A toolkit for code audit in checkmarx platform, including web app simulation, work shell and much more.

Please keep it in mind that this is the 'minimal functional prototype', there are known issues in this repo, and the overall architexture may change in future versions. If you face any problem, trace the update roadmap , rise an issue here , or simply read and modify the source code.

Here is the sample format of xlsx report:

Notes: leave # column blank, the program will automatically set index from 1 in this column.

For the first time, using init_from_excel method to load xlsx file. This operation will generate a json file whose name is the project name for saving, and if everything is right, a cmd shell will be open. Please avoid using Visual Studio Code since cmd module will not displayed in the console.

from common import DBBuilder
from shell import WorkShell

project_name = 'your-project-name'
xlsx_path = 'your-xlsx-path'

#Init from xlsx, and boost shell
WorkShell(builder=DBBuilder(project_name).init_from_excel(xlsx_name)).cmdloop()

If you already have the json file, use the command below to load the json file and boost shell, all changes in json file will be loaded.

WorkShell(project_name='supply-ors-pu').cmdloop()

When using -t commands:

• -t sqlformat :Add comments nd set Status as Open, where line is the line attribution and filename is SrcFileName attribution.

  The application uses 'String.format' to embed untrusted params and construct sql queries at line {line} of {filename}, which may cause sql injection attacks.

• -t sql+ : Add comments and set Status as Open, where line is the line attribution and filename is SrcFileName attribution.

  The application uses string concatenation to embed untrusted params and construct sql queries at line {line} of {filename}, which may cause sql injection attacks.

• Use -l line to modify line value above, and use -df to change filename as DestFileName

• -t pending : Add comments, and set Status as pending

  The application uses string concatenation to embed untrusted params and construct sql queries at line {line} of {filename}, which may cause sql injection attacks.
  

• -t fp1 : Add comments, and set Status as False Positive

  The global filterring method has been used , or there are other filtering methods, but it is not recognized by checkmarx
  

• -t fp2 : Add comments, and set Status as False Positive

  The input has been restricted on characters, such as length, character type, etc., but it is not recognized by checkmarx.
  

• -t fp3 : Add comments, and set Status as False Positive

  The input comes from a trusted source, such as constants or variables that are not input by the user, but it is not recognized by checkmarx.
  

• -t fp4 : Add comments, and set Status as False Positive

  The output will not cause vulnerabilities, but the tool misreports the vulnerabilities.
  

• -t fp5 : Add comments, and set Status as False Positive

  There is no logical relationship between the data flow provided by Checkmarx.
  

Currently you can use codes below to automatically load all 'False Positive' records in your xlsx file and set them as 'Not Exploitable' or any other status in Checkmarx.

from web import CheckmarxDriver


your_system_user_name = 'yourname'

json_file_to_save_the_work_queue = 'url-list.json'

your_completed_xlsx_path = 'report.xlsx'

status_col_index_in_xlsx = 'AB'

link_col_index_in_xlsx = 'AC'

status_you_want_to_load_into_workqueue = 'False Positive'

status_you_want_to_set_as = 'Not Exploitable' #must be one of checkmarx status

#Init a driver, and name a json file path where you want to save your work queue.
driver = CheckmarxDriver(your_system_user_name).set_workqueue_cache_path(json_file_to_save_the_work_queue)
driver.init_workqueue_from_excel(your_completed_xlsx_path,link_col_index_in_xlsx,status_col_index_in_xlsx,status_you_want_to_load_into_workqueue)
#If you quit the program, you can load the workqueue from json file directly using the method below: 
# driver.load_workqueue_from_json()

#After init/load workqueue, you can use `exec_workqueue` to run the work queue. 


driver.exec_workqueue(change_to=status_you_want_to_set_as)

Notes: This operation will load your chrome user data in your computer. Make sure you can access checkmarx in chrome via Domain authentication. Make sure the chrome is closed when running the script.

Here are known issues we will fix in later update.

1. [LOW] Sometimes an error ''append' method can not be implemented in dic format will raise. Try restart your jupyter, delete any json file created.
2. [LOW] Chrome might not be able to continue loading pages due to memory issue. Try restart script.
3. [MEDIUM] When using e the chunk index will not be reset as 1 , which will raise out of range issue. You may lose content after last saving
4. [LOW] Make sure you have correct zoom in chrome using script, or the login may fail.
5. [HIGH] If set 'reference' pointing to same record, an error will appear during export procedure, you may lose all content in this node and in every following nodes.

1. More browser support.
2. Prefetch checkmarx data.
3. Web GUI/ Better console UI using rich