cycode 3.3.1.dev7__tar.gz → 3.4.1__tar.gz

{cycode-3.3.1.dev7 → cycode-3.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: cycode
-Version: 3.3.1.dev7
+Version: 3.4.1
 Summary: Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning.
 Home-page: https://github.com/cycodehq/cycode-cli
 License: MIT

cycode-3.4.1/cycode/__init__.py

@@ -0,0 +1 @@
+__version__ = '3.4.1'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag

{cycode-3.3.1.dev7 → cycode-3.4.1}/cycode/cli/apps/scan/commit_range_scanner.py

@@ -25,6 +25,7 @@ from cycode.cli.files_collector.commit_range_documents import (
     get_diff_file_content,
     get_diff_file_path,
     get_pre_commit_modified_documents,
+    get_safe_head_reference_for_diff,
     parse_commit_range_sast,
     parse_commit_range_sca,
 )
@@ -271,7 +272,9 @@ def _scan_sca_pre_commit(ctx: typer.Context, repo_path: str) -> None:
 
 def _scan_secret_pre_commit(ctx: typer.Context, repo_path: str) -> None:
     progress_bar = ctx.obj['progress_bar']
-    diff_index = git_proxy.get_repo(repo_path).index.diff(consts.GIT_HEAD_COMMIT_REV, create_patch=True, R=True)
+    repo = git_proxy.get_repo(repo_path)
+    head_reference = get_safe_head_reference_for_diff(repo)
+    diff_index = repo.index.diff(head_reference, create_patch=True, R=True)
 
     progress_bar.set_section_length(ScanProgressBarSection.PREPARE_LOCAL_FILES, len(diff_index))
 

{cycode-3.3.1.dev7 → cycode-3.4.1}/cycode/cli/apps/scan/remote_url_resolver.py

@@ -99,17 +99,46 @@ def _try_to_get_plastic_remote_url(path: str) -> Optional[str]:
 
 def _try_get_git_remote_url(path: str) -> Optional[str]:
     try:
-        remote_url = git_proxy.get_repo(path).remotes[0].config_reader.get('url')
-        logger.debug('Found Git remote URL, %s', {'remote_url': remote_url, 'path': path})
+        repo = git_proxy.get_repo(path, search_parent_directories=True)
+        remote_url = repo.remotes[0].config_reader.get('url')
+        logger.debug('Found Git remote URL, %s', {'remote_url': remote_url, 'repo_path': repo.working_dir})
         return remote_url
-    except Exception:
-        logger.debug('Failed to get Git remote URL. Probably not a Git repository')
+    except Exception as e:
+        logger.debug('Failed to get Git remote URL. Probably not a Git repository', exc_info=e)
         return None
 
 
-def try_get_any_remote_url(path: str) -> Optional[str]:
+def _try_get_any_remote_url(path: str) -> Optional[str]:
     remote_url = _try_get_git_remote_url(path)
     if not remote_url:
         remote_url = _try_to_get_plastic_remote_url(path)
 
     return remote_url
+
+
+def get_remote_url_scan_parameter(paths: tuple[str, ...]) -> Optional[str]:
+    remote_urls = set()
+    for path in paths:
+        # FIXME(MarshalX): perf issue. This looping will produce:
+        #  - len(paths) Git subprocess calls in the worst case
+        #  - len(paths)*2 Plastic SCM subprocess calls
+        remote_url = _try_get_any_remote_url(path)
+        if remote_url:
+            remote_urls.add(remote_url)
+
+    if len(remote_urls) == 1:
+        # we are resolving remote_url only if all paths belong to the same repo (identical remote URLs),
+        # otherwise, the behavior is undefined
+        remote_url = remote_urls.pop()
+
+        logger.debug(
+            'Single remote URL found. Scan will be associated with organization, %s', {'remote_url': remote_url}
+        )
+        return remote_url
+
+    logger.debug(
+        'Multiple different remote URLs found. Scan will not be associated with organization, %s',
+        {'remote_urls': remote_urls},
+    )
+
+    return None

{cycode-3.3.1.dev7 → cycode-3.4.1}/cycode/cli/apps/scan/scan_parameters.py

@@ -1,9 +1,8 @@
-import os
 from typing import Optional
 
 import typer
 
-from cycode.cli.apps.scan.remote_url_resolver import try_get_any_remote_url
+from cycode.cli.apps.scan.remote_url_resolver import get_remote_url_scan_parameter
 from cycode.cli.utils.scan_utils import generate_unique_scan_id
 from cycode.logger import get_logger
 
@@ -29,18 +28,9 @@ def get_scan_parameters(ctx: typer.Context, paths: Optional[tuple[str, ...]] = N
 
     scan_parameters['paths'] = paths
 
-    if len(paths) != 1:
-        logger.debug('Multiple paths provided, going to ignore remote url')
-        return scan_parameters
-
-    if not os.path.isdir(paths[0]):
-        logger.debug('Path is not a directory, going to ignore remote url')
-        return scan_parameters
-
-    remote_url = try_get_any_remote_url(paths[0])
-    if remote_url:
-        # TODO(MarshalX): remove hardcode in context
-        ctx.obj['remote_url'] = remote_url
-        scan_parameters['remote_url'] = remote_url
+    remote_url = get_remote_url_scan_parameter(paths)
+    # TODO(MarshalX): remove hardcode in context
+    ctx.obj['remote_url'] = remote_url
+    scan_parameters['remote_url'] = remote_url
 
     return scan_parameters

{cycode-3.3.1.dev7 → cycode-3.4.1}/cycode/cli/consts.py

@@ -105,7 +105,7 @@ SCA_CONFIGURATION_SCAN_SUPPORTED_FILES = (  # keep in lowercase
     'conan.lock',
 )
 
-SCA_EXCLUDED_PATHS = (
+SCA_EXCLUDED_FOLDER_IN_PATH = (
     'node_modules',
     'venv',
     '.venv',
@@ -261,6 +261,7 @@ SCAN_STATUS_ERROR = 'Error'
 # git consts
 COMMIT_DIFF_DELETED_FILE_CHANGE_TYPE = 'D'
 GIT_HEAD_COMMIT_REV = 'HEAD'
+GIT_EMPTY_TREE_OBJECT = '4b825dc642cb6eb9a060e54bf8d69288fbee4904'
 EMPTY_COMMIT_SHA = '0000000000000000000000000000000000000000'
 GIT_PUSH_OPTION_COUNT_ENV_VAR_NAME = 'GIT_PUSH_OPTION_COUNT'
 GIT_PUSH_OPTION_ENV_VAR_PREFIX = 'GIT_PUSH_OPTION_'

{cycode-3.3.1.dev7 → cycode-3.4.1}/cycode/cli/files_collector/commit_range_documents.py

@@ -22,6 +22,31 @@ if TYPE_CHECKING:
 logger = get_logger('Commit Range Collector')
 
 
+def get_safe_head_reference_for_diff(repo: 'Repo') -> str:
+    """Get a safe reference to use for diffing against the current HEAD.
+    In repositories with no commits, HEAD doesn't exist, so we return the empty tree hash.
+
+    Args:
+        repo: Git repository object
+
+    Returns:
+        Either "HEAD" string if commits exist, or empty tree hash if no commits exist
+    """
+    try:
+        repo.rev_parse(consts.GIT_HEAD_COMMIT_REV)
+        return consts.GIT_HEAD_COMMIT_REV
+    except Exception as e:  # actually gitdb.exc.BadObject; no import because of lazy loading
+        logger.debug(
+            'Repository has no commits, using empty tree hash for diffs, %s',
+            {'repo_path': repo.working_tree_dir},
+            exc_info=e,
+        )
+
+        # Repository has no commits, use the universal empty tree hash
+        # This is the standard Git approach for initial commits
+        return consts.GIT_EMPTY_TREE_OBJECT
+
+
 def _does_reach_to_max_commits_to_scan_limit(commit_ids: list[str], max_commits_count: Optional[int]) -> bool:
     if max_commits_count is None:
         return False
@@ -213,7 +238,8 @@ def get_pre_commit_modified_documents(
     diff_documents = []
 
     repo = git_proxy.get_repo(repo_path)
-    diff_index = repo.index.diff(consts.GIT_HEAD_COMMIT_REV, create_patch=True, R=True)
+    head_reference = get_safe_head_reference_for_diff(repo)
+    diff_index = repo.index.diff(head_reference, create_patch=True, R=True)
     progress_bar.set_section_length(progress_bar_section, len(diff_index))
     for diff in diff_index:
         progress_bar.update(progress_bar_section)
@@ -228,9 +254,11 @@ def get_pre_commit_modified_documents(
             )
         )
 
-        file_content = _get_file_content_from_commit_diff(repo, consts.GIT_HEAD_COMMIT_REV, diff)
-        if file_content:
-            git_head_documents.append(Document(file_path, file_content))
+        # Only get file content from HEAD if HEAD exists (not the empty tree hash)
+        if head_reference == consts.GIT_HEAD_COMMIT_REV:
+            file_content = _get_file_content_from_commit_diff(repo, head_reference, diff)
+            if file_content:
+                git_head_documents.append(Document(file_path, file_content))
 
         if os.path.exists(file_path):
             file_content = get_file_content(file_path)
@@ -274,13 +302,13 @@ def parse_commit_range_sast(commit_range: str, path: str) -> tuple[Optional[str]
     else:
         # Git commands like 'git diff <commit>' compare against HEAD.
         from_spec = commit_range
-        to_spec = 'HEAD'
+        to_spec = consts.GIT_HEAD_COMMIT_REV
 
     # If a spec is empty (e.g., from '..master'), default it to 'HEAD'
     if not from_spec:
-        from_spec = 'HEAD'
+        from_spec = consts.GIT_HEAD_COMMIT_REV
     if not to_spec:
-        to_spec = 'HEAD'
+        to_spec = consts.GIT_HEAD_COMMIT_REV
 
     try:
         # Use rev_parse to resolve each specifier to its full commit SHA

{cycode-3.3.1.dev7 → cycode-3.4.1}/cycode/cli/files_collector/file_excluder.py

@@ -1,3 +1,4 @@
+from pathlib import Path
 from typing import TYPE_CHECKING
 
 from cycode.cli import consts
@@ -40,11 +41,13 @@ def _does_document_exceed_max_size_limit(content: str) -> bool:
 
 
 def _is_file_relevant_for_sca_scan(filename: str) -> bool:
-    if any(sca_excluded_path in filename for sca_excluded_path in consts.SCA_EXCLUDED_PATHS):
-        logger.debug(
-            'The file is irrelevant because it is from the inner path of node_modules, %s', {'filename': filename}
-        )
-        return False
+    for part in Path(filename).parts:
+        if part in consts.SCA_EXCLUDED_FOLDER_IN_PATH:
+            logger.debug(
+                'The file is irrelevant because it is from an excluded directory, %s',
+                {'filename': filename, 'excluded_directory': part},
+            )
+            return False
 
     return True
 

{cycode-3.3.1.dev7 → cycode-3.4.1}/cycode/cli/printers/rich_printer.py

@@ -91,7 +91,7 @@ class RichPrinter(TextPrinter):
         details_table.add_row('Version', detection_details.get('package_version'))
 
         if detection.has_alert:
-            patched_version = detection_details['alert'].get('patched_version')
+            patched_version = detection_details['alert'].get('first_patched_version')
             details_table.add_row('First patched version', patched_version or 'Not fixed')
 
         dependency_path = detection_details.get('dependency_paths')

{cycode-3.3.1.dev7 → cycode-3.4.1}/cycode/cli/user_settings/base_file_manager.py

@@ -4,6 +4,9 @@ from collections.abc import Hashable
 from typing import Any
 
 from cycode.cli.utils.yaml_utils import read_yaml_file, update_yaml_file
+from cycode.logger import get_logger
+
+logger = get_logger('Base File Manager')
 
 
 class BaseFileManager(ABC):
@@ -15,5 +18,11 @@ class BaseFileManager(ABC):
 
     def write_content_to_file(self, content: dict[Hashable, Any]) -> None:
         filename = self.get_filename()
-        os.makedirs(os.path.dirname(filename), exist_ok=True)
+
+        try:
+            os.makedirs(os.path.dirname(filename), exist_ok=True)
+        except Exception as e:
+            logger.warning('Failed to create directory for file, %s', {'filename': filename}, exc_info=e)
+            return
+
         update_yaml_file(filename, content)

{cycode-3.3.1.dev7 → cycode-3.4.1}/cycode/cli/utils/version_checker.py

@@ -8,6 +8,9 @@ from cycode.cli.console import console
 from cycode.cli.user_settings.configuration_manager import ConfigurationManager
 from cycode.cli.utils.path_utils import get_file_content
 from cycode.cyclient.cycode_client_base import CycodeClientBase
+from cycode.logger import get_logger
+
+logger = get_logger('Version Checker')
 
 
 def _compare_versions(
@@ -154,8 +157,8 @@ class VersionChecker(CycodeClientBase):
             os.makedirs(os.path.dirname(self.cache_file), exist_ok=True)
             with open(self.cache_file, 'w', encoding='UTF-8') as f:
                 f.write(str(time.time()))
-        except OSError:
-            pass
+        except Exception as e:
+            logger.debug('Failed to update version check cache file: %s', {'file': self.cache_file}, exc_info=e)
 
     def check_for_update(self, current_version: str, use_cache: bool = True) -> Optional[str]:
         """Check if an update is available for the current version.

{cycode-3.3.1.dev7 → cycode-3.4.1}/cycode/cli/utils/yaml_utils.py

@@ -35,7 +35,8 @@ def _yaml_object_safe_load(file: TextIO) -> dict[Hashable, Any]:
 
 
 def read_yaml_file(filename: str) -> dict[Hashable, Any]:
-    if not os.path.exists(filename):
+    if not os.access(filename, os.R_OK) or not os.path.exists(filename):
+        logger.debug('Config file is not accessible or does not exist: %s', {'filename': filename})
         return {}
 
     with open(filename, encoding='UTF-8') as file:
@@ -43,6 +44,10 @@ def read_yaml_file(filename: str) -> dict[Hashable, Any]:
 
 
 def write_yaml_file(filename: str, content: dict[Hashable, Any]) -> None:
+    if not os.access(filename, os.W_OK) and os.path.exists(filename):
+        logger.warning('No write permission for file. Cannot save config, %s', {'filename': filename})
+        return
+
     with open(filename, 'w', encoding='UTF-8') as file:
         yaml.safe_dump(content, file)
 

{cycode-3.3.1.dev7 → cycode-3.4.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "cycode"
-version = "3.3.1.dev7" # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag
+version = "3.4.1" # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag
 description = "Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning."
 keywords=["secret-scan", "cycode", "devops", "token", "secret", "security", "cycode", "code"]
 authors = ["Cycode <support@cycode.com>"]

cycode-3.3.1.dev7/cycode/__init__.py

@@ -1 +0,0 @@
-__version__ = '3.3.1.dev7'  # DON'T TOUCH. Placeholder. Will be filled automatically on poetry build from Git Tag