Skip to content

Commit 37ff0d6

Browse files
RedRaysTeamRedRaysTeam
committed
Init
1 parent 90169ec commit 37ff0d6

File tree

75 files changed

+579
-311
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

75 files changed

+579
-311
lines changed

‎.flake8

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
[flake8]
2+
# Increase the max line length to 120 characters
3+
max-line-length = 120
4+
5+
# Ignore specific errors/warnings:
6+
# E501: Line too long
7+
# W291: Trailing whitespace
8+
# E128: Continuation line under-indented for visual indent
9+
# E126: Continuation line over-indented for hanging indent
10+
# E127: Continuation line over-indented for visual indent
11+
# W503: Line break occurred before a binary operator
12+
# E266: Too many leading '#' for block comment
13+
ignore = E501, W291, E128, E126, E127, W503, E266, W605, C901, E303
14+
15+
# Exclude some directories from checking
16+
exclude =
17+
.git,
18+
__pycache__,
19+
build,
20+
dist,
21+
.venv
22+
23+
24+
# Maximum allowed complexity for functions
25+
max-complexity = 10

‎.github/workflows/ci.yml

+73-47
Original file line numberDiff line numberDiff line change
@@ -1,53 +1,79 @@
1-
stages:
2-
- lint
3-
- test
4-
- build
5-
- deploy
1+
name: CI/CD Pipeline
62

7-
variables:
8-
PIP_CACHE_DIR: "$CI_PROJECT_DIR/.pip-cache"
3+
on:
4+
push:
5+
branches: [ master ]
6+
pull_request:
7+
branches: [ master ]
98

10-
cache:
11-
paths:
12-
- .pip-cache/
9+
jobs:
10+
lint:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- uses: actions/checkout@v2
14+
- name: Set up Python
15+
uses: actions/setup-python@v2
16+
with:
17+
python-version: 3.9
18+
- name: Install dependencies
19+
run: |
20+
python -m pip install --upgrade pip
21+
pip install flake8
22+
- name: Lint with flake8
23+
run: flake8 .
1324

14-
lint:
15-
stage: lint
16-
image: python:3.9
17-
before_script:
18-
- pip install flake8
19-
script:
20-
- flake8 .
21-
22-
test:
23-
stage: test
24-
image: python:3.9
25-
before_script:
26-
- pip install -r requirements.txt
27-
- pip install pytest pytest-cov
28-
script:
29-
- pytest tests/ --cov=./ --cov-report=xml
30-
artifacts:
31-
reports:
32-
coverage_report:
33-
coverage_format: cobertura
25+
test:
26+
runs-on: ubuntu-latest
27+
steps:
28+
- uses: actions/checkout@v2
29+
- name: Set up Python
30+
uses: actions/setup-python@v2
31+
with:
32+
python-version: 3.9
33+
- name: Install dependencies
34+
run: |
35+
python -m pip install --upgrade pip
36+
pip install -r requirements.txt
37+
pip install pytest pytest-cov
38+
- name: List directory contents
39+
run: ls -R
40+
- name: Run tests
41+
run: |
42+
export PYTHONPATH=$PYTHONPATH:$(pwd)
43+
pytest tests/ -v --cov=./ --cov-report=xml
44+
- name: Upload coverage report
45+
uses: actions/upload-artifact@v2
46+
with:
47+
name: coverage-report
3448
path: coverage.xml
3549

36-
build:
37-
stage: build
38-
image: python:3.9
39-
script:
40-
- pip install pyinstaller
41-
- pyinstaller --onefile main.py
42-
artifacts:
43-
paths:
44-
- dist/main
50+
build:
51+
runs-on: ubuntu-latest
52+
needs: [lint, test]
53+
steps:
54+
- uses: actions/checkout@v2
55+
- name: Set up Python
56+
uses: actions/setup-python@v2
57+
with:
58+
python-version: 3.9
59+
- name: Install dependencies
60+
run: |
61+
python -m pip install --upgrade pip
62+
pip install pyinstaller
63+
- name: Build executable
64+
run: pyinstaller --onefile main.py
65+
- name: Upload artifact
66+
uses: actions/upload-artifact@v2
67+
with:
68+
name: abap-code-scanner
69+
path: dist/main
4570

46-
deploy:
47-
stage: deploy
48-
image: python:3.9
49-
script:
50-
- echo "Deploying application..."
51-
# Add your deployment steps here
52-
only:
53-
- main # This job will only run on the main branch
71+
deploy:
72+
runs-on: ubuntu-latest
73+
needs: build
74+
if: github.ref == 'refs/heads/main'
75+
steps:
76+
- name: Deploy application
77+
run: |
78+
echo "Deploying application..."
79+
# Add your deployment steps here

‎README.md

+141
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
# ABAP Code Scanner Framework
2+
3+
## Overview
4+
5+
The ABAP Code Analyzer Framework is a powerful tool designed to analyze ABAP (Advanced Business Application Programming) code for potential security vulnerabilities, code quality issues, and best practice violations. This framework provides a flexible and extensible way to scan ABAP code and generate comprehensive reports on various aspects of code security and quality.
6+
7+
## Features
8+
9+
- Multiple security checks including:
10+
- Cross-Site Scripting (XSS) vulnerabilities
11+
- Directory Traversal vulnerabilities
12+
- Hardcoded credentials
13+
- Weak cryptographic algorithms
14+
- And many more...
15+
- Customizable and extensible architecture
16+
- Command-line interface for easy integration into CI/CD pipelines
17+
- Detailed reporting in XLSX format
18+
- Configurable scan settings
19+
20+
## Upcoming Feature: Dataflow Analysis
21+
22+
We are excited mdto announce that we are working on implementing a dataflow analysis feature. This enhancement will significantly improve the accuracy and depth of our security scans.
23+
24+
### What is Dataflow Analysis?
25+
26+
Dataflow analysis is a technique used to track how data moves through an application. In the context of security, it helps identify how potentially tainted data (e.g., user inputs) propagates through the system and whether it reaches sensitive sinks (e.g., database queries, output functions) without proper sanitization.
27+
28+
### Planned Functionality
29+
30+
Our dataflow analysis will:
31+
32+
- Track parameters and their contents from the beginning of functions, reports, forms, includes, or other ABAP structures.
33+
- Follow the data as it flows through the code, monitoring transformations and assignments.
34+
- Identify potential injection points where tainted data might be used unsafely.
35+
- Provide more accurate and context-aware vulnerability detection.
36+
37+
This feature will enable the framework to:
38+
- Reduce false positives by understanding the context and transformations of data.
39+
- Detect complex vulnerabilities that simple pattern matching might miss.
40+
- Offer more detailed and actionable reports on potential security issues.
41+
42+
## Advanced Private Version
43+
44+
We are excited to announce that a more advanced version of the ABAP Code Analyzer is available as private software. This enhanced version includes:
45+
46+
- Over 250 security checks for comprehensive code analysis
47+
- Additional reporting formats and integration options
48+
- Priority support and regular updates
49+
50+
For more information about the advanced private version, please contact RedRays, Inc. at [email protected].
51+
52+
## Prerequisites
53+
54+
- Python 3.9 or higher
55+
- pip (Python package installer)
56+
57+
## Installation
58+
59+
1. Clone the repository:
60+
```
61+
git clone https://github.com/redrays-io/ABAP-Code-Analyzer.git
62+
cd ABAP-Code-Analyzer
63+
```
64+
65+
2. Install the required dependencies:
66+
```
67+
pip install -r requirements.txt
68+
```
69+
70+
## Usage
71+
72+
To run the ABAP Code Analyzer:
73+
74+
```
75+
python main.py path/to/abap/code/dir
76+
```
77+
78+
Optional arguments:
79+
- `-c`, `--config`: Path to the configuration file (default: config.yml)
80+
81+
## Report
82+
When the program finishes successfully, you will find the abap_security_scan_report.xlsx file in the project folder.
83+
Below, you can see an example of the report file.
84+
![report example](images/screenshot.png)
85+
86+
## Configuration
87+
88+
The scanner can be configured using a YAML file. By default, it looks for `config.yml` in the project root. You can specify a different configuration file using the `-c` or `--config` option.
89+
90+
Example configuration:
91+
92+
```yaml
93+
checks:
94+
- CheckCrossSiteScripting
95+
- CheckSQLInjection
96+
- CheckDirectoryTraversal
97+
98+
file_extensions:
99+
- .abap
100+
- .txt
101+
102+
exclude_patterns:
103+
- "**/test/**"
104+
```
105+
106+
## Adding New Checks
107+
108+
To add a new security check:
109+
110+
1. Create a new Python file in the `checks` directory.
111+
2. Define a class that inherits from a base check class.
112+
3. Implement the required methods, including the main `run` method.
113+
4. Add the new check to the configuration file.
114+
115+
## Running Tests
116+
117+
To run the test suite:
118+
119+
On Windows:
120+
```
121+
run_tests.bat
122+
```
123+
124+
On Unix-like systems:
125+
```
126+
./run_tests.sh
127+
```
128+
129+
## Contributing
130+
131+
Contributions to the ABAP Code Analyzer Framework are welcome! Please feel free to submit pull requests, create issues or spread the word.
132+
133+
## License
134+
135+
This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
136+
137+
## Acknowledgments
138+
139+
- Thanks to all contributors who have helped to improve this framework.
140+
- Special thanks to the ABAP community for their invaluable resources and documentation.
141+

‎checks/CheckAbapOutgoingFtpConn.py

+3-4
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
1-
# checks/check_abap_outgoing_ftp_conn.py
2-
31
import re
42
from dataclasses import dataclass
53
from typing import List
64

5+
76
@dataclass
87
class CheckResult:
98
line_number: int
109
line_content: str
1110

11+
1212
class CheckAbapOutgoingFtpConn:
13-
title = "Outgoing FTP Connection"
13+
title = "Insecure Outgoing FTP Connection"
1414
severity = "Low"
1515
vulnerability_type = "Unencrypted Communications"
1616

@@ -26,4 +26,3 @@ def run(self, file_content: str) -> List[CheckResult]:
2626
line_number = file_content[:match.start()].count('\n') + 1
2727
return [CheckResult(line_number, match.group().strip())]
2828
return []
29-

‎checks/CheckBrokenAuthCheck.py

+1-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
# checks/check_broken_auth_check.py
2-
31
import re
42
from dataclasses import dataclass
53
from typing import List
@@ -12,7 +10,7 @@ class CheckResult:
1210

1311

1412
class CheckBrokenAuthCheck:
15-
title = "Broken AUTH Checks"
13+
title = "Insufficient Authorization Check Vulnerability"
1614
severity = "Medium"
1715
vulnerability_type = "Access Control Bypass"
1816

‎checks/CheckCallTransformation.py

+3-1
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,15 @@
22
from dataclasses import dataclass
33
from typing import List
44

5+
56
@dataclass
67
class CheckResult:
78
line_number: int
89
line_content: str
910

11+
1012
class CheckCallTransformation:
11-
title = "XML Injection via \"CALL TRANSFORMATION\""
13+
title = "Possible XML Injection Vulnerability in CALL TRANSFORMATION"
1214
severity = "High"
1315
vulnerability_type = "XML Injection"
1416

‎checks/CheckCrossSiteScripting.py

+4-4
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
1-
# checks/CheckCrossSiteScripting.py
2-
31
import re
42
from dataclasses import dataclass
53
from typing import List, Dict
64

5+
76
@dataclass
87
class CheckResult:
98
line_number: int
109
line_content: str
1110

11+
1212
class CheckCrossSiteScripting:
13-
title = "Potential Cross-Site Scripting vulnerability"
13+
title = "Cross-Site Scripting (XSS) Vulnerability in Output Handling"
1414
severity = "High"
1515
vulnerability_type = "Cross-Site Scripting"
1616

@@ -60,4 +60,4 @@ def run(self, file_content: str) -> List[CheckResult]:
6060
results.append(CheckResult(i, line.strip()))
6161
break # Stop searching after finding the first vulnerability in the line
6262

63-
return results
63+
return results

0 commit comments

Comments
 (0)