devsecops-engine-tools 1.59.0__py3-none-any.whl → 1.60.1__py3-none-any.whl

devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kics/kics_tool.py

@@ -7,7 +7,7 @@ from devsecops_engine_tools.engine_sast.engine_iac.src.domain.model.gateways.too
     ToolGateway,
 )
 from devsecops_engine_tools.engine_sast.engine_iac.src.infrastructure.driven_adapters.kics.kics_deserealizator import (
-    KicsDeserealizator
+    KicsDeserealizator,
 )
 from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
 from devsecops_engine_tools.engine_utilities import settings
@@ -35,10 +35,90 @@ class KicsTool(ToolGateway):
         "googledeploymentmanager": "GoogleDeploymentManager",
         "knative": "Knative",
         "pulumi": "Pulumi",
-        "serverlessfw": "ServerlessFW"
+        "serverlessfw": "ServerlessFW",
     }
 
-    def download(self, file, url):
+    def run_tool(
+        self, config_tool, folders_to_scan, work_folder, platform_to_scan, **kwargs
+    ):
+        kics_version = config_tool[self.TOOL_KICS]["CLI_VERSION"]
+        path_kics = config_tool[self.TOOL_KICS]["PATH_KICS"]
+        download_kics_assets = config_tool[self.TOOL_KICS]["DOWNLOAD_KICS_ASSETS"]
+
+        os_platform = platform.system()
+        path_kics = (
+            path_kics.replace("/", "\\") if os_platform == "Windows" else path_kics
+        )
+        work_folder = (
+            work_folder.replace("/", "\\") if os_platform == "Windows" else work_folder
+        )
+
+        command_prefix = (
+            f"{work_folder}\\{path_kics}.exe"
+            if os_platform == "Windows"
+            else f"{work_folder}/{path_kics}"
+        )
+
+        if not self._validate_kics(command_prefix):
+            logger.info("KICS binary not found or invalid, downloading assets...")
+
+        if download_kics_assets:
+            self._get_assets(kics_version, work_folder)
+
+        queries = self._get_queries(config_tool, platform_to_scan)
+        self._execute_kics(
+            folders_to_scan,
+            command_prefix,
+            platform_to_scan,
+            work_folder,
+            os_platform,
+            queries,
+        )
+        data = self._load_results(work_folder, queries)
+
+        if data:
+            kics_deserealizator = KicsDeserealizator()
+            total_vulnerabilities = kics_deserealizator.calculate_total_vulnerabilities(
+                data
+            )
+            path_file = os.path.join(work_folder, "results.json")
+
+            if total_vulnerabilities == 0:
+                return [], path_file
+
+            filtered_results = kics_deserealizator.get_findings(data)
+            finding_list = kics_deserealizator.get_list_finding(filtered_results)
+
+            return finding_list, path_file
+        return [], None
+
+    def get_iac_context_from_results(self, path_file_results):
+        # TODO: Implement this method
+        pass
+
+    def _validate_kics(self, command_prefix):
+        try:
+            result = subprocess.run(
+                [command_prefix, "version"], capture_output=True, text=True
+            )
+            if result.returncode == 0:
+                return True
+            else:
+                logger.error(f"KICS binary not valid: {result.stderr}")
+                return False
+        except Exception as e:
+            logger.error(f"Error validating KICS binary: {e}")
+
+    def _get_assets(self, kics_version, work_folder):
+        name_zip = "assets_compressed.zip"
+        assets_url = f"https://github.com/Checkmarx/kics/releases/download/v{kics_version}/extracted-info.zip"
+        self._download(name_zip, assets_url)
+
+        directory_assets = f"{work_folder}/kics-devsecops"
+        utils = Utils()
+        utils.unzip_file(name_zip, directory_assets)
+
+    def _download(self, file, url):
         try:
             response = requests.get(url)
             with open(file, "wb") as f:
@@ -46,14 +126,39 @@ class KicsTool(ToolGateway):
         except Exception as ex:
             logger.error(f"An error ocurred downloading {file} {ex}")
 
-    def execute_kics(self, folders_to_scan, prefix, platform_to_scan, work_folder, os_platform, queries):
-        folders = ','.join(folders_to_scan)
-        queries = ','.join([list(query.values())[0] for query in queries])
+    def _get_queries(self, config_tool, platform_to_scan):
+        try:
+            queries = []
+            for platform in platform_to_scan:
+                platform = platform.strip().upper()
+                if f"RULES_{platform}" not in config_tool[self.TOOL_KICS]["RULES"]:
+                    logger.error(f"Platform {platform} not found in RULES")
+                queries = [
+                    {key: value["checkID"]}
+                    for key, value in config_tool[self.TOOL_KICS]["RULES"][
+                        f"RULES_{platform}"
+                    ].items()
+                ]
+            return queries
+        except Exception as e:
+            logger.error(f"Error writing queries file: {e}")
+
+    def _execute_kics(
+        self,
+        folders_to_scan,
+        prefix,
+        platform_to_scan,
+        work_folder,
+        os_platform,
+        queries,
+    ):
+        folders = ",".join(folders_to_scan)
+        queries = ",".join([list(query.values())[0] for query in queries])
         mapped_platforms = [
             self.scan_type_platform_mapping.get(platform.lower(), platform)
             for platform in platform_to_scan
         ]
-        platforms = ','.join(mapped_platforms)
+        platforms = ",".join(mapped_platforms)
 
         command = [
             prefix,
@@ -65,19 +170,22 @@ class KicsTool(ToolGateway):
             "--include-queries",
             queries,
             "-q",
-            f"{work_folder}\\kics-devsecops\\assets\\queries" if os_platform == "Windows"
-            else f"{work_folder}/kics-devsecops/assets/queries",
+            (
+                f"{work_folder}\\kics-devsecops\\assets\\queries"
+                if os_platform == "Windows"
+                else f"{work_folder}/kics-devsecops/assets/queries"
+            ),
             "--report-formats",
             "json",
             "-o",
-            work_folder
+            work_folder,
         ]
         try:
             subprocess.run(command, capture_output=True)
         except subprocess.CalledProcessError as e:
             logger.error(f"Error during KICS execution: {e}")
 
-    def load_results(self, work_folder, queries):
+    def _load_results(self, work_folder, queries):
         try:
             results_path = os.path.join(work_folder, "results.json")
             with open(results_path, "r") as f:
@@ -87,7 +195,10 @@ class KicsTool(ToolGateway):
                 query_ids = {list(query.values())[0] for query in queries}
                 if finding.get("query_id") in query_ids:
                     finding["custom_vuln_id"] = next(
-                        key for query in queries for key, value in query.items() if value == finding.get("query_id")
+                        key
+                        for query in queries
+                        for key, value in query.items()
+                        if value == finding.get("query_id")
                     )
 
             with open(results_path, "w") as f:
@@ -97,76 +208,3 @@ class KicsTool(ToolGateway):
         except Exception as ex:
             logger.error(f"An error occurred loading or modifying KICS results {ex}")
             return None
-
-    def get_assets(self, kics_version, work_folder):
-        name_zip = "assets_compressed.zip"
-        assets_url = f"https://github.com/Checkmarx/kics/releases/download/v{kics_version}/extracted-info.zip"
-        self.download(name_zip, assets_url)
-
-        directory_assets = f"{work_folder}/kics-devsecops"
-        utils = Utils()
-        utils.unzip_file(name_zip, directory_assets)
-
-    def validate_kics(self, command_prefix):
-        try:
-            result = subprocess.run([command_prefix, "version"], capture_output=True, text=True)
-            if result.returncode == 0:
-                return True
-            else:
-                logger.error(f"KICS binary not valid: {result.stderr}")
-                return False
-        except Exception as e:
-            logger.error(f"Error validating KICS binary: {e}")
-
-    def get_queries(self, config_tool, platform_to_scan):
-        try:
-            queries = []
-            for platform in platform_to_scan:
-                platform = platform.strip().upper()
-                if f"RULES_{platform}" not in config_tool[self.TOOL_KICS]["RULES"]:
-                    logger.error(f"Platform {platform} not found in RULES")
-                queries = [{key: value["checkID"]} for key, value in config_tool[self.TOOL_KICS]["RULES"][f"RULES_{platform}"].items()]
-            return queries
-        except Exception as e:
-            logger.error(f"Error writing queries file: {e}")
-
-    def run_tool(
-            self, config_tool, folders_to_scan, work_folder, platform_to_scan, **kwargs
-    ):
-        kics_version = config_tool[self.TOOL_KICS]["CLI_VERSION"]
-        path_kics = config_tool[self.TOOL_KICS]["PATH_KICS"]
-        download_kics_assets = config_tool[self.TOOL_KICS]["DOWNLOAD_KICS_ASSETS"]
-        
-        os_platform = platform.system()
-        path_kics = path_kics.replace("/", "\\") if os_platform == "Windows" else path_kics
-        work_folder = work_folder.replace("/", "\\") if os_platform == "Windows" else work_folder
-        
-        command_prefix = f"{work_folder}\\{path_kics}.exe" if os_platform == "Windows" else f"{work_folder}/{path_kics}"
-        
-        if not self.validate_kics(command_prefix):
-            logger.info("KICS binary not found or invalid, downloading assets...")
-
-        if download_kics_assets:
-            self.get_assets(kics_version, work_folder)
-
-        queries = self.get_queries(config_tool, platform_to_scan)
-        self.execute_kics(folders_to_scan, command_prefix, platform_to_scan, work_folder, os_platform, queries)
-        data = self.load_results(work_folder, queries)
-        
-        if data:
-            kics_deserealizator = KicsDeserealizator()
-            total_vulnerabilities = kics_deserealizator.calculate_total_vulnerabilities(data)
-            path_file = os.path.join(work_folder, "results.json")
-
-            if total_vulnerabilities == 0:
-                return [], path_file
-
-            filtered_results = kics_deserealizator.get_findings(data)
-            finding_list = kics_deserealizator.get_list_finding(filtered_results)
-
-            return finding_list, path_file
-        return [], None
-    
-    def get_iac_context_from_results(self, path_file_results):
-        #TODO: Implement this method
-        pass

devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kubescape/kubescape_tool.py

@@ -18,15 +18,61 @@ logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 
 class KubescapeTool(ToolGateway):
 
-    def download_tool(self, file, url):
-        try:
-            response = requests.get(url, allow_redirects=True)
-            with open(file, "wb") as binary_file:
-                binary_file.write(response.content)
-        except Exception as e:
-            logger.error(f"Error downloading Kubescape: {e}")
+    def run_tool(self, config_tool, folders_to_scan, platform_to_scan, **kwargs):
+
+        if folders_to_scan and "k8s" in platform_to_scan:
+
+            kubescape_version = config_tool["KUBESCAPE"]["VERSION"]
+            os_platform = platform.system()
+            base_url = f"https://github.com/kubescape/kubescape/releases/download/v{kubescape_version}/"
+            command_prefix = self._select_operative_system(os_platform, base_url)
+            self._execute_kubescape(folders_to_scan, command_prefix)
+
+            json_name = "results_kubescape.json"
+            data = self._load_json(json_name)
+
+            if not data:
+                return [], None
+            else:
+                kubescape_deserealizator = KubescapeDeserealizator()
+                result_extracted_data = (
+                    kubescape_deserealizator.extract_failed_controls(data)
+                )
+                finding_list = kubescape_deserealizator.get_list_finding(
+                    result_extracted_data
+                )
+                path_results = os.path.abspath(json_name)
+            return finding_list, path_results
+        else:
+            return [], None
+
+    def get_iac_context_from_results(self, path_file_results):
+        # TODO: Implement this method
+        pass
 
-    def install_tool(self, file, url):
+    def _select_operative_system(self, os_platform, base_url):
+        if os_platform == "Linux":
+            distro_name = distro.name()
+            if distro_name == "Ubuntu":
+                file = "kubescape-ubuntu-latest"
+                self._install_tool(file, base_url + file)
+                return f"./{file}"
+            else:
+                logger.warning(f"{distro_name} is not supported.")
+                return None
+        elif os_platform == "Windows":
+            file = "kubescape-windows-latest.exe"
+            self._install_tool_windows(file, base_url + file)
+            return f"./{file}"
+        elif os_platform == "Darwin":
+            file = "kubescape-macos-latest"
+            self._install_tool(file, base_url + file)
+            return f"./{file}"
+        else:
+            logger.warning(f"{os_platform} is not supported.")
+            return [], None
+
+    def _install_tool(self, file, url):
         installed = subprocess.run(
             ["which", f"./{file}"],
             stdout=subprocess.PIPE,
@@ -34,13 +80,13 @@ class KubescapeTool(ToolGateway):
         )
         if installed.returncode == 1:
             try:
-                self.download_tool(file, url)
+                self._download_tool(file, url)
                 subprocess.run(["chmod", "+x", f"./{file}"])
 
             except Exception as e:
                 logger.error(f"Error installing Kubescape: {e}")
 
-    def install_tool_windows(self, file, url):
+    def _install_tool_windows(self, file, url):
         try:
             subprocess.run(
                 [f"./{file}", "version"],
@@ -49,20 +95,39 @@ class KubescapeTool(ToolGateway):
             )
         except:
             try:
-                self.download_tool(file, url)
+                self._download_tool(file, url)
 
             except Exception as e:
                 logger.error(f"Error installing Kubescape: {e}")
 
-    def execute_kubescape(self, folders_to_scan, prefix):
-        command = [prefix, "scan"] + folders_to_scan + ["--format", "json", "--format-version", "v2", "--output",
-                                                        "results_kubescape.json", "-v"]
+    def _download_tool(self, file, url):
+        try:
+            response = requests.get(url, allow_redirects=True)
+            with open(file, "wb") as binary_file:
+                binary_file.write(response.content)
+        except Exception as e:
+            logger.error(f"Error downloading Kubescape: {e}")
+
+    def _execute_kubescape(self, folders_to_scan, prefix):
+        command = (
+            [prefix, "scan"]
+            + folders_to_scan
+            + [
+                "--format",
+                "json",
+                "--format-version",
+                "v2",
+                "--output",
+                "results_kubescape.json",
+                "-v",
+            ]
+        )
         try:
             subprocess.run(command, capture_output=True)
         except subprocess.CalledProcessError as e:
             logger.error(f"Error during Kubescape execution: {e}")
 
-    def load_json(self, json_name):
+    def _load_json(self, json_name):
         try:
             with open(json_name) as file:
                 return json.load(file)
@@ -71,53 +136,3 @@ class KubescapeTool(ToolGateway):
         except json.JSONDecodeError:
             logger.error("The JSON result is empty.")
         return None
-
-    def select_operative_system(self, os_platform, base_url):
-        if os_platform == "Linux":
-            distro_name = distro.name()
-            if distro_name == "Ubuntu":
-                file = "kubescape-ubuntu-latest"
-                self.install_tool(file, base_url + file)
-                return f"./{file}"
-            else:
-                logger.warning(f"{distro_name} is not supported.")
-                return None
-        elif os_platform == "Windows":
-            file = "kubescape-windows-latest.exe"
-            self.install_tool_windows(file, base_url + file)
-            return f"./{file}"
-        elif os_platform == "Darwin":
-            file = "kubescape-macos-latest"
-            self.install_tool(file, base_url + file)
-            return f"./{file}"
-        else:
-            logger.warning(f"{os_platform} is not supported.")
-            return [], None
-
-    def run_tool(self, config_tool, folders_to_scan, platform_to_scan, **kwargs):
-
-        if folders_to_scan and "k8s" in platform_to_scan:
-
-            kubescape_version = config_tool["KUBESCAPE"]["VERSION"]
-            os_platform = platform.system()
-            base_url = f"https://github.com/kubescape/kubescape/releases/download/v{kubescape_version}/"
-            command_prefix = self.select_operative_system(os_platform, base_url)
-            self.execute_kubescape(folders_to_scan, command_prefix)
-
-            json_name = "results_kubescape.json"
-            data = self.load_json(json_name)
-
-            if not data:
-                return [], None
-            else:
-                kubescape_deserealizator = KubescapeDeserealizator()
-                result_extracted_data = kubescape_deserealizator.extract_failed_controls(data)
-                finding_list = kubescape_deserealizator.get_list_finding(result_extracted_data)
-                path_results = os.path.abspath(json_name)
-            return finding_list, path_results
-        else:
-            return [], None
-
-    def get_iac_context_from_results(self, path_file_results):
-        #TODO: Implement this method
-        pass

devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/entry_points/entry_point_tool.py

@@ -2,5 +2,5 @@ from devsecops_engine_tools.engine_sast.engine_iac.src.domain.usecases.iac_scan
     IacScan,
 )
 
-def init_engine_sast_rm(devops_platform_gateway, tool_gateway, dict_args, secret_tool, tool, env):
-    return IacScan(tool_gateway, devops_platform_gateway).process(dict_args, secret_tool, tool, env)
+def init_engine_sast_rm(devops_platform_gateway, remote_config_source_gateway, tool_gateway, dict_args, secret_tool, tool, env):
+    return IacScan(tool_gateway, devops_platform_gateway, remote_config_source_gateway).process(dict_args, secret_tool, tool, env)

devsecops_engine_tools/engine_sast/engine_secret/src/applications/runner_secret_scan.py

@@ -17,7 +17,7 @@ from devsecops_engine_tools.engine_utilities.git_cli.infrastructure.git_run impo
     GitRun
     )
 
-def runner_secret_scan(dict_args, tool, devops_platform_gateway, secret_tool):
+def runner_secret_scan(dict_args, tool, devops_platform_gateway, remote_config_source_gateway, secret_tool):
     try:
         tool_deserealizator = None
         tool_gateway = None
@@ -31,6 +31,7 @@ def runner_secret_scan(dict_args, tool, devops_platform_gateway, secret_tool):
 
         return engine_secret_scan(
             devops_platform_gateway = devops_platform_gateway,
+            remote_config_source_gateway=remote_config_source_gateway,
             tool_gateway = tool_gateway,
             dict_args = dict_args,
             tool=tool,

devsecops_engine_tools/engine_sast/engine_secret/src/domain/usecases/secret_scan.py

@@ -18,11 +18,13 @@ class SecretScan:
         self,
         tool_gateway: ToolGateway,
         devops_platform_gateway: DevopsPlatformGateway,
+        remote_config_source_gateway: DevopsPlatformGateway,
         tool_deserialize: DeseralizatorGateway,
         git_gateway: GitGateway
         ):
         self.tool_gateway = tool_gateway
         self.devops_platform_gateway = devops_platform_gateway
+        self.remote_config_source_gateway = remote_config_source_gateway
         self.tool_deserialize = tool_deserialize
         self.git_gateway = git_gateway
 
@@ -69,7 +71,7 @@ class SecretScan:
     
     def complete_config_tool(self, dict_args, tool):
         tool = str(tool).lower()
-        init_config_tool = self.devops_platform_gateway.get_remote_config(
+        init_config_tool = self.remote_config_source_gateway.get_remote_config(
             dict_args["remote_config_repo"], "engine_sast/engine_secret/ConfigTool.json", dict_args["remote_config_branch"]
         )
         init_config_tool['SCOPE_PIPELINE'] = self.devops_platform_gateway.get_variable("pipeline_name")

devsecops_engine_tools/engine_sast/engine_secret/src/domain/usecases/set_input_core.py

@@ -10,11 +10,13 @@ class SetInputCore:
     def __init__(
         self,
         tool_remote: DevopsPlatformGateway,
+        remote_config_source_gateway: DevopsPlatformGateway,
         dict_args,
         tool,
         config_tool,
     ):
         self.tool_remote = tool_remote
+        self.remote_config_source_gateway = remote_config_source_gateway
         self.dict_args = dict_args
         self.tool = tool
         self.config_tool = config_tool
@@ -26,7 +28,7 @@ class SetInputCore:
         Returns:
             dict: Remote configuration.
         """
-        return self.tool_remote.get_remote_config(
+        return self.remote_config_source_gateway.get_remote_config(
             self.dict_args["remote_config_repo"], file_path, self.dict_args["remote_config_branch"]
         )
 

devsecops_engine_tools/engine_sast/engine_secret/src/infrastructure/entry_points/entry_point_tool.py

@@ -4,13 +4,13 @@ from devsecops_engine_tools.engine_sast.engine_secret.src.domain.usecases.set_in
     SetInputCore,
 )
 
-def engine_secret_scan(devops_platform_gateway, tool_gateway, dict_args, tool, tool_deserealizator, git_gateway, secret_tool):
-    exclusions = devops_platform_gateway.get_remote_config(
+def engine_secret_scan(devops_platform_gateway, remote_config_source_gateway, tool_gateway, dict_args, tool, tool_deserealizator, git_gateway, secret_tool):
+    exclusions = remote_config_source_gateway.get_remote_config(
         dict_args["remote_config_repo"], "engine_sast/engine_secret/Exclusions.json", dict_args["remote_config_branch"]
     )
-    secret_scan = SecretScan(tool_gateway, devops_platform_gateway, tool_deserealizator, git_gateway)
+    secret_scan = SecretScan(tool_gateway, devops_platform_gateway, remote_config_source_gateway, tool_deserealizator, git_gateway)
     config_tool, skip_tool_isp = secret_scan.complete_config_tool(dict_args, tool)
     skip_tool = secret_scan.skip_from_exclusion(exclusions, skip_tool_isp)
     finding_list, file_path_findings = secret_scan.process(skip_tool, config_tool, secret_tool, dict_args, tool)
-    input_core = SetInputCore(devops_platform_gateway, dict_args, tool, config_tool)
+    input_core = SetInputCore(devops_platform_gateway, remote_config_source_gateway, dict_args, tool, config_tool)
     return finding_list, input_core.set_input_core(file_path_findings)

devsecops_engine_tools/engine_sca/engine_container/src/applications/runner_container_scan.py

@@ -18,7 +18,7 @@ from devsecops_engine_tools.engine_sca.engine_container.src.infrastructure.drive
 )
 
 
-def runner_engine_container(dict_args, tool, secret_tool, tool_remote):
+def runner_engine_container(dict_args, tool, secret_tool, tool_remote, remote_config_source_gateway):
     try:
         if tool.lower() == "trivy":
             tool_run = TrivyScan()
@@ -30,6 +30,7 @@ def runner_engine_container(dict_args, tool, secret_tool, tool_remote):
         return init_engine_sca_rm(
             tool_run,
             tool_remote,
+            remote_config_source_gateway,
             tool_images,
             tool_deseralizator,
             dict_args,

devsecops_engine_tools/engine_sca/engine_container/src/domain/model/context_container.py

@@ -1,6 +1,7 @@
 from dataclasses import dataclass
 from typing import List, Optional
 
+
 @dataclass
 class ContextContainer:
     cve_id: str
@@ -20,4 +21,4 @@ class ContextContainer:
     published_date: Optional[str]
     last_modified_date: Optional[str]
     references: Optional[List[str]]
-    source_tool: str
+    source_tool: str

devsecops_engine_tools/engine_sca/engine_container/src/domain/model/gateways/deserealizator_gateway.py

@@ -1,6 +1,8 @@
 from abc import ABCMeta, abstractmethod
 from devsecops_engine_tools.engine_core.src.domain.model.finding import Finding
-from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.context_container import ContextContainer
+from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.context_container import (
+    ContextContainer,
+)
 
 
 class DeseralizatorGateway(metaclass=ABCMeta):
@@ -8,5 +10,8 @@ class DeseralizatorGateway(metaclass=ABCMeta):
     def get_list_findings(self, results_scan_list: list) -> "list[Finding]":
         "Deseralizator"
 
-    def get_container_context_from_results(self, results_scan_list: list) -> "list[ContextContainer]":
+    @abstractmethod
+    def get_container_context_from_results(
+        self, results_scan_list: list
+    ) -> "list[ContextContainer]":
         "Deseralizator"