devsecops-engine-tools 1.18.2__tar.gz → 1.19.0__tar.gz

{devsecops_engine_tools-1.18.2 → devsecops_engine_tools-1.19.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.18.2
+Version: 1.19.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.18.2 → devsecops_engine_tools-1.19.0}/devsecops_engine_tools/engine_core/src/domain/model/report.py

@@ -28,6 +28,7 @@ class Report:
         self.vul_description = kwargs.get("vul_description", "")
         self.risk_accepted = kwargs.get("risk_accepted", "")
         self.false_p = kwargs.get("false_p", "")
+        self.out_of_scope = kwargs.get("out_of_scope", "")
         self.service = kwargs.get("service", "")
         self.reason = kwargs.get("reason", "")
         self.component_name = kwargs.get("component_name", "")

{devsecops_engine_tools-1.18.2 → devsecops_engine_tools-1.19.0}/devsecops_engine_tools/engine_core/src/domain/usecases/handle_risk.py

@@ -147,7 +147,7 @@ class HandleRisk:
 
         if self._should_skip_analysis(risk_config, pipeline_name, risk_exclusions):
             print("Tool skipped by DevSecOps Policy.")
-            logger.info("Tool skipped by DevSecOps Policy.")
+            dict_args["send_metrics"] = "false"
             return [], input_core
 
         secret_tool = None

{devsecops_engine_tools-1.18.2 → devsecops_engine_tools-1.19.0}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/aws/s3_manager.py

@@ -24,17 +24,22 @@ class S3Manager(MetricsManagerGateway):
             return ""
 
     def send_metrics(self, config_tool, tool, file_path):
-        temp_credentials = assume_role(
-            config_tool["METRICS_MANAGER"]["AWS"]["ROLE_ARN"]
-        )
+        credentials_role = assume_role(config_tool["METRICS_MANAGER"]["AWS"]["ROLE_ARN"]) if config_tool["METRICS_MANAGER"]["AWS"]["USE_ROLE"] else None
         session = boto3.session.Session()
-        client = session.client(
-            service_name="s3",
-            region_name=config_tool["METRICS_MANAGER"]["AWS"]["REGION_NAME"],
-            aws_access_key_id=temp_credentials["AccessKeyId"],
-            aws_secret_access_key=temp_credentials["SecretAccessKey"],
-            aws_session_token=temp_credentials["SessionToken"],
-        )
+
+        if credentials_role:
+            client = session.client(
+                service_name="s3",
+                region_name=config_tool["METRICS_MANAGER"]["AWS"]["REGION_NAME"],
+                aws_access_key_id=credentials_role["AccessKeyId"],
+                aws_secret_access_key=credentials_role["SecretAccessKey"],
+                aws_session_token=credentials_role["SessionToken"],
+            )
+        else:
+            client = session.client(
+                service_name="s3",
+                region_name=config_tool["METRICS_MANAGER"]["AWS"]["REGION_NAME"]
+            )
         date = datetime.datetime.now()
         path_bucket = f'engine_tools/{tool}/{date.strftime("%Y")}/{date.strftime("%m")}/{date.strftime("%d")}/{file_path.split("/")[-1]}'
 

{devsecops_engine_tools-1.18.2 → devsecops_engine_tools-1.19.0}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/aws/secrets_manager.py

@@ -19,15 +19,22 @@ logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 @dataclass
 class SecretsManager(SecretsManagerGateway):
     def get_secret(self, config_tool):
-        temp_credentials = assume_role(config_tool["SECRET_MANAGER"]["AWS"]["ROLE_ARN"])
+        credentials_role = assume_role(config_tool["SECRET_MANAGER"]["AWS"]["ROLE_ARN"]) if config_tool["SECRET_MANAGER"]["AWS"]["USE_ROLE"] else None
         session = boto3.session.Session()
-        client = session.client(
-            service_name="secretsmanager",
-            region_name=config_tool["SECRET_MANAGER"]["AWS"]["REGION_NAME"],
-            aws_access_key_id=temp_credentials["AccessKeyId"],
-            aws_secret_access_key=temp_credentials["SecretAccessKey"],
-            aws_session_token=temp_credentials["SessionToken"],
-        )
+
+        if credentials_role:
+            client = session.client(
+                service_name="secretsmanager",
+                region_name=config_tool["SECRET_MANAGER"]["AWS"]["REGION_NAME"],
+                aws_access_key_id=credentials_role["AccessKeyId"],
+                aws_secret_access_key=credentials_role["SecretAccessKey"],
+                aws_session_token=credentials_role["SessionToken"],
+            )
+        else:
+            client = session.client(
+                service_name="secretsmanager",
+                region_name=config_tool["SECRET_MANAGER"]["AWS"]["REGION_NAME"],
+            )
 
         try:
             secret_name = config_tool["SECRET_MANAGER"]["AWS"]["SECRET_NAME"]

{devsecops_engine_tools-1.18.2 → devsecops_engine_tools-1.19.0}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/defect_dojo/defect_dojo.py

@@ -39,6 +39,11 @@ logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 
 @dataclass
 class DefectDojoPlatform(VulnerabilityManagementGateway):
+
+    OUT_OF_SCOPE = "Out of Scope"
+    FALSE_POSITIVE = "False Positive"
+    TRANSFERRED_FINDING = "Transferred Finding"
+
     def send_vulnerability_management(
         self, vulnerability_management: VulnerabilityManagement
     ):
@@ -80,6 +85,9 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                     "VULNERABILITY_MANAGER"
                 ]["BRANCH_FILTER"].split(",")
             ) or (vulnerability_management.dict_args["tool"] == "engine_secret"):
+                tags = vulnerability_management.dict_args["tool"]
+                if vulnerability_management.dict_args["tool"] == "engine_iac":
+                    tags = f"{vulnerability_management.dict_args["tool"]}_{"_".join(vulnerability_management.dict_args["platform"])}"
                 request: ImportScanRequest = Connect.cmdb(
                     cmdb_mapping={
                         "product_type_name": "nombreevc",
@@ -117,7 +125,7 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                         in enviroment_mapping
                         else enviroment_mapping["default"]
                     ),
-                    tags=vulnerability_management.dict_args["tool"],
+                    tags=tags,
                 )
 
                 def request_func():
@@ -199,6 +207,11 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                 "tags": tool,
                 "limit": dd_limits_query,
             }
+            out_of_scope_query_params = {
+                "out_of_scope": True,
+                "tags": tool,
+                "limit": dd_limits_query,
+            }
             false_positive_query_params = {
                 "false_p": True,
                 "tags": tool,
@@ -227,7 +240,17 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                 false_positive_query_params,
                 tool,
                 self._format_date_to_dd_format,
-                "False Positive",
+                self.FALSE_POSITIVE,
+            )
+
+            exclusions_false_positive = self._get_findings_with_exclusions(
+                session_manager,
+                service,
+                dd_max_retries,
+                out_of_scope_query_params,
+                tool,
+                self._format_date_to_dd_format,
+                self.OUT_OF_SCOPE,
             )
 
             exclusions_transfer_finding = self._get_findings_with_exclusions(
@@ -237,7 +260,7 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                 transfer_finding_query_params,
                 tool,
                 self._format_date_to_dd_format,
-                "Transferred Finding",
+                self.TRANSFERRED_FINDING,
             )
 
             return (
@@ -346,13 +369,19 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
             elif finding.false_p:
                 exclusions.append(
                     self._create_report_exclusion(
-                        finding, date_fn, "engine_risk", "False Positive", host_dd
+                        finding, date_fn, "engine_risk", self.FALSE_POSITIVE, host_dd
+                    )
+                )
+            elif finding.out_of_scope:
+                exclusions.append(
+                    self._create_report_exclusion(
+                        finding, date_fn, "engine_risk", self.OUT_OF_SCOPE, host_dd
                     )
                 )
             elif finding.risk_status == "Transfer Accepted":
                 exclusions.append(
                     self._create_report_exclusion(
-                        finding, date_fn, "engine_risk", "Transferred Finding", host_dd
+                        finding, date_fn, "engine_risk", self.TRANSFERRED_FINDING, host_dd
                     )
                 )
         return exclusions
@@ -390,10 +419,10 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                     raise e
 
     def _date_reason_based(self, finding, date_fn, reason):
-        if reason == "False Positive":
+        if reason in [self.FALSE_POSITIVE, self.OUT_OF_SCOPE]:
             create_date = date_fn(finding.last_status_update)
             expired_date = date_fn(None)
-        elif reason == "Transferred Finding":
+        elif reason == self.TRANSFERRED_FINDING:
             create_date = date_fn(finding.transfer_finding.date)
             expired_date = date_fn(finding.transfer_finding.expiration_date)
         else:
@@ -461,9 +490,9 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
             vul_description=finding.description,
             risk_accepted=finding.risk_accepted,
             false_p=finding.false_p,
+            out_of_scope=finding.out_of_scope,
             service=finding.service,
-            unique_id_from_tool=finding.unique_id_from_tool,
-            out_of_scope=finding.out_of_scope
+            unique_id_from_tool=finding.unique_id_from_tool
         )
 
     def _format_date_to_dd_format(self, date_string):

{devsecops_engine_tools-1.18.2 → devsecops_engine_tools-1.19.0}/devsecops_engine_tools/engine_sast/engine_code/src/domain/usecases/code_scan.py

@@ -6,15 +6,14 @@ from devsecops_engine_tools.engine_core.src.domain.model.gateway.devops_platform
     DevopsPlatformGateway,
 )
 from devsecops_engine_tools.engine_utilities.git_cli.model.gateway.git_gateway import (
-    GitGateway
+    GitGateway,
 )
 from devsecops_engine_tools.engine_sast.engine_code.src.domain.model.config_tool import (
     ConfigTool,
 )
 from devsecops_engine_tools.engine_core.src.domain.model.exclusions import Exclusions
-from devsecops_engine_tools.engine_core.src.domain.model.input_core import (
-    InputCore
-)
+from devsecops_engine_tools.engine_core.src.domain.model.input_core import InputCore
+from devsecops_engine_tools.engine_utilities.utils.utils import Utils
 from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
 from devsecops_engine_tools.engine_utilities import settings
 
@@ -23,7 +22,10 @@ logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 
 class CodeScan:
     def __init__(
-        self, tool_gateway: ToolGateway, devops_platform_gateway: DevopsPlatformGateway, git_gateway: GitGateway
+        self,
+        tool_gateway: ToolGateway,
+        devops_platform_gateway: DevopsPlatformGateway,
+        git_gateway: GitGateway,
     ):
         self.tool_gateway = tool_gateway
         self.devops_platform_gateway = devops_platform_gateway
@@ -31,14 +33,11 @@ class CodeScan:
 
     def set_config_tool(self, dict_args):
         init_config_tool = self.devops_platform_gateway.get_remote_config(
-            dict_args["remote_config_repo"], 
-            "engine_sast/engine_code/ConfigTool.json"
-        )
-        scope_pipeline = self.devops_platform_gateway.get_variable(
-            "pipeline_name"
+            dict_args["remote_config_repo"], "engine_sast/engine_code/ConfigTool.json"
         )
+        scope_pipeline = self.devops_platform_gateway.get_variable("pipeline_name")
         return ConfigTool(json_data=init_config_tool, scope=scope_pipeline)
-    
+
     def get_pull_request_files(self, target_branches):
         files_pullrequest = self.git_gateway.get_files_pull_request(
             self.devops_platform_gateway.get_variable("path_directory"),
@@ -49,19 +48,17 @@ class CodeScan:
             self.devops_platform_gateway.get_variable("organization"),
             self.devops_platform_gateway.get_variable("project_name"),
             self.devops_platform_gateway.get_variable("repository"),
-            self.devops_platform_gateway.get_variable("repository_provider")
-            )
+            self.devops_platform_gateway.get_variable("repository_provider"),
+        )
         return files_pullrequest
 
-    def get_exclusions(self, dict_args, tool):
-        exclusions_data = self.devops_platform_gateway.get_remote_config(
-            dict_args["remote_config_repo"],
-            "engine_sast/engine_code/Exclusions.json"
-        )
+    def get_exclusions(self, tool, exclusions_data):
         list_exclusions = []
         skip_tool = False
         for pipeline, exclusions in exclusions_data.items():
-            if (pipeline == "All") or (pipeline == self.devops_platform_gateway.get_variable("pipeline_name")):
+            if (pipeline == "All") or (
+                pipeline == self.devops_platform_gateway.get_variable("pipeline_name")
+            ):
                 if exclusions.get("SKIP_TOOL", False):
                     skip_tool = True
                 elif exclusions.get(tool, False):
@@ -78,10 +75,12 @@ class CodeScan:
                         list_exclusions.append(exclusion)
         return list_exclusions, skip_tool
 
-    def apply_exclude_path(self, exclude_folder, ignore_search_pattern, pull_request_file):
+    def apply_exclude_path(
+        self, exclude_folder, ignore_search_pattern, pull_request_file
+    ):
         patterns = ignore_search_pattern
         patterns.extend([rf"/{re.escape(folder)}//*" for folder in exclude_folder])
-        
+
         for pattern in patterns:
             if re.search(pattern, pull_request_file):
                 return True
@@ -89,35 +88,54 @@ class CodeScan:
 
     def process(self, dict_args, tool):
         config_tool = self.set_config_tool(dict_args)
-        list_exclusions, skip_tool = self.get_exclusions(dict_args, tool)
+        exclusions_data = self.devops_platform_gateway.get_remote_config(
+            dict_args["remote_config_repo"], "engine_sast/engine_code/Exclusions.json"
+        )
+        list_exclusions, skip_tool = self.get_exclusions(tool, exclusions_data)
         findings_list, path_file_results = [], ""
 
         if not skip_tool:
             pull_request_files = []
             if not dict_args["folder_path"]:
-                pull_request_files = self.get_pull_request_files(config_tool.target_branches)
-                pull_request_files = [pf for pf in pull_request_files 
-                                      if not self.apply_exclude_path(config_tool.exclude_folder, config_tool.ignore_search_pattern, pf)]
+                pull_request_files = self.get_pull_request_files(
+                    config_tool.target_branches
+                )
+                pull_request_files = [
+                    pf
+                    for pf in pull_request_files
+                    if not self.apply_exclude_path(
+                        config_tool.exclude_folder,
+                        config_tool.ignore_search_pattern,
+                        pf,
+                    )
+                ]
 
             findings_list, path_file_results = self.tool_gateway.run_tool(
-                dict_args["folder_path"], 
+                dict_args["folder_path"],
                 pull_request_files,
                 self.devops_platform_gateway.get_variable("path_directory"),
                 self.devops_platform_gateway.get_variable("repository"),
-                config_tool
+                config_tool,
             )
 
         else:
-            print(f"Tool skipped by DevSecOps policy")
-            logger.info(f"Tool skipped by DevSecOps policy")
+            print("Tool skipped by DevSecOps policy")
+            dict_args["send_metrics"] = "false"
 
         input_core = InputCore(
             totalized_exclusions=list_exclusions,
-            threshold_defined=config_tool.threshold,
+            threshold_defined=Utils.update_threshold(
+                self,
+                config_tool.threshold,
+                exclusions_data,
+                config_tool.scope_pipeline,
+            ),
             path_file_results=path_file_results,
             custom_message_break_build=config_tool.message_info_engine_code,
             scope_pipeline=config_tool.scope_pipeline,
-            stage_pipeline=self.devops_platform_gateway.get_variable("stage").capitalize(),
+            stage_pipeline=self.devops_platform_gateway.get_variable(
+                "stage"
+            ).capitalize(),
         )
 
         return findings_list, input_core

{devsecops_engine_tools-1.18.2 → devsecops_engine_tools-1.19.0}/devsecops_engine_tools/engine_sast/engine_iac/src/domain/usecases/iac_scan.py

@@ -13,6 +13,8 @@ from devsecops_engine_tools.engine_core.src.domain.model.exclusions import Exclu
 from devsecops_engine_tools.engine_core.src.domain.model.input_core import InputCore
 from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
 from devsecops_engine_tools.engine_utilities import settings
+from devsecops_engine_tools.engine_core.src.domain.model.threshold import Threshold
+from devsecops_engine_tools.engine_utilities.utils.utils import Utils
 
 logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 
@@ -45,11 +47,11 @@ class IacScan:
                 environment="pdn" if env not in ["dev", "qa", "pdn"] else env,
                 platform_to_scan=dict_args["platform"],
                 secret_tool=secret_tool,
-                secret_external_checks=dict_args["token_external_checks"]
+                secret_external_checks=dict_args["token_external_checks"],
             )
         else:
-            print(f"Tool skipped by DevSecOps policy")
-            logger.info(f"Tool skipped by DevSecOps policy")
+            print("Tool skipped by DevSecOps policy")
+            dict_args["send_metrics"] = "false"
 
         totalized_exclusions = []
         (
@@ -69,7 +71,12 @@ class IacScan:
 
         input_core = InputCore(
             totalized_exclusions=totalized_exclusions,
-            threshold_defined=config_tool_core.threshold,
+            threshold_defined=Utils.update_threshold(
+                self,
+                config_tool_core.threshold,
+                exclusions,
+                config_tool_core.scope_pipeline,
+            ),
             path_file_results=path_file_results,
             custom_message_break_build=config_tool_core.message_info_engine_iac,
             scope_pipeline=config_tool_core.scope_pipeline,
@@ -88,7 +95,13 @@ class IacScan:
             "pipeline_name"
         )
 
-        skip_tool = bool(re.match(config_tool.ignore_search_pattern, config_tool.scope_pipeline, re.IGNORECASE))
+        skip_tool = bool(
+            re.match(
+                config_tool.ignore_search_pattern,
+                config_tool.scope_pipeline,
+                re.IGNORECASE,
+            )
+        )
 
         if config_tool.exclusions.get("All") is not None:
             config_tool.exclusions_all = config_tool.exclusions.get("All").get(tool)
@@ -96,7 +109,9 @@ class IacScan:
             config_tool.exclusions_scope = config_tool.exclusions.get(
                 config_tool.scope_pipeline
             ).get(tool)
-            skip_tool = bool(config_tool.exclusions.get(config_tool.scope_pipeline).get("SKIP_TOOL"))
+            skip_tool = bool(
+                config_tool.exclusions.get(config_tool.scope_pipeline).get("SKIP_TOOL")
+            )
 
         if dict_args["folder_path"]:
             if (
@@ -124,11 +139,7 @@ class IacScan:
 
     def search_folders(self, search_pattern):
         current_directory = os.getcwd()
-        patron = (
-            "(?i).*?("
-            + "|".join(search_pattern)
-            + ").*$"
-        )
+        patron = "(?i).*?(" + "|".join(search_pattern) + ").*$"
         folders = [
             folder
             for folder in os.listdir(current_directory)

{devsecops_engine_tools-1.18.2 → devsecops_engine_tools-1.19.0}/devsecops_engine_tools/engine_sast/engine_secret/src/domain/usecases/secret_scan.py

@@ -59,6 +59,9 @@ class SecretScan:
                 self.devops_platform_gateway.get_variable("os"),
                 self.devops_platform_gateway.get_variable("path_directory")
                 )
+        else:
+            print("Tool skipped by DevSecOps policy")
+            dict_args["send_metrics"] = "false"
         return finding_list, file_path_findings
     
     def complete_config_tool(self, dict_args, tool):

{devsecops_engine_tools-1.18.2 → devsecops_engine_tools-1.19.0}/devsecops_engine_tools/engine_sast/engine_secret/src/domain/usecases/set_input_core.py

@@ -3,13 +3,20 @@ from devsecops_engine_tools.engine_core.src.domain.model.gateway.devops_platform
     DevopsPlatformGateway,
 )
 from devsecops_engine_tools.engine_sast.engine_secret.src.domain.model.DeserializeConfigTool import (
-    DeserializeConfigTool
-    )
+    DeserializeConfigTool,
+)
 from devsecops_engine_tools.engine_core.src.domain.model.exclusions import Exclusions
+from devsecops_engine_tools.engine_utilities.utils.utils import Utils
 
 
 class SetInputCore:
-    def __init__(self, tool_remote: DevopsPlatformGateway, dict_args, tool, config_tool: DeserializeConfigTool):
+    def __init__(
+        self,
+        tool_remote: DevopsPlatformGateway,
+        dict_args,
+        tool,
+        config_tool: DeserializeConfigTool,
+    ):
         self.tool_remote = tool_remote
         self.dict_args = dict_args
         self.tool = tool
@@ -22,7 +29,9 @@ class SetInputCore:
         Returns:
             dict: Remote configuration.
         """
-        return self.tool_remote.get_remote_config(self.dict_args["remote_config_repo"], file_path)
+        return self.tool_remote.get_remote_config(
+            self.dict_args["remote_config_repo"], file_path
+        )
 
     def get_variable(self, variable):
         """
@@ -60,15 +69,23 @@ class SetInputCore:
         Returns:
             dict: Input core.
         """
+        exclusions_config = self.get_remote_config(
+            "engine_sast/engine_secret/Exclusions.json"
+        )
         return InputCore(
             totalized_exclusions=self.get_exclusions(
-                self.get_remote_config("engine_sast/engine_secret/Exclusions.json"),
+                exclusions_config,
                 self.get_variable("pipeline_name"),
                 self.tool,
             ),
-            threshold_defined=self.config_tool.level_compliance,
+            threshold_defined=Utils.update_threshold(
+                self,
+                self.config_tool.level_compliance,
+                exclusions_config,
+                self.config_tool.scope_pipeline,
+            ),
             path_file_results=finding_list,
             custom_message_break_build=self.config_tool.message_info_engine_secret,
             scope_pipeline=self.config_tool.scope_pipeline,
-            stage_pipeline=self.tool_remote.get_variable("stage").capitalize()
+            stage_pipeline=self.tool_remote.get_variable("stage").capitalize(),
         )

{devsecops_engine_tools-1.18.2 → devsecops_engine_tools-1.19.0}/devsecops_engine_tools/engine_sca/engine_container/src/domain/usecases/set_input_core.py

@@ -1,8 +1,7 @@
 from devsecops_engine_tools.engine_core.src.domain.model.input_core import InputCore
-from devsecops_engine_tools.engine_core.src.domain.model.threshold import Threshold
-
-
 from devsecops_engine_tools.engine_core.src.domain.model.exclusions import Exclusions
+from devsecops_engine_tools.engine_core.src.domain.model.threshold import Threshold
+from devsecops_engine_tools.engine_utilities.utils.utils import Utils
 
 
 class SetInputCore:
@@ -44,7 +43,12 @@ class SetInputCore:
                 self.pipeline_name,
                 self.tool,
             ),
-            Threshold(self.remote_config["THRESHOLD"]),
+            Utils.update_threshold(
+                self,
+                Threshold(self.remote_config["THRESHOLD"]),
+                self.exclusions,
+                self.pipeline_name,
+            ),
             image_scanned,
             self.remote_config["MESSAGE_INFO_ENGINE_CONTAINER"],
             self.pipeline_name,

{devsecops_engine_tools-1.18.2 → devsecops_engine_tools-1.19.0}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/entry_points/entry_point_tool.py

@@ -56,7 +56,7 @@ def init_engine_sca_rm(
             deseralized = container_sca_scan.deseralizator(image_scanned)
     else:
         print("Tool skipped by DevSecOps policy")
-        logger.info("Tool skipped by DevSecOps policy")
+        dict_args["send_metrics"] = "false"
     core_input = input_core.set_input_core(image_scanned)
 
     return deseralized, core_input

{devsecops_engine_tools-1.18.2 → devsecops_engine_tools-1.19.0}/devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/usecases/set_input_core.py

@@ -1,6 +1,7 @@
 from devsecops_engine_tools.engine_core.src.domain.model.input_core import InputCore
 from devsecops_engine_tools.engine_core.src.domain.model.threshold import Threshold
 from devsecops_engine_tools.engine_core.src.domain.model.exclusions import Exclusions
+from devsecops_engine_tools.engine_utilities.utils.utils import Utils
 
 
 class SetInputCore:
@@ -31,15 +32,6 @@ class SetInputCore:
                     list_exclusions.extend(exclusions)
         return list_exclusions
 
-    def update_threshold(self, threshold, exclusions_data, pipeline_name):
-        if (pipeline_name in exclusions_data) and (
-            exclusions_data[pipeline_name].get("THRESHOLD", 0)
-        ):
-            threshold["VULNERABILITY"] = exclusions_data[pipeline_name][
-                "THRESHOLD"
-            ].get("VULNERABILITY")
-        return threshold
-
     def set_input_core(self, dependencies_scanned):
         """
         Set the input core.
@@ -53,10 +45,11 @@ class SetInputCore:
                 self.pipeline_name,
                 self.tool,
             ),
-            Threshold(
-                self.update_threshold(
-                    self.remote_config["THRESHOLD"], self.exclusions, self.pipeline_name
-                )
+            Utils.update_threshold(
+                self,
+                Threshold(self.remote_config["THRESHOLD"]),
+                self.exclusions,
+                self.pipeline_name,
             ),
             dependencies_scanned,
             self.remote_config["MESSAGE_INFO_ENGINE_DEPENDENCIES"],

{devsecops_engine_tools-1.18.2 → devsecops_engine_tools-1.19.0}/devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/entry_points/entry_point_tool.py

@@ -62,8 +62,8 @@ def init_engine_dependencies(
         else:
             logger.error(f"Path {to_scan} does not exist")
     else:
-        print(f"Tool skipped by DevSecOps policy")
-        logger.info(f"Tool skipped by DevSecOps policy")
+        print("Tool skipped by DevSecOps policy")
+        dict_args["send_metrics"] = "false"
 
     core_input = input_core.set_input_core(dependencies_scanned)
 

{devsecops_engine_tools-1.18.2 → devsecops_engine_tools-1.19.0}/devsecops_engine_tools/engine_utilities/sonarqube/src/domain/usecases/report_sonar.py

@@ -150,7 +150,6 @@ class ReportSonar:
                             if finding.active and related_sonar_finding["status"] == "RESOLVED": status = "reopen"
                             elif related_sonar_finding["status"] != "RESOLVED":
                                 if finding.false_p: status = "falsepositive"
-                                elif finding.risk_accepted: status = "close"
                                 elif finding.risk_accepted or finding.out_of_scope: status = "wontfix"
                             if status:
                                 self.sonar_gateway.change_finding_status(

devsecops_engine_tools-1.19.0/devsecops_engine_tools/engine_utilities/utils/utils.py

@@ -0,0 +1,40 @@
+import zipfile
+import base64
+import re
+
+from devsecops_engine_tools.engine_core.src.domain.model.threshold import Threshold
+from devsecops_engine_tools.engine_core.src.domain.model.level_vulnerability import (
+    LevelVulnerability,
+)
+
+
+class Utils:
+
+    def unzip_file(self, zip_file_path, extract_path):
+        with zipfile.ZipFile(zip_file_path, "r") as zip_ref:
+            zip_ref.extractall(extract_path)
+
+    def encode_token_to_base64(self, token):
+        token_bytes = f"{token}:".encode("utf-8")
+        base64_token = base64.b64encode(token_bytes).decode("utf-8")
+        return base64_token
+
+    def update_threshold(self, threshold: Threshold, exclusions_data, pipeline_name):
+        def set_vulnerability(level):
+            threshold.vulnerability = LevelVulnerability(level)
+            return threshold
+
+        threshold_pipeline = exclusions_data.get(pipeline_name, {}).get("THRESHOLD", {})
+        if threshold_pipeline:
+            return set_vulnerability(threshold_pipeline.get("VULNERABILITY"))
+
+        search_patterns = exclusions_data.get("BY_PATTERN_SEARCH", {})
+        
+        match_pattern = next(
+            (v["THRESHOLD"]["VULNERABILITY"]
+            for pattern, v in search_patterns.items()
+            if re.match(pattern, pipeline_name, re.IGNORECASE)),
+            None
+        )
+
+        return set_vulnerability(match_pattern) if match_pattern else threshold

devsecops_engine_tools-1.19.0/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.19.0'