoutTicket", message, customDebug)
		customDebug.Debugf("*** ERROR *** Could not get aggregated data from %s org %s project %s, skipping this project", flags.mandatoryFlags.endpointAPI, flags.mandatoryFlags.orgID, projectID)
		return nil, "", err
	}

	j, err := jsn.NewJson(responseAggregatedData)
	vulnsWithAllPaths := make(map[string]interface{})

	issueType := ""
	listOfIssues := j.K("issues").Array().Elements()
	if len(listOfIssues) > 0 {
		issueType = listOfIssues[0].K("issueType").String().Value
	}

	// IAC issues are of type configuration and are not supported atm
	if issueType == "configuration" {
		message := fmt.Sprintf(" *** WARN *** IAC projects are not supported, skipping project ID %s", projectID)
		writeErrorFile("getVulnsWithoutTicket", message, customDebug)
		customDebug.Debug(" *** WARN *** IAC projects are not supported, skipping")
		return vulnsWithAllPaths, "", err
	}

	// Code issue
	// the response from aggregated data is empty for code issues
	if len(listOfIssues) == 0 {
		snykCodeIssue, err := getSnykCodeIssueWithoutTickets(flags, projectID, tickets, customDebug)
		return snykCodeIssue, "", err
	}

	// Open source issue
	skippedIssues := ""
	vulnsWithAllPaths, skippedIssues, err = getSnykOpenSourceIssueWithoutTickets(flags, projectID, maturityFilter, tickets, customDebug, responseAggregatedData)

	return vulnsWithAllPaths, skippedIssues, err
}

/*
**
function getSnykOpenSourceIssueWithoutTickets
input flags mandatory and optionnal flags
input projectID string, the ID of the project we are get issues from
input tickets map[string]string, the list value pair ticket id, issue id which already have a ticket
input debug customDebug
input responseAggregatedData []byte, response from the aggregated data endpoint
return vulnsWithAllPaths map[string]interface{}, list of issues with all details and path
return skippedIssues string, list of issues that couldn't be created because there was a problem retrieving data from snyk
Create a list of issue details without tickets.

	Loop through the issues
		Get the path for each issue id
		add the path to the issue details

**
*/
func getSnykOpenSourceIssueWithoutTickets(flags flags, projectID string, maturityFilter []string, tickets map[string]string, customDebug debug, responseAggregatedData []byte) (map[string]interface{}, string, error) {

	vulnsPerPath := make(map[string]interface{})
	vulnsWithAllPaths := make(map[string]interface{})

	j, err := jsn.NewJson(responseAggregatedData)
	if err != nil {
		message := fmt.Sprintf(" %s", err.Error())
		writeErrorFile("getSnykOpenSourceIssueWithoutTickets", message, customDebug)
		return nil, "", err
	}

	listOfIssues := j.K("issues").Array().Elements()

	issueSkipped := ""

	for _, e := range listOfIssues {
		if e.K("issueType").String().Value == "vuln" {
			if len(e.K("id").String().Value) != 0 {
				if _, found := tickets[e.K("id").String().Value]; !found {

					var issueId = e.K("id").String().Value

					bytes, err := json.Marshal(e)
					if err != nil {
						continue
					}
					json.Unmarshal(bytes, &vulnsPerPath)

					ProjectIssuePathData, err := makeSnykAPIRequest("GET", flags.mandatoryFlags.endpointAPI+"/v1/org/"+flags.mandatoryFlags.orgID+"/project/"+projectID+"/issue/"+issueId+"/paths", flags.mandatoryFlags.apiToken, nil, customDebug)
					if err != nil {
						log.Printf("*** ERROR *** Could not get paths data from %s org %s project %s issue %s", flags.mandatoryFlags.endpointAPI, flags.mandatoryFlags.orgID, projectID, issueId)
						issueSkipped += "\nissue ID: " + issueId + " from project ID:" + projectID
						message := fmt.Sprintf("*** ERROR *** Could not get paths data from %s org %s project %s issue %s skipped", flags.mandatoryFlags.endpointAPI, flags.mandatoryFlags.orgID, projectID, issueId)
						writeErrorFile("getSnykOpenSourceIssueWithoutTickets", message, customDebug)
						continue
					}
					ProjectIssuePathDataJson, er := jsn.NewJson(ProjectIssuePathData)
					if er != nil {
						log.Printf("*** ERROR *** Json creation failed\n")
						issueSkipped += "\nissue ID: " + issueId + " from project ID:" + projectID
						message := fmt.Sprintf("*** ERROR *** *** ERROR *** Json creation failed \n issue skipped %s org %s project %s issue %s", flags.mandatoryFlags.endpointAPI, flags.mandatoryFlags.orgID, projectID, issueId)
						writeErrorFile("getSnykOpenSourceIssueWithoutTickets", message, customDebug)
						continue
					}
					vulnsPerPath["from"] = ProjectIssuePathDataJson.K("paths")
					marshalledvulnsPerPath, err := json.Marshal(vulnsPerPath)
					vulnsWithAllPaths[issueId], err = jsn.NewJson(marshalledvulnsPerPath)
					if er != nil {
						log.Printf("*** ERROR *** vuln per path Json creation failed\n")
						message := fmt.Sprintf("*** ERROR *** Json creation failed \n issue skipped %s org %s project %s issue %s", flags.mandatoryFlags.endpointAPI, flags.mandatoryFlags.orgID, projectID, issueId)
						writeErrorFile("getSnykOpenSourceIssueWithoutTickets", message, customDebug)
						issueSkipped += "\nissue ID: " + issueId + " from project ID:" + projectID
						continue
					}
				}
			}
		}
	}

	for _, e := range listOfIssues {
		if e.K("issueType").String().Value == "license" {
			if len(e.K("id").String().Value) != 0 {
				if _, found := tickets[e.K("id").String().Value]; !found {
					var issueId = e.K("id").String().Value
					bytes, err := json.Marshal(e)
					if err != nil {
						continue
					}
					json.Unmarshal(bytes, &vulnsPerPath)

					ProjectIssuePathData, err := makeSnykAPIRequest("GET", flags.mandatoryFlags.endpointAPI+"/v1/org/"+flags.mandatoryFlags.orgID+"/project/"+projectID+"/issue/"+issueId+"/paths", flags.mandatoryFlags.apiToken, nil, customDebug)
					if err != nil {
						log.Printf("*** ERROR *** Could not get aggregated data from %s org %s project %s issue %s", flags.mandatoryFlags.endpointAPI, flags.mandatoryFlags.orgID, projectID, issueId)
						issueSkipped += "\nissue ID: " + issueId + " from project ID:" + projectID
						message := fmt.Sprintf("*** ERROR *** Could not get aggregated data from %s org %s project %s issue %s skipped", flags.mandatoryFlags.endpointAPI, flags.mandatoryFlags.orgID, projectID, issueId)
						writeErrorFile("getSnykOpenSourceIssueWithoutTickets", message, customDebug)
						continue
					}

					ProjectIssuePathDataJson, er := jsn.NewJson(ProjectIssuePathData)
					if er != nil {
						log.Printf("*** ERROR *** Json creation failed\n")
						issueSkipped += "\nissue ID: " + issueId + " from project ID:" + projectID
						message := fmt.Sprintf("*** ERROR *** Json creation failed \n issue skipped %s org %s project %s issue %s", flags.mandatoryFlags.endpointAPI, flags.mandatoryFlags.orgID, projectID, issueId)
						writeErrorFile("getSnykOpenSourceIssueWithoutTickets", message, customDebug)
						continue
					}

					vulnsPerPath["from"] = ProjectIssuePathDataJson.K("paths")
					marshalledvulnsPerPath, err := json.Marshal(vulnsPerPath)
					vulnsWithAllPaths[issueId], err = jsn.NewJson(marshalledvulnsPerPath)
					if er != nil {
						log.Printf("*** ERROR *** license per path Json creation failed\n")
						issueSkipped += "\nissue ID: " + issueId + " from project ID:" + projectID
						message := fmt.Sprintf("*** ERROR *** Json creation failed \n issue skipped %s org %s project %s issue %s", flags.mandatoryFlags.endpointAPI, flags.mandatoryFlags.orgID, projectID, issueId)
						writeErrorFile("getSnykOpenSourceIssueWithoutTickets", message, customDebug)
						continue
					}
				}
			}
		}
	}
	return vulnsWithAllPaths, issueSkipped, nil
}

func createMaturityFilter(filtersArray []string) []string {

	var MaturityFilter []string

	for _, filter := range filtersArray {
		switch filter {
		case "no-data":
			MaturityFilter = append(MaturityFilter, filter)
		case "no-known-exploit":
			MaturityFilter = append(MaturityFilter, filter)
		case "proof-of-concept":
			MaturityFilter = append(MaturityFilter, filter)
		case "mature":
			MaturityFilter = append(MaturityFilter, filter)
		case "":
		default:
			log.Fatalf("*** ERROR ***: %s is not a valid maturity level. Levels are Must be one of [no-data,no-known-exploit,proof-of-concept,mature]", filter)
		}
	}
	return MaturityFilter
}

/*
**
function getSnykCodeIssueWithoutTickets
input flags mandatory and optionnal flags
input projectID string, the ID of the project we are get issues from
input tickets map[string]string, the list value pair ticket id, issue id which already have a ticket
input debug customDebug
return fullCodeIssueDetail map[string]interface{}, list of issue details without tickets
Create a list of issue details without tickets.

	Loop through the severity array to get the all issues IDs
	Loop through those ids the get the details
		The issue details doesn't give the title of the severity => adding it the the details
	Adding all the details to the list

**
*/
func getSnykCodeIssueWithoutTickets(flags flags, projectID string, tickets map[string]string, customDebug debug) (map[string]interface{}, error) {

	// In the v1 api low severity means get all the issues up,
	// mediun means all but low and so on
	// this is not possible with v3.
	// to keep the logic of the tool
	// we create an array of severity
	// and loop on it to get all the issues
	severity := []string{}
	switch flags.optionalFlags.severity {
	case "critical":
		severity = []string{"critical"}
	case "high":
		severity = []string{"critical", "high"}
	case "medium":
		severity = []string{"critical", "high", "medium"}
	case "low":
		severity = []string{"critical", "high", "medium", "low"}
	default:
		message := fmt.Sprintf("*** ERROR *** Unexpected severity threshold ")
		writeErrorFile("getSnykCodeIssueWithoutTickets", message, customDebug)
		log.Fatalln("Unexpected severity threshold")
	}

	fullCodeIssueDetail := make(map[string]interface{})
	var errorMessage error

	// Doing this for test propose
	endpointAPI := flags.mandatoryFlags.endpointAPI
	if endpointAPI == "" {
		endpointAPI = "https://api.snyk.io"
	}

	for _, severityIndexValue := range severity {

		url := endpointAPI + "/rest/orgs/" + flags.mandatoryFlags.orgID + "/issues?project_id=" + projectID + "&version=2021-08-20~experimental"
		if len(flags.optionalFlags.severity) > 0 {
			url = endpointAPI + "/rest/orgs/" + flags.mandatoryFlags.orgID + "/issues?project_id=" + projectID + "&severity=" + severityIndexValue + "&version=2021-08-20~experimental"
		}

		for {
			// get the list of code issue for this project
			responseData, err := makeSnykAPIRequest("GET", url, flags.mandatoryFlags.apiToken, nil, customDebug)

			if err != nil {
				if (err.Error() != "Not found, Request failed") && (err.Error() != "Request failed with 50x") {
					log.Printf("*** ERROR ***** Could not get code issues list from %s org %s project %s", flags.mandatoryFlags.endpointAPI, flags.mandatoryFlags.orgID, projectID)
					errorMessage = err
					message := fmt.Sprintf("*** ERROR ***** Could not get code issues list from %s org %s project %s", flags.mandatoryFlags.endpointAPI, flags.mandatoryFlags.orgID, projectID)
					writeErrorFile("getSnykCodeIssueWithoutTickets", message, customDebug)
					break
				}
			}

			// loop through the issues and get the details
			jsonData, err := jsn.NewJson(responseData)

			issueDetail := make(map[string]interface{})

			for _, e := range jsonData.K("data").Array().Elements() {

				if len(e.K("id").String().Value) != 0 {
					if _, found := tickets[e.K("id").String().Value]; !found {

						// checking if the issue is ignored
						if e.K("attributes").K("ignored").Bool().Value == true {
							continue
						}

						id := e.K("id").String().Value

						url := endpointAPI + "/rest/orgs/" + flags.mandatoryFlags.orgID + "/issues/detail/code/" + id + "?project_id=" + projectID + "&version=2022-04-06~experimental"

						// get the details of this code issue id
						responseIssueDetail, err := makeSnykAPIRequest("GET", url, flags.mandatoryFlags.apiToken, nil, customDebug)
						if err != nil {
							log.Printf("*** ERROR *** Could not get code issues list from %s org %s project %s", flags.mandatoryFlags.endpointAPI, flags.mandatoryFlags.orgID, projectID)
							message := fmt.Sprintf("*** ERROR *** Could not get code issues list from %s org %s project %s", flags.mandatoryFlags.endpointAPI, flags.mandatoryFlags.orgID, projectID)
							writeErrorFile("getSnykCodeIssueWithoutTickets", message, customDebug)
							continue
						}

						jsonIssueDetail, er := jsn.NewJson(responseIssueDetail)
						if er != nil {
							log.Printf("*** ERROR *** Json creation failed\n")
							message := fmt.Sprintf("*** ERROR *** Json creation failed\n")
							writeErrorFile("getSnykCodeIssueWithoutTickets", message, customDebug)
							continue
						}

						bytes, err := json.Marshal(jsonIssueDetail)
						if err != nil {
							continue
						}
						json.Unmarshal(bytes, &issueDetail)

						if flags.optionalFlags.priorityScoreThreshold > 0 {
							if flags.optionalFlags.priorityScoreThreshold > jsonIssueDetail.K("data").K("attributes").K("priorityScore").Int().Value {
								customDebug.Debug(fmt.Sprintf("*** INFO *** Filtering out issue based on priority score priorityScoreThreshold=%d, issue priorityScore=%d", flags.optionalFlags.priorityScoreThreshold, jsonIssueDetail.K("data").K("attributes").K("priorityScore").Int().Value))
								continue
							}
						}

						issueDetail["title"] = e.K("attributes").K("title").String().Value

						marshalledjsonIssueDetail, err := json.Marshal(issueDetail)
						fullCodeIssueDetail[id], err = jsn.NewJson(marshalledjsonIssueDetail)
						if er != nil {
							log.Printf("*** ERROR *** Json creation failed\n")
							message := fmt.Sprintf("*** ERROR *** Json creation failed\n")
							writeErrorFile("getSnykCodeIssueWithoutTickets", message, customDebug)
							log.Fatalln(er)
						}
					}

				}
			}

			if len(jsonData.K("links").K("next").String().Value) > 0 {
				url = endpointAPI + "/rest" + jsonData.K("links").K("next").String().Value
			} else {
				break
			}
		}
	}

	return fullCodeIssueDetail, errorMessage
}