diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..0d20b64 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +*.pyc diff --git a/README.md b/README.md new file mode 100644 index 0000000..68842e2 --- /dev/null +++ b/README.md @@ -0,0 +1,13 @@ +## Running SCA + +```bash +pip install -r requirements.txt +./sca.py --input-files=analyze-me.php +``` + +## Running the test suite +```bash +pip install -r requirements.txt +nosetests core/tests/ --ignore-files=.*samate.* +``` + diff --git a/core/sca_core.py b/core/sca_core.py index dbb3e26..a160edf 100644 --- a/core/sca_core.py +++ b/core/sca_core.py @@ -25,6 +25,7 @@ # pushing/popping the scopes from the stack. Node = phpast.Node + def accept(nodeinst, visitor): skip = visitor(nodeinst) if skip: @@ -175,4 +176,3 @@ def _visitor(self, node): def debug(self, newobj): if self.DEBUG and newobj: print newobj - \ No newline at end of file diff --git a/core/tests/test_vulnerabilities.py b/core/tests/test_vulnerabilities.py index 4385133..eb97ea6 100644 --- a/core/tests/test_vulnerabilities.py +++ b/core/tests/test_vulnerabilities.py @@ -125,7 +125,7 @@ def test_vuln_functions_4(self): analyzer = PhpSCA(code) sys1, echo, sys2 = analyzer.get_func_calls() self.assertEquals([], sys1.vulntypes) - self.assertTrue('XSS' in echo.vulntypes) + self.assertIn('XSS', echo.vulntypes) self.assertTrue('OS_COMMANDING' in sys2.vulntypes) def test_vuln_functions_5(self): @@ -164,7 +164,7 @@ def test_assignment_multiple(self): echo $a; ?>''' vulns = PhpSCA(code).get_vulns() - self.assertTrue('XSS' in vulns) + self.assertIn('XSS', vulns) self.assertTrue('SQL_INJECTION' in vulns) def test_multiple_parents_vuln_trace(self): @@ -173,7 +173,7 @@ def test_multiple_parents_vuln_trace(self): echo $_GET[2] . $a; ?>''' vulns = PhpSCA(code).get_vulns() - self.assertTrue('XSS' in vulns) + self.assertIn('XSS', vulns) self.assertEquals(2, len(vulns['XSS'])) self.assertEquals(3, vulns['XSS'][0][-1].lineno) self.assertEquals(2, vulns['XSS'][1][-1].lineno) @@ -185,5 +185,4 @@ def test_samevar(self): echo $param; ?>''' vulns = PhpSCA(code).get_vulns() - self.assertTrue('XSS' in vulns) - \ No newline at end of file + self.assertIn('XSS', vulns) diff --git a/requirements.txt b/requirements.txt new file mode 100644 index 0000000..3efdd24 --- /dev/null +++ b/requirements.txt @@ -0,0 +1,5 @@ +pymock==1.0.5.1 +phply==0.9.1 +lxml==3.4.4 + + diff --git a/sca.py b/sca.py index 7d155ba..09dc9e6 100755 --- a/sca.py +++ b/sca.py @@ -22,9 +22,11 @@ For more info visit https://github.com/wvdongen/SCA ''' + def usage(): print usage_doc + def main(): try: long_options = ['help', 'input-files=']