Malicious code scanner

[barv-jfrog]

• The pull request is targeting the dev branch.
• The code has been validated to compile successfully by running go vet ./....
• The code has been formatted properly using go fmt ./....
• All static analysis checks passed.
• All tests have passed. If this feature is not already covered by the tests, new tests have been added.
• Updated the Contributing page / ReadMe page / CI Workflow files if needed.
• All changes are detailed at the description. if not already covered at JFrog Documentation, new documentation have been added.

---

depends on:

• malicious code scanner jfrog-apps-config#7
• malicious-code-scanner jfrog-client-go#1080
• malicious-code-flag documentation#195

---

Description:

New malicious scanners which check for malicious code on the source code. For example, models such as pickle may contain malicious code in their code, so now jf audit can scan this pickles and show in a table what is the malicious code.

---

Example:

[attiasas]

1. Improve PR details, Link related PRs
2. Please add tests! there are multiple places to add them
3. Take a look at my comments.
4. Make sure the PM are aware of the output and approve the text and UI before merge

[attiasas]

Suggested change

	MaliciousVulnerabilities []SourceCodeRow `json:"malicious_code"`
	MaliciousViolations []SourceCodeRow `json:"maliciousViolations"`
	MaliciousVulnerabilities []SourceCodeRow `json:"maliciousCode"`
	MaliciousViolations []SourceCodeRow `json:"maliciousViolations"`

make sure the formats are the same...

[barv-jfrog]

ok

[attiasas]

Suggested change

	if sjc.current == nil {
	return results.ErrResetConvertor
	}
	maliciousSimpleJson, err := PrepareSimpleJsonJasIssues(sjc.entitledForJas, sjc.pretty, results.ScanResultsToRuns(maliciousFindings)...)
	if err != nil || len(maliciousSimpleJson) == 0 {
	return
	}
	if sjc.current == nil {
	return results.ErrResetConvertor
	}
	for i := range maliciousFindings {
	if shouldUpdateStatus(sjc.current.Statuses.MaliciousStatusCode, &maliciousFindings[i].StatusCode) {
	sjc.current.Statuses.MaliciousStatusCode = &maliciousFindings[i].StatusCode
	}
	}
	maliciousSimpleJson, err := PrepareSimpleJsonJasIssues(sjc.entitledForJas, sjc.pretty, results.ScanResultsToRuns(maliciousFindings)...)
	if err != nil || len(maliciousSimpleJson) == 0 {
	return
	}

Add this scan to the status attributes so we can use it in all other places to display the command information

[barv-jfrog]

ok

[attiasas]

for remote push, while developing, make sure you are pointing to a valid branch.
This is expceting the code to be in the machine locally.

[barv-jfrog]

ok

[attiasas]

don't forget to uncomment when done

[barv-jfrog]

fixed

[attiasas]

Nice, take a look at my comments, in addition:

1. fix failed tests
2. add description to the PR details, make sure to explain the type of scan and add screen shots so the users can understand and reference to.
3. Add integration tests at audit_test.go that runs and validate a malicious issues on a project

[attiasas]

Suggested change

	"name": "JFrog Terraform scanner",
	"name": "JFrog Malicious Code scanner",

[barv-jfrog]

fixed

[attiasas]

did we also added this to the config at the platform?