feat(docs, aws reporters): Lots of doc updates, also added BedrockSum… #155

scrthq · 2025-06-06T04:07:07Z

…maryReporter and S3Reporter bases (mostly working, some small changes needed still)

Issue #, if available:

Description of changes:

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

…maryReporter and S3Reporter bases (mostly working, some small changes needed still)

github-actions · 2025-06-07T01:13:07Z

ASH Security Scan Report

Report generated: 2025-06-11T02:22:16+00:00
Time since scan: 1 minute

Scan Metadata

Project: ASH
Scan executed: 2025-06-11T02:20:25+00:00
ASH version: 3.0.0

Summary

Scanner Results

The table below shows findings by scanner, with status based on severity thresholds and dependencies:

Severity levels: Suppressed (S), Critical (C), High (H), Medium (M), Low (L), Info (I)
Duration (Time): Time taken by the scanner to complete its execution
Actionable: Number of findings at or above the threshold severity level
Result:
- ✅ PASSED = No findings at or above threshold
- ❌ FAILED = Findings at or above threshold
- ⚠️ MISSING = Required dependencies not available
- ⏭️ SKIPPED = Scanner explicitly disabled
Threshold: The minimum severity level that will cause a scanner to fail (ALL, LOW, MEDIUM, HIGH, CRITICAL)
- Values in parentheses indicate where the threshold is set in order of precedence:
  - env (ASH_SEVERITY_THRESHOLD environment variable)
  - config (scanner config section in the ASH_CONFIG used)
  - scanner (default configuration in the plugin, if explicitly set)
  - global (global_settings section in the ASH_CONFIG used)
Note: Suppressed findings are counted separately and do not contribute to actionable findings

Scanner	Suppressed	High	Medium	Low	Info	Actionable	Result	Threshold
bandit	0	5	0	58	0	5	❌ Failed	MEDIUM (global)
cdk-nag	0	30	0	0	5	30	❌ Failed	MEDIUM (global)
cfn-nag	0	0	9	0	0	9	❌ Failed	MEDIUM (global)
checkov	1	25	0	0	0	25	❌ Failed	MEDIUM (global)
detect-secrets	0	72	0	0	0	72	❌ Failed	MEDIUM (global)
grype	0	2	1	0	0	3	❌ Failed	MEDIUM (global)
npm-audit	0	0	0	0	0	0	✅ Passed	MEDIUM (global)
opengrep	9	21	0	0	0	21	❌ Failed	MEDIUM (global)
semgrep	0	10	0	0	0	10	❌ Failed	MEDIUM (global)
syft	0	0	0	0	0	0	✅ Passed	MEDIUM (global)

Top 10 Hotspots

Files with the highest number of security findings:

Finding Count	File Location
40	tests/test_data/scanners/syft/syft.src.json
39	tests/test_data/scanners/cdk/insecure-s3-template.yaml
24	/out/converted/jupyter/tests__test_data__finding_samples__ipynb__ipynb.py
12	tests/test_data/scanners/grype/grype.src.json
10	tests/test_data/scanners/cdk/test.yaml_cdk_nag_results/cfn-and-python-test-yaml.template.json
10	tests/test_data/scanners/cdk/test.yaml_cdk_nag_results/test-yaml.template.json
10	tests/test_data/scanners/grype/grype.src.ash_output.work.json
10	.ash/ash_output/converted/jupyter/tests__test_data__finding_samples__ipynb__ipynb.py
4	tests/test_data/scanners/checkov/src.js.docker.Dockerfile.json
3	poetry.lock

Detailed Findings

Show 20 of 175 actionable findings

Finding 1: B108

Severity: HIGH
Scanner: bandit
Rule ID: B108
Location: tests/unit/utils/test_sarif_utils_extended.py:136-138

Description:
Probable insecure usage of temp file/directory.

Code Snippet:

sarif = create_test_sarif()
    invocation = {"command_line": "scanner --scan file.py", "working_directory": "/tmp"}

Finding 2: B301

Severity: HIGH
Scanner: bandit
Rule ID: B301
Location: /out/converted/jupyter/tests__test_data__finding_samples__ipynb__ipynb.py:202-204

Description:
Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.

Code Snippet:

pick = dill.dumps({"a": "b", "c": "d"})
print(dill.loads(pick))

Finding 3: B301

Severity: HIGH
Scanner: bandit
Rule ID: B301
Location: /out/converted/jupyter/tests__test_data__finding_samples__ipynb__ipynb.py:207-209

Description:
Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.

Code Snippet:

file_obj.seek(0)
print(dill.load(file_obj))

Finding 4: B301

Severity: HIGH
Scanner: bandit
Rule ID: B301
Location: /out/converted/jupyter/tests__test_data__finding_samples__ipynb__ipynb.py:226-228

Description:
Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.

Code Snippet:

pick = dill.dumps({"a": "b", "c": "d"})
print(dill.loads(pick))

Finding 5: B301

Severity: HIGH
Scanner: bandit
Rule ID: B301
Location: /out/converted/jupyter/tests__test_data__finding_samples__ipynb__ipynb.py:231-233

Description:
Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.

Code Snippet:

file_obj.seek(0)
print(dill.load(file_obj))

Finding 6: SECRET-SECRET-KEYWORD

Severity: HIGH
Scanner: detect-secrets
Rule ID: SECRET-SECRET-KEYWORD
Location: docs/content/docs/plugins/aws/index.md:143

Description:
Secret of type 'Secret Keyword' detected in file 'docs/content/docs/plugins/aws/index.md' at line 143

Code Snippet:

Secret of type Secret Keyword detected

Finding 7: SECRET-SECRET-KEYWORD

Severity: HIGH
Scanner: detect-secrets
Rule ID: SECRET-SECRET-KEYWORD
Location: docs/content/docs/plugins/development-guide.md:439

Description:
Secret of type 'Secret Keyword' detected in file 'docs/content/docs/plugins/development-guide.md' at line 439

Code Snippet:

Secret of type Secret Keyword detected

Finding 8: SECRET-BASE64-HIGH-ENTROPY-STRING

Severity: HIGH
Scanner: detect-secrets
Rule ID: SECRET-BASE64-HIGH-ENTROPY-STRING
Location: tests/test_data/scanners/cdk/test.yaml_cdk_nag_results/cfn-and-python-test-yaml.template.json:283

Description:
Secret of type 'Base64 High Entropy String' detected in file 'tests/test_data/scanners/cdk/test.yaml_cdk_nag_results/cfn-and-python-test-yaml.template.json' at line 283

Code Snippet:

Secret of type Base64 High Entropy String detected

Finding 9: SECRET-BASE64-HIGH-ENTROPY-STRING

Severity: HIGH
Scanner: detect-secrets
Rule ID: SECRET-BASE64-HIGH-ENTROPY-STRING
Location: tests/test_data/scanners/cdk/test.yaml_cdk_nag_results/test-yaml.template.json:283

Description:
Secret of type 'Base64 High Entropy String' detected in file 'tests/test_data/scanners/cdk/test.yaml_cdk_nag_results/test-yaml.template.json' at line 283

Code Snippet:

Secret of type Base64 High Entropy String detected

Finding 10: SECRET-HEX-HIGH-ENTROPY-STRING

Severity: HIGH
Scanner: detect-secrets
Rule ID: SECRET-HEX-HIGH-ENTROPY-STRING
Location: tests/test_data/scanners/grype/grype.src.ash_output.work.json:188

Description:
Secret of type 'Hex High Entropy String' detected in file 'tests/test_data/scanners/grype/grype.src.ash_output.work.json' at line 188

Code Snippet:

Secret of type Hex High Entropy String detected

Finding 11: SECRET-HEX-HIGH-ENTROPY-STRING

Severity: HIGH
Scanner: detect-secrets
Rule ID: SECRET-HEX-HIGH-ENTROPY-STRING
Location: tests/test_data/scanners/grype/grype.src.ash_output.work.json:208

Description:
Secret of type 'Hex High Entropy String' detected in file 'tests/test_data/scanners/grype/grype.src.ash_output.work.json' at line 208

Code Snippet:

Secret of type Hex High Entropy String detected

Finding 12: SECRET-HEX-HIGH-ENTROPY-STRING

Severity: HIGH
Scanner: detect-secrets
Rule ID: SECRET-HEX-HIGH-ENTROPY-STRING
Location: tests/test_data/scanners/grype/grype.src.ash_output.work.json:176

Description:
Secret of type 'Hex High Entropy String' detected in file 'tests/test_data/scanners/grype/grype.src.ash_output.work.json' at line 176

Code Snippet:

Secret of type Hex High Entropy String detected

Finding 13: SECRET-HEX-HIGH-ENTROPY-STRING

Severity: HIGH
Scanner: detect-secrets
Rule ID: SECRET-HEX-HIGH-ENTROPY-STRING
Location: tests/test_data/scanners/grype/grype.src.ash_output.work.json:180

Description:
Secret of type 'Hex High Entropy String' detected in file 'tests/test_data/scanners/grype/grype.src.ash_output.work.json' at line 180

Code Snippet:

Secret of type Hex High Entropy String detected

Finding 14: SECRET-HEX-HIGH-ENTROPY-STRING

Severity: HIGH
Scanner: detect-secrets
Rule ID: SECRET-HEX-HIGH-ENTROPY-STRING
Location: tests/test_data/scanners/grype/grype.src.ash_output.work.json:156

Description:
Secret of type 'Hex High Entropy String' detected in file 'tests/test_data/scanners/grype/grype.src.ash_output.work.json' at line 156

Code Snippet:

Secret of type Hex High Entropy String detected

Finding 15: SECRET-HEX-HIGH-ENTROPY-STRING

Severity: HIGH
Scanner: detect-secrets
Rule ID: SECRET-HEX-HIGH-ENTROPY-STRING
Location: tests/test_data/scanners/grype/grype.src.ash_output.work.json:164

Description:
Secret of type 'Hex High Entropy String' detected in file 'tests/test_data/scanners/grype/grype.src.ash_output.work.json' at line 164

Code Snippet:

Secret of type Hex High Entropy String detected

Finding 16: SECRET-HEX-HIGH-ENTROPY-STRING

Severity: HIGH
Scanner: detect-secrets
Rule ID: SECRET-HEX-HIGH-ENTROPY-STRING
Location: tests/test_data/scanners/grype/grype.src.ash_output.work.json:200

Description:
Secret of type 'Hex High Entropy String' detected in file 'tests/test_data/scanners/grype/grype.src.ash_output.work.json' at line 200

Code Snippet:

Secret of type Hex High Entropy String detected

Finding 17: SECRET-HEX-HIGH-ENTROPY-STRING

Severity: HIGH
Scanner: detect-secrets
Rule ID: SECRET-HEX-HIGH-ENTROPY-STRING
Location: tests/test_data/scanners/grype/grype.src.ash_output.work.json:172

Description:
Secret of type 'Hex High Entropy String' detected in file 'tests/test_data/scanners/grype/grype.src.ash_output.work.json' at line 172

Code Snippet:

Secret of type Hex High Entropy String detected

Finding 18: SECRET-HEX-HIGH-ENTROPY-STRING

Severity: HIGH
Scanner: detect-secrets
Rule ID: SECRET-HEX-HIGH-ENTROPY-STRING
Location: tests/test_data/scanners/grype/grype.src.ash_output.work.json:160

Description:
Secret of type 'Hex High Entropy String' detected in file 'tests/test_data/scanners/grype/grype.src.ash_output.work.json' at line 160

Code Snippet:

Secret of type Hex High Entropy String detected

Finding 19: SECRET-HEX-HIGH-ENTROPY-STRING

Severity: HIGH
Scanner: detect-secrets
Rule ID: SECRET-HEX-HIGH-ENTROPY-STRING
Location: tests/test_data/scanners/grype/grype.src.ash_output.work.json:184

Description:
Secret of type 'Hex High Entropy String' detected in file 'tests/test_data/scanners/grype/grype.src.ash_output.work.json' at line 184

Code Snippet:

Secret of type Hex High Entropy String detected

Finding 20: SECRET-HEX-HIGH-ENTROPY-STRING

Severity: HIGH
Scanner: detect-secrets
Rule ID: SECRET-HEX-HIGH-ENTROPY-STRING
Location: tests/test_data/scanners/grype/grype.src.json:164

Description:
Secret of type 'Hex High Entropy String' detected in file 'tests/test_data/scanners/grype/grype.src.json' at line 164

Code Snippet:

Secret of type Hex High Entropy String detected

Note: Showing 20 of 175 total actionable findings. Configure max_detailed_findings to adjust this limit.

Report generated by Automated Security Helper (ASH) at 2025-06-11T02:22:16+00:00

github-advanced-security

AWS Labs - Automated Security Helper found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

…ed test docs to docs content

…the .coveragerc

…ady for review

scrthq added 3 commits June 5, 2025 22:53

feat(docs, aws reporters): Lots of doc updates, also added BedrockSum…

2d1672e

…maryReporter and S3Reporter bases (mostly working, some small changes needed still)

feat(tests): added test framework structure and true global suppressions

7c127ea

feat(tests): added test framework structure and true global suppressions

01c0516

github-advanced-security bot found potential problems Jun 7, 2025

View reviewed changes

scrthq added 25 commits June 7, 2025 12:33

feat(tests): tests passing again, working on coverage increasing

5f1055c

saving point mid-fix

11d5cb5

saving point mid-fix

d7d69d1

saving point mid-fix

0fd0427

saving point mid-fix

aa1c2fb

fixing tests

dcc2fd7

test errors resolved, fixing remaining failures now

1573a97

fixed more tests

699ff6d

fix(tests): finally all fixed

266d2f1

fix(tests): fixing new test failures?

6d1da78

fix(tests): fixing new test failures?

c5aa167

fix(tests): fixing new test failures?

49020f3

fix(tests): fixing new test failures?

3ba7c83

fix(tests): fixing new test failures?

9f28db4

fix(tests): fixing new test failures?

ee44aa4

fix(tests): fixing new test failures?

008422b

fix(tests): fixing new test failures?

9cfc582

fix(tests): fixing new test failures?

3d54893

fix(tests): fixing new test failures?

5065978

fix(tests): fixing new test failures?

741ce69

chore(docs, tests): cleaned up tests from unsafe temp path usage, mov…

834a003

…ed test docs to docs content

chore(docs, tests): cleaned up tests from unsafe temp path usage, mov…

2a819f6

…ed test docs to docs content

chore(docs, tests): cleaned up tests from unsafe temp path usage, mov…

6ef65f4

…ed test docs to docs content

fix(tests): adjusted clean_dict test to be included, fixed failures

319db21

chore(ci): removed coverage workflow, not needed as it is built into …

a556693

…the .coveragerc

scrthq added 8 commits June 8, 2025 19:10

chore(ci): removed coverage workflow and adapters, not needed

dcade41

fix(docs): added timeout to requests call in testing documentation

aa53936

chore(dx): centralized ash built-in plugins

425af7c

chore(docs): added documentation for built-in plugins and updated nav

4c5be39

chore(docs, tests, ci): updates with tests all passing again, docs re…

9637eac

…ady for review

fix(ci): troubleshooting windows scan validation step

290c4c5

fix(ci): troubleshooting windows scan validation step

7b04706

fix(ci): troubleshooting windows scan validation step

a5985d6

scrthq merged commit c59ece9 into beta Jun 11, 2025
30 checks passed

scrthq deleted the v3/feat/doc-updates branch June 11, 2025 02:29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(docs, aws reporters): Lots of doc updates, also added BedrockSum… #155

feat(docs, aws reporters): Lots of doc updates, also added BedrockSum… #155

Uh oh!

scrthq commented Jun 6, 2025

Uh oh!

github-actions bot commented Jun 7, 2025 •

edited

Loading

Finding 1: B108

Finding 2: B301

Finding 3: B301

Finding 4: B301

Finding 5: B301

Finding 6: SECRET-SECRET-KEYWORD

Finding 7: SECRET-SECRET-KEYWORD

Finding 8: SECRET-BASE64-HIGH-ENTROPY-STRING

Finding 9: SECRET-BASE64-HIGH-ENTROPY-STRING

Finding 10: SECRET-HEX-HIGH-ENTROPY-STRING

Finding 11: SECRET-HEX-HIGH-ENTROPY-STRING

Finding 12: SECRET-HEX-HIGH-ENTROPY-STRING

Finding 13: SECRET-HEX-HIGH-ENTROPY-STRING

Finding 14: SECRET-HEX-HIGH-ENTROPY-STRING

Finding 15: SECRET-HEX-HIGH-ENTROPY-STRING

Finding 16: SECRET-HEX-HIGH-ENTROPY-STRING

Finding 17: SECRET-HEX-HIGH-ENTROPY-STRING

Finding 18: SECRET-HEX-HIGH-ENTROPY-STRING

Finding 19: SECRET-HEX-HIGH-ENTROPY-STRING

Finding 20: SECRET-HEX-HIGH-ENTROPY-STRING

Uh oh!

github-advanced-security bot left a comment

Uh oh!

Uh oh!

Uh oh!

feat(docs, aws reporters): Lots of doc updates, also added BedrockSum… #155

feat(docs, aws reporters): Lots of doc updates, also added BedrockSum… #155

Uh oh!

Conversation

scrthq commented Jun 6, 2025

Uh oh!

github-actions bot commented Jun 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ASH Security Scan Report

Scan Metadata

Summary

Scanner Results

Top 10 Hotspots

Detailed Findings

Finding 1: B108

Finding 2: B301

Finding 3: B301

Finding 4: B301

Finding 5: B301

Finding 6: SECRET-SECRET-KEYWORD

Finding 7: SECRET-SECRET-KEYWORD

Finding 8: SECRET-BASE64-HIGH-ENTROPY-STRING

Finding 9: SECRET-BASE64-HIGH-ENTROPY-STRING

Finding 10: SECRET-HEX-HIGH-ENTROPY-STRING

Finding 11: SECRET-HEX-HIGH-ENTROPY-STRING

Finding 12: SECRET-HEX-HIGH-ENTROPY-STRING

Finding 13: SECRET-HEX-HIGH-ENTROPY-STRING

Finding 14: SECRET-HEX-HIGH-ENTROPY-STRING

Finding 15: SECRET-HEX-HIGH-ENTROPY-STRING

Finding 16: SECRET-HEX-HIGH-ENTROPY-STRING

Finding 17: SECRET-HEX-HIGH-ENTROPY-STRING

Finding 18: SECRET-HEX-HIGH-ENTROPY-STRING

Finding 19: SECRET-HEX-HIGH-ENTROPY-STRING

Finding 20: SECRET-HEX-HIGH-ENTROPY-STRING

Uh oh!

github-advanced-security bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Jun 7, 2025 •

edited

Loading