SCA scanner configuration file

General configuration file keys

Here is a simple and recommended overview of the general configuration file keys. Remember that this applies to all of Fluid Attacks’ scanners .

namespace: myappoutput:  file_path: ./Fluid-Attacks-Results.csv  format: CSVworking_dir: .language: EN

Specific configuration file keys

The following key is available for the SCA scanner, and it can be used to perform SCA analysis over a repository.

sca

This key has two configuration options:

1. include (mandatory): Paths to files or directories to analyze
2. exclude (optional): Files or directories to exclude from the analysis

For example:

sca:  include:    - relative/path/to/file    - relative/path/to/directory/  # Optional keys  exclude:

    - glob(**/test/)

Specify paths in the include/exclude subsections

You can specify your paths in two different ways:

1. Using a path relative to the working directory, for example:

namespace: namespaceworking_dir: /test/directorysca:  include:    - src/main/java/org/test/Test.java

1. Using Unix-style globs , relative to working_dir, for example:

namespace: namespaceworking_dir: /test/directorysca:  include:    - glob(*)  exclude:    - glob(**.java)    - glob(src/**/test*.py)

Configuration file example

Below is an example of a highly personalized configuration file:

namespace: my_appworking_dir: ./commit: e59607b9de3ef4c13d292705fg3da1ff0c67eb38language: ENoutput:  file_path: /fluid-attacks-results.csv  format: CSVchecks:  - F052sca:  include:    - src/front/package-lock.json    - glob(*)    - glob(**.json)

  exclude:    - glob(src/**/test/package.json)

Analyze Docker images

The SCA image also has the option to analyze Docker images. For this, you must use the sbom key.

sbom

This key has the following basic options:

1. source_type: docker (mandatory): Specifies a Docker image analysis
2. image_uri (mandatory): The unique identifier of the image you want to analyze
3. image_config (optional): Specifies different credentials to use for the analysis, allowing the following options:
4. docker_username (optional): The username that owns the Docker image in the container registry of your choice
5. docker_password (optional): The password or token with read access rights to the image.
6. ​use_docker_daemon (optional): When set to true, the scan connects to your Docker daemon to analyze images. This is useful for scanning images stored locally. Please note that this option is only available on Linux systems.

If your image is hosted on ECR, you can also use these options as part of the image_config sub-key:

1. aws_region (optional): AWS region for images hosted on ECR
2. access_key_id, secret_access_key, session_token (optional): AWS credentials with read access to the ECR image.

Configuration file example for Docker image analysis

Below is an example of a configuration file to analyze a Docker image hosted on GHCR.

language: ENoutput:  file_path: /working-dir/fluid-attacks-results.csv  format: CSVsbom:

  source_type: docker  image_uri: docker://ghcr.io/myuser/my-img:latest

  image_config:

    docker_username: myuser    docker_password: ghp_my_secret_token

Below is an example of a configuration file to analyze a local image (only available on Linux systems).

language: ENoutput:  file_path: /working-dir/fluid-attacks-results.csv  format: CSVsbom:

  source_type: docker  image_uri: alpine:3.17

  image_config:

use_docker_daemon: true