Use new sb contrib (#119)

Bug fix Groovy support
ShiftLeftSecurity · Jul 8, 2020 · d00befc · d00befc
1 parent 4eed6c1
commit d00befc
Show file tree

Hide file tree

Showing 12 changed files with 158 additions and 44 deletions.
diff --git a/Dockerfile b/Dockerfile
@@ -18,8 +18,8 @@ ENV GOSEC_VERSION=2.3.0 \
     PMD_CMD="/opt/pmd-bin-${PMD_VERSION}/bin/run.sh pmd" \
     JQ_VERSION=1.6 \
     FSB_VERSION=1.10.1 \
-    FB_CONTRIB_VERSION=7.4.7 \
-    SB_VERSION=4.0.1 \
+    SB_CONTRIB_VERSION=7.4.7 \
+    SB_VERSION=4.0.6 \
     GOPATH=/opt/app-root/go \
     SHIFTLEFT_HOME=/opt/sl-cli \
     PATH=${PATH}:${GRADLE_HOME}/bin:${GOPATH}/bin:
@@ -64,13 +64,13 @@ RUN curl -L "https://github.com/detekt/detekt/releases/download/v${DETEKT_VERSIO
     && curl -LO "https://github.com/controlplaneio/kubesec/releases/download/v${KUBESEC_VERSION}/kubesec_linux_amd64.tar.gz" \
     && tar -C /usr/local/bin/shiftleft/ -xvf kubesec_linux_amd64.tar.gz \
     && rm kubesec_linux_amd64.tar.gz \
-    && curl -LO "https://repo.maven.apache.org/maven2/com/github/spotbugs/spotbugs/${SB_VERSION}/spotbugs-${SB_VERSION}.zip" \
-    && unzip -q spotbugs-${SB_VERSION}.zip -d /opt/ \
-    && rm spotbugs-${SB_VERSION}.zip \
+    && curl -LO "https://github.com/spotbugs/spotbugs/releases/download/${SB_VERSION}/spotbugs-${SB_VERSION}.tgz" \
+    && tar -C /opt/ -xvf spotbugs-${SB_VERSION}.tgz \
+    && rm spotbugs-${SB_VERSION}.tgz \
     && curl -LO "https://repo1.maven.org/maven2/com/h3xstream/findsecbugs/findsecbugs-plugin/${FSB_VERSION}/findsecbugs-plugin-${FSB_VERSION}.jar" \
     && mv findsecbugs-plugin-${FSB_VERSION}.jar /opt/spotbugs-${SB_VERSION}/plugin/findsecbugs-plugin.jar \
-    && curl -LO "https://repo1.maven.org/maven2/com/mebigfatguy/fb-contrib/fb-contrib/${FB_CONTRIB_VERSION}/fb-contrib-${FB_CONTRIB_VERSION}.jar" \
-    && mv fb-contrib-${FB_CONTRIB_VERSION}.jar /opt/spotbugs-${SB_VERSION}/plugin/fb-contrib.jar \
+    && curl -LO "https://repo1.maven.org/maven2/com/mebigfatguy/sb-contrib/sb-contrib/${SB_CONTRIB_VERSION}/sb-contrib-${SB_CONTRIB_VERSION}.jar" \
+    && mv sb-contrib-${SB_CONTRIB_VERSION}.jar /opt/spotbugs-${SB_VERSION}/plugin/sb-contrib.jar \
     && curl "https://cdn.shiftleft.io/download/sl" > /usr/local/bin/shiftleft/sl \
     && chmod a+rx /usr/local/bin/shiftleft/sl \
     && mkdir -p /opt/sl-cli
@@ -95,7 +95,7 @@ ENV APP_SRC_DIR=/usr/local/src \
     DEPSCAN_CMD="/usr/local/bin/depscan" \
     MVN_CMD="/opt/apache-maven/bin/mvn" \
     PMD_CMD="/opt/pmd-bin/bin/run.sh pmd" \
-    SB_VERSION=4.0.1 \
+    SB_VERSION=4.0.6 \
     PMD_VERSION=6.24.0 \
     PMD_JAVA_OPTS="" \
     SPOTBUGS_HOME=/opt/spotbugs \

diff --git a/README.md b/README.md
@@ -25,10 +25,12 @@ ShiftLeft Scan is a free open-source security tool for modern DevOps teams. With
 | credscan             | gitleaks                            |
 | depscan              | dep-scan                            |
 | go                   | gosec, staticcheck                  |
+| groovy               | find-sec-bugs                       |
 | java                 | cdxgen, gradle, find-sec-bugs, pmd  |
-| jsp                  | pmd                                 |
+| jsp                  | pmd, find-sec-bugs                  |
 | json                 | jq, jsondiff, jsonschema            |
 | kotlin               | detekt, find-sec-bugs               |
+| scala                | find-sec-bugs                       |
 | kubernetes           | checkov, kubesec, kube-score        |
 | nodejs               | cdxgen, njsscan, eslint, yarn, rush |
 | puppet               | puppet-lint                         |

diff --git a/appimage-builder.yml b/appimage-builder.yml
@@ -72,6 +72,7 @@ AppDir:
       DEPSCAN_CMD: '${APPDIR}/usr/bin/depscan'
       PMD_CMD: '${APPDIR}/opt/pmd-bin/bin/run.sh pmd'
       SPOTBUGS_HOME: '${APPDIR}/opt/spotbugs'
+      DETEKT_JAR: '${APPDIR}/usr/bin/detekt-cli.jar'
 
   test:
     fedora:

diff --git a/appimage-reqs.sh b/appimage-reqs.sh
@@ -10,8 +10,8 @@ GITLEAKS_VERSION=4.3.1
 SC_VERSION=2020.1.4
 PMD_VERSION=6.24.0
 FSB_VERSION=1.10.1
-FB_CONTRIB_VERSION=7.4.7
-SB_VERSION=4.0.1
+SB_CONTRIB_VERSION=7.4.7
+SB_VERSION=4.0.6
 NODE_VERSION=14.5.0
 export PATH=$PATH:${APPDIR}/usr/bin:
 
@@ -45,13 +45,13 @@ curl -L "https://github.com/detekt/detekt/releases/download/v${DETEKT_VERSION}/d
     && curl -LO "https://github.com/controlplaneio/kubesec/releases/download/v${KUBESEC_VERSION}/kubesec_linux_amd64.tar.gz" \
     && tar -C ${APPDIR}/usr/bin/ -xvf kubesec_linux_amd64.tar.gz \
     && rm kubesec_linux_amd64.tar.gz \
-    && curl -LO "https://repo.maven.apache.org/maven2/com/github/spotbugs/spotbugs/${SB_VERSION}/spotbugs-${SB_VERSION}.zip" \
-    && unzip -q spotbugs-${SB_VERSION}.zip -d ${OPTDIR}/ \
-    && rm spotbugs-${SB_VERSION}.zip
+    && curl -LO "https://github.com/spotbugs/spotbugs/releases/download/${SB_VERSION}/spotbugs-${SB_VERSION}.tgz" \
+    && tar -C ${OPTDIR}/ -xvf spotbugs-${SB_VERSION}.tgz \
+    && rm spotbugs-${SB_VERSION}.tgz
 curl -LO "https://repo1.maven.org/maven2/com/h3xstream/findsecbugs/findsecbugs-plugin/${FSB_VERSION}/findsecbugs-plugin-${FSB_VERSION}.jar" \
     && mv findsecbugs-plugin-${FSB_VERSION}.jar ${OPTDIR}/spotbugs-${SB_VERSION}/plugin/findsecbugs-plugin.jar \
-    && curl -LO "https://repo1.maven.org/maven2/com/mebigfatguy/fb-contrib/fb-contrib/${FB_CONTRIB_VERSION}/fb-contrib-${FB_CONTRIB_VERSION}.jar" \
-    && mv fb-contrib-${FB_CONTRIB_VERSION}.jar ${OPTDIR}/spotbugs-${SB_VERSION}/plugin/fb-contrib.jar \
+    && curl -LO "https://repo1.maven.org/maven2/com/mebigfatguy/sb-contrib/sb-contrib/${SB_CONTRIB_VERSION}/sb-contrib-${SB_CONTRIB_VERSION}.jar" \
+    && mv sb-contrib-${SB_CONTRIB_VERSION}.jar ${OPTDIR}/spotbugs-${SB_VERSION}/plugin/sb-contrib.jar \
     && mv ${OPTDIR}/spotbugs-${SB_VERSION} ${OPTDIR}/spotbugs \
     && php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');" && php composer-setup.php \
     && mv composer.phar ${APPDIR}/usr/bin/composer \

diff --git a/ci/Dockerfile-java b/ci/Dockerfile-java
@@ -11,15 +11,16 @@ ENV GOSEC_VERSION=2.3.0 \
     GITLEAKS_VERSION=4.3.1 \
     GRADLE_VERSION=6.5.1 \
     GRADLE_HOME=/opt/gradle-${GRADLE_VERSION} \
+    SBT_VERSION=1.3.4 \
     MAVEN_VERSION=3.6.3 \
     MAVEN_HOME=/opt/apache-maven-${MAVEN_VERSION} \
     SC_VERSION=2020.1.4 \
     PMD_VERSION=6.24.0 \
     PMD_CMD="/opt/pmd-bin-${PMD_VERSION}/bin/run.sh pmd" \
     JQ_VERSION=1.6 \
     FSB_VERSION=1.10.1 \
-    FB_CONTRIB_VERSION=7.4.7 \
-    SB_VERSION=4.0.1 \
+    SB_CONTRIB_VERSION=7.4.7 \
+    SB_VERSION=4.0.6 \
     GOPATH=/opt/app-root/go \
     SHIFTLEFT_HOME=/opt/sl-cli \
     PATH=${PATH}:${GRADLE_HOME}/bin:${GOPATH}/bin:
@@ -39,6 +40,10 @@ RUN curl -LO "https://services.gradle.org/distributions/gradle-${GRADLE_VERSION}
     && unzip -q apache-maven-${MAVEN_VERSION}-bin.zip -d /opt/ \
     && chmod +x /opt/apache-maven-${MAVEN_VERSION}/bin/mvn \
     && rm apache-maven-${MAVEN_VERSION}-bin.zip \
+    && curl -LO "https://sbt-downloads.cdnedge.bluemix.net/releases/v${SBT_VERSION}/sbt-${SBT_VERSION}.zip" \
+    && unzip -q sbt-${SBT_VERSION}.zip -d /opt/ \
+    && chmod +x /opt/sbt/bin/sbt \
+    && rm sbt-${SBT_VERSION}.zip \
     && curl -LO "https://storage.googleapis.com/shellcheck/shellcheck-stable.linux.x86_64.tar.xz" \
     && tar -C /tmp/ -xvf shellcheck-stable.linux.x86_64.tar.xz \
     && cp /tmp/shellcheck-stable/shellcheck /usr/local/bin/shiftleft/shellcheck \
@@ -64,13 +69,13 @@ RUN curl -L "https://github.com/detekt/detekt/releases/download/${DETEKT_VERSION
     && curl -LO "https://github.com/controlplaneio/kubesec/releases/download/v${KUBESEC_VERSION}/kubesec_linux_amd64.tar.gz" \
     && tar -C /usr/local/bin/shiftleft/ -xvf kubesec_linux_amd64.tar.gz \
     && rm kubesec_linux_amd64.tar.gz \
-    && curl -LO "https://repo.maven.apache.org/maven2/com/github/spotbugs/spotbugs/${SB_VERSION}/spotbugs-${SB_VERSION}.zip" \
-    && unzip -q spotbugs-${SB_VERSION}.zip -d /opt/ \
-    && rm spotbugs-${SB_VERSION}.zip \
+    && curl -LO "https://github.com/spotbugs/spotbugs/releases/download/${SB_VERSION}/spotbugs-${SB_VERSION}.tgz" \
+    && tar -C /opt/ -xvf spotbugs-${SB_VERSION}.tgz \
+    && rm spotbugs-${SB_VERSION}.tgz \
     && curl -LO "https://repo1.maven.org/maven2/com/h3xstream/findsecbugs/findsecbugs-plugin/${FSB_VERSION}/findsecbugs-plugin-${FSB_VERSION}.jar" \
     && mv findsecbugs-plugin-${FSB_VERSION}.jar /opt/spotbugs-${SB_VERSION}/plugin/findsecbugs-plugin.jar \
-    && curl -LO "https://repo1.maven.org/maven2/com/mebigfatguy/fb-contrib/fb-contrib/${FB_CONTRIB_VERSION}/fb-contrib-${FB_CONTRIB_VERSION}.jar" \
-    && mv fb-contrib-${FB_CONTRIB_VERSION}.jar /opt/spotbugs-${SB_VERSION}/plugin/fb-contrib.jar \
+    && curl -LO "https://repo1.maven.org/maven2/com/mebigfatguy/sb-contrib/sb-contrib/${SB_CONTRIB_VERSION}/sb-contrib-${SB_CONTRIB_VERSION}.jar" \
+    && mv sb-contrib-${SB_CONTRIB_VERSION}.jar /opt/spotbugs-${SB_VERSION}/plugin/sb-contrib.jar \
     && curl "https://cdn.shiftleft.io/download/sl" > /usr/local/bin/shiftleft/sl \
     && chmod a+rx /usr/local/bin/shiftleft/sl \
     && mkdir -p /opt/sl-cli && /usr/local/bin/shiftleft/sl update libplugin
@@ -95,7 +100,7 @@ ENV APP_SRC_DIR=/usr/local/src \
     DEPSCAN_CMD="/usr/local/bin/depscan" \
     MVN_CMD="/opt/apache-maven/bin/mvn" \
     PMD_CMD="/opt/pmd-bin/bin/run.sh pmd" \
-    SB_VERSION=4.0.1 \
+    SB_VERSION=4.0.6 \
     PMD_VERSION=6.24.0 \
     PMD_JAVA_OPTS="" \
     SPOTBUGS_HOME=/opt/spotbugs \
@@ -125,6 +130,7 @@ COPY --from=builder /opt/pmd-bin-${PMD_VERSION} /opt/pmd-bin
 COPY --from=builder /opt/spotbugs-${SB_VERSION} /opt/spotbugs
 COPY --from=builder /opt/gradle-${GRADLE_VERSION} /opt/gradle
 COPY --from=builder /opt/apache-maven-${MAVEN_VERSION} /opt/apache-maven
+COPY --from=builder /opt/sbt /opt/sbt
 COPY --from=builder /opt/sl-cli /opt/sl-cli
 COPY tools_config/ /usr/local/src/
 COPY requirements.txt /usr/local/src/

diff --git a/ci/Dockerfile-oss b/ci/Dockerfile-oss
@@ -18,8 +18,8 @@ ENV GOSEC_VERSION=2.3.0 \
     PMD_CMD="/opt/pmd-bin-${PMD_VERSION}/bin/run.sh pmd" \
     JQ_VERSION=1.6 \
     FSB_VERSION=1.10.1 \
-    FB_CONTRIB_VERSION=7.4.7 \
-    SB_VERSION=4.0.1 \
+    SB_CONTRIB_VERSION=7.4.7 \
+    SB_VERSION=4.0.6 \
     GOPATH=/opt/app-root/go \
     PATH=${PATH}:${GRADLE_HOME}/bin:${GOPATH}/bin:
 
@@ -63,13 +63,13 @@ RUN curl -L "https://github.com/detekt/detekt/releases/download/${DETEKT_VERSION
     && curl -LO "https://github.com/controlplaneio/kubesec/releases/download/v${KUBESEC_VERSION}/kubesec_linux_amd64.tar.gz" \
     && tar -C /usr/local/bin/shiftleft/ -xvf kubesec_linux_amd64.tar.gz \
     && rm kubesec_linux_amd64.tar.gz \
-    && curl -LO "https://repo.maven.apache.org/maven2/com/github/spotbugs/spotbugs/${SB_VERSION}/spotbugs-${SB_VERSION}.zip" \
-    && unzip -q spotbugs-${SB_VERSION}.zip -d /opt/ \
-    && rm spotbugs-${SB_VERSION}.zip \
+    && curl -LO "https://github.com/spotbugs/spotbugs/releases/download/${SB_VERSION}/spotbugs-${SB_VERSION}.tgz" \
+    && tar -C /opt/ -xvf spotbugs-${SB_VERSION}.tgz \
+    && rm spotbugs-${SB_VERSION}.tgz \
     && curl -LO "https://repo1.maven.org/maven2/com/h3xstream/findsecbugs/findsecbugs-plugin/${FSB_VERSION}/findsecbugs-plugin-${FSB_VERSION}.jar" \
     && mv findsecbugs-plugin-${FSB_VERSION}.jar /opt/spotbugs-${SB_VERSION}/plugin/findsecbugs-plugin.jar \
-    && curl -LO "https://repo1.maven.org/maven2/com/mebigfatguy/fb-contrib/fb-contrib/${FB_CONTRIB_VERSION}/fb-contrib-${FB_CONTRIB_VERSION}.jar" \
-    && mv fb-contrib-${FB_CONTRIB_VERSION}.jar /opt/spotbugs-${SB_VERSION}/plugin/fb-contrib.jar
+    && curl -LO "https://repo1.maven.org/maven2/com/mebigfatguy/sb-contrib/sb-contrib/${SB_CONTRIB_VERSION}/sb-contrib-${SB_CONTRIB_VERSION}.jar" \
+    && mv sb-contrib-${SB_CONTRIB_VERSION}.jar /opt/spotbugs-${SB_VERSION}/plugin/sb-contrib.jar
 RUN gem install -q puppet-lint cyclonedx-ruby && gem cleanup -q
 
 FROM shiftleft/scan-base-slim as sast-scan-tools
@@ -91,7 +91,7 @@ ENV APP_SRC_DIR=/usr/local/src \
     DEPSCAN_CMD="/usr/local/bin/depscan" \
     MVN_CMD="/opt/apache-maven/bin/mvn" \
     PMD_CMD="/opt/pmd-bin/bin/run.sh pmd" \
-    SB_VERSION=4.0.1 \
+    SB_VERSION=4.0.6 \
     PMD_VERSION=6.24.0 \
     PMD_JAVA_OPTS="" \
     SPOTBUGS_HOME=/opt/spotbugs \

diff --git a/lib/builder.py b/lib/builder.py
@@ -95,13 +95,15 @@ def java_build(src, reports_dir, lang_tools):
     """
     cmd_args = []
     pom_files = [p.as_posix() for p in Path(src).rglob("pom.xml")]
+    gradle_files = [p.as_posix() for p in Path(src).rglob("build.gradle")]
+    sbt_files = [p.as_posix() for p in Path(src).rglob("build.sbt")]
     env = get_env()
     if pom_files:
         cmd_args = lang_tools.get("maven")
-    else:
-        gradle_files = [p.as_posix() for p in Path(src).rglob("build.gradle")]
-        if gradle_files:
-            cmd_args = get_gradle_cmd(src, lang_tools.get("gradle"))
+    elif gradle_files:
+        cmd_args = get_gradle_cmd(src, lang_tools.get("gradle"))
+    elif sbt_files:
+        cmd_args = lang_tools.get("sbt")
     if not cmd_args:
         LOG.info("Java auto build is supported only for maven or gradle based projects")
         return False
@@ -161,6 +163,32 @@ def kotlin_build(src, reports_dir, lang_tools):
     return java_build(src, reports_dir, lang_tools)
 
 
+def scala_build(src, reports_dir, lang_tools):
+    """
+    Automatically build scala project
+
+    :param src: Source directory
+    :param reports_dir: Reports directory to store any logs
+    :param lang_tools: Language specific build tools
+
+    :return: boolean status from the build. True if the command executed successfully. False otherwise
+    """
+    return java_build(src, reports_dir, lang_tools)
+
+
+def groovy_build(src, reports_dir, lang_tools):
+    """
+    Automatically build groovy project
+
+    :param src: Source directory
+    :param reports_dir: Reports directory to store any logs
+    :param lang_tools: Language specific build tools
+
+    :return: boolean status from the build. True if the command executed successfully. False otherwise
+    """
+    return java_build(src, reports_dir, lang_tools)
+
+
 def nodejs_build(src, reports_dir, lang_tools):
     """
     Automatically build nodejs project

diff --git a/lib/config.py b/lib/config.py
@@ -20,8 +20,10 @@
 
 runtimeValues = {}
 
-APP_SRC_DIR = os.path.join(os.path.dirname(__file__), "..")
-TOOLS_CONFIG_DIR = os.path.join(os.path.dirname(__file__), "..")
+APP_SRC_DIR = os.getenv("APP_SRC_DIR", os.path.join(os.path.dirname(__file__), ".."))
+TOOLS_CONFIG_DIR = os.getenv(
+    "TOOLS_CONFIG_DIR", os.path.join(os.path.dirname(__file__), "..")
+)
 
 # Depth of credscan
 credscan_depth = "5"
@@ -35,6 +37,7 @@
 
 # Kotlint detekt config
 detekt_config = os.path.join(TOOLS_CONFIG_DIR, "detekt-config.yml")
+detekt_jar = "/usr/local/bin/detekt-cli.jar"
 
 DEPSCAN_CMD = "/usr/local/bin/depscan"
 PMD_CMD = "/opt/pmd-bin/bin/run.sh pmd"
@@ -271,13 +274,34 @@ def set(configName, value):
             "csv",
             "-R",
             get("TOOLS_CONFIG_DIR") + "/rules-pmd.xml",
-        ]
+        ],
+        "audit-jsp": [
+            "java",
+            "-jar",
+            get("SPOTBUGS_HOME") + "/lib/spotbugs.jar",
+            "-textui",
+            "-include",
+            get("TOOLS_CONFIG_DIR") + "/spotbugs/include.xml",
+            "-exclude",
+            get("TOOLS_CONFIG_DIR") + "/spotbugs/exclude.xml",
+            "-noClassOk",
+            "-sourcepath",
+            "%(src)s",
+            "-quiet",
+            "-medium",
+            "-xml:withMessages",
+            "-effort:max",
+            "-nested:false",
+            "-output",
+            "%(report_fname_prefix)s.xml",
+            "%(src)s",
+        ],
     },
     "kotlin": {
         "source-kt": [
             "java",
             "-jar",
-            "/usr/local/bin/detekt-cli.jar",
+            get("detekt_jar"),
             "-c",
             get("detekt_config"),
             "-i",
@@ -412,6 +436,52 @@ def set(configName, value):
         ],
     },
     "puppet": ["puppet-lint", "--error-level", "all", "--json", "%(src)s"],
+    "scala": {
+        "audit-scala": [
+            "java",
+            "-jar",
+            get("SPOTBUGS_HOME") + "/lib/spotbugs.jar",
+            "-textui",
+            "-include",
+            get("TOOLS_CONFIG_DIR") + "/spotbugs/include.xml",
+            "-exclude",
+            get("TOOLS_CONFIG_DIR") + "/spotbugs/exclude.xml",
+            "-noClassOk",
+            "-sourcepath",
+            "%(src)s",
+            "-quiet",
+            "-medium",
+            "-xml:withMessages",
+            "-effort:max",
+            "-nested:false",
+            "-output",
+            "%(report_fname_prefix)s.xml",
+            "%(src)s",
+        ],
+    },
+    "groovy": {
+        "audit-groovy": [
+            "java",
+            "-jar",
+            get("SPOTBUGS_HOME") + "/lib/spotbugs.jar",
+            "-textui",
+            "-include",
+            get("TOOLS_CONFIG_DIR") + "/spotbugs/include.xml",
+            "-exclude",
+            get("TOOLS_CONFIG_DIR") + "/spotbugs/exclude.xml",
+            "-noClassOk",
+            "-sourcepath",
+            "%(src)s",
+            "-quiet",
+            "-medium",
+            "-xml:withMessages",
+            "-effort:max",
+            "-nested:false",
+            "-output",
+            "%(report_fname_prefix)s.xml",
+            "%(src)s",
+        ],
+    },
     "terraform": {
         "source-tf": ["checkov", "-s", "--quiet", "-o", "json", "-d", "%(src)s"],
         "tfsec": ["tfsec", "--format", "json", "--no-colour", "%(src)s"],
@@ -466,6 +536,7 @@ def set(configName, value):
     "java": {
         "maven": [get("MVN_CMD"), "compile"],
         "gradle": [get("GRADLE_CMD"), "compileJava"],
+        "sbt": ["sbt", "compile"],
     },
     "android": {"gradle": [get("GRADLE_CMD"), "compileDebugSources"],},
     "kotlin": {
@@ -479,6 +550,7 @@ def set(configName, value):
     "scala": {
         "maven": [get("MVN_CMD"), "compile"],
         "gradle": [get("GRADLE_CMD"), "compileScala"],
+        "sbt": ["sbt", "compile"],
     },
     "nodejs": {
         "npm": ["npm", "install"],
@@ -533,6 +605,7 @@ def set(configName, value):
     "source-vf": "Source code analyzer for VisualForce",
     "source-sql": "Source code analyzer for SQL",
     "source-jsp": "Source code analyzer for JSP",
+    "audit-jsp": "Security audit for JSP",
     "source-apex": "Source code analyzer for apex",
     "binary": "Binary byte-code analyzer",
     "class": "Class file analyzer",

diff --git a/lib/executor.py b/lib/executor.py
@@ -110,6 +110,8 @@ def exec_tool(
             tool_verb = "Scanning with"
             if "init" in tool_name:
                 tool_verb = "Initializing"
+            elif "build" in tool_name:
+                tool_verb = "Building with"
             task = progress.add_task(
                 "[green]" + tool_verb + " " + tool_name, total=100, start=False
             )