devsecops-engine-tools 1.115.1__tar.gz → 1.116.0__tar.gz

{devsecops_engine_tools-1.115.1 → devsecops_engine_tools-1.116.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devsecops-engine-tools
-Version: 1.115.1
+Version: 1.116.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team
@@ -29,7 +29,7 @@ Requires-Dist: rich==14.1.0
 Requires-Dist: cpe==1.3.1
 Requires-Dist: packageurl-python==0.13.4
 Requires-Dist: ruamel.yaml==0.18.15
-Requires-Dist: Authlib==1.6.4
+Requires-Dist: Authlib==1.6.5
 Requires-Dist: PyJWT==2.10.1
 Requires-Dist: sympy==1.14.0
 Requires-Dist: urllib3==1.26.20

{devsecops_engine_tools-1.115.1 → devsecops_engine_tools-1.116.0}/devsecops_engine_tools/engine_core/src/applications/runner_engine_core.py

@@ -125,6 +125,7 @@ def get_inputs_from_cli(args):
             "engine_dependencies",
             "engine_container",
             "engine_risk",
+            "engine_function",
         ],
         type=str,
         required=True,
@@ -246,6 +247,7 @@ def get_inputs_from_cli(args):
         "engine_code": ["bearer", "kiuwan"],
         "engine_dast": ["nuclei"],
         "engine_risk": None,
+        "engine_function": ["prisma"],
     }
 
     args = parser.parse_args()

{devsecops_engine_tools-1.115.1 → devsecops_engine_tools-1.116.0}/devsecops_engine_tools/engine_core/src/domain/usecases/handle_scan.py

@@ -36,6 +36,9 @@ from devsecops_engine_tools.engine_sca.engine_container.src.applications.runner_
 from devsecops_engine_tools.engine_sca.engine_dependencies.src.applications.runner_dependencies_scan import (
     runner_engine_dependencies,
 )
+from devsecops_engine_tools.engine_sca.engine_function.src.applications.runner_function_scan import (
+    runner_engine_function,
+)
 from devsecops_engine_tools.engine_dast.src.applications.runner_dast_scan import (
     runner_engine_dast,
 )
@@ -100,6 +103,22 @@ class HandleScan:
                 sbom_components,
             )
             return findings_list, input_core
+        elif "engine_function" in dict_args["module"]:
+            findings_list, input_core = runner_engine_function(
+                dict_args,
+                config_tool["ENGINE_FUNCTION"],
+                secret_tool,
+                self.devops_platform_gateway,
+                self.remote_config_source_gateway
+            )
+            self._use_vulnerability_management(
+                config_tool,
+                input_core,
+                dict_args,
+                secret_tool,
+                env
+            )
+            return findings_list, input_core
         elif "engine_dast" in dict_args["module"]:
             findings_list, input_core = runner_engine_dast(
                 dict_args,

{devsecops_engine_tools-1.115.1 → devsecops_engine_tools-1.116.0}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/printer_pretty_table/printer_pretty_table.py

@@ -27,9 +27,7 @@ class PrinterPrettyTable(PrinterTableGateway):
                 finding.description,
                 finding.where,
             ]
-            if (finding.module == "engine_container") or (
-                finding.module == "engine_dependencies"
-            ):
+            if finding.module in ("engine_container", "engine_dependencies", "engine_function"):
                 row_data.append(finding.requirements)
             elif finding.module == "engine_code":
                 row_data.append(finding.cvss)
@@ -53,9 +51,8 @@ class PrinterPrettyTable(PrinterTableGateway):
         if (
             finding_list
             and (
-                (finding_list[0].module == "engine_container") 
-                or (finding_list[0].module == "engine_dependencies")
-                )
+                finding_list[0].module in ["engine_container","engine_dependencies", "engine_function"]
+            )
         ):
             headers = ["Severity", "ID", "Description", "Where", "Fixed in"]
         elif finding_list and finding_list[0].module == "engine_code":

{devsecops_engine_tools-1.115.1 → devsecops_engine_tools-1.116.0}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/prisma_cloud/prisma_cloud_manager_scan.py

@@ -1,10 +1,8 @@
-import stat
 import requests
 import os
 import subprocess
 import base64
 import json
-import platform
 from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.gateways.tool_gateway import (
     ToolGateway,
 )
@@ -13,55 +11,18 @@ from devsecops_engine_tools.engine_utilities.sbom.deserealizator import (
 )
 from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
 from devsecops_engine_tools.engine_utilities import settings
+from devsecops_engine_tools.engine_utilities.twistcli_utils.twistcli_utils import download_twistcli
 
 logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 
 
 class PrismaCloudManagerScan(ToolGateway):
-    def download_twistcli(
-        self,
-        file_path,
-        prisma_key,
-        prisma_console_url,
-        prisma_api_version,
-    ):
-        
-        machine = platform.machine()
-        system = platform.system()
-
-        base_url = f"{prisma_console_url}/api/{prisma_api_version}/util"
-
-        os_mapping = {
-            "Linux": "twistcli",
-            "Windows": "windows/twistcli.exe",
-            "Darwin": "osx/twistcli",
-        }
-
-        url = f"{base_url}/{os_mapping[system]}"
-
-        if system == "Linux" and machine == "aarch64":
-            url = f"{base_url}/arm64/twistcli"
-        elif system == "Darwin" and machine == "aarch64":
-            url = f"{base_url}/osx/arm64/twistcli"
-
-        credentials = base64.b64encode(
-            prisma_key.encode()
-        ).decode()
-        headers = {"Authorization": f"Basic {credentials}"}
-        try:
-            response = requests.get(url, headers=headers)
-            response.raise_for_status()
-
-            with open(file_path, "wb") as file:
-                file.write(response.content)
-
-            os.chmod(file_path, stat.S_IRWXU)
-            logger.info(f"twistcli downloaded and saved to: {file_path}")
-            return 0
-
-        except Exception as e:
-            raise ValueError(f"Error downloading twistcli: {e}")
-
+    def download_twistcli(self, file_path, prisma_key, prisma_console_url, prisma_api_version) -> int:
+        """
+        Método de instancia separado (lo que usan los tests),
+        delega en el util compat 'basic' para no romper aserciones.
+        """
+        return download_twistcli(file_path, prisma_key, prisma_console_url, prisma_api_version)
     def scan_image(
         self, file_path, image_name, result_file, remoteconfig, prisma_key, docker_address
     ):
@@ -168,7 +129,6 @@ class PrismaCloudManagerScan(ToolGateway):
         except Exception as e:
             logger.error(f"Error generating SBOM: {e}")
 
-
     def _split_prisma_token(self, prisma_key):
         try:
             access_prisma, token_prisma = prisma_key.split(":")

devsecops_engine_tools-1.116.0/devsecops_engine_tools/engine_sca/engine_function/src/applications/runner_function_scan.py

@@ -0,0 +1,32 @@
+from devsecops_engine_tools.engine_sca.engine_function.src.infrastructure.entry_points.entry_point_tool import (
+    init_engine_sca_rm,
+)
+from devsecops_engine_tools.engine_sca.engine_function.src.infrastructure.driven_adapters.prisma_cloud.prisma_cloud_manager_scan import (
+    PrismaCloudManagerScan,
+)
+from devsecops_engine_tools.engine_sca.engine_function.src.infrastructure.driven_adapters.prisma_cloud.prisma_deserialize_output import (
+    PrismaDeserealizator,
+)
+
+
+def runner_engine_function(dict_args, config_tool, secret_tool, tool_remote, remote_config_source_gateway):
+    try:
+        if config_tool["TOOL"].lower() == "prisma":
+            tool_run = PrismaCloudManagerScan(config_tool, dict_args)
+            tool_deseralizator = PrismaDeserealizator()
+        return init_engine_sca_rm(
+            tool_run,
+            tool_remote,
+            remote_config_source_gateway,
+            tool_deseralizator,
+            dict_args,
+            secret_tool,
+            config_tool,
+        )
+
+    except Exception as e:
+        raise Exception(f"Error SCAN engine function : {str(e)}")
+
+
+if __name__ == "__main__":
+    runner_engine_function()

devsecops_engine_tools-1.116.0/devsecops_engine_tools/engine_sca/engine_function/src/domain/model/gateways/deserealizator_gateway.py

@@ -0,0 +1,8 @@
+from abc import ABCMeta, abstractmethod
+from devsecops_engine_tools.engine_core.src.domain.model.finding import Finding
+
+
+class DeseralizatorGateway(metaclass=ABCMeta):
+    @abstractmethod
+    def get_list_findings(self, results_scan_list: list) -> "list[Finding]":
+        "Deseralizator"

devsecops_engine_tools-1.116.0/devsecops_engine_tools/engine_sca/engine_function/src/domain/model/gateways/tool_gateway.py

@@ -0,0 +1,13 @@
+from abc import ABCMeta, abstractmethod
+
+
+class ToolGateway(metaclass=ABCMeta):
+    @abstractmethod
+    def run_tool_function_sca(
+        self,
+        dict_args,
+        token:str=None,
+        skip_flag:bool=None,
+    ) -> str:
+        
+        "run tool function sca"

devsecops_engine_tools-1.116.0/devsecops_engine_tools/engine_sca/engine_function/src/domain/usecases/function_sca_scan.py

@@ -0,0 +1,71 @@
+from devsecops_engine_tools.engine_core.src.domain.model.gateway.devops_platform_gateway import (
+    DevopsPlatformGateway,
+)
+from devsecops_engine_tools.engine_sca.engine_function.src.domain.model.gateways.tool_gateway import (
+    ToolGateway,
+)
+from devsecops_engine_tools.engine_sca.engine_function.src.domain.model.gateways.deserealizator_gateway import (
+    DeseralizatorGateway,
+)
+
+
+class FunctionScaScan:
+    def __init__(
+        self,
+        tool_run: ToolGateway,
+        remote_config,
+        tool_remote: DevopsPlatformGateway,
+        tool_deseralizator: DeseralizatorGateway,
+        dict_args,
+        secret_tool,
+        token_engine_container
+    ):
+        self.tool_run = tool_run
+        self.remote_config = remote_config
+        self.tool_remote = tool_remote
+        self.tool_deseralizator = tool_deseralizator
+        self.dict_args = dict_args
+        self.secret_tool = secret_tool
+        self.token_engine_container = token_engine_container
+
+    def get_remote_config(self, file_path):
+        """
+        Get remote configuration.
+
+        Returns:
+            dict: Remote configuration.
+        """
+        return self.tool_remote.get_remote_config(self.dict_args["remote_config_repo"], file_path, self.dict_args["remote_config_branch"])
+
+
+    def get_variable(self, variable):
+        """
+        Get variable.
+
+        Returns:
+            dict: Remote variable.
+        """
+        return self.tool_remote.get_variable(variable)
+
+    def process(self):
+        """
+        Process SCA scanning.
+
+        Returns:
+            dict: SCA scanning results.
+        """
+
+        return self.tool_run.run_tool_function_sca(
+            self.get_remote_config("engine_sca/engine_function/ConfigTool.json"),
+            self.secret_tool,
+            self.token_engine_container,
+        )
+
+    def deseralizator(self, function_scanned):
+        """
+        Process the results deserializer.
+
+        Returns:
+            list: Deserialized list of findings.
+        """
+        return self.tool_deseralizator.get_list_findings(function_scanned)

devsecops_engine_tools-1.116.0/devsecops_engine_tools/engine_sca/engine_function/src/domain/usecases/handle_remote_config_patterns.py

@@ -0,0 +1,73 @@
+import re
+
+class HandleRemoteConfigPatterns:
+    def __init__(self, remote_config, exclusions, pipeline_name):
+        self.remote_config = remote_config
+        self.exclusions = exclusions
+        self.pipeline_name = pipeline_name
+
+    def get_remote_config(self, file_path):
+        """
+        Get remote configuration
+        Return: dict: Remote configuration
+        """
+        return self.tool_remote.get_remote_config(
+            self.dict_args["remote_config_repo"], file_path, self.dict_args["remote_config_branch"]
+        )
+
+    def get_variable(self, variable):
+        """
+        Get variable.
+
+        Returns:
+            dict: Remote variable.
+        """
+        return self.tool_remote.get_variable(variable)
+    
+    def handle_skip_tool(self, exclusions, pipeline_name):
+        """
+        Handle skip tool.
+
+        Return: bool: True -> skip tool, False -> not skip tool.
+        """
+        if (pipeline_name in exclusions) and (
+            exclusions[pipeline_name].get("SKIP_TOOL", 0)
+        ):
+            return True
+        else:
+            return False
+
+    def process_handle_skip_tool(self):
+        """
+        Process handle skip tool.
+
+        Return: bool: True -> skip tool, False -> not skip tool.
+        """
+        return self.handle_skip_tool(
+            self.get_remote_config("engine_sca/engine_function/Exclusions.json"),
+            self.get_variable("pipeline_name"),
+        )
+    
+    def ignore_analysis_pattern(self):
+        """
+        Handle analysis pattern.
+        Return: bool: False -> not scan, True -> scan.
+        """
+        ignore = self.remote_config["IGNORE_SEARCH_PATTERN"]
+        if re.match(ignore, self.pipeline_name, re.IGNORECASE):
+            return False
+        else:
+            return True
+
+    def skip_from_exclusion(self):
+        """
+        Handle skip tool.
+
+        Return: bool: True -> skip tool, False -> not skip tool.
+        """
+        if (self.pipeline_name in self.exclusions) and (
+            self.exclusions[self.pipeline_name].get("SKIP_TOOL", 0)
+        ):
+            return True
+        else:
+            return False

devsecops_engine_tools-1.116.0/devsecops_engine_tools/engine_sca/engine_function/src/domain/usecases/set_input_core.py

@@ -0,0 +1,76 @@
+from devsecops_engine_tools.engine_core.src.domain.model.input_core import InputCore
+from devsecops_engine_tools.engine_core.src.domain.model.threshold import Threshold
+from devsecops_engine_tools.engine_core.src.domain.model.gateway.devops_platform_gateway import (
+    DevopsPlatformGateway,
+)
+from devsecops_engine_tools.engine_core.src.domain.model.exclusions import Exclusions
+
+
+class SetInputCore:
+    def __init__(self, tool_remote: DevopsPlatformGateway, dict_args, config_tool):
+        self.tool_remote = tool_remote
+        self.dict_args = dict_args
+        self.config_tool = config_tool
+
+    def get_remote_config(self, file_path):
+        """
+        Get remote configuration.
+
+        Returns:
+            dict: Remote configuration.
+        """
+        return self.tool_remote.get_remote_config(self.dict_args["remote_config_repo"], file_path)
+
+    def get_variable(self, variable):
+        """
+        Get variable.
+
+        Returns:
+            dict: Remote variable.
+        """
+        return self.tool_remote.get_variable(variable)
+
+    def get_exclusions(self, exclusions_data, pipeline_name, tool):
+        list_exclusions = []
+        for key, value in exclusions_data.items():
+            if (key == "All") or (key == pipeline_name):
+                if value.get(tool, 0):
+                    exclusions = [
+                        Exclusions(
+                            id=item.get("id", ""),
+                            where=item.get("where", ""),
+                            cve_id=item.get("cve_id", ""),
+                            create_date=item.get("create_date", ""),
+                            expired_date=item.get("expired_date", ""),
+                            severity=item.get("severity", ""),
+                            hu=item.get("hu", ""),
+                            reason=item.get("reason", "DevSecOps policy"),
+                        )
+                        for item in value[tool]
+                    ]
+                    list_exclusions.extend(exclusions)
+        return list_exclusions
+
+    def set_input_core(self):
+        """
+        Set the input core.
+
+        Returns:
+            dict: Input core.
+        """        
+        
+        return InputCore(
+            self.get_exclusions(
+                self.get_remote_config("engine_sca/engine_function/Exclusions.json"),
+                self.get_variable("pipeline_name"),
+                self.config_tool["TOOL"],
+            ),
+            Threshold(
+                self.get_remote_config("engine_sca/engine_function/ConfigTool.json")["THRESHOLD"]
+            ),
+            None,
+            self.get_remote_config("engine_sca/engine_function/ConfigTool.json")["MESSAGE_INFO_ENGINE_FUNCTION"],
+            self.get_variable("pipeline_name"),
+            self.get_variable("pipeline_name"),
+            self.get_variable("stage"),
+        )

devsecops_engine_tools-1.116.0/devsecops_engine_tools/engine_sca/engine_function/src/infrastructure/driven_adapters/prisma_cloud/prisma_cloud_manager_scan.py

@@ -0,0 +1,175 @@
+import os
+import glob
+import subprocess
+import re
+from devsecops_engine_tools.engine_sca.engine_function.src.domain.model.gateways.tool_gateway import (
+    ToolGateway,
+)
+from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
+from devsecops_engine_tools.engine_utilities import settings
+from devsecops_engine_tools.engine_utilities.twistcli_utils.twistcli_utils import download_twistcli
+
+
+
+logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
+
+
+class PrismaCloudManagerScan:
+    def __init__(
+        self,
+        tool_run: ToolGateway,
+        dict_args
+    ):
+        self.tool_run = tool_run
+        self.dict_args = dict_args
+
+    def run_tool_function_sca(
+        self, 
+        remoteconfig, 
+        secret_tool,
+        token_engine_container,
+    ):
+        prisma_key = (
+            f"{secret_tool['access_prisma']}:{secret_tool['token_prisma']}" if secret_tool else token_engine_container
+        )
+        file_path = os.path.join(
+            os.getcwd(), remoteconfig["PRISMA_CLOUD"]["TWISTCLI_PATH"]
+        )
+        if not os.path.exists(file_path):
+            self.download_twistcli(
+                file_path,
+                prisma_key,
+                remoteconfig["PRISMA_CLOUD"]["PRISMA_CONSOLE_URL"],
+                remoteconfig["PRISMA_CLOUD"]["PRISMA_API_VERSION"],
+            )
+        folder_path = self.dict_args["folder_path"]
+        function_scan = self._scan_function(
+            file_path,
+            folder_path,
+            remoteconfig,
+            prisma_key,
+        )
+
+        return function_scan
+
+    def _split_prisma_token(self, prisma_key):
+        try:
+            access_prisma, token_prisma = prisma_key.split(":")
+            return access_prisma, token_prisma
+        except ValueError:
+            raise ValueError("The string is not properly formatted. Make sure it contains a ':'.")
+
+    def _scan_function(self, file_path, folder_path, remoteconfig, prisma_key):
+        function_path = glob.glob(os.path.join(folder_path, "*.zip"))
+        if not function_path:
+            print("No .zip file found [Scanning skipped]")
+            return None
+        zip_name = os.path.basename(function_path[0])
+        command = (
+            file_path,
+            "serverless",
+            "scan",
+            "--address",
+            remoteconfig["PRISMA_CLOUD"]["PRISMA_CONSOLE_URL"],
+            "--user",
+            self._split_prisma_token(prisma_key)[0],
+            "--password",
+            self._split_prisma_token(prisma_key)[1],
+            "--details",
+            function_path[0],
+        )
+        try:
+            result = subprocess.run(
+                command,
+                check=True,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                text=True,
+                errors="replace"
+            )
+            print(f"The function {zip_name} was scanned")
+            result = self._parse_scan_results(result.stdout)
+            return result
+
+        except subprocess.CalledProcessError as e:
+            logger.error(
+                f"Error during function scan of {zip_name}"
+                f"\n errorcode: {e.returncode}"
+                f"\n output: {e.output}"
+            )
+    def download_twistcli(self, file_path, prisma_key, prisma_console_url, prisma_api_version) -> int:
+        """
+        Método de instancia separado (lo que usan los tests),
+        delega en el util compat 'basic' para no romper aserciones.
+        """
+        return download_twistcli(file_path, prisma_key, prisma_console_url, prisma_api_version)
+
+    def _parse_scan_results(self, stdout: str) -> dict:
+        def extract_dist(pattern: str) -> dict:
+            match = re.search(pattern, stdout)
+            return {
+                "critical": int(match.group(2)),
+                "high": int(match.group(3)),
+                "medium": int(match.group(4)),
+                "low": int(match.group(5)),
+                "total": int(match.group(1))
+            } if match else {}
+
+        def clean_text(text) -> str:
+            cleaned_text = text.replace('\x1b[0m', '')
+            cleaned_text = cleaned_text.replace('\x1b[91;1m', '')
+            cleaned_text = cleaned_text.replace('\x1b[33;1m','')
+            return cleaned_text
+
+        def extract_table() -> list:
+            lines = stdout.splitlines()
+            table_start = [i for i, line in enumerate(lines) if 'CVE-' in line]
+            table_data = []
+            if table_start:
+                i = table_start[0]
+                while i < len(lines):
+                    if "CVE-" in lines[i]:
+                        row = lines[i]
+                        desc_lines = []
+                        i += 1
+                        while i < len(lines) and not lines[i].strip().startswith("| CVE-") and not "+---" in lines[i]:
+                            desc_lines.append(lines[i])
+                            i += 1
+                        full_row = row + "\n" + "\n".join(desc_lines)
+                        table_data.append(full_row)
+                    else:
+                        i += 1
+
+            vulnerabilities = []
+            for row in table_data:
+                parts = [x.strip() for x in row.split("|")[1:-1]]
+                if len(parts) >= 9:
+                    vuln = {
+                        "id": clean_text(parts[0]),
+                        "severity": clean_text(parts[1]),
+                        "cvss": float(clean_text(parts[2])) if parts[2] else 0.0,
+                        "packageName": clean_text(parts[3]),
+                        "packageVersion": clean_text(parts[4]),
+                        "status": clean_text(parts[5]),
+                        "publishedDate": clean_text(parts[6]),
+                        "discoveredDate": clean_text(parts[7]),
+                        "description": clean_text(parts[8]).replace("u00a0", " ").strip(" .") + "..."
+                    }
+                    vulnerabilities.append(vuln)
+            return vulnerabilities
+
+        name_match = re.search(r"Scan results for: function (.+?)\s", stdout)
+        function_name = name_match.group(1) if name_match else "unknown.zip"
+
+        return {
+            "results": [
+                {
+                    "name": function_name,
+                    "complianceDistribution": extract_dist(r"Compliance found for function .*?: total - (\d+), critical - (\d+), high - (\d+), medium - (\d+), low - (\d+)"),
+                    "complianceScanPassed": "Compliance threshold check results: PASS" in stdout,
+                    "vulnerabilities": extract_table(),
+                    "vulnerabilityDistribution": extract_dist(r"Vulnerabilities found for function .*?: total - (\d+), critical - (\d+), high - (\d+), medium - (\d+), low - (\d+)"),
+                    "vulnerabilityScanPassed": "Vulnerability threshold check results: PASS" in stdout
+                }
+            ]
+        }