From 1dd07f13bb2672c6ba2f1a396d2ab70b4b5ddfe4 Mon Sep 17 00:00:00 2001 From: Sahilb315 Date: Fri, 9 May 2025 03:05:50 +0530 Subject: [PATCH] replace AnalysePackage with QueryPackageAnalysis API & use community API --- cmd/npm/npm.go | 4 ---- cmd/npm/pnpm.go | 4 ---- pkg/analyser/analysis.go | 41 ++++++++++++---------------------------- pkg/common/grpc.go | 11 +---------- pkg/wrapper/npm_base.go | 3 ++- 5 files changed, 15 insertions(+), 48 deletions(-) diff --git a/cmd/npm/npm.go b/cmd/npm/npm.go index 8f8d582..d24fb1f 100644 --- a/cmd/npm/npm.go +++ b/cmd/npm/npm.go @@ -24,10 +24,6 @@ func NewNpmCommand() *cobra.Command { } if len(args) >= 2 && utils.IsInstallCommand(string(registry.RegistryNPM), args[0]) { - if err := utils.ValidateEnvVars(); err != nil { - return err - } - pmw := wrapper.NewPackageManagerWrapper(registry.RegistryNPM) pmw.Action = args[0] pmw.PackageName = args[1] diff --git a/cmd/npm/pnpm.go b/cmd/npm/pnpm.go index 6ffe6a9..8241043 100644 --- a/cmd/npm/pnpm.go +++ b/cmd/npm/pnpm.go @@ -24,10 +24,6 @@ func NewPnpmCommand() *cobra.Command { } if len(args) >= 2 && utils.IsInstallCommand(string(registry.RegistryPNPM), args[0]) { - if err := utils.ValidateEnvVars(); err != nil { - return err - } - pmw := wrapper.NewPackageManagerWrapper(registry.RegistryPNPM) pmw.Action = args[0] pmw.PackageName = args[1] diff --git a/pkg/analyser/analysis.go b/pkg/analyser/analysis.go index 92cd7ec..2a71b54 100644 --- a/pkg/analyser/analysis.go +++ b/pkg/analyser/analysis.go @@ -21,31 +21,26 @@ type PackageAnalyser struct { Ctx context.Context MaliciousPkgsMutex sync.Mutex ProgressTracker ui.ProgressTracker + Ecosystem packagev1.Ecosystem } -func New(client malysisv1grpc.MalwareAnalysisServiceClient, ctx context.Context) *PackageAnalyser { +func New(client malysisv1grpc.MalwareAnalysisServiceClient, ctx context.Context, ecosystem packagev1.Ecosystem) *PackageAnalyser { return &PackageAnalyser{ MaliciousPkgs: make(map[string]string), Client: client, Ctx: ctx, MaliciousPkgsMutex: sync.Mutex{}, + Ecosystem: ecosystem, } } func (ap *PackageAnalyser) Handler() vetUtils.WorkQueueFn[models.Package] { return func(q *vetUtils.WorkQueue[models.Package], item models.Package) error { - resp, err := SubmitPackageForAnalysis(ap.Ctx, ap.Client, - packagev1.Ecosystem_ECOSYSTEM_NPM, item.Name, item.Version) + reportResp, err := QueryPackageAnalysis(ap.Ctx, ap.Client, + ap.Ecosystem, item.Name, item.Version) if err != nil { log.Debugf("Failed to analyze %s@%s: %v", item.Name, item.Version, err) - return err - } - - reportResp, err := GetAnalysisReport(ap.Ctx, ap.Client, resp.GetAnalysisId()) - if err != nil { - log.Debugf("Failed to get analysis report for %s:%s %v", - item.Name, resp.GetAnalysisId(), err) - return err + return nil } report := reportResp.GetReport() @@ -73,10 +68,9 @@ func (ap *PackageAnalyser) Handler() vetUtils.WorkQueueFn[models.Package] { } } -func SubmitPackageForAnalysis(ctx context.Context, client malysisv1grpc.MalwareAnalysisServiceClient, - ecosystem packagev1.Ecosystem, name string, - version string) (*malysisv1.AnalyzePackageResponse, error) { - req := &malysisv1.AnalyzePackageRequest{ +func QueryPackageAnalysis(ctx context.Context, client malysisv1grpc.MalwareAnalysisServiceClient, ecosystem packagev1.Ecosystem, name string, + version string) (*malysisv1.QueryPackageAnalysisResponse, error) { + resp, err := client.QueryPackageAnalysis(ctx, &malysisv1.QueryPackageAnalysisRequest{ Target: &malysisv1pb.PackageAnalysisTarget{ PackageVersion: &packagev1.PackageVersion{ Package: &packagev1.Package{ @@ -86,22 +80,11 @@ func SubmitPackageForAnalysis(ctx context.Context, client malysisv1grpc.MalwareA Version: version, }, }, - } - resp, err := client.AnalyzePackage(ctx, req) + }) + if err != nil { return nil, fmt.Errorf("failed to analyze %s@%s: %w", name, version, err) } + return resp, nil } - -func GetAnalysisReport(ctx context.Context, client malysisv1grpc.MalwareAnalysisServiceClient, - analysisId string) (*malysisv1.GetAnalysisReportResponse, error) { - analysisReportReq := &malysisv1.GetAnalysisReportRequest{ - AnalysisId: analysisId, - } - reportResp, err := client.GetAnalysisReport(ctx, analysisReportReq) - if err != nil { - return nil, fmt.Errorf("failed to get analysis report: %w", err) - } - return reportResp, nil -} diff --git a/pkg/common/grpc.go b/pkg/common/grpc.go index 30ba140..18760e8 100644 --- a/pkg/common/grpc.go +++ b/pkg/common/grpc.go @@ -5,20 +5,11 @@ import ( "net/http" drygrpc "github.com/safedep/dry/adapters/grpc" - "github.com/safedep/pmg/pkg/common/utils" "google.golang.org/grpc" ) func NewCloudClientConnection() (*grpc.ClientConn, error) { - tok := utils.ApiKey() - tenantId := utils.TenantDomain() - if tok == "" || tenantId == "" { - return nil, fmt.Errorf("SAFEDEP_API_KEY and SAFEDEP_TENANT_ID must be set") - } - headers := http.Header{} - headers.Set("x-tenant-id", tenantId) - - cc, err := newGrpcClient(headers, tok, "pmg-pkg-scan", "api.safedep.io", "443") + cc, err := newGrpcClient(http.Header{}, "", "pmg-pkg-scan", "community-api.safedep.io", "443") if err != nil { return nil, fmt.Errorf("failed to create gRPC client: %v", err) } diff --git a/pkg/wrapper/npm_base.go b/pkg/wrapper/npm_base.go index 37ab228..acd40b8 100644 --- a/pkg/wrapper/npm_base.go +++ b/pkg/wrapper/npm_base.go @@ -5,6 +5,7 @@ import ( "fmt" "time" + packagev1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/package/v1" "github.com/fatih/color" "github.com/safedep/dry/log" "github.com/safedep/pmg/internal/ui" @@ -100,7 +101,7 @@ func (pmw *PackageManagerWrapper) analyzeDependencies(ctx context.Context, deps return fmt.Errorf("error while creating a malware analysis client: %w", err) } - pkgAnalyser := analyser.New(client, ctx) + pkgAnalyser := analyser.New(client, ctx, packagev1.Ecosystem_ECOSYSTEM_NPM) pkgAnalyser.ProgressTracker = progressTracker handler := pkgAnalyser.Handler()