Add sca signature, change package name format

.github/workflows/codeql-analysis.yml

@@ -11,26 +11,26 @@ on:
       - '**.json'
       - 'LICENSE'
       - '.gitignore'
-    pull_request:
-      branches: [ master ]
-      paths-ignore:
-        - '.github/**'
-        - '**.md'
-        - '**.yml'
-        - '**.json'
-        - 'LICENSE'
-        - '.gitignore'
-    schedule:
-      #        ┌───────────── minute (0 - 59)
-      #        │  ┌───────────── hour (0 - 23)
-      #        │  │ ┌───────────── day of the month (1 - 31)
-      #        │  │ │ ┌───────────── month (1 - 12 or JAN-DEC)
-      #        │  │ │ │ ┌───────────── day of the week (0 - 6 or SUN-SAT)
-      #        │  │ │ │ │
-      #        │  │ │ │ │
-      #        │  │ │ │ │
-      #        *  * * * *
-      - cron: '30 1 * * 0'
+  pull_request:
+    branches: [ master ]
+    paths-ignore:
+      - '.github/**'
+      - '**.md'
+      - '**.yml'
+      - '**.json'
+      - 'LICENSE'
+      - '.gitignore'
+  schedule:
+    #        ┌───────────── minute (0 - 59)
+    #        │  ┌───────────── hour (0 - 23)
+    #        │  │ ┌───────────── day of the month (1 - 31)
+    #        │  │ │ ┌───────────── month (1 - 12 or JAN-DEC)
+    #        │  │ │ │ ┌───────────── day of the week (0 - 6 or SUN-SAT)
+    #        │  │ │ │ │
+    #        │  │ │ │ │
+    #        │  │ │ │ │
+    #        *  * * * *
+    - cron: '30 1 * * 0'
 
 jobs:
   CodeQL-Build:
@@ -54,8 +54,8 @@ jobs:
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v1
         # Override language selection by uncommenting this and choosing your languages
-         with:
-           languages: python, c
+        with:
+          languages: python
 
       - name: Set up Python
         uses: actions/setup-python@v2

.github/workflows/vul-test.yml

@@ -58,6 +58,10 @@ jobs:
         run: |
           curl --fail --retry-delay 10 --retry 30 --retry-connrefused http://127.0.0.1:8003/api/django/demo/get_open?name=Data
           cd ${{ github.workspace }}/DockerVulspace
+          docker-compose exec -T djangoweb python -V
+          docker-compose exec -T djangoweb pip list
+          docker-compose exec -T flaskweb python -V
+          docker-compose exec -T flaskweb pip list
           docker-compose logs djangoweb flaskweb
           bash ${{ github.workspace }}/DongTai-agent-python/dongtai_agent_python/tests/vul-test.sh \
             django http://127.0.0.1:8003/api/django ${{ github.run_id }}

dongtai_agent_python/assess_ext/patch/cast.c

@@ -56,13 +56,13 @@ PyObject *unicode_cast_new(PyTypeObject *type, PyObject *args, PyObject *kwargs)
 
 int apply_cast_patch(funchook_t *funchook) {
     bytes_cast_origin = (void *)PyBytes_Type.tp_new;
-    funchook_prepare_wrapper(funchook, &bytes_cast_origin, bytes_cast_new);
+    funchook_prepare_wrapper(funchook, (PyCFunction)&bytes_cast_origin, bytes_cast_new);
 
     bytearray_cast_origin = (void *)PyByteArray_Type.tp_init;
-    funchook_prepare_wrapper(funchook, &bytearray_cast_origin, bytearray_cast_new);
+    funchook_prepare_wrapper(funchook, (PyCFunction)&bytearray_cast_origin, bytearray_cast_new);
 
     unicode_cast_origin = (void *)PyUnicode_Type.tp_new;
-    funchook_prepare_wrapper(funchook, &unicode_cast_origin, unicode_cast_new);
+    funchook_prepare_wrapper(funchook, (PyCFunction)&unicode_cast_origin, unicode_cast_new);
 
     log_debug("------c_patch------------------ cast");
 

dongtai_agent_python/utils/utils.py

@@ -95,15 +95,16 @@ def get_packages():
                     if os.path.exists(package.location + os.sep + lvl):
                         module_path = package.location + os.sep + lvl
 
-        # @TODO: temporary set package signature to blank
-        # sha_1 = hashlib.sha1()
-        # sha_1.update(bytes(package.project_name.lower() + '-' + package.version, encoding='utf-8'))
-        # digest = sha_1.hexdigest()
+        package_name = 'pypi:' + package.project_name.lower() + ':' + package.version
+        sha_1 = hashlib.sha1()
+        sha_1.update(bytes(package_name, encoding='utf-8'))
+        digest = sha_1.hexdigest()
 
         sca_packages.append({
-            'packageName': package.project_name + '-' + package.version,
+            'packageName': package_name,
+            'packageVersion': package.version,
             'packagePath': module_path,
             'packageAlgorithm': 'SHA-1',
-            'packageSignature': '',
+            'packageSignature': digest,
         })
     return sca_packages