devsecops-engine-tools 1.24.4__tar.gz → 1.25.1__tar.gz

{devsecops_engine_tools-1.24.4 → devsecops_engine_tools-1.25.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.24.4
+Version: 1.25.1
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team
@@ -26,6 +26,8 @@ Requires-Dist: boto3==1.34.157
 Requires-Dist: docker==7.1.0
 Requires-Dist: setuptools==72.1.0
 Requires-Dist: rich==13.9.4
+Requires-Dist: cpe==1.3.1
+Requires-Dist: packageurl-python==0.15.6
 
 # DevSecOps Engine Tools
 

{devsecops_engine_tools-1.24.4 → devsecops_engine_tools-1.25.1}/devsecops_engine_tools/engine_sca/engine_container/src/domain/model/gateways/images_gateway.py

@@ -5,3 +5,7 @@ class ImagesGateway(metaclass=ABCMeta):
     @abstractmethod
     def list_images(self, image_to_scan) -> str:
         "get image to scan"
+
+    @abstractmethod
+    def get_base_image(self, image_to_scan) -> str:
+        "get base image"

{devsecops_engine_tools-1.24.4 → devsecops_engine_tools-1.25.1}/devsecops_engine_tools/engine_sca/engine_container/src/domain/model/gateways/tool_gateway.py

@@ -3,5 +3,5 @@ from abc import ABCMeta, abstractmethod
 
 class ToolGateway(metaclass=ABCMeta):
     @abstractmethod
-    def run_tool_container_sca(self, dict_args, secret_tool, token_engine_container, scan_image, release) -> str:
+    def run_tool_container_sca(self, dict_args, secret_tool, token_engine_container, scan_image, release, base_image, exclusions) -> str:
         "run tool container sca"

{devsecops_engine_tools-1.24.4 → devsecops_engine_tools-1.25.1}/devsecops_engine_tools/engine_sca/engine_container/src/domain/usecases/container_sca_scan.py

@@ -22,6 +22,7 @@ class ContainerScaScan:
         secret_tool,
         token_engine_container,
         image_to_scan,
+        exclusions
     ):
         self.tool_run = tool_run
         self.remote_config = remote_config
@@ -31,6 +32,7 @@ class ContainerScaScan:
         self.secret_tool = secret_tool
         self.token_engine_container = token_engine_container
         self.image_to_scan = image_to_scan
+        self.exclusions = exclusions
 
     def get_image(self, image_to_scan):
         """
@@ -41,6 +43,15 @@ class ContainerScaScan:
         """
         return self.tool_images.list_images(image_to_scan)
 
+    def get_base_image(self, matching_image):
+            """
+            Process the base image.
+
+            Returns:
+                String: base image.
+            """
+            return self.tool_images.get_base_image(matching_image)
+
     def get_images_already_scanned(self):
         """
         Create images scanned file if it does not exist and get the images that have already been scanned.
@@ -66,21 +77,24 @@ class ContainerScaScan:
         Returns:
             string: file scanning results name.
         """
-        matching_image = self.get_image(self.image_to_scan)
+        base_image = None
         image_scanned = None
+        matching_image = self.get_image(self.image_to_scan)
+        if self.remote_config['GET_IMAGE_BASE']:
+            base_image = self.get_base_image(matching_image)
         if matching_image:
             image_name = matching_image.tags[0]
             result_file = image_name.replace("/","_") + "_scan_result.json"
             if image_name in self.get_images_already_scanned():
                 print(f"The image {image_name} has already been scanned previously.")
-                return image_scanned
+                return image_scanned, base_image
             image_scanned = self.tool_run.run_tool_container_sca(
-                self.remote_config, self.secret_tool, self.token_engine_container, image_name, result_file
+                self.remote_config, self.secret_tool, self.token_engine_container, image_name, result_file, base_image, self.exclusions
             )
             self.set_image_scanned(image_name)
         else:
             print(f"'Not image found for {self.image_to_scan}'. Tool skipped.")
-        return image_scanned
+        return image_scanned, base_image
 
     def deseralizator(self, image_scanned):
         """

{devsecops_engine_tools-1.24.4 → devsecops_engine_tools-1.25.1}/devsecops_engine_tools/engine_sca/engine_container/src/domain/usecases/set_input_core.py

@@ -12,25 +12,37 @@ class SetInputCore:
         self.tool = tool
         self.stage = stage
 
-    def get_exclusions(self, exclusions_data, pipeline_name, tool):
-        list_exclusions = [
-            Exclusions(
-                id=item.get("id", ""),
-                where=item.get("where", ""),
-                cve_id=item.get("cve_id", ""),
-                create_date=item.get("create_date", ""),
-                expired_date=item.get("expired_date", ""),
-                severity=item.get("severity", ""),
-                hu=item.get("hu", ""),
-                reason=item.get("reason", "Risk acceptance"),
-            )
-            for key, value in exclusions_data.items()
-            if key in {"All", pipeline_name} and value.get(tool)
-            for item in value[tool]
-        ]
+    def get_exclusions(self, exclusions_data, pipeline_name, tool, base_image):
+        list_exclusions = []
+        print("The base image used is:", base_image)
+        for key, value in exclusions_data.items():
+            if key not in {"All", pipeline_name} or not value.get(tool):
+                continue
+
+            for item in value[tool]:
+                if key == "All":
+                    source_images = item.get("source_images", [])
+                    if source_images and base_image is None:
+                        continue
+                    if source_images and not any(base_image in source for source in source_images):
+                        continue
+                    
+                list_exclusions.append(
+                    Exclusions(
+                        id=item.get("id", ""),
+                        where=item.get("where", ""),
+                        cve_id=item.get("cve_id", ""),
+                        create_date=item.get("create_date", ""),
+                        expired_date=item.get("expired_date", ""),
+                        severity=item.get("severity", ""),
+                        hu=item.get("hu", ""),
+                        reason=item.get("reason", "Risk acceptance"),
+                    )
+                )
+
         return list_exclusions
 
-    def set_input_core(self, image_scanned):
+    def set_input_core(self, image_scanned,base_image):
         """
         Set the input core.
 
@@ -42,6 +54,7 @@ class SetInputCore:
                 self.exclusions,
                 self.pipeline_name,
                 self.tool,
+                base_image
             ),
             Utils.update_threshold(
                 self,

{devsecops_engine_tools-1.24.4 → devsecops_engine_tools-1.25.1}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/docker/docker_images.py

@@ -31,3 +31,20 @@ class DockerImages(ImagesGateway):
             logger.error(
                 f"Error listing images, docker must be running and added to PATH: {e}"
             )
+
+    def get_base_image(self, matching_image):
+        try:
+            client = docker.from_env()
+            image_details = client.api.inspect_image(matching_image.id)
+            labels = image_details.get("Config", {}).get("Labels", {})
+            source_image = labels.get("source-image")
+            if source_image:
+                logger.info(f"Base image for '{matching_image}' from source-image label: {source_image}")
+                return source_image
+
+            logger.warning(f"Base image not found for '{matching_image}'.")
+            return None
+
+        except Exception as e:
+            logger.error(f"Error getting base image: {e}")
+            return None

{devsecops_engine_tools-1.24.4 → devsecops_engine_tools-1.25.1}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/prisma_cloud/prisma_cloud_manager_scan.py

@@ -4,6 +4,7 @@ import os
 import subprocess
 import logging
 import base64
+import json
 from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.gateways.tool_gateway import (
     ToolGateway,
 )
@@ -68,14 +69,36 @@ class PrismaCloudManagerScan(ToolGateway):
                 text=True,
             )
             print(f"The image {image_name} was scanned")
-
             return result_file
 
         except subprocess.CalledProcessError as e:
             logger.error(f"Error during image scan of {image_name}: {e.stderr}")
 
+    def _write_image_base(self, result_file, base_image, exclusions_data):
+        try:
+            with open(result_file, "r") as file:
+                data = json.load(file)
+
+            prisma_exclusions = exclusions_data.get("All", {}).get("PRISMA", [])
+            modified = False
+            for result in data.get("results", []):
+                for vulnerability in result.get("vulnerabilities", []):
+                    for exclusion in prisma_exclusions:
+                        if (
+                            vulnerability.get("id") == exclusion.get("id") and
+                            any(image.startswith(base_image) for image in exclusion.get("source_images", []))
+                        ):
+                            vulnerability["baseImage"] = base_image
+                            modified = True
+
+            if modified:
+                with open(result_file, "w") as file:
+                    json.dump(data, file, indent=4)
+        except subprocess.CalledProcessError as e:
+             logger.error(f"Error during write image base of {base_image}: {e.stderr}")
+            
     def run_tool_container_sca(
-        self, remoteconfig, secret_tool, token_engine_container, image_name, result_file
+        self, remoteconfig, secret_tool, token_engine_container, image_name, result_file, base_image, exclusions
     ):
         prisma_secret_key = secret_tool["token_prisma_cloud"] if secret_tool else token_engine_container
         file_path = os.path.join(
@@ -95,7 +118,9 @@ class PrismaCloudManagerScan(ToolGateway):
             image_name,
             result_file,
             remoteconfig,
-            prisma_secret_key,
+            prisma_secret_key
         )
+        if base_image:
+            self._write_image_base(result_file, base_image, exclusions)
 
         return image_scanned

{devsecops_engine_tools-1.24.4 → devsecops_engine_tools-1.25.1}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/trivy_tool/trivy_manager_scan.py

@@ -7,6 +7,7 @@ import platform
 import requests
 import tarfile
 import zipfile
+import json
 
 from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
 from devsecops_engine_tools.engine_utilities import settings
@@ -52,7 +53,7 @@ class TrivyScan(ToolGateway):
             except Exception as e:
                 logger.error(f"Error installing trivy: {e}")
 
-    def scan_image(self, prefix, image_name, result_file):
+    def scan_image(self, prefix, image_name, result_file, base_image):
         command = [
             prefix,
             "--scanners",
@@ -78,7 +79,7 @@ class TrivyScan(ToolGateway):
         except Exception as e:
             logger.error(f"Error during image scan of {image_name}: {e}")
 
-    def run_tool_container_sca(self, remoteconfig, secret_tool, token_engine_container, image_name, result_file):
+    def run_tool_container_sca(self, remoteconfig, secret_tool, token_engine_container, image_name, result_file ,base_image, exclusions):
         trivy_version = remoteconfig["TRIVY"]["TRIVY_VERSION"]
         os_platform = platform.system()
         arch_platform = platform.architecture()[0]
@@ -101,7 +102,7 @@ class TrivyScan(ToolGateway):
             return None
 
         image_scanned = (
-            self.scan_image(command_prefix, image_name, result_file)
+            self.scan_image(command_prefix, image_name, result_file, base_image)
         )
 
         return image_scanned

{devsecops_engine_tools-1.24.4 → devsecops_engine_tools-1.25.1}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/entry_points/entry_point_tool.py

@@ -38,6 +38,7 @@ def init_engine_sca_rm(
     stage = tool_remote.get_variable("stage")
     image_to_scan = dict_args["image_to_scan"]
     image_scanned = None
+    base_image = None
     deseralized = []
     input_core = SetInputCore(remote_config, exclusions, pipeline_name, tool, stage)
     if scan_flag and not (skip_flag):
@@ -50,13 +51,14 @@ def init_engine_sca_rm(
             secret_tool,
             dict_args["token_engine_container"],
             image_to_scan,
+            exclusions
         )
-        image_scanned = container_sca_scan.process()
+        image_scanned,base_image = container_sca_scan.process()
         if image_scanned:
             deseralized = container_sca_scan.deseralizator(image_scanned)
     else:
         print("Tool skipped by DevSecOps policy")
         dict_args["send_metrics"] = "false"
-    core_input = input_core.set_input_core(image_scanned)
+    core_input = input_core.set_input_core(image_scanned,base_image)
 
     return deseralized, core_input

{devsecops_engine_tools-1.24.4 → devsecops_engine_tools-1.25.1}/devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/dependency_check/dependency_check_deserialize.py

@@ -8,6 +8,8 @@ from devsecops_engine_tools.engine_core.src.domain.model.finding import (
 from dataclasses import dataclass
 from datetime import datetime
 import xml.etree.ElementTree as ET
+from packageurl import PackageURL
+from cpe import CPE
 from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
 from devsecops_engine_tools.engine_utilities import settings
 
@@ -37,14 +39,14 @@ class DependencyCheckDeserialize(DeserializatorGateway):
                     
                     id = vulnerability.find('ns:name', namespace).text[:20]
                     cvss = ", ".join(f"{child.tag.split('}')[-1]}: {child.text}" for child in vulnerability.find('ns:cvssV3', namespace)) if vulnerability.find('ns:cvssV3', namespace) else ""
-                    fileName = dependency.find('ns:fileName', namespace).text.split(":")[-1].strip()
+                    where = self.get_where(dependency, namespace)
                     description = vulnerability.find('ns:description', namespace).text if vulnerability.find('ns:description', namespace).text else ""
                     severity = vulnerability.find('ns:severity', namespace).text.lower()
-                    cvss
+                    
                     finding_open = Finding(
                         id=id,
                         cvss=cvss,
-                        where=fileName,
+                        where=where,
                         description=description[:120].replace("\n\n", " ").replace("\n", " ").strip() if len(description) > 0 else "No description available",
                         severity=severity,
                         identification_date=datetime.now().strftime("%d%m%Y"),
@@ -86,4 +88,68 @@ class DependencyCheckDeserialize(DeserializatorGateway):
             for dep in to_remove: dependencies.remove(dep)
             data_result.write(dependencies_scanned_file, encoding="utf-8", xml_declaration=True)
         
-        return dependencies, namespace
+        return dependencies, namespace
+
+    def get_where(self, dependency, namespace):
+        identifiers_node = dependency.find("ns:identifiers", namespace)
+        if identifiers_node:
+            package_node = identifiers_node.find(".//ns:package", namespace)
+            if package_node:
+                id = package_node.find("ns:id", namespace).text
+                purl = PackageURL.from_string(id)
+                purl_parts = purl.to_dict()
+                component_name = (
+                    purl_parts["namespace"] + ":"
+                    if purl_parts["namespace"]
+                    and len(purl_parts["namespace"]) > 0
+                    else ""
+                )
+                component_name += (
+                    purl_parts["name"]
+                    if purl_parts["name"] and len(purl_parts["name"]) > 0
+                    else ""
+                )
+                component_name = component_name or None
+                component_version = (
+                    purl_parts["version"]
+                    if purl_parts["version"] and len(purl_parts["version"]) > 0
+                    else ""
+                )
+                return f"{component_name}:{component_version}"
+
+            cpe_node = identifiers_node.find(
+                ".//ns:identifier[@type='cpe']", namespace
+            )
+            if cpe_node:
+                id = cpe_node.find("ns:name", namespace).text
+                cpe = CPE(id)
+                component_name = (
+                    cpe.get_vendor()[0] + ":"
+                    if len(cpe.get_vendor()) > 0
+                    else ""
+                )
+                component_name += (
+                    cpe.get_product()[0] if len(cpe.get_product()) > 0 else ""
+                )
+                component_name = component_name or None
+                component_version = (
+                    cpe.get_version()[0]
+                    if len(cpe.get_version()) > 0
+                    else None
+                )
+                return f"{component_name}:{component_version}"
+
+            maven_node = identifiers_node.find(
+                ".//ns:identifier[@type='maven']", namespace
+            )
+            if maven_node:
+                maven_parts = maven_node.find("ns:name", namespace).text.split(
+                    ":",
+                )
+
+                if len(maven_parts) == 3:
+                    component_name = maven_parts[0] + ":" + maven_parts[1]
+                    component_version = maven_parts[2]
+                    return f"{component_name}:{component_version}"
+
+        return ""

devsecops_engine_tools-1.25.1/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.25.1'

{devsecops_engine_tools-1.24.4 → devsecops_engine_tools-1.25.1}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.24.4
+Version: 1.25.1
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team
@@ -26,6 +26,8 @@ Requires-Dist: boto3==1.34.157
 Requires-Dist: docker==7.1.0
 Requires-Dist: setuptools==72.1.0
 Requires-Dist: rich==13.9.4
+Requires-Dist: cpe==1.3.1
+Requires-Dist: packageurl-python==0.15.6
 
 # DevSecOps Engine Tools
 

{devsecops_engine_tools-1.24.4 → devsecops_engine_tools-1.25.1}/devsecops_engine_tools.egg-info/requires.txt

@@ -14,3 +14,5 @@ boto3==1.34.157
 docker==7.1.0
 setuptools==72.1.0
 rich==13.9.4
+cpe==1.3.1
+packageurl-python==0.15.6

devsecops_engine_tools-1.24.4/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.24.4'