PyPI - devsecops-engine-tools - Versions diffs - 1.162.0__tar.gz → 1.166.0__tar.gz - Mend

Files changed (467) hide show

{devsecops_engine_tools-1.162.0 → devsecops_engine_tools-1.166.0}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/prisma_cloud/prisma_cloud_manager_scan.py RENAMED Viewed

@@ -1,13 +1,18 @@
 import requests
 import os
+import re
+import shutil
 import subprocess
 import time
 import base64
 import json
-from typing import List
+from typing import List, Optional, Tuple
 from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.gateways.tool_gateway import (
     ToolGateway,
 )
+from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.context_container import (
+    ContextContainer,
+)
 from devsecops_engine_tools.engine_utilities.sbom.deserealizator import (
     get_list_component,
 )
@@ -198,19 +203,48 @@ class PrismaCloudManagerScan(ToolGateway):
             return access_prisma, token_prisma
         except ValueError:
             raise ValueError("The string is not properly formatted. Make sure it contains a ':'.")
-    def run_tool_container_sca(
-        self, remoteconfig, secret_tool, token_engine_container, image_name, result_file, base_image, exclusions, generate_sbom, docker_address, is_compressed_file=False
-    ):
-        prisma_key = (
-            f"{secret_tool['access_prisma']}:{secret_tool['token_prisma']}" if secret_tool else token_engine_container
-        )
-        file_path = os.path.join(
-            os.getcwd(), remoteconfig["PRISMA_CLOUD"]["TWISTCLI_PATH"]
-        )
-        sbom_components = None
+    def _parse_version(self, version_text: str) -> Optional[Tuple[int, ...]]:
+        match = re.search(r"(\d+(?:\.\d+)+)", version_text or "")
+        if not match:
+            return None
+        return tuple(int(part) for part in match.group(1).split("."))
+    def _get_twistcli_version(self, binary_path: str) -> Optional[Tuple[int, ...]]:
+        try:
+            result = subprocess.run(
+                [binary_path, "--version"],
+                check=True,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                text=True,
+            )
+            return self._parse_version(result.stdout or result.stderr)
+        except Exception as e:
+            logger.warning("Could not determine twistcli version at %s: %s", binary_path, e)
+            return None
+    def _resolve_twistcli_path(self, remoteconfig, prisma_key):
+        """Reuse the twistcli found in PATH unless it's older than PRISMA_CLOUD.MIN_TWISTCLI_VERSION."""
+        twistcli_in_path = shutil.which(remoteconfig["PRISMA_CLOUD"]["TWISTCLI_PATH"])
+        min_version = remoteconfig["PRISMA_CLOUD"].get("MIN_TWISTCLI_VERSION")
+        if twistcli_in_path and min_version:
+            installed_version = self._get_twistcli_version(twistcli_in_path)
+            if not installed_version or installed_version < self._parse_version(min_version):
+                logger.warning(
+                    "twistcli found in PATH at %s (version %s) is older than required %s, downloading instead",
+                    twistcli_in_path,
+                    installed_version,
+                    min_version,
+                )
+                twistcli_in_path = None
+        if twistcli_in_path:
+            logger.info("twistcli found in PATH at %s, skipping download", twistcli_in_path)
+            return twistcli_in_path
+        file_path = os.path.join(os.getcwd(), remoteconfig["PRISMA_CLOUD"]["TWISTCLI_PATH"])
         if not os.path.exists(file_path):
             self.download_twistcli(
                 file_path,
@@ -218,6 +252,18 @@ class PrismaCloudManagerScan(ToolGateway):
                 remoteconfig["PRISMA_CLOUD"]["PRISMA_CONSOLE_URL"],
                 remoteconfig["PRISMA_CLOUD"]["PRISMA_API_VERSION"],
             )
+        return file_path
+    def run_tool_container_sca(
+        self, remoteconfig, secret_tool, token_engine_container, image_name, result_file, base_image, exclusions, generate_sbom, docker_address, is_compressed_file=False
+    ):
+        prisma_key = (
+            f"{secret_tool['access_prisma']}:{secret_tool['token_prisma']}" if secret_tool else token_engine_container
+        )
+        file_path = self._resolve_twistcli_path(remoteconfig, prisma_key)
+        sbom_components = None
         image_scanned = self.scan_image(
             file_path,
             image_name,
@@ -239,6 +285,65 @@ class PrismaCloudManagerScan(ToolGateway):
         return image_scanned, sbom_components
-    def get_container_context_from_results(self, path_file_results: str) -> List:
-        # TODO: Implement Prisma Cloud context extraction
-        return []
+    def get_container_context_from_results(self, path_file_results: str) -> List[ContextContainer]:
+        SEVERITY_MAP = {
+            "unimportant": "low",
+            "unassigned": "low",
+            "negligible": "low",
+            "not yet assigned": "low",
+            "low": "low",
+            "medium": "medium",
+            "moderate": "medium",
+            "high": "high",
+            "important": "high",
+            "critical": "critical",
+        }
+        context_container_list = []
+        with open(path_file_results, "rb") as file:
+            image_object = file.read()
+            json_data = json.loads(image_object)
+        results = json_data.get("results", [])
+        for result in results:
+            target_image = result.get("name") or result.get("id", "unknown")
+            os_type = result.get("distro", "unknown")
+            vulnerabilities = result.get("vulnerabilities", [])
+            for vul in vulnerabilities:
+                status = vul.get("status", "unknown")
+                link = vul.get("link")
+                context_container = ContextContainer(
+                    cve_id=vul.get("id", "unknown"),
+                    cwe_id=vul.get("cwe", "unknown"),
+                    vendor_id=vul.get("vendorId", "unknown"),
+                    severity=SEVERITY_MAP.get(
+                        vul.get("severity", "").lower(), vul.get("severity", "unknown")
+                    ),
+                    vulnerability_status=status,
+                    target_image=target_image,
+                    package_name=vul.get("packageName", "unknown"),
+                    installed_version=vul.get("packageVersion", "unknown"),
+                    fixed_version=self._extract_fixed_version(status),
+                    cvss_score=vul.get("cvss"),
+                    cvss_vector=vul.get("vector", "unknown"),
+                    description=vul.get("description", "unknown").replace("\n", ""),
+                    os_type=os_type,
+                    layer_digest=result.get("id", "unknown"),
+                    published_date=vul.get("publishedDate"),
+                    last_modified_date=vul.get("discoveredDate", "unknown"),
+                    references=[link] if link else "unknown",
+                    source_tool="PrismaCloud",
+                )
+                context_container_list.append(context_container)
+        return context_container_list
+    def _extract_fixed_version(self, status: str) -> str:
+        """Extract fixed version from Prisma status like 'fixed in 1.2.3'."""
+        prefix = "fixed in "
+        if isinstance(status, str) and status.lower().startswith(prefix):
+            return status[len(prefix):].strip()
+        return "unknown"

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devsecops-engine-tools
-Version: 1.162.0
+Version: 1.166.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team
@@ -24,7 +24,7 @@ Requires-Dist: PyGithub==2.8.1
 Requires-Dist: distro==1.9.0
 Requires-Dist: boto3==1.40.70
 Requires-Dist: docker==7.1.0
-Requires-Dist: setuptools==78.1.1
+Requires-Dist: setuptools==83.0.0
 Requires-Dist: rich==14.1.0
 Requires-Dist: cpe==1.3.1
 Requires-Dist: packageurl-python==0.13.4

@@ -212,7 +212,7 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                 test_string = "//".join([url_parts[0] + "/", url_parts[1]])
                 print(
                     "Report sent to vulnerability management: ",
-                    f"{test_string}?tags={vulnerability_management.dict_args['module']}",
+                    f"{test_string}/test_details" if vulnerability_management.config_tool['VULNERABILITY_MANAGER']['DEFECT_DOJO']['REDIRECT_NEW_VIEWS'] else test_string,
                 )
         else:
             raise ExceptionVulnerabilityManagement(response)
@@ -461,7 +461,7 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                 host_dd = print_domain
             for engagement in engagements:
-                engagement.vm_url = f"{host_dd}/engagement/{engagement.id}/finding/open"
+                engagement.vm_url = f"{host_dd}/engagement/{engagement.id}"
             return engagements
@@ -577,6 +577,9 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
             "get_exact_product": vulnerability_management.config_tool[
                 "VULNERABILITY_MANAGER"
             ]["DEFECT_DOJO"].get("GET_EXACT_PRODUCT", False),
+            "apply_tags_to_findings": vulnerability_management.config_tool[
+                "VULNERABILITY_MANAGER"
+            ]["DEFECT_DOJO"].get("APPLY_TAGS_TO_FINDINGS", False),
             "tool_sonarqube_configuration": (
                 tool_sonar_conf_mapping[
                     vulnerability_management.sonar_instance.upper()

@@ -24,6 +24,7 @@ class ImportScanRequest:
     deduplication_on_engagement: str = ""
     lead: str = ""
     tags: List[str] = dataclasses.field(default_factory=list)
+    apply_tags_to_findings: bool = False
     close_old_findings: str = ""
     close_old_findings_product_scope: str = ""
     push_to_jira: str = ""

@@ -232,6 +232,7 @@ class ImportScanSerializer(Schema):
     expression = fields.Str(required=True)
     reimport_scan = fields.Bool(required=False)
     get_exact_product = fields.Bool(required=False)
+    apply_tags_to_findings = fields.Bool(required=False, load_default=False)
     @post_load
     def make_cmdb(self, data, **kwargs):

@@ -63,7 +63,7 @@ class ImportScanUserCase:
             except Exception as e:
                 raise ApiError(e)
-        response.url = f"{request.host_defect_dojo}/engagement/{str(response.engagement_id)}/finding/open"
+        response.url = f"{request.host_defect_dojo}/test/{str(response.test_id)}"
         return response
     def execute(self, request: ImportScanRequest) -> ImportScanRequest:

@@ -32,6 +32,7 @@ class ImportScanRestConsumer:
             "deduplication_on_engagement": request.deduplication_on_engagement,
             "lead": request.lead,
             "tags": ",".join(request.tags) if request.tags else "",
+            "apply_tags_to_findings": str(request.apply_tags_to_findings).lower(),
             "close_old_findings": str(request.close_old_findings),
             "close_old_findings_product_scope": str(request.close_old_findings_product_scope),
             "push_to_jira": str(request.push_to_jira),
@@ -89,6 +90,7 @@ class ImportScanRestConsumer:
             "deduplication_on_engagement": request.deduplication_on_engagement,
             "lead": request.lead,
             "tags": request.tags,
+            "apply_tags_to_findings": str(request.apply_tags_to_findings).lower(),
             "close_old_findings": request.close_old_findings,
             "close_old_findings_product_scope": request.close_old_findings_product_scope,
             "push_to_jira": request.push_to_jira,

	@@ -0,0 +1 @@
1	+ version = '1.166.0'

	@@ -1 +0,0 @@
1	- version = '1.162.0'

devsecops-engine-tools 1.162.0__tar.gz → 1.166.0__tar.gz

devsecops-engine-tools 1.162.0tar.gz → 1.166.0tar.gz