Skip to content

Commit 141a98e

Browse files
matteogreekcopernico
authored andcommitted
Update README.md
1 parent 1fe0a45 commit 141a98e

File tree

1 file changed

+41
-45
lines changed

1 file changed

+41
-45
lines changed

prospector/README.md

Lines changed: 41 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -3,48 +3,61 @@
33
:warning: **WARNING** Prospector is a research prototype,
44
currently under development: the instructions below are intended for development, testing and demonstration purposes only!
55

6+
:exclamation: Please note that **Windows is not supported** while WSL and WSL2 are fine.
7+
68
## Description
79

810
Prospector is a tool to reduce the effort needed to find security fixes for
9-
*known* vulnerabilities in open source software repositories
10-
11-
It takes a vulnerability description (in natural language) in input and
12-
produces in output a ranked list of commits, in decreasing order of relevance.
11+
*known* vulnerabilities in open source software repositories.
1312

14-
If you find a bug, please open an issue. If you can also fix the bug, please
15-
create a pull request (make sure it includes a test case that passes with your correction
16-
but fails without it)
13+
Given an advisory expressed in natural language, Prospector processes the commits found in the target source code repository, ranks them based on a set of predefined rules, and produces a report that the user can inspect to determine which commits to retain as the actual fix.
1714

15+
## Setup & Run
1816

19-
## Setup
17+
:warning: The tool requires Docker and Docker-compose, as it employes Docker containers for certain functionalities. Make sure you have Docker installed and running before proceeding with the setup and usage of Prospector.
2018

21-
:exclamation: Please note that **Windows is not supported** while WSL and WSL2 are fine.
19+
To quickly set up Prospector:
20+
1. Clone the project KB repository
21+
```
22+
git clone https://github.com/sap/project-kb
23+
```
24+
2. Navigate to the *prospector* folder
25+
```
26+
cd project-kb/prospector
27+
```
2228

23-
Prerequisites:
29+
3. Execute the bash script *run_prospector.sh* specifying the *-h* flag. This will display a list of options that you can use to customize the execution of Prospector.
2430

25-
* Python 3.10
26-
* postgresql
27-
* gcc g++ libffi-dev python3-dev libpq-dev (to build python dependencies)
31+
```
32+
./run_prospector.sh -h
33+
```
34+
The bash script builds and starts the required Docker containers. Once the building step is completed, the script will show the list of available options.
2835

29-
The easiest way to set up Prospector is to clone the project KB repository and then navigate to the prospector folder:
36+
4. Try the following example:
3037

3138
```
32-
git clone https://github.com/sap/project-kb
33-
cd project-kb/prospector
39+
./run_prospector.sh CVE-2020-1925 --repository https://github.com/apache/olingo-odata4
3440
```
41+
By default, Prospector saves the results in a HTML file named *prospector-report.html*.
42+
Open this file in a web browser to view what Prospector was able to find!
43+
44+
## Development
45+
46+
Prerequisites:
47+
48+
* Python 3.10
49+
* postgreSQL
50+
* gcc g++ libffi-dev python3-dev libpq-dev
51+
* Docker & Docker-compose
3552

3653
You can setup everything and install the dependencies by running:
3754
```
3855
make setup
39-
```
40-
or (for development purposes):
41-
```
4256
make dev-setup
4357
```
4458

4559
This is necessary only the first time you set up your dev. environment.
4660

47-
4861
Afterwards, you will just have to set the environment variables using the `.env` file and sourcing it with:
4962

5063
```
@@ -72,15 +85,9 @@ If you use VSCode, this can be achieved by pasting these lines in your configura
7285
"editor.formatOnSave": true,
7386
```
7487

75-
## Starting the backend database and the job workers [OPTIONAL]
76-
77-
If you run the client without running the backend you will get a warning and have slower response times when making multiple queries. If you only intend to try out the client, feel free to skip this section and the next and go straight to "Using the CLI".
78-
79-
Note: this section and the following assume you have performed succesfully the
80-
steps in the *setup* section above.
88+
### Starting the backend database and the job workers
8189

82-
This is achieved with docker and docker-compose, make sure you have both installed
83-
and working before proceeding.
90+
If you run the client without running the backend you will get a warning and have slower response times when making multiple queries.
8491

8592
You can then start the necessary containers with the following command:
8693

@@ -92,7 +99,7 @@ If you wish to cleanup docker to run a fresh version of the backend you can run:
9299

93100
`make docker-clean`
94101

95-
## Starting the RESTful server
102+
### Starting the RESTful server
96103

97104
`uvicorn api.main:app --reload`
98105

@@ -107,27 +114,16 @@ You might also want to take a look at `http://127.0.0.1:8000/docs`.
107114

108115
which is equivalent but more convenient for debugging.
109116

110-
111-
## Using the CLI
112-
113-
Try the following example:
114-
115-
`python client/cli/main.py CVE-2014-0050 --repository https://github.com/apache/commons-fileupload --use-nvd`
116-
117-
or, specifying the tag interval to restrict the retrieval of candidate commits:
118-
119-
`python client/cli/main.py CVE-2014-0050 --repository https://github.com/apache/commons-fileupload --use-nvd --tag-interval FILEUPLOAD_1_3:FILEUPLOAD_1_3_1`
120-
121-
In the example above, the tag interval has been chosen by considering the text of the advisory ("MultipartStream.java in Apache Commons FileUpload before 1.3.1 [...]") and comparing it with the set of tags found in the git repository.
122-
123-
*HEADS-UP*: Prospector has the capability to "guess" tag names from version intervals, but that functionality is not yet exposed to the command line client (it will be in the future). If you are curious to know how that works, please see the last page of [this paper](https://arxiv.org/pdf/2103.13375).
124-
125-
## Testing
117+
### Testing
126118

127119
Prospector makes use of `pytest`.
128120

129121
:exclamation: **NOTE:** before using it please make sure to have running instances of the backend and the database.
130122

123+
If you find a bug, please open an issue. If you can also fix the bug, please
124+
create a pull request (make sure it includes a test case that passes with your correction
125+
but fails without it)
126+
131127
## History
132128

133129
The high-level structure of Prospector follows the approach of its

0 commit comments

Comments
 (0)