devsecops-engine-tools 1.14.3__tar.gz → 1.14.5__tar.gz

{devsecops_engine_tools-1.14.3 → devsecops_engine_tools-1.14.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.14.3
+Version: 1.14.5
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.14.3 → devsecops_engine_tools-1.14.5}/devsecops_engine_tools/engine_sast/engine_secret/src/domain/model/DeserializeConfigTool.py

@@ -12,3 +12,4 @@ class DeserializeConfigTool:
         self.enable_custom_rules = json_data[tool]["ENABLE_CUSTOM_RULES"]
         self.external_dir_owner = json_data[tool]["EXTERNAL_DIR_OWNER"]
         self.external_dir_repo = json_data[tool]["EXTERNAL_DIR_REPOSITORY"]
+        self.tool_version = json_data[tool]["VERSION"]

{devsecops_engine_tools-1.14.3 → devsecops_engine_tools-1.14.5}/devsecops_engine_tools/engine_sast/engine_secret/src/domain/model/gateway/tool_gateway.py

@@ -3,7 +3,7 @@ from devsecops_engine_tools.engine_sast.engine_secret.src.domain.model.Deseriali
 
 class ToolGateway(metaclass=ABCMeta):
     @abstractmethod
-    def install_tool(self, agent_os: str, agent_temp_dir:str) -> any:
+    def install_tool(self, agent_os: str, agent_temp_dir:str, version: str) -> any:
         "install tool"
     @abstractmethod
     def run_tool_secret_scan(self,
@@ -13,5 +13,6 @@ class ToolGateway(metaclass=ABCMeta):
                             repository_name: str,
                             config_tool: DeserializeConfigTool,
                             secret_tool,
-                            secret_external_checks) -> str:
+                            secret_external_checks,
+                            agent_tem_dir:str) -> str:
         "run tool secret scan"

{devsecops_engine_tools-1.14.3 → devsecops_engine_tools-1.14.5}/devsecops_engine_tools/engine_sast/engine_secret/src/domain/usecases/secret_scan.py

@@ -34,7 +34,7 @@ class SecretScan:
         file_path_findings = ""
         secret_external_checks=dict_args["token_external_checks"]
         if skip_tool == False:
-            self.tool_gateway.install_tool(self.devops_platform_gateway.get_variable("os"), self.devops_platform_gateway.get_variable("temp_directory"))
+            self.tool_gateway.install_tool(self.devops_platform_gateway.get_variable("os"), self.devops_platform_gateway.get_variable("temp_directory"), config_tool.tool_version)
             files_pullrequest = self.git_gateway.get_files_pull_request(
                 self.devops_platform_gateway.get_variable("path_directory"),
                 self.devops_platform_gateway.get_variable("target_branch"),
@@ -52,7 +52,8 @@ class SecretScan:
                     self.devops_platform_gateway.get_variable("repository"),
                     config_tool,
                     secret_tool,
-                    secret_external_checks)
+                    secret_external_checks,
+                    self.devops_platform_gateway.get_variable("temp_directory"))
             finding_list = self.tool_deserialize.get_list_vulnerability(
                 findings,
                 self.devops_platform_gateway.get_variable("os"),

{devsecops_engine_tools-1.14.3 → devsecops_engine_tools-1.14.5}/devsecops_engine_tools/engine_sast/engine_secret/src/infrastructure/driven_adapters/trufflehog/trufflehog_run.py

@@ -19,26 +19,35 @@ result = []
 
 
 class TrufflehogRun(ToolGateway):
-    def install_tool(self, agent_os, agent_temp_dir) -> any:
+    def install_tool(self, agent_os, agent_temp_dir, tool_version) -> any:
         reg_exp_os = r"Windows"
         check_os = re.search(reg_exp_os, agent_os)
+        reg_exp_tool = fr"{tool_version}"
         if check_os:
-            self.run_install_win(agent_temp_dir)
+            command = f"{agent_temp_dir}/trufflehog.exe --version"
+            subprocess.run(command, shell=True)
+            result = subprocess.run(command, capture_output=True, shell=True)
+            output = result.stderr.strip()
+            check_tool = re.search(reg_exp_tool, output.decode("utf-8"))
+            if not check_tool:
+                self.run_install_win(agent_temp_dir, tool_version)
+                subprocess.run(command, shell=True)
         else:
             command = f"trufflehog --version"
+            subprocess.run(command, shell=True)
             result = subprocess.run(command, capture_output=True, shell=True)
             output = result.stderr.strip()
-            reg_exp = r"not found"
-            check_tool = re.search(reg_exp, output.decode("utf-8"))
-            if check_tool:
-                self.run_install()
+            check_tool = re.search(reg_exp_tool, output.decode("utf-8"))
+            if not check_tool:
+                self.run_install(tool_version)
+                subprocess.run(command, shell=True)
 
-    def run_install(self):
-        command = f"curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin"
-        subprocess.run(command, capture_output=True, shell=True)
+    def run_install(self, tool_version):
+        command = f"curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin v{tool_version}"
+        res = subprocess.run(command, capture_output=True, shell=True)
 
-    def run_install_win(self, agent_temp_dir):
-        command_complete = f"powershell -Command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; [Net.ServicePointManager]::SecurityProtocol; New-Item -Path {agent_temp_dir} -ItemType Directory -Force; Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh' -OutFile {agent_temp_dir}\install_trufflehog.sh; bash {agent_temp_dir}\install_trufflehog.sh -b C:/Trufflehog/bin; $env:Path += ';C:/Trufflehog/bin'; C:/Trufflehog/bin/trufflehog.exe --version"
+    def run_install_win(self, agent_temp_dir, tool_version):
+        command_complete = f"powershell -Command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; [Net.ServicePointManager]::SecurityProtocol; New-Item -Path {agent_temp_dir} -ItemType Directory -Force; Invoke-WebRequest -Uri 'https://github.com/trufflesecurity/trufflehog/releases/download/v{tool_version}/trufflehog_{tool_version}_windows_amd64.tar.gz' -OutFile {agent_temp_dir}/trufflehog.tar.gz -UseBasicParsing; tar -xzf {agent_temp_dir}/trufflehog.tar.gz -C {agent_temp_dir}; Remove-Item {agent_temp_dir}/trufflehog.tar.gz; $env:Path += '; + {agent_temp_dir}'; & {agent_temp_dir}/trufflehog.exe --version"
         process = subprocess.Popen(
             command_complete, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True
         )
@@ -52,15 +61,16 @@ class TrufflehogRun(ToolGateway):
         repository_name,
         config_tool,
         secret_tool,
-        secret_external_checks
+        secret_external_checks,
+        agent_temp_dir
     ):
         trufflehog_command = "trufflehog"
         if "Windows" in agent_os:
-            trufflehog_command = "C:/Trufflehog/bin/trufflehog.exe"
+            trufflehog_command = f"{agent_temp_dir}/trufflehog.exe"
         with open(f"{agent_work_folder}/excludedPath.txt", "w") as file:
             file.write("\n".join(config_tool.exclude_path))
         exclude_path = f"{agent_work_folder}/excludedPath.txt"
-        include_paths = self.config_include_path(files_commits, agent_work_folder)
+        include_paths = self.config_include_path(files_commits, agent_work_folder, agent_os)
         enable_custom_rules = config_tool.enable_custom_rules.lower()
         secret = None
         
@@ -87,7 +97,7 @@ class TrufflehogRun(ToolGateway):
         findings, file_findings = self.create_file(self.decode_output(results), agent_work_folder)
         return  findings, file_findings
 
-    def config_include_path(self, files, agent_work_folder):
+    def config_include_path(self, files, agent_work_folder, agent_os):
         chunks = []
         if len(files) != 0:
             chunk_size = (len(files) + 3) // 4
@@ -102,6 +112,8 @@ class TrufflehogRun(ToolGateway):
             include_paths.append(file_path)
             with open(file_path, "w") as file:
                 for file_pr_path in chunk:
+                    if "Windows" in agent_os:
+                        file_pr_path = str(file_pr_path).replace("/","\\\\")
                     file.write(f"{file_pr_path.strip()}\n")
         return include_paths
 
@@ -119,7 +131,7 @@ class TrufflehogRun(ToolGateway):
         if enable_custom_rules == "true":
             command = command.replace("--no-verification --json", "--config /tmp/rules/trufflehog/custom-rules.yaml --no-verification --json")
 
-        result = subprocess.run(command, capture_output=True, shell=True, text=True)
+        result = subprocess.run(command, capture_output=True, shell=True, text=True, encoding='utf-8')
         return result.stdout.strip()
 
     def decode_output(self, results):

devsecops_engine_tools-1.14.5/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.14.5'

{devsecops_engine_tools-1.14.3 → devsecops_engine_tools-1.14.5}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.14.3
+Version: 1.14.5
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

devsecops_engine_tools-1.14.3/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.14.3'