|
| 1 | +package scan |
| 2 | + |
| 3 | +import ( |
| 4 | + "github.com/CompassSecurity/pipeleek/internal/cmd/flags" |
| 5 | + "github.com/CompassSecurity/pipeleek/pkg/config" |
| 6 | + jenkinsscan "github.com/CompassSecurity/pipeleek/pkg/jenkins/scan" |
| 7 | + "github.com/CompassSecurity/pipeleek/pkg/logging" |
| 8 | + "github.com/rs/zerolog" |
| 9 | + "github.com/rs/zerolog/log" |
| 10 | + "github.com/spf13/cobra" |
| 11 | +) |
| 12 | + |
| 13 | +type JenkinsScanOptions struct { |
| 14 | + config.CommonScanOptions |
| 15 | + JenkinsURL string |
| 16 | + Username string |
| 17 | + Token string |
| 18 | + Folder string |
| 19 | + Job string |
| 20 | + MaxBuilds int |
| 21 | +} |
| 22 | + |
| 23 | +var options = JenkinsScanOptions{ |
| 24 | + CommonScanOptions: config.DefaultCommonScanOptions(), |
| 25 | +} |
| 26 | + |
| 27 | +var maxArtifactSize string |
| 28 | + |
| 29 | +func NewScanCmd() *cobra.Command { |
| 30 | + scanCmd := &cobra.Command{ |
| 31 | + Use: "scan", |
| 32 | + Short: "Scan Jenkins jobs", |
| 33 | + Long: `Scan Jenkins job logs, artifacts, job definitions, and exposed environment variables for secrets.`, |
| 34 | + Example: ` |
| 35 | +# Scan all accessible jobs on the Jenkins instance |
| 36 | +pipeleek jenkins scan --jenkins https://jenkins.example.com --username admin --token token_value |
| 37 | +
|
| 38 | +# Scan only a folder recursively |
| 39 | +pipeleek jenkins scan --jenkins https://jenkins.example.com --username admin --token token_value --folder team-a |
| 40 | +
|
| 41 | +# Scan one specific job path |
| 42 | +pipeleek jenkins scan --jenkins https://jenkins.example.com --username admin --token token_value --job team-a/service-a |
| 43 | +
|
| 44 | +# Limit builds per job and include artifacts |
| 45 | +pipeleek jenkins scan --jenkins https://jenkins.example.com --username admin --token token_value --max-builds 20 --artifacts |
| 46 | + `, |
| 47 | + Run: Scan, |
| 48 | + } |
| 49 | + |
| 50 | + flags.AddCommonScanFlagsNoOwned(scanCmd, &options.CommonScanOptions, &maxArtifactSize) |
| 51 | + scanCmd.Flags().StringVarP(&options.JenkinsURL, "jenkins", "j", "", "Jenkins base URL") |
| 52 | + scanCmd.Flags().StringVarP(&options.Username, "username", "u", "", "Jenkins username") |
| 53 | + scanCmd.Flags().StringVarP(&options.Token, "token", "t", "", "Jenkins API token") |
| 54 | + scanCmd.Flags().StringVarP(&options.Folder, "folder", "f", "", "Jenkins folder path to scan recursively (e.g. team-a/platform)") |
| 55 | + scanCmd.Flags().StringVarP(&options.Job, "job", "", "", "Specific Jenkins job path to scan (e.g. team-a/service-a)") |
| 56 | + scanCmd.Flags().IntVarP(&options.MaxBuilds, "max-builds", "", 25, "Maximum builds to scan per job (0 = all builds)") |
| 57 | + scanCmd.MarkFlagsMutuallyExclusive("folder", "job") |
| 58 | + |
| 59 | + return scanCmd |
| 60 | +} |
| 61 | + |
| 62 | +func Scan(cmd *cobra.Command, args []string) { |
| 63 | + if err := config.AutoBindFlags(cmd, map[string]string{ |
| 64 | + "jenkins": "jenkins.url", |
| 65 | + "username": "jenkins.username", |
| 66 | + "token": "jenkins.token", |
| 67 | + "folder": "jenkins.scan.folder", |
| 68 | + "job": "jenkins.scan.job", |
| 69 | + "max-builds": "jenkins.scan.max_builds", |
| 70 | + "threads": "common.threads", |
| 71 | + "truffle-hog-verification": "common.trufflehog_verification", |
| 72 | + "max-artifact-size": "common.max_artifact_size", |
| 73 | + "confidence": "common.confidence_filter", |
| 74 | + "hit-timeout": "common.hit_timeout", |
| 75 | + }); err != nil { |
| 76 | + log.Fatal().Err(err).Msg("Failed to bind command flags to configuration keys") |
| 77 | + } |
| 78 | + |
| 79 | + if err := config.RequireConfigKeys("jenkins.url", "jenkins.username", "jenkins.token"); err != nil { |
| 80 | + log.Fatal().Err(err).Msg("required configuration missing") |
| 81 | + } |
| 82 | + |
| 83 | + options.JenkinsURL = config.GetString("jenkins.url") |
| 84 | + options.Username = config.GetString("jenkins.username") |
| 85 | + options.Token = config.GetString("jenkins.token") |
| 86 | + options.Folder = config.GetString("jenkins.scan.folder") |
| 87 | + options.Job = config.GetString("jenkins.scan.job") |
| 88 | + options.MaxBuilds = config.GetInt("jenkins.scan.max_builds") |
| 89 | + options.MaxScanGoRoutines = config.GetInt("common.threads") |
| 90 | + options.TruffleHogVerification = config.GetBool("common.trufflehog_verification") |
| 91 | + maxArtifactSize = config.GetString("common.max_artifact_size") |
| 92 | + options.ConfidenceFilter = config.GetStringSlice("common.confidence_filter") |
| 93 | + |
| 94 | + if err := config.ValidateURL(options.JenkinsURL, "Jenkins URL"); err != nil { |
| 95 | + log.Fatal().Err(err).Msg("Invalid Jenkins URL") |
| 96 | + } |
| 97 | + if err := config.ValidateToken(options.Username, "Jenkins Username"); err != nil { |
| 98 | + log.Fatal().Err(err).Msg("Invalid Jenkins Username") |
| 99 | + } |
| 100 | + if err := config.ValidateToken(options.Token, "Jenkins API Token"); err != nil { |
| 101 | + log.Fatal().Err(err).Msg("Invalid Jenkins API Token") |
| 102 | + } |
| 103 | + if err := config.ValidateThreadCount(options.MaxScanGoRoutines); err != nil { |
| 104 | + log.Fatal().Err(err).Msg("Invalid thread count") |
| 105 | + } |
| 106 | + |
| 107 | + scanOpts, err := jenkinsscan.InitializeOptions( |
| 108 | + options.Username, |
| 109 | + options.Token, |
| 110 | + options.JenkinsURL, |
| 111 | + options.Folder, |
| 112 | + options.Job, |
| 113 | + maxArtifactSize, |
| 114 | + options.Artifacts, |
| 115 | + options.TruffleHogVerification, |
| 116 | + options.MaxBuilds, |
| 117 | + options.MaxScanGoRoutines, |
| 118 | + options.ConfidenceFilter, |
| 119 | + options.HitTimeout, |
| 120 | + ) |
| 121 | + if err != nil { |
| 122 | + log.Fatal().Err(err).Msg("Failed initializing scan options") |
| 123 | + } |
| 124 | + |
| 125 | + scanner := jenkinsscan.NewScanner(scanOpts) |
| 126 | + logging.RegisterStatusHook(func() *zerolog.Event { return scanner.Status() }) |
| 127 | + |
| 128 | + if err := scanner.Scan(); err != nil { |
| 129 | + log.Fatal().Err(err).Msg("Scan failed") |
| 130 | + } |
| 131 | +} |
0 commit comments