Documentation
¶
Overview ¶
Package cli is the command line shared by the engine binary and the thin per-detector binaries (emudhra-scan, php2shell-scan), which pin one detector and keep their old command names, flags and exit status rules.
Index ¶
Constants ¶
const CatalogSchema = 1
CatalogSchema changes only when a field is removed or changes meaning. New fields are added without changing it.
Variables ¶
This section is empty.
Functions ¶
func SetMemoryLimit ¶
func SetMemoryLimit()
SetMemoryLimit keeps the heap near what is actually live: archive members and large files are held one at a time, and without a limit the collector lets the heap grow to about twice that. GOMEMLIMIT in the environment wins.
Types ¶
type Catalog ¶ added in v0.4.0
type Catalog struct {
Schema int `json:"schema"`
Tool string `json:"tool"`
Version string `json:"version"`
Detectors []CatalogEntry `json:"detectors"`
}
Catalog is what "earlylight detectors --format json" prints. Each release attaches it as detectors.json, so DefectDojo can tell which detectors a release contains without downloading and running a binary.
type CatalogEntry ¶ added in v0.4.0
type CatalogEntry struct {
ID string `json:"id"`
Title string `json:"title"`
CVEs []string `json:"cves"`
Advisories []string `json:"advisories"`
Disclosed string `json:"disclosed"`
// Modes are the commands that run the detector: fs, image, host, repo, fix.
Modes []string `json:"modes"`
Kinds []CatalogKind `json:"kinds"`
Tags []string `json:"tags"`
Data string `json:"data,omitempty"`
}
CatalogEntry is one detector, taken from its manifest.
type CatalogKind ¶ added in v0.4.0
type CatalogKind struct {
ID string `json:"id"`
Title string `json:"title"`
Level string `json:"level"`
Description string `json:"description,omitempty"`
Severity string `json:"severity,omitempty"`
CWEs []string `json:"cwes,omitempty"`
}
CatalogKind is one type of finding. Its SARIF rule ID is "<detector>/<id>".
type Config ¶
type Config struct {
Tool string
Version string
// Detector pins a single detector (thin binaries). Empty: --detector picks.
Detector string
// Summary is the first line of the usage text.
Summary string
// AsRootDir makes --as-root take the system root directory as its value
// (php2shell-scan) instead of being a switch (emudhra-scan).
AsRootDir bool
// ErrorsFirst makes an error exit 2 even when something is vulnerable, and
// --exit-zero override everything else (php2shell-scan). Otherwise a
// vulnerable finding exits 1 first (emudhra-scan, the engine).
ErrorsFirst bool
}
Config describes one binary.
Source Files