Merge pull request #712 from snyk/feat/add-apprisk-flavor

feat: add AppRisk flavor skeleton [HYB-463]

.gitleaks.toml

@@ -11,4 +11,5 @@ commits = [
   # false positive for pgp prefix and suffix blocks
   "555fe920c97af38fa78a875fbb858d5588a6ec80",
   "a8335efefaa9f483294554c5086702457b735651",
+  "0501dae214d6dc4d6fd574b57d06eee08042b18e"
 ]

config.default.json

@@ -1,6 +1,7 @@
 {
   "BROKER_SERVER_UNIVERSAL_CONFIG_ENABLED": false,
   "SUPPORTED_BROKER_TYPES": [
+    "apprisk",
     "artifactory",
     "azure-repos",
     "bitbucket-server",
@@ -22,6 +23,37 @@
       },
       "required": {}
     },
+    "apprisk": {
+      "validations": [
+        {
+          "url": "https://$CHECKMARX/cxrestapi/auth/identity/connect/token",
+          "body": {
+            "BROKER_VAR_SUB": ["username", "password"],
+            "username": "$CHECKMARX_USERNAME",
+            "password": "$CHECKMARX_PASSWORD",
+            "grant_type": "password",
+            "scope": "sast_rest_api",
+            "client_id": "resource_owner_client",
+            "client_secret": "014DF517-39D1-4453-B7B3-9930C563627C"
+          },
+          "method": "post",
+          "headers": {
+            "x-broker-content-type": "application/x-www-form-urlencoded"
+          }
+        }
+      ],
+      "default": {
+        "CHECKMARX": "$CHECKMARX",
+        "CHECKMARX_USERNAME": "$CHECKMARX_USERNAME",
+        "CHECKMARX_PASSWORD": "$CHECKMARX_PASSWORD"
+      },
+      "required": {
+        "CHECKMARX": "checkmarx.customer.com",
+        "CHECKMARX_USERNAME": "<username>",
+        "CHECKMARX_PASSWORD": "<password>",
+        "BROKER_CLIENT_URL": "https://<broker.client.hostname>:<port>"
+      }
+    },
     "artifactory": {
       "validations": [
         {
@@ -280,6 +312,7 @@
     }
   },
   "FILTER_RULES_PATHS": {
+    "apprisk": "defaultFilters/apprisk.json",
     "artifactory": "defaultFilters/artifactory.json",
     "azure-repos": "defaultFilters/azure-repos.json",
     "bitbucket-server": "defaultFilters/bitbucket-server.json",
@@ -427,6 +460,11 @@
       "name": "Jira",
       "type": "jira",
       "brokerType": "jira-bearer-auth"
+    },
+    "apprisk": {
+      "name": "Apprisk",
+      "type": "apprisk",
+      "brokerType": "apprisk"
     }
   }
 }

defaultFilters/apprisk.json

@@ -0,0 +1,36 @@
+{
+    "public": [
+    ],
+    "private": [
+      {
+        "//": "Ask for Authentication token",
+        "method": "POST",
+        "path": "/cxrestapi/auth/identity/connect/token",
+        "origin": "https://${CHECKMARX}"
+      },
+      {
+        "//": "Get All Project Details",
+        "method": "GET",
+        "path": "/projects",
+        "origin": "https://${CHECKMARX}"
+      },
+      {
+        "//": "Get Remote Source Settings for GIT",
+        "method": "GET",
+        "path": "/projects/:id/sourceCode/remoteSettings/git",
+        "origin": "https://${CHECKMARX}"
+      },
+      {
+        "//": "Get All Scans for Project",
+        "method": "GET",
+        "path": "/sast/scans",
+        "origin": "https://${CHECKMARX}"
+      },
+      {
+        "//": "Get Statistic Results by Scan Id",
+        "method": "GET",
+        "path": "/sast/scans/:id/resultsStatistics",
+        "origin": "https://${CHECKMARX}"
+      }
+    ]
+  }

lib/client/types/config.ts

@@ -44,6 +44,7 @@ export interface ConnectionValidation {
   method?: string;
   auth: ConnectionHeaderAuth | ConnectionBasicAuth;
   body?: any;
+  headers?: Record<string, string>;
 }
 
 export interface ConnectionHeaderAuth {

lib/client/utils/connectionValidation.ts

@@ -10,7 +10,7 @@ export const validateConnection = async (config: ConnectionConfig) => {
     const validation = config.validations[i] ?? {};
     const method = validation?.method ?? 'GET';
     const { auth, url } = validation;
-    const headers: Record<string, string> = {};
+    const headers: Record<string, string> = validation?.headers ?? {};
     headers['user-agent'] = `Snyk Broker client ${version}`;
     switch (auth?.type) {
       case 'basic':

lib/common/relay/prepareRequest.ts

@@ -205,6 +205,22 @@ export const prepareRequestFromFilterResult = async (
       logger.error({ error }, 'error while signing github commit');
     }
   }
+  if (
+    payload.headers &&
+    payload.headers['x-broker-content-type'] ===
+      'application/x-www-form-urlencoded'
+  ) {
+    payload.headers['Content-Type'] = 'application/x-www-form-urlencoded';
+    if (payload.body) {
+      const jsonBody = JSON.parse(payload.body) as Record<string, any>;
+      const params = new URLSearchParams();
+      for (const [key, value] of Object.entries(jsonBody)) {
+        params.append(key, value.toString());
+      }
+      payload.body = params.toString();
+    }
+  }
+
   if (options.config && options.config.LOG_ENABLE_BODY === 'true') {
     logContext.requestBody = payload.body;
   }