You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: prospector/README.md
+41-45Lines changed: 41 additions & 45 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,48 +3,61 @@
3
3
:warning:**WARNING** Prospector is a research prototype,
4
4
currently under development: the instructions below are intended for development, testing and demonstration purposes only!
5
5
6
+
:exclamation: Please note that **Windows is not supported** while WSL and WSL2 are fine.
7
+
6
8
## Description
7
9
8
10
Prospector is a tool to reduce the effort needed to find security fixes for
9
-
*known* vulnerabilities in open source software repositories
10
-
11
-
It takes a vulnerability description (in natural language) in input and
12
-
produces in output a ranked list of commits, in decreasing order of relevance.
11
+
*known* vulnerabilities in open source software repositories.
13
12
14
-
If you find a bug, please open an issue. If you can also fix the bug, please
15
-
create a pull request (make sure it includes a test case that passes with your correction
16
-
but fails without it)
13
+
Given an advisory expressed in natural language, Prospector processes the commits found in the target source code repository, ranks them based on a set of predefined rules, and produces a report that the user can inspect to determine which commits to retain as the actual fix.
17
14
15
+
## Setup & Run
18
16
19
-
## Setup
17
+
:warning: The tool requires Docker and Docker-compose, as it employes Docker containers for certain functionalities. Make sure you have Docker installed and running before proceeding with the setup and usage of Prospector.
20
18
21
-
:exclamation: Please note that **Windows is not supported** while WSL and WSL2 are fine.
19
+
To quickly set up Prospector:
20
+
1. Clone the project KB repository
21
+
```
22
+
git clone https://github.com/sap/project-kb
23
+
```
24
+
2. Navigate to the *prospector* folder
25
+
```
26
+
cd project-kb/prospector
27
+
```
22
28
23
-
Prerequisites:
29
+
3. Execute the bash script *run_prospector.sh* specifying the *-h* flag. This will display a list of options that you can use to customize the execution of Prospector.
The bash script builds and starts the required Docker containers. Once the building step is completed, the script will show the list of available options.
28
35
29
-
The easiest way to set up Prospector is to clone the project KB repository and then navigate to the prospector folder:
By default, Prospector saves the results in a HTML file named *prospector-report.html*.
42
+
Open this file in a web browser to view what Prospector was able to find!
43
+
44
+
## Development
45
+
46
+
Prerequisites:
47
+
48
+
* Python 3.10
49
+
* postgreSQL
50
+
* gcc g++ libffi-dev python3-dev libpq-dev
51
+
* Docker & Docker-compose
35
52
36
53
You can setup everything and install the dependencies by running:
37
54
```
38
55
make setup
39
-
```
40
-
or (for development purposes):
41
-
```
42
56
make dev-setup
43
57
```
44
58
45
59
This is necessary only the first time you set up your dev. environment.
46
60
47
-
48
61
Afterwards, you will just have to set the environment variables using the `.env` file and sourcing it with:
49
62
50
63
```
@@ -72,15 +85,9 @@ If you use VSCode, this can be achieved by pasting these lines in your configura
72
85
"editor.formatOnSave": true,
73
86
```
74
87
75
-
## Starting the backend database and the job workers [OPTIONAL]
76
-
77
-
If you run the client without running the backend you will get a warning and have slower response times when making multiple queries. If you only intend to try out the client, feel free to skip this section and the next and go straight to "Using the CLI".
78
-
79
-
Note: this section and the following assume you have performed succesfully the
80
-
steps in the *setup* section above.
88
+
### Starting the backend database and the job workers
81
89
82
-
This is achieved with docker and docker-compose, make sure you have both installed
83
-
and working before proceeding.
90
+
If you run the client without running the backend you will get a warning and have slower response times when making multiple queries.
84
91
85
92
You can then start the necessary containers with the following command:
86
93
@@ -92,7 +99,7 @@ If you wish to cleanup docker to run a fresh version of the backend you can run:
92
99
93
100
`make docker-clean`
94
101
95
-
## Starting the RESTful server
102
+
###Starting the RESTful server
96
103
97
104
`uvicorn api.main:app --reload`
98
105
@@ -107,27 +114,16 @@ You might also want to take a look at `http://127.0.0.1:8000/docs`.
107
114
108
115
which is equivalent but more convenient for debugging.
In the example above, the tag interval has been chosen by considering the text of the advisory ("MultipartStream.java in Apache Commons FileUpload before 1.3.1 [...]") and comparing it with the set of tags found in the git repository.
122
-
123
-
*HEADS-UP*: Prospector has the capability to "guess" tag names from version intervals, but that functionality is not yet exposed to the command line client (it will be in the future). If you are curious to know how that works, please see the last page of [this paper](https://arxiv.org/pdf/2103.13375).
124
-
125
-
## Testing
117
+
### Testing
126
118
127
119
Prospector makes use of `pytest`.
128
120
129
121
:exclamation:**NOTE:** before using it please make sure to have running instances of the backend and the database.
130
122
123
+
If you find a bug, please open an issue. If you can also fix the bug, please
124
+
create a pull request (make sure it includes a test case that passes with your correction
125
+
but fails without it)
126
+
131
127
## History
132
128
133
129
The high-level structure of Prospector follows the approach of its
0 commit comments