boman-cli 2.6.5__tar.gz → 2.6.7__tar.gz

{boman_cli-2.6.5 → boman_cli-2.6.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: boman-cli
-Version: 2.6.5
+Version: 2.6.7
 Summary: CLI tool of boman.ai
 Home-page: https://boman.ai
 Author: Sumeru Software Solutions Pvt. Ltd.
@@ -103,6 +103,9 @@ Example: boman-cli -a run -zap_session_script ./session.js
 
 # Release Notes:
 
+### 2.6.6
+- **Rule Deprication** - Depricating generic rule (Trojan Horse)
+
 ### 2.6.5
 - **Minor Bug fix** - Including only verfied secrets in trufflehog
 

{boman_cli-2.6.5 → boman_cli-2.6.7}/README.md

@@ -81,6 +81,9 @@ Example: boman-cli -a run -zap_session_script ./session.js
 
 # Release Notes:
 
+### 2.6.6
+- **Rule Deprication** - Depricating generic rule (Trojan Horse)
+
 ### 2.6.5
 - **Minor Bug fix** - Including only verfied secrets in trufflehog
 

{boman_cli-2.6.5 → boman_cli-2.6.7}/boman_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: boman-cli
-Version: 2.6.5
+Version: 2.6.7
 Summary: CLI tool of boman.ai
 Home-page: https://boman.ai
 Author: Sumeru Software Solutions Pvt. Ltd.
@@ -103,6 +103,9 @@ Example: boman-cli -a run -zap_session_script ./session.js
 
 # Release Notes:
 
+### 2.6.6
+- **Rule Deprication** - Depricating generic rule (Trojan Horse)
+
 ### 2.6.5
 - **Minor Bug fix** - Including only verfied secrets in trufflehog
 

{boman_cli-2.6.5 → boman_cli-2.6.7}/boman_cli.egg-info/SOURCES.txt

@@ -40,7 +40,6 @@ bomancli/malware_rules/boman/csharp/12-insecure-deserialization.yaml
 bomancli/malware_rules/boman/generic/01-obfuscated-dynamic-exec-confusable-unicode.yaml
 bomancli/malware_rules/boman/generic/05-lifecycle-hook-abuse-composer.yaml
 bomancli/malware_rules/boman/generic/05-lifecycle-hook-abuse-npm.yaml
-bomancli/malware_rules/boman/generic/11-trojan-source.yaml
 bomancli/malware_rules/boman/generic/boman-malware-detection.yml
 bomancli/malware_rules/boman/go/01-obfuscated-dynamic-exec.yaml
 bomancli/malware_rules/boman/go/02-reverse-shell.yaml

{boman_cli-2.6.5 → boman_cli-2.6.7}/bomancli/Config.py

@@ -121,7 +121,7 @@ class Config:
 
     log_level = "INFO"
 
-    version = 'v2.6.5'
+    version = 'v2.6.7'
 
     boman_config_file = 'boman.yaml'
     
@@ -240,4 +240,8 @@ class Config:
     
     # common for trivy container and sbom scan
     set_cache_dir = False
-    cache_dir = " --cache-dir /tmp/.trivycache"
+    cache_dir = " --cache-dir /tmp/.trivycache"
+    
+    non_root_mode = False
+    home="HOME=/tmp"
+    xdg_cache_home="XDG_CACHE_HOME=/tmp/.cache"

{boman_cli-2.6.5 → boman_cli-2.6.7}/bomancli/main.py

@@ -196,8 +196,15 @@ def runImage(data=None,type=None):
 
                     logging.info('SAST Docker: Preparing %s scan for non jenkins env with %s user ', tool_name ,userid)
                     Config.build_dir = Config.sast_build_dir
-                    container_output = docker.containers.run(docker_image, command_line, volumes={Config.sast_build_dir: {
-                                'bind': data['bind']}},user=userid,detach=detach,environment=env_var,remove=True)          
+                    if Config.non_root_mode:
+                        env_var.append(Config.home)
+                        env_var.append(Config.xdg_cache_home)
+                        logging.info('SAST Docker: Non-root mode is enabled for the scans')
+                        container_output = docker.containers.run(docker_image,command_line,volumes={Config.sast_build_dir: {'bind': data['bind']}},user=userid,
+                        working_dir="/tmp",detach=detach,environment=env_var,remove=True)                        
+                    else:
+                        container_output = docker.containers.run(docker_image, command_line, volumes={Config.sast_build_dir: {
+                                    'bind': data['bind']}},user=userid,detach=detach,environment=env_var,remove=True)          
                     logging.info('SAST Docker: SUCCESS !!!. Message: %s Scan Completed',tool_name)
                 logging.info('SAST Docker: Deleting custom opengrep rules from the build directory')
                 shutil.rmtree('malware_rules')
@@ -1301,6 +1308,7 @@ def default():
     parser.add_argument('-pot','--pollTime',default=100,help="Polling Time. Min : 30s, Max: 5min, Default : 1min. Format: input the time in seconds eg: 1min => 60 ")
     parser.add_argument('-pof','--pollFrequency',default=10,help="Polling Frequency. Min : 5s, Max: 1min, Default : 10s. Format: input the time in seconds eg: 1min => 60 ")
     parser.add_argument('-std','--setCacheDir',default=False,help="Set the cache directory for the scan. Set true if you use jenkins cicd")
+    parser.add_argument('-nrm','--nonRootMode',default=False,help="Set the non-root mode for the scan. Set true if you use jenkins cicd")
     args = parser.parse_args()
 
     # if len(sys.args) == 1:
@@ -1328,6 +1336,11 @@ def default():
     else:
         Config.set_cache_dir = False
 
+    if args.nonRootMode:
+        Config.non_root_mode = True
+    else:
+        Config.non_root_mode = False
+
     # lingu user id set
     if args.semgrepToken == 'No':
         ##logging.info('jenkins is choosen')

{boman_cli-2.6.5 → boman_cli-2.6.7}/setup.cfg

@@ -1,6 +1,6 @@
 [metadata]
 environment = prod
-version = 2.6.5
+version = 2.6.7
 name = boman-cli
 saas_base_url = 
 https = //dashboard.boman.ai/

boman_cli-2.6.5/bomancli/malware_rules/boman/generic/11-trojan-source.yaml

@@ -1,33 +0,0 @@
-rules:
-  - id: generic-trojan-source-bidi-control-chars
-    languages: [generic]
-    severity: ERROR
-    message: >
-      Unicode bidirectional-control or zero-width character found in source.
-      These characters can make code render differently than it executes
-      (Trojan Source, CVE-2021-42574) or hide invisible logic/homoglyphs from
-      reviewers. Legitimate source code almost never needs these characters.
-    metadata:
-      category: security
-      subcategory: [malware]
-      family: trojan-source
-      mitre-attack: [T1036]
-      confidence: HIGH
-      impact: HIGH
-      references:
-        - https://trojansource.codes/
-        - https://nvd.nist.gov/vuln/detail/CVE-2021-42574
-      remediation: >
-        Remove the invisible/bidi-control character. If it was introduced by
-        a copy-pasted snippet, re-type the affected line from a trusted
-        source instead of just deleting the character, since more may be
-        hidden nearby.
-    # NOTE: U+FEFF (BOM / zero-width no-break space) was deliberately removed
-    # from this class -- a leading byte-order-mark is mundane encoding
-    # metadata added by many editors/tools, not a Trojan-Source attack, and
-    # including it produced real false positives on ordinary BOM-prefixed
-    # files in this repo's own clean-corpus validation (this engine's regex
-    # has no reliable lookbehind to special-case "only when not at offset
-    # 0"). The remaining bidi-override and zero-width-joiner characters have
-    # no legitimate use and are a strong enough signal on their own.
-    pattern-regex: '[\x{200B}-\x{200D}\x{2060}\x{202A}-\x{202E}\x{2066}-\x{2069}\x{061C}]'