devsecops-engine-tools 1.24.4__py3-none-any.whl → 1.25.0__py3-none-any.whl

devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/dependency_check/dependency_check_deserialize.py

@@ -8,6 +8,8 @@ from devsecops_engine_tools.engine_core.src.domain.model.finding import (
 from dataclasses import dataclass
 from datetime import datetime
 import xml.etree.ElementTree as ET
+from packageurl import PackageURL
+from cpe import CPE
 from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
 from devsecops_engine_tools.engine_utilities import settings
 
@@ -37,14 +39,14 @@ class DependencyCheckDeserialize(DeserializatorGateway):
                     
                     id = vulnerability.find('ns:name', namespace).text[:20]
                     cvss = ", ".join(f"{child.tag.split('}')[-1]}: {child.text}" for child in vulnerability.find('ns:cvssV3', namespace)) if vulnerability.find('ns:cvssV3', namespace) else ""
-                    fileName = dependency.find('ns:fileName', namespace).text.split(":")[-1].strip()
+                    where = self.get_where(dependency, namespace)
                     description = vulnerability.find('ns:description', namespace).text if vulnerability.find('ns:description', namespace).text else ""
                     severity = vulnerability.find('ns:severity', namespace).text.lower()
-                    cvss
+                    
                     finding_open = Finding(
                         id=id,
                         cvss=cvss,
-                        where=fileName,
+                        where=where,
                         description=description[:120].replace("\n\n", " ").replace("\n", " ").strip() if len(description) > 0 else "No description available",
                         severity=severity,
                         identification_date=datetime.now().strftime("%d%m%Y"),
@@ -86,4 +88,68 @@ class DependencyCheckDeserialize(DeserializatorGateway):
             for dep in to_remove: dependencies.remove(dep)
             data_result.write(dependencies_scanned_file, encoding="utf-8", xml_declaration=True)
         
-        return dependencies, namespace
+        return dependencies, namespace
+
+    def get_where(self, dependency, namespace):
+        identifiers_node = dependency.find("ns:identifiers", namespace)
+        if identifiers_node:
+            package_node = identifiers_node.find(".//ns:package", namespace)
+            if package_node:
+                id = package_node.find("ns:id", namespace).text
+                purl = PackageURL.from_string(id)
+                purl_parts = purl.to_dict()
+                component_name = (
+                    purl_parts["namespace"] + ":"
+                    if purl_parts["namespace"]
+                    and len(purl_parts["namespace"]) > 0
+                    else ""
+                )
+                component_name += (
+                    purl_parts["name"]
+                    if purl_parts["name"] and len(purl_parts["name"]) > 0
+                    else ""
+                )
+                component_name = component_name or None
+                component_version = (
+                    purl_parts["version"]
+                    if purl_parts["version"] and len(purl_parts["version"]) > 0
+                    else ""
+                )
+                return f"{component_name}:{component_version}"
+
+            cpe_node = identifiers_node.find(
+                ".//ns:identifier[@type='cpe']", namespace
+            )
+            if cpe_node:
+                id = cpe_node.find("ns:name", namespace).text
+                cpe = CPE(id)
+                component_name = (
+                    cpe.get_vendor()[0] + ":"
+                    if len(cpe.get_vendor()) > 0
+                    else ""
+                )
+                component_name += (
+                    cpe.get_product()[0] if len(cpe.get_product()) > 0 else ""
+                )
+                component_name = component_name or None
+                component_version = (
+                    cpe.get_version()[0]
+                    if len(cpe.get_version()) > 0
+                    else None
+                )
+                return f"{component_name}:{component_version}"
+
+            maven_node = identifiers_node.find(
+                ".//ns:identifier[@type='maven']", namespace
+            )
+            if maven_node:
+                maven_parts = maven_node.find("ns:name", namespace).text.split(
+                    ":",
+                )
+
+                if len(maven_parts) == 3:
+                    component_name = maven_parts[0] + ":" + maven_parts[1]
+                    component_version = maven_parts[2]
+                    return f"{component_name}:{component_version}"
+
+        return ""

devsecops_engine_tools/version.py

@@ -1 +1 @@
-version = '1.24.4'
+version = '1.25.0'

{devsecops_engine_tools-1.24.4.dist-info → devsecops_engine_tools-1.25.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.24.4
+Version: 1.25.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team
@@ -26,6 +26,8 @@ Requires-Dist: boto3==1.34.157
 Requires-Dist: docker==7.1.0
 Requires-Dist: setuptools==72.1.0
 Requires-Dist: rich==13.9.4
+Requires-Dist: cpe==1.3.1
+Requires-Dist: packageurl-python==0.15.6
 
 # DevSecOps Engine Tools
 

{devsecops_engine_tools-1.24.4.dist-info → devsecops_engine_tools-1.25.0.dist-info}/RECORD

@@ -1,5 +1,5 @@
 devsecops_engine_tools/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-devsecops_engine_tools/version.py,sha256=nxK2BgifENKV6dt-QsgVy0XRMMENjCqihuFovRTFDxo,19
+devsecops_engine_tools/version.py,sha256=H5emCtCaqtHr-9dLv_SG9PwZ_mJKNcZ0wZ2S_f-TQHQ,19
 devsecops_engine_tools/engine_core/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_core/src/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_core/src/applications/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -206,7 +206,7 @@ devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/usecases/set_in
 devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/dependency_check/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/dependency_check/dependency_check_deserialize.py,sha256=iI9nkJVJaagEGFaZ9AABYflla1PvCgu6afl9LYm35AU,4654
+devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/dependency_check/dependency_check_deserialize.py,sha256=ptNRUxAjTfPf_kkafC2SlLCD6Loddf4que6pxipJNO4,7210
 devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/dependency_check/dependency_check_tool.py,sha256=T34iL4zFjyWYrRKDR0I6dfrXCyzIRM1nrqck4ubXm_w,5121
 devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/xray_tool/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/xray_tool/xray_deserialize_output.py,sha256=ZUk-e1PKzV7uRAT7BpET363pgl2eMnXMCGSpewsOpKg,2236
@@ -308,8 +308,8 @@ devsecops_engine_tools/engine_utilities/utils/name_conversion.py,sha256=ADJrRGax
 devsecops_engine_tools/engine_utilities/utils/printers.py,sha256=amYAr9YQfYgR6jK9a2l26z3oovFPQ3FAKmhq6BKhEBA,623
 devsecops_engine_tools/engine_utilities/utils/session_manager.py,sha256=yNtlT-8Legz1sHbGPH8LNYjL-LgDUE0zXG2rYjiab7U,290
 devsecops_engine_tools/engine_utilities/utils/utils.py,sha256=yvCbPKAWa7wxk5S-s_Xkvx9VtnIpv9eWUMG8wtlmrhs,5870
-devsecops_engine_tools-1.24.4.dist-info/METADATA,sha256=6PGOMHLoCAB5KfO60Ut4bauTOOUARHLmaAm0u5XhYOM,10943
-devsecops_engine_tools-1.24.4.dist-info/WHEEL,sha256=R0nc6qTxuoLk7ShA2_Y-UWkN8ZdfDBG2B6Eqpz2WXbs,91
-devsecops_engine_tools-1.24.4.dist-info/entry_points.txt,sha256=MHCTFFs9bdNKo6YcWCcBW2_8X6yTisgLOlmVx-V8Rxc,276
-devsecops_engine_tools-1.24.4.dist-info/top_level.txt,sha256=ge6y0X_xBAU1aG3EMWFtl9djbVyg5BxuSp2r2Lg6EQU,23
-devsecops_engine_tools-1.24.4.dist-info/RECORD,,
+devsecops_engine_tools-1.25.0.dist-info/METADATA,sha256=oJKPtxsdfGzrdqYgZg1sokubbszwx1AceewY7AJkqWg,11010
+devsecops_engine_tools-1.25.0.dist-info/WHEEL,sha256=R0nc6qTxuoLk7ShA2_Y-UWkN8ZdfDBG2B6Eqpz2WXbs,91
+devsecops_engine_tools-1.25.0.dist-info/entry_points.txt,sha256=MHCTFFs9bdNKo6YcWCcBW2_8X6yTisgLOlmVx-V8Rxc,276
+devsecops_engine_tools-1.25.0.dist-info/top_level.txt,sha256=ge6y0X_xBAU1aG3EMWFtl9djbVyg5BxuSp2r2Lg6EQU,23
+devsecops_engine_tools-1.25.0.dist-info/RECORD,,