scanner

Documentation

Index

• func DetectEcosystem(target string) []string
• type DepsResult
  • func RunGoVulnCheck(target string) (*DepsResult, error)
  • func RunNpmAudit(target string) (*DepsResult, error)
  • func RunPipAudit(target string) (*DepsResult, error)
• type GitleaksResult
  • func RunGitleaks(target string) (*GitleaksResult, error)
  • func (r *GitleaksResult) ToFindings(target string) []report.Finding
• type GosecResult
  • func RunGosec(target string) (*GosecResult, error)
  • func (r *GosecResult) ToFindings(target string) []report.Finding
• type SemgrepFinding
• type SemgrepResult
  • func RunSemgrep(target string, rules string) (*SemgrepResult, error)
  • func (r *SemgrepResult) ToFindings(target string) []report.Finding

Functions

func DetectEcosystem

func DetectEcosystem(target string) []string

DetectEcosystem checks which dependency files exist in the target.

Types

type DepsResult

type DepsResult struct {
	Findings  []report.Finding
	Ecosystem string
}

DepsResult holds dependency check results for a single ecosystem.

func RunGoVulnCheck

func RunGoVulnCheck(target string) (*DepsResult, error)

RunGoVulnCheck runs govulncheck on a Go project and returns findings.

func RunNpmAudit

func RunNpmAudit(target string) (*DepsResult, error)

RunNpmAudit runs npm audit on a Node.js project.

func RunPipAudit

func RunPipAudit(target string) (*DepsResult, error)

RunPipAudit runs pip-audit on a Python project.

type GitleaksResult

type GitleaksResult struct {
	Findings []gitleaksFinding
	RawJSON  string
}

GitleaksResult wraps the output of `gitleaks detect --report-format json`.

func RunGitleaks

func RunGitleaks(target string) (*GitleaksResult, error)

RunGitleaks runs gitleaks detect on the given target directory. It returns parsed findings and any error.

func (*GitleaksResult) ToFindings

func (r *GitleaksResult) ToFindings(target string) []report.Finding

ToFindings converts gitleaks findings to ironwall Finding structs.

type GosecResult

type GosecResult struct {
	Issues  []*issue.Issue
	Metrics *gosec.Metrics
	Errors  map[string][]gosec.Error
}

GosecResult holds the results of an embedded gosec scan.

func RunGosec

func RunGosec(target string) (*GosecResult, error)

RunGosec runs an embedded gosec scan on the target directory. This replaces the semgrep subprocess with native Go AST analysis.

func (*GosecResult) ToFindings

func (r *GosecResult) ToFindings(target string) []report.Finding

ToFindings converts gosec issues to ironwall Finding structs.

type SemgrepFinding

type SemgrepFinding struct {
	CheckID string `json:"check_id"`
	Path    string `json:"path"`
	Start   struct {
		Line   int `json:"line"`
		Col    int `json:"col"`
		Offset int `json:"offset"`
	} `json:"start"`
	End struct {
		Line   int `json:"line"`
		Col    int `json:"col"`
		Offset int `json:"offset"`
	} `json:"end"`
	Extra struct {
		Message  string `json:"message"`
		Severity string `json:"severity"`
		Metadata struct {
			CWE      string `json:"cwe"`
			OWASP    string `json:"owasp"`
			Category string `json:"category"`
		} `json:"metadata"`
		Lines string `json:"lines"`
		Fix   string `json:"fix"`
	} `json:"extra"`
}

SemgrepFinding is the JSON structure semgrep outputs per match.

type SemgrepResult

type SemgrepResult struct {
	Results []SemgrepFinding `json:"results"`
	Errors  []interface{}    `json:"errors"`
	RawJSON string
}

SemgrepResult wraps the output of `semgrep scan --json`.

func RunSemgrep

func RunSemgrep(target string, rules string) (*SemgrepResult, error)

RunSemgrep runs semgrep scan on the given target with specified rules. rules can be "" for auto-detection, or a semgrep rule string like "p/python".

func (*SemgrepResult) ToFindings

func (r *SemgrepResult) ToFindings(target string) []report.Finding

ToFindings converts semgrep findings to ironwall Finding structs.