devsecops-engine-tools 1.33.0__tar.gz → 1.34.0__tar.gz

{devsecops_engine_tools-1.33.0 → devsecops_engine_tools-1.34.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.33.0
+Version: 1.34.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.33.0 → devsecops_engine_tools-1.34.0}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/defect_dojo/defect_dojo.py

@@ -18,6 +18,7 @@ from devsecops_engine_tools.engine_utilities.defect_dojo import (
 from devsecops_engine_tools.engine_core.src.domain.model.exclusions import Exclusions
 from devsecops_engine_tools.engine_core.src.domain.model.report import Report
 from devsecops_engine_tools.engine_utilities.utils.session_manager import SessionManager
+from devsecops_engine_tools.engine_utilities.utils.utils import Utils
 from devsecops_engine_tools.engine_core.src.domain.model.customs_exceptions import (
     ExceptionVulnerabilityManagement,
     ExceptionFindingsExcepted,
@@ -28,13 +29,11 @@ from devsecops_engine_tools.engine_core.src.infrastructure.helpers.util import (
     format_date,
 )
 from functools import partial
-
 from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
 from devsecops_engine_tools.engine_utilities import settings
 from devsecops_engine_tools.engine_utilities.defect_dojo.domain.serializers.import_scan import (
     ImportScanSerializer,
 )
-import time
 import concurrent.futures
 
 logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
@@ -113,7 +112,7 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                 def request_func():
                     return DefectDojo.send_import_scan(request)
 
-                response = self._retries_requests(
+                response = Utils().retries_requests(
                     request_func,
                     vulnerability_management.config_tool["VULNERABILITY_MANAGER"][
                         "DEFECT_DOJO"
@@ -166,7 +165,7 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                     else None
                 )
 
-            return self._retries_requests(request_func, dd_max_retries, retry_delay=5)
+            return Utils().retries_requests(request_func, dd_max_retries, retry_delay=5)
 
         except Exception as ex:
             raise ExceptionVulnerabilityManagement(
@@ -555,7 +554,7 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                 session=session_manager, service=service, **query_params
             ).results
 
-        return self._retries_requests(request_func, max_retries, retry_delay=5)
+        return Utils().retries_requests(request_func, max_retries, retry_delay=5)
     
     def _get_finding_exclusion(self, session_manager, max_retries, query_params):
         def request_func():
@@ -563,21 +562,7 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                 session=session_manager, **query_params
             ).results
 
-        return self._retries_requests(request_func, max_retries, retry_delay=5)
-
-    def _retries_requests(self, request_func, max_retries, retry_delay):
-        for attempt in range(max_retries):
-            try:
-                return request_func()
-            except Exception as e:
-                logger.error(f"Error making the request: {e}")
-                if attempt < max_retries - 1:
-                    logger.warning(f"Retry in {retry_delay} seconds...")
-                    time.sleep(retry_delay)
-                else:
-                    logger.error("Maximum number of retries reached, aborting.")
-                    raise e
-
+        return Utils().retries_requests(request_func, max_retries, retry_delay=5)
 
     def _date_reason_based(self, finding, date_fn, reason, tool, **kwargs):
         def get_vuln_id(finding, tool):

devsecops_engine_tools-1.34.0/devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/http/client/auth_client.py

@@ -0,0 +1,12 @@
+from devsecops_engine_tools.engine_dast.src.domain.model.gateways.authentication_gateway import (
+    AuthenticationGateway,
+)
+
+
+class AuthClientCredential(AuthenticationGateway):
+    def __init__(self, security_auth: dict):
+        self.client_id: str = security_auth.get("client_id")
+        self.client_secrets: str = security_auth.get("client_secret")
+
+    def get_credentials(self):
+        return None

devsecops_engine_tools-1.34.0/devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/jwt/jwt_object.py

@@ -0,0 +1,64 @@
+from time import (
+    time
+)
+from secrets import (
+    token_hex
+)
+from authlib.jose import (
+    jwt
+)
+from devsecops_engine_tools.engine_dast.src.domain.model.gateways.authentication_gateway import (
+    AuthenticationGateway,
+)
+
+
+class JwtObject(AuthenticationGateway):
+    def __init__(self, security_auth: dict):
+        self.type = "jwt"
+        self.private_key: str = security_auth.get("jwt_private_key")
+        self.algorithm: str = security_auth.get("jwt_algorithm")
+        self.iss: str = security_auth.get("jwt_iss")
+        self.sum: str = security_auth.get("jwt_sum")
+        self.aud: str = security_auth.get("jwt_aud")
+        self.iat: float = time()
+        self.exp: float = self.iat + 60 * 60
+        self.nonce = token_hex(10)
+        self.payload: dict = {}
+        self.header: dict = {}
+        self.jwt_token: str = ""
+        self.header_name: str = security_auth.get("jwt_header_name")
+        self.init_header()
+        self.init_payload()
+
+    def init_header(self) -> None:
+        self.header: dict = {"alg": self.algorithm}
+
+    def init_payload(self) -> dict:
+        self.payload: dict = {
+            "iss": self.iss,
+            "sum": self.sum,
+            "aud": self.aud,
+            "exp": self.exp,
+            "iat": self.iat,
+            "nonce": self.nonce,
+        }
+        return self.payload
+
+    def get_credentials(self) -> tuple:
+        """
+        Generates JWT using a file with the configuration
+
+        Returns:
+
+        tuple: header and jwt
+
+        """
+        self.private_key = (
+            self.private_key.replace(" ", "\n")
+            .replace("-----BEGIN\nPRIVATE\nKEY-----", "-----BEGIN PRIVATE KEY-----")
+            .replace("-----END\nPRIVATE\nKEY-----", "-----END PRIVATE KEY-----")
+        )
+        self.jwt_token = jwt.encode(self.header, self.payload, self.private_key).decode(
+            "utf-8"
+        )
+        return self.header_name, self.jwt_token

devsecops_engine_tools-1.34.0/devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/jwt/jwt_tool.py

@@ -0,0 +1,153 @@
+from typing import (
+    List
+)
+from datetime import (
+    datetime,
+)
+import jwt
+from devsecops_engine_tools.engine_core.src.domain.model.finding import (
+    Category,
+    Finding,
+)
+from devsecops_engine_tools.engine_dast.src.domain.model.gateways.tool_gateway import (
+    ToolGateway,
+)
+from devsecops_engine_tools.engine_dast.src.domain.model.api_operation import (
+    ApiOperation
+)
+from devsecops_engine_tools.engine_dast.src.infrastructure.helpers.file_generator_tool import (
+    generate_file_from_tool,
+)
+
+class JwtTool(ToolGateway):
+
+    def __init__(self, target_config):
+        self.TOOL = "JWT"
+        self.BAD_JWT_ALG = ["none", "ES256", "ES384", "ES512"]
+        self.BAD_JWS_ALG = ["none", "ES256", "ES384", "ES512"]
+        self.GOOD_JWE_ALG = ["dir", "RSA-OAEP", "RSA-OAEP-256"]
+        self.GOOD_JWE_ENC = ["A256GCM"]
+        self.target_config = target_config
+
+    def verify_jwt_alg(self, token):
+        "Evaluate JSON Web token's algorithm"
+
+        map_id = "JWT_ALGORITHM"
+        alg = jwt.get_unverified_header(token)["alg"]
+
+        if alg in self.BAD_JWT_ALG: #Is vulnerable
+            return {
+                "map_id": map_id,
+                "description": "msg"
+                }
+
+    def verify_jws_alg(self, token):
+        """Evaluate JSON Web signature's algorithm"""
+
+        map_id = "JWS_ALGORITHM"
+        alg = jwt.get_unverified_header(token)["alg"]
+
+        if alg in self.BAD_JWS_ALG:#Is vulnerable
+            return {
+                "map_id": map_id,
+                "description": "msg"
+                }
+
+    def verify_jwe(self, token):
+        """Evaluate JSON Web encryption's algorithm"""
+
+        map_id = "JWE_ALGORITHM"
+        msg = ""
+        enc = jwt.get_unverified_header(token)["enc"]
+        alg = jwt.get_unverified_header(token)["alg"]
+
+        if enc in self.GOOD_JWE_ENC:
+            if alg in self.GOOD_JWE_ALG:# Is not vulnerable
+                return
+            else:
+                msg = "Algorithm: " + alg
+        else:
+            msg = "Encryption: " + enc
+
+        return {
+            "map_id": map_id,
+            "description": msg
+            }
+
+    def check_token(self, token, jwt_details, config_tool):
+        "Validates JWT, JWS or JWE"
+
+        hed = jwt.get_unverified_header(token)
+
+        if "enc" in hed.keys():
+            result = self.verify_jwe(token)
+        elif "typ" in hed.keys():
+            result = self.verify_jwt_alg(token)
+        else:
+            result = self.verify_jws_alg(token)
+
+        if result:
+            mapped_result = {
+                "check_id": config_tool["RULES"][result["map_id"]]["checkID"],
+                "cvss": config_tool["RULES"][result["map_id"]]["cvss"],
+                "matched-at": jwt_details["path"],
+                "description": result["msg"],
+                "severity": config_tool["RULES"][result["map_id"]]["severity"],
+                "remediation": result["remediation"]
+            }
+            return mapped_result
+        return None
+    
+    def configure_tool(self, target_data):
+        """Method for group all operations that uses JWT"""
+        jwt_list: List[ApiOperation] = []
+        for operation in target_data.operations:
+            if operation.authentication_gateway.type.lower() == "jwt":
+                jwt_list.append(operation)
+        return jwt_list
+
+    def execute(self, jwt_config: List[ApiOperation], config_tool):
+        result_scans = []
+        if len(jwt_config) > 0:
+            for jwt_operation in jwt_config:
+                jwt_operation.authenticate()
+                result = self.check_token(token=jwt_operation.credentials[1],
+                                        jwt_details=jwt_operation.data["operation"],
+                                        config_tool=config_tool)
+                if result:
+                    result_scans.append(result)
+        return result_scans
+
+    def get_list_finding(
+        self,
+        result_scan_list: "List[dict]"
+    ) -> "List[Finding]":
+        list_open_findings = []
+        if len(result_scan_list) > 0:
+            for scan in result_scan_list:
+                finding_open = Finding(
+                    id=scan.get("check-id"),
+                    cvss=scan.get("cvss"),
+                    where=scan.get("matched-at"),
+                    description=scan.get("description"),
+                    severity=scan.get("severity").lower(),
+                    identification_date=datetime.now().strftime("%d%m%Y"),
+                    module="engine_dast",
+                    category=Category("vulnerability"),
+                    requirements=scan.get("remediation"),
+                    tool="jwt",
+                    published_date_cve=scan.get("published-cve")
+                )
+                list_open_findings.append(finding_open)
+        return list_open_findings
+
+    def run_tool(self, target_data, config_tool):
+        jwt_config = self.configure_tool(target_data)
+        result_scans = self.execute(jwt_config, config_tool)
+        if result_scans:
+            finding_list = self.get_list_finding(result_scans)
+            path_file_results = generate_file_from_tool(
+                self.TOOL, result_scans, config_tool
+            )
+            return finding_list, path_file_results
+        return []

{devsecops_engine_tools-1.33.0 → devsecops_engine_tools-1.34.0}/devsecops_engine_tools/engine_utilities/sonarqube/src/domain/model/gateways/sonar_gateway.py

@@ -39,7 +39,8 @@ class SonarGateway(metaclass=ABCMeta):
         sonar_token: str,
         endpoint: str,
         data: dict,
-        finding_type: str
+        finding_type: str,
+        sonar_max_retry: int
     ):
         "use API to change vulnerabilities state in sonar"
 
@@ -50,7 +51,8 @@ class SonarGateway(metaclass=ABCMeta):
         sonar_token: str,
         endpoint: str,
         params: dict,
-        finding_type: str
+        finding_type: str,
+        sonar_max_retry: int
     ):
         "use API to get project findings in sonar"
 

{devsecops_engine_tools-1.33.0 → devsecops_engine_tools-1.34.0}/devsecops_engine_tools/engine_utilities/sonarqube/src/domain/usecases/report_sonar.py

@@ -127,7 +127,8 @@ class ReportSonar:
                         "s": "CREATION_DATE",
                         "asc": "false"
                     },
-                    "issues"
+                    "issues",
+                    report_config_tool["MAX_RETRIES_QUERY_SONAR"]
                 )
                 sonar_hotspots = self.sonar_gateway.get_findings(
                     args["sonar_url"],
@@ -138,7 +139,8 @@ class ReportSonar:
                         "ps": 100,
                         "p": 1,
                     },
-                    "hotspots"
+                    "hotspots",
+                    report_config_tool["MAX_RETRIES_QUERY_SONAR"]
                 )
 
                 sonar_findings = sonar_vulnerabilities + sonar_hotspots
@@ -164,7 +166,8 @@ class ReportSonar:
                                         "issue": related_sonar_finding["key"],
                                         "transition": status
                                     },
-                                    "issue"
+                                    "issue",
+                                    report_config_tool["MAX_RETRIES_QUERY_SONAR"]
                                 )
                         else:
                             resolution = None
@@ -185,7 +188,8 @@ class ReportSonar:
                                     secret["token_sonar"],
                                     "/api/hotspots/change_status",
                                     data,
-                                    "hotspot"
+                                    "hotspot",
+                                    report_config_tool["MAX_RETRIES_QUERY_SONAR"]
                                 )
 
             except Exception as e:

{devsecops_engine_tools-1.33.0 → devsecops_engine_tools-1.34.0}/devsecops_engine_tools/engine_utilities/sonarqube/src/infrastructure/driven_adapters/sonarqube/sonarqube_report.py

@@ -61,47 +61,54 @@ class SonarAdapter(SonarGateway):
     def filter_by_sonarqube_tag(self, findings):
         return [finding for finding in findings if "sonarqube" in finding.tags]
     
-    def change_finding_status(self, sonar_url, sonar_token, endpoint, data, finding_type):
+    def change_finding_status(self, sonar_url, sonar_token, endpoint, data, finding_type, sonar_max_retry):
         try:
-            response = requests.post(
-                f"{sonar_url}{endpoint}",
-                headers={
-                    "Authorization": f"Basic {Utils().encode_token_to_base64(sonar_token)}"
-                },
-                data=data
-            )
-            response.raise_for_status()
+            def request_func():
+                response = requests.post(
+                    f"{sonar_url}{endpoint}",
+                    headers={
+                        "Authorization": f"Basic {Utils().encode_token_to_base64(sonar_token)}"
+                    },
+                    data=data
+                )
+                response.raise_for_status()
+
+                if finding_type == "issue": 
+                    info = data["transition"]
+                else:
+                    resolution_info = ""
+                    if data.get("resolution"): resolution_info = f" ({data['resolution']})"
 
-            if finding_type == "issue": 
-                info = data["transition"]
-            else:
-                resolution_info = ""
-                if data.get("resolution"): resolution_info = f" ({data['resolution']})"
+                    info = f"{data['status']}{resolution_info}"
 
-                info = f"{data['status']}{resolution_info}"
+                print(f"The state of the {finding_type} {data[finding_type]} was changed to {info}.")
 
-            print(f"The state of the {finding_type} {data[finding_type]} was changed to {info}.")
+            Utils().retries_requests(request_func, sonar_max_retry, retry_delay=5)
+                
         except Exception as e:
             logger.warning(f"Unable to change the status of {finding_type} {data[finding_type]}. Error: {e}")
             pass
 
-    def get_findings(self, sonar_url, sonar_token, endpoint, params, finding_type):
+    def get_findings(self, sonar_url, sonar_token, endpoint, params, finding_type, sonar_max_retry):
         findings = []
         try:
-            while True:
-                response = requests.get(
-                    f"{sonar_url}{endpoint}",
-                    headers={
-                        "Authorization": f"Basic {Utils().encode_token_to_base64(sonar_token)}"
-                    },
-                    params=params
-                )
-                response.raise_for_status()
-                data = response.json()
+            def request_func():
+                while True:
+                    response = requests.get(
+                        f"{sonar_url}{endpoint}",
+                        headers={
+                            "Authorization": f"Basic {Utils().encode_token_to_base64(sonar_token)}"
+                        },
+                        params=params
+                    )
+                    response.raise_for_status()
+                    data = response.json()
 
-                findings.extend(data[finding_type])
-                if len(data[finding_type]) < params["ps"]: break
-                params["p"] = params["p"] + 1
+                    findings.extend(data[finding_type])
+                    if len(data[finding_type]) < params["ps"]: break
+                    params["p"] = params["p"] + 1
+            
+            Utils().retries_requests(request_func, sonar_max_retry, 5)
 
             return findings
         except Exception as e:

{devsecops_engine_tools-1.33.0 → devsecops_engine_tools-1.34.0}/devsecops_engine_tools/engine_utilities/sonarqube/src/infrastructure/entry_points/entry_point_report_sonar.py

@@ -26,19 +26,28 @@ def init_report_sonar(
         args["remote_config_repo"], "/engine_core/ConfigTool.json", args["remote_config_branch"]
     )
     report_config_tool = devops_platform_gateway.get_remote_config(
-        args["remote_config_repo"], "/report_sonar/ConfigTool.json"
+        args["remote_config_repo"], "/report_sonar/ConfigTool.json", args["remote_config_branch"]
     )
+    excluded_pipelines = devops_platform_gateway.get_remote_config(
+        args["remote_config_repo"], "/report_sonar/Exclusions.json", args["remote_config_branch"]
+    )
+    
     Printers.print_logo_tool(config_tool["BANNER"])
 
     pipeline_name = devops_platform_gateway.get_variable("pipeline_name")
     branch = devops_platform_gateway.get_variable("branch_tag")
+
     is_valid_pipeline = not re.match(
-        report_config_tool["IGNORE_SEARCH_PATTERN"], pipeline_name, re.IGNORECASE
-    )
+        report_config_tool["IGNORE_SEARCH_PATTERN"], 
+        pipeline_name, 
+        re.IGNORECASE
+    ) and pipeline_name not in excluded_pipelines
+    
     is_valid_branch = any(
         target_branch in str(branch)
         for target_branch in report_config_tool["TARGET_BRANCHES"]
     )
+
     is_enabled = config_tool["REPORT_SONAR"]["ENABLED"]
 
     if is_enabled and is_valid_pipeline and is_valid_branch:

{devsecops_engine_tools-1.33.0 → devsecops_engine_tools-1.34.0}/devsecops_engine_tools/engine_utilities/utils/utils.py

@@ -1,6 +1,7 @@
 import zipfile
 import tarfile
 import platform
+import time
 from devsecops_engine_tools.engine_utilities.github.infrastructure.github_api import (
     GithubApi,
 )
@@ -141,3 +142,16 @@ class Utils:
         )
 
         return set_threshold(match_pattern) if match_pattern else threshold
+
+    def retries_requests(self, request_func, max_retries, retry_delay):
+        for attempt in range(max_retries):
+            try:
+                return request_func()
+            except Exception as e:
+                logger.error(f"Error making the request: {e}")
+                if attempt < max_retries - 1:
+                    logger.warning(f"Retry in {retry_delay} seconds...")
+                    time.sleep(retry_delay)
+                else:
+                    logger.error("Maximum number of retries reached, aborting.")
+                    raise e

devsecops_engine_tools-1.34.0/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.34.0'

{devsecops_engine_tools-1.33.0 → devsecops_engine_tools-1.34.0}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.33.0
+Version: 1.34.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.33.0 → devsecops_engine_tools-1.34.0}/devsecops_engine_tools.egg-info/SOURCES.txt

@@ -80,6 +80,12 @@ devsecops_engine_tools/engine_dast/src/domain/usecases/__init__.py
 devsecops_engine_tools/engine_dast/src/domain/usecases/dast_scan.py
 devsecops_engine_tools/engine_dast/src/infrastructure/__init__.py
 devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/__init__.py
+devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/http/__init__.py
+devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/http/client/__init__.py
+devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/http/client/auth_client.py
+devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/jwt/__init__.py
+devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/jwt/jwt_object.py
+devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/jwt/jwt_tool.py
 devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/nuclei/__init__.py
 devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/nuclei/nuclei_config.py
 devsecops_engine_tools/engine_dast/src/infrastructure/driven_adapters/nuclei/nuclei_deserealizer.py

devsecops_engine_tools-1.33.0/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.33.0'