devsecops-engine-tools 1.169.2__tar.gz → 1.170.0__tar.gz

{devsecops_engine_tools-1.169.2 → devsecops_engine_tools-1.170.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devsecops-engine-tools
-Version: 1.169.2
+Version: 1.170.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.169.2 → devsecops_engine_tools-1.170.0}/devsecops_engine_tools/engine_core/src/domain/usecases/handle_risk.py

@@ -175,14 +175,53 @@ class HandleRisk:
             dict_args["send_metrics"] = "false"
             return [], input_core
 
-        secret_tool = None
+        secret_tool = self._resolve_secret_tool(dict_args, remote_config)
+
+        service_list = self._resolve_service_list(
+            pipeline_name, dict_args, secret_tool, remote_config, risk_config
+        )
+        service_list = self._add_definition_engagement(
+            service_list, definition_name, dict_args, secret_tool, remote_config
+        )
+
+        new_service_list = self._exclude_services(
+            dict_args, pipeline_name, service_list, risk_config
+        )
+
+        for engagement in new_service_list:
+            print(
+                f"Service to analyze: {engagement.name}, URL: {engagement.vm_url}"
+            )
+
+        findings, exclusions = self._collect_findings_from_vm(
+            new_service_list, dict_args, secret_tool, remote_config
+        )
+
+        result = runner_engine_risk(
+            dict_args,
+            findings,
+            exclusions,
+            [service.name for service in new_service_list],
+            self.devops_platform_gateway,
+            self.remote_config_source_gateway,
+            self.print_table_gateway,
+            self.vulnerability_management,
+            secret_tool,
+            remote_config,
+        )
+
+        return result, input_core
+
+    def _resolve_secret_tool(self, dict_args, remote_config):
         if dict_args["use_secrets_manager"] == "true":
-            secret_tool = self.secrets_manager_gateway.get_secret(remote_config)
+            return self.secrets_manager_gateway.get_secret(remote_config)
+        return None
 
+    def _resolve_service_list(
+        self, pipeline_name, dict_args, secret_tool, remote_config, risk_config
+    ):
         service = pipeline_name
-        service_list = []
-        initial_services = []
-        initial_services += [service]
+        initial_services = [service]
 
         match_parent = re.match(
             risk_config["PARENT_ANALYSIS"]["REGEX_GET_PARENT"], service
@@ -192,59 +231,82 @@ class HandleRisk:
             initial_services += [parent_service]
 
         if risk_config["HANDLE_SERVICE_NAME"]["ENABLED"].lower() == "true":
-            service = next(
-                (
-                    pipeline_name.replace(ending, "")
-                    for ending in risk_config["HANDLE_SERVICE_NAME"]["CHECK_ENDING"]
-                    if pipeline_name.endswith(ending)
-                ),
+            return self._resolve_service_list_with_handled_names(
                 pipeline_name,
+                initial_services,
+                dict_args,
+                secret_tool,
+                remote_config,
+                risk_config,
             )
-            initial_services += [service]
-            match_service_code = re.match(
-                risk_config["HANDLE_SERVICE_NAME"]["REGEX_GET_SERVICE_CODE"], service
+
+        return self._resolve_service_list_by_exact_match(
+            initial_services, dict_args, secret_tool, remote_config
+        )
+
+    def _resolve_service_list_with_handled_names(
+        self, pipeline_name, initial_services, dict_args, secret_tool, remote_config, risk_config
+    ):
+        service = next(
+            (
+                pipeline_name.replace(ending, "")
+                for ending in risk_config["HANDLE_SERVICE_NAME"]["CHECK_ENDING"]
+                if pipeline_name.endswith(ending)
+            ),
+            pipeline_name,
+        )
+        initial_services += [service]
+        match_service_code = re.match(
+            risk_config["HANDLE_SERVICE_NAME"]["REGEX_GET_SERVICE_CODE"], service
+        )
+        if not match_service_code:
+            return []
+
+        service_code = match_service_code.group(0)
+        initial_services += [
+            add_service.format(service_code=service_code)
+            for add_service in risk_config["HANDLE_SERVICE_NAME"]["ADD_SERVICES"]
+        ]
+        engagements = self.vulnerability_management.get_active_engagements(
+            service_code, dict_args, secret_tool, remote_config
+        )
+        return self._filter_engagements(
+            engagements, service, initial_services, risk_config
+        )
+
+    def _resolve_service_list_by_exact_match(
+        self, initial_services, dict_args, secret_tool, remote_config
+    ):
+        service_list = []
+        for service in initial_services:
+            engagements = self.vulnerability_management.get_active_engagements(
+                service, dict_args, secret_tool, remote_config
             )
-            if match_service_code:
-                service_code = match_service_code.group(0)
-                initial_services += [
-                    service.format(service_code=service_code)
-                    for service in risk_config["HANDLE_SERVICE_NAME"]["ADD_SERVICES"]
-                ]
-                engagements = self.vulnerability_management.get_active_engagements(
-                    service_code, dict_args, secret_tool, remote_config
-                )
-                service_list += self._filter_engagements(
-                    engagements, service, initial_services, risk_config
-                )
-        else:
-            for service in initial_services:
-                engagements = self.vulnerability_management.get_active_engagements(
-                    service, dict_args, secret_tool, remote_config
-                )
-                for engagement in engagements:
-                    if engagement.name.lower() == service.lower():
-                        service_list += [engagement]
-                        break
+            for engagement in engagements:
+                if engagement.name.lower() == service.lower():
+                    service_list += [engagement]
+                    break
+        return service_list
 
-        if definition_name and definition_name.lower() not in [
+    def _add_definition_engagement(
+        self, service_list, definition_name, dict_args, secret_tool, remote_config
+    ):
+        if not definition_name or definition_name.lower() in [
             service.name.lower() for service in service_list
         ]:
-            build_engagements = self.vulnerability_management.get_active_engagements(
-                definition_name, dict_args, secret_tool, remote_config
-            )
-            for build_engagement in build_engagements:
-                if build_engagement.name.lower() == definition_name.lower():
-                    service_list += [build_engagement]
+            return service_list
 
-        new_service_list = self._exclude_services(
-            dict_args, pipeline_name, service_list, risk_config
+        build_engagements = self.vulnerability_management.get_active_engagements(
+            definition_name, dict_args, secret_tool, remote_config
         )
+        for build_engagement in build_engagements:
+            if build_engagement.name.lower() == definition_name.lower():
+                service_list += [build_engagement]
+        return service_list
 
-        for engagement in new_service_list:
-            print(
-                f"Service to analyze: {engagement.name}, URL: {engagement.vm_url}"
-            )
-
+    def _collect_findings_from_vm(
+        self, new_service_list, dict_args, secret_tool, remote_config
+    ):
         findings = []
         exclusions = []
         for service in new_service_list:
@@ -253,18 +315,4 @@ class HandleRisk:
             )
             findings += findings_list
             exclusions += exclusions_list
-
-        result = runner_engine_risk(
-            dict_args,
-            findings,
-            exclusions,
-            [service.name for service in new_service_list],
-            self.devops_platform_gateway,
-            self.remote_config_source_gateway,
-            self.print_table_gateway,
-            self.vulnerability_management,
-            secret_tool,
-            remote_config,
-        )
-
-        return result, input_core
+        return findings, exclusions

{devsecops_engine_tools-1.169.2 → devsecops_engine_tools-1.170.0}/devsecops_engine_tools/engine_core/src/domain/usecases/handle_scan.py

@@ -343,39 +343,56 @@ class HandleScan:
         quality_vulnerability_management = (
             input_core.threshold_defined.quality_vulnerability_management
         )
-        if quality_vulnerability_management and input_core.threshold_defined.name == "default":
-            product_type = self.vulnerability_management.get_product_type_pipeline(
-                input_core.scope_pipeline, dict_args, secret_tool, config_tool
-            )
-            if product_type:
-                pt_name = product_type.name
-                apply_qualitypt = next(
-                    filter(
-                        lambda qapt: pt_name in qapt,
-                        quality_vulnerability_management["PTS"],
-                    ),
-                    None,
-                )
-                if apply_qualitypt:
-                    pt_info = apply_qualitypt[pt_name]
-                    pt_profile = pt_info["PROFILE"] if config_tool["BREAK_BUILD_MANAGER"]["MODEL"] == "severity" else None
-                    pt_profile_priority = pt_info["PROFILE_PRIORITY"] if config_tool["BREAK_BUILD_MANAGER"]["MODEL"] == "priority" else None
-                    pt_apps = pt_info["APPS"]
+        if not (
+            quality_vulnerability_management
+            and input_core.threshold_defined.name == "default"
+        ):
+            return
 
-                    if pt_profile and (
-                        pt_apps == "ALL"
-                        or any(pd in input_core.scope_pipeline for pd in pt_apps)
-                    ):
-                        input_core.threshold_defined.vulnerability = LevelVulnerability(
-                            quality_vulnerability_management[pt_profile]
-                        )
-                    if pt_profile_priority and (
-                        pt_apps == "ALL"
-                        or any(pd in input_core.scope_pipeline for pd in pt_apps)
-                    ):
-                        input_core.threshold_defined.priority = LevelPriority(
-                            quality_vulnerability_management[pt_profile_priority]
-                        )
+        product_type = self.vulnerability_management.get_product_type_pipeline(
+            input_core.scope_pipeline, dict_args, secret_tool, config_tool
+        )
+        if not product_type:
+            return
+
+        apply_qualitypt = self._find_matching_quality_pt(
+            product_type.name, quality_vulnerability_management["PTS"]
+        )
+        if not apply_qualitypt:
+            return
+
+        self._apply_quality_pt_threshold(
+            input_core,
+            config_tool,
+            quality_vulnerability_management,
+            apply_qualitypt[product_type.name],
+        )
+
+    def _find_matching_quality_pt(self, pt_name, quality_pts):
+        return next(
+            filter(lambda qapt: pt_name in qapt, quality_pts),
+            None,
+        )
+
+    def _apply_quality_pt_threshold(
+        self, input_core, config_tool, quality_vulnerability_management, pt_info
+    ):
+        model = config_tool["BREAK_BUILD_MANAGER"]["MODEL"]
+        pt_profile = pt_info["PROFILE"] if model == "severity" else None
+        pt_profile_priority = pt_info["PROFILE_PRIORITY"] if model == "priority" else None
+        pt_apps = pt_info["APPS"]
+        applies_to_pipeline = pt_apps == "ALL" or any(
+            pd in input_core.scope_pipeline for pd in pt_apps
+        )
+
+        if pt_profile and applies_to_pipeline:
+            input_core.threshold_defined.vulnerability = LevelVulnerability(
+                quality_vulnerability_management[pt_profile]
+            )
+        if pt_profile_priority and applies_to_pipeline:
+            input_core.threshold_defined.priority = LevelPriority(
+                quality_vulnerability_management[pt_profile_priority]
+            )
 
     def _handle_context_extraction(
         self,

{devsecops_engine_tools-1.169.2 → devsecops_engine_tools-1.170.0}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/cdxgen/cdxgen.py

@@ -26,26 +26,25 @@ class CdxGen(SbomManagerGateway):
 
     def get_components(self, artifact, config, service_name) -> "list[Component]":
         try:
-            cdxgen_version = config["CDXGEN"]["CDXGEN_VERSION"]
-            slim = "-slim" if config["CDXGEN"]["SLIM_BINARY"] else ""
-            fetch_license = config["CDXGEN"].get("FETCH_LICENSE", False)
-            exclude_types = config["CDXGEN"].get("EXCLUDE_TYPES", [])
-            exclude_paths = config["CDXGEN"].get("EXCLUDE_PATHS", [])
-            recurse = config["CDXGEN"].get("RECURSE", True)
-            install_deps = config["CDXGEN"].get("INSTALL_DEPENDENCIES", True)
-            debug_pipelines = config["CDXGEN"].get("DEBUG_PIPELINES", [])
-            required_only_pipelines = config["CDXGEN"].get("REQUIRED_ONLY_PIPELINES", [])
-            spec_version = config["CDXGEN"].get("SPEC_VERSION", "1.6")
-            break_on_build_failure = config["CDXGEN"].get("BREAK_ON_BUILD_FAILURE", True)
-            build_failure_patterns = config["CDXGEN"].get("BUILD_FAILURE_PATTERNS", [])
+            cdxgen_config = config["CDXGEN"]
+            cdxgen_version = cdxgen_config["CDXGEN_VERSION"]
+            slim = "-slim" if cdxgen_config["SLIM_BINARY"] else ""
+            fetch_license = cdxgen_config.get("FETCH_LICENSE", False)
+            exclude_types = cdxgen_config.get("EXCLUDE_TYPES", [])
+            exclude_paths = cdxgen_config.get("EXCLUDE_PATHS", [])
+            recurse = cdxgen_config.get("RECURSE", True)
+            install_deps = cdxgen_config.get("INSTALL_DEPENDENCIES", True)
+            debug_pipelines = cdxgen_config.get("DEBUG_PIPELINES", [])
+            required_only_pipelines = cdxgen_config.get("REQUIRED_ONLY_PIPELINES", [])
+            spec_version = cdxgen_config.get("SPEC_VERSION", "1.6")
+            break_on_build_failure = cdxgen_config.get("BREAK_ON_BUILD_FAILURE", True)
+            build_failure_patterns = cdxgen_config.get("BUILD_FAILURE_PATTERNS", [])
             failure_patterns = build_failure_patterns if break_on_build_failure else []
 
-            if config["CDXGEN"].get("OVERRIDE_REGISTRIES", False):
-                registries = config["CDXGEN"].get("REGISTRIES", {})
-                for env_var, url in registries.items():
-                    os.environ[env_var] = url
+            if cdxgen_config.get("OVERRIDE_REGISTRIES", False):
+                self._apply_registry_overrides(cdxgen_config.get("REGISTRIES", {}))
 
-            enable_debug = service_name in debug_pipelines if debug_pipelines else False
+            enable_debug = self._pipeline_in_list(service_name, debug_pipelines)
             if enable_debug:
                 logger.info(f"Enabling debug mode for pipeline: {service_name}")
                 os.environ["CDXGEN_DEBUG_MODE"] = "debug"
@@ -53,50 +52,57 @@ class CdxGen(SbomManagerGateway):
             if fetch_license:
                 os.environ["FETCH_LICENSE"] = "true"
 
-            os_platform = platform.system()
-            os_architecture = platform.machine()
+            command_prefix, is_supported = self._resolve_cdxgen_command_prefix(cdxgen_version, slim)
+            if not is_supported:
+                return None
 
-            command_prefix = self._check_cdxgen_in_path()
-            
-            if command_prefix:
-                logger.info(f"Using cdxgen from PATH: {command_prefix}")
-            else:
-                base_url = (
-                    f"https://github.com/CycloneDX/cdxgen/releases/download/v{cdxgen_version}/"
-                )
-                
-                if os_platform == "Linux":
-                    if os_architecture == "aarch64":
-                        file = f"cdxgen-linux-arm64{slim}"
-                    else:
-                        file = f"cdxgen-linux-amd64{slim}"
-                    command_prefix = self._install_tool_unix(
-                        file, base_url + file, "cdxgen"
-                    )
-                elif os_platform == "Darwin":
-                    if os_architecture == "arm64":
-                        file = f"cdxgen-darwin-arm64{slim}"
-                    else:
-                        file = f"cdxgen-darwin-amd64{slim}"
-                    command_prefix = self._install_tool_unix(
-                        file, base_url + file, "cdxgen"
-                    )
-                elif os_platform == "Windows":
-                    file = f"cdxgen-windows-amd64{slim}.exe"
-                    command_prefix = self._install_tool_windows(
-                        file, base_url + file, "cdxgen.exe"
-                    )
-                else:
-                    logger.warning(f"{os_platform} is not supported.")
-                    return None
-
-            required_only = service_name in required_only_pipelines if required_only_pipelines else False
+            required_only = self._pipeline_in_list(service_name, required_only_pipelines)
             result_sbom = self._run_cdxgen(command_prefix, artifact, service_name, exclude_types, exclude_paths, recurse, install_deps, required_only, enable_debug, spec_version, failure_patterns)
-            return get_list_component(result_sbom, config["CDXGEN"]["OUTPUT_FORMAT"])
+            return get_list_component(result_sbom, cdxgen_config["OUTPUT_FORMAT"])
         except Exception as e:
             logger.error(f"Error generating SBOM: {e}")
             return None
 
+    def _apply_registry_overrides(self, registries):
+        for env_var, url in registries.items():
+            os.environ[env_var] = url
+
+    def _pipeline_in_list(self, service_name, pipelines):
+        return service_name in pipelines if pipelines else False
+
+    def _resolve_cdxgen_command_prefix(self, cdxgen_version, slim):
+        command_prefix = self._check_cdxgen_in_path()
+        if command_prefix:
+            logger.info(f"Using cdxgen from PATH: {command_prefix}")
+            return command_prefix, True
+
+        os_platform = platform.system()
+        os_architecture = platform.machine()
+        base_url = (
+            f"https://github.com/CycloneDX/cdxgen/releases/download/v{cdxgen_version}/"
+        )
+
+        if os_platform == "Linux":
+            file = (
+                f"cdxgen-linux-arm64{slim}"
+                if os_architecture == "aarch64"
+                else f"cdxgen-linux-amd64{slim}"
+            )
+            return self._install_tool_unix(file, base_url + file, "cdxgen"), True
+        if os_platform == "Darwin":
+            file = (
+                f"cdxgen-darwin-arm64{slim}"
+                if os_architecture == "arm64"
+                else f"cdxgen-darwin-amd64{slim}"
+            )
+            return self._install_tool_unix(file, base_url + file, "cdxgen"), True
+        if os_platform == "Windows":
+            file = f"cdxgen-windows-amd64{slim}.exe"
+            return self._install_tool_windows(file, base_url + file, "cdxgen.exe"), True
+
+        logger.warning(f"{os_platform} is not supported.")
+        return None, False
+
     def _run_cdxgen(self, command_prefix, artifact, service_name, exclude_types, exclude_paths, recurse, install_deps, required_only=False, enable_debug=False, spec_version="1.6", failure_patterns=None):
         failure_patterns = failure_patterns or []
         result_file = f"{service_name}_SBOM.json"

{devsecops_engine_tools-1.169.2 → devsecops_engine_tools-1.170.0}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/context_extraction/context_extraction_manager.py

@@ -111,48 +111,51 @@ class ContextExtractionManager(ContextExtractionGateway):
         module_name: str
     ) -> None:
         # Convert context objects to Finding objects for priority calculation
-        findings_for_priority = []
-        for context_item in context_list:
-            # Extract the ID depending on the context type
-            if hasattr(context_item, 'cve_id'):
-                if isinstance(context_item.cve_id, list):
-                    # For dependencies: cve_id is a list
-                    finding_id = context_item.cve_id[0] if context_item.cve_id else "unknown"
-                else:
-                    # For container: cve_id is a string
-                    finding_id = context_item.cve_id
-            elif hasattr(context_item, 'id'):
-                # For IaC: id is a string
-                finding_id = context_item.id
-            elif hasattr(context_item, 'name'):
-                # For license: name is the identifier
-                finding_id = context_item.name
-            else:
-                finding_id = "unknown"
-            
-            finding = Finding(
-                id=finding_id,
-                cvss="",
-                where="",
-                description="",
-                severity=context_item.severity,
-                identification_date="",
-                published_date_cve="",
-                module=module_name,
-                category=Category.VULNERABILITY,
-                requirements="",
-                tool="",
-            )
-            findings_for_priority.append(finding)
-        
+        findings_for_priority = [
+            self._build_finding_for_priority(context_item, module_name)
+            for context_item in context_list
+        ]
+
         # Calculate priorities using the risk_score_gateway
         self._risk_score_gateway.get_risk_score(findings_for_priority, config_tool, module_name)
-        
+
         # Update context objects with calculated priorities
         # Store only the scale as a string for all modules
         for context_item, finding in zip(context_list, findings_for_priority):
             if finding.priority:
                 context_item.priority = finding.priority.scale
+
+    def _build_finding_for_priority(self, context_item, module_name: str) -> Finding:
+        finding_id = self._resolve_context_finding_id(context_item)
+        return Finding(
+            id=finding_id,
+            cvss="",
+            where="",
+            description="",
+            severity=context_item.severity,
+            identification_date="",
+            published_date_cve="",
+            module=module_name,
+            category=Category.VULNERABILITY,
+            requirements="",
+            tool="",
+        )
+
+    def _resolve_context_finding_id(self, context_item) -> str:
+        # Extract the ID depending on the context type
+        if hasattr(context_item, 'cve_id'):
+            if isinstance(context_item.cve_id, list):
+                # For dependencies: cve_id is a list
+                return context_item.cve_id[0] if context_item.cve_id else "unknown"
+            # For container: cve_id is a string
+            return context_item.cve_id
+        if hasattr(context_item, 'id'):
+            # For IaC: id is a string
+            return context_item.id
+        if hasattr(context_item, 'name'):
+            # For license: name is the identifier
+            return context_item.name
+        return "unknown"
     
     def _save_context(self, module_name: str, context_list: List, print_to_logs: bool) -> None:
         context_key = self._context_key_mapping.get(module_name, f"{module_name}_context")