devsecops-engine-tools 1.11.2__tar.gz → 1.11.3__tar.gz

{devsecops_engine_tools-1.11.2 → devsecops_engine_tools-1.11.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.11.2
+Version: 1.11.3
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.11.2 → devsecops_engine_tools-1.11.3}/devsecops_engine_tools/engine_core/src/applications/runner_engine_core.py

@@ -144,7 +144,7 @@ def get_inputs_from_cli(args):
     parser.add_argument(
         "--token_external_checks",
         required=False,
-        help="Token for downloading external checks from engine_iac if is necessary. Ej: github:token, ssh:privatekey:pass",
+        help="Token for downloading external checks from engine_iac or engine_secret if is necessary. Ej: github:token, ssh:privatekey:pass",
     )
     parser.add_argument(
         "--xray_mode",

{devsecops_engine_tools-1.11.2 → devsecops_engine_tools-1.11.3}/devsecops_engine_tools/engine_core/src/domain/usecases/handle_scan.py

@@ -136,7 +136,8 @@ class HandleScan:
             findings_list, input_core = runner_secret_scan(
                 dict_args,
                 config_tool["ENGINE_SECRET"]["TOOL"],
-                self.devops_platform_gateway
+                self.devops_platform_gateway,
+                secret_tool
             )
             if (
                 dict_args["use_vulnerability_management"] == "true"

{devsecops_engine_tools-1.11.2 → devsecops_engine_tools-1.11.3}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/aws/secrets_manager.py

@@ -36,5 +36,5 @@ class SecretsManager(SecretsManagerGateway):
             secret_dict = json.loads(secret)
             return secret_dict
         except NoCredentialsError as e:
-            logger.error("Error getting secret: {e}")
+            logger.error(f"Error getting secret: {e}")
             return None

{devsecops_engine_tools-1.11.2 → devsecops_engine_tools-1.11.3}/devsecops_engine_tools/engine_sast/engine_secret/src/applications/runner_secret_scan.py

@@ -11,7 +11,7 @@ from devsecops_engine_tools.engine_utilities.git_cli.infrastructure.git_run impo
     GitRun
     )
 
-def runner_secret_scan(dict_args, tool, devops_platform_gateway):
+def runner_secret_scan(dict_args, tool, devops_platform_gateway, secret_tool):
     try:
         tool_deserealizator = None
         tool_gateway = None
@@ -25,7 +25,8 @@ def runner_secret_scan(dict_args, tool, devops_platform_gateway):
             dict_args = dict_args,
             tool=tool,
             tool_deserealizator = tool_deserealizator,
-            git_gateway = git_gateway
+            git_gateway = git_gateway,
+            secret_tool = secret_tool
         )
     except Exception as e:
         raise Exception(f"Error engine_secret : {str(e)}")

{devsecops_engine_tools-1.11.2 → devsecops_engine_tools-1.11.3}/devsecops_engine_tools/engine_sast/engine_secret/src/domain/model/DeserializeConfigTool.py

@@ -9,3 +9,6 @@ class DeserializeConfigTool:
         self.exclude_path = json_data[tool]["EXCLUDE_PATH"]
         self.number_threads = json_data[tool]["NUMBER_THREADS"]
         self.target_branches = json_data["TARGET_BRANCHES"]
+        self.enable_custom_rules = json_data[tool]["ENABLE_CUSTOM_RULES"]
+        self.external_dir_owner = json_data[tool]["EXTERNAL_DIR_OWNER"]
+        self.external_dir_repo = json_data[tool]["EXTERNAL_DIR_REPOSITORY"]

{devsecops_engine_tools-1.11.2 → devsecops_engine_tools-1.11.3}/devsecops_engine_tools/engine_sast/engine_secret/src/domain/model/gateway/tool_gateway.py

@@ -1,5 +1,5 @@
 from abc import ABCMeta, abstractmethod
-
+from devsecops_engine_tools.engine_sast.engine_secret.src.domain.model.DeserializeConfigTool import DeserializeConfigTool
 
 class ToolGateway(metaclass=ABCMeta):
     @abstractmethod
@@ -8,9 +8,10 @@ class ToolGateway(metaclass=ABCMeta):
     @abstractmethod
     def run_tool_secret_scan(self,
                             files_pullrequest: dict,
-                            exclude_path: dict,
                             agent_os: str,
                             agent_work_folder: str,
-                            num_threads: int,
-                            repository_name: str) -> str:
+                            repository_name: str,
+                            config_tool: DeserializeConfigTool,
+                            secret_tool,
+                            secret_external_checks) -> str:
         "run tool secret scan"

{devsecops_engine_tools-1.11.2 → devsecops_engine_tools-1.11.3}/devsecops_engine_tools/engine_sast/engine_secret/src/domain/usecases/secret_scan.py

@@ -28,9 +28,10 @@ class SecretScan:
         self.tool_deserialize = tool_deserialize
         self.git_gateway = git_gateway
 
-    def process(self, skip_tool, config_tool):
+    def process(self, skip_tool, config_tool, secret_tool, dict_args):
         finding_list = []
         file_path_findings = ""
+        secret_external_checks=dict_args["token_external_checks"]
         if skip_tool == False:
             self.tool_gateway.install_tool(self.devops_platform_gateway.get_variable("os"), self.devops_platform_gateway.get_variable("temp_directory"))
             files_pullrequest = self.git_gateway.get_files_pull_request(
@@ -45,12 +46,12 @@ class SecretScan:
                 self.devops_platform_gateway.get_variable("repository_provider"))
             findings, file_path_findings = self.tool_gateway.run_tool_secret_scan(
                     files_pullrequest,
-                    config_tool.exclude_path,
                     self.devops_platform_gateway.get_variable("os"),
                     self.devops_platform_gateway.get_variable("path_directory"),
-                    config_tool.number_threads,
-                    self.devops_platform_gateway.get_variable("repository")
-                    )
+                    self.devops_platform_gateway.get_variable("repository"),
+                    config_tool,
+                    secret_tool,
+                    secret_external_checks)
             finding_list = self.tool_deserialize.get_list_vulnerability(
                 findings,
                 self.devops_platform_gateway.get_variable("os"),

{devsecops_engine_tools-1.11.2 → devsecops_engine_tools-1.11.3}/devsecops_engine_tools/engine_sast/engine_secret/src/infrastructure/driven_adapters/trufflehog/trufflehog_run.py

@@ -7,6 +7,13 @@ import concurrent.futures
 from devsecops_engine_tools.engine_sast.engine_secret.src.domain.model.gateway.tool_gateway import (
     ToolGateway,
 )
+from devsecops_engine_tools.engine_utilities.github.infrastructure.github_api import (
+    GithubApi,
+)
+from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
+from devsecops_engine_tools.engine_utilities import settings
+
+logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 
 result = []
 
@@ -40,20 +47,34 @@ class TrufflehogRun(ToolGateway):
     def run_tool_secret_scan(
         self,
         files_commits,
-        exclude_paths,
         agent_os,
         agent_work_folder,
-        num_threads,
         repository_name,
+        config_tool,
+        secret_tool,
+        secret_external_checks
     ):
         trufflehog_command = "trufflehog"
         if "Windows" in agent_os:
             trufflehog_command = "C:/Trufflehog/bin/trufflehog.exe"
         with open(f"{agent_work_folder}/excludedPath.txt", "w") as file:
-            file.write("\n".join(exclude_paths))
+            file.write("\n".join(config_tool.exclude_path))
         exclude_path = f"{agent_work_folder}/excludedPath.txt"
         include_paths = self.config_include_path(files_commits, agent_work_folder)
-        with concurrent.futures.ThreadPoolExecutor(max_workers=num_threads) as executor:
+        enable_custom_rules = config_tool.enable_custom_rules.lower()
+        secret = None
+        
+        if secret_tool is not None:
+            secret = secret_tool["github_token"] if "github" in secret_tool else None
+        elif secret_external_checks is not None:
+            secret = secret_external_checks.split("github:")[1] if "github" in secret_external_checks else None            
+
+        if enable_custom_rules == "true" and secret is not None:
+            self.configurate_external_checks(config_tool, secret)
+        else: #In case that remote config from tool is enable but in the args dont send any type of secrets. So dont modified command
+            enable_custom_rules == "false"
+
+        with concurrent.futures.ThreadPoolExecutor(max_workers=config_tool.number_threads) as executor:
             results = executor.map(
                 self.run_trufflehog,
                 [trufflehog_command] * len(include_paths),
@@ -61,6 +82,7 @@ class TrufflehogRun(ToolGateway):
                 [exclude_path] * len(include_paths),
                 include_paths,
                 [repository_name] * len(include_paths),
+                [enable_custom_rules],
             )
         findings, file_findings = self.create_file(self.decode_output(results), agent_work_folder)
         return  findings, file_findings
@@ -90,8 +112,13 @@ class TrufflehogRun(ToolGateway):
         exclude_path,
         include_path,
         repository_name,
+        enable_custom_rules
     ):
         command = f"{trufflehog_command} filesystem {agent_work_folder + '/' + repository_name} --include-paths {include_path} --exclude-paths {exclude_path} --no-verification --json"
+
+        if enable_custom_rules == "true":
+            command = command.replace("--no-verification --json", "--config /tmp/rules/trufflehog/custom-rules.yaml --no-verification --json")
+
         result = subprocess.run(command, capture_output=True, shell=True, text=True)
         return result.stdout.strip()
 
@@ -115,4 +142,15 @@ class TrufflehogRun(ToolGateway):
                 find["SourceMetadata"]["Data"]["Filesystem"]["file"] = where_text
                 json_str = json.dumps(find)
                 file.write(json_str + '\n')
-        return findings, file_findings
+        return findings, file_findings
+    
+    def configurate_external_checks(self, config_tool, secret):
+        try:
+            github_api = GithubApi(secret)
+            github_api.download_latest_release_assets(
+                config_tool.external_dir_owner,
+                config_tool.external_dir_repo,
+                "/tmp",
+            )
+        except Exception as ex:
+            logger.error(f"An error ocurred download external checks {ex}")

{devsecops_engine_tools-1.11.2 → devsecops_engine_tools-1.11.3}/devsecops_engine_tools/engine_sast/engine_secret/src/infrastructure/entry_points/entry_point_tool.py

@@ -4,13 +4,13 @@ from devsecops_engine_tools.engine_sast.engine_secret.src.domain.usecases.set_in
     SetInputCore,
 )
 
-def engine_secret_scan(devops_platform_gateway, tool_gateway, dict_args, tool, tool_deserealizator, git_gateway):
+def engine_secret_scan(devops_platform_gateway, tool_gateway, dict_args, tool, tool_deserealizator, git_gateway, secret_tool):
     exclusions = devops_platform_gateway.get_remote_config(
         dict_args["remote_config_repo"], "engine_sast/engine_secret/Exclusions.json"
     )
     secret_scan = SecretScan(tool_gateway, devops_platform_gateway, tool_deserealizator, git_gateway)
     config_tool = secret_scan.complete_config_tool(dict_args, tool)
     skip_tool = secret_scan.skip_from_exclusion(exclusions)
-    finding_list, file_path_findings = secret_scan.process(skip_tool, config_tool)
+    finding_list, file_path_findings = secret_scan.process(skip_tool, config_tool, secret_tool, dict_args)
     input_core = SetInputCore(devops_platform_gateway, dict_args, tool, config_tool)
     return finding_list, input_core.set_input_core(file_path_findings)

devsecops_engine_tools-1.11.3/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.11.3'

{devsecops_engine_tools-1.11.2 → devsecops_engine_tools-1.11.3}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.11.2
+Version: 1.11.3
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

devsecops_engine_tools-1.11.2/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.11.2'