Sharang ParnerkarandClaude Opus 4.8
1a8a6e5149
Onboard a PLC/SPS target with a git repo (or source archive) of exported control logic and get the same results as an upload — the natural way CODESYS projects are version-controlled, so each scan is a git pull rather than a blob re-upload. - scan_matrix: the PLC control-logic requirement is satisfied by a PlcProject *or* a code artifact (git repo / source archive). - plan: resolve_artifact binds the PLC scan to the PlcProject if present, else the code artifact. - orchestrator: a PLC/SPS target routes to the control-logic scanner over the clone (not the SAST/semgrep pipeline), then still runs DAST for a reachable device. - plc::sbom::collect_sbom: the control-app SBOM now also comes from any `.projectarchive` committed inside the working tree (a git repo / extracted archive), in addition to an uploaded archive. Docs: new guide page "PLC / SPS (CODESYS)" documenting the best-case git repo layout (commit PLCopen XML exports for SAST + the .projectarchive for the SBOM; don't commit only the binary .project). UI: onboarding wizard shows the same guidance for PLC/SPS targets. Implements the git-ingest follow-up from #166 / #165. Tracker #167. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
3.6 KiB
PLC / SPS Projects (CODESYS)
Certifai analyzes industrial control logic (IEC 61131-3) for PLC/SPS targets such as CODESYS projects. A single PLC/SPS target is treated as a composite device: the control application and the device it runs on.
| What you provide | What Certifai does |
|---|---|
PLC project (PLCopen XML / ST, or a .projectarchive) |
Control-logic SAST — semantic security rules over ST and graphical FBD/LD |
A .projectarchive |
Control-app SBOM — the referenced CODESYS libraries + the runtime version, matched against known CVEs |
| A device firmware image | Firmware SBOM / CVE (opt-in) |
| A reachable endpoint (WebVisu, OPC UA) | DAST / pentest (opt-in) |
Two ways to deliver the project
You can either upload the project when onboarding, or point Certifai at a
git repository (recommended — every scan is just a git pull, no re-upload).
Option A — Upload
On the onboarding wizard, choose target type PLC / SPS, then attach a PLC project artifact and pick its format:
- PLCopen XML (
.xml) — export from CODESYS via Project → Export PLCopenXML. - Structured Text (
.st) — a raw ST file. - Project archive (
.projectarchive) — File → Project Archive → Save/Send Archive… with "Referenced libraries" ticked. This is the only form that also yields the library + runtime SBOM.
Option B — Git repository (recommended)
Attach a Git repository artifact to the PLC/SPS target. Certifai clones it and runs the control-logic scan over the exported source in the repo.
Best-case git repository layout
Because the binary .project does not diff or merge in git, commit textual
exports for review-friendly SAST, and include the .projectarchive so the
library/runtime SBOM is available too:
my-plc-project/
├── src/
│ ├── PLC_PRG.xml # PLCopen XML export (ST or FBD/LD) — one per POU
│ ├── PumpController.xml
│ ├── SafetyInterlock.xml
│ └── GVL.xml # global variable lists, also as PLCopen XML
├── PumpStation.projectarchive # optional but recommended → library + runtime SBOM
└── README.md
Guidelines
- Export to PLCopen XML (
Project → Export PLCopenXML), one file per POU, and commit those. ST, and graphical FBD/LD, are both analyzed. - Alternatively commit raw
.st/.exp/.sclfiles — also analyzed. - Do not commit only the binary
.project— it cannot be parsed (and does not diff). If you want the library SBOM, commit the.projectarchiveas well. - CODESYS's built-in Git integration, which stores an exported representation, works too — as long as the committed form is PLCopen XML / textual.
::: tip What unlocks what
- Control-logic SAST needs textual source in the repo (PLCopen XML or
.st). - Library + runtime SBOM needs a
.projectarchive— PLCopen XML exports do not carry the referenced libraries. :::
What the scanner finds
The control-logic rules are CWE-mapped and include: hardcoded credentials (CWE-798), default/weak passwords (CWE-1393), safety interlock / watchdog bypass (CWE-1384), unchecked array indexing (CWE-129), division-by-zero (CWE-369, guard-aware), cleartext/insecure communication (CWE-319), insecure protocol ports (CWE-319, e.g. Modbus 502, FTP 21, Telnet 23), and unstructured jumps (CWE-691).
The SBOM view lists the CODESYS libraries (pkg:codesys/<name>@<version>) and
the runtime; matching runtime components (e.g. the Cmp* / 3SLicense libraries)
surface real CODESYS advisories as CVE alerts.