Use Assess CLI with Go agents
Use this procedure if you are using Contrast Go agents and want to find vulnerabilities while running API or end-to-end testing.
Running an application with the Go agent is different than most other Contrast agents. The Go agent is injected into the application’s source code at compile time.
Before you begin
You can use the Contrast Go Test Bench application to test the Assess CLI. For details about using this test application, go to the Contrast CodeSec website.
Verify your application can use the Assess CLI by checking the Go supported technologies.
Steps
Open a terminal window and install the Contrast Go agent in your environment (version 1.19 minimum),
Important
Do not create a configuration (YAML) file for the agent. The Assess CLI creates this file automatically.
Verify that the compiler is installed using this command:
go version go version go1.19.1 darwin/arm6
Install, compile, and run your application.
To verify that the application is running without Contrast implementation, open a browser and navigate to the application. Enter
CTRL-C
to stop the application.For example, if you are using the Contrast Go Test Bench application, you would navigate to
localhost:8080
.Enter the Assess CLI command:
contrast assess
This command generates the agent configuration file that the Contrast CLI and the agent share. CLI commands describes the options for this command, including the path for the configuration file.
You see output similar to this:
✔Configuration file found at "user_path"
⠼ Waiting for the session to be created.
In your IDE or in a second terminal window, compile and run your application, which is now instrumented with the Contrast Go agent.
For example: if you are using the Contrast Go Test Bench application, the commands would look like this:
go-test-bench on main [!?] via 🐹 v1.19.1 took 1h52m1s ❯ contrast-go run ./cmd/gin/app.go
Open a third terminal window and exercise your application, either interactively or using automated API or end-to-end tests.
For example, if you are using the Contrast Go Test Bench application, the commands would look like this:
go-test-bench on main [!?] via 🐹 v1.19.1 took 4s ❯ go run ./cmd/exercise
In the first terminal window that you opened, view the results.