Package: eze-cli
______   ______  ______                 _____   _        _____ 
        |  ____| |___  / |  ____|               / ____| | |      |_   _|
        | |__       / /  | |__       ______    | |      | |        | |  
        |  __|     / /   |  __|     |______|   | |      | |        | |  
        | |____   / /__  | |____               | |____  | |____   _| |_ 
        |______| /_____| |______|               \_____| |______| |_____|The one stop solution for security testing in modern developmentGetting StartedEze is the one stop solution developed byRiverSafe Ltdfor security testing in modern development.Eze cli scans for vulnerable dependencies, insecure code, hardcoded secrets, and license violations across a range of languagespipinstalleze-cli
ezetestFeatures:Quick setup via Dockerfile with preinstalled toolsAuto-configures tools out the box, Supported languages: Python, Node and JavaSAST tools for finding security anti-patternsSCA tools for finding vulnerable dependenciesSecret tools for finding hardcoded passwordsSBOM tools for generating a list of componentsLicense scanning for violations (akastrong copyleftusage)Extendable plugin architecture for adding new security toolsLayering enterprise level reporting and auditing via theEze Management Console(PAID service offered byRiverSafe)Eze UsageJust one command will run eze, and generate a configuration file".ezerc.toml"based off the current codebaseInstallvia pippipinstalleze-cli
eze--versiondownload exe's from releases page and put on patheze--versionRun Scanrun all toolscdpath/to/src
ezetestjust a single toolcdpath/to/src# eze test -t <tool_name>ezetest-tsemgrepLanguage SupportLanguageSBOMSCASASTJava:heavy_check_mark::heavy_check_mark::heavy_check_mark:Node:heavy_check_mark::heavy_check_mark::heavy_check_mark:Python:heavy_check_mark::heavy_check_mark::heavy_check_mark:C#:heavy_check_mark::heavy_check_mark::heavy_check_mark:Docker:heavy_check_mark:*:heavy_check_mark:*:heavy_check_mark:Terraform:heavy_check_mark::heavy_check_mark:Go:heavy_check_mark:Ruby:heavy_check_mark:ocaml:heavy_check_mark:PHP:heavy_check_mark:Auto Configured = :heavy_check_mark:Manually Configured = :heavy_check_mark:*future language support will be implemented according to popularity, seehttps://pypl.github.io/PYPL.htmlConfiguring EzeAdvanced Configuration: Autoconfig.ezerc.tomlWhen.ezerc.tomlis not present, Eze will auto configure tools according to a "autoconfig.json" file, and generates a.ezerc.tomlfor youThe default autoconfig settings is in "eze/data/default_autoconfig.json"Can be set to a custom file with--autoconfigflageze test --autoconfig PATHCustom Autoconfig configurationEze runs off a local.ezerc.tomlfile, when this config is not present, a sample config will be generated automatically by scanning the codebase (eze test). You can customise it to:Add/remove a scanning toolCustomise the arguments passed to a specific toolAutoconfig JSON format{"_help_message":"<DEVELOPER COMMENTS>","license":{"_help_message":"eze.enums.LicenseScanType value","license_mode":"PROPRIETARY|PERMISSIVE|OPENSOURCE|OFF"},"tools":{"<tool-id>":{"_help_message":"<DEVELOPER COMMENTS>","enabled_always":"true or false","enable_on_file":["<LIST OF FILE NAMES IF FOUND WILL ENABLE TOOL>"],"enable_on_file_ext":["<LIST OF FILE EXTENSIONS IF FOUND WILL ENABLE TOOL>"],"config":{"<FIELD>":"<VALUE>"}}},"reporters":{"<reporter-id>":{"_help_message":"LISTED REPORTERS ARE ALWAYS ENABLED","config":{"<FIELD>":"<VALUE>"}}}}Advanced Configuration: .ezerc.tomlOn top of the auto-configuration, you can edit your local.ezerc.tomlto run custom tools with custom configurationWhen a.ezerc.tomlis present, this will be used instead of the autoconfiguration settingssee list of available tools and reporters using these commands# which tools are available in ezeezetoolslist
ezetoolshelp<TOOL># which reporters are available in ezeezereporterslist
ezereportershelp<TOOL># which projects are being detected by ezeezeprojectsAdvanced Configuration: .ezerc.toml formatbasic .ezerc.toml TOML formathttps://en.wikipedia.org/wiki/TOML# create template with "eze housekeeping create-local-config'"# ===================================# GLOBAL CONFIG# ===================================[global]# LICENSE_CHECKLICENSE_CHECK="PROPRIETARY|PERMISSIVE|OPENSOURCE|OFF"# LICENSE_ALLOWLIST, list of licenses to exempt from license checksLICENSE_ALLOWLIST=[]# LICENSE_DENYLIST, list of licenses to always report usage as a errorLICENSE_DENYLIST=[]# ========================================# TOOL CONFIG# ========================================[TOOL_1]# Full List of Fields and Tool Help available "docker run riversafe/eze-cli tools help <TOOL_NAME>"TOOL_CONFIG_FIELD="TOOL_CONFIG_VALUE"[TOOL_2]"..."="..."# ========================================# REPORT CONFIG# ========================================[REPORTER_1]# Full List of Fields and Reporter Help available "docker run riversafe/eze-cli reporters help REPORTER_NAME"REPORTER_CONFIG_FIELD="REPORTER_CONFIG_VALUE"[REPORTER_2]"..."="..."# ========================================# SCAN CONFIG# ========================================[scan]tools=["TOOL_1","..."]reporters=["REPORTER_1","..."]Tools and Reporters availableUpdated: 2023/01/25Opensource Tools in EzeTypeNameVersionLicenseDescriptionSCAanchore-grype0.54.0 (docker)Apache-2.0Opensource multi-language SCA and container scannerSBOManchore-syft0.64.0 (docker)Apache-2.0Opensource multi-language and container bill of materials (SBOM) generation utilitySCAcontainer-trivy0.35.0 (docker)Apache-2.0Opensource container scannerSBOMdotnet-cyclonedx2.3.0.0Apache-2.0Opensource utility for generating bill of materials (SBOM) in C#/dotnet projectsSASTkics1.6.6 (docker)Apache-2.0Opensource Infrastructure as a Code (IaC) scannerSBOMjava-cyclonedx2.7.4 (docker)Apache-2.0Opensource java bill of materials generator & open-source vulnerability detection toolSCAnode-npmaudit9.2.0NPMOpensource node SCA scannerSASTnode-npmoutdated9.2.0NPMOpensource tool for scanning Node.js projects and identifying outdated dependenciesSBOMnode-cyclonedx3.10.6 (docker)Apache-2.0Opensource node bill of materials (SBOM) generation utilitySCApython-outdated3.10.1 (docker)Apache-2.0Inbuilt python outdated dependency scannerSASTpython-bandit1.7.4 (docker)Apache-2.0Opensource python SAST scannerSBOMpython-cyclonedx3.10.1 (docker)Apache-2.0Opensource python bill of materials (SBOM) generation utility, also runs SCA via pypiMISCraw1.1.0inbuiltInput for saved eze json reportsSASTsemgrep1.2.0 (docker)LGPLOpensource multi language SAST scannerSECRETtrufflehog3.21.0 (docker)GPLOpensource secret scannerAn updated list of tools, licenses, and sizes pre-installed in latest Eze Cli Docker image can be found using the commandezetoolslist--include-version
ezetoolshelp<tool-name># aka eze tools help trufflehogReporters in EzeNameVersionLicenseDescriptionconsole1.1.0inbuiltStandard command line reporterjson1.1.0inbuiltJSON output file reportereze1.1.0inbuiltEze management console reporterbom1.1.0inbuiltJSON cyclonedx bill of materials reportersarif1.1.0inbuiltSarif output file reportermarkdown1.1.0inbuiltMarkdown output file formatterhtml1.1.0inbuiltHTML output file formatterAn updated list of reporters can be found using the commandezereporterslist
ezereportershelp<reporter-name># aka eze reporters help consoleRunning eze via dockerStarting from version 1, eze is now primarily a local executable or python script, docker is a legacy way of running eze in an monolithic container.For most users, executable version much faster as only need to install docker images for languages being used, rather than all language tools.Thisdocker imagetool orchestrator is designed to be run by developers, security consultants, and ci pipelinesdockerrun-t-vFOLDER_TO_SCAN:/datariversafe/eze-clitestEze Docker UsageJust one line, viadockerwill run eze, and generate a configuration file".ezerc.toml"based off the current codebasedockerrun-t-vFOLDER_TO_SCAN:/datariversafe/eze-clitestadd-tto docker to enable terminal coloursadd--debugto docker to enable terminal coloursfor sysadmin and power users wanting to build their own images, see theREADME-DEVELOPMENT.mdEze Docker cli shortcutsThese commands will run a security scan against code in the current folderCLICommandlinux/mac os bashdocker run -it -v "$(pwd)":/data riversafe/eze-cli testwindows git bashdocker run -it -v $(pwd -W):/data riversafe/eze-cli testwindows powershelldocker run -it -v ${PWD}:/data riversafe/eze-cli testwindows cmddocker run -it -v %cd%:/data riversafe/eze-cli testEze Docker and CI Servers: Howto detect Headless GitNormally when a project is checked out of git, the location can be read from the .git folder.For CI servers git is check out headlessly (with no .git) and environments are provided for git repo / build number etc, eze will read these environment variables when detecting headless git repos.These environment variables will need to be fed to eze's docker image.aka for ado pipelinedockerrun--rm-e"BUILD_SOURCEBRANCHNAME=$BUILD_SOURCEBRANCHNAME"-e"BUILD_REPOSITORY_URI=$BUILD_REPOSITORY_URI"-e"SYSTEM_PULLREQUEST_SOURCEBRANCH=$SYSTEM_PULLREQUEST_SOURCEBRANCH"-v"$(pwd)":/datariversafe/eze-clitestCI serverEnvironment VariablesADOBUILD_SOURCEBRANCH BUILD_SOURCEBRANCHNAME SYSTEM_PULLREQUEST_SOURCEBRANCHAWS AmplifyAWS_BRANCHAWS CodebuildAWS_BRANCHJENKINSGIT_LOCAL_BRANCH GIT_BRANCHIBMCLOUD toolchainGIT_BRANCHGCPBRANCH_NAMEGitlab CICI_COMMIT_BRANCH CI_MERGE_REQUEST_TARGET_BRANCH_NAME CI_EXTERNAL_PULL_REQUEST_TARGET_BRANCH_NAME CI_DEFAULT_BRANCHGithub CIGITHUB_REFOther Common commandsStopping a docker imageStarted a local eze scan but want to stop the scan without waiting the 30-40 seconds for the scan to completeTo immediately stop a docker image do the following# get docker container id$dockerstats
CONTAINERIDNAMECPU%MEMUSAGE/LIMITMEM%NETI/OBLOCKI/OPIDS
f0bef6e0bba7optimistic_burnell0.01%104.8MiB/12.33GiB0.83%221MB/4.73MB0B/0B17# docker stop container id$dockerstop-t0f0bef6e0bba7Dotnet sharingDotnet can be slow downloading all the artifacts it requiresWhen you provide a persistent .nuget/packages/ folder which will speed up scans# example of sharing your local .nuget/packages/dockerrun-t-vLOCATION:/data-v~/.nuget/packages/:/home/ezeuser/.nuget/packages/eze-clitestNPM cache sharingNPM can be slow downloading all the artifacts it requiresWhen you provide a persistent .npm/ folder which will speed up scansps your local node_modules will help as well# example of sharing your local .npmdockerrun-t-vLOCATION:/data-v~/.npm/:/home/ezeuser/.npm/eze-clitestterraform cache sharingterraform can be slow downloading all the artifacts it requiresWhen you provide a persistent .terraform.d/ folder which will speed up scansps your local node_modules will help as well# example of sharing your local .terraform.ddockerrun-t-vLOCATION:/data-v~/.terraform.d/:/home/ezeuser/.terraform.d/eze-clitestDevelopers DocumentationTo add your own tools checkout [README-DEVELOPMENT.md], this will walk you through installing eze locally for local development.ContributeTo start contributing read [CONTRIBUTING.md]