devsecops-engine-tools 1.23.2__py3-none-any.whl → 1.24.1__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.


This version of devsecops-engine-tools might be problematic. Click here for more details.

@@ -4,5 +4,5 @@ from devsecops_engine_tools.engine_core.src.domain.model.finding import Finding
4
4
 
5
5
  class DeserializatorGateway(metaclass=ABCMeta):
6
6
  @abstractmethod
7
- def get_list_findings(self, results_scan_file) -> "list[Finding]":
7
+ def get_list_findings(self, results_scan_file, remote_config) -> "list[Finding]":
8
8
  "Deserializator"
@@ -48,4 +48,4 @@ class DependenciesScan:
48
48
  Process the results deserializer.
49
49
  Terun: list: Deserialized list of findings.
50
50
  """
51
- return self.tool_deserializator.get_list_findings(dependencies_scanned)
51
+ return self.tool_deserializator.get_list_findings(dependencies_scanned, self.remote_config)
@@ -7,8 +7,7 @@ from devsecops_engine_tools.engine_core.src.domain.model.finding import (
7
7
  )
8
8
  from dataclasses import dataclass
9
9
  from datetime import datetime
10
- import json
11
- import os
10
+ import xml.etree.ElementTree as ET
12
11
  from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
13
12
  from devsecops_engine_tools.engine_utilities import settings
14
13
 
@@ -17,47 +16,74 @@ logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
17
16
 
18
17
  @dataclass
19
18
  class DependencyCheckDeserialize(DeserializatorGateway):
19
+ TOOL = "DEPENDENCY_CHECK"
20
20
 
21
- def get_list_findings(self, dependencies_scanned_file) -> "list[Finding]":
22
- filename, extension = os.path.splitext(dependencies_scanned_file)
23
- if extension.lower() != ".json":
24
- dependencies_scanned_file = f"{filename}.json"
25
-
26
- data_result = self.load_results(dependencies_scanned_file)
21
+ def get_list_findings(self, dependencies_scanned_file, remote_config) -> "list[Finding]":
22
+ dependencies, namespace = self.filter_vulnerabilities_by_confidence(dependencies_scanned_file, remote_config)
27
23
 
28
24
  list_open_vulnerabilities = []
29
- for dependency in data_result.get("dependencies", []):
30
- for vulnerability in dependency.get("vulnerabilities", []):
31
- vulnerable_software = vulnerability.get("vulnerableSoftware", [])
32
- fix = (
33
- vulnerable_software[0]
34
- .get("software", {})
35
- .get("versionEndExcluding", None)
36
- if vulnerable_software
37
- else None
38
- )
39
- finding_open = Finding(
40
- id=vulnerability["name"][:20],
41
- cvss=str(vulnerability.get("cvssv3", {})),
42
- where=dependency.get("fileName").split(":")[-1].strip(),
43
- description=vulnerability["description"][:170].replace("\n\n", " "),
44
- severity=vulnerability["severity"].lower(),
45
- identification_date=datetime.now().strftime("%d%m%Y"),
46
- published_date_cve=None,
47
- module="engine_dependencies",
48
- category=Category.VULNERABILITY,
49
- requirements=fix,
50
- tool="DEPENDENCY_CHECK",
51
- )
52
- list_open_vulnerabilities.append(finding_open)
25
+
26
+ for dependency in dependencies:
27
+ vulnerabilities_node = dependency.find('ns:vulnerabilities', namespace)
28
+ if vulnerabilities_node:
29
+ vulnerabilities = vulnerabilities_node.findall('ns:vulnerability', namespace)
30
+ for vulnerability in vulnerabilities:
31
+ fix = "Not found"
32
+ vulnerable_software = vulnerability.find('ns:vulnerableSoftware', namespace)
33
+ if vulnerable_software:
34
+ software = vulnerable_software.findall('ns:software', namespace)
35
+ if len(software) > 0:
36
+ fix = software[0].get("versionEndExcluding", "Not found").lower()
37
+
38
+ id = vulnerability.find('ns:name', namespace).text[:20]
39
+ cvss = ", ".join(f"{child.tag.split('}')[-1]}: {child.text}" for child in vulnerability.find('ns:cvssV3', namespace)) if vulnerability.find('ns:cvssV3', namespace) else ""
40
+ fileName = dependency.find('ns:fileName', namespace).text.split(":")[-1].strip()
41
+ description = vulnerability.find('ns:description', namespace).text if vulnerability.find('ns:description', namespace).text else ""
42
+ severity = vulnerability.find('ns:severity', namespace).text.lower()
43
+ cvss
44
+ finding_open = Finding(
45
+ id=id,
46
+ cvss=cvss,
47
+ where=fileName,
48
+ description=description[:120].replace("\n\n", " ").replace("\n", " ").strip() if len(description) > 0 else "No description available",
49
+ severity=severity,
50
+ identification_date=datetime.now().strftime("%d%m%Y"),
51
+ published_date_cve=None,
52
+ module="engine_dependencies",
53
+ category=Category.VULNERABILITY,
54
+ requirements=fix,
55
+ tool="DEPENDENCY_CHECK",
56
+ )
57
+ list_open_vulnerabilities.append(finding_open)
53
58
 
54
59
  return list_open_vulnerabilities
55
60
 
56
- def load_results(self, dependencies_scanned_file):
57
- try:
58
- with open(dependencies_scanned_file) as f:
59
- data = json.load(f)
60
- return data
61
- except Exception as ex:
62
- logger.error(f"An error ocurred loading dependency-check results {ex}")
63
- return None
61
+ def filter_vulnerabilities_by_confidence(self, dependencies_scanned_file, remote_config):
62
+ data_result = ET.parse(dependencies_scanned_file)
63
+ root = data_result.getroot()
64
+
65
+ namespace_uri = root.tag.split('}')[0].strip('{')
66
+ namespace = {'ns': namespace_uri}
67
+ ET.register_namespace('', namespace_uri)
68
+
69
+ confidence_levels = ["low", "medium", "high", "highest"]
70
+ confidences = remote_config[self.TOOL]["VULNERABILITY_CONFIDENCE"]
71
+
72
+ dependencies = root.find('ns:dependencies', namespace)
73
+ if dependencies:
74
+ to_remove = []
75
+ for dep in dependencies.findall('ns:dependency', namespace):
76
+ identifiers = dep.find('ns:identifiers', namespace)
77
+ if identifiers:
78
+ vulnerability_ids = identifiers.findall('ns:vulnerabilityIds', namespace)
79
+ if vulnerability_ids:
80
+ vul_ids_confidences = [conf.get("confidence", "").lower() for conf in vulnerability_ids]
81
+ if len(vul_ids_confidences) > 0:
82
+ if not max(vul_ids_confidences, key=lambda c: confidence_levels.index(c)) in confidences:
83
+ to_remove.append(dep)
84
+ elif not "no_confidence" in confidences:
85
+ to_remove.append(dep)
86
+ for dep in to_remove: dependencies.remove(dep)
87
+ data_result.write(dependencies_scanned_file, encoding="utf-8", xml_declaration=True)
88
+
89
+ return dependencies, namespace
@@ -19,8 +19,12 @@ logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
19
19
 
20
20
 
21
21
  class DependencyCheckTool(ToolGateway):
22
+ def __init__(self):
23
+ self.download_tool_called = False
24
+
22
25
  def download_tool(self, cli_version):
23
26
  try:
27
+ self.download_tool_called = True
24
28
  url = f"https://github.com/jeremylong/DependencyCheck/releases/download/v{cli_version}/dependency-check-{cli_version}-release.zip"
25
29
  response = requests.get(url, allow_redirects=True)
26
30
  home_directory = os.path.expanduser("~")
@@ -66,13 +70,12 @@ class DependencyCheckTool(ToolGateway):
66
70
  command = [
67
71
  command_prefix,
68
72
  "--format",
69
- "JSON",
70
- "--format",
71
73
  "XML",
72
74
  "--nvdApiKey",
73
75
  token,
74
76
  "--scan",
75
77
  file_to_scan,
78
+ "--noupdate"
76
79
  ]
77
80
 
78
81
  if not token:
@@ -82,11 +85,10 @@ class DependencyCheckTool(ToolGateway):
82
85
  command = [
83
86
  command_prefix,
84
87
  "--format",
85
- "JSON",
86
- "--format",
87
88
  "XML",
88
89
  "--scan",
89
90
  file_to_scan,
91
+ "--noupdate"
90
92
  ]
91
93
 
92
94
  subprocess.run(command, capture_output=True, check=True)
@@ -46,7 +46,7 @@ class XrayDeserializator(DeserializatorGateway):
46
46
  ]
47
47
  return vulnerabilities
48
48
 
49
- def get_list_findings(self, dependencies_scanned_file) -> "list[Finding]":
49
+ def get_list_findings(self, dependencies_scanned_file, remote_config) -> "list[Finding]":
50
50
  list_open_vulnerabilities = []
51
51
  with open(dependencies_scanned_file, "rb") as file:
52
52
  json_data = json.loads(file.read())
@@ -49,7 +49,7 @@ class AzureDevopsApi:
49
49
  except Exception as e:
50
50
  raise ApiError("Error getting Azure DevOps connection: " + str(e))
51
51
 
52
- def get_remote_json_config(self, connection: Connection, branch):
52
+ def get_remote_json_config(self, connection: Connection, branch=""):
53
53
  try:
54
54
  git_client = connection.clients.get_git_client()
55
55
  version_descriptor = None
@@ -190,7 +190,7 @@ class ReportSonar:
190
190
  logger.warning(f"It was not possible to synchronize Sonar and Vulnerability Manager: {e}")
191
191
 
192
192
  input_core.scope_pipeline = project_key
193
- if re.match(report_config_tool["SCOPE_VALIDATION_REGEX"], source_code_management_uri, re.IGNORECASE):
193
+ if re.match(report_config_tool["SCOPE_VALIDATION_REGEX"], self.devops_platform_gateway.get_variable("repository_provider"), re.IGNORECASE):
194
194
  input_core.scope_pipeline = pipeline_name
195
195
 
196
196
  self.vulnerability_management_gateway.send_vulnerability_management(
@@ -1 +1 @@
1
- version = '1.23.2'
1
+ version = '1.24.1'
@@ -1,6 +1,6 @@
1
1
  Metadata-Version: 2.1
2
2
  Name: devsecops-engine-tools
3
- Version: 1.23.2
3
+ Version: 1.24.1
4
4
  Summary: Tool for DevSecOps strategy
5
5
  Home-page: https://github.com/bancolombia/devsecops-engine-tools
6
6
  Author: Bancolombia DevSecOps Team
@@ -1,5 +1,5 @@
1
1
  devsecops_engine_tools/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
2
- devsecops_engine_tools/version.py,sha256=WhBlxj7zPvgn7L0tTf0vHC7F7bzYaXubWH1FyqpgbKQ,19
2
+ devsecops_engine_tools/version.py,sha256=60Kvr0rSTJ9SYGMHHXTlDAGMXhJK6ufRBv4rEfAZtXE,19
3
3
  devsecops_engine_tools/engine_core/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
4
4
  devsecops_engine_tools/engine_core/src/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
5
5
  devsecops_engine_tools/engine_core/src/applications/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -197,19 +197,19 @@ devsecops_engine_tools/engine_sca/engine_dependencies/src/deployment/infrastruct
197
197
  devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
198
198
  devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/model/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
199
199
  devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/model/gateways/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
200
- devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/model/gateways/deserializator_gateway.py,sha256=WOJbKbeFIbQ0IR6lic2JheTPUJPPzAYsGykU1DiMmHw,286
200
+ devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/model/gateways/deserializator_gateway.py,sha256=A4WPW-cNMlitI7-P2L-W2hFUPvIU7Ejk6JxRJGATfwc,301
201
201
  devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/model/gateways/tool_gateway.py,sha256=KVHx_8A7hSUQqZdq0S8-yX2f_L2wYDC6TodSV96f3ww,273
202
202
  devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/usecases/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
203
- devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/usecases/dependencies_sca_scan.py,sha256=ZsNl4K4hXC4H2VGu4UEe2yRA6HvMRxQ2Jrs0rE8KezU,1542
203
+ devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/usecases/dependencies_sca_scan.py,sha256=0JYY5g3bSSiEqFdsN5phglX76z3YpiyGTL_CvBvO274,1562
204
204
  devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/usecases/handle_remote_config_patterns.py,sha256=cTM8IQRZJBr5zG5nhCkTxuw2fCHDZ3wrPgQhRjG88pg,968
205
205
  devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/usecases/set_input_core.py,sha256=0M53iuI0VEDcYk9G4EuAFTc1Iok3xqiWLHYuKaU3dqg,2250
206
206
  devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
207
207
  devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
208
208
  devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/dependency_check/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
209
- devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/dependency_check/dependency_check_deserialize.py,sha256=ihsWd10JnYmnhsm22KbND_GvBKGwAeEuPbiBe0Wx1kQ,2582
210
- devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/dependency_check/dependency_check_tool.py,sha256=a63ny6Jt8tZzcb7dS8Nes2DqOHs9oQuLFhzz7nEMhHQ,5059
209
+ devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/dependency_check/dependency_check_deserialize.py,sha256=iI9nkJVJaagEGFaZ9AABYflla1PvCgu6afl9LYm35AU,4654
210
+ devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/dependency_check/dependency_check_tool.py,sha256=T34iL4zFjyWYrRKDR0I6dfrXCyzIRM1nrqck4ubXm_w,5121
211
211
  devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/xray_tool/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
212
- devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/xray_tool/xray_deserialize_output.py,sha256=Vm0pj1i6a34xXouXUU95Y04hzR--9tcMQuycR7IMUnQ,2221
212
+ devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/xray_tool/xray_deserialize_output.py,sha256=ZUk-e1PKzV7uRAT7BpET363pgl2eMnXMCGSpewsOpKg,2236
213
213
  devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/xray_tool/xray_manager_scan.py,sha256=u8SAtVuTqJ6o2B6jC-gMNG2Pn7a_bHWT_B1a_55iYZ4,7408
214
214
  devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/entry_points/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
215
215
  devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/entry_points/entry_point_tool.py,sha256=3EJ00WleYziW_EenXsJQ_OLOV1hAulSuVXjc42sGUIQ,2606
@@ -219,7 +219,7 @@ devsecops_engine_tools/engine_utilities/__init__.py,sha256=47DEQpj8HBSa-_TImW-5J
219
219
  devsecops_engine_tools/engine_utilities/settings.py,sha256=CPnDndwVeRgQNml3HVzvytVruDd8dTd1ICHbkMDSgTM,2144
220
220
  devsecops_engine_tools/engine_utilities/azuredevops/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
221
221
  devsecops_engine_tools/engine_utilities/azuredevops/infrastructure/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
222
- devsecops_engine_tools/engine_utilities/azuredevops/infrastructure/azure_devops_api.py,sha256=yhZaXC2RQEhGfXt-ULTdDLG9PI9WjV7iscxhDHwfm8w,2965
222
+ devsecops_engine_tools/engine_utilities/azuredevops/infrastructure/azure_devops_api.py,sha256=l_sRaktn51NEeJowtEJWfUnUmjaU9uRTqXo4jcNR24E,2968
223
223
  devsecops_engine_tools/engine_utilities/azuredevops/models/AzureMessageLoggingPipeline.py,sha256=pCwlPDDl-hgvZ9gvceuC8GsKbsMhRm3ykhFFVByVqcI,664
224
224
  devsecops_engine_tools/engine_utilities/azuredevops/models/AzurePredefinedVariables.py,sha256=r-PpcKlyuXzKHx6ao4SuVI9dOKMVnjL1U_b-yfJK0o4,2387
225
225
  devsecops_engine_tools/engine_utilities/azuredevops/models/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -288,7 +288,7 @@ devsecops_engine_tools/engine_utilities/sonarqube/src/domain/model/__init__.py,s
288
288
  devsecops_engine_tools/engine_utilities/sonarqube/src/domain/model/gateways/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
289
289
  devsecops_engine_tools/engine_utilities/sonarqube/src/domain/model/gateways/sonar_gateway.py,sha256=PCrGq7NOINAFPvmX-5V5191MGhahsnQeWXUB1-xL4Xw,1279
290
290
  devsecops_engine_tools/engine_utilities/sonarqube/src/domain/usecases/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
291
- devsecops_engine_tools/engine_utilities/sonarqube/src/domain/usecases/report_sonar.py,sha256=iAmogxLTYLWgN524--8IT33T_p54rdvQdRymAHGK-C0,9048
291
+ devsecops_engine_tools/engine_utilities/sonarqube/src/domain/usecases/report_sonar.py,sha256=SOqTVfbzFZ8ZAaLh_cynAFwT8_FlFYCcrMKTLwWJURo,9086
292
292
  devsecops_engine_tools/engine_utilities/sonarqube/src/infrastructure/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
293
293
  devsecops_engine_tools/engine_utilities/sonarqube/src/infrastructure/driven_adapters/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
294
294
  devsecops_engine_tools/engine_utilities/sonarqube/src/infrastructure/driven_adapters/sonarqube/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -308,8 +308,8 @@ devsecops_engine_tools/engine_utilities/utils/name_conversion.py,sha256=ADJrRGax
308
308
  devsecops_engine_tools/engine_utilities/utils/printers.py,sha256=amYAr9YQfYgR6jK9a2l26z3oovFPQ3FAKmhq6BKhEBA,623
309
309
  devsecops_engine_tools/engine_utilities/utils/session_manager.py,sha256=yNtlT-8Legz1sHbGPH8LNYjL-LgDUE0zXG2rYjiab7U,290
310
310
  devsecops_engine_tools/engine_utilities/utils/utils.py,sha256=yvCbPKAWa7wxk5S-s_Xkvx9VtnIpv9eWUMG8wtlmrhs,5870
311
- devsecops_engine_tools-1.23.2.dist-info/METADATA,sha256=N5-qql91wwAB1MAWeyNOeCNaA8kbabphHq0yJ94eC9U,10943
312
- devsecops_engine_tools-1.23.2.dist-info/WHEEL,sha256=R0nc6qTxuoLk7ShA2_Y-UWkN8ZdfDBG2B6Eqpz2WXbs,91
313
- devsecops_engine_tools-1.23.2.dist-info/entry_points.txt,sha256=MHCTFFs9bdNKo6YcWCcBW2_8X6yTisgLOlmVx-V8Rxc,276
314
- devsecops_engine_tools-1.23.2.dist-info/top_level.txt,sha256=ge6y0X_xBAU1aG3EMWFtl9djbVyg5BxuSp2r2Lg6EQU,23
315
- devsecops_engine_tools-1.23.2.dist-info/RECORD,,
311
+ devsecops_engine_tools-1.24.1.dist-info/METADATA,sha256=eh484HcoNCg1p-ztHmAlG3EaO6t2VLcFjXgJHSX3LyI,10943
312
+ devsecops_engine_tools-1.24.1.dist-info/WHEEL,sha256=R0nc6qTxuoLk7ShA2_Y-UWkN8ZdfDBG2B6Eqpz2WXbs,91
313
+ devsecops_engine_tools-1.24.1.dist-info/entry_points.txt,sha256=MHCTFFs9bdNKo6YcWCcBW2_8X6yTisgLOlmVx-V8Rxc,276
314
+ devsecops_engine_tools-1.24.1.dist-info/top_level.txt,sha256=ge6y0X_xBAU1aG3EMWFtl9djbVyg5BxuSp2r2Lg6EQU,23
315
+ devsecops_engine_tools-1.24.1.dist-info/RECORD,,