plugins/semgrep: add csmock semgrep plugin

make-srpm.sh

@@ -198,6 +198,13 @@ Requires: csmock-common
 %description -n csmock-plugin-pylint
 This package contains the pylint plug-in for csmock.
 
+%package -n csmock-plugin-semgrep
+Summary: csmock plug-in providing the support for semgrep scan
+Requires: csmock-common
+
+%description -n csmock-plugin-semgrep
+This package contains the semgrep plug-in for csmock.
+
 %package -n csmock-plugin-shellcheck
 Summary: csmock plug-in providing the support for ShellCheck.
 Requires: csmock-common
@@ -330,6 +337,10 @@ This package contains the unicontrol plug-in for csmock.
 %{python3_sitelib}/csmock/plugins/pylint.py*
 %{python3_sitelib}/csmock/plugins/__pycache__/pylint.*
 
+%files -n csmock-plugin-semgrep
+%{python3_sitelib}/csmock/plugins/semgrep.py*
+%{python3_sitelib}/csmock/plugins/__pycache__/semgrep.*
+
 %files -n csmock-plugin-shellcheck
 %{_datadir}/csmock/scripts/run-shellcheck.sh
 %{python3_sitelib}/csmock/plugins/shellcheck.py*

py/CMakeLists.txt

@@ -64,6 +64,7 @@ if(ENABLE_CSMOCK)
     install_plugin(gitleaks)
     install_plugin(infer)
     install_plugin(pylint)
+    install_plugin(semgrep)
     install_plugin(shellcheck)
     install_plugin(smatch)
     install_plugin(snyk)

py/plugins/semgrep.py

@@ -0,0 +1,233 @@
+# Copyright (C) 2024 Red Hat, Inc.
+#
+# This file is part of csmock.
+#
+# csmock is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# any later version.
+#
+# csmock is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with csmock.  If not, see <http://www.gnu.org/licenses/>.
+
+"""
+Semgrep client plugin
+"""
+import os
+
+from csmock.common.util import sanitize_opts_arg  # pylint: disable=import-error
+
+
+# disable metrics to be sent to semgrep cloud
+DEFAULT_SEMGREP_SEND_METRICS = "off"
+
+# This plug-in is pinned to a specific version of Semgrep because newer Semgrep
+# versions break compatibility with externally maintained Semgrep rules.  See
+# https://github.com/semgrep/semgrep/releases for available releases.
+SEMGREP_CLI_VERSION = "1.56.0"
+
+SEMGREP_SCAN_DIR = "/builddir/build/BUILD"
+
+SEMGREP_SCAN_OUTPUT = "/builddir/semgrep-scan-results.sarif"
+
+SEMGREP_SCAN_CHROOT_ROOT_PATH = "/builddir/semgrep-chroot-root"
+
+SEMGREP_SCAN_LOG = "/builddir/semgrep-scan.log"
+
+
+class PluginProps:  # pylint: disable=too-few-public-methods
+    """
+    Props of the plugin
+    """
+    def __init__(self):
+        self.description = (
+            "A fast, open-source, static analysis engine for finding bugs, "
+            "detecting dependency vulnerabilities, and enforcing code standards."
+        )
+
+        self.stable = False
+
+
+class Plugin:
+    """
+    Semgrep static analysis engine plugin
+    """
+    def __init__(self):
+        self.enabled = False
+        self.semgrep_scan_opts = None
+
+    def get_props(self):  # pylint: disable=missing-function-docstring
+        return PluginProps()
+
+    def enable(self):  # pylint: disable=missing-function-docstring
+        self.enabled = True
+
+    def init_parser(self, parser):
+        """
+        Initialize the argument parser for the Semgrep plugin.
+        """
+        parser.add_argument(
+            "--semgrep-metrics",
+            default=DEFAULT_SEMGREP_SEND_METRICS,
+            help=f"configure whether usage metrics are sent to the Semgrep server (defaults to {DEFAULT_SEMGREP_SEND_METRICS})",
+        )
+
+        parser.add_argument(
+            "--semgrep-rules-repo",
+            help="semgrep rules repo, assuming rules are located under the 'rules' sub-directory",
+        )
+
+        parser.add_argument(
+            "--semgrep-verbose",
+            action="store_true",
+            help="show more details about what rules are running, which files failed to parse, etc.",
+        )
+
+        parser.add_argument(
+            "--semgrep-scan-opts",
+            help="space-separated list of additional options passed to the 'semgrep scan' command",
+        )
+
+    def handle_args(self, parser, args, props):  # pylint: disable=too-many-statements,missing-function-docstring
+        if not self.enabled:
+            return
+
+        if not args.semgrep_rules_repo:
+            parser.error("'--semgrep-rules-repo' is required to run semgrep scan")
+
+        # sanitize options passed to --semgrep-scan-opts to avoid shell injection
+        self.semgrep_scan_opts = sanitize_opts_arg(parser, args, "--semgrep-scan-opts")
+
+        # install semgrep cli and download semgrep rules
+        def prepare_semgrep_runtime_hook(results, props):
+            # target dir where semgrep cli and its dependencies are installed
+            semgrep_lib_dir = os.path.join(results.tmpdir, "semgrep_lib")
+            try:
+                # make sure the lib directory exists
+                os.makedirs(semgrep_lib_dir, mode=0o755, exist_ok=True)
+            except OSError:
+                results.error("failed to create semgrep lib directory")
+                return 1
+
+            # install semgrep cli using pip
+            cmd = f"python3 -m pip install --target={semgrep_lib_dir} semgrep=={SEMGREP_CLI_VERSION}"
+            ec = results.exec_cmd(cmd, shell=True)
+            if 0 != ec:
+                results.error("failed to install semgrep cli using pip")
+                return 1
+
+            semgrep_prefix = f"env PATH={semgrep_lib_dir}/bin:$PATH, PYTHONPATH={semgrep_lib_dir}"
+
+            semgrep_rules_repo_dir = os.path.join(results.tmpdir, "semgrep_rules")
+            repo_clone_cmd = [
+                "git", "clone", "--depth", "1",
+                args.semgrep_rules_repo,
+                semgrep_rules_repo_dir
+            ]
+            ec = results.exec_cmd(repo_clone_cmd)
+            if 0 != ec:
+                results.error("failed to download semgrep rules")
+                return ec
+            # query version of semgrep
+            cmd = semgrep_prefix + " semgrep --version"
+            ec, output = results.get_cmd_output(cmd)
+            if 0 != ec:
+                results.error("failed to query semgrep cli version", ec=ec)
+                return ec
+
+            # parse and record the version of semgrep cli
+            version = output.rstrip("\n")
+            results.ini_writer.append("analyzer-version-semgrep-cli", version)
+
+            # get the results out of the chroot
+            props.copy_out_files += [
+                SEMGREP_SCAN_OUTPUT,
+                SEMGREP_SCAN_LOG,
+                SEMGREP_SCAN_CHROOT_ROOT_PATH,
+            ]
+            return 0
+
+        props.pre_mock_hooks += [prepare_semgrep_runtime_hook]
+
+        def scan_hook(results, mock, props):  # pylint: disable=unused-argument
+            semgrep_lib_dir = os.path.join(results.tmpdir, "semgrep_lib")
+            semgrep_prefix = f"env PATH={semgrep_lib_dir}/bin:$PATH PYTHONPATH={semgrep_lib_dir}"
+            # assuming semgrep rules are located under the 'rules' directory
+            semgrep_rules_dir = os.path.join(results.tmpdir, "semgrep_rules/rules")
+            # write the chroot root path to the SEMGREP_SCAN_CHROOT_ROOT_PATH
+            with open(f"{mock.mock_root}{SEMGREP_SCAN_CHROOT_ROOT_PATH}", "w", encoding="utf-8") as f:
+                f.write(mock.mock_root)
+
+            # command to run semgrep scan
+            semgrep_scan_cmd = semgrep_prefix + (
+                f" semgrep scan --metrics={args.semgrep_metrics} --sarif"
+                f" --config={semgrep_rules_dir}"
+            )
+            if args.semgrep_verbose:
+                semgrep_scan_cmd += " --verbose"
+
+            # append additional options passed to the 'semgrep scan' command
+            if self.semgrep_scan_opts:
+                semgrep_scan_cmd += f" {self.semgrep_scan_opts}"
+
+            # eventually append the target directory to be scanned
+            semgrep_scan_cmd += (
+                f" --output={mock.mock_root}{SEMGREP_SCAN_OUTPUT} {mock.mock_root}{SEMGREP_SCAN_DIR}"
+                f" 2>{mock.mock_root}{SEMGREP_SCAN_LOG}"
+            )
+            # run semgrep scan
+            ec = results.exec_cmd(semgrep_scan_cmd, shell=True)
+
+            # according to semgrep cli scan doc, below are the known error codes
+            error_messages = {
+                123: "Indiscriminate errors reported on standard error.",
+                124: "Command line parsing errors.",
+                125: "Unexpected internal errors (bugs)."
+            }
+
+            if ec in error_messages:
+                results.error(f"semgrep: {error_messages[ec]} Command: {semgrep_scan_cmd}")
+            elif ec != 0:
+                results.error(f"semgrep: Scan failed with exit code {ec}. Command: {semgrep_scan_cmd}")
+
+            return 0
+
+        # run semgrep scan after successful build
+        props.post_install_hooks += [scan_hook]
+
+        # convert the results into the csdiff's JSON format
+        def filter_hook(results):
+            src = results.dbgdir_raw + SEMGREP_SCAN_OUTPUT
+            if not os.path.exists(src):
+                return 0
+            dst = f"{results.dbgdir_uni}/semgrep-scan-results.json"
+
+            # read from SEMGREP_SCAN_CHROOT_ROOT_PATH to get the chroot root path
+            chroot_root_path = ""
+            with open(f"{results.dbgdir_raw}{SEMGREP_SCAN_CHROOT_ROOT_PATH}", "r", encoding="utf-8") as f:
+                chroot_root_path = f.read().rstrip("\n")
+
+            # remove the `SEMGREP_SCAN_CHROOT_ROOT_PATH` file
+            os.remove(f"{results.dbgdir_raw}{SEMGREP_SCAN_CHROOT_ROOT_PATH}")
+
+            tmp_dir_basename = results.tmpdir.split("/")[-1]
+            semgrep_rules_path_prefix = f"{tmp_dir_basename}/semgrep_rules/"
+            # semgrep report has dot-separated rules path
+            tmp_path = semgrep_rules_path_prefix.lstrip("/").replace("/", r"\.")
+            # strip suspicious path prefix from the semgrep rules directory
+            # depending on where the semgrep scan process is run, the raw report may or may not contain "/tmp"
+            # in its rules path. The following sed command strips suspicious path prefixes by removing
+            # any sequence of non left-square-bracket characters preceding '{tmp_path}'
+            cmd = (
+                fr"csgrep {src} --mode=json --strip-path-prefix {chroot_root_path}{SEMGREP_SCAN_DIR}/ "
+                fr"| sed 's|[^\[]*{tmp_path}||' > {dst}"  # pylint: disable=W1401
+            )
+
+            return results.exec_cmd(cmd, shell=True)
+
+        props.post_process_hooks += [filter_hook]