devsecops-engine-tools 1.11.5__tar.gz → 1.13.0__tar.gz

{devsecops_engine_tools-1.11.5 → devsecops_engine_tools-1.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.11.5
+Version: 1.13.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.11.5 → devsecops_engine_tools-1.13.0}/devsecops_engine_tools/engine_sast/engine_secret/src/infrastructure/driven_adapters/trufflehog/trufflehog_deserealizator.py

@@ -10,15 +10,29 @@ class SecretScanDeserealizator(DeseralizatorGateway):
 
     def get_list_vulnerability(self, results_scan_list: List[dict], os, path_directory) -> List[Finding]:
         list_open_vulnerabilities = []
+        current_date=datetime.now().strftime("%d%m%Y")
+
         for result in results_scan_list:
-            where_text, raw = self.get_where_correctly(result, os, path_directory)
+            where_text, raw_data = self.get_where_correctly(result, os, path_directory)
+            extra_data = result.get("ExtraData", {})
+            rule_name = extra_data.get("name") if extra_data else None
+
+            if rule_name and "Actuator" in rule_name:
+                description = "Actuator misconfiguration can leak sensitive information"
+                finding_id = "MISCONFIGURATION_SCANNING"
+                where = f"{where_text}, Misconfiguration: {raw_data}"
+            else:
+                description = "Sensitive information in source code"
+                finding_id = "SECRET_SCANNING"
+                where = f"{where_text}, Secret: {raw_data}"
+            
             vulnerability_open = Finding(
-                id="SECRET_SCANNING",
+                id=finding_id,
                 cvss=None,
-                where=f"{where_text}, Secret: {raw}",
-                description="Sensitive information in source code",
+                where=where,
+                description=description,
                 severity="critical",
-                identification_date=datetime.now().strftime("%d%m%Y"),
+                identification_date=current_date,
                 published_date_cve=None,
                 module="engine_secret",
                 category=Category.VULNERABILITY,

{devsecops_engine_tools-1.11.5 → devsecops_engine_tools-1.13.0}/devsecops_engine_tools/engine_sca/engine_dependencies/src/applications/runner_dependencies_scan.py

@@ -15,24 +15,22 @@ from devsecops_engine_tools.engine_sca.engine_dependencies.src.infrastructure.en
 )
 
 
-def runner_engine_dependencies(dict_args, config_tool, secret_tool, devops_platform_gateway):
+def runner_engine_dependencies(
+    dict_args, config_tool, secret_tool, devops_platform_gateway
+):
     try:
         tools_mapping = {
-            "XRAY": {
-                "tool_run": XrayScan,
-                "tool_deserializator": XrayDeserializator
-            },
+            "XRAY": {"tool_run": XrayScan, "tool_deserializator": XrayDeserializator},
             "DEPENDENCY_CHECK": {
                 "tool_run": DependencyCheckTool,
-                "tool_deserializator": DependencyCheckDeserialize
-            }
+                "tool_deserializator": DependencyCheckDeserialize,
+            },
         }
 
         selected_tool = config_tool["ENGINE_DEPENDENCIES"]["TOOL"]
         tool_run = tools_mapping[selected_tool]["tool_run"]()
         tool_deserializator = tools_mapping[selected_tool]["tool_deserializator"]()
 
-
         return init_engine_dependencies(
             tool_run,
             devops_platform_gateway,

{devsecops_engine_tools-1.11.5 → devsecops_engine_tools-1.13.0}/devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/dependency_check/dependency_check_deserialize.py

@@ -14,6 +14,7 @@ from devsecops_engine_tools.engine_utilities import settings
 
 logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 
+
 @dataclass
 class DependencyCheckDeserialize(DeserializatorGateway):
 
@@ -38,7 +39,7 @@ class DependencyCheckDeserialize(DeserializatorGateway):
                 finding_open = Finding(
                     id=vulnerability["name"][:20],
                     cvss=str(vulnerability.get("cvssv3", {})),
-                    where=dependency.get("fileName").split(':')[-1].strip(),
+                    where=dependency.get("fileName").split(":")[-1].strip(),
                     description=vulnerability["description"][:170].replace("\n\n", " "),
                     severity=vulnerability["severity"].lower(),
                     identification_date=datetime.now().strftime("%d%m%Y"),
@@ -46,12 +47,12 @@ class DependencyCheckDeserialize(DeserializatorGateway):
                     module="engine_dependencies",
                     category=Category.VULNERABILITY,
                     requirements=fix,
-                    tool="DEPENDENCY_CHECK"
+                    tool="DEPENDENCY_CHECK",
                 )
                 list_open_vulnerabilities.append(finding_open)
 
         return list_open_vulnerabilities
-    
+
     def load_results(self, dependencies_scanned_file):
         try:
             with open(dependencies_scanned_file) as f:

{devsecops_engine_tools-1.11.5 → devsecops_engine_tools-1.13.0}/devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/dependency_check/dependency_check_tool.py

@@ -9,7 +9,9 @@ import platform
 import shutil
 
 from devsecops_engine_tools.engine_utilities.utils.utils import Utils
-from devsecops_engine_tools.engine_sca.engine_dependencies.src.infrastructure.helpers.get_artifacts import GetArtifacts
+from devsecops_engine_tools.engine_sca.engine_dependencies.src.infrastructure.helpers.get_artifacts import (
+    GetArtifacts,
+)
 from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
 from devsecops_engine_tools.engine_utilities import settings
 
@@ -22,7 +24,9 @@ class DependencyCheckTool(ToolGateway):
             url = f"https://github.com/jeremylong/DependencyCheck/releases/download/v{cli_version}/dependency-check-{cli_version}-release.zip"
             response = requests.get(url, allow_redirects=True)
             home_directory = os.path.expanduser("~")
-            zip_name = os.path.join(home_directory, f"dependency_check_{cli_version}.zip")
+            zip_name = os.path.join(
+                home_directory, f"dependency_check_{cli_version}.zip"
+            )
             with open(zip_name, "wb") as f:
                 f.write(response.content)
 
@@ -39,7 +43,9 @@ class DependencyCheckTool(ToolGateway):
             return command_prefix
 
         home_directory = os.path.expanduser("~")
-        bin_route = os.path.join(home_directory, f"dependency-check/bin/{command_prefix}")
+        bin_route = os.path.join(
+            home_directory, f"dependency-check/bin/{command_prefix}"
+        )
 
         if shutil.which(bin_route):
             return bin_route
@@ -50,18 +56,38 @@ class DependencyCheckTool(ToolGateway):
             if os.path.exists(bin_route):
                 if not is_windows:
                     subprocess.run(["chmod", "+x", bin_route], check=True)
-                return bin_route 
+                return bin_route
         except Exception as e:
             logger.error(f"Error installing OWASP dependency check: {e}")
             return None
 
     def scan_dependencies(self, command_prefix, file_to_scan, token):
         try:
-            command = [command_prefix, "--format", "JSON", "--format", "XML", "--nvdApiKey", token, "--scan", file_to_scan,]
+            command = [
+                command_prefix,
+                "--format",
+                "JSON",
+                "--format",
+                "XML",
+                "--nvdApiKey",
+                token,
+                "--scan",
+                file_to_scan,
+            ]
 
             if not token:
-                print("¡¡Remember!!, it is recommended to use the API key for faster vulnerability database downloads.")
-                command = [command_prefix, "--format", "JSON", "--format", "XML", "--scan", file_to_scan,]
+                print(
+                    "¡¡Remember!!, it is recommended to use the API key for faster vulnerability database downloads."
+                )
+                command = [
+                    command_prefix,
+                    "--format",
+                    "JSON",
+                    "--format",
+                    "XML",
+                    "--scan",
+                    file_to_scan,
+                ]
 
             subprocess.run(command, capture_output=True, check=True)
         except subprocess.CalledProcessError as error:
@@ -85,7 +111,7 @@ class DependencyCheckTool(ToolGateway):
         except Exception as ex:
             logger.error(f"An error ocurred search dependency-check results {ex}")
             return None
-        
+
     def is_java_installed(self):
         return shutil.which("java") is not None
 
@@ -97,17 +123,21 @@ class DependencyCheckTool(ToolGateway):
         pipeline_name,
         to_scan,
         token,
-        token_engine_dependencies
+        token_engine_dependencies,
     ):
         if not self.is_java_installed():
-            logger.error("Java is not installed, please install it to run dependency check")
+            logger.error(
+                "Java is not installed, please install it to run dependency check"
+            )
             return None
 
         cli_version = remote_config["DEPENDENCY_CHECK"]["CLI_VERSION"]
 
         get_artifacts = GetArtifacts()
 
-        pattern = get_artifacts.excluded_files(remote_config, pipeline_name, exclusion, "DEPENDENCY_CHECK")
+        pattern = get_artifacts.excluded_files(
+            remote_config, pipeline_name, exclusion, "DEPENDENCY_CHECK"
+        )
         to_scan = get_artifacts.find_artifacts(
             to_scan, pattern, remote_config["DEPENDENCY_CHECK"]["PACKAGES_TO_SCAN"]
         )

{devsecops_engine_tools-1.11.5 → devsecops_engine_tools-1.13.0}/devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/xray_tool/xray_manager_scan.py

@@ -9,7 +9,9 @@ import re
 import os
 import json
 
-from devsecops_engine_tools.engine_sca.engine_dependencies.src.infrastructure.helpers.get_artifacts import GetArtifacts
+from devsecops_engine_tools.engine_sca.engine_dependencies.src.infrastructure.helpers.get_artifacts import (
+    GetArtifacts,
+)
 from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
 from devsecops_engine_tools.engine_utilities import settings
 
@@ -99,7 +101,7 @@ class XrayScan(ToolGateway):
         if os.path.exists(gradlew_path):
             os.chmod(gradlew_path, 0o755)
 
-    def scan_dependencies(self, prefix, cwd, mode, to_scan):
+    def scan_dependencies(self, prefix, cwd, config, mode, to_scan):
         command = [
             prefix,
             mode,
@@ -110,8 +112,7 @@ class XrayScan(ToolGateway):
             command, cwd=cwd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True
         )
         if result.stdout or all(
-            word in result.stderr
-            for word in ["Technology", "WorkingDirectory", "Descriptors"]
+            word in result.stderr for word in config["XRAY"]["STDERR_EXPECTED_WORDS"]
         ):
             if result.stdout:
                 scan_result = json.loads(result.stdout)
@@ -119,7 +120,12 @@ class XrayScan(ToolGateway):
                 scan_result = {}
                 if any(
                     word in result.stderr
-                    for word in ["What went wrong", "Caused by"]
+                    for word in config["XRAY"]["STDERR_BREAK_ERRORS"]
+                ):
+                    raise Exception(f"Error executing Xray scan: {result.stderr}")
+                if any(
+                    word in result.stderr
+                    for word in config["XRAY"]["STDERR_ACCEPTED_ERRORS"]
                 ):
                     logger.error(f"Error executing Xray scan: {result.stderr}")
                     return None
@@ -142,12 +148,14 @@ class XrayScan(ToolGateway):
         pipeline_name,
         to_scan,
         secret_tool,
-        token_engine_dependencies
+        token_engine_dependencies,
     ):
         token = secret_tool["token_xray"] if secret_tool else token_engine_dependencies
         if dict_args["xray_mode"] == "scan":
             get_artifacts = GetArtifacts()
-            pattern = get_artifacts.excluded_files(remote_config, pipeline_name, exclusion, "XRAY")
+            pattern = get_artifacts.excluded_files(
+                remote_config, pipeline_name, exclusion, "XRAY"
+            )
             to_scan = get_artifacts.find_artifacts(
                 to_scan, pattern, remote_config["XRAY"]["PACKAGES_TO_SCAN"]
             )
@@ -180,6 +188,7 @@ class XrayScan(ToolGateway):
         results_file = self.scan_dependencies(
             command_prefix,
             cwd,
+            remote_config,
             dict_args["xray_mode"],
             to_scan,
         )

{devsecops_engine_tools-1.11.5 → devsecops_engine_tools-1.13.0}/devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/helpers/get_artifacts.py

@@ -9,6 +9,7 @@ from devsecops_engine_tools.engine_utilities import settings
 
 logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 
+
 class GetArtifacts:
 
     def excluded_files(self, remote_config, pipeline_name, exclusions, tool):
@@ -29,7 +30,7 @@ class GetArtifacts:
                         pattern = pattern2
 
         return pattern
-    
+
     def find_packages(self, pattern, packages, working_dir):
         packages_list = []
         files_list = []
@@ -47,7 +48,7 @@ class GetArtifacts:
                     if extension_pattern.search(file):
                         files_list.append(os.path.join(root, file))
         return packages_list, files_list
-    
+
     def compress_and_mv(self, tar_path, package):
         try:
             with tarfile.open(tar_path, "w") as tar:
@@ -65,7 +66,7 @@ class GetArtifacts:
             target = os.path.join(dir_to_scan_path, os.path.basename(file))
             shutil.copy2(file, target)
             logger.debug(f"File to scan: {file}")
-    
+
     def find_artifacts(self, to_scan, pattern, packages):
         dir_to_scan_path = os.path.join(to_scan, "dependencies_to_scan")
         if os.path.exists(dir_to_scan_path):

devsecops_engine_tools-1.13.0/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.13.0'

{devsecops_engine_tools-1.11.5 → devsecops_engine_tools-1.13.0}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.11.5
+Version: 1.13.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

devsecops_engine_tools-1.11.5/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.11.5'