conviso-ast 3.0.1rc3__py3-none-any.whl → 3.0.2rc0__py3-none-any.whl

{conviso_ast-3.0.1rc3.dist-info → conviso_ast-3.0.2rc0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: conviso-ast
-Version: 3.0.1rc3
+Version: 3.0.2rc0
 Maintainer: Conviso
 Maintainer-email: development@convisoappsec.com
 Project-URL: Source, https://github.com/convisoappsec/convisocli/

{conviso_ast-3.0.1rc3.dist-info → conviso_ast-3.0.2rc0.dist-info}/RECORD

@@ -1,9 +1,9 @@
-conviso_ast-3.0.1rc3.data/scripts/flow_bash_completer.sh,sha256=9q3HPuXq_FCUUV3IFGcOefsOLhPWatUkLY7txiBM7Uo,624
-conviso_ast-3.0.1rc3.data/scripts/flow_fish_completer.fish,sha256=-wiuarawDJkms5N-rh99brIOzhy-ktsM1mi1ohQ3Mtg,147
-conviso_ast-3.0.1rc3.data/scripts/flow_zsh_completer.sh,sha256=cAtTDGUs5sY4NAA7AjscmLWj0dbNZ9iZhLP6BTz6dEQ,844
+conviso_ast-3.0.2rc0.data/scripts/flow_bash_completer.sh,sha256=9q3HPuXq_FCUUV3IFGcOefsOLhPWatUkLY7txiBM7Uo,624
+conviso_ast-3.0.2rc0.data/scripts/flow_fish_completer.fish,sha256=-wiuarawDJkms5N-rh99brIOzhy-ktsM1mi1ohQ3Mtg,147
+conviso_ast-3.0.2rc0.data/scripts/flow_zsh_completer.sh,sha256=cAtTDGUs5sY4NAA7AjscmLWj0dbNZ9iZhLP6BTz6dEQ,844
 convisoappsec/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 convisoappsec/logger.py,sha256=aTNebqOau9nEadBySMTXtnbGkOkJ_q2kyFlX1mzizeg,1132
-convisoappsec/version.py,sha256=2X1IZUl4Pw9Uhoh_gMYFrzVwRJ6cuhVyjhuG61X9gFg,27
+convisoappsec/version.py,sha256=GnndlAXQvhYs3pVBtlsldtjm-6BhjGYuUmT4jZh5UbI,27
 convisoappsec/common/__init__.py,sha256=QN7tV2C_jhTiWUrJHv2jbeq6ae3MssgLUWpQZwe8O2s,105
 convisoappsec/common/box.py,sha256=WTtPF3YWxkcdblPmFTzrzQlPPPUwVsDt2zoi6xFMy1U,7561
 convisoappsec/common/cleaner.py,sha256=Iy8BWCXj_v51oovcYzI_uhaJzLL-fCUyDxrbBglfwEs,2680
@@ -43,7 +43,7 @@ convisoappsec/flow/graphql_api/v1/models/issues.py,sha256=ZAM_aPwj20I7cApX1leCDV
 convisoappsec/flow/graphql_api/v1/models/project.py,sha256=CDZlufsT-_iQIOgpOPAtdmcv0JvHWFd6TjcDIAj6w7c,972
 convisoappsec/flow/graphql_api/v1/schemas/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 convisoappsec/flow/graphql_api/v1/schemas/mutations/__init__.py,sha256=R9LgniQyj694h1MD7cn1-HJRDjI4PLiOrCmsqjp16ho,3251
-convisoappsec/flow/graphql_api/v1/schemas/resolvers/__init__.py,sha256=2jAgzA-8te6HyyV8RVAx0BnLDeZhFulZynbxm5JR8Sc,2713
+convisoappsec/flow/graphql_api/v1/schemas/resolvers/__init__.py,sha256=QRqSriwq2x0p78jSdz86KybhOetq8FSVlGI1VNM1tK8,2868
 convisoappsec/flow/util/__init__.py,sha256=32E3AbPrBf0stKOzCIvz7BeWtBjAScIt7FNyERjN-p4,99
 convisoappsec/flow/util/ci_provider.py,sha256=VYDESwNFbtrRcWDtTEb8tYDN5qbnLksmQI_ntsciJ4I,2093
 convisoappsec/flow/util/source_code_compressor.py,sha256=b2iA8Exf8wVbxR1mnvwTbruDjdpYyVloUmSlyYLSJQU,508
@@ -99,7 +99,7 @@ convisoappsec/flowcli/findings/import_sarif/entrypoint.py,sha256=MIHi9ZWU2Jn2o7o
 convisoappsec/flowcli/iac/__init__.py,sha256=a3IZzSKpm987fMEliTECDeXO_Eduk7eg-aQzmaWvUXQ,47
 convisoappsec/flowcli/iac/dry_run.py,sha256=xvC0Wb2Sxl37yEjFaFMGcRvLJ4Q8evrNQoUXuahHtCg,2990
 convisoappsec/flowcli/iac/entrypoint.py,sha256=WMlSwHd7cLxhUfy643OquQhUHEy4yNf7s0K5bkrXYno,295
-convisoappsec/flowcli/iac/run.py,sha256=2o4mKeEDR3PQukuinF7lcd6xArIwI5N7ESQJkYOJn20,11672
+convisoappsec/flowcli/iac/run.py,sha256=Y86MYTM8kTcF3TdvZuGgGLmNOEx7EPVaidKnStSbVpE,11203
 convisoappsec/flowcli/sast/__init__.py,sha256=S4O78eZGhgpT2lZY3GSUIUTQJB5a62uAVirEqbf4EQY,49
 convisoappsec/flowcli/sast/dry_run.py,sha256=lUi9LCfBlBjcAYm4v_Etl3raPZcTHVr5fVxGnB1eVSM,5787
 convisoappsec/flowcli/sast/entrypoint.py,sha256=XMu8WpZNwSujWOwbHUThk3JK_WtRWHau9kYD2ttjULY,300
@@ -116,12 +116,12 @@ convisoappsec/flowcli/vulnerability/assert_security_rules.py,sha256=j7VcondMeZSR
 convisoappsec/flowcli/vulnerability/container_vulnerability_manager.py,sha256=EkJhbUm1DTP14mIg_ZC4SKFSlvTtfPpSpNAMWPkwrsc,6897
 convisoappsec/flowcli/vulnerability/entrypoint.py,sha256=WsQkEJSbb9CwPm_deUtata9omEYYcaZnssYKTAybtjA,386
 convisoappsec/flowcli/vulnerability/rules_schema.json,sha256=OBkj9RMXltGoJYsyPqOsrJDfcyrQDlQHk9b5i9rMhoc,948
-convisoappsec/flowcli/vulnerability/run.py,sha256=6flmvr55cKxj-duX3w4PAFwJgC5AJ0NYJ9Zk3FZHFII,17144
+convisoappsec/flowcli/vulnerability/run.py,sha256=A43g4rB2tqaCFSXM55Twe0ggXt_KtAkR3KVkTYa0x8k,18842
 convisoappsec/sast/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 convisoappsec/sast/decision.py,sha256=d7dcNr9yZMzyccpFS_peAmDo0ZtfsE1qXDdYrvCux2U,1025
 convisoappsec/sast/sastbox.py,sha256=hXZLiYh_F3f6yd1ydPYVOMKg-tNOQOZiBvKmWyedagI,11031
-conviso_ast-3.0.1rc3.dist-info/METADATA,sha256=y5TPvQ7QuomSTYUE-bYt3MY_HMMmUFn_8X9QVxlGWv0,1078
-conviso_ast-3.0.1rc3.dist-info/WHEEL,sha256=In9FTNxeP60KnTkGw7wk6mJPYd_dQSjEZmXdBdMCI-8,91
-conviso_ast-3.0.1rc3.dist-info/entry_points.txt,sha256=0IvamweR_V0uG4O5Fo9NpVHTHfpZRwUE9kn7KEVZ668,109
-conviso_ast-3.0.1rc3.dist-info/top_level.txt,sha256=ju5r0RSCF1HA7m9JOG10jrQS4SnqQEJzl6-YMCxbSl4,14
-conviso_ast-3.0.1rc3.dist-info/RECORD,,
+conviso_ast-3.0.2rc0.dist-info/METADATA,sha256=s6Y107PspXj0WR6fvxhJcBL7eeXuL6rC4X8gKtC2RGI,1078
+conviso_ast-3.0.2rc0.dist-info/WHEEL,sha256=In9FTNxeP60KnTkGw7wk6mJPYd_dQSjEZmXdBdMCI-8,91
+conviso_ast-3.0.2rc0.dist-info/entry_points.txt,sha256=0IvamweR_V0uG4O5Fo9NpVHTHfpZRwUE9kn7KEVZ668,109
+conviso_ast-3.0.2rc0.dist-info/top_level.txt,sha256=ju5r0RSCF1HA7m9JOG10jrQS4SnqQEJzl6-YMCxbSl4,14
+conviso_ast-3.0.2rc0.dist-info/RECORD,,

convisoappsec/flow/graphql_api/v1/schemas/resolvers/__init__.py

@@ -150,6 +150,14 @@ query GetIssuesFingerprint(
         collection {
             id
             type
+            ... on ScaFinding {
+			      	detail {
+			      		cve
+			      		affectedVersion
+			      		fileName
+			      		package
+			      	}
+			      }
             ... on FindingInterface {
                 originalIssueIdFromTool
                 scanSource

convisoappsec/flowcli/iac/run.py

@@ -183,13 +183,6 @@ def deploy_results_to_conviso(
                     if error.code == 'RECORD_NOT_UNIQUE':
                         continue
                     elif error.code == "Record not found" or "Record not found" in str(error):
-                        LOGGER.warning(
-                            f"\n⚠️ [Record Not Found] Falha ao vincular vulnerabilidade (Asset ou Sync ID inválido). Item ignorado.\n"
-                            f"   - Issue: {issue.get('title')}\n"
-                            f"   - Hash: {issue.get('hash_issue')}"
-                            f"   - Asset: {asset_id}"
-                            f"   - control sync: {control_sync_status_id}"
-                        )
                         continue
                     else:
                         retry_handler = RetryHandler(

convisoappsec/flowcli/vulnerability/run.py

@@ -233,28 +233,56 @@ def run(context, flow_context, asset_id, company_id, end_commit, start_commit, r
     # Starting executing the ast again
     sast_hash_issues = perform_sastbox_scan(sastbox_registry, sastbox_repository_name, sastbox_tag, repository_dir)
 
-    sca_hash_issues = perform_sca_scan(repository_dir=repository_dir)
+    vulnerabilities = perform_sca_scan(repository_dir=repository_dir)
     iac_hash_issues = perform_iac_scan(repository_dir=repository_dir)
 
     # we need to append the two lists because at the moment this was made, iac and sast has sast as type on cp.
     sast_hash_issues = sast_hash_issues + iac_hash_issues
     # end ast execution
 
+    current_sca_hashes = set()
+    current_sca_tuples = set()
+
+    for vulnerability in vulnerabilities:
+        if vulnerability.get('hash_issue'):
+            current_sca_hashes.add(vulnerability['hash_issue'])
+
+        cve_list = vulnerability.get('cve')
+
+        if isinstance(cve_list, list) and len(cve_list) > 0:
+            cve_str = str(cve_list[0])
+        else:
+            cve_str = str(cve_list) if cve_list is not None else ""
+
+        if vulnerability.get('package') and vulnerability.get('version'):
+            current_sca_tuples.add((vulnerability['package'], vulnerability['version'], cve_str))
+
     set_of_sast_hash_issues = set(sast_hash_issues)
-    set_of_sca_hash_issues = set(sca_hash_issues)
 
     close_sast_issues(conviso_api, sast_issues_without_fix_accepted, set_of_sast_hash_issues, control_sync_status_id)
-    close_sca_issues(conviso_api, sca_issues_without_fix_accepted, set_of_sca_hash_issues, control_sync_status_id)
+    close_sca_issues(conviso_api, sca_issues_without_fix_accepted, current_sca_hashes, current_sca_tuples, control_sync_status_id)
 
     sast_issues_to_reopen = [
         {'id': item['id'], 'originalIssueIdFromTool': item['originalIssueIdFromTool']}
         for item in sast_issues_with_fix_accepted if item['originalIssueIdFromTool'] in sast_hash_issues
     ]
 
-    sca_issues_to_reopen = [
-        {'id': item['id'], 'originalIssueIdFromTool': item['originalIssueIdFromTool']}
-        for item in sca_issues_with_fix_accepted if item['originalIssueIdFromTool'] in sca_hash_issues
-    ]
+    sca_issues_to_reopen = []
+    for item in sca_issues_with_fix_accepted:
+        tool_id = item.get('originalIssueIdFromTool')
+        should_reopen = False
+
+        if tool_id:
+            if tool_id in current_sca_hashes:
+                should_reopen = True
+        else:
+            detail = item.get('detail', {})
+            item_tuple = (detail.get('package'), detail.get('affectedVersion'), detail.get('cve'))
+            if item_tuple in current_sca_tuples:
+                should_reopen = True
+
+        if should_reopen:
+            sca_issues_to_reopen.append({'id': item['id'], 'originalIssueIdFromTool': tool_id})
 
     if sast_issues_to_reopen:
         log_func("SAST: reopening {issues} vulnerability/vulnerabilities on conviso platform ...".format(
@@ -303,14 +331,25 @@ def close_sast_issues(conviso_api, issues_from_cp, issues_from_current_scan, con
         )
 
 
-def close_sca_issues(conviso_api, issues_from_cp, issues_from_current_scan, control_sync_status_id):
+def close_sca_issues(conviso_api, issues_from_cp, current_hashes, current_tuples, control_sync_status_id):
     """ method to close sca issues on conviso platform """
 
     log_func("SCA: Verifying if any vulnerability was solved...")
-    differences = [
-        {'id': item['id'], 'originalIssueIdFromTool': item['originalIssueIdFromTool']}
-        for item in issues_from_cp if item['originalIssueIdFromTool'] not in issues_from_current_scan
-    ]
+
+    differences = []
+
+    for item in issues_from_cp:
+        tool_id = item.get('originalIssueIdFromTool')
+
+        if tool_id:
+            if tool_id not in current_hashes:
+                differences.append({'id': item['id'], 'originalIssueIdFromTool': tool_id})
+        else:
+            detail = item.get('detail', {})
+            item_tuple = (detail.get('package'), detail.get('affectedVersion'), detail.get('cve'))
+
+            if item_tuple not in current_tuples:
+                differences.append({'id': item['id'], 'originalIssueIdFromTool': None})
 
     if len(differences) == 0:
         log_func("No vulnerabilities have been fixed yet...")
@@ -407,19 +446,28 @@ def perform_sca_scan(flow_context, repository_dir):
             if file_path:
                 results_filepaths.append(file_path)
 
-        hash_issues = []
+        detected_vulnerabilities = []
 
         for report_path in results_filepaths:
             try:
                 with open(report_path, 'r') as report_file:
                     report_content = json.load(report_file)
                     issues = report_content.get("issues", [])
-                    hash_issues.extend(issue.get("hash_issue") for issue in issues)
+
+                    for issue in issues:
+                        vuln_data = {
+                            "hash_issue": issue.get("hash_issue"),
+                            "package": issue.get("component"),
+                            "version": issue.get("version"),
+                            "cve": issue.get("cve")
+                        }
+
+                        detected_vulnerabilities.append(vuln_data)
 
             except (FileNotFoundError, json.JSONDecodeError) as e:
                 print(f"Error processing {report_path}: {e}")
 
-        return hash_issues
+        return detected_vulnerabilities
 
     except Exception as e:
         on_http_error(e)

convisoappsec/version.py

@@ -1 +1 @@
-__version__ = '3.0.1-rc.3'
+__version__ = '3.0.2-rc.0'