init

internal/scanner/parser.go

@@ -0,0 +1,196 @@
+/*
+Copyright 2025.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package scanner
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/json"
+	"strings"
+	"time"
+
+	nucleiv1alpha1 "github.com/mortenolsen/nuclei-operator/api/v1alpha1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+// NucleiOutput represents the structure of Nuclei's JSONL output
+type NucleiOutput struct {
+	TemplateID   string     `json:"template-id"`
+	TemplatePath string     `json:"template-path"`
+	Info         NucleiInfo `json:"info"`
+	Type         string     `json:"type"`
+	Host         string     `json:"host"`
+	MatchedAt    string     `json:"matched-at"`
+	Timestamp    string     `json:"timestamp"`
+	// ExtractedResults can be a string array or other types
+	ExtractedResults interface{} `json:"extracted-results,omitempty"`
+	// MatcherName is the name of the matcher that triggered
+	MatcherName string `json:"matcher-name,omitempty"`
+	// IP is the resolved IP address
+	IP string `json:"ip,omitempty"`
+	// CurlCommand is the curl command to reproduce the request
+	CurlCommand string `json:"curl-command,omitempty"`
+}
+
+// NucleiInfo contains template metadata
+type NucleiInfo struct {
+	Name        string      `json:"name"`
+	Author      interface{} `json:"author"` // Can be string or []string
+	Tags        interface{} `json:"tags"`   // Can be string or []string
+	Description string      `json:"description,omitempty"`
+	Severity    string      `json:"severity"`
+	Reference   interface{} `json:"reference,omitempty"` // Can be string or []string
+	Metadata    interface{} `json:"metadata,omitempty"`
+}
+
+// ParseJSONLOutput parses Nuclei's JSONL output and returns a slice of Findings
+func ParseJSONLOutput(output []byte) ([]nucleiv1alpha1.Finding, error) {
+	var findings []nucleiv1alpha1.Finding
+
+	scanner := bufio.NewScanner(bytes.NewReader(output))
+	// Increase buffer size for potentially large JSON lines
+	scanner.Buffer(make([]byte, 0, 64*1024), 1024*1024)
+
+	for scanner.Scan() {
+		line := scanner.Bytes()
+		if len(line) == 0 {
+			continue
+		}
+
+		// Skip non-JSON lines (nuclei sometimes outputs status messages)
+		if !bytes.HasPrefix(bytes.TrimSpace(line), []byte("{")) {
+			continue
+		}
+
+		finding, err := parseJSONLine(line)
+		if err != nil {
+			// Log warning but continue parsing other lines
+			// In production, you might want to use a proper logger
+			continue
+		}
+
+		findings = append(findings, finding)
+	}
+
+	if err := scanner.Err(); err != nil {
+		return findings, err
+	}
+
+	return findings, nil
+}
+
+// parseJSONLine parses a single JSONL line into a Finding
+func parseJSONLine(line []byte) (nucleiv1alpha1.Finding, error) {
+	var output NucleiOutput
+	if err := json.Unmarshal(line, &output); err != nil {
+		return nucleiv1alpha1.Finding{}, err
+	}
+
+	finding := nucleiv1alpha1.Finding{
+		TemplateID:   output.TemplateID,
+		TemplateName: output.Info.Name,
+		Severity:     strings.ToLower(output.Info.Severity),
+		Type:         output.Type,
+		Host:         output.Host,
+		MatchedAt:    output.MatchedAt,
+		Description:  output.Info.Description,
+		Timestamp:    parseTimestamp(output.Timestamp),
+	}
+
+	// Parse extracted results
+	finding.ExtractedResults = parseStringSlice(output.ExtractedResults)
+
+	// Parse references
+	finding.Reference = parseStringSlice(output.Info.Reference)
+
+	// Parse tags
+	finding.Tags = parseStringSlice(output.Info.Tags)
+
+	// Store additional metadata as RawExtension
+	if output.Info.Metadata != nil {
+		if metadataBytes, err := json.Marshal(output.Info.Metadata); err == nil {
+			finding.Metadata = &runtime.RawExtension{Raw: metadataBytes}
+		}
+	}
+
+	return finding, nil
+}
+
+// parseTimestamp parses a timestamp string into metav1.Time
+func parseTimestamp(ts string) metav1.Time {
+	if ts == "" {
+		return metav1.Now()
+	}
+
+	// Try various timestamp formats that Nuclei might use
+	formats := []string{
+		time.RFC3339,
+		time.RFC3339Nano,
+		"2006-01-02T15:04:05.000Z",
+		"2006-01-02T15:04:05Z",
+		"2006-01-02 15:04:05",
+	}
+
+	for _, format := range formats {
+		if t, err := time.Parse(format, ts); err == nil {
+			return metav1.NewTime(t)
+		}
+	}
+
+	// If parsing fails, return current time
+	return metav1.Now()
+}
+
+// parseStringSlice converts various types to a string slice
+// Nuclei output can have fields as either a single string or an array of strings
+func parseStringSlice(v interface{}) []string {
+	if v == nil {
+		return nil
+	}
+
+	switch val := v.(type) {
+	case string:
+		if val == "" {
+			return nil
+		}
+		// Check if it's a comma-separated list
+		if strings.Contains(val, ",") {
+			parts := strings.Split(val, ",")
+			result := make([]string, 0, len(parts))
+			for _, p := range parts {
+				if trimmed := strings.TrimSpace(p); trimmed != "" {
+					result = append(result, trimmed)
+				}
+			}
+			return result
+		}
+		return []string{val}
+	case []interface{}:
+		result := make([]string, 0, len(val))
+		for _, item := range val {
+			if s, ok := item.(string); ok && s != "" {
+				result = append(result, s)
+			}
+		}
+		return result
+	case []string:
+		return val
+	default:
+		return nil
+	}
+}

internal/scanner/scanner.go

@@ -0,0 +1,239 @@
+/*
+Copyright 2025.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package scanner
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+
+	nucleiv1alpha1 "github.com/mortenolsen/nuclei-operator/api/v1alpha1"
+)
+
+// Scanner defines the interface for executing Nuclei scans
+type Scanner interface {
+	// Scan executes a Nuclei scan against the given targets and returns the results
+	Scan(ctx context.Context, targets []string, options ScanOptions) (*ScanResult, error)
+}
+
+// ScanOptions contains configuration options for a scan
+type ScanOptions struct {
+	// Templates specifies which Nuclei templates to use (paths or tags)
+	Templates []string
+	// Severity filters results by minimum severity level
+	Severity []string
+	// Timeout is the maximum duration for the scan
+	Timeout time.Duration
+}
+
+// ScanResult contains the results of a completed scan
+type ScanResult struct {
+	// Findings contains all vulnerabilities/issues discovered
+	Findings []nucleiv1alpha1.Finding
+	// Summary provides aggregated statistics
+	Summary nucleiv1alpha1.ScanSummary
+	// Duration is how long the scan took
+	Duration time.Duration
+}
+
+// NucleiScanner implements the Scanner interface using the Nuclei binary
+type NucleiScanner struct {
+	nucleiBinaryPath string
+	templatesPath    string
+}
+
+// Config holds configuration for the NucleiScanner
+type Config struct {
+	// NucleiBinaryPath is the path to the nuclei binary (default: "nuclei")
+	NucleiBinaryPath string
+	// TemplatesPath is the path to nuclei templates (default: use nuclei's default)
+	TemplatesPath string
+	// DefaultTimeout is the default scan timeout (default: 30m)
+	DefaultTimeout time.Duration
+}
+
+// DefaultConfig returns a Config with default values
+func DefaultConfig() Config {
+	return Config{
+		NucleiBinaryPath: getEnvOrDefault("NUCLEI_BINARY_PATH", "nuclei"),
+		TemplatesPath:    getEnvOrDefault("NUCLEI_TEMPLATES_PATH", ""),
+		DefaultTimeout:   getEnvDurationOrDefault("NUCLEI_TIMEOUT", 30*time.Minute),
+	}
+}
+
+// NewNucleiScanner creates a new NucleiScanner with the given configuration
+func NewNucleiScanner(config Config) *NucleiScanner {
+	return &NucleiScanner{
+		nucleiBinaryPath: config.NucleiBinaryPath,
+		templatesPath:    config.TemplatesPath,
+	}
+}
+
+// NewNucleiScannerWithDefaults creates a new NucleiScanner with default configuration
+func NewNucleiScannerWithDefaults() *NucleiScanner {
+	return NewNucleiScanner(DefaultConfig())
+}
+
+// Scan executes a Nuclei scan against the given targets
+func (s *NucleiScanner) Scan(ctx context.Context, targets []string, options ScanOptions) (*ScanResult, error) {
+	if len(targets) == 0 {
+		return nil, fmt.Errorf("no targets provided for scan")
+	}
+
+	startTime := time.Now()
+
+	// Create a temporary directory for this scan
+	tmpDir, err := os.MkdirTemp("", "nuclei-scan-*")
+	if err != nil {
+		return nil, fmt.Errorf("failed to create temp directory: %w", err)
+	}
+	defer os.RemoveAll(tmpDir)
+
+	// Write targets to a file
+	targetsFile := filepath.Join(tmpDir, "targets.txt")
+	if err := os.WriteFile(targetsFile, []byte(strings.Join(targets, "\n")), 0600); err != nil {
+		return nil, fmt.Errorf("failed to write targets file: %w", err)
+	}
+
+	// Build the nuclei command arguments
+	args := s.buildArgs(targetsFile, options)
+
+	// Set timeout from options or use default
+	timeout := options.Timeout
+	if timeout == 0 {
+		timeout = 30 * time.Minute
+	}
+
+	// Create context with timeout
+	scanCtx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+
+	// Execute nuclei
+	cmd := exec.CommandContext(scanCtx, s.nucleiBinaryPath, args...)
+
+	var stdout, stderr bytes.Buffer
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+
+	err = cmd.Run()
+	duration := time.Since(startTime)
+
+	// Check for context cancellation
+	if scanCtx.Err() == context.DeadlineExceeded {
+		return nil, fmt.Errorf("scan timed out after %v", timeout)
+	}
+	if scanCtx.Err() == context.Canceled {
+		return nil, fmt.Errorf("scan was cancelled")
+	}
+
+	// Nuclei returns exit code 0 even when it finds vulnerabilities
+	// Non-zero exit codes indicate actual errors
+	if err != nil {
+		if exitErr, ok := err.(*exec.ExitError); ok {
+			// Exit code 1 can mean "no results found" which is not an error
+			if exitErr.ExitCode() != 1 {
+				return nil, fmt.Errorf("nuclei execution failed: %w, stderr: %s", err, stderr.String())
+			}
+		} else {
+			return nil, fmt.Errorf("failed to execute nuclei: %w", err)
+		}
+	}
+
+	// Parse the JSONL output
+	findings, err := ParseJSONLOutput(stdout.Bytes())
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse nuclei output: %w", err)
+	}
+
+	// Calculate summary
+	summary := calculateSummary(findings, len(targets), duration)
+
+	return &ScanResult{
+		Findings: findings,
+		Summary:  summary,
+		Duration: duration,
+	}, nil
+}
+
+// buildArgs constructs the command line arguments for nuclei
+func (s *NucleiScanner) buildArgs(targetsFile string, options ScanOptions) []string {
+	args := []string{
+		"-l", targetsFile,
+		"-jsonl",
+		"-silent",
+		"-no-color",
+	}
+
+	// Add templates path if configured
+	if s.templatesPath != "" {
+		args = append(args, "-t", s.templatesPath)
+	}
+
+	// Add specific templates if provided
+	if len(options.Templates) > 0 {
+		for _, t := range options.Templates {
+			args = append(args, "-t", t)
+		}
+	}
+
+	// Add severity filter if provided
+	if len(options.Severity) > 0 {
+		args = append(args, "-severity", strings.Join(options.Severity, ","))
+	}
+
+	return args
+}
+
+// calculateSummary generates a ScanSummary from the findings
+func calculateSummary(findings []nucleiv1alpha1.Finding, targetsCount int, duration time.Duration) nucleiv1alpha1.ScanSummary {
+	severityCounts := make(map[string]int)
+
+	for _, f := range findings {
+		severity := strings.ToLower(f.Severity)
+		severityCounts[severity]++
+	}
+
+	return nucleiv1alpha1.ScanSummary{
+		TotalFindings:      len(findings),
+		FindingsBySeverity: severityCounts,
+		TargetsScanned:     targetsCount,
+		DurationSeconds:    int64(duration.Seconds()),
+	}
+}
+
+// getEnvOrDefault returns the environment variable value or a default
+func getEnvOrDefault(key, defaultValue string) string {
+	if value := os.Getenv(key); value != "" {
+		return value
+	}
+	return defaultValue
+}
+
+// getEnvDurationOrDefault returns the environment variable as a duration or a default
+func getEnvDurationOrDefault(key string, defaultValue time.Duration) time.Duration {
+	if value := os.Getenv(key); value != "" {
+		if d, err := time.ParseDuration(value); err == nil {
+			return d
+		}
+	}
+	return defaultValue
+}