staticanalysis

Documentation

Index

• type BasicFileData
  • func (bd BasicFileData) String() string
• type BasicPackageData
  • func GetBasicData(fileList []string, pathInArchive func(absolutePath string) string) (*BasicPackageData, error)
• type Result
  • func AnalyzePackageFiles(extractDir string, jsParserConfig parsing.ParserConfig, analysisTasks []Task) (*Result, error)
  • func (ar Result) String() string
• type Task
  • func AllTasks() []Task
  • func TaskFromString(s string) (Task, bool)

Types

type BasicFileData

type BasicFileData struct {
	// Filename records the path to the file within the package archive
	Filename string `json:"filename"`

	// Description records the output of the `file` command run on that file.
	Description string `json:"description"`

	// Size records the size of the file (as reported by the filesystem).
	Size int64 `json:"size"`

	// Hash records the SHA256sum hash of the file.
	Hash string `json:"hash"`

	// LineLengths records the counts of line lengths in the file,
	// where a line is defined as all characters up to a newline.
	LineLengths valuecounts.ValueCounts `json:"line_lengths"`
}

BasicFileData records various information about a file that can be determined without parsing it using a programming language parser.

func (BasicFileData) String

func (bd BasicFileData) String() string

type BasicPackageData

type BasicPackageData struct {
	Files []BasicFileData `json:"files"`
}

BasicPackageData records basic information about files in a package, mapping file path within the archive to BasicFileData about that file.

func GetBasicData

func GetBasicData(fileList []string, pathInArchive func(absolutePath string) string) (*BasicPackageData, error)

GetBasicData collects basic file information for the specified files Errors are logged rather than returned, since failures in analysing some files should not prevent the analysis of other files.

pathInArchive maps the absolute paths in fileList to relative paths in the package archive, to use for results.

type Result

type Result struct {
	// NOTE: the JSON names below should match the values in task.go
	BasicData *BasicPackageData `json:"basic,omitempty"`

	ParsingData []*parsing.SingleResult `json:"parsing,omitempty"`

	ObfuscationData *obfuscation.Result `json:"obfuscation,omitempty"`
}

Result (staticanalysis.Result) is the top-level data structure that stores all data produced by static analysis performed on a package / artifact. Each element corresponds to an individual static analysis task (see Task). Note that this data is sent across a sandbox boundary, so all nested structs must be JSON serialisable.

func AnalyzePackageFiles

func AnalyzePackageFiles(extractDir string, jsParserConfig parsing.ParserConfig, analysisTasks []Task) (*Result, error)

AnalyzePackageFiles walks a tree of extracted package files and runs the analysis tasks listed in analysisTasks to produce the result data.

Note that to some tasks depend on the data from other tasks; for example, 'obfuscation' depends on 'parsing'. If a task listed in analysisTasks depends on a task not listed in analysisTasks, then both tasks are performed.

If staticanalysis.Parsing is not in the list of analysisTasks, jsParserConfig may be empty.

If an error occurs while traversing the extracted package directory tree, or an invalid task is requested, a nil result is returned along with the corresponding error object.

func (Result) String

func (ar Result) String() string

type Task

type Task string

A Task (static analysis task) refers to a particular type of static analysis to be performed. Some tasks may depend on other tasks, for example Obfuscation depends on Parsing.

const (
	// Basic analysis consists of information about a file that can be determined
	// without parsing, for example file size, file type and hash.
	Basic Task = "basic"

	// Parsing analysis involves using a programming language parser to extract
	// source code information from the file.
	Parsing Task = "parsing"

	// Obfuscation analysis involves using certain rules to detect the presence of
	// obfuscated code. It depends on the output of the Parsing task, but does not
	// require reading files directly.
	Obfuscation Task = "obfuscation"

	// All is not a task itself, but represents/'depends on' all other tasks.
	All Task = "all"
)

NOTE: the string values below should match the JSON field names in result.go.

func AllTasks

func AllTasks() []Task

func TaskFromString

func TaskFromString(s string) (Task, bool)