devsecops-engine-tools 1.48.1__py3-none-any.whl → 1.50.0__py3-none-any.whl

devsecops_engine_tools/engine_risk/src/domain/usecases/break_build.py

@@ -128,16 +128,17 @@ class BreakBuild:
             remediation_rate_name,
             mitigated_name,
             all_findings_name,
-            new_industry_vulnerabilities,
+            new_findings,
             white_list_name,
+            transferred_name,
             base_image_name,
         ) = sp.symbols(
-            "RemediationRate Mitigated AllFindings NewIndustryVulnerabilities WhiteList BaseImage"
+            "RemediationRate Mitigated AllFindings NewFindings WhiteList Transferred BaseImage"
         )
         formula = sp.Eq(
             remediation_rate_name,
             100
-            * (mitigated_name / (all_findings_name - new_industry_vulnerabilities - white_list_name - base_image_name)),
+            * (mitigated_name / (all_findings_name - new_findings - white_list_name - transferred_name - base_image_name)),
         )
         print("\n")
         sp.pretty_print(formula)
@@ -149,18 +150,24 @@ class BreakBuild:
             for report in all_report
             if "On Whitelist" in report.risk_status and not report.mitigated
         )
+        transferred_list_count = sum(
+            1
+            for report in all_report
+            if "Transfer Accepted" in report.risk_status and not report.mitigated
+        )
         base_image_count = sum(
             1
             for report in all_report
             if "Image Base" in report.vul_description
             and "On Whitelist" not in report.risk_status
+            and "Transfer Accepted" not in report.risk_status
             and not report.mitigated
         )
         all_findings_count = len(all_report)
         print(
-            f"Mitigated: {mitigated_count}   AllFindings: {all_findings_count}   BaseImage: {base_image_count}   NewIndustryVulnerabilities: {self.policy_excluded}   WhiteList: {white_list_count}\n\n"
+            f"Mitigated: {mitigated_count}   AllFindings: {all_findings_count}   BaseImage: {base_image_count}   NewFindings: {self.policy_excluded}   Transferred: {transferred_list_count}   WhiteList: {white_list_count}\n\n"
         )
-        total = all_findings_count - self.policy_excluded - white_list_count - base_image_count
+        total = all_findings_count - self.policy_excluded - white_list_count - base_image_count - transferred_list_count
         remediation_rate_value = self._get_percentage(mitigated_count / total)
 
         risk_threshold = self._get_remediation_rate_threshold(total)

devsecops_engine_tools/engine_sast/engine_iac/src/domain/usecases/iac_scan.py

@@ -47,6 +47,7 @@ class IacScan:
                 platform_to_scan=dict_args["platform"],
                 secret_tool=secret_tool,
                 secret_external_checks=dict_args["token_external_checks"],
+                work_folder=self.devops_platform_gateway.get_variable("temp_directory"),
             )
         else:
             print("Tool skipped by DevSecOps policy")
@@ -149,4 +150,4 @@ class IacScan:
             for folder in folders
             if re.match(patron, folder)
         ]
-        return matching_folders
+        return matching_folders

devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_tool.py

@@ -211,6 +211,7 @@ class CheckovTool(ToolGateway):
         platform_to_scan,
         secret_tool,
         secret_external_checks,
+        **kwargs
     ):
         util = Utils()
         agent_env = util.configurate_external_checks(self.TOOL_CHECKOV,config_tool, secret_tool,secret_external_checks)

devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kics/kics_deserealizator.py

@@ -35,8 +35,8 @@ class KicsDeserealizator:
             severity = query.get("severity", "").upper()
             if severity in {"LOW", "MEDIUM", "HIGH", "CRITICAL"}:
                 description = query.get("query_name", "")
-                query_id = query.get("query_id", "")
                 for file in query.get("files", []):
+                    query_id = file.get("similarity_id", "")
                     file_name = file.get("file_name", "")
                     filtered_results.append({
                         "severity": severity,

devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kics/kics_tool.py

@@ -18,6 +18,25 @@ logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 
 class KicsTool(ToolGateway):
     TOOL_KICS = "KICS"
+    scan_type_platform_mapping = {
+        "openapi": "OpenAPI",
+        "terraform": "Terraform",
+        "k8s": "Kubernetes",
+        "docker": "Dockerfile",
+        "cloudformation": "CloudFormation",
+        "ansible": "Ansible",
+        "azureresourcemanager": "AzureResourceManager",
+        "bicep": "Bicep",
+        "buildah": "Buildah",
+        "cicd": "CICD",
+        "crossplane": "Crossplane",
+        "dockercompose": "DockerCompose",
+        "grpc": "GRPC",
+        "googledeploymentmanager": "GoogleDeploymentManager",
+        "knative": "Knative",
+        "pulumi": "Pulumi",
+        "serverlessfw": "ServerlessFW"
+    }
 
     def download(self, file, url):
         try:
@@ -27,105 +46,117 @@ class KicsTool(ToolGateway):
         except Exception as ex:
             logger.error(f"An error ocurred downloading {file} {ex}")
 
-    def install_tool(self, file, url, command_prefix):
-        utils = Utils()
-        kics = f"./{command_prefix}/kics"
-        installed = subprocess.run(
-            ["which", command_prefix],
-            stdout=subprocess.PIPE,
-            stderr=subprocess.PIPE,
-        )
-        if installed.returncode == 1:
-            try:
-                self.download(file, url)
-                utils.unzip_file(file, command_prefix)
-                subprocess.run(["chmod", "+x", kics])
-                return kics
-            except Exception as e:
-                logger.error(f"Error installing KICS: {e}")
-        else:
-            return command_prefix
-
-    def install_tool_windows(self, file, url, command_prefix):
-        try:
-            subprocess.run(
-                [command_prefix, "version"],
-                stdout=subprocess.PIPE,
-                stderr=subprocess.PIPE,
-            )
-            return command_prefix
-        except:
-            try:
-                utils = Utils()
-                self.download(file, url)
-                utils.unzip_file(file, command_prefix)
-                return f"./{command_prefix}/kics"
-
-            except Exception as e:
-                logger.error(f"Error installing KICS: {e}")
-
-    def execute_kics(self, folders_to_scan, prefix):
+    def execute_kics(self, folders_to_scan, prefix, platform_to_scan, work_folder, os_platform, queries):
         folders = ','.join(folders_to_scan)
-        command = [prefix, "scan", "-p", folders, "-q", "./kics_assets/assets", "--report-formats", "json", "-o", "./"]
+        queries = ','.join([list(query.values())[0] for query in queries])
+        mapped_platforms = [
+            self.scan_type_platform_mapping.get(platform.lower(), platform)
+            for platform in platform_to_scan
+        ]
+        platforms = ','.join(mapped_platforms)
+
+        command = [
+            prefix,
+            "scan",
+            "-p",
+            folders,
+            "-t",
+            platforms,
+            "--include-queries",
+            queries,
+            "-q",
+            f"{work_folder}\\kics-devsecops\\assets\\queries" if os_platform == "Windows"
+            else f"{work_folder}/kics-devsecops/assets/queries",
+            "--report-formats",
+            "json",
+            "-o",
+            work_folder
+        ]
         try:
             subprocess.run(command, capture_output=True)
         except subprocess.CalledProcessError as e:
             logger.error(f"Error during KICS execution: {e}")
 
-    def load_results(self):
+    def load_results(self, work_folder, queries):
         try:
-            with open('results.json') as f:
+            results_path = os.path.join(work_folder, "results.json")
+            with open(results_path, "r") as f:
                 data = json.load(f)
+
+            for finding in data.get("queries", []):
+                query_ids = {list(query.values())[0] for query in queries}
+                if finding.get("query_id") in query_ids:
+                    finding["custom_vuln_id"] = next(
+                        key for query in queries for key, value in query.items() if value == finding.get("query_id")
+                    )
+
+            with open(results_path, "w") as f:
+                json.dump(data, f, indent=4)
+
             return data
         except Exception as ex:
-            logger.error(f"An error ocurred loading KICS results {ex}")
+            logger.error(f"An error occurred loading or modifying KICS results {ex}")
             return None
 
-    def select_operative_system(self, os_platform, config_tool, path_kics):
-        command_prefix = path_kics
-        if os_platform == "Linux":
-            kics_zip = "kics_linux.zip"
-            url_kics = config_tool[self.TOOL_KICS]["KICS_LINUX"]
-            return self.install_tool(kics_zip, url_kics, command_prefix)
-        elif os_platform == "Windows":
-            kics_zip = "kics_windows.zip"
-            url_kics = config_tool[self.TOOL_KICS]["KICS_WINDOWS"]
-            return self.install_tool_windows(kics_zip, url_kics, command_prefix)
-        elif os_platform == "Darwin":
-            kics_zip = "kics_macos.zip"
-            url_kics = config_tool[self.TOOL_KICS]["KICS_MAC"]
-            return self.install_tool(kics_zip, url_kics, command_prefix)
-        else:
-            logger.warning(f"{os_platform} is not supported.")
-            return [], None
-
-    def get_assets(self, kics_version):
+    def get_assets(self, kics_version, work_folder):
         name_zip = "assets_compressed.zip"
         assets_url = f"https://github.com/Checkmarx/kics/releases/download/v{kics_version}/extracted-info.zip"
         self.download(name_zip, assets_url)
 
-        directory_assets = "kics_assets"
+        directory_assets = f"{work_folder}/kics-devsecops"
         utils = Utils()
         utils.unzip_file(name_zip, directory_assets)
 
+    def validate_kics(self, command_prefix):
+        try:
+            result = subprocess.run([command_prefix, "version"], capture_output=True, text=True)
+            if result.returncode == 0:
+                return True
+            else:
+                logger.error(f"KICS binary not valid: {result.stderr}")
+                return False
+        except Exception as e:
+            logger.error(f"Error validating KICS binary: {e}")
+
+    def get_queries(self, config_tool, platform_to_scan):
+        try:
+            queries = []
+            for platform in platform_to_scan:
+                platform = platform.strip().upper()
+                if f"RULES_{platform}" not in config_tool[self.TOOL_KICS]["RULES"]:
+                    logger.error(f"Platform {platform} not found in RULES")
+                queries = [{key: value["checkID"]} for key, value in config_tool[self.TOOL_KICS]["RULES"][f"RULES_{platform}"].items()]
+            return queries
+        except Exception as e:
+            logger.error(f"Error writing queries file: {e}")
+
     def run_tool(
-            self, config_tool, folders_to_scan, **kwargs
+            self, config_tool, folders_to_scan, work_folder, platform_to_scan, **kwargs
     ):
-        kics_version = config_tool[self.TOOL_KICS]["VERSION"]
+        kics_version = config_tool[self.TOOL_KICS]["CLI_VERSION"]
         path_kics = config_tool[self.TOOL_KICS]["PATH_KICS"]
         download_kics_assets = config_tool[self.TOOL_KICS]["DOWNLOAD_KICS_ASSETS"]
-        if download_kics_assets:
-            self.get_assets(kics_version)
-
+        
         os_platform = platform.system()
-        command_prefix = self.select_operative_system(os_platform, config_tool, path_kics)
-        self.execute_kics(folders_to_scan, command_prefix)
+        path_kics = path_kics.replace("/", "\\") if os_platform == "Windows" else path_kics
+        work_folder = work_folder.replace("/", "\\") if os_platform == "Windows" else work_folder
+        
+        command_prefix = f"{work_folder}\\{path_kics}.exe" if os_platform == "Windows" else f"{work_folder}/{path_kics}"
+        
+        if not self.validate_kics(command_prefix):
+            logger.info("KICS binary not found or invalid, downloading assets...")
+
+        if download_kics_assets:
+            self.get_assets(kics_version, work_folder)
 
-        data = self.load_results()
+        queries = self.get_queries(config_tool, platform_to_scan)
+        self.execute_kics(folders_to_scan, command_prefix, platform_to_scan, work_folder, os_platform, queries)
+        data = self.load_results(work_folder, queries)
+        
         if data:
             kics_deserealizator = KicsDeserealizator()
             total_vulnerabilities = kics_deserealizator.calculate_total_vulnerabilities(data)
-            path_file = os.path.abspath("results.json")
+            path_file = os.path.join(work_folder, "results.json")
 
             if total_vulnerabilities == 0:
                 return [], path_file
@@ -134,4 +165,4 @@ class KicsTool(ToolGateway):
             finding_list = kics_deserealizator.get_list_finding(filtered_results)
 
             return finding_list, path_file
-        return [], None
+        return [], None

devsecops_engine_tools/version.py

@@ -1 +1 @@
-version = '1.48.1'
+version = '1.50.0'

{devsecops_engine_tools-1.48.1.dist-info → devsecops_engine_tools-1.50.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.48.1
+Version: 1.50.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.48.1.dist-info → devsecops_engine_tools-1.50.0.dist-info}/RECORD

@@ -1,5 +1,5 @@
 devsecops_engine_tools/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-devsecops_engine_tools/version.py,sha256=fsWA33w6l-rR0RWdoXYfxoaTVXSxTBcmlhCVcZQZfyI,19
+devsecops_engine_tools/version.py,sha256=IbFsfcSGQh-O_BT3I9RBywWSl3q9CYS9_0Z1DsySd80,19
 devsecops_engine_tools/engine_core/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_core/src/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_core/src/applications/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -101,7 +101,7 @@ devsecops_engine_tools/engine_risk/src/domain/model/gateways/__init__.py,sha256=
 devsecops_engine_tools/engine_risk/src/domain/model/gateways/add_epss_gateway.py,sha256=cTm4QSxiaUt7ETCdXWZxKEus8pmEDA3e9k5b39SLDDE,178
 devsecops_engine_tools/engine_risk/src/domain/usecases/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_risk/src/domain/usecases/add_data.py,sha256=4wqDj-q7hJfJscvrbMDcy7tONqxdxl-CSl_TWTRUGKA,402
-devsecops_engine_tools/engine_risk/src/domain/usecases/break_build.py,sha256=AgBM6p730v7alb_Um-av7K_aHGywkxhQJ6441lh5U6Y,15017
+devsecops_engine_tools/engine_risk/src/domain/usecases/break_build.py,sha256=jXNb0bcpJu0L6eiQ4SAtjai9AoQbeU66fK-IGgup8pk,15324
 devsecops_engine_tools/engine_risk/src/domain/usecases/check_threshold.py,sha256=VYdmcbAuNNvdHCegRfvza7YJ8FHbFNyDosrKJrMW93I,765
 devsecops_engine_tools/engine_risk/src/domain/usecases/get_exclusions.py,sha256=1UNNq_Yhg3R78jLRSKcMNQYe8T8gl1C31C0ttBF0OAk,3992
 devsecops_engine_tools/engine_risk/src/domain/usecases/handle_filters.py,sha256=R53fnuIQYfr7YbpMz1BGPJ1d5z9jY_Hnm7EmPt99wlE,3608
@@ -146,16 +146,16 @@ devsecops_engine_tools/engine_sast/engine_iac/src/domain/model/config_tool.py,sh
 devsecops_engine_tools/engine_sast/engine_iac/src/domain/model/gateways/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_sast/engine_iac/src/domain/model/gateways/tool_gateway.py,sha256=ClElxyHbwfDCW0fgcehaNfQLq00zozhO71EnyCjzt-U,182
 devsecops_engine_tools/engine_sast/engine_iac/src/domain/usecases/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-devsecops_engine_tools/engine_sast/engine_iac/src/domain/usecases/iac_scan.py,sha256=4d9TF8pM_iun9EZo1c9IPZV84BrufGJvQRC8WCup3oQ,5910
+devsecops_engine_tools/engine_sast/engine_iac/src/domain/usecases/iac_scan.py,sha256=BkUfDivqyYvZOTfJ8MfhvD9BMQPXRLQCmKhByjQnfvk,5998
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_config.py,sha256=qbE6wUO5_WFXF_QolL0JYelaRGEOUakPEZR_6HAKzzI,4355
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_deserealizator.py,sha256=l_opY909gh1m3k2ud2xDrCVnDTBe3ApYT75juBf_uMk,1836
-devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_tool.py,sha256=bMcPri5oZkQdzjz2cIWIb-JA3xpdsFwD7LPBp_IDUnQ,11991
+devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_tool.py,sha256=buTIx2Tq3g5Rs-v4eT2GFB8NKzNh6R-FpzkofCUq9qw,12008
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kics/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kics/kics_deserealizator.py,sha256=b1X5GWz2snJtsKZcGEsILNc178hv9p-lg-el0Jc-_Eo,2084
-devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kics/kics_tool.py,sha256=8lda0A7huVSWgq2zMAN92vQv4ug0HiQMATGdXV5lgyA,5202
+devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kics/kics_deserealizator.py,sha256=tZq3jutZL2M9XIxm5K_xd3mWwTCMVmHQPFNvrslCqCM,2092
+devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kics/kics_tool.py,sha256=pVNZclcBKA6Ebm9kUfBWlHFI37ROT58CdqcczeM1UGs,6656
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kubescape/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kubescape/kubescape_deserealizator.py,sha256=bGOGmsIpJcQzTMxptJPwZCA9_2Woaua3pXmMs4kTnX8,2893
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kubescape/kubescape_tool.py,sha256=N17glvzoUkGQJ_1icqznpORXuKJRKEq8Ye1IleN5o1g,4544
@@ -347,8 +347,8 @@ devsecops_engine_tools/engine_utilities/utils/name_conversion.py,sha256=ADJrRGax
 devsecops_engine_tools/engine_utilities/utils/printers.py,sha256=amYAr9YQfYgR6jK9a2l26z3oovFPQ3FAKmhq6BKhEBA,623
 devsecops_engine_tools/engine_utilities/utils/session_manager.py,sha256=Z0fdhB3r-dxU0nGSD9zW_B4r2Qol1rUnUCkhFR0U-HQ,487
 devsecops_engine_tools/engine_utilities/utils/utils.py,sha256=HCjS900TBoNcHrC4LaiP-Kf9frVdtagF130qOUgnO2M,6757
-devsecops_engine_tools-1.48.1.dist-info/METADATA,sha256=hqIhjAzLVeg0ie74aQKly3ouyx32l_gutUl5jjWdGCo,11779
-devsecops_engine_tools-1.48.1.dist-info/WHEEL,sha256=R0nc6qTxuoLk7ShA2_Y-UWkN8ZdfDBG2B6Eqpz2WXbs,91
-devsecops_engine_tools-1.48.1.dist-info/entry_points.txt,sha256=MHCTFFs9bdNKo6YcWCcBW2_8X6yTisgLOlmVx-V8Rxc,276
-devsecops_engine_tools-1.48.1.dist-info/top_level.txt,sha256=ge6y0X_xBAU1aG3EMWFtl9djbVyg5BxuSp2r2Lg6EQU,23
-devsecops_engine_tools-1.48.1.dist-info/RECORD,,
+devsecops_engine_tools-1.50.0.dist-info/METADATA,sha256=eT8fLJFCtv45wDxQruQSonplLFPbEY2F8h6SDb3Z3OM,11779
+devsecops_engine_tools-1.50.0.dist-info/WHEEL,sha256=R0nc6qTxuoLk7ShA2_Y-UWkN8ZdfDBG2B6Eqpz2WXbs,91
+devsecops_engine_tools-1.50.0.dist-info/entry_points.txt,sha256=MHCTFFs9bdNKo6YcWCcBW2_8X6yTisgLOlmVx-V8Rxc,276
+devsecops_engine_tools-1.50.0.dist-info/top_level.txt,sha256=ge6y0X_xBAU1aG3EMWFtl9djbVyg5BxuSp2r2Lg6EQU,23
+devsecops_engine_tools-1.50.0.dist-info/RECORD,,