devsecops-engine-tools 1.13.0__tar.gz → 1.13.2__tar.gz

{devsecops_engine_tools-1.13.0 → devsecops_engine_tools-1.13.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.13.0
+Version: 1.13.2
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.13.0 → devsecops_engine_tools-1.13.2}/devsecops_engine_tools/engine_core/src/domain/usecases/handle_risk.py

@@ -51,7 +51,9 @@ class HandleRisk:
                 "Error getting finding list in handle risk: {0}".format(str(e))
             )
 
-    def _filter_engagements(self, engagements, service, risk_config):
+    def _filter_engagements(
+        self, engagements, service, endings_to_exclude, risk_config
+    ):
         filtered_engagements = []
         min_word_length = risk_config["HANDLE_SERVICE_NAME"]["MIN_WORD_LENGTH"]
         words = [
@@ -63,6 +65,7 @@ class HandleRisk:
         ]
         check_words_regex = risk_config["HANDLE_SERVICE_NAME"]["REGEX_CHECK_WORDS"]
         min_word_amount = risk_config["HANDLE_SERVICE_NAME"]["MIN_WORD_AMOUNT"]
+
         for engagement in engagements:
             if service.lower() in engagement.name.lower():
                 filtered_engagements += [engagement.name]
@@ -71,6 +74,13 @@ class HandleRisk:
                 >= min_word_amount
             ):
                 filtered_engagements += [engagement.name]
+        if endings_to_exclude:
+            filtered_engagements = [
+                engagement
+                for engagement in filtered_engagements
+                if not any(engagement.endswith(ending) for ending in endings_to_exclude)
+            ]
+
         return filtered_engagements
 
     def _exclude_services(self, dict_args, pipeline_name, service_list):
@@ -82,16 +92,18 @@ class HandleRisk:
             and risk_exclusions[pipeline_name].get("SKIP_SERVICE", 0)
             and risk_exclusions[pipeline_name]["SKIP_SERVICE"].get("services", 0)
         ):
-            services_to_exclude = risk_exclusions[pipeline_name]["SKIP_SERVICE"].get(
-                "services", []
+            services_to_exclude = set(
+                risk_exclusions[pipeline_name]["SKIP_SERVICE"].get("services", [])
             )
-            service_excluded = []
-            for service in service_list:
-                if service in services_to_exclude:
-                    service_list.remove(service)
-                    service_excluded += [service]
+            service_set = set(service_list)
+
+            remaining_services = list(service_set - services_to_exclude)
+            service_excluded = list(service_set & services_to_exclude)
+
             print(f"Services to exclude: {service_excluded}")
             logger.info(f"Services to exclude: {service_excluded}")
+
+            return remaining_services
         return service_list
 
     def process(self, dict_args: any, remote_config: any):
@@ -108,12 +120,16 @@ class HandleRisk:
         service_list = []
 
         if risk_config["HANDLE_SERVICE_NAME"]["ENABLED"].lower() == "true":
+            exclusive_endings = risk_config["HANDLE_SERVICE_NAME"]["EXCLUSIVE_ENDING"]
+            endings_to_exclude = [
+                ending
+                for ending in exclusive_endings
+                if not pipeline_name.endswith(ending)
+            ]
             service = next(
                 (
                     pipeline_name.replace(ending, "")
-                    for ending in risk_config["HANDLE_SERVICE_NAME"][
-                        "ERASE_SERVICE_ENDING"
-                    ]
+                    for ending in exclusive_endings
                     if pipeline_name.endswith(ending)
                 ),
                 pipeline_name,
@@ -131,7 +147,7 @@ class HandleRisk:
                     service_code, dict_args, secret_tool, remote_config
                 )
                 service_list += self._filter_engagements(
-                    engagements, service, risk_config
+                    engagements, service, endings_to_exclude, risk_config
                 )
 
         service_list += [service]

{devsecops_engine_tools-1.13.0 → devsecops_engine_tools-1.13.2}/devsecops_engine_tools/engine_sast/engine_secret/src/infrastructure/driven_adapters/trufflehog/trufflehog_run.py

@@ -140,6 +140,8 @@ class TrufflehogRun(ToolGateway):
                 original_where = original_where.replace("\\", "/")
                 where_text = original_where.replace(agent_work_folder, "")
                 find["SourceMetadata"]["Data"]["Filesystem"]["file"] = where_text
+                name = find["ExtraData"]["name"] if find["ExtraData"] != None else None
+                find["Id"] = "MISSCONFIGURATION_SCANNING" if name != None and "Actuator" in name else "SECRET_SCANNING"
                 json_str = json.dumps(find)
                 file.write(json_str + '\n')
         return findings, file_findings

devsecops_engine_tools-1.13.2/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.13.2'

{devsecops_engine_tools-1.13.0 → devsecops_engine_tools-1.13.2}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.13.0
+Version: 1.13.2
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

devsecops_engine_tools-1.13.0/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.13.0'