contentctl 5.3.0__tar.gz → 5.3.2__tar.gz

{contentctl-5.3.0 → contentctl-5.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: contentctl
-Version: 5.3.0
+Version: 5.3.2
 Summary: Splunk Content Control Tool
 License: Apache 2.0
 Author: STRT

{contentctl-5.3.0 → contentctl-5.3.2}/contentctl/actions/detection_testing/GitService.py

@@ -14,7 +14,7 @@ from contentctl.input.director import DirectorOutputDto
 from contentctl.objects.config import All, Changes, Selected, test_common
 from contentctl.objects.data_source import DataSource
 from contentctl.objects.detection import Detection
-from contentctl.objects.lookup import CSVLookup, Lookup
+from contentctl.objects.lookup import CSVLookup, Lookup, RuntimeCSV
 from contentctl.objects.macro import Macro
 from contentctl.objects.security_content_object import SecurityContentObject
 
@@ -148,6 +148,9 @@ class GitService(BaseModel):
                             matched = list(
                                 filter(
                                     lambda x: isinstance(x, CSVLookup)
+                                    and not isinstance(
+                                        x, RuntimeCSV
+                                    )  # RuntimeCSV is not used directly by any content
                                     and x.filename == decoded_path,
                                     self.director.lookups,
                                 )

{contentctl-5.3.0 → contentctl-5.3.2}/contentctl/actions/inspect.py

@@ -16,6 +16,7 @@ from contentctl.objects.errors import (
     DetectionMissingError,
     MetadataValidationError,
     VersionBumpingError,
+    VersionBumpingTooFarError,
     VersionDecrementedError,
 )
 from contentctl.objects.savedsearches_conf import SavedsearchesConf
@@ -101,7 +102,7 @@ class Inspect:
             -F "app_package=@<PATH/APP-PACKAGE>" \
             -F "included_tags=cloud" \
             --url "https://appinspect.splunk.com/v1/app/validate"
-        
+
         This is confirmed by the great resource:
         https://curlconverter.com/
         """
@@ -429,6 +430,19 @@ class Inspect:
                     )
                 )
 
+            # Versions should never increase more than one version between releases
+            if (
+                current_stanza.metadata.detection_version
+                > previous_stanza.metadata.detection_version + 1
+            ):
+                validation_errors[rule_name].append(
+                    VersionBumpingTooFarError(
+                        rule_name=rule_name,
+                        current_version=current_stanza.metadata.detection_version,
+                        previous_version=previous_stanza.metadata.detection_version,
+                    )
+                )
+
         # Convert our dict mapping to a flat list of errors for use in reporting
         validation_error_list = [
             x for inner_list in validation_errors.values() for x in inner_list

{contentctl-5.3.0 → contentctl-5.3.2}/contentctl/actions/validate.py

@@ -54,7 +54,7 @@ class Validate:
         """
         lookupsDirectory = repo_path / "lookups"
 
-        # Get all of the files referneced by Lookups
+        # Get all of the files referenced by Lookups
         usedLookupFiles: list[pathlib.Path] = [
             lookup.filename
             for lookup in director_output_dto.lookups

{contentctl-5.3.0 → contentctl-5.3.2}/contentctl/objects/abstract_security_content_objects/detection_abstract.py

@@ -547,7 +547,7 @@ class Detection_Abstract(SecurityContentObject):
                     {
                         "name": lookup.name,
                         "description": lookup.description,
-                        "filename": lookup.filename.name,
+                        "filename": lookup.filename.name,  # This does not cause an issue for RuntimeCSV type because they are not used by any detections
                         "default_match": lookup.default_match,
                         "case_sensitive_match": "true"
                         if lookup.case_sensitive_match

{contentctl-5.3.0 → contentctl-5.3.2}/contentctl/objects/errors.py

@@ -185,7 +185,7 @@ class VersionBumpingError(VersioningError):
         return (
             f"Rule '{self.rule_name}' has changed in current build compared to previous "
             "build (stanza hashes differ); the detection version should be bumped "
-            f"to at least {self.previous_version + 1}."
+            f"to {self.previous_version + 1}."
         )
 
     @property
@@ -194,4 +194,30 @@ class VersionBumpingError(VersioningError):
         A short-form error message
         :returns: a str, the message
         """
-        return f"Detection version in current build should be bumped to at least {self.previous_version + 1}."
+        return f"Detection version in current build should be bumped to {self.previous_version + 1}."
+
+
+class VersionBumpingTooFarError(VersioningError):
+    """
+    An error indicating the detection changed but its version was bumped too far
+    """
+
+    @property
+    def long_message(self) -> str:
+        """
+        A long-form error message
+        :returns: a str, the message
+        """
+        return (
+            f"Rule '{self.rule_name}' has changed in current build compared to previous "
+            "build (stanza hashes differ); however the detection version increased too much"
+            f"The version should be reduced to {self.previous_version + 1}."
+        )
+
+    @property
+    def short_message(self) -> str:
+        """
+        A short-form error message
+        :returns: a str, the message
+        """
+        return f"Detection version in current build should be reduced to {self.previous_version + 1}."

{contentctl-5.3.0 → contentctl-5.3.2}/contentctl/objects/lookup.py

@@ -257,7 +257,7 @@ class CSVLookup(FileBackedLookup):
         """
         if self.file_path is None:
             raise ValueError(
-                f"Cannot get the filename of the lookup {self.lookup_type} because the YML file_path attribute is None"
+                f"Cannot get the filename of the lookup {self.lookup_type} for content [{self.name}] because the YML file_path attribute is None"
             )  # type: ignore
 
         csv_file = self.file_path.parent / f"{self.file_path.stem}.{self.lookup_type}"  # type: ignore

{contentctl-5.3.0 → contentctl-5.3.2}/pyproject.toml

@@ -1,7 +1,7 @@
 [tool.poetry]
 name = "contentctl"
 
-version = "5.3.0"
+version = "5.3.2"
 
 description = "Splunk Content Control Tool"
 authors = ["STRT <research@splunk.com>"]