Skip to content

Commit 79c78ab

Browse files
prabhuprabhu
authored
html reporting - part 1 (owasp-dep-scan#437)
* Reporting lib Signed-off-by: Prabhu Subramanian <[email protected]> * Bug fix Signed-off-by: Prabhu Subramanian <[email protected]> * Bug fix Signed-off-by: Prabhu Subramanian <[email protected]> * Bug fix Signed-off-by: Prabhu Subramanian <[email protected]> * Bug fix Signed-off-by: Prabhu Subramanian <[email protected]> * Bug fix Signed-off-by: Prabhu Subramanian <[email protected]> --------- Signed-off-by: Prabhu Subramanian <[email protected]>
1 parent 2276017 commit 79c78ab

File tree

16 files changed

+2448
-323
lines changed

16 files changed

+2448
-323
lines changed

‎.github/workflows/dockertests.yml‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ jobs:
7070
path: 'repotests/java-sec-code'
7171
- name: Reachables tests
7272
run: |
73-
mkdir -p ${GITHUB_WORKSPACE}/rtests_ubuntu
73+
mkdir -p ${GITHUB_WORKSPACE}/rtests_ubuntu ${RUNNER_TEMP}/cdxgen-temp
7474
cd ${GITHUB_WORKSPACE}/repotests/java-sec-code
7575
mvn clean compile -DskipTests
7676
cd ${GITHUB_WORKSPACE}
@@ -99,6 +99,10 @@ jobs:
9999
run: |
100100
chmod +x contrib/free_disk_space.sh
101101
./contrib/free_disk_space.sh
102+
- name: Use Node.js
103+
uses: actions/setup-node@v4
104+
with:
105+
node-version: '24.x'
102106
- name: Install dependencies
103107
run: |
104108
uv sync --all-extras --all-packages --dev
@@ -114,17 +118,19 @@ jobs:
114118
path: 'repotests/NodeGoat'
115119
- name: Test container images
116120
run: |
117-
mkdir -p containertests_${{ matrix.os }}
121+
mkdir -p containertests_${{ matrix.os }} /tmp/cdxgen-temp
118122
uv pip install -r contrib/requirements.txt
119123
cp contrib/csaf.toml repotests/microservices-demo/csaf.toml
120124
cp contrib/csaf.toml repotests/NodeGoat/csaf.toml
121125
uv run depscan --no-banner --bom ./test/data/bom-yaml-manifest.json -o ${GITHUB_WORKSPACE}/containertests_${{ matrix.os }} --no-vuln-table
122126
uv run depscan --no-banner -t docker --src ubuntu:latest -o ${GITHUB_WORKSPACE}/containertests_${{ matrix.os }} --no-vuln-table
123-
uv run depscan --csaf --no-banner -t go --src ${GITHUB_WORKSPACE}/repotests/microservices-demo -o ${GITHUB_WORKSPACE}/containertests_${{ matrix.os }} --reports-dir ${GITHUB_WORKSPACE}/containertests_${{ matrix.os }}/msd
124-
uv run depscan --csaf --no-banner -t js --src ${GITHUB_WORKSPACE}/repotests/NodeGoat --reports-dir ${GITHUB_WORKSPACE}/containertests_${{ matrix.os }}/ng-reports
127+
uv run depscan --csaf --no-banner -t go --bom-engine CdxgenGenerator --src ${GITHUB_WORKSPACE}/repotests/microservices-demo -o ${GITHUB_WORKSPACE}/containertests_${{ matrix.os }} --reports-dir ${GITHUB_WORKSPACE}/containertests_${{ matrix.os }}/msd
128+
uv run depscan --csaf --no-banner -t js --bom-engine CdxgenGenerator --src ${GITHUB_WORKSPACE}/repotests/NodeGoat --reports-dir ${GITHUB_WORKSPACE}/containertests_${{ matrix.os }}/ng-reports
125129
env:
126130
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
127131
PYTHONUTF8: 1
132+
SCAN_DEBUG_MODE: debug
133+
CDXGEN_TEMP_DIR: /tmp/cdxgen-temp
128134
- uses: actions/upload-artifact@v4
129135
with:
130136
name: containertests_${{ matrix.os }}
@@ -166,6 +172,7 @@ jobs:
166172
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
167173
PYTHONUTF8: 1
168174
SCAN_DEBUG_MODE: "debug"
175+
CDXGEN_TEMP_DIR: ${{ runner.temp }}/cdxgen-temp
169176
- uses: actions/upload-artifact@v4
170177
with:
171178
name: containertests_${{ matrix.os }}_python${{ matrix.python-version }}
@@ -215,6 +222,7 @@ jobs:
215222
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
216223
PYTHONUTF8: 1
217224
SCAN_DEBUG_MODE: "debug"
225+
CDXGEN_TEMP_DIR: ${{ runner.temp }}/cdxgen-temp
218226
- uses: actions/upload-artifact@v4
219227
with:
220228
name: containertests_${{ matrix.os }}

‎.github/workflows/pythonapp.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ jobs:
2222
- name: Use Node.js
2323
uses: actions/setup-node@v4
2424
with:
25-
node-version: '22.x'
25+
node-version: '24.x'
2626
- name: Set up JDK
2727
uses: actions/setup-java@v4
2828
with:

‎.github/workflows/repotests.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -233,7 +233,7 @@ jobs:
233233
strategy:
234234
fail-fast: true
235235
matrix:
236-
python-version: ['3.12']
236+
python-version: ['3.13']
237237
runs-on: ['self-hosted', 'ubuntu', 'amd64']
238238
steps:
239239
- uses: actions/checkout@v4

‎depscan/cli.py‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@
5454
from depscan.lib.license import build_license_data, bulk_lookup
5555
from depscan.lib.logger import DEBUG, LOG, SPINNER, console, IS_CI
5656

57+
from reporting_lib.htmlgen import ReportGenerator
5758
if sys.platform == "win32" and os.environ.get("PYTHONIOENCODING") is None:
5859
sys.stdin.reconfigure(encoding="utf-8")
5960
sys.stdout.reconfigure(encoding="utf-8")
@@ -617,15 +618,11 @@ def run_depscan(args):
617618
html_report_file = depscan_options.get(
618619
"html_report_file", os.path.join(reports_dir, "depscan.html")
619620
)
620-
pdf_report_file = depscan_options.get(
621-
"pdf_report_file", os.path.join(reports_dir, "depscan.pdf")
622-
)
623621
txt_report_file = depscan_options.get(
624622
"txt_report_file", os.path.join(reports_dir, "depscan.txt")
625623
)
626624
run_config_file = os.path.join(reports_dir, "depscan.toml.sample")
627625
depscan_options["html_report_file"] = html_report_file
628-
depscan_options["pdf_report_file"] = pdf_report_file
629626
depscan_options["txt_report_file"] = txt_report_file
630627
# Create reports directory
631628
if reports_dir and not os.path.exists(reports_dir):
@@ -975,7 +972,9 @@ def run_depscan(args):
975972
theme=(MONOKAI if os.getenv("USE_DARK_THEME") else DEFAULT_TERMINAL_THEME),
976973
)
977974
console.save_text(txt_report_file, clear=False)
978-
utils.export_pdf(html_report_file, pdf_report_file)
975+
# Prettify the rich html report
976+
html_report_generator = ReportGenerator(input_rich_html_path=html_report_file, report_output_path=html_report_file, raw_content=False)
977+
html_report_generator.parse_and_generate_report()
979978
# This logic needs refactoring
980979
# render report into template if wished
981980
if args.report_template and os.path.isfile(args.report_template):

‎depscan/lib/explainer.py‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -464,8 +464,16 @@ def flow_to_str(explanation_mode, flow, project_type):
464464
and flow.get("lineNumber")
465465
and not flow.get("parentFileName").startswith("unknown")
466466
):
467-
file_loc = f"{flow.get('parentFileName').replace('src/main/java/', '').replace('src/main/scala/', '')}#{flow.get('lineNumber')} "
467+
# strip common prefixes
468+
name = flow.get('parentFileName', '')
469+
for p in ('src/main/java/', 'src/main/scala/'):
470+
name = name.removeprefix(p)
471+
file_loc = f"{name}#{flow.get('lineNumber')} "
468472
node_desc = flow.get("code").split("\n")[0]
473+
if (len(node_desc) < 3 or node_desc.endswith("{")) and len(flow.get("code")) > 3:
474+
node_desc = " ".join(flow.get("code", "").split())
475+
if "(" in node_desc:
476+
node_desc = node_desc.split("(")[0] + "() ..."
469477
if node_desc.endswith("("):
470478
node_desc = f":diamond_suit: {node_desc})"
471479
elif node_desc.startswith("return "):

‎devenv.lock‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,10 @@
33
"devenv": {
44
"locked": {
55
"dir": "src/modules",
6-
"lastModified": 1749824181,
6+
"lastModified": 1751909516,
77
"owner": "cachix",
88
"repo": "devenv",
9-
"rev": "d6928b1805a6bfd29f2eaa04c36b27506ebb1e94",
9+
"rev": "36e4cf7d6cb89862e69efce4e5c147ac2e4d38f9",
1010
"type": "github"
1111
},
1212
"original": {
@@ -87,10 +87,10 @@
8787
]
8888
},
8989
"locked": {
90-
"lastModified": 1749636823,
90+
"lastModified": 1750779888,
9191
"owner": "cachix",
9292
"repo": "git-hooks.nix",
93-
"rev": "623c56286de5a3193aa38891a6991b28f9bab056",
93+
"rev": "16ec914f6fb6f599ce988427d9d94efddf25fe6d",
9494
"type": "github"
9595
},
9696
"original": {
@@ -121,10 +121,10 @@
121121
},
122122
"nixpkgs": {
123123
"locked": {
124-
"lastModified": 1746807397,
124+
"lastModified": 1750441195,
125125
"owner": "cachix",
126126
"repo": "devenv-nixpkgs",
127-
"rev": "c5208b594838ea8e6cca5997fbf784b7cca1ca90",
127+
"rev": "0ceffe312871b443929ff3006960d29b120dc627",
128128
"type": "github"
129129
},
130130
"original": {
@@ -177,10 +177,10 @@
177177
},
178178
"nixpkgs-unstable": {
179179
"locked": {
180-
"lastModified": 1749871736,
180+
"lastModified": 1751852175,
181181
"owner": "nixos",
182182
"repo": "nixpkgs",
183-
"rev": "6afe187897bef7933475e6af374c893f4c84a293",
183+
"rev": "2defa37146df235ef62f566cde69930a86f14df1",
184184
"type": "github"
185185
},
186186
"original": {

‎documentation/docs/adv-usage.mdx‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -97,10 +97,6 @@ The license data is sourced from choosealicense.com and is quite limited. If the
9797

9898
dep-scan could auto-detect most cloud applications and Kubernetes manifest files. Pass the argument `-t yaml-manifest` to manually specify the type.
9999

100-
## PDF reports
101-
102-
Ensure [wkhtmltopdf](https://wkhtmltopdf.org/downloads.html) is installed or use the official container image to generate pdf reports. Use with `--explain` for more detailed reports.
103-
104100
## Custom reports
105101

106102
dep-scan can be provided with a [Jinja](https://jinja.palletsprojects.com/en/3.1.x/) template using the `--report-template` parameter.

‎documentation/docs/migrate-v5-to-v6.mdx‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ Use this document as a reference to migrate your depscan v5 workflows to v6.
2828
- BOMs created by depscan now use the new `.cdx.json` extension with the sbom-project_type prefix. Example: sbom-java.cdx.json, sbom-docker.cdx.json.
2929
- When invoked with the --bom-dir argument containing multiple BOM files or when using the new lifecycle analyzer, a single VDR file named `depscan-universal.vdr.json` is created under the reports directory.
3030
- The JSON Lines file `depscan.json` is no longer created.
31+
- PDF reports based on Rich HTML reports are no longer available. Use the browser print functionality in the HTML report to export to PDF.
3132

3233
## Remote audit
3334

‎documentation/docs/reachability-analysis.mdx‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -130,10 +130,6 @@ For simple container scans, pass the image name via the `--src` argument. For li
130130

131131
Ensure the application is first built, since depscan cannot automatically build arbitrary projects and container images. To customize the build directory, use the environment variable `DEPSCAN_BUILD_DIR`.
132132

133-
### PDF reports were not generated
134-
135-
Install the `wkhtmltopdf` [package](https://wkhtmltopdf.org) based on your operating system. Ensure depscan was installed including the group "ext" or "all"
136-
137133
```shell
138134
pip install owasp-depscan[all]
139135
```

‎packages/reporting-lib/README.md‎

Whitespace-only changes.

0 commit comments

Comments
 (0)