devsecops-engine-tools 1.24.4__tar.gz → 1.25.0__tar.gz

{devsecops_engine_tools-1.24.4 → devsecops_engine_tools-1.25.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.24.4
+Version: 1.25.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team
@@ -26,6 +26,8 @@ Requires-Dist: boto3==1.34.157
 Requires-Dist: docker==7.1.0
 Requires-Dist: setuptools==72.1.0
 Requires-Dist: rich==13.9.4
+Requires-Dist: cpe==1.3.1
+Requires-Dist: packageurl-python==0.15.6
 
 # DevSecOps Engine Tools
 

{devsecops_engine_tools-1.24.4 → devsecops_engine_tools-1.25.0}/devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/dependency_check/dependency_check_deserialize.py

@@ -8,6 +8,8 @@ from devsecops_engine_tools.engine_core.src.domain.model.finding import (
 from dataclasses import dataclass
 from datetime import datetime
 import xml.etree.ElementTree as ET
+from packageurl import PackageURL
+from cpe import CPE
 from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
 from devsecops_engine_tools.engine_utilities import settings
 
@@ -37,14 +39,14 @@ class DependencyCheckDeserialize(DeserializatorGateway):
                     
                     id = vulnerability.find('ns:name', namespace).text[:20]
                     cvss = ", ".join(f"{child.tag.split('}')[-1]}: {child.text}" for child in vulnerability.find('ns:cvssV3', namespace)) if vulnerability.find('ns:cvssV3', namespace) else ""
-                    fileName = dependency.find('ns:fileName', namespace).text.split(":")[-1].strip()
+                    where = self.get_where(dependency, namespace)
                     description = vulnerability.find('ns:description', namespace).text if vulnerability.find('ns:description', namespace).text else ""
                     severity = vulnerability.find('ns:severity', namespace).text.lower()
-                    cvss
+                    
                     finding_open = Finding(
                         id=id,
                         cvss=cvss,
-                        where=fileName,
+                        where=where,
                         description=description[:120].replace("\n\n", " ").replace("\n", " ").strip() if len(description) > 0 else "No description available",
                         severity=severity,
                         identification_date=datetime.now().strftime("%d%m%Y"),
@@ -86,4 +88,68 @@ class DependencyCheckDeserialize(DeserializatorGateway):
             for dep in to_remove: dependencies.remove(dep)
             data_result.write(dependencies_scanned_file, encoding="utf-8", xml_declaration=True)
         
-        return dependencies, namespace
+        return dependencies, namespace
+
+    def get_where(self, dependency, namespace):
+        identifiers_node = dependency.find("ns:identifiers", namespace)
+        if identifiers_node:
+            package_node = identifiers_node.find(".//ns:package", namespace)
+            if package_node:
+                id = package_node.find("ns:id", namespace).text
+                purl = PackageURL.from_string(id)
+                purl_parts = purl.to_dict()
+                component_name = (
+                    purl_parts["namespace"] + ":"
+                    if purl_parts["namespace"]
+                    and len(purl_parts["namespace"]) > 0
+                    else ""
+                )
+                component_name += (
+                    purl_parts["name"]
+                    if purl_parts["name"] and len(purl_parts["name"]) > 0
+                    else ""
+                )
+                component_name = component_name or None
+                component_version = (
+                    purl_parts["version"]
+                    if purl_parts["version"] and len(purl_parts["version"]) > 0
+                    else ""
+                )
+                return f"{component_name}:{component_version}"
+
+            cpe_node = identifiers_node.find(
+                ".//ns:identifier[@type='cpe']", namespace
+            )
+            if cpe_node:
+                id = cpe_node.find("ns:name", namespace).text
+                cpe = CPE(id)
+                component_name = (
+                    cpe.get_vendor()[0] + ":"
+                    if len(cpe.get_vendor()) > 0
+                    else ""
+                )
+                component_name += (
+                    cpe.get_product()[0] if len(cpe.get_product()) > 0 else ""
+                )
+                component_name = component_name or None
+                component_version = (
+                    cpe.get_version()[0]
+                    if len(cpe.get_version()) > 0
+                    else None
+                )
+                return f"{component_name}:{component_version}"
+
+            maven_node = identifiers_node.find(
+                ".//ns:identifier[@type='maven']", namespace
+            )
+            if maven_node:
+                maven_parts = maven_node.find("ns:name", namespace).text.split(
+                    ":",
+                )
+
+                if len(maven_parts) == 3:
+                    component_name = maven_parts[0] + ":" + maven_parts[1]
+                    component_version = maven_parts[2]
+                    return f"{component_name}:{component_version}"
+
+        return ""

devsecops_engine_tools-1.25.0/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.25.0'

{devsecops_engine_tools-1.24.4 → devsecops_engine_tools-1.25.0}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.24.4
+Version: 1.25.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team
@@ -26,6 +26,8 @@ Requires-Dist: boto3==1.34.157
 Requires-Dist: docker==7.1.0
 Requires-Dist: setuptools==72.1.0
 Requires-Dist: rich==13.9.4
+Requires-Dist: cpe==1.3.1
+Requires-Dist: packageurl-python==0.15.6
 
 # DevSecOps Engine Tools
 

{devsecops_engine_tools-1.24.4 → devsecops_engine_tools-1.25.0}/devsecops_engine_tools.egg-info/requires.txt

@@ -14,3 +14,5 @@ boto3==1.34.157
 docker==7.1.0
 setuptools==72.1.0
 rich==13.9.4
+cpe==1.3.1
+packageurl-python==0.15.6

devsecops_engine_tools-1.24.4/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.24.4'