Close 713 port reachability to new sdk

examples/reachability/overrides.yaml

@@ -0,0 +1,4 @@
+git-clone:
+- name: "repo_url"
+  type: "string"
+  value: "https://github.com/fportantier/vulpy.git"

examples/reachability/workflow.yaml

@@ -0,0 +1,7 @@
+description: Reachability based workflow
+name: nancy
+components:
+- component: file://new-components/targets/git-clone/component.yaml
+- component: file://new-components/scanners/bandit/component.yaml
+- component: file://new-components/enrichers/reachability/component.yaml
+- component: file://new-components/reporters/json-logger/component.yaml

new-components/enrichers/reachability/README.md

@@ -0,0 +1,29 @@
+# custom-annotation
+
+This component implements an [enricher](https://github.com/smithy-security/smithy/blob/main/sdk/component/component.go)
+This enricher performs reachability analysis using [atom](https://github.com/AppThreat/atom).
+
+## Environment variables
+
+The component uses environment variables for configuration.
+
+It requires the component
+environment variables defined [here](https://github.com/smithy-security/smithy/blob/main/sdk/README.md#component) as well as the following:
+
+| Environment Variable       | Type   | Required | Default | Description                                                             |
+|----------------------------|--------|----------|---------|-------------------------------------------------------------------------|
+| ATOM\_FILE\_PATH    | string | yes      | -       | Path to the file where atom has produced reachable slices.                     |
+
+## How to run
+
+Execute:
+
+```shell
+docker-compose up --build --force-recreate --remove-orphans
+```
+
+Then shutdown with:
+
+```shell
+docker-compose down --rmi all
+```

new-components/enrichers/reachability/cdxgen-atom-runner/Dockerfile

@@ -0,0 +1,10 @@
+FROM golang:1.23-bookworm AS build
+
+WORKDIR /build
+
+COPY . /build/
+RUN go build -o cdxgen-atom-runner main.go
+
+FROM ghcr.io/appthreat/atom:v2.1.14 AS run
+COPY --from=build /build/cdxgen-atom-runner /runner
+ENTRYPOINT ["/runner"]

new-components/enrichers/reachability/cdxgen-atom-runner/Makefile

@@ -0,0 +1,11 @@
+.PHONY: image
+
+BUILD_ARCHITECTURE=
+COMPONENT_REGISTRY=
+COMPONENT_REPOSITORY=
+COMPONENT_TAG=
+
+image:
+	docker build $$([ "${BUILD_ARCHITECTURE}" != "" ] && echo "--platform=${BUILD_ARCHITECTURE}" ) \
+				 --tag $(COMPONENT_REGISTRY)/$(COMPONENT_REPOSITORY):$(COMPONENT_TAG) \
+				 --file Dockerfile .

new-components/enrichers/reachability/cdxgen-atom-runner/go.mod

@@ -0,0 +1,13 @@
+module github.com/smithy-security/smithy/new-components/enrichers/reachability/cdxgen-atom-runner
+
+go 1.23.3
+
+require (
+	github.com/go-errors/errors v1.5.1
+	github.com/smithy-security/pkg/detect-repo-languages v0.0.0-20250224152126-1825c2dd709a
+)
+
+require (
+	github.com/go-enry/go-enry/v2 v2.9.2 // indirect
+	github.com/go-enry/go-oniguruma v1.2.1 // indirect
+)

new-components/enrichers/reachability/cdxgen-atom-runner/go.sum

@@ -0,0 +1,25 @@
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/go-enry/go-enry/v2 v2.9.2 h1:giOQAtCgBX08kosrX818DCQJTCNtKwoPBGu0qb6nKTY=
+github.com/go-enry/go-enry/v2 v2.9.2/go.mod h1:9yrj4ES1YrbNb1Wb7/PWYr2bpaCXUGRt0uafN0ISyG8=
+github.com/go-enry/go-oniguruma v1.2.1 h1:k8aAMuJfMrqm/56SG2lV9Cfti6tC4x8673aHCcBk+eo=
+github.com/go-enry/go-oniguruma v1.2.1/go.mod h1:bWDhYP+S6xZQgiRL7wlTScFYBe023B6ilRZbCAD5Hf4=
+github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk=
+github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/smithy-security/pkg/detect-repo-languages v0.0.0-20250224152126-1825c2dd709a h1:bK+oDK9NPK+nUjDwc/Lh9OHSaH4YPkeGSLWJJYoeR7E=
+github.com/smithy-security/pkg/detect-repo-languages v0.0.0-20250224152126-1825c2dd709a/go.mod h1:L9LIoEKnzIHNvlFv+bdIAxxk1I3hZD3R6mJe02RmIow=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

new-components/enrichers/reachability/cdxgen-atom-runner/main.go

@@ -0,0 +1,161 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"log"
+	"log/slog"
+	"os"
+	"os/exec"
+	"path"
+	"strings"
+
+	"github.com/go-errors/errors"
+	langs "github.com/smithy-security/pkg/detect-repo-languages"
+)
+
+var (
+	sourceLocation  string
+	scratchLocation string
+)
+
+type SupportedLanguage int
+
+const (
+	C SupportedLanguage = iota
+	Java
+	Javascript
+	Typescript
+	PHP
+	Python
+	Ruby
+)
+
+var (
+	langName = map[SupportedLanguage]string{
+		Java:       "java",
+		Javascript: "javascript",
+		Typescript: "javascript",
+		PHP:        "php",
+		Python:     "python",
+		Ruby:       "ruby",
+	}
+	toLang = map[string]SupportedLanguage{
+		"java":                 Java,
+		"java properties":      Java,
+		"java server pages":    Java,
+		"java template engine": Java,
+		"javascript":           Javascript,
+		"javascript+erb":       Javascript,
+		"typescript":           Typescript,
+		"php":                  PHP,
+		"python":               Python,
+		"python console":       Python,
+		"python traceback":     Python,
+		"ruby":                 Ruby,
+	}
+)
+
+func main() {
+
+	flag.StringVar(&sourceLocation, "source-location", "", "location of source code")
+	flag.StringVar(&scratchLocation, "scratch-location", "", "location of source code")
+	flag.Parse()
+
+	if sourceLocation == "" {
+		log.Fatal("source-location cannot be empty")
+	}
+
+	if scratchLocation == "" {
+		log.Fatal("scratch-location cannot be empty")
+	}
+
+	slog.Info("running codeql against source code at", slog.String("source", sourceLocation), "putting results at", slog.String("scratch", scratchLocation))
+	langs, err := detectLanguages(sourceLocation)
+	if err != nil {
+		log.Fatalf("could not detect languages, err: %s", err)
+	}
+	slog.Info("found ", slog.String("langs", strings.Join(langs, ",")))
+	for _, l := range langs {
+		lang, ok := toLang[l]
+		if !ok {
+			slog.Info("is not supported by codeql, skipping", slog.String("lang", l))
+			continue
+		}
+		slog.Info("preparing codeql database for ", slog.String("lang", l))
+		sbomFile, err := generateSBOM(lang)
+		if err != nil {
+			log.Fatalf("could not prepare codeql database for language %s, err: %s", langName[lang], err)
+		}
+		slog.Info("running detection for ", slog.String("lang", l))
+
+		if err := generateReachableSlices(lang, sbomFile); err != nil {
+			log.Fatalf("could not run codeql database analyze for language %s, err: %s", langName[lang], err)
+		}
+	}
+}
+
+func detectLanguages(sourceLocation string) ([]string, error) {
+	file, err := os.Stat(sourceLocation)
+	if err != nil {
+		return nil, errors.Errorf("could not read source code from path '%s', err: '%s'", sourceLocation, err)
+	}
+	if !file.IsDir() {
+		return nil, errors.Errorf("could not read source code from path '%s', it's not a directory", sourceLocation)
+	}
+	return langs.Detect(sourceLocation)
+}
+
+func generateSBOM(lang SupportedLanguage) (string, error) {
+	slog.Info("running", slog.String("command",
+		fmt.Sprintf("node /opt/cdxgen/bin/cdxgen.js -t %s --deep -r --feature-flags safe-pip-install -p -o %s	%s --spec-version 1.5",
+			langName[lang],
+			path.Join(scratchLocation, "bom.json"),
+			sourceLocation)))
+	outfileLoc := path.Join(scratchLocation, fmt.Sprintf("%s.bom.json", langName[lang]))
+	command := exec.Command("node",
+		"/opt/cdxgen/bin/cdxgen.js",
+		"-t", langName[lang],
+		"--deep",
+		"-r",
+		"--feature-flags safe-pip-install",
+		"-p",
+		"-o", outfileLoc,
+		sourceLocation,
+		"--spec-version", "1.5")
+	command.Env = append(command.Env, "NPM_INSTALL_ARGS='--force --ignore-scripts --package-lock --legacy-peer-deps'")
+	out, err := command.CombinedOutput()
+	if err != nil {
+		return "", errors.Errorf("could not generate SBOM for lang %s, could not run command, output: %s err: %w", langName[lang], string(out), err)
+	}
+	slog.Info("successfully generated SBOM for ", slog.String("language", langName[lang]), slog.String("output", string(out)))
+	return outfileLoc, nil
+}
+
+func generateReachableSlices(lang SupportedLanguage, bomFileLoc string) error {
+	bomDir := path.Dir(bomFileLoc)
+	targetFilepath := path.Join(bomDir, "bom.json")
+	if err := os.Rename(bomFileLoc, targetFilepath); err != nil {
+		return errors.Errorf("could not rename bom file %s to %s, err: %w", bomFileLoc, targetFilepath, err)
+	}
+	atomOutput := path.Join(sourceLocation, fmt.Sprintf("%s.app.atom", langName[lang]))
+	atomSlices := path.Join(scratchLocation, fmt.Sprintf("%s.reachables.json", langName[lang]))
+	slog.Info("running", slog.String("command",
+		fmt.Sprintf("atom reachables -o %s -s %s -l %s %s",
+			atomOutput, atomSlices, langName[lang], sourceLocation,
+		)))
+	command := exec.Command("/opt/bin/atom",
+		"reachables",
+		"-o", atomOutput,
+		"-s", atomSlices,
+		"-l", langName[lang],
+		sourceLocation,
+	)
+	out, err := command.CombinedOutput()
+	if err != nil {
+		return errors.Errorf("could not generate reachable slices, could not run command, output: %s err: %w", string(out), err)
+	}
+	slog.Info("successfully generated reachable slices for ", slog.String("language", langName[lang]), slog.String("output", string(out)))
+	slog.Info("output", slog.String("filename", atomOutput), slog.String("slices", atomSlices))
+	return nil
+}