Skip to content

Commit 83db6c9

Browse files
Alex HolmbergAlex793x
authored andcommitted
feat: huge improvements towards security and secret variable detection.
With the new update we don't get false positive towards files name conventions such as .env.samples, .env.templates, env.examples etc. We are also skipping if files are ignored within .gitignore, since those files aren't being track. upcoming is to ensure git cache isn't storing .gitignored files, to ensure mistakes doesn't happen
1 parent cc04d9a commit 83db6c9

14 files changed

Lines changed: 3164 additions & 114 deletions

File tree

Cargo.lock

Lines changed: 11 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Cargo.toml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ termcolor = "1"
3333
chrono = { version = "0.4", features = ["serde"] }
3434
colored = "2"
3535
prettytable = "0.10"
36+
term_size = "0.3"
3637

3738
# Vulnerability checking dependencies
3839
rustsec = "0.29"

examples/enhanced_security.rs

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
//! Example: Enhanced Security Analysis
2+
//!
3+
//! This example demonstrates the enhanced security analysis capabilities
4+
//! including the new modular JavaScript/TypeScript security analyzer.
5+
6+
use std::path::Path;
7+
use syncable_cli::analyzer::{analyze_project, SecurityAnalyzer};
8+
9+
fn main() -> Result<(), Box<dyn std::error::Error>> {
10+
env_logger::init();
11+
12+
// For this example, analyze the current directory or a provided path
13+
let project_path = std::env::args()
14+
.nth(1)
15+
.map(|p| Path::new(&p).to_path_buf())
16+
.unwrap_or_else(|| std::env::current_dir().unwrap());
17+
18+
println!("🔍 Analyzing project security for: {}", project_path.display());
19+
20+
// First, perform regular project analysis to detect languages
21+
let analysis = analyze_project(&project_path)?;
22+
23+
println!("\n📋 Detected Languages:");
24+
for lang in &analysis.languages {
25+
println!(" • {} (confidence: {:.1}%)", lang.name, lang.confidence * 100.0);
26+
}
27+
28+
println!("\n🔧 Detected Technologies:");
29+
for tech in &analysis.technologies {
30+
println!(" • {} v{} ({:?})",
31+
tech.name,
32+
tech.version.as_deref().unwrap_or("unknown"),
33+
tech.category
34+
);
35+
}
36+
37+
// Check if this is a JavaScript/TypeScript project
38+
let has_js = analysis.languages.iter()
39+
.any(|lang| matches!(lang.name.as_str(), "JavaScript" | "TypeScript" | "JSX" | "TSX"));
40+
41+
if has_js {
42+
println!("\n✅ JavaScript/TypeScript project detected! Using enhanced security analysis...");
43+
} else {
44+
println!("\n📄 Using general security analysis...");
45+
}
46+
47+
// Run enhanced security analysis
48+
println!("\n🛡️ Starting enhanced security analysis...");
49+
50+
let mut security_analyzer = SecurityAnalyzer::new()?;
51+
let security_report = security_analyzer.analyze_security_enhanced(&analysis)?;
52+
53+
// Display results
54+
println!("\n📊 Security Analysis Results:");
55+
println!(" Overall Score: {:.1}/100", security_report.overall_score);
56+
println!(" Risk Level: {:?}", security_report.risk_level);
57+
println!(" Total Findings: {}", security_report.total_findings);
58+
59+
if security_report.total_findings > 0 {
60+
println!("\n🚨 Security Findings:");
61+
62+
// Group findings by severity
63+
for severity in [
64+
syncable_cli::analyzer::security::core::SecuritySeverity::Critical,
65+
syncable_cli::analyzer::security::core::SecuritySeverity::High,
66+
syncable_cli::analyzer::security::core::SecuritySeverity::Medium,
67+
syncable_cli::analyzer::security::core::SecuritySeverity::Low,
68+
] {
69+
let findings: Vec<_> = security_report.findings.iter()
70+
.filter(|f| f.severity == severity)
71+
.collect();
72+
73+
if !findings.is_empty() {
74+
let severity_icon = match severity {
75+
syncable_cli::analyzer::security::core::SecuritySeverity::Critical => "🔴",
76+
syncable_cli::analyzer::security::core::SecuritySeverity::High => "🟠",
77+
syncable_cli::analyzer::security::core::SecuritySeverity::Medium => "🟡",
78+
syncable_cli::analyzer::security::core::SecuritySeverity::Low => "🔵",
79+
_ => "⚪",
80+
};
81+
82+
println!("\n{} {:?} Severity ({} findings):", severity_icon, severity, findings.len());
83+
84+
for finding in findings.iter().take(3) { // Show first 3 of each severity
85+
println!(" 📍 {}", finding.title);
86+
if let Some(ref file_path) = finding.file_path {
87+
let relative_path = file_path.strip_prefix(&project_path)
88+
.unwrap_or(file_path);
89+
print!(" 📄 {}", relative_path.display());
90+
if let Some(line) = finding.line_number {
91+
print!(":{}", line);
92+
}
93+
println!();
94+
}
95+
println!(" 💡 {}", finding.description);
96+
97+
if !finding.remediation.is_empty() {
98+
println!(" 🔧 Remediation: {}", finding.remediation[0]);
99+
}
100+
println!();
101+
}
102+
103+
if findings.len() > 3 {
104+
println!(" ... and {} more findings", findings.len() - 3);
105+
}
106+
}
107+
}
108+
109+
// Show recommendations
110+
if !security_report.recommendations.is_empty() {
111+
println!("\n💡 Recommendations:");
112+
for (i, recommendation) in security_report.recommendations.iter().enumerate() {
113+
println!(" {}. {}", i + 1, recommendation);
114+
}
115+
}
116+
} else {
117+
println!("✅ No security issues detected!");
118+
}
119+
120+
println!("\n✨ Enhanced security analysis complete!");
121+
122+
Ok(())
123+
}

src/analyzer/frameworks/go.rs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -232,12 +232,12 @@ fn get_go_technology_rules() -> Vec<TechnologyRule> {
232232
// CLI FRAMEWORKS
233233
TechnologyRule {
234234
name: "Cobra".to_string(),
235-
category: TechnologyCategory::Library(LibraryType::Utility),
235+
category: TechnologyCategory::Library(LibraryType::CLI),
236236
confidence: 0.85,
237237
dependency_patterns: vec!["github.com/spf13/cobra".to_string(), "cobra".to_string()],
238238
requires: vec![],
239239
conflicts_with: vec![],
240-
is_primary_indicator: false,
240+
is_primary_indicator: true,
241241
alternative_names: vec!["spf13/cobra".to_string()],
242242
},
243243

src/analyzer/frameworks/rust.rs

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -414,32 +414,32 @@ fn get_rust_technology_rules() -> Vec<TechnologyRule> {
414414
// CLI FRAMEWORKS
415415
TechnologyRule {
416416
name: "clap".to_string(),
417-
category: TechnologyCategory::Library(LibraryType::Utility),
417+
category: TechnologyCategory::Library(LibraryType::CLI),
418418
confidence: 0.85,
419419
dependency_patterns: vec!["clap".to_string()],
420420
requires: vec![],
421421
conflicts_with: vec![],
422-
is_primary_indicator: false,
422+
is_primary_indicator: true,
423423
alternative_names: vec![],
424424
},
425425
TechnologyRule {
426426
name: "structopt".to_string(),
427-
category: TechnologyCategory::Library(LibraryType::Utility),
427+
category: TechnologyCategory::Library(LibraryType::CLI),
428428
confidence: 0.85,
429429
dependency_patterns: vec!["structopt".to_string()],
430430
requires: vec![],
431431
conflicts_with: vec![],
432-
is_primary_indicator: false,
432+
is_primary_indicator: true,
433433
alternative_names: vec![],
434434
},
435435
TechnologyRule {
436436
name: "argh".to_string(),
437-
category: TechnologyCategory::Library(LibraryType::Utility),
437+
category: TechnologyCategory::Library(LibraryType::CLI),
438438
confidence: 0.85,
439439
dependency_patterns: vec!["argh".to_string()],
440440
requires: vec![],
441441
conflicts_with: vec![],
442-
is_primary_indicator: false,
442+
is_primary_indicator: true,
443443
alternative_names: vec![],
444444
},
445445

src/analyzer/mod.rs

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ pub mod language_detector;
1919
pub mod project_context;
2020
pub mod vulnerability_checker;
2121
pub mod security_analyzer;
22+
pub mod security;
2223
pub mod tool_installer;
2324
pub mod monorepo_detector;
2425
pub mod docker_analyzer;
@@ -36,6 +37,13 @@ pub use security_analyzer::{
3637
SecurityCategory, ComplianceStatus, SecurityAnalysisConfig
3738
};
3839

40+
// Re-export new modular security analysis types
41+
pub use security::{
42+
ModularSecurityAnalyzer, JavaScriptSecurityAnalyzer,
43+
SecretPatternManager
44+
};
45+
pub use security::config::SecurityConfigPreset;
46+
3947
// Re-export monorepo analysis types
4048
pub use monorepo_detector::{
4149
MonorepoDetectionConfig, analyze_monorepo, analyze_monorepo_with_config
@@ -102,6 +110,8 @@ pub enum LibraryType {
102110
HttpClient,
103111
/// Authentication (Auth0, Firebase Auth)
104112
Authentication,
113+
/// CLI frameworks (clap, structopt, argh)
114+
CLI,
105115
/// Other specific types
106116
Other(String),
107117
}

0 commit comments

Comments
 (0)