devsecops-engine-tools 1.13.1__tar.gz → 1.13.3__tar.gz

{devsecops_engine_tools-1.13.1 → devsecops_engine_tools-1.13.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.13.1
+Version: 1.13.3
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.13.1 → devsecops_engine_tools-1.13.3}/devsecops_engine_tools/engine_core/src/domain/model/exclusions.py

@@ -5,10 +5,10 @@ from dataclasses import dataclass
 class Exclusions:
     def __init__(self, **kwargs):
         self.id = kwargs.get("id", "")
-        self.where = kwargs.get("where", "")
+        self.where = kwargs.get("where", "all")
         self.cve_id = kwargs.get("cve_id", "")
         self.create_date = kwargs.get("create_date", "")
         self.expired_date = kwargs.get("expired_date", "")
         self.severity = kwargs.get("severity", "")
         self.hu = kwargs.get("hu", "")
-        self.reason = kwargs.get("reason", "Risk acceptance")
+        self.reason = kwargs.get("reason", "Risk Accepted")

{devsecops_engine_tools-1.13.1 → devsecops_engine_tools-1.13.3}/devsecops_engine_tools/engine_core/src/domain/usecases/handle_risk.py

@@ -106,16 +106,40 @@ class HandleRisk:
             return remaining_services
         return service_list
 
-    def process(self, dict_args: any, remote_config: any):
-        secret_tool = None
-        if dict_args["use_secrets_manager"] == "true":
-            secret_tool = self.secrets_manager_gateway.get_secret(remote_config)
+    def _should_skip_analysis(self, remote_config, pipeline_name, exclusions):
+        ignore_pattern = remote_config["IGNORE_ANALYSIS_PATTERN"]
+        return re.match(ignore_pattern, pipeline_name, re.IGNORECASE) or (
+            pipeline_name in exclusions
+            and exclusions[pipeline_name].get("SKIP_TOOL", 0)
+        )
 
+    def process(self, dict_args: any, remote_config: any):
         risk_config = self.devops_platform_gateway.get_remote_config(
             dict_args["remote_config_repo"], "engine_risk/ConfigTool.json"
         )
-
+        risk_exclusions = self.devops_platform_gateway.get_remote_config(
+            dict_args["remote_config_repo"], "engine_risk/Exclusions.json"
+        )
         pipeline_name = self.devops_platform_gateway.get_variable("pipeline_name")
+
+        input_core = InputCore(
+            [],
+            {},
+            "",
+            "",
+            pipeline_name,
+            self.devops_platform_gateway.get_variable("stage").capitalize(),
+        )
+
+        if self._should_skip_analysis(risk_config, pipeline_name, risk_exclusions):
+            print("Tool skipped by DevSecOps Policy.")
+            logger.info("Tool skipped by DevSecOps Policy.")
+            return [], input_core
+
+        secret_tool = None
+        if dict_args["use_secrets_manager"] == "true":
+            secret_tool = self.secrets_manager_gateway.get_secret(remote_config)
+
         service = pipeline_name
         service_list = []
 
@@ -180,15 +204,9 @@ class HandleRisk:
             dict_args,
             findings,
             exclusions,
+            new_service_list,
             self.devops_platform_gateway,
             self.print_table_gateway,
         )
-        input_core = InputCore(
-            [],
-            {},
-            "",
-            "",
-            pipeline_name,
-            self.devops_platform_gateway.get_variable("stage").capitalize(),
-        )
+
         return result, input_core

{devsecops_engine_tools-1.13.1 → devsecops_engine_tools-1.13.3}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/defect_dojo/defect_dojo.py

@@ -220,7 +220,8 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
             all_findings_query_params = {
                 "limit": config_tool["VULNERABILITY_MANAGER"]["DEFECT_DOJO"][
                     "LIMITS_QUERY"
-                ]
+                ],
+                "duplicate": "false"
             }
             max_retries = config_tool["VULNERABILITY_MANAGER"]["DEFECT_DOJO"][
                 "MAX_RETRIES_QUERY"

{devsecops_engine_tools-1.13.1 → devsecops_engine_tools-1.13.3}/devsecops_engine_tools/engine_risk/src/applications/runner_engine_risk.py

@@ -13,7 +13,12 @@ logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 
 
 def runner_engine_risk(
-    dict_args, findings, vm_exclusions, devops_platform_gateway, print_table_gateway
+    dict_args,
+    findings,
+    vm_exclusions,
+    services,
+    devops_platform_gateway,
+    print_table_gateway,
 ):
     add_epss_gateway = FirstCsv()
 
@@ -23,5 +28,6 @@ def runner_engine_risk(
         print_table_gateway,
         dict_args,
         findings,
+        services,
         vm_exclusions,
     )

{devsecops_engine_tools-1.13.1 → devsecops_engine_tools-1.13.3}/devsecops_engine_tools/engine_risk/src/domain/usecases/break_build.py

@@ -118,9 +118,11 @@ class BreakBuild:
 
     def _remediation_rate_control(self, all_report: "list[Report]"):
         remote_config = self.remote_config
-        remediation_rate_value = self._get_percentage(
-            (sum(1 for report in all_report if report.mitigated)) / len(all_report)
-        )
+        mitigated = sum(1 for report in all_report if report.mitigated)
+        total = len(all_report)
+        print(f"Mitigated count: {mitigated}   Total count: {total}")
+        remediation_rate_value = self._get_percentage(mitigated / total)
+
         risk_threshold = remote_config["THRESHOLD"]["REMEDIATION_RATE"]
         self.remediation_rate = remediation_rate_value
 
@@ -151,14 +153,6 @@ class BreakBuild:
     def _get_percentage(self, decimal):
         return round(decimal * 100, 3)
 
-    def _get_applied_exclusion(self, report: Report):
-        for exclusion in self.exclusions:
-            if exclusion.id and (report.id == exclusion.id):
-                return exclusion
-            elif exclusion.id and (report.vuln_id_from_tool == exclusion.id):
-                return exclusion
-        return None
-
     def _map_applied_exclusion(self, exclusions: "list[Exclusions]"):
         return [
             {
@@ -173,22 +167,27 @@ class BreakBuild:
         ]
 
     def _apply_exclusions(self, report_list: "list[Report]"):
-        new_report_list = []
+        filtered_reports = []
         applied_exclusions = []
-        exclusions_ids = {exclusion.id for exclusion in self.exclusions if exclusion.id}
 
         for report in report_list:
-            if report.vuln_id_from_tool and (
-                report.vuln_id_from_tool in exclusions_ids
-            ):
-                applied_exclusions.append(self._get_applied_exclusion(report))
-            elif report.id and (report.id in exclusions_ids):
-                applied_exclusions.append(self._get_applied_exclusion(report))
-            else:
+            exclude = False
+            for exclusion in self.exclusions:
+                if (
+                    (
+                        report.vuln_id_from_tool
+                        and report.vuln_id_from_tool == exclusion.id
+                    )
+                    or (report.id and report.id == exclusion.id)
+                ) and ((exclusion.where in report.where) or (exclusion.where == "all")):
+                    exclude = True
+                    applied_exclusions.append(exclusion)
+                    break
+            if not exclude:
                 report.reason = "Remediation Rate"
-                new_report_list.append(report)
+                filtered_reports.append(report)
 
-        return new_report_list, applied_exclusions
+        return filtered_reports, applied_exclusions
 
     def _tag_blacklist_control(self, report_list: "list[Report]"):
         remote_config = self.remote_config

{devsecops_engine_tools-1.13.1 → devsecops_engine_tools-1.13.3}/devsecops_engine_tools/engine_risk/src/domain/usecases/get_exclusions.py

@@ -11,14 +11,14 @@ class GetExclusions:
         findings,
         risk_config,
         risk_exclusions,
-        pipeline_name,
+        services,
     ):
         self.devops_platform_gateway = devops_platform_gateway
         self.dict_args = dict_args
         self.findings = findings
         self.risk_config = risk_config
         self.risk_exclusions = risk_exclusions
-        self.pipeline_name = pipeline_name
+        self.services = services
 
     def process(self):
         core_config = self.devops_platform_gateway.get_remote_config(
@@ -49,7 +49,8 @@ class GetExclusions:
 
     def _get_exclusions(self, config, key):
         exclusions = []
-        for scope in ["All", self.pipeline_name]:
+        scope_list = ["All"] + self.services
+        for scope in scope_list:
             if config.get(scope, None) and config[scope].get(key, None):
                 exclusions.extend(
                     [

{devsecops_engine_tools-1.13.1 → devsecops_engine_tools-1.13.3}/devsecops_engine_tools/engine_risk/src/infrastructure/entry_points/entry_point_risk.py

@@ -26,6 +26,7 @@ def init_engine_risk(
     print_table_gateway,
     dict_args,
     findings,
+    services,
     vm_exclusions,
 ):
     remote_config = devops_platform_gateway.get_remote_config(
@@ -34,17 +35,12 @@ def init_engine_risk(
     risk_exclusions = devops_platform_gateway.get_remote_config(
         dict_args["remote_config_repo"], "engine_risk/Exclusions.json"
     )
-    pipeline_name = devops_platform_gateway.get_variable("pipeline_name")
-    if should_skip_analysis(remote_config, pipeline_name, risk_exclusions):
-        print("Tool skipped by DevSecOps Policy.")
-        logger.info("Tool skipped by DevSecOps Policy.")
-        return
 
     return process_findings(
         findings,
         vm_exclusions,
         dict_args,
-        pipeline_name,
+        services,
         risk_exclusions,
         remote_config,
         add_epss_gateway,
@@ -53,18 +49,11 @@ def init_engine_risk(
     )
 
 
-def should_skip_analysis(remote_config, pipeline_name, exclusions):
-    ignore_pattern = remote_config["IGNORE_ANALYSIS_PATTERN"]
-    return re.match(ignore_pattern, pipeline_name, re.IGNORECASE) or (
-        pipeline_name in exclusions and exclusions[pipeline_name].get("SKIP_TOOL", 0)
-    )
-
-
 def process_findings(
     findings,
     vm_exclusions,
     dict_args,
-    pipeline_name,
+    services,
     risk_exclusions,
     remote_config,
     add_epss_gateway,
@@ -86,7 +75,7 @@ def process_findings(
         dict_args,
         remote_config,
         risk_exclusions,
-        pipeline_name,
+        services,
         add_epss_gateway,
         print_table_gateway,
     )
@@ -100,7 +89,7 @@ def process_active_findings(
     dict_args,
     remote_config,
     risk_exclusions,
-    pipeline_name,
+    services,
     add_epss_gateway,
     print_table_gateway,
 ):
@@ -111,7 +100,7 @@ def process_active_findings(
         data_added,
         remote_config,
         risk_exclusions,
-        pipeline_name,
+        services,
     )
     exclusions = get_exclusions.process()
     break_build = BreakBuild(

{devsecops_engine_tools-1.13.1 → devsecops_engine_tools-1.13.3}/devsecops_engine_tools/engine_sast/engine_secret/src/infrastructure/driven_adapters/trufflehog/trufflehog_run.py

@@ -140,6 +140,8 @@ class TrufflehogRun(ToolGateway):
                 original_where = original_where.replace("\\", "/")
                 where_text = original_where.replace(agent_work_folder, "")
                 find["SourceMetadata"]["Data"]["Filesystem"]["file"] = where_text
+                name = find["ExtraData"]["name"] if find["ExtraData"] != None else None
+                find["Id"] = "MISSCONFIGURATION_SCANNING" if name != None and "Actuator" in name else "SECRET_SCANNING"
                 json_str = json.dumps(find)
                 file.write(json_str + '\n')
         return findings, file_findings

devsecops_engine_tools-1.13.3/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.13.3'

{devsecops_engine_tools-1.13.1 → devsecops_engine_tools-1.13.3}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.13.1
+Version: 1.13.3
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

devsecops_engine_tools-1.13.1/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.13.1'