{"id":19683617,"url":"https://github.com/doyensec/poiex","last_synced_at":"2025-04-29T05:31:24.339Z","repository":{"id":192021551,"uuid":"667850119","full_name":"doyensec/PoiEx","owner":"doyensec","description":"🌐 Visualize and explore IaC ✒️ Create and share notes in VS Code 🤝 Sync notes and findings in real-time with friends","archived":false,"fork":false,"pushed_at":"2024-02-02T20:06:03.000Z","size":3437,"stargazers_count":72,"open_issues_count":0,"forks_count":2,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-04-05T13:38:06.405Z","etag":null,"topics":["collaborative-editing","iac","security","security-tools","semgrep","vscode","vscode-extension"],"latest_commit_sha":null,"homepage":"https://blog.doyensec.com/2024/01/30/poiex-release.html","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/doyensec.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2023-07-18T12:48:49.000Z","updated_at":"2025-03-02T07:59:40.000Z","dependencies_parsed_at":"2023-09-02T05:05:24.107Z","dependency_job_id":"bdd8356a-b35f-4e3b-b767-3783e1b4ded8","html_url":"https://github.com/doyensec/PoiEx","commit_stats":null,"previous_names":["doyensec/poiex"],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/doyensec%2FPoiEx","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/doyensec%2FPoiEx/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/doyensec%2FPoiEx/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/doyensec%2FPoiEx/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/doyensec","download_url":"https://codeload.github.com/doyensec/PoiEx/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251444456,"owners_count":21590493,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["collaborative-editing","iac","security","security-tools","semgrep","vscode","vscode-extension"],"created_at":"2024-11-11T18:14:56.595Z","updated_at":"2025-04-29T05:31:23.040Z","avatar_url":"https://github.com/doyensec.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# PoiEx\n\n## What's PoiEx?\n\n**PoiEx** is an experimental VS Code extension built to identify and visualize the Points of Intersection between a web application and the underlying infrastructure.  \n\nSince it was designed to simplify manual code review activities, it was also packed with: [Semgrep](https://semgrep.dev/) support, notes taking and collaboration capabilities.\n\n\u003c/br\u003e\n\u003cp align=\"center\"\u003e\n    \u003cimg src=\"images/logo-1.png\" width=\"30%\" alt=\"PoiEx logo\"\u003e\n\u003c/p\u003e\n\u003c/br\u003e\n\nRead the launch post on the [Doyensec blog](https://blog.doyensec.com/2024/01/30/poiex-release.html) for practical examples and tips.\n\n## Try It Out!\n\nDownload and install the VSIX extension from GitHub Releases. Make sure you have [Semgrep](https://semgrep.dev/) installed before running PoiEx.\n\n## Points of Intersection Explorer\n\nA Point of Intersection (PoI) marks where your code interacts with its underlying infrastructure, revealing connections between the implemented logic and the Infrastructure as Code (IaC). PoiEx identifies and visualizes PoIs, allowing testers and cloud security specialists to better understand and identify security vulnerabilities in your cloud applications.\u003cbr\u003e\u003cbr\u003e\nThe extension relies on [Inframap](https://github.com/cycloidio/inframap/) to generate an interactive IaC diagram. Each entity in the diagram is clickable to reveal the PoIs, Semgrep results and the IaC definition, linked to the selected entity. By then clicking on a PoI, the user can jump to the relevant code section.\u003cbr\u003e\n\nBelow an example infrastructure diagram generation and PoIs exploration.\n![IaC Diagrams](images/animation-diagram.gif)\n\n**Note**: If you do not have a Terraform IaC definition file but you have access to the live infrastructure, you can use reverse-terraforming tools such as [terraformer](https://github.com/GoogleCloudPlatform/terraformer) to generate an IaC file from existing infrastructure.\u003cbr\u003e\n\n### Core Features\n\nPoiEx allows users to:\n  \n- Scan the application's code and the IaC definition at the same time with [Semgrep](https://semgrep.dev/), generating explorable results in a user-friendly view inside VS Code's Problems section\n\n- Visualize the infrastructure diagram generated with [Inframap](https://github.com/cycloidio/inframap/). Additionally, the diagram is enhanced to be interactive, each entity in the diagram is clickable and reveals the enumerated PoIs that are linked to the selected entity. By then clicking on a PoI, it jumps to the relevant code section to review the code in which it is embedded. \n  \n- Take notes using the VS Code Comments API, allowing it to be used also as a standalone code-analysis tool\n  \n- Collaborate with other reviewers on encrypted projects pushed to a [MongoDB](https://www.mongodb.com/) instance\n\n### Supported CSPs \u0026 Languages\n\nA custom set of Semgrep rules has been developed. Each pair of language and Cloud Service Provider (CSP) needs a different ruleset, as a rule is generally able to match only one language and one CSP. \n\nThe table below summarizes the currently supported CSPs and languages:\n\n| Language/CSP   | GCP | AWS |\n|-----------------|-----|-----|\n| Python          | Yes | Yes |\n| JavaScript      | Yes | Yes |\n| Go              | No  | Yes |\n| TypeScript     | No  | Yes |\n\n\n### Enhancing Reviews with PoiEx\nNon-IaC related features were added to support manual reviews in different ways. Such functionalities are unrelated to the cloud infrastructure analysis and they are usable in any code review activity.\u003cbr\u003e\nA few examples are attached below. Please refer to the  [launch blogpost](https://blog.doyensec.com/2024/01/25/poiex-release.html) for detailed use cases.\n#### 1. Standalone Semgrep Integration\nScan the application's code and the IaC definition at the same time with [Semgrep](https://semgrep.dev/), generating explorable results in a user-friendly view, inside VS Code's Problems section. The Semgrep ruleset is fully customizable via direct arguments in the Settings page.\n\nIt is also possible to flag the findings as `false positive`,`hot` or `resolved` and have them synced in collaboration mode.\n![Semgrep integration](images/feature-findings.png)\n\n#### 2. Notes Taking\nIt is possible to start comment threads directly within the codebase for adding details and reactions.\u003cbr\u003e\n\n![threadExample](images/threadExample.png)\n\nWhen collaboration mode is disabled, each project is stored in a local SQLite database. In this mode, projects are not synchronized or shared across different collaborators.\n\n#### 3. Collaboration with Peers\nPoiEx allows for real-time synchronization of findings and comments with other users. This mode requires a MongoDB instance shared across all collaborators.  Read more in the  [collaboration guide](./COLLAB_MODE.md).\n## Extension Settings\n\n* `poiex.enableIaC`: Enable IaC features of this extension \n* `poiex.authorName`: Author name for comments\n* `poiex.semgrepArgs`: Semgrep command line arguments\n* `poiex.semgrepTimeout`: Semgrep execution timeout (in seconds)\n* `poiex.collab.enabled`: Enable collaboration via MongoDB\n* `poiex.collab.uri`: URI of the remote MongoDB server\n* `poiex.collab.database`: Name of the MongoDB database\n* `poiex.collab.expireAfter`: Auto-delete comments on the remote database after a certain amount of seconds (set to 0 to disable)\n\n## Credits\n\nThis project was made with love on the [Doyensec Research Island](https://doyensec.com/research.html) by [Michele Lizzit](https://www.linkedin.com/in/michelelizzit/) for his master's thesis at ETH Zurich, under the mentoring of [Francesco Lacerenza](https://twitter.com/lacerenza_fra).\n\nWe took inspiration from [vscode-security-notes](https://github.com/RefactorSecurity/vscode-security-notes) by RefactorSecurity.\n\nDownload the latest [release](https://github.com/doyensec/PoiEx/releases) and contribute with a star, [bug reports or suggestions](https://github.com/doyensec/PoiEx/issues).\n\n\u003cimg src='images/doyensec_logo.png' height='40px' alt='Doyensec Research'\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdoyensec%2Fpoiex","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdoyensec%2Fpoiex","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdoyensec%2Fpoiex/lists"}