Skip to content

Commit 86ad624

Browse files
author
luotianqi
committed
updata readme
1 parent 840c579 commit 86ad624

3 files changed

Lines changed: 219 additions & 219 deletions

File tree

‎.github/README.md‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
2+
3+
<p align="center">
4+
<img alt="logo" src="https://opensca.xmirror.cn/static/media/OpenSCAlogo.e980a0f9.svg">
5+
</p>
6+
<h1 align="center" style="margin: 30px 0 30px; font-weight: bold;">OpenSCA-Cli</h1>
7+
8+
<p align="center">
9+
<a href="https://github.com/XmirrorSecurity/OpenSCA-cli/blob/master/LICENSE"><img src="https://img.shields.io/github/license/XmirrorSecurity/OpenSCA-cli?style=flat-square"></a>
10+
<a href="https://github.com/XmirrorSecurity/OpenSCA-cli/releases"><img src="https://img.shields.io/github/v/release/XmirrorSecurity/OpenSCA-cli?style=flat-square"></a>
11+
</p>
12+
13+
14+
15+
## Introduction
16+
17+
OpenSCA is intended for scanning the third-party component dependencies and vulnerabilities.
18+
19+
------
20+
21+
## Detection Ability
22+
23+
OpenSCA is now capable of parsing configuration files in the listed programming languages and correspondent package managers. The project team is now dedicated to introducing more languages and enriching the parsing of relevant configuration files gradually.
24+
25+
| LANGUAGE | PACKAGE MANAGER | FILE |
26+
| ------------ | --------------- | ---------------------------------------------- |
27+
| `Java` | `Maven` | `pom.xml` |
28+
| `JavaScript` | `Npm` | `package-lock.json` `package.json` `yarn.lock` |
29+
| `PHP` | `Composer` | `composer.json` |
30+
| `Ruby` | `gem` | `gemfile.lock` |
31+
| `Golang` | `gomod` | `go.mod` `go.sum` |
32+
33+
## Download and Deployment
34+
35+
1. Download the appropriate executable file according to your system architecture from [release](https://github.com/XmirrorSecurity/OpenSCA-cli/releases).
36+
37+
2. Or download the source code and compile (go 1.11 and above is needed)
38+
39+
```
40+
git clone https://github.com/XmirrorSecurity/OpenSCA-cli.git
41+
cd opensca-cli
42+
go build cmd/opensca-cli
43+
```
44+
45+
The default option is to generate the program of the current system architecture. If you want to try it for other system architectures, you can set the following environment variables before compiling.
46+
47+
- Disable `CGO_ENABLED` `CGO_ENABLED=0`
48+
- Set the operating system `GOOS=${OS} \\ darwin,freebsd,liunx,windows`
49+
- Set the architecture `GOARCH=${arch} \\ 386,amd64,arm`
50+
51+
## Samples
52+
53+
For detecting the component information only:
54+
55+
```
56+
opensca-cli -path ${project_path}
57+
```
58+
59+
For connecting to the cloud platform:
60+
61+
```
62+
opensca-cli -url ${url} -token ${token} -path ${project_path}
63+
```
64+
65+
Or for using the local vulnerability database:
66+
67+
```
68+
opensca-cli -db db.json -path ${project_path}
69+
```
70+
71+
## Parameters
72+
73+
**You can either configure the parameters in configuration files or input the parameters in the command-line. When the two conflict with each other, the input parameters will be prioritized.**
74+
75+
| PARAMETER | TYPE | DESCRIPTION | SAMPLE |
76+
| ---------- | -------- | ------------------------------------------------------------ | --------------------------------- |
77+
| `config` | `string` | Set the configuration file path, when the program runs, the parameter of the configuration file will be used as the startup parameters. If the configuration parameter conflicts with the command-line input parameter, the latter will be taken. | `-config config.json` |
78+
| `path` | `string` | Set the file or directory path to be detected. | `-path ./foo` |
79+
| `url` | `string` | Check the vulnerabilities from the cloud vulnerability database, set the address of the cloud service. It needs to be used with the `token` parameter. | `-url https://opensca.xmirror.cn` |
80+
| `token` | `string` | Cloud service verification. You have to apply for it on the cloud service platform and use it with the `url` parameter. | `-token xxxxxxx` |
81+
| `cache` | `bool` | This option is recommended. It can cache the downloaded files, for example, the `.pom` file, and save your time when detecting the same component next time. The downloaded files are saved in `.cache` under the same directory as opensca-cli. | `-cache` |
82+
| `vuln` | `bool` | Show the vulnerabilities info only. Using this parameter, the component hierarchical architecture will **NOT** be included in the result. | `-vuln` |
83+
| `out` | `string` | Set the output file. The result is json format. | `-out output.json` |
84+
| `db` | `string` | Set the local vulnerability database file. It helps when you prefer to use your own vulnerability database. The format of the vulnerability database is shown below. If the cloud and local vulnerability databases are both set, the result of detection will merge both. | `-db db.json` |
85+
| `progress` | `bool` | Show the progress bar. | `-progress` |
86+
87+
------
88+
89+
### The Format of the Vulnerability Database File
90+
91+
```
92+
[
93+
{
94+
"vendor": "org.apache.logging.log4j",
95+
"product": "log4j-core",
96+
"version": "[2.0-beta9,2.12.2)||[2.13.0,2.15.0)",
97+
"language": "java",
98+
"name": "Apache Log4j2 远程代码执行漏洞",
99+
"id": "XMIRROR-2021-44228",
100+
"cve_id": "CVE-2021-44228",
101+
"cnnvd_id": "CNNVD-202112-799",
102+
"cnvd_id": "CNVD-2021-95914",
103+
"cwe_id": "CWE-502,CWE-400,CWE-20",
104+
"description": "Apache Log4j是美国阿帕奇（Apache）基金会的一款基于Java的开源日志记录工具。\r\nApache Log4J 存在代码问题漏洞，攻击者可设计一个数据请求发送给使用 Apache Log4j工具的服务器，当该请求被打印成日志时就会触发远程代码执行。",
105+
"description_en": "Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0, this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.",
106+
"suggestion": "2.12.1及以下版本可以更新到2.12.2，其他建议更新至2.15.0或更高版本，漏洞详情可参考：https://github.com/apache/logging-log4j2/pull/608 \r\n1、临时解决方案，适用于2.10及以上版本：\r\n\t（1）设置jvm参数：“-Dlog4j2.formatMsgNoLookups=true”；\r\n\t（2）设置参数：“log4j2.formatMsgNoLookups=True”；",
107+
"attack_type": "远程",
108+
"release_date": "2021-12-10",
109+
"security_level_id": 1,
110+
"exploit_level_id": 1
111+
},
112+
{}
113+
]
114+
```
115+
116+
#### Explanations of Vulnerability Database Fields
117+
118+
| FIELD | DESCRIPTION | REQUIRED OR NOT |
119+
| ------------------- | ------------------------------------------------------------ | --------------- |
120+
| `vendor` | the manufacturer of the component | N |
121+
| `product` | the name of the component | Y |
122+
| `version` | the versions of the component affected by the vulnerability | Y |
123+
| `language` | the programming language of the component | Y |
124+
| `name` | the name of the vulnerability | N |
125+
| `id` | custom identifier | Y |
126+
| `cve_id` | cve identifier | N |
127+
| `cnnvd_id` | cnnvd identifier | N |
128+
| `cnvd_id` | cnvd identifier | N |
129+
| `cwe_id` | cwe identifier | N |
130+
| `description` | the description of the vulnerability | N |
131+
| `description_en` | the description of the vulnerability in English | N |
132+
| `suggestion` | the suggestion for fixing the vulnerability | N |
133+
| `attack_type` | the type of attack | N |
134+
| `release_date` | the release date of the vulnerability | N |
135+
| `security_level_id` | the security level of the vulnerability (diminishing from 1 to 4) | N |
136+
| `exploit_level_id` | the exploit level of the vulnerability (0-N/A 1-Available) | N |
137+
138+
## Contributing
139+
140+
OpenSCA is an open source project, we appreciate your help!
141+
142+
To contribute, please read our [Contributing Guideline](./docs/Contributing%20Guideline-en%20v1.0.md).
143+
144+
145+
146+
*For the Chinese version of this document, please check [README](./README-CN.md).

‎README-CN.md‎

Lines changed: 0 additions & 140 deletions
This file was deleted.

0 commit comments

Comments
 (0)