boman-cli 2.6.1__tar.gz → 2.6.3__tar.gz

{boman_cli-2.6.1 → boman_cli-2.6.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: boman-cli
-Version: 2.6.1
+Version: 2.6.3
 Summary: CLI tool of boman.ai
 Home-page: https://boman.ai
 Author: Sumeru Software Solutions Pvt. Ltd.
@@ -103,6 +103,12 @@ Example: boman-cli -a run -zap_session_script ./session.js
 
 # Release Notes:
 
+### 2.6.3
+- **Bug fix** - minor bug fixes
+
+### 2.6.2
+- **Updated rules** - new rules added
+
 ### 2.6.1
 - **Updated tools** - updated SAST, SCA and Secret scan tools
 

{boman_cli-2.6.1 → boman_cli-2.6.3}/README.md

@@ -81,6 +81,12 @@ Example: boman-cli -a run -zap_session_script ./session.js
 
 # Release Notes:
 
+### 2.6.3
+- **Bug fix** - minor bug fixes
+
+### 2.6.2
+- **Updated rules** - new rules added
+
 ### 2.6.1
 - **Updated tools** - updated SAST, SCA and Secret scan tools
 

{boman_cli-2.6.1 → boman_cli-2.6.3}/boman_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: boman-cli
-Version: 2.6.1
+Version: 2.6.3
 Summary: CLI tool of boman.ai
 Home-page: https://boman.ai
 Author: Sumeru Software Solutions Pvt. Ltd.
@@ -103,6 +103,12 @@ Example: boman-cli -a run -zap_session_script ./session.js
 
 # Release Notes:
 
+### 2.6.3
+- **Bug fix** - minor bug fixes
+
+### 2.6.2
+- **Updated rules** - new rules added
+
 ### 2.6.1
 - **Updated tools** - updated SAST, SCA and Secret scan tools
 

{boman_cli-2.6.1 → boman_cli-2.6.3}/boman_cli.egg-info/SOURCES.txt

@@ -17,5 +17,5 @@ bomancli/main.py
 bomancli/sbom_enricher.py
 bomancli/utils.py
 bomancli/validation.py
-bomancli/opengrep_rules/boman-malware-detection.yml
+bomancli/malware_rules/boman/js/boman-malware-detection.yml
 bomancli/templates/template_plan.yaml

{boman_cli-2.6.1 → boman_cli-2.6.3}/bomancli/Config.py

@@ -121,7 +121,7 @@ class Config:
 
     log_level = "INFO"
 
-    version = 'v2.6.1'
+    version = 'v2.6.3'
 
     boman_config_file = 'boman.yaml'
     

{boman_cli-2.6.1 → boman_cli-2.6.3}/bomancli/main.py

@@ -181,8 +181,8 @@ def runImage(data=None,type=None):
                 
                 # logging.info('Semgrep token present')
                 logging.info("copying custom opengrep rules to the build directory")
-                Utils.copy_rules_to_base_docker('opengrep_rules/boman-malware-detection.yml', Config.sast_build_dir)
-                command_line  = f"{command_line} --config auto --config /src/opengrep_rules/boman-malware-detection.yml"
+                Utils.copy_rules_to_base_docker('malware_rules', Config.sast_build_dir)
+                command_line  = f"{command_line} --config auto --config /src/malware_rules --exclude='/src/malware_rules/**' --exclude='/src/boman_opengrep.json'"
                 if Config.jenkins == 'yes':
 
                     logging.info('SAST Docker: Preparing %s scan for jenkins env with %s user ', tool_name , userid)    
@@ -200,7 +200,7 @@ def runImage(data=None,type=None):
                                 'bind': data['bind']}},user=userid,detach=detach,environment=env_var,remove=True)          
                     logging.info('SAST Docker: SUCCESS !!!. Message: %s Scan Completed',tool_name)
                 logging.info('SAST Docker: Deleting custom opengrep rules from the build directory')
-                shutil.rmtree('opengrep_rules')
+                shutil.rmtree('malware_rules')
             except errors.ContainerError as exc:
                 msg='\n The following error has been recorded while scanning SAST'
                 Utils.logError(msg,str(exc))
@@ -208,7 +208,7 @@ def runImage(data=None,type=None):
                 Config.sast_scan_status = 'Failed'
                 Config.sast_errors = f'Exit Status {exc.exit_status}:{str(exc)}]'
                 logging.info('SAST Docker: Deleting custom opengrep rules from the build directory')
-                shutil.rmtree('opengrep_rules')
+                shutil.rmtree('malware_rules')
 
 
 

boman_cli-2.6.3/bomancli/malware_rules/boman/js/boman-malware-detection.yml

@@ -0,0 +1,35 @@
+rules:
+  - id: global-require-capability-capture-obfuscation-potential-malware
+    languages: [regex]
+    severity: HIGH
+    metadata:
+      category: security
+      technique: capability-smuggling
+      confidence: HIGH
+      impact: HIGH
+    message: >
+      Obfuscated malicious code was identified within the source code repository. 
+      The code appears to have been introduced through a third-party dependency or 
+      inadvertently committed by a developer. Its presence poses a supply chain security risk 
+      and may enable unauthorized actions, data exfiltration, or compromise the integrity of 
+      the application and development environment.
+    pattern-regex: '(global(This)?)\s*(\[(?:[^\[\]]|\[[^\[\]]*\]){1,80}\]|\.[A-Za-z0-9_$]+)\s*=\s*require\b'
+
+  - id: json-file-contains-obfuscated-js-code-potential-malware
+    languages: [regex]
+    severity: HIGH
+    paths:
+      include:
+        - "*.json"
+    metadata:
+      category: security
+      technique: format-integrity
+      confidence: MEDIUM
+      impact: HIGH
+    message: >
+      Obfuscated malicious code was identified within the source code repository. 
+      The code appears to have been introduced through a third-party dependency or 
+      inadvertently committed by a developer. Its presence poses a supply chain security risk 
+      and may enable unauthorized actions, data exfiltration, or compromise the integrity of 
+      the application and development environment.
+    pattern-regex: '(?s)\A(?=.*(?:\brequire\s*\(|\bfunction\s*\(|\beval\s*\(|=>|\b(?:var|let|const)\s+\w+\s*=|;\s*$))'

{boman_cli-2.6.1 → boman_cli-2.6.3}/bomancli/utils.py

@@ -391,9 +391,9 @@ def copy_rules_to_base_docker(opengrep_rules_path, base_docker_path):
     logging.info('Copying the opengrep rules to base docker image')
     try:
         rules_path = pkg_resources.resource_filename(__name__,opengrep_rules_path)
-        os.makedirs(os.path.join(base_docker_path, opengrep_rules_path), exist_ok=True)
+        # os.makedirs(os.path.join(base_docker_path, opengrep_rules_path), exist_ok=True)
         # logging.info(rules_path, os.path.join(base_docker_path, opengrep_rules_path))
-        shutil.copy(rules_path, os.path.join(base_docker_path, opengrep_rules_path))
+        shutil.copytree(rules_path, os.path.join(base_docker_path, opengrep_rules_path))
         logging.info('Copied the opengrep rules to base docker image successfully')
     except Exception as e:
         logging.error('Error while copying the opengrep rules to base docker image: %s', e)

{boman_cli-2.6.1 → boman_cli-2.6.3}/setup.cfg

@@ -1,9 +1,9 @@
 [metadata]
 environment = prod
-version = v2.6.1
+version = 2.6.3
 name = boman-cli
 saas_base_url = 
-https = //qa.boman.ai/
+https = //dashboard.boman.ai/
 
 [egg_info]
 tag_build = 

{boman_cli-2.6.1 → boman_cli-2.6.3}/setup.py

@@ -46,7 +46,7 @@ setup(
     license='BSD 2-clause',
     entry_points = entry_points,
     packages=['bomancli'],
-    package_data={'bomancli': ['templates/template_plan.yaml', 'opengrep_rules/boman-malware-detection.yml']},
+    package_data={'bomancli': ['templates/template_plan.yaml', 'malware_rules/**/*', 'malware_rules/**/**/*']},
     install_requires=['docker<=7.0.0',
                       'requests<=2.31.0',
                       'pyyaml',

boman_cli-2.6.1/bomancli/opengrep_rules/boman-malware-detection.yml

@@ -1,36 +0,0 @@
-rules:
-  - id: boman-global-require-capability-capture-obfuscation
-    languages: [regex]
-    severity: HIGH
-    metadata:
-      category: security
-      technique: capability-smuggling
-      confidence: HIGH
-      impact: HIGH
-    message: >
-      Code stashes require/module/__dirname/__filename onto the global object
-      under a (possibly obfuscated/computed) property name -- a known technique
-      for smuggling Node.js module-loading capability into a context that
-      should not normally have it (config file, eval'd snippet, stripped
-      bundle). Seen in jsjiami/javascript-obfuscator-packed droppers.
-    pattern-regex: '(global(This)?)\s*(\[(?:[^\[\]]|\[[^\[\]]*\]){1,80}\]|\.[A-Za-z0-9_$]+)\s*=\s*require\b'
-
-  - id: boman-json-file-contains-obfuscated-js-code-tokens
-    languages: [regex]
-    severity: HIGH
-    paths:
-      include:
-        - "*.json"
-    metadata:
-      category: security
-      technique: format-integrity
-      confidence: MEDIUM
-      impact: HIGH
-    message: >
-      This .json file contains tokens that are not legal outside a JSON string
-      value (require(, function(, eval(, var/let/const declarations, =>,
-      statement-terminating semicolons). A well-formed JSON document should
-      never contain executable-looking code -- this is a strong signal that
-      non-JSON content has been appended/smuggled into a file that tooling
-      (bundlers, config loaders) treats as trusted configuration.
-    pattern-regex: '(?s)\A(?=.*(?:\brequire\s*\(|\bfunction\s*\(|\beval\s*\(|=>|\b(?:var|let|const)\s+\w+\s*=|;\s*$))'