devsecops-engine-tools 1.58.0__tar.gz → 1.59.0__tar.gz

{devsecops_engine_tools-1.58.0 → devsecops_engine_tools-1.59.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.58.0
+Version: 1.59.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.58.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools/engine_core/src/applications/runner_engine_core.py

@@ -203,6 +203,15 @@ def get_inputs_from_cli(args):
         help="File path containing the configuration, structured according to the documentation, \
         for the API or web application to be scanned by the DAST tool."
     )
+    parser.add_argument(
+        "-c",
+        "--context",
+        choices=["true", "false"],
+        type=str,
+        required=False,
+        default="false",
+        help="Enable or disable context creation. Applies only to engine_iac and engine_container. Default is false."
+    )
 
     TOOLS = {
         "engine_iac": ["checkov", "kics", "kubescape"],
@@ -242,7 +251,8 @@ def get_inputs_from_cli(args):
         "token_external_checks": args.token_external_checks,
         "xray_mode": args.xray_mode,
         "image_to_scan": args.image_to_scan,
-        "dast_file_path": args.dast_file_path
+        "dast_file_path": args.dast_file_path,
+        "context": args.context
     }
 
 

devsecops_engine_tools-1.59.0/devsecops_engine_tools/engine_sast/engine_iac/src/domain/model/context_iac.py

@@ -0,0 +1,13 @@
+from dataclasses import dataclass
+
+@dataclass
+class ContextIac:
+    id: str
+    check_name: str
+    check_class: str
+    severity: str
+    where: str
+    resource: str
+    description: str
+    module: str
+    tool: str

{devsecops_engine_tools-1.58.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools/engine_sast/engine_iac/src/domain/model/gateways/tool_gateway.py

@@ -4,3 +4,9 @@ class ToolGateway(metaclass=ABCMeta):
     @abstractmethod
     def run_tool(self, config_tool, folders_to_scan, **kwargs):
         "run_tool"
+
+    @classmethod
+    def get_iac_context_from_results(
+        self, path_file_results
+    ) -> None:
+        "get_iac_context_from_results"

{devsecops_engine_tools-1.58.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools/engine_sast/engine_iac/src/domain/usecases/iac_scan.py

@@ -48,13 +48,18 @@ class IacScan:
                 secret_tool=secret_tool,
                 secret_external_checks=dict_args["token_external_checks"],
                 work_folder=self.devops_platform_gateway.get_variable("temp_directory"),
-                dict_args=dict_args
+                dict_args=dict_args,
             )
         else:
             print("Tool skipped by DevSecOps policy")
             dict_args["send_metrics"] = "false"
             dict_args["use_vulnerability_management"] = "false"
-
+        
+        if dict_args.get("context") == "true":
+            self.tool_gateway.get_iac_context_from_results(
+                path_file_results
+            )
+            
         totalized_exclusions = []
         (
             totalized_exclusions.extend(

{devsecops_engine_tools-1.58.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_deserealizator.py

@@ -5,7 +5,6 @@ from devsecops_engine_tools.engine_core.src.domain.model.finding import (
 from datetime import datetime
 from dataclasses import dataclass
 
-
 @dataclass
 class CheckovDeserealizator:
     @classmethod
@@ -17,7 +16,7 @@ class CheckovDeserealizator:
         for result in results_scan_list:
             if "failed_checks" in str(result):
                 for scan in result["results"]["failed_checks"]:
-                    check_id = scan.get("check_id")
+                    check_id = scan.get("check_id") 
                     if not rules.get(check_id):
                         description = scan.get("check_name")
                         severity = default_severity.lower()
@@ -40,6 +39,8 @@ class CheckovDeserealizator:
                         requirements=scan.get("guideline"),
                         tool="Checkov"
                     )
-                    list_open_findings.append(finding_open)
-
-        return list_open_findings
+                    list_open_findings.append(finding_open)      
+       
+        return list_open_findings
+    
+    

{devsecops_engine_tools-1.58.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_tool.py

@@ -9,6 +9,7 @@ import threading
 import json
 import shutil
 import platform
+from devsecops_engine_tools.engine_sast.engine_iac.src.domain.model.context_iac import ContextIac
 from devsecops_engine_tools.engine_sast.engine_iac.src.domain.model.gateways.tool_gateway import (
     ToolGateway,
 )
@@ -273,6 +274,37 @@ class CheckovTool(ToolGateway):
         else:
             return [], None
         
+    def get_iac_context_from_results(
+        self, path_file_results: str
+    ):
+        with open(path_file_results, "r") as file:
+            context_results_scan_list = json.load(file)
+            context_iac_list = []
+            failed_checks = context_results_scan_list.get("results", {}).get("failed_checks", [])
+            for check in failed_checks:
+                file_line_range = check.get("file_line_range", ["unknown", "unknown"])
+                start_line = file_line_range[0] if len(file_line_range) > 0 else "unknown"
+                end_line = file_line_range[1] if len(file_line_range) > 1 else "unknown"
+                line_range_str = f"{start_line}-{end_line}" if start_line != end_line else str(start_line)
+
+                context_iac = ContextIac(
+                    id=check.get("check_id", "unknown"),
+                    check_name=check.get("check_name", "unknown"),
+                    check_class=check.get("check_class", "unknown"),
+                    severity=check.get("severity").lower(),
+                    where=f"{check.get('repo_file_path', 'unknown')}: {check.get('resource', 'unknown')} (line {line_range_str})",
+                    resource=check.get("resource", "unknown"),
+                    description=check.get("check_name", "unknown"),
+                    module="engine_iac",
+                    tool="Checkov"
+                )
+
+                context_iac_list.append(context_iac)
+                        
+            print("===== BEGIN CONTEXT OUTPUT =====")
+            print(json.dumps({"iac_context": [obj.__dict__ for obj in context_iac_list]}, indent=4))
+            print("===== END CONTEXT OUTPUT =====")
+        
 
     def install_binary(self,config_tool):
         os_platform = platform.system()

{devsecops_engine_tools-1.58.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kics/kics_tool.py

@@ -165,4 +165,8 @@ class KicsTool(ToolGateway):
             finding_list = kics_deserealizator.get_list_finding(filtered_results)
 
             return finding_list, path_file
-        return [], None
+        return [], None
+    
+    def get_iac_context_from_results(self, path_file_results):
+        #TODO: Implement this method
+        pass

{devsecops_engine_tools-1.58.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kubescape/kubescape_tool.py

@@ -117,3 +117,7 @@ class KubescapeTool(ToolGateway):
             return finding_list, path_results
         else:
             return [], None
+
+    def get_iac_context_from_results(self, path_file_results):
+        #TODO: Implement this method
+        pass

devsecops_engine_tools-1.59.0/devsecops_engine_tools/engine_sca/engine_container/src/domain/model/context_container.py

@@ -0,0 +1,23 @@
+from dataclasses import dataclass
+from typing import List, Optional
+
+@dataclass
+class ContextContainer:
+    cve_id: str
+    cwe_id: Optional[List[str]]
+    vendor_id: Optional[List[str]]
+    severity: str
+    vulnerability_status: str
+    target_image: str
+    package_name: str
+    installed_version: str
+    fixed_version: Optional[str]
+    cvss_score: Optional[float]
+    cvss_vector: Optional[str]
+    description: str
+    os_type: str
+    layer_digest: Optional[str]
+    published_date: Optional[str]
+    last_modified_date: Optional[str]
+    references: Optional[List[str]]
+    source_tool: str

{devsecops_engine_tools-1.58.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools/engine_sca/engine_container/src/domain/model/gateways/deserealizator_gateway.py

@@ -1,8 +1,12 @@
 from abc import ABCMeta, abstractmethod
 from devsecops_engine_tools.engine_core.src.domain.model.finding import Finding
+from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.context_container import ContextContainer
 
 
 class DeseralizatorGateway(metaclass=ABCMeta):
     @abstractmethod
     def get_list_findings(self, results_scan_list: list) -> "list[Finding]":
         "Deseralizator"
+
+    def get_container_context_from_results(self, results_scan_list: list) -> "list[ContextContainer]":
+        "Deseralizator"

{devsecops_engine_tools-1.58.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools/engine_sca/engine_container/src/domain/usecases/container_sca_scan.py

@@ -24,6 +24,7 @@ class ContainerScaScan:
         image_to_scan,
         exclusions,
         pipeline_name,
+        context,
     ):
         self.tool_run = tool_run
         self.remote_config = remote_config
@@ -35,6 +36,7 @@ class ContainerScaScan:
         self.image_to_scan = image_to_scan
         self.exclusions = exclusions
         self.pipeline_name = pipeline_name
+        self.context = context
 
     def get_image(self, image_to_scan):
         """
@@ -137,4 +139,8 @@ class ContainerScaScan:
         Returns:
             list: Deserialized list of findings.
         """
+        context_flag = self.context
+        if context_flag == "true":
+            self.tool_deseralizator.get_container_context_from_results(image_scanned)
+                    
         return self.tool_deseralizator.get_list_findings(image_scanned)

{devsecops_engine_tools-1.58.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/prisma_cloud/prisma_deserialize_output.py

@@ -67,3 +67,7 @@ class PrismaDeserealizator(DeseralizatorGateway):
             list_open_vulnerabilities.extend(vulnerabilities)
 
         return list_open_vulnerabilities
+    
+    def get_container_context_from_results(self, image_scanned):
+        #TODO: Implement this method
+        pass

{devsecops_engine_tools-1.58.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/trivy_tool/trivy_deserialize_output.py

@@ -1,3 +1,4 @@
+from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.context_container import ContextContainer
 from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.gateways.deserealizator_gateway import (
     DeseralizatorGateway,
 )
@@ -5,11 +6,10 @@ from devsecops_engine_tools.engine_core.src.domain.model.finding import (
     Finding,
     Category,
 )
-from dataclasses import dataclass
+from dataclasses import asdict, dataclass
 import json
 from datetime import datetime, timezone
 
-
 @dataclass
 class TrivyDeserializator(DeseralizatorGateway):
     def check_date_format(self, vul):
@@ -61,3 +61,50 @@ class TrivyDeserializator(DeseralizatorGateway):
             ]
             list_open_vulnerabilities.extend(vulnerabilities)
         return list_open_vulnerabilities
+    
+    def get_container_context_from_results(self, image_scanned) -> "list[ContextContainer]":
+        context_container_list = []
+
+        with open(image_scanned, "rb") as file:
+            image_object = file.read()
+            json_data = json.loads(image_object)
+
+        results = json_data.get("Results", [])
+
+        for result in results:
+            vulnerabilities = result.get("Vulnerabilities", [])
+            for vul in vulnerabilities:
+                context_container = ContextContainer(
+                    cve_id=vul.get("VulnerabilityID", "unknown"),
+                    cwe_id=vul.get("CweIDs", "unknown"),
+                    vendor_id=vul.get("VendorIDs", "unknown"),
+                    severity=vul.get("Severity", "unknown").lower(),
+                    vulnerability_status=vul.get("Status", "unknown"),
+                    target_image=result.get("Target", "unknown"),
+                    package_name=vul.get("PkgName", "unknown"),
+                    installed_version=vul.get("InstalledVersion", "unknown"),
+                    fixed_version=vul.get("FixedVersion", "unknown"),
+                    cvss_score=next(
+                        (
+                            v.get("V3Score", "unknown")
+                            for v in vul.get("CVSS", {}).values()
+                            if "V3Score" in v
+                        ),
+                        None,
+                    ),
+                    cvss_vector=vul.get("CVSS", "unknown"),
+                    description=vul.get("Description", "unknown").replace("\n", ""),
+                    os_type=result.get("Type", "unknown"),
+                    layer_digest=vul.get("Layer", {}).get("DiffID", "unknown"),
+                    published_date=self.check_date_format(vul)
+                    if vul.get("PublishedDate")
+                    else None,
+                    last_modified_date=vul.get("LastModifiedDate", "unknown"),
+                    references=vul.get("References", "unknown"),
+                    source_tool="Trivy",
+                )
+                context_container_list.append(context_container)
+
+        print("===== BEGIN CONTEXT OUTPUT =====")
+        print(json.dumps({"container_context": [asdict(context) for context in context_container_list]}, indent=2))
+        print("===== END CONTEXT OUTPUT =====")

{devsecops_engine_tools-1.58.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/entry_points/entry_point_tool.py

@@ -53,7 +53,8 @@ def init_engine_sca_rm(
             dict_args["token_engine_container"],
             image_to_scan,
             exclusions,
-            pipeline_name
+            pipeline_name,
+            context = dict_args["context"]
         )
         image_scanned, base_image, sbom_components = container_sca_scan.process()
         if image_scanned:

devsecops_engine_tools-1.59.0/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.59.0'

{devsecops_engine_tools-1.58.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.58.0
+Version: 1.59.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.58.0 → devsecops_engine_tools-1.59.0}/devsecops_engine_tools.egg-info/SOURCES.txt

@@ -151,6 +151,7 @@ devsecops_engine_tools/engine_sast/engine_iac/src/deployment/infrastructure/__in
 devsecops_engine_tools/engine_sast/engine_iac/src/domain/__init__.py
 devsecops_engine_tools/engine_sast/engine_iac/src/domain/model/__init__.py
 devsecops_engine_tools/engine_sast/engine_iac/src/domain/model/config_tool.py
+devsecops_engine_tools/engine_sast/engine_iac/src/domain/model/context_iac.py
 devsecops_engine_tools/engine_sast/engine_iac/src/domain/model/gateways/__init__.py
 devsecops_engine_tools/engine_sast/engine_iac/src/domain/model/gateways/tool_gateway.py
 devsecops_engine_tools/engine_sast/engine_iac/src/domain/usecases/__init__.py
@@ -204,6 +205,7 @@ devsecops_engine_tools/engine_sca/engine_container/src/deployment/__init__.py
 devsecops_engine_tools/engine_sca/engine_container/src/deployment/infrastructure/__init__.py
 devsecops_engine_tools/engine_sca/engine_container/src/domain/__init__.py
 devsecops_engine_tools/engine_sca/engine_container/src/domain/model/__init__.py
+devsecops_engine_tools/engine_sca/engine_container/src/domain/model/context_container.py
 devsecops_engine_tools/engine_sca/engine_container/src/domain/model/gateways/__init__.py
 devsecops_engine_tools/engine_sca/engine_container/src/domain/model/gateways/deserealizator_gateway.py
 devsecops_engine_tools/engine_sca/engine_container/src/domain/model/gateways/images_gateway.py

devsecops_engine_tools-1.58.0/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.58.0'