supplier-meesho.webflow 1.0.0

package/meesecops/config.py

@@ -0,0 +1,206 @@
+import os
+
+basedir = os.path.abspath(os.path.dirname(__file__))
+
+
+class Config(object):
+
+    DOMAIN = 'https://secops.meesho.com/'
+
+    #-------domain settings---------#
+    HTTPS_PORT = 443
+    HTTP_PORT = 80
+    INTERFACE = '0.0.0.0'
+
+    SSL_CERTFILE = 'ssl/server.crt'
+    SSL_KEYFILE = 'ssl/server.key'
+    
+    #-------domain settings---------#
+
+
+    #-----application settings------#
+    SECRET_KEY = 'sfGROg5nBwBZGzW49U3wN6miM'
+    DEBUG = True
+    ACCESS_LOGFILE_NAME = 'logs/access_log'
+    ERROR_LOGFILE_NAME = 'logs/error_log'
+    UPLOAD_FOLDER = 'uploads'
+    DEFAULT_FOLDER = 'static/default'
+    #-----application settings------#
+
+    #-------oauth settings---------#
+    OAUTH_CLIENT = 'google'
+
+    GOOGLE_CLIENT_ID = '808541240444-mslmfmk38llifs65pqhqis0vahodn3s9.apps.googleusercontent.com'
+    GOOGLE_CLIENT_SECRET = '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'
+    
+    REDIRECT_URI = '/oauth2callback'  # one of the Redirect URIs from Google APIs console
+
+    BASE_URL='https://www.google.com/accounts/'
+    AUTHORIZE_URL='https://accounts.google.com/o/oauth2/auth'
+    REQUEST_TOKEN_URL=None
+    REQUEST_TOKEN_PARAMS={'scope': 'https://www.googleapis.com/auth/userinfo.email',
+                        'response_type': 'code'}
+    ACCESS_TOKEN_URL='https://accounts.google.com/o/oauth2/token'
+    ACCESS_TOKEN_METHOD='POST'
+    ACCESS_TOKEN_PARAMS={'grant_type': 'authorization_code'}
+    #-------oauth settings---------#
+
+    #-------other settings---------#
+    ALLOWED_DOMAINS = ['meesho.com']
+    SECURITY_EMAIL = 'sec-eng@meesho.com'
+    APPSEC_USERS = REVIEW_APPROVERS = [
+        'ritish.kumar@meesho.com',
+        'gobind.singh@meesho.com', 
+        'aradhna.bhatia@meesho.com',
+        'abhinav.gupta@meesho.com',
+        'atul.jaiswal@meesho.com',
+        'malkit.singh@meesho.com',
+        'navdeep.singh@meesho.com',
+        'pankaj.badera@meesho.com',
+        'rakesh.paruchuri@meesho.com',
+        'siddharth.rajput@meesho.com',
+        'sourav.sahana@meesho.com',
+        'utkarsh.tiwari@meesho.com',
+        'vishal.jain@meesho.com',
+        'yash.anand@meesho.com'
+    ]
+    DEFAULT_DOMAIN = "meesho.com"
+    DEFAULT_USER = "ritish.kumar@meesho.com" #must be a valid JIRA user.
+    PEER_REVIEW_ENABLED = False
+    PEER_REVIEW_REQUIRED_FOR = []
+    #-------other settings---------#
+
+
+    #-external page links settings-#
+    SEC_KB_LINK = "https://meesho.atlassian.net/wiki/spaces/SEC/overview"
+    APPSEC_TEAM_LINK = "https://meesho.slack.com/archives/C02DWH0BHGU"
+    VRM_POLICY_LINK = "https://meesho.atlassian.net/wiki/spaces/SEC/pages/2145648661/Third+Party+Vendor+Assessment"
+    SEC_AWARENESS_LINK = "https://meesho.atlassian.net/wiki/spaces/SEC/pages/2269053062/Tech+Talks+by+Security+Team"
+    INFOSEC_POLICY_LINK = "https://meesho.atlassian.net/wiki/spaces/SEC/pages/2098397342/Security+Review+Process"
+    
+    #-external page links settings-#
+
+
+    #-------JIRA settings----------#
+    JIRA_SETTINGS = {
+
+        "JIRA_URL" : "https://meesho.atlassian.net/",
+        "JIRA_USER" : "ritish.kumar@meesho.com",
+        "JIRA_PASS" : "yQNpTWcStxM07t6JO0TH3777",
+        "JIRA_PROJECT" : "SECREV",
+        "DEFAULT_SEVERITY" : "Major",
+
+        "JIRA_TRANSITIONS" : [
+            { # action ids with out peer review
+                "TODO_TRANS" : 21, # move to To do from backlog action
+                "SEND_FOR_REVIEW_TRANS" : None, # This should always be none
+                "APPROVE_TRANS" : 71, #Resolve action
+                "CLOSED_TRANS" : 61, # close or reject action
+                "PENDING_REJECTED":51,
+                "BACKLOG_REJECTED":101,
+                "OPEN_REJECTED":31
+            },
+            { # action ids with peer review
+                "TODO_TRANS" : 51, # move to To do from backlog action
+                "SEND_FOR_REVIEW_TRANS" : 51, # Send for review action
+                "REJECT_APPROVAL" : 61, # reject review action
+                "APPROVE_TRANS" : 71, # approve action
+                "CLOSED_TRANS" : 61, # close or reject action
+                "PENDING_REJECTED":51,
+                "BACKLOG_REJECTED":101,
+                "OPEN_REJECTED":31
+            }
+        ],
+        "JIRA_COMPONENTS" : {
+            "SECURITY_REVIEW" : "Security Review",
+            "SECURITY_BUG" : "Security Bug"
+        },
+
+        "JIRA_FILTERS" : {
+            "open_secreviews" : 10360,
+            "open_secbugs" : 10382,
+            "open_secreviews_2_weeks" : 10365,
+            "open_secreviews_by_me" : 10364,
+            "open_tickets" : 10356,
+            "total_secreviews" : 10361,
+            "total_secbugs" : 10381,
+            "total_secreviews_2_weeks" : 10366,
+
+            "total_demandorg": 10396,
+            "open_demandorg": 10397,
+            "total_supplyorg": 10399,
+            "open_supplyorg": 10398,
+            "total_devsecops": 10400,
+            "open_devsecops": 10401,
+            "total_misc": 10403,
+            "open_misc": 10402
+        },
+
+        "STATUS_N_SEVERITY" : {
+            "by_status" : ["Open","In Progress","Re-Validation","Done","Reopened", "Pending", "Backlog", "Rejected"],
+            "by_severity" : ["Critical", "Blocker","Major","Minor", "High","Medium","Low","Informational"],
+            "by_age":["0-10 Days","10-20 Days","20-30 Days",">30 Days"],
+            "by_severity_secreviews" : ["Critical", "Blocker","Major","Minor"]
+        },
+
+        "STATUS_CODES" : {
+            "Done":"green",  
+            "Rejected" : "red",
+            "In Progress":"yellow", 
+            "Pending":"orange",  
+            "Open":"blue",
+            "Backlog":"purple",
+
+            "Re-Validation":"orange",
+            "Reopened":"red",
+
+            "Critical":"red",
+            "Major":"yellow",
+            "Blocker":"orange",
+            "Minor":"purple",
+
+            "High":"orange",
+            "Medium":"yellow",
+            "Low":"green",
+            "Informational":"blue",
+
+            "0-10 Days":"blue",
+            "10-20 Days":"yellow",
+            "20-30 Days":"orange",
+            ">30 Days":"red"
+        },
+
+        "COLOR_CODES" : {
+            "BACKGROUND" : {
+                "red" : 'rgba(202, 11, 0, 1)',
+                "green" : 'rgba(107, 142, 35, 1)',
+                "yellow" : 'rgba(255, 165, 0, 1)',
+                "orange" : 'rgba(255, 69, 0, 1)',
+                "purple" : 'rgba(177, 163, 199, 1)',
+                "blue" : 'rgba(154,225,253, 1)'
+            },
+            "BORDER" : {
+                "red" : 'rgba(202, 11, 0, 1)',
+                "green" : 'rgba(107, 142, 35, 1)',
+                "yellow" : 'rgba(255, 165, 0, 1)',
+                "orange" : 'rgba(255, 69, 0, 1)',
+                "purple" : 'rgba(177, 163, 199, 1)',
+                "blue" : 'rgba(154,225,253, 1)'
+            }
+        }
+    }
+
+    #-------allowed domains settings---------#    
+
+
+
+class ProductionConfig(Config):
+    DEBUG = False
+
+
+class DevelopmentConfig(Config):
+    DEBUG = True
+
+
+class TestingConfig(Config):
+    TESTING = True

package/meesecops/logs/README.txt

@@ -0,0 +1 @@
+Access and Error Logs will come here

package/meesecops/requirements.txt

@@ -0,0 +1,32 @@
+certifi==2020.6.20
+cffi==1.14.0
+chardet==3.0.4
+click==7.1.2
+cryptography>=3.2
+defusedxml==0.6.0
+enum34==1.1.10
+Flask==1.1.2
+Flask-OAuth==0.12
+gevent==20.6.2
+greenlet==0.4.16
+httplib2>=0.19.0
+idna==2.10
+ipaddress==1.0.23
+itsdangerous==1.1.0
+Jinja2>=2.11.3
+jira==2.0.0
+MarkupSafe==1.1.1
+oauth2==1.9.0.post1
+oauthlib==3.1.0
+pbr==5.4.5
+pycparser==2.20
+PyJWT==1.7.1
+requests==2.27.1
+requests-oauthlib==1.3.0
+requests-toolbelt==0.9.1
+six==1.15.0
+urllib3==1.26.8
+Werkzeug==0.16.1
+zope.event==4.4
+zope.interface==5.1.0
+Flask-Caching==1.7.2

package/meesecops/run.py

@@ -0,0 +1,100 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+from application import app
+
+import gevent
+import gevent.monkey
+from gevent.pywsgi import WSGIServer
+
+import threading
+import time
+import requests
+
+from datetime import date
+
+gevent.monkey.patch_all()
+
+def refresh_cache():
+    url = app.config['DOMAIN']
+    requests.get(url+'ticket_states/')
+    while True:
+        requests.get(url+'get_tickets/total_secbugs?&review_or_bug=secbugs')
+        requests.get(url+'get_tickets/open_secbugs?&review_or_bug=secbugs')
+        requests.get(url+'get_tickets/total_secbugs?&since=-7d&review_or_bug=secbugs')
+        requests.get(url+'get_tickets/open_secbugs?&since=-7d&review_or_bug=secbugs')
+        requests.get(url+'get_tickets/total_demandorg?&review_or_bug=demandorg')
+        requests.get(url+'get_tickets/open_demandorg?&review_or_bug=demandorg')
+        requests.get(url+'get_tickets/total_supplyorg?&review_or_bug=supplyorg')
+        requests.get(url+'get_tickets/open_supplyorg?&review_or_bug=supplyorg')
+        requests.get(url+'get_tickets/total_devsecops?&review_or_bug=devsecops')
+        requests.get(url+'get_tickets/open_devsecops?&review_or_bug=devsecops')
+        requests.get(url+'get_tickets/total_misc?&review_or_bug=misc')
+        requests.get(url+'get_tickets/open_misc?&review_or_bug=misc')
+        time.sleep(290)
+
+current_year = date.today().year
+previous_year = current_year-1
+
+def refresh_quarterly_stats():
+    url = app.config['DOMAIN']
+    requests.get(url+'ticket_states/')
+    while True:
+        requests.get(url+'get_quarterly_tickets/total_secbugs?&year='+str(current_year)+'&quarter=Q1')
+        requests.get(url+'get_quarterly_tickets/open_secbugs?&year='+str(current_year)+'&quarter=Q1')
+        requests.get(url+'get_quarterly_tickets/total_secbugs?&year='+str(previous_year)+'&quarter=Q1')
+        requests.get(url+'get_quarterly_tickets/open_secbugs?&year='+str(previous_year)+'&quarter=Q1')
+        time.sleep(295)
+
+# ------- PRODUCTION CONFIG -------
+if __name__ == '__main__':
+
+    thread1= threading.Thread(target=refresh_cache)
+    thread1.setDaemon(True)
+
+    thread2= threading.Thread(target=refresh_quarterly_stats)
+    thread2.setDaemon(True)
+
+    thread1.start()
+    thread2.start()
+    
+    try:
+
+        INTERFACE = app.config['INTERFACE']
+        
+        # ----------------- For HTTPS -------------------#
+        # HTTPS_PORT = app.config['HTTPS_PORT']
+        # SSL_CERTFILE = app.config['SSL_CERTFILE']
+        # SSL_KEYFILE = app.config['SSL_KEYFILE']
+
+        # server = WSGIServer((INTERFACE, HTTPS_PORT), app, certfile=SSL_CERTFILE, keyfile=SSL_KEYFILE,log=app.logger)
+        # if server:
+        #     print "Server Started on: https://"+str(INTERFACE)+":"+str(HTTPS_PORT)+"/"
+
+    
+        # ---------------- For HTTP Only ----------------#
+        HTTP_PORT = app.config['HTTP_PORT']
+        server = WSGIServer((INTERFACE, HTTP_PORT), app,log=app.logger)
+
+        if server:
+            print "Server Started on: http://"+str(INTERFACE)+":"+str(HTTP_PORT)+"/"
+
+        
+        # -------Common for both HTTP and HTTPS----------#
+        server.serve_forever()
+
+
+    except KeyboardInterrupt:
+        print "\nUser Abort Identified. Good Bye\n"
+
+# ------- DEVELOPMENT CONFIG -------
+# if __name__ == "__main__":
+#     INTERFACE = app.config['INTERFACE']
+#     PORT = app.config['HTTP_PORT']
+#     DEBUG = app.config['DEBUG']
+    
+#     app.run(host=INTERFACE,port=PORT,debug=DEBUG)
+
+
+
+

package/meesecops/ssl/README.txt

@@ -0,0 +1 @@
+copy your ssl certificates here

package/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "supplier-meesho.webflow",
+  "version": "1.0.0",
+  "description": "Test by Security",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "author": "",
+  "license": "ISC"
+}

package/prod.pem

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAxtZWFECRxonF25Ug2x56NBA3b0WAZqNyxanlPL11VrlNPvmC
+AizzYXr5GVRdu7e3f24r7ZqoBRCJpodbOp6Mdx58aXY9HXDU4znwK6urwYG5R+6X
+12UuVtQO49KICVsr+eMwSy0Pc1Fu7YXHdGEG0JgCmTZpRoMWKPiwsJ2Dp7wC7SSA
+Vz4h0hUNNDXpoGQNyUjUHh58EwSEoPoSsK7HLusBoU90EISo1HFbxNFiQ4bzL4vN
+jMy630+b3ZJDXc6DUHQgS9UM/BOHEnDPTb9qV0x5gGIueQZ0tZTMugQyKn5vlRvY
+LveaUnoKTSE8HWHeOnVoa8Wm5coykrar3SDxewIDAQABAoIBAQCr7dFomZxzK9Yl
+1IEgdu377rnAQTyRg2tOd2V8a+X2Iywj8+LytqOL+qVBva1/D5BfY4ggX8ZA+tfL
+YucDfOzAY1/4YQDfYBz0jbiaSkqte9oV1Lz+xsKW2a42WGjAjlEsNcIgfsoJULS2
+NSMOAoe9/nLgwCevjNGwg7lkPg8FDQpl+pl/YOetZkd5FO8XaWQpoXHzDIsUB5H6
+blE/7DgUncbc9BrPhQatZUg9P08Bm1YEQPwH6fu7CLA5sxCk6TPDKn6VgAhzUH8L
+PUYmvrPd0CycTLLQCOYdGK/ko1wJgLsbMo43fzNPJzWPCS8P7we3KlqDj39ipNjL
+GXstUtoBAoGBAOz53yuOVHmOqseyJC6behzoIhy8wTuNSPqbUT2pQMZ2JJB90rzd
+xwepJdm3O6HbRhmUF51v8/JLaqFd4PskJhT+Zcql3tUXQfqCLyzE2fr7nFbs+W43
+DxGmFnYg9WstOP0Mj/9VJH6gNNQ+gAlCgCN0PsMVdA48YotA+thiW3XBAoGBANbM
+qx9uyTUgv2oH4IGy9qVsRCLuhGHlOK8ccdP4iIMA/kNWJHrmV0COGlBLYxBKkk/g
+2QlGna13xn9boK7hxj5g9CSbG51g+W/1qioddxrXd+0IIvMxtFriQFEnHFOuAxdM
+JfYLAVZJitmwvifYYO1THYCup5jVMBcjPzjXLE47AoGAaevB2akTjwW6xemVDJQH
+/9WuMaQYxrJ+9SzpIiN9xXdXHpJu2GZUqNLtDSQ+bjkhWxt7dq5snlchQSFCB17/
++pA/FVYQhLSRlBQOW/dc6zb9iUkAsEfB34SaM5DFwXMELu8nidwXpNWc52VMO1dT
+CQXTa8UyC47oCRAxTvifosECgYBgQFBCAovI8ca0RZlVpRMe51fU61qI34U5+p4L
+JShOw8gr9lLce5EHjWW/KzjV2QSdJJ08qdcIH07kTPPAyczisOFV8ec663R6tfOt
+cYyoi3rizS2UGma9/vphIwxvdt9NtkKgcSgFOWktySQ8iJpOXlsvCZRySL2G8LVo
+zAq/dwKBgQDlB0+QkliOIIJibqjhyaX2/9gmJK3ULgDWYJmujzgJS8Vq54Jk5sbt
+NOaB9febsPy7CoeeCpznqtRvp4PeowVtV43OwQN0LviTUxvTdtXomII6oyuDpnS1
+Lio24GSzkfrBLxZ28Z6VlVewcG2ZaFuv6sEChcg+lOpe7GCe/dgoAA==
+-----END RSA PRIVATE KEY-----

package/test1.py

@@ -0,0 +1,133 @@
+import requests
+import json
+import ast 
+from jira import JIRA
+from datetime import datetime, timedelta
+
+"""
+JIRA_SETTINGS = {
+    "JIRA_TRANSITIONS" :
+            { # action ids with out peer review
+                "TODO_TRANS" : 6, # move to To do from backlog action
+                "SEND_FOR_REVIEW_TRANS" : None, # This should always be none
+                "APPROVE_TRANS" : 5, #Resolve action
+                "CLOSED_TRANS" : 2 # close or reject action,
+            }
+}
+JIRA_OPTIONS = {'server': "https://secops420.atlassian.net/",'verify':True}
+
+jira = JIRA(JIRA_OPTIONS, basic_auth=("cemep84019@showbaz.com","200iCmB6BjaxxACjuVKO4C4B"))
+
+JIRA_TRANSITIONS = JIRA_SETTINGS['JIRA_TRANSITIONS']
+
+def resolve_or_close_jira(jira,JIRA_TRANSITIONS,status,key,comments,action=None,approver=None):
+    
+    if not action:
+        return [False, "Action parameter missing"]
+
+    if status == "Open" and action=="Approve":
+        return [False, "Issue is in Open Status"]
+
+    
+    if action == "Approve":
+        transaction_id = JIRA_TRANSITIONS['APPROVE_TRANS']
+        fields = {'resolution':{'name': 'Done'}}
+    
+
+    if action == "Reject":
+        fields = {'resolution':{'name': 'Won\'t Do'}}
+        transaction_id = JIRA_TRANSITIONS['CLOSED_TRANS']
+
+        if status == "Under review":
+            transaction_id = JIRA_TRANSITIONS['REJECT_APPROVAL']
+            fields = None
+
+    if action == "Send for Review":
+        transaction_id = JIRA_TRANSITIONS['SEND_FOR_REVIEW_TRANS']
+        fields = None
+
+
+    try:
+        result = jira.transition_issue(key,transaction_id, fields=fields, comment=comments)
+        msg = None
+        if approver:
+            try:
+                jira.assign_issue(key,approver)
+            except Exception as ae:
+                app.logger.warning(str(ae.text))
+                msg = str(ae.text)
+                return [False, msg]
+
+        return [True,msg]
+
+    except Exception as ae:
+        msg = str(ae.text)
+        return [False, msg]
+
+    return [None,msg]
+
+print(resolve_or_close_jira(jira,JIRA_TRANSITIONS,"Open","SC-16","ABC","Reject",approver=None))
+"""
+
+
+"""
+url = "https://secops420.atlassian.net/rest/api/latest/user/search?query=cemep84019@showbaz.com"
+result = requests.get(url,auth=("cemep84019@showbaz.com","200iCmB6BjaxxACjuVKO4C4B"))
+#n=ast.literal_eval(result.text[1:-1])
+#print(n['accountId'])
+x=json.loads(result.text)[0]['accountId']
+print(x)
+"""
+
+"""
+def test():
+    temp_url = "https://portswigger.net/daily-swig/"
+
+    url=temp_url+"data?label=vulnerabilities"
+
+    headers={
+        "Accept": "application/json",
+        "Content-Type": "application/json"
+    }
+
+    duedate = 21
+    duedate = datetime.now() + timedelta(duedate)
+    payload=json.dumps(
+        {
+        "fields": {
+        "project": {
+            "key": "SECREV"
+        }, 
+        "summary": "Test",
+        "description": "Test", 
+        "issuetype": {
+            "name": "Task"
+        },
+        "components":[{
+            "name": "Security Review"
+        }],
+        "priority":{
+            "name": "Major"
+        }
+    }
+    }
+    )
+
+    result = requests.get(url)
+    return json.loads(result.text)
+
+x=test()
+y = x["ResultSet"]["Results"][0]["altText2"]
+print(y)
+"""
+
+JIRA_OPTIONS = {'server': "https://meesho.atlassian.net/",'verify':True}
+
+jira = JIRA(JIRA_OPTIONS, basic_auth=("ritish.kumar@meesho.com","yQNpTWcStxM07t6JO0TH3777"))
+
+
+issue = jira.issue('SECREV-132')
+due_date = (issue.fields.created)[:10]
+due_date = datetime.strptime(due_date, '%Y-%m-%d')
+due_days = str((datetime.now() - due_date).days)
+print(due_days)