devsecops-engine-tools 1.40.0__tar.gz → 1.41.0__tar.gz

{devsecops_engine_tools-1.40.0 → devsecops_engine_tools-1.41.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.40.0
+Version: 1.41.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.40.0 → devsecops_engine_tools-1.41.0}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/defect_dojo/defect_dojo.py

@@ -1,4 +1,5 @@
 from dataclasses import dataclass
+import re
 from devsecops_engine_tools.engine_core.src.domain.model.gateway.vulnerability_management_gateway import (
     VulnerabilityManagementGateway,
 )
@@ -91,10 +92,13 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                     "VULNERABILITY_MANAGER"
                 ]["BRANCH_FILTER"]
             ) or (vulnerability_management.dict_args["module"] == "engine_secret"):
-                tags = vulnerability_management.dict_args["module"]
+                tags = [vulnerability_management.dict_args["module"]]
                 if vulnerability_management.dict_args["module"] == "engine_iac":
-                    tags = f"{vulnerability_management.dict_args['module']}_{'_'.join(vulnerability_management.dict_args['platform'])}"
-
+                    tags = [f"{vulnerability_management.dict_args['module']}_{'_'.join(vulnerability_management.dict_args['platform'])}"]
+                if vulnerability_management.dict_args["module"] == "engine_container" and sum(1 for line in open("scanned_images.txt", 'r', encoding='utf-8') if line.strip()) > 1:
+                    match = re.search(r"(?<=:)([^-]+)", vulnerability_management.dict_args['image_to_scan'])
+                    tags.append(match.group(1) if match else None)
+                  
                 use_cmdb = vulnerability_management.config_tool[
                     "VULNERABILITY_MANAGER"
                 ]["DEFECT_DOJO"]["CMDB"]["USE_CMDB"]
@@ -451,7 +455,7 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
             "branch_tag": vulnerability_management.branch_tag,
             "commit_hash": vulnerability_management.commit_hash,
             "service": vulnerability_management.input_core.scope_pipeline,
-            "test_title": tags,
+            "test_title": '_'.join(tags),
             "environment": (
                 enviroment_mapping[vulnerability_management.environment.lower()]
                 if vulnerability_management.environment is not None
@@ -785,4 +789,4 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                 return self._get_where(finding, tag)
             return finding.file_path
         else:
-            return finding.file_path
+            return finding.file_path

{devsecops_engine_tools-1.40.0 → devsecops_engine_tools-1.41.0}/devsecops_engine_tools/engine_risk/src/domain/usecases/break_build.py

@@ -26,6 +26,7 @@ class BreakBuild:
         report_list: "list[Report]",
         all_report: "list[Report]",
         threshold: any,
+        policy_excluded: int,
     ):
         self.devops_platform_gateway = devops_platform_gateway
         self.printer_table_gateway = printer_table_gateway
@@ -35,6 +36,7 @@ class BreakBuild:
         self.report_list = report_list
         self.all_report = all_report
         self.threshold = threshold
+        self.policy_excluded = policy_excluded
         self.break_build = False
         self.warning_build = False
         self.report_breaker = []
@@ -50,11 +52,9 @@ class BreakBuild:
         }
 
     def process(self):
-        self._remediation_rate_control(self.all_report)
         new_report_list, applied_exclusions = self._apply_exclusions(self.report_list)
-        if self.break_build:
-            self.report_breaker.extend(copy.deepcopy(new_report_list))
         self._tag_blacklist_control(new_report_list)
+        self._remediation_rate_control(self.all_report, new_report_list)
         self._risk_score_control(new_report_list)
         all_exclusions = list(self.vm_exclusions) + list(applied_exclusions)
         self._print_exclusions(self._map_applied_exclusion(all_exclusions))
@@ -118,10 +118,19 @@ class BreakBuild:
         else:
             print(self.devops_platform_gateway.result_pipeline("succeeded"))
 
-    def _remediation_rate_control(self, all_report: "list[Report]"):
+    def _remediation_rate_control(
+        self, all_report: "list[Report]", new_report_list: "list[Report]"
+    ):
         mitigated = sum(1 for report in all_report if report.mitigated)
-        total = len(all_report)
-        print(f"Mitigated count: {mitigated}   Total count: {total}")
+        white_list = sum(
+            1
+            for report in all_report
+            if "white_list" in report.tags and not report.mitigated
+        )
+        total = len(all_report) - self.policy_excluded - white_list
+        print(
+            f"Mitigated count: {mitigated}   Total count: {len(all_report)}   Policy excluded: {self.policy_excluded + white_list}"
+        )
         remediation_rate_value = self._get_percentage(mitigated / total)
 
         risk_threshold = self._get_remediation_rate_threshold(total)
@@ -150,10 +159,18 @@ class BreakBuild:
                 )
             )
             self.break_build = True
+            [
+                setattr(report, "reason", "Remediation Rate")
+                for report in new_report_list
+            ]
+            self.report_breaker.extend(copy.deepcopy(new_report_list))
 
     def _get_remediation_rate_threshold(self, total):
         remediation_rate = self.threshold["REMEDIATION_RATE"]
-        for key in sorted(remediation_rate.keys(), key=lambda x: int(x) if x.isdigit() else float('inf')):
+        for key in sorted(
+            remediation_rate.keys(),
+            key=lambda x: int(x) if x.isdigit() else float("inf"),
+        ):
             if key.isdigit() and total <= int(key):
                 return remediation_rate[key]
         return remediation_rate["other"]
@@ -209,7 +226,6 @@ class BreakBuild:
                         applied_exclusions.append(exclusion_copy)
                         break
             if not exclude:
-                report.reason = "Remediation Rate"
                 filtered_reports.append(report)
 
         return filtered_reports, applied_exclusions
@@ -217,21 +233,22 @@ class BreakBuild:
     def _tag_blacklist_control(self, report_list: "list[Report]"):
         remote_config = self.remote_config
         if report_list:
-            tag_blacklist = set(remote_config["TAG_BLACKLIST"])
-            tag_age_threshold = self.threshold["TAG_MAX_AGE"]
+            tag_blacklist = set(remote_config["TAG_BLACKLIST_EXCLUSION_DAYS"].keys())
 
             filtered_reports_above_threshold = [
                 (report, tag)
                 for report in report_list
                 for tag in report.tags
-                if tag in tag_blacklist and report.age >= tag_age_threshold
+                if tag in tag_blacklist
+                and report.age >= remote_config["TAG_BLACKLIST_EXCLUSION_DAYS"][tag]
             ]
 
             filtered_reports_below_threshold = [
                 (report, tag)
                 for report in report_list
                 for tag in report.tags
-                if tag in tag_blacklist and report.age < tag_age_threshold
+                if tag in tag_blacklist
+                and report.age < remote_config["TAG_BLACKLIST_EXCLUSION_DAYS"][tag]
             ]
 
             for report, tag in filtered_reports_above_threshold:
@@ -239,7 +256,7 @@ class BreakBuild:
                 print(
                     self.devops_platform_gateway.message(
                         "error",
-                        f"Report {report.vm_id} with tag {tag} is blacklisted and age {report.age} is above threshold {tag_age_threshold}",
+                        f"Report {report.vm_id} with tag '{tag}' is blacklisted and age {report.age} is above threshold {remote_config['TAG_BLACKLIST_EXCLUSION_DAYS'][tag]}",
                     )
                 )
 
@@ -247,9 +264,10 @@ class BreakBuild:
                 print(
                     self.devops_platform_gateway.message(
                         "warning",
-                        f"Report {report.vm_id} with tag {tag} is blacklisted but age {report.age} is below threshold {tag_age_threshold}",
+                        f"Report {report.vm_id} with tag '{tag}' is blacklisted but age {report.age} is below threshold {remote_config['TAG_BLACKLIST_EXCLUSION_DAYS'][tag]}",
                     )
                 )
+                self.policy_excluded += 1
 
             if filtered_reports_above_threshold:
                 self.break_build = True

{devsecops_engine_tools-1.40.0 → devsecops_engine_tools-1.41.0}/devsecops_engine_tools/engine_risk/src/domain/usecases/get_exclusions.py

@@ -1,6 +1,7 @@
 from devsecops_engine_tools.engine_core.src.domain.model.exclusions import (
     Exclusions,
 )
+from datetime import datetime, timedelta
 
 
 class GetExclusions:
@@ -12,6 +13,7 @@ class GetExclusions:
         risk_config,
         risk_exclusions,
         services,
+        active_findings,
     ):
         self.devops_platform_gateway = devops_platform_gateway
         self.dict_args = dict_args
@@ -19,10 +21,13 @@ class GetExclusions:
         self.risk_config = risk_config
         self.risk_exclusions = risk_exclusions
         self.services = services
+        self.active_findings = active_findings
 
     def process(self):
         core_config = self.devops_platform_gateway.get_remote_config(
-            self.dict_args["remote_config_repo"], "engine_core/ConfigTool.json", self.dict_args["remote_config_branch"]
+            self.dict_args["remote_config_repo"],
+            "engine_core/ConfigTool.json",
+            self.dict_args["remote_config_branch"],
         )
         unique_tags = self._get_unique_tags()
         exclusions = []
@@ -35,14 +40,19 @@ class GetExclusions:
                     )
                 )
 
-        return exclusions
+        new_vuln_exclusions, len_new_vuln_exclusions = self._get_exclusions_new_vuln()
+        exclusions.extend(new_vuln_exclusions)
+
+        return exclusions, len_new_vuln_exclusions
 
     def _get_risk_exclusions(self):
         return self._get_exclusions(self.risk_exclusions, "RISK")
 
     def _get_exclusions_by_practice(self, core_config, practice, path):
         exclusions_config = self.devops_platform_gateway.get_remote_config(
-            self.dict_args["remote_config_repo"], path, self.dict_args["remote_config_branch"]
+            self.dict_args["remote_config_repo"],
+            path,
+            self.dict_args["remote_config_branch"],
         )
         tool = core_config[practice.upper()]["TOOL"]
         return self._get_exclusions(exclusions_config, tool)
@@ -69,3 +79,26 @@ class GetExclusions:
             tags = finding.tags
             unique_tags.update(tags)
         return list(unique_tags)
+
+    def _get_exclusions_new_vuln(self):
+        cutoff_date = datetime.now() - timedelta(days=5)
+        exclusions = []
+        for finding in self.active_findings:
+            if finding.publish_date:
+                try:
+                    finding_publish_date = datetime.strptime(
+                        finding.publish_date, "%Y-%m-%d"
+                    )
+                except ValueError:
+                    continue
+                if finding_publish_date >= cutoff_date and hasattr(finding, "id"):
+                    exclusion_data = finding.__dict__.copy()
+                    exclusion_data["create_date"] = finding_publish_date.strftime(
+                        "%d%m%Y"
+                    )
+                    exclusion_data["expired_date"] = (
+                        finding_publish_date + timedelta(days=5)
+                    ).strftime("%d%m%Y")
+                    exclusion_data["reason"] = "New vulnerability in the industry"
+                    exclusions.append(Exclusions(**exclusion_data))
+        return exclusions, len(exclusions)

{devsecops_engine_tools-1.40.0 → devsecops_engine_tools-1.41.0}/devsecops_engine_tools/engine_risk/src/domain/usecases/handle_filters.py

@@ -49,11 +49,13 @@ class HandleFilters:
     def filter_tags_days(self, devops_platform_gateway, remote_config, findings):
         tag_exclusion_days = remote_config["TAG_EXCLUSION_DAYS"]
         filtered_findings = []
+        filtered = 0
 
         for finding in findings:
             exclude = False
             for tag in finding.tags:
                 if tag in tag_exclusion_days and finding.age < tag_exclusion_days[tag]:
+                    filtered += 1
                     exclude = True
                     print(
                         devops_platform_gateway.message(
@@ -65,7 +67,7 @@ class HandleFilters:
             if not exclude:
                 filtered_findings.append(finding)
 
-        return filtered_findings
+        return filtered_findings, filtered
 
     def _get_active_findings(self, findings):
         return list(

{devsecops_engine_tools-1.40.0 → devsecops_engine_tools-1.41.0}/devsecops_engine_tools/engine_risk/src/infrastructure/entry_points/entry_point_risk.py

@@ -31,10 +31,14 @@ def init_engine_risk(
     vm_exclusions,
 ):
     remote_config = devops_platform_gateway.get_remote_config(
-        dict_args["remote_config_repo"], "engine_risk/ConfigTool.json", dict_args["remote_config_branch"]
+        dict_args["remote_config_repo"],
+        "engine_risk/ConfigTool.json",
+        dict_args["remote_config_branch"],
     )
     risk_exclusions = devops_platform_gateway.get_remote_config(
-        dict_args["remote_config_repo"], "engine_risk/Exclusions.json", dict_args["remote_config_branch"]
+        dict_args["remote_config_repo"],
+        "engine_risk/Exclusions.json",
+        dict_args["remote_config_branch"],
     )
     pipeline_name = devops_platform_gateway.get_variable("pipeline_name")
 
@@ -49,7 +53,7 @@ def init_engine_risk(
 
     unique_findings = handle_filters.filter_duplicated(active_findings)
 
-    filtered_findings = handle_filters.filter_tags_days(
+    filtered_findings, len_tag_filtered = handle_filters.filter_tags_days(
         devops_platform_gateway, remote_config, unique_findings
     )
 
@@ -62,8 +66,11 @@ def init_engine_risk(
         remote_config,
         risk_exclusions,
         services,
+        active_findings,
     )
-    exclusions = get_exclusions.process()
+    exclusions, len_new_vuln = get_exclusions.process()
+
+    policy_excluded = len_tag_filtered + len_new_vuln
 
     threshold = CheckThreshold(
         pipeline_name, remote_config["THRESHOLD"], risk_exclusions
@@ -78,6 +85,7 @@ def init_engine_risk(
         data_added,
         findings,
         threshold,
+        policy_excluded,
     )
 
     return break_build.process()

{devsecops_engine_tools-1.40.0 → devsecops_engine_tools-1.41.0}/devsecops_engine_tools/engine_utilities/defect_dojo/domain/models/finding.py

@@ -77,7 +77,7 @@ class Finding(FromDictMixin):
     sast_source_line = None
     sast_source_file_path = None
     nb_occurences = None
-    publish_date = None
+    publish_date: str = ""
     planned_remediation_date = None
     planned_remediation_version = None
     effort_for_fixing = None

{devsecops_engine_tools-1.40.0 → devsecops_engine_tools-1.41.0}/devsecops_engine_tools/engine_utilities/defect_dojo/domain/request_objects/import_scan.py

@@ -1,4 +1,5 @@
 import dataclasses
+from typing import List
 
 
 @dataclasses.dataclass
@@ -20,7 +21,7 @@ class ImportScanRequest:
     auto_create_context: str = ""
     deduplication_on_engagement: str = ""
     lead: str = ""
-    tags: str = ""
+    tags: List[str] = dataclasses.field(default_factory=list)
     close_old_findings: str = ""
     close_old_findings_product_scope: str = ""
     push_to_jira: str = ""
@@ -124,4 +125,4 @@ class ImportScanRequest:
             "api_scan_configuration": self.api_scan_configuration,
             "build_id": self.build_id,
         }
-        return r
+        return r

{devsecops_engine_tools-1.40.0 → devsecops_engine_tools-1.41.0}/devsecops_engine_tools/engine_utilities/defect_dojo/domain/serializers/import_scan.py

@@ -183,7 +183,7 @@ class ImportScanSerializer(Schema):
     auto_create_context = fields.Str(required=False, load_default="true")
     deduplication_on_engagement = fields.Str(required=False)
     lead = fields.Str(required=False)
-    tags = fields.Str(required=True)
+    tags = fields.List(fields.String(), required=True)
     close_old_findings = fields.Str(required=False, load_default=True)
     close_old_findings_product_scope = fields.Str(required=False)
     push_to_jira = fields.Str(required=False)
@@ -224,4 +224,4 @@ class ImportScanSerializer(Schema):
 
     @post_load
     def make_cmdb(self, data, **kwargs):
-        return ImportScanRequest(**data)
+        return ImportScanRequest(**data)

{devsecops_engine_tools-1.40.0 → devsecops_engine_tools-1.41.0}/devsecops_engine_tools/engine_utilities/defect_dojo/infraestructure/driver_adapters/import_scan.py

@@ -34,7 +34,7 @@ class ImportScanRestConsumer:
             "auto_create_context": "false",
             "deduplication_on_engagement": request.deduplication_on_engagement,
             "lead": request.lead,
-            "tags": request.tags,
+            "tags": ",".join(request.tags) if request.tags else "",
             "close_old_findings": str(request.close_old_findings),
             "close_old_findings_product_scope": str(request.close_old_findings_product_scope),
             "push_to_jira": str(request.push_to_jira),
@@ -112,4 +112,4 @@ class ImportScanRestConsumer:
         except Exception as e:
             logger.error(f"from dict import Scan: {response.json()}")
             raise ApiError(e)
-        return response
+        return response

devsecops_engine_tools-1.41.0/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.41.0'

{devsecops_engine_tools-1.40.0 → devsecops_engine_tools-1.41.0}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.40.0
+Version: 1.41.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

devsecops_engine_tools-1.40.0/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.40.0'