16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
|
# File 'lib/omamori/report_generator/console_formatter.rb', line 16
def format(combined_results)
output = ""
ai_risks = combined_results && combined_results["ai_security_risks"] ? combined_results["ai_security_risks"] : []
if !ai_risks.empty?
output += "--- AI Analysis Results ---\n".colorize(:bold)
ai_risks.each do |risk|
severity_color = SEVERITY_COLORS[risk["severity"]] || :white
risk_type = risk["type"] || "Unknown Type"
output += " - Type: #{risk_type.colorize(severity_color)}\n"
output += " Severity: #{risk["severity"].colorize(severity_color)}\n"
output += " Location: #{risk["location"]}\n"
output += " Details: #{risk["details"]}\n"
output += " Code Snippet:\n"
output += format_code_snippet(risk["code_snippet"])
output += "\n"
end
else
output += "--- AI Analysis Results ---\n".colorize(:bold)
output += "No AI-detected security risks.\n".colorize(:green)
end
output += "\n"
static_results = combined_results && combined_results["static_analysis_results"] ? combined_results["static_analysis_results"] : {}
output += "--- Static Analysis Results ---\n".colorize(:bold)
brakeman_result = static_results["brakeman"]
if brakeman_result
output += "Brakeman:\n".colorize(:underline)
if brakeman_result["warnings"] && !brakeman_result["warnings"].empty?
brakeman_result["warnings"].each do |warning|
severity_color = SEVERITY_COLORS[warning["confidence"]] || :white output += " - Warning Type: #{warning["warning_type"].colorize(severity_color)}\n"
output += " Message: #{warning["message"]}\n"
output += " File: #{warning["file"]}\n"
output += " Line: #{warning["line"]}\n"
output += " Code: #{warning["code"]}\n"
output += " Link: #{warning["link"]}\n"
output += " \n"
end
else
output += "No Brakeman warnings found.\n".colorize(:green)
end
else
output += "Brakeman results not available.\n".colorize(:yellow)
end
output += "\n"
bundler_audit_result = static_results["bundler_audit"]
if bundler_audit_result && bundler_audit_result["scan"] && bundler_audit_result["scan"]["results"]
output += "Bundler-Audit:\n".colorize(:underline)
scan_results = bundler_audit_result["scan"]["results"]
vulnerabilities = scan_results.select { |result| result["type"] == "unpatched_gem" }
if !vulnerabilities.empty?
output += " Vulnerabilities:\n".colorize(:bold)
vulnerabilities.each do |vulnerability_entry|
advisory = vulnerability_entry["advisory"]
gem_info = vulnerability_entry["gem"]
severity_color = SEVERITY_COLORS[advisory["criticality"]] || :white output += " - ID: #{advisory["id"].colorize(severity_color)}\n"
output += " Gem: #{gem_info["name"]} (#{gem_info["version"]})\n" output += " Title: #{advisory["title"]}\n"
output += " URL: #{advisory["url"]}\n"
output += " Criticality: #{advisory["criticality"].colorize(severity_color)}\n"
output += " Description: #{advisory["description"]}\n"
output += " Patched Versions: #{advisory["patched_versions"].join(', ')}\n"
output += " Advisory Date: #{advisory["date"]}\n" output += "\n"
end
else
output += " No vulnerabilities found.\n".colorize(:green)
end
output += " No unpatched gems found.\n".colorize(:green)
else
output += "Bundler-Audit results not available or in unexpected format.\n".colorize(:yellow)
end
output += "\n"
ai_risk_count = ai_risks.length
brakeman_warning_count = brakeman_result && brakeman_result["warnings"] ? brakeman_result["warnings"].length : 0
bundler_audit_vulnerability_count = bundler_audit_result && bundler_audit_result["scan"] && bundler_audit_result["scan"]["results"] ? bundler_audit_result["scan"]["results"].select { |result| result["type"] == "unpatched_gem" }.length : 0
summary_output = "--- Scan Summary ---\n".colorize(:bold)
summary_output += "AI Analysis: #{ai_risk_count} issues".colorize(ai_risk_count > 0 ? :red : :green) + "\n"
summary_output += "Brakeman: #{brakeman_warning_count} warnings".colorize(brakeman_warning_count > 0 ? :red : :green) + "\n"
summary_output += "Bundler-Audit: #{bundler_audit_vulnerability_count} vulnerabilities".colorize(bundler_audit_vulnerability_count > 0 ? :red : :green) + "\n"
summary_output += "\n"
output += summary_output
output
end
|