Snyk 1.130 vs. SonarQube 10.5: SCA Comparison for npm 10.8 and PyPI 3.13 Dependencies

const { execSync } = require('child_process');const fs = require('fs/promises');const path = require('path');// Snyk 1.130 configurationconst SNYK_VERSION = '1.130.0';const SUPPORTED_NPM_VERSION = '10.8.0';const VULN_SEVERITY_THRESHOLD = 'high'; // Only fail on high/critical/** * Validates that required tool versions are installed * @returns {boolean} True if all versions match benchmarks */async function validateEnvironment() {  try {    const npmVersion = execSync('npm --version').toString().trim();    const snykVersion = execSync('snyk --version').toString().trim();        if (npmVersion !== SUPPORTED_NPM_VERSION) {      throw new Error(`npm version mismatch: expected ${SUPPORTED_NPM_VERSION}, got ${npmVersion}`);    }    if (!snykVersion.startsWith(SNYK_VERSION)) {      throw new Error(`Snyk version mismatch: expected ${SNYK_VERSION}, got ${snykVersion}`);    }    console.log(`Environment validated: npm ${npmVersion}, Snyk ${snykVersion}`);    return true;  } catch (err) {    console.error('Environment validation failed:', err.message);    process.exit(1);  }}/** * Runs Snyk SCA scan on target npm project * @param {string} projectPath - Absolute path to npm project root * @returns {object} Parsed Snyk scan report */async function runSnykScan(projectPath) {  try {    // Validate project has package.json    const packageJsonPath = path.join(projectPath, 'package.json');    await fs.access(packageJsonPath);        // Run Snyk test with JSON output, severity threshold    const scanOutput = execSync(      `snyk test --json --severity-threshold=${VULN_SEVERITY_THRESHOLD} --project-path=${projectPath}`,      { encoding: 'utf8', maxBuffer: 10 * 1024 * 1024 } // 10MB buffer for large dep trees    );        const scanReport = JSON.parse(scanOutput);    // Add metadata for benchmark tracking    scanReport.meta = {      tool: 'snyk',      version: SNYK_VERSION,      npmVersion: SUPPORTED_NPM_VERSION,      scanTimestamp: new Date().toISOString()    };    return scanReport;  } catch (err) {    // Snyk exits with code 1 if vulnerabilities found, handle that    if (err.status === 1) {      const scanReport = JSON.parse(err.stdout);      scanReport.meta = {        tool: 'snyk',        version: SNYK_VERSION,        npmVersion: SUPPORTED_NPM_VERSION,        scanTimestamp: new Date().toISOString()      };      return scanReport;    }    console.error('Snyk scan failed:', err.message);    throw err;  }}/** * Writes scan report to disk and generates summary * @param {object} report - Snyk scan report * @param {string} outputPath - Path to write report */async function persistResults(report, outputPath) {  try {    await fs.mkdir(path.dirname(outputPath), { recursive: true });    await fs.writeFile(outputPath, JSON.stringify(report, null, 2));        const vulnCount = report.vulnerabilities?.length || 0;    const criticalCount = report.vulnerabilities?.filter(v => v.severity === 'critical').length || 0;    console.log(`Scan complete: ${vulnCount} total vulnerabilities (${criticalCount} critical)`);    console.log(`Report written to ${outputPath}`);  } catch (err) {    console.error('Failed to persist results:', err.message);    throw err;  }}// Main execution(async () => {  await validateEnvironment();  const targetProject = process.argv[2] || process.cwd();  const reportPath = path.join(targetProject, 'snyk-report.json');      try {    const scanReport = await runSnykScan(targetProject);    await persistResults(scanReport, reportPath);        if (scanReport.vulnerabilities?.length > 0) {      console.warn('Vulnerabilities detected, failing CI build');      process.exit(1);    }  } catch (err) {    console.error('Pipeline failed:', err.message);    process.exit(1);  }})();

import subprocessimport jsonimport osimport sysfrom pathlib import Pathimport requestsfrom typing import Dict, List, Optional# SonarQube 10.5 configurationSONAR_VERSION = "10.5.0"SUPPORTED_PYTHON_VERSION = "3.13.0"SONAR_HOST = os.getenv("SONAR_HOST", "http://localhost:9000")SONAR_TOKEN = os.getenv("SONAR_TOKEN", "")class SonarQubePyPIScanner:    """Handles PyPI 3.13 dependency scanning via SonarQube 10.5 Developer Edition"""        def __init__(self, project_key: str, project_path: Path):        self.project_key = project_key        self.project_path = project_path        self.scan_report: Optional[Dict] = None            def validate_environment(self) -> bool:        """Validate Python and SonarQube CLI versions match benchmarks"""        try:            python_version = subprocess.check_output(                ["python3", "--version"], text=True            ).strip().split()[1]            if python_version != SUPPORTED_PYTHON_VERSION:                raise ValueError(f"Python version mismatch: expected {SUPPORTED_PYTHON_VERSION}, got {python_version}")                        sonar_version = subprocess.check_output(                ["sonar-scanner", "--version"], text=True            ).strip().split()[1]            if not sonar_version.startswith(SONAR_VERSION):                raise ValueError(f"SonarQube version mismatch: expected {SONAR_VERSION}, got {sonar_version}")                        if not SONAR_TOKEN:                raise ValueError("SONAR_TOKEN environment variable not set")                        print(f"Environment validated: Python {python_version}, SonarQube {sonar_version}")            return True        except Exception as e:            print(f"Environment validation failed: {e}", file=sys.stderr)            sys.exit(1)                def generate_dependency_report(self) -> Path:        """Generate PyPI dependency tree for SonarQube ingestion"""        try:            # Use pip 23.3+ to generate requirements with hashes            subprocess.check_call(                ["pip3", "freeze", "--local", "--all"],                stdout=open(self.project_path / "requirements.txt", "w")            )            # Generate JSON dependency tree for benchmark tracking            dep_tree = subprocess.check_output(                ["pip3", "list", "--format=json"], text=True            )            dep_path = self.project_path / "pypi-deps.json"            with open(dep_path, "w") as f:                json.dump(json.loads(dep_tree), f, indent=2)            print(f"Dependency report generated at {dep_path}")            return dep_path        except Exception as e:            print(f"Failed to generate dependency report: {e}", file=sys.stderr)            raise                def run_scan(self) -> Dict:        """Trigger SonarQube scan and fetch results"""        try:            # Run sonar-scanner with PyPI SCA parameters            subprocess.check_call([                "sonar-scanner",                f"-Dsonar.projectKey={self.project_key}",                f"-Dsonar.sources={self.project_path}",                "-Dsonar.python.coverage.reportPaths=coverage.xml",                "-Dsonar.dependencyCheck.xmlReportPath=dependency-check-report.xml"            ], env={**os.environ, "SONAR_TOKEN": SONAR_TOKEN})                        # Fetch scan results from SonarQube API            response = requests.get(                f"{SONAR_HOST}/api/issues/search",                params={                    "componentKeys": self.project_key,                    "types": "VULNERABILITY",                    "ps": 500                },                auth=(SONAR_TOKEN, "")            )            response.raise_for_status()            self.scan_report = response.json()            self.scan_report["meta"] = {                "tool": "sonarqube",                "version": SONAR_VERSION,                "pythonVersion": SUPPORTED_PYTHON_VERSION,                "scanTimestamp": subprocess.check_output(["date", "+%Y-%m-%dT%H:%M:%SZ"], text=True).strip()            }            return self.scan_report        except Exception as e:            print(f"SonarQube scan failed: {e}", file=sys.stderr)            raise                def generate_summary(self) -> None:        """Print scan summary to stdout"""        if not self.scan_report:            print("No scan report available")            return        vulns = self.scan_report.get("issues", [])        critical = len([v for v in vulns if v.get("severity") == "CRITICAL"])        high = len([v for v in vulns if v.get("severity") == "MAJOR"])        print(f"SonarQube Scan Summary: {len(vulns)} total vulnerabilities ({critical} critical, {high} high)")                def persist_results(self, output_path: Path) -> None:        """Write scan report to disk"""        try:            with open(output_path, "w") as f:                json.dump(self.scan_report, f, indent=2)            print(f"SonarQube report written to {output_path}")        except Exception as e:            print(f"Failed to persist results: {e}", file=sys.stderr)            raiseif __name__ == "__main__":    if len(sys.argv) < 3:        print("Usage: python3 sonar_pypi_scan.py  ")        sys.exit(1)    project_key = sys.argv[1]    project_path = Path(sys.argv[2])    scanner = SonarQubePyPIScanner(project_key, project_path)    scanner.validate_environment()    scanner.generate_dependency_report()    report = scanner.run_scan()    scanner.generate_summary()    scanner.persist_results(project_path / "sonar-report.json")

const { execSync } = require('child_process');const fs = require('fs/promises');const path = require('path');const csvWriter = require('csv-writer').createObjectCsvWriter;// Benchmark configurationconst BENCHMARK_PROJECTS = [  { name: 'express-app', type: 'npm', path: './test-projects/express-app' },  { name: 'django-app', type: 'pypi', path: './test-projects/django-app' },  { name: 'react-monorepo', type: 'npm', path: './test-projects/react-monorepo' },  { name: 'fastapi-app', type: 'pypi', path: './test-projects/fastapi-app' }];const SNYK_VERSION = '1.130.0';const SONAR_VERSION = '10.5.0';const ITERATIONS = 5; // Run each scan 5 times for statistical significance/** * Measures execution time of a shell command * @param {string} cmd - Command to execute * @returns {object} { stdout, stderr, durationMs } */function measureCommand(cmd) {  const start = Date.now();  try {    const stdout = execSync(cmd, { encoding: 'utf8', maxBuffer: 20 * 1024 * 1024 });    const durationMs = Date.now() - start;    return { stdout, stderr: '', durationMs, success: true };  } catch (err) {    const durationMs = Date.now() - start;    return { stdout: err.stdout || '', stderr: err.stderr || '', durationMs, success: false, error: err.message };  }}/** * Runs Snyk scan for a single project and returns metrics * @param {object} project - Project config from BENCHMARK_PROJECTS * @returns {object} Scan metrics */async function runSnykBenchmark(project) {  const results = [];  for (let i = 0; i < ITERATIONS; i++) {    const { stdout, durationMs, success } = measureCommand(      `snyk test --json --project-path=${project.path}`    );    let vulnCount = 0;    if (success || stdout) {      try {        const report = JSON.parse(stdout);        vulnCount = report.vulnerabilities?.length || 0;      } catch (e) {        // Ignore parse errors for failed scans      }    }    results.push({ iteration: i, durationMs, vulnCount, success });  }  // Calculate averages  const avgDuration = results.reduce((sum, r) => sum + r.durationMs, 0) / ITERATIONS;  const avgVulns = results.reduce((sum, r) => sum + r.vulnCount, 0) / ITERATIONS;  return {    tool: 'snyk',    toolVersion: SNYK_VERSION,    project: project.name,    projectType: project.type,    avgScanDurationMs: avgDuration,    avgVulnerabilities: avgVulns,    successRate: results.filter(r => r.success).length / ITERATIONS  };}/** * Runs SonarQube scan for a single project and returns metrics * @param {object} project - Project config from BENCHMARK_PROJECTS * @returns {object} Scan metrics */async function runSonarBenchmark(project) {  const results = [];  for (let i = 0; i < ITERATIONS; i++) {    const { stdout, durationMs, success } = measureCommand(      `sonar-scanner -Dsonar.projectKey=${project.name} -Dsonar.sources=${project.path}`    );    // Fetch vulnerability count from SonarQube API (simplified for example)    let vulnCount = 0;    if (success) {      try {        const apiResponse = execSync(          `curl -s "${process.env.SONAR_HOST}/api/issues/search?componentKeys=${project.name}&types=VULNERABILITY"`        ).toString();        const report = JSON.parse(apiResponse);        vulnCount = report.issues?.length || 0;      } catch (e) {        // Ignore API errors      }    }    results.push({ iteration: i, durationMs, vulnCount, success });  }  const avgDuration = results.reduce((sum, r) => sum + r.durationMs, 0) / ITERATIONS;  const avgVulns = results.reduce((sum, r) => sum + r.vulnCount, 0) / ITERATIONS;  return {    tool: 'sonarqube',    toolVersion: SONAR_VERSION,    project: project.name,    projectType: project.type,    avgScanDurationMs: avgDuration,    avgVulnerabilities: avgVulns,    successRate: results.filter(r => r.success).length / ITERATIONS  };}/** * Main benchmark execution */async function runBenchmark() {  const benchmarkResults = [];  for (const project of BENCHMARK_PROJECTS) {    console.log(`Benchmarking ${project.name} (${project.type})...`);    // Run Snyk benchmark    const snykResult = await runSnykBenchmark(project);    benchmarkResults.push(snykResult);    // Run SonarQube benchmark    const sonarResult = await runSonarBenchmark(project);    benchmarkResults.push(sonarResult);  }  // Write results to CSV  const csvWriterInstance = csvWriter({    path: 'snyk-sonar-benchmark-results.csv',    header: [      { id: 'tool', title: 'Tool' },      { id: 'toolVersion', title: 'Tool Version' },      { id: 'project', title: 'Project' },      { id: 'projectType', title: 'Project Type' },      { id: 'avgScanDurationMs', title: 'Avg Scan Duration (ms)' },      { id: 'avgVulnerabilities', title: 'Avg Vulnerabilities' },      { id: 'successRate', title: 'Success Rate' }    ]  });  await csvWriterInstance.writeRecords(benchmarkResults);  console.log('Benchmark results written to snyk-sonar-benchmark-results.csv');  return benchmarkResults;}// Execute benchmark(async () => {  try {    await runBenchmark();  } catch (err) {    console.error('Benchmark failed:', err.message);    process.exit(1);  }})();