devsecops-engine-tools 1.57.0__tar.gz → 1.59.0__tar.gz

{devsecops_engine_tools-1.57.0 → devsecops_engine_tools-1.59.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.57.0
+Version: 1.59.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team
@@ -32,6 +32,7 @@ Requires-Dist: ruamel.yaml==0.18.6
 Requires-Dist: Authlib==1.3.2
 Requires-Dist: PyJWT==2.9.0
 Requires-Dist: sympy==1.13.3
+Requires-Dist: holidays==0.58
 
 # DevSecOps Engine Tools
 

{devsecops_engine_tools-1.57.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools/engine_core/src/applications/runner_engine_core.py

@@ -203,6 +203,15 @@ def get_inputs_from_cli(args):
         help="File path containing the configuration, structured according to the documentation, \
         for the API or web application to be scanned by the DAST tool."
     )
+    parser.add_argument(
+        "-c",
+        "--context",
+        choices=["true", "false"],
+        type=str,
+        required=False,
+        default="false",
+        help="Enable or disable context creation. Applies only to engine_iac and engine_container. Default is false."
+    )
 
     TOOLS = {
         "engine_iac": ["checkov", "kics", "kubescape"],
@@ -242,7 +251,8 @@ def get_inputs_from_cli(args):
         "token_external_checks": args.token_external_checks,
         "xray_mode": args.xray_mode,
         "image_to_scan": args.image_to_scan,
-        "dast_file_path": args.dast_file_path
+        "dast_file_path": args.dast_file_path,
+        "context": args.context
     }
 
 

{devsecops_engine_tools-1.57.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools/engine_risk/src/domain/usecases/break_build.py

@@ -15,6 +15,8 @@ from collections import Counter
 import copy
 import sympy as sp
 import math
+from datetime import datetime, timedelta
+import holidays
 
 
 class BreakBuild:
@@ -138,7 +140,16 @@ class BreakBuild:
         formula = sp.Eq(
             remediation_rate_name,
             100
-            * (mitigated_name / (all_findings_name - new_findings - white_list_name - transferred_name - base_image_name)),
+            * (
+                mitigated_name
+                / (
+                    all_findings_name
+                    - new_findings
+                    - white_list_name
+                    - transferred_name
+                    - base_image_name
+                )
+            ),
         )
         print("\n")
         sp.pretty_print(formula)
@@ -167,7 +178,13 @@ class BreakBuild:
         print(
             f"Mitigated: {mitigated_count}   AllFindings: {all_findings_count}   BaseImage: {base_image_count}   NewFindings: {self.policy_excluded}   Transferred: {transferred_list_count}   WhiteList: {white_list_count}\n\n"
         )
-        total = all_findings_count - self.policy_excluded - white_list_count - base_image_count - transferred_list_count
+        total = (
+            all_findings_count
+            - self.policy_excluded
+            - white_list_count
+            - base_image_count
+            - transferred_list_count
+        )
 
         if total == 0:
             print(
@@ -198,7 +215,9 @@ class BreakBuild:
             )
             self.warning_build = True
         else:
-            missing_findings = math.ceil((risk_threshold / 100 * total) - mitigated_count)
+            missing_findings = math.ceil(
+                (risk_threshold / 100 * total) - mitigated_count
+            )
             print(
                 self.devops_platform_gateway.message(
                     "error",
@@ -281,62 +300,85 @@ class BreakBuild:
         remote_config = self.remote_config
         if report_list:
             tag_blacklist = set(remote_config["TAG_BLACKLIST_EXCLUSION_DAYS"].keys())
+            colombian_holidays = holidays.Colombia()
 
-            filtered_reports_above_threshold = [
-                (report, tag)
-                for report in report_list
-                for tag in report.tags
-                if tag in tag_blacklist
-                and report.age >= remote_config["TAG_BLACKLIST_EXCLUSION_DAYS"][tag]
-            ]
+        def calculate_working_days(start_date, days):
+            current_date = start_date
+            working_days = 0
+            while working_days < days:
+                current_date += timedelta(days=1)
+                if (
+                    current_date.weekday() < 5
+                    and current_date not in colombian_holidays
+                ):
+                    working_days += 1
+            return current_date
 
-            filtered_reports_below_threshold = [
-                (report, tag)
-                for report in report_list
-                for tag in report.tags
-                if tag in tag_blacklist
-                and report.age < remote_config["TAG_BLACKLIST_EXCLUSION_DAYS"][tag]
-            ]
+        filtered_reports_above_threshold = []
+        filtered_reports_below_threshold = []
 
-            for report, tag in filtered_reports_above_threshold:
-                report.reason = "Blacklisted"
-                print(
-                    self.devops_platform_gateway.message(
-                        "error",
-                        f"Report {report.vm_id} with tag '{tag}' is blacklisted and age {report.age} is above threshold {remote_config['TAG_BLACKLIST_EXCLUSION_DAYS'][tag]}",
-                    )
+        for report in report_list:
+            for tag in report.tags:
+                if tag in tag_blacklist:
+                    exclusion_value = remote_config["TAG_BLACKLIST_EXCLUSION_DAYS"][tag]
+                    if isinstance(exclusion_value, str) and "WD" in exclusion_value:
+                        working_days_threshold = int(exclusion_value.replace("WD", ""))
+                        report_created_date = datetime.strptime(
+                            report.created.split("T")[0], "%Y-%m-%d"
+                        )
+                        threshold_date = calculate_working_days(
+                            report_created_date, working_days_threshold
+                        )
+                        if datetime.now() >= threshold_date:
+                            filtered_reports_above_threshold.append((report, tag))
+                        else:
+                            filtered_reports_below_threshold.append((report, tag))
+                    else:
+                        numeric_threshold = int(exclusion_value)
+                        if report.age >= numeric_threshold:
+                            filtered_reports_above_threshold.append((report, tag))
+                        else:
+                            filtered_reports_below_threshold.append((report, tag))
+
+        for report, tag in filtered_reports_above_threshold:
+            report.reason = "Blacklisted"
+            print(
+                self.devops_platform_gateway.message(
+                    "error",
+                    f"Report {report.vm_id} with tag '{tag}' is blacklisted and age {report.age} is above threshold {remote_config['TAG_BLACKLIST_EXCLUSION_DAYS'][tag]}",
                 )
+            )
 
-            for report, tag in filtered_reports_below_threshold:
-                print(
-                    self.devops_platform_gateway.message(
-                        "warning",
-                        f"Report {report.vm_id} with tag '{tag}' is blacklisted but age {report.age} is below threshold {remote_config['TAG_BLACKLIST_EXCLUSION_DAYS'][tag]}",
-                    )
+        for report, tag in filtered_reports_below_threshold:
+            print(
+                self.devops_platform_gateway.message(
+                    "warning",
+                    f"Report {report.vm_id} with tag '{tag}' is blacklisted but age {report.age} is below threshold {remote_config['TAG_BLACKLIST_EXCLUSION_DAYS'][tag]}",
                 )
-                self.policy_excluded += 1
+            )
+            self.policy_excluded += 1
 
-            if filtered_reports_above_threshold:
-                self.break_build = True
-                self.blacklisted += len(filtered_reports_above_threshold)
-                self.report_breaker.extend(
-                    copy.deepcopy(
-                        [report for report, _ in filtered_reports_above_threshold]
-                    )
+        if filtered_reports_above_threshold:
+            self.break_build = True
+            self.blacklisted += len(filtered_reports_above_threshold)
+            self.report_breaker.extend(
+                copy.deepcopy(
+                    [report for report, _ in filtered_reports_above_threshold]
                 )
+            )
 
-            for report in report_list:
-                if "On Blacklist" in report.risk_status:
-                    self.break_build = True
-                    report.reason = "Blacklisted"
-                    self.blacklisted += 1
-                    self.report_breaker.append(copy.deepcopy(report))
-                    print(
-                        self.devops_platform_gateway.message(
-                            "error",
-                            f"Report {report.vm_id} is blacklisted.",
-                        )
+        for report in report_list:
+            if "On Blacklist" in report.risk_status:
+                self.break_build = True
+                report.reason = "Blacklisted"
+                self.blacklisted += 1
+                self.report_breaker.append(copy.deepcopy(report))
+                print(
+                    self.devops_platform_gateway.message(
+                        "error",
+                        f"Report {report.vm_id} is blacklisted.",
                     )
+                )
 
     def _risk_score_control(self, report_list: "list[Report]"):
         remote_config = self.remote_config

devsecops_engine_tools-1.59.0/devsecops_engine_tools/engine_sast/engine_iac/src/domain/model/context_iac.py

@@ -0,0 +1,13 @@
+from dataclasses import dataclass
+
+@dataclass
+class ContextIac:
+    id: str
+    check_name: str
+    check_class: str
+    severity: str
+    where: str
+    resource: str
+    description: str
+    module: str
+    tool: str

{devsecops_engine_tools-1.57.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools/engine_sast/engine_iac/src/domain/model/gateways/tool_gateway.py

@@ -4,3 +4,9 @@ class ToolGateway(metaclass=ABCMeta):
     @abstractmethod
     def run_tool(self, config_tool, folders_to_scan, **kwargs):
         "run_tool"
+
+    @classmethod
+    def get_iac_context_from_results(
+        self, path_file_results
+    ) -> None:
+        "get_iac_context_from_results"

{devsecops_engine_tools-1.57.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools/engine_sast/engine_iac/src/domain/usecases/iac_scan.py

@@ -48,13 +48,18 @@ class IacScan:
                 secret_tool=secret_tool,
                 secret_external_checks=dict_args["token_external_checks"],
                 work_folder=self.devops_platform_gateway.get_variable("temp_directory"),
-                dict_args=dict_args
+                dict_args=dict_args,
             )
         else:
             print("Tool skipped by DevSecOps policy")
             dict_args["send_metrics"] = "false"
             dict_args["use_vulnerability_management"] = "false"
-
+        
+        if dict_args.get("context") == "true":
+            self.tool_gateway.get_iac_context_from_results(
+                path_file_results
+            )
+            
         totalized_exclusions = []
         (
             totalized_exclusions.extend(

{devsecops_engine_tools-1.57.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_deserealizator.py

@@ -5,7 +5,6 @@ from devsecops_engine_tools.engine_core.src.domain.model.finding import (
 from datetime import datetime
 from dataclasses import dataclass
 
-
 @dataclass
 class CheckovDeserealizator:
     @classmethod
@@ -17,7 +16,7 @@ class CheckovDeserealizator:
         for result in results_scan_list:
             if "failed_checks" in str(result):
                 for scan in result["results"]["failed_checks"]:
-                    check_id = scan.get("check_id")
+                    check_id = scan.get("check_id") 
                     if not rules.get(check_id):
                         description = scan.get("check_name")
                         severity = default_severity.lower()
@@ -40,6 +39,8 @@ class CheckovDeserealizator:
                         requirements=scan.get("guideline"),
                         tool="Checkov"
                     )
-                    list_open_findings.append(finding_open)
-
-        return list_open_findings
+                    list_open_findings.append(finding_open)      
+       
+        return list_open_findings
+    
+    

{devsecops_engine_tools-1.57.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_tool.py

@@ -9,6 +9,7 @@ import threading
 import json
 import shutil
 import platform
+from devsecops_engine_tools.engine_sast.engine_iac.src.domain.model.context_iac import ContextIac
 from devsecops_engine_tools.engine_sast.engine_iac.src.domain.model.gateways.tool_gateway import (
     ToolGateway,
 )
@@ -273,6 +274,37 @@ class CheckovTool(ToolGateway):
         else:
             return [], None
         
+    def get_iac_context_from_results(
+        self, path_file_results: str
+    ):
+        with open(path_file_results, "r") as file:
+            context_results_scan_list = json.load(file)
+            context_iac_list = []
+            failed_checks = context_results_scan_list.get("results", {}).get("failed_checks", [])
+            for check in failed_checks:
+                file_line_range = check.get("file_line_range", ["unknown", "unknown"])
+                start_line = file_line_range[0] if len(file_line_range) > 0 else "unknown"
+                end_line = file_line_range[1] if len(file_line_range) > 1 else "unknown"
+                line_range_str = f"{start_line}-{end_line}" if start_line != end_line else str(start_line)
+
+                context_iac = ContextIac(
+                    id=check.get("check_id", "unknown"),
+                    check_name=check.get("check_name", "unknown"),
+                    check_class=check.get("check_class", "unknown"),
+                    severity=check.get("severity").lower(),
+                    where=f"{check.get('repo_file_path', 'unknown')}: {check.get('resource', 'unknown')} (line {line_range_str})",
+                    resource=check.get("resource", "unknown"),
+                    description=check.get("check_name", "unknown"),
+                    module="engine_iac",
+                    tool="Checkov"
+                )
+
+                context_iac_list.append(context_iac)
+                        
+            print("===== BEGIN CONTEXT OUTPUT =====")
+            print(json.dumps({"iac_context": [obj.__dict__ for obj in context_iac_list]}, indent=4))
+            print("===== END CONTEXT OUTPUT =====")
+        
 
     def install_binary(self,config_tool):
         os_platform = platform.system()

{devsecops_engine_tools-1.57.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kics/kics_tool.py

@@ -165,4 +165,8 @@ class KicsTool(ToolGateway):
             finding_list = kics_deserealizator.get_list_finding(filtered_results)
 
             return finding_list, path_file
-        return [], None
+        return [], None
+    
+    def get_iac_context_from_results(self, path_file_results):
+        #TODO: Implement this method
+        pass

{devsecops_engine_tools-1.57.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kubescape/kubescape_tool.py

@@ -117,3 +117,7 @@ class KubescapeTool(ToolGateway):
             return finding_list, path_results
         else:
             return [], None
+
+    def get_iac_context_from_results(self, path_file_results):
+        #TODO: Implement this method
+        pass

devsecops_engine_tools-1.59.0/devsecops_engine_tools/engine_sca/engine_container/src/domain/model/context_container.py

@@ -0,0 +1,23 @@
+from dataclasses import dataclass
+from typing import List, Optional
+
+@dataclass
+class ContextContainer:
+    cve_id: str
+    cwe_id: Optional[List[str]]
+    vendor_id: Optional[List[str]]
+    severity: str
+    vulnerability_status: str
+    target_image: str
+    package_name: str
+    installed_version: str
+    fixed_version: Optional[str]
+    cvss_score: Optional[float]
+    cvss_vector: Optional[str]
+    description: str
+    os_type: str
+    layer_digest: Optional[str]
+    published_date: Optional[str]
+    last_modified_date: Optional[str]
+    references: Optional[List[str]]
+    source_tool: str

{devsecops_engine_tools-1.57.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools/engine_sca/engine_container/src/domain/model/gateways/deserealizator_gateway.py

@@ -1,8 +1,12 @@
 from abc import ABCMeta, abstractmethod
 from devsecops_engine_tools.engine_core.src.domain.model.finding import Finding
+from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.context_container import ContextContainer
 
 
 class DeseralizatorGateway(metaclass=ABCMeta):
     @abstractmethod
     def get_list_findings(self, results_scan_list: list) -> "list[Finding]":
         "Deseralizator"
+
+    def get_container_context_from_results(self, results_scan_list: list) -> "list[ContextContainer]":
+        "Deseralizator"

{devsecops_engine_tools-1.57.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools/engine_sca/engine_container/src/domain/usecases/container_sca_scan.py

@@ -24,6 +24,7 @@ class ContainerScaScan:
         image_to_scan,
         exclusions,
         pipeline_name,
+        context,
     ):
         self.tool_run = tool_run
         self.remote_config = remote_config
@@ -35,6 +36,7 @@ class ContainerScaScan:
         self.image_to_scan = image_to_scan
         self.exclusions = exclusions
         self.pipeline_name = pipeline_name
+        self.context = context
 
     def get_image(self, image_to_scan):
         """
@@ -137,4 +139,8 @@ class ContainerScaScan:
         Returns:
             list: Deserialized list of findings.
         """
+        context_flag = self.context
+        if context_flag == "true":
+            self.tool_deseralizator.get_container_context_from_results(image_scanned)
+                    
         return self.tool_deseralizator.get_list_findings(image_scanned)

{devsecops_engine_tools-1.57.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/prisma_cloud/prisma_deserialize_output.py

@@ -67,3 +67,7 @@ class PrismaDeserealizator(DeseralizatorGateway):
             list_open_vulnerabilities.extend(vulnerabilities)
 
         return list_open_vulnerabilities
+    
+    def get_container_context_from_results(self, image_scanned):
+        #TODO: Implement this method
+        pass

{devsecops_engine_tools-1.57.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/trivy_tool/trivy_deserialize_output.py

@@ -1,3 +1,4 @@
+from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.context_container import ContextContainer
 from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.gateways.deserealizator_gateway import (
     DeseralizatorGateway,
 )
@@ -5,11 +6,10 @@ from devsecops_engine_tools.engine_core.src.domain.model.finding import (
     Finding,
     Category,
 )
-from dataclasses import dataclass
+from dataclasses import asdict, dataclass
 import json
 from datetime import datetime, timezone
 
-
 @dataclass
 class TrivyDeserializator(DeseralizatorGateway):
     def check_date_format(self, vul):
@@ -61,3 +61,50 @@ class TrivyDeserializator(DeseralizatorGateway):
             ]
             list_open_vulnerabilities.extend(vulnerabilities)
         return list_open_vulnerabilities
+    
+    def get_container_context_from_results(self, image_scanned) -> "list[ContextContainer]":
+        context_container_list = []
+
+        with open(image_scanned, "rb") as file:
+            image_object = file.read()
+            json_data = json.loads(image_object)
+
+        results = json_data.get("Results", [])
+
+        for result in results:
+            vulnerabilities = result.get("Vulnerabilities", [])
+            for vul in vulnerabilities:
+                context_container = ContextContainer(
+                    cve_id=vul.get("VulnerabilityID", "unknown"),
+                    cwe_id=vul.get("CweIDs", "unknown"),
+                    vendor_id=vul.get("VendorIDs", "unknown"),
+                    severity=vul.get("Severity", "unknown").lower(),
+                    vulnerability_status=vul.get("Status", "unknown"),
+                    target_image=result.get("Target", "unknown"),
+                    package_name=vul.get("PkgName", "unknown"),
+                    installed_version=vul.get("InstalledVersion", "unknown"),
+                    fixed_version=vul.get("FixedVersion", "unknown"),
+                    cvss_score=next(
+                        (
+                            v.get("V3Score", "unknown")
+                            for v in vul.get("CVSS", {}).values()
+                            if "V3Score" in v
+                        ),
+                        None,
+                    ),
+                    cvss_vector=vul.get("CVSS", "unknown"),
+                    description=vul.get("Description", "unknown").replace("\n", ""),
+                    os_type=result.get("Type", "unknown"),
+                    layer_digest=vul.get("Layer", {}).get("DiffID", "unknown"),
+                    published_date=self.check_date_format(vul)
+                    if vul.get("PublishedDate")
+                    else None,
+                    last_modified_date=vul.get("LastModifiedDate", "unknown"),
+                    references=vul.get("References", "unknown"),
+                    source_tool="Trivy",
+                )
+                context_container_list.append(context_container)
+
+        print("===== BEGIN CONTEXT OUTPUT =====")
+        print(json.dumps({"container_context": [asdict(context) for context in context_container_list]}, indent=2))
+        print("===== END CONTEXT OUTPUT =====")

{devsecops_engine_tools-1.57.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/entry_points/entry_point_tool.py

@@ -53,7 +53,8 @@ def init_engine_sca_rm(
             dict_args["token_engine_container"],
             image_to_scan,
             exclusions,
-            pipeline_name
+            pipeline_name,
+            context = dict_args["context"]
         )
         image_scanned, base_image, sbom_components = container_sca_scan.process()
         if image_scanned:

devsecops_engine_tools-1.59.0/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.59.0'

{devsecops_engine_tools-1.57.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.57.0
+Version: 1.59.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team
@@ -32,6 +32,7 @@ Requires-Dist: ruamel.yaml==0.18.6
 Requires-Dist: Authlib==1.3.2
 Requires-Dist: PyJWT==2.9.0
 Requires-Dist: sympy==1.13.3
+Requires-Dist: holidays==0.58
 
 # DevSecOps Engine Tools
 

{devsecops_engine_tools-1.57.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools.egg-info/SOURCES.txt

@@ -151,6 +151,7 @@ devsecops_engine_tools/engine_sast/engine_iac/src/deployment/infrastructure/__in
 devsecops_engine_tools/engine_sast/engine_iac/src/domain/__init__.py
 devsecops_engine_tools/engine_sast/engine_iac/src/domain/model/__init__.py
 devsecops_engine_tools/engine_sast/engine_iac/src/domain/model/config_tool.py
+devsecops_engine_tools/engine_sast/engine_iac/src/domain/model/context_iac.py
 devsecops_engine_tools/engine_sast/engine_iac/src/domain/model/gateways/__init__.py
 devsecops_engine_tools/engine_sast/engine_iac/src/domain/model/gateways/tool_gateway.py
 devsecops_engine_tools/engine_sast/engine_iac/src/domain/usecases/__init__.py
@@ -204,6 +205,7 @@ devsecops_engine_tools/engine_sca/engine_container/src/deployment/__init__.py
 devsecops_engine_tools/engine_sca/engine_container/src/deployment/infrastructure/__init__.py
 devsecops_engine_tools/engine_sca/engine_container/src/domain/__init__.py
 devsecops_engine_tools/engine_sca/engine_container/src/domain/model/__init__.py
+devsecops_engine_tools/engine_sca/engine_container/src/domain/model/context_container.py
 devsecops_engine_tools/engine_sca/engine_container/src/domain/model/gateways/__init__.py
 devsecops_engine_tools/engine_sca/engine_container/src/domain/model/gateways/deserealizator_gateway.py
 devsecops_engine_tools/engine_sca/engine_container/src/domain/model/gateways/images_gateway.py

{devsecops_engine_tools-1.57.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools.egg-info/requires.txt

@@ -20,3 +20,4 @@ ruamel.yaml==0.18.6
 Authlib==1.3.2
 PyJWT==2.9.0
 sympy==1.13.3
+holidays==0.58

devsecops_engine_tools-1.57.0/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.57.0'