devsecops-engine-tools 1.6.7__py3-none-any.whl

devsecops_engine_tools/engine_core/src/domain/usecases/break_build.py

@@ -0,0 +1,375 @@
+from dataclasses import dataclass
+from functools import reduce
+
+from devsecops_engine_tools.engine_core.src.domain.model.input_core import InputCore
+from devsecops_engine_tools.engine_core.src.domain.model.finding import (
+    Finding,
+    Category,
+)
+from devsecops_engine_tools.engine_core.src.domain.model.exclusions import Exclusions
+from devsecops_engine_tools.engine_core.src.domain.model.gateway.devops_platform_gateway import (
+    DevopsPlatformGateway,
+)
+from devsecops_engine_tools.engine_core.src.domain.model.gateway.printer_table_gateway import (
+    PrinterTableGateway,
+)
+
+from collections import Counter
+from datetime import timedelta, datetime
+import pytz
+
+
+@dataclass
+class BreakBuild:
+    def __init__(
+        self,
+        devops_platform_gateway: DevopsPlatformGateway,
+        printer_table_gateway: PrinterTableGateway,
+    ):
+        self.devops_platform_gateway = devops_platform_gateway
+        self.printer_table_gateway = printer_table_gateway
+
+    def _apply_policie_exception_new_vulnerability_industry(
+        self, findings_list: "list[Finding]", exclusions: "list[Exclusions]", args: any
+    ):
+        if args["tool"] in ["engine_container", "engine_dependencies"]:
+            date_actual = datetime.now(pytz.utc)
+            for item in findings_list:
+                if item.published_date_cve:
+                    date_initial = datetime.fromisoformat(item.published_date_cve)
+                    date_final = date_initial + timedelta(days=5)
+                    if date_initial <= date_actual <= date_final:
+                        exclusions.append(
+                            Exclusions(
+                                **{
+                                    "id": item.id,
+                                    "where": "all",
+                                    "create_date": date_initial.strftime("%d%m%Y"),
+                                    "expired_date": date_final.strftime("%d%m%Y"),
+                                    "reason": "New vulnerability in the industry",
+                                }
+                            )
+                        )
+
+    def process(self, findings_list: "list[Finding]", input_core: InputCore, args: any):
+        devops_platform_gateway = self.devops_platform_gateway
+        printer_table_gateway = self.printer_table_gateway
+        threshold = input_core.threshold_defined
+        exclusions = input_core.totalized_exclusions
+        custom_message = input_core.custom_message_break_build
+
+        scan_result = {
+            "findings_excluded": [],
+            "vulnerabilities": {},
+            "compliances": {},
+        }
+
+        if len(findings_list) != 0:
+            self._apply_policie_exception_new_vulnerability_industry(
+                findings_list, exclusions, args
+            )
+
+            findings_excluded_list = list(
+                filter(
+                    lambda item: any(
+                        exclusion.id == item.id
+                        and (exclusion.where in item.where or "all" in exclusion.where)
+                        for exclusion in exclusions
+                    ),
+                    findings_list,
+                )
+            )
+
+            scan_result["findings_excluded"] = list(
+                map(
+                    lambda item: {
+                        "id": item.id,
+                        "severity": item.severity,
+                        "category": item.category.value,
+                    },
+                    findings_excluded_list,
+                )
+            )
+
+            findings_without_exclusions_list = list(
+                filter(
+                    lambda v: v not in findings_excluded_list,
+                    findings_list,
+                )
+            )
+
+            vulnerabilities_without_exclusions_list = list(
+                filter(
+                    lambda v: v.category == Category.VULNERABILITY,
+                    findings_without_exclusions_list,
+                )
+            )
+
+            compliances_without_exclusions_list = list(
+                filter(
+                    lambda v: v.category == Category.COMPLIANCE,
+                    findings_without_exclusions_list,
+                )
+            )
+
+            vulnerabilities_critical = reduce(
+                lambda count, vulnerability: (
+                    count + 1 if vulnerability.severity == "critical" else count
+                ),
+                vulnerabilities_without_exclusions_list,
+                0,
+            )
+            vulnerabilities_high = reduce(
+                lambda count, vulnerability: (
+                    count + 1 if vulnerability.severity == "high" else count
+                ),
+                vulnerabilities_without_exclusions_list,
+                0,
+            )
+            vulnerabilities_medium = reduce(
+                lambda count, vulnerability: (
+                    count + 1 if vulnerability.severity == "medium" else count
+                ),
+                vulnerabilities_without_exclusions_list,
+                0,
+            )
+            vulnerabilities_low = reduce(
+                lambda count, vulnerability: (
+                    count + 1 if vulnerability.severity == "low" else count
+                ),
+                vulnerabilities_without_exclusions_list,
+                0,
+            )
+            vulnerabilities_unknown = reduce(
+                lambda count, vulnerability: (
+                    count + 1 if vulnerability.severity == "unknown" else count
+                ),
+                vulnerabilities_without_exclusions_list,
+                0,
+            )
+
+            compliance_critical = reduce(
+                lambda count, compliance: (
+                    count + 1 if compliance.severity == "critical" else count
+                ),
+                compliances_without_exclusions_list,
+                0,
+            )
+            print()
+            if (
+                sum(
+                    [
+                        vulnerabilities_critical,
+                        vulnerabilities_high,
+                        vulnerabilities_medium,
+                        vulnerabilities_low,
+                    ]
+                )
+                == 0
+            ):
+                print(
+                    devops_platform_gateway.message(
+                        "succeeded", "There are no vulnerabilities"
+                    )
+                )
+                print(devops_platform_gateway.result_pipeline("succeeded"))
+            elif (
+                vulnerabilities_critical >= threshold.vulnerability.critical
+                or vulnerabilities_high >= threshold.vulnerability.high
+                or vulnerabilities_medium >= threshold.vulnerability.medium
+                or vulnerabilities_low >= threshold.vulnerability.low
+            ):
+                print("Below are all vulnerabilities detected.")
+                printer_table_gateway.print_table_findings(
+                    vulnerabilities_without_exclusions_list
+                )
+                print(
+                    devops_platform_gateway.message(
+                        "error",
+                        "Security count issues (critical: {0}, high: {1}, medium: {2}, low: {3}) is greater than or equal to failure criteria (critical: {4}, high: {5}, medium: {6}, low:{7}, operator: or)".format(
+                            vulnerabilities_critical,
+                            vulnerabilities_high,
+                            vulnerabilities_medium,
+                            vulnerabilities_low,
+                            threshold.vulnerability.critical,
+                            threshold.vulnerability.high,
+                            threshold.vulnerability.medium,
+                            threshold.vulnerability.low,
+                        ),
+                    )
+                )
+                print(devops_platform_gateway.result_pipeline("failed"))
+
+                scan_result["vulnerabilities"] = {
+                    "threshold": {
+                        "critical": vulnerabilities_critical,
+                        "high": vulnerabilities_high,
+                        "medium": vulnerabilities_medium,
+                        "low": vulnerabilities_low,
+                    },
+                    "status": "failed",
+                    "found": list(
+                        map(
+                            lambda item: {
+                                "id": item.id,
+                                "severity": item.severity,
+                            },
+                            vulnerabilities_without_exclusions_list,
+                        )
+                    ),
+                }
+            else:
+                print("Below are all vulnerabilities detected.")
+                printer_table_gateway.print_table_findings(
+                    vulnerabilities_without_exclusions_list
+                )
+                print(
+                    devops_platform_gateway.message(
+                        "warning",
+                        "Security count issues (critical: {0}, high: {1}, medium: {2}, low: {3}) is not greater than or equal to failure criteria (critical: {4}, high: {5}, medium: {6}, low:{7}, operator: or)".format(
+                            vulnerabilities_critical,
+                            vulnerabilities_high,
+                            vulnerabilities_medium,
+                            vulnerabilities_low,
+                            threshold.vulnerability.critical,
+                            threshold.vulnerability.high,
+                            threshold.vulnerability.medium,
+                            threshold.vulnerability.low,
+                        ),
+                    )
+                )
+                
+                if devops_platform_gateway.get_variable("stage") == "build":
+                    print(devops_platform_gateway.result_pipeline("succeeded_with_issues"))
+                else:
+                    print(devops_platform_gateway.result_pipeline("succeeded"))
+
+                scan_result["vulnerabilities"] = {
+                    "threshold": {
+                        "critical": vulnerabilities_critical,
+                        "high": vulnerabilities_high,
+                        "medium": vulnerabilities_medium,
+                        "low": vulnerabilities_low,
+                    },
+                    "status": "succeeded",
+                    "found": list(
+                        map(
+                            lambda item: {
+                                "id": item.id,
+                                "severity": item.severity,
+                            },
+                            vulnerabilities_without_exclusions_list,
+                        )
+                    ),
+                }
+
+            ids_vulnerabilitites = list(
+                map(lambda x: x.id, vulnerabilities_without_exclusions_list)
+            )
+            ids_match = list(filter(lambda x: x in ids_vulnerabilitites, threshold.cve))
+            if len(ids_match) > 0:
+                print(
+                    devops_platform_gateway.message(
+                        "error",
+                        "Scan Failed due to vulnerability policy violations: CVEs Vulnerabilities: {0}".format(
+                            ",".join(ids_match)
+                        ),
+                    )
+                )
+                print(devops_platform_gateway.result_pipeline("failed"))
+
+            print()
+            if len(compliances_without_exclusions_list) > 0:
+                print("Below are all compliances issues detected.")
+                printer_table_gateway.print_table_findings(
+                    compliances_without_exclusions_list
+                )
+                status = "succeeded"
+                if compliance_critical >= threshold.compliance.critical:
+                    print(
+                        devops_platform_gateway.message(
+                            "error",
+                            "Compliance issues count (critical: {0}) is greater than or equal to failure criteria (critical: {1})".format(
+                                compliance_critical, threshold.compliance.critical
+                            ),
+                        )
+                    )
+                    print(devops_platform_gateway.result_pipeline("failed"))
+                    status = "failed"
+                scan_result["compliances"] = {
+                    "threshold": {"critical": compliance_critical},
+                    "status": status,
+                    "found": list(
+                        map(
+                            lambda item: {
+                                "id": item.id,
+                                "severity": item.severity,
+                            },
+                            compliances_without_exclusions_list,
+                        )
+                    ),
+                }
+            else:
+                print(
+                    devops_platform_gateway.message(
+                        "succeeded", "There are no compliances issues"
+                    )
+                )
+                print(devops_platform_gateway.result_pipeline("succeeded"))
+            print()
+            if len(findings_excluded_list) > 0:
+                exclusions_list = list(
+                    map(
+                        lambda item: {
+                            "severity": item.severity,
+                            "id": item.id,
+                            "where": item.where,
+                            "create_date": next(
+                                (
+                                    elem.create_date
+                                    for elem in exclusions
+                                    if elem.id == item.id
+                                ),
+                                None,
+                            ),
+                            "expired_date": next(
+                                (
+                                    elem.expired_date
+                                    for elem in exclusions
+                                    if elem.id == item.id
+                                ),
+                                None,
+                            ),
+                            "reason": next(
+                                (
+                                    elem.reason
+                                    for elem in exclusions
+                                    if elem.id == item.id
+                                ),
+                                None,
+                            ),
+                        },
+                        findings_excluded_list,
+                    )
+                )
+                print(
+                    devops_platform_gateway.message(
+                        "warning", "Bellow are all findings that were excepted."
+                    )
+                )
+                printer_table_gateway.print_table_exclusions(exclusions_list)
+                for reason, total in Counter(
+                    map(lambda x: x["reason"], exclusions_list)
+                ).items():
+                    print("{0} findings count: {1}".format(reason, total))
+        else:
+            print(devops_platform_gateway.message("succeeded", "There are no findings"))
+            print(devops_platform_gateway.result_pipeline("succeeded"))
+        print()
+        print(
+            devops_platform_gateway.message(
+                "info",
+                custom_message,
+            )
+        )
+        return scan_result

devsecops_engine_tools/engine_core/src/domain/usecases/handle_scan.py

@@ -0,0 +1,148 @@
+from devsecops_engine_tools.engine_sast.engine_iac.src.applications.runner_iac_scan import (
+    runner_engine_iac,
+)
+from devsecops_engine_tools.engine_sast.engine_secret.src.applications.runner_secret_scan import (
+    runner_secret_scan,
+)
+from devsecops_engine_tools.engine_core.src.domain.model.gateway.vulnerability_management_gateway import (
+    VulnerabilityManagementGateway,
+)
+from devsecops_engine_tools.engine_core.src.domain.model.gateway.secrets_manager_gateway import (
+    SecretsManagerGateway,
+)
+from devsecops_engine_tools.engine_core.src.domain.model.gateway.devops_platform_gateway import (
+    DevopsPlatformGateway,
+)
+from devsecops_engine_tools.engine_core.src.domain.model.vulnerability_management import (
+    VulnerabilityManagement,
+)
+from devsecops_engine_tools.engine_core.src.domain.model.customs_exceptions import (
+    ExceptionVulnerabilityManagement,
+    ExceptionFindingsExcepted,
+)
+from devsecops_engine_tools.engine_sca.engine_container.src.applications.runner_container_scan import (
+    runner_engine_container,
+)
+from devsecops_engine_tools.engine_sca.engine_dependencies.src.applications.runner_dependencies_scan import (
+    runner_engine_dependencies,
+)
+from devsecops_engine_tools.engine_core.src.infrastructure.helpers.util import (
+    define_env,
+)
+
+from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
+from devsecops_engine_tools.engine_utilities import settings
+
+logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
+
+MESSAGE_ENABLED = "not yet enabled"
+
+
+class HandleScan:
+    def __init__(
+        self,
+        vulnerability_management: VulnerabilityManagementGateway,
+        secrets_manager_gateway: SecretsManagerGateway,
+        devops_platform_gateway: DevopsPlatformGateway,
+    ):
+        self.vulnerability_management = vulnerability_management
+        self.secrets_manager_gateway = secrets_manager_gateway
+        self.devops_platform_gateway = devops_platform_gateway
+
+    def _use_vulnerability_management(
+        self, config_tool, input_core, dict_args, secret_tool, env
+    ):
+        try:
+            self.vulnerability_management.send_vulnerability_management(
+                VulnerabilityManagement(
+                    config_tool[dict_args["tool"].upper()]["TOOL"],
+                    input_core,
+                    dict_args,
+                    secret_tool,
+                    config_tool,
+                    self.devops_platform_gateway.get_source_code_management_uri(),
+                    self.devops_platform_gateway.get_base_compact_remote_config_url(
+                        dict_args["remote_config_repo"]
+                    ),
+                    self.devops_platform_gateway.get_variable("access_token"),
+                    self.devops_platform_gateway.get_variable("build_execution_id"),
+                    self.devops_platform_gateway.get_variable("build_id"),
+                    self.devops_platform_gateway.get_variable("branch_tag"),
+                    self.devops_platform_gateway.get_variable("commit_hash"),
+                    env
+                )
+            )
+        except ExceptionVulnerabilityManagement as ex1:
+            logger.error(str(ex1))
+        try:
+            input_core.totalized_exclusions.extend(
+                self.vulnerability_management.get_findings_excepted(
+                    input_core.scope_pipeline,
+                    dict_args,
+                    secret_tool,
+                    config_tool,
+                )
+            )
+        except ExceptionFindingsExcepted as ex2:
+            logger.error(str(ex2))
+
+    def process(self, dict_args: any, config_tool: any):
+        secret_tool = None
+        env = define_env(
+                    self.devops_platform_gateway.get_variable("environment"),
+                    self.devops_platform_gateway.get_variable("branch_name"),
+                )
+        if dict_args["use_secrets_manager"] == "true":
+            secret_tool = self.secrets_manager_gateway.get_secret(config_tool)
+        if "engine_iac" in dict_args["tool"]:
+            findings_list, input_core = runner_engine_iac(
+                dict_args, config_tool["ENGINE_IAC"]["TOOL"], secret_tool,self.devops_platform_gateway, env
+            )
+            if dict_args["use_vulnerability_management"] == "true":
+                self._use_vulnerability_management(
+                    config_tool, input_core, dict_args, secret_tool, env
+                )
+            return findings_list, input_core
+        elif "engine_container" in dict_args["tool"]:
+            secret_sca = ""
+            if secret_tool is not None:
+                secret_sca = secret_tool["token_prisma_cloud"]
+            else:
+                secret_sca = dict_args["token_engine_container"]
+            findings_list, input_core = runner_engine_container(
+                dict_args, config_tool, secret_sca, self.devops_platform_gateway
+            )
+            if (
+                dict_args["use_vulnerability_management"] == "true"
+                and input_core.path_file_results
+            ):
+                self._use_vulnerability_management(
+                    config_tool, input_core, dict_args, secret_tool, env
+                )
+            return findings_list, input_core
+        elif "engine_dast" in dict_args["tool"]:
+            print(MESSAGE_ENABLED)
+        elif "engine_secret" in dict_args["tool"]:
+            findings_list, input_core = runner_secret_scan(
+                dict_args,
+                config_tool["ENGINE_SECRET"]["TOOL"],
+                self.devops_platform_gateway
+            )
+            return findings_list, input_core
+        elif "engine_dependencies" in dict_args["tool"]:
+            if secret_tool is not None:
+                secret_sca = secret_tool["token_xray"]
+            else:
+                secret_sca = dict_args["token_engine_dependencies"]
+            findings_list, input_core = runner_engine_dependencies(
+                dict_args, config_tool, secret_sca, self.devops_platform_gateway
+            )
+
+            if (
+                dict_args["use_vulnerability_management"] == "true"
+                and input_core.path_file_results
+            ):
+                self._use_vulnerability_management(
+                    config_tool, input_core, dict_args, secret_tool, env
+                )
+            return findings_list, input_core

devsecops_engine_tools/engine_core/src/domain/usecases/metrics_manager.py

@@ -0,0 +1,59 @@
+from devsecops_engine_tools.engine_core.src.domain.model.gateway.devops_platform_gateway import (
+    DevopsPlatformGateway,
+)
+from devsecops_engine_tools.engine_core.src.domain.model.gateway.metrics_manager_gateway import (
+    MetricsManagerGateway,
+)
+from devsecops_engine_tools.engine_core.src.domain.model.input_core import InputCore
+from devsecops_engine_tools.engine_utilities.utils.logger_info import log_records
+from devsecops_engine_tools.engine_core.src.infrastructure.helpers.util import (
+    define_env,
+)
+import datetime
+import json
+import os
+
+
+class MetricsManager:
+    def __init__(
+        self,
+        devops_platform_gateway: DevopsPlatformGateway,
+        metrics_manager_gateway: MetricsManagerGateway,
+    ):
+        self.devops_platform_gateway = devops_platform_gateway
+        self.metrics_manager_gateway = metrics_manager_gateway
+
+    def process(
+        self, config_tool: any, input_core: InputCore, dict_args: any, scan_result: any
+    ):
+        execution_id = self.devops_platform_gateway.get_variable("release_id") if input_core.stage_pipeline == "Release" else self.devops_platform_gateway.get_variable("build_execution_id")
+        scope_pipeline = input_core.scope_pipeline
+        base_directory = os.path.expanduser("/tmp/log_engine_tools")
+        file_path = f"{base_directory}/{scope_pipeline}.json"
+        base_directory_path = os.path.expanduser(base_directory)
+        if not os.path.exists(base_directory_path):
+            os.makedirs(base_directory_path)
+        else:
+            if os.path.exists(file_path):
+                os.remove(file_path)
+        with open(
+            file_path,
+            "x",
+        ) as file:
+            body = {
+                "id": execution_id,
+                "date": datetime.datetime.now().strftime("%Y-%m-%d"),
+                "component": scope_pipeline,
+                "stage": input_core.stage_pipeline,
+                "check_type": dict_args["tool"],
+                "environment": define_env(
+                    self.devops_platform_gateway.get_variable("environment"),
+                    self.devops_platform_gateway.get_variable("branch_name"),
+                ),
+                "events": log_records,
+                "scan_result": scan_result
+            }
+            json.dump(body, file)
+        self.metrics_manager_gateway.send_metrics(
+            config_tool, dict_args["tool"], file_path
+        )

devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/aws/s3_manager.py

@@ -0,0 +1,52 @@
+from devsecops_engine_tools.engine_core.src.domain.model.gateway.metrics_manager_gateway import (
+    MetricsManagerGateway,
+)
+from devsecops_engine_tools.engine_core.src.infrastructure.helpers.aws import (
+    assume_role,
+)
+import boto3
+import logging
+import datetime
+
+boto3.set_stream_logger(name="botocore.credentials", level=logging.WARNING)
+
+
+class S3Manager(MetricsManagerGateway):
+
+    def _get_s3_data(self, client, bucket, path):
+        try:
+            response = client.get_object(
+                Bucket=bucket,
+                Key=path,
+            )
+            return response["Body"].read().decode("utf-8")
+        except client.exceptions.NoSuchKey:
+            return ""
+
+    def send_metrics(self, config_tool, tool, file_path):
+        temp_credentials = assume_role(
+            config_tool["METRICS_MANAGER"]["AWS"]["ROLE_ARN"]
+        )
+        session = boto3.session.Session()
+        client = session.client(
+            service_name="s3",
+            region_name=config_tool["METRICS_MANAGER"]["AWS"]["REGION_NAME"],
+            aws_access_key_id=temp_credentials["AccessKeyId"],
+            aws_secret_access_key=temp_credentials["SecretAccessKey"],
+            aws_session_token=temp_credentials["SessionToken"],
+        )
+        date = datetime.datetime.now()
+        path_bucket = f'{tool}/{date.strftime("%Y")}/{date.strftime("%m")}/{date.strftime("%d")}/{file_path.split("/")[-1]}'
+
+        data = self._get_s3_data(
+            client, config_tool["METRICS_MANAGER"]["AWS"]["BUCKET"], path_bucket
+        )
+
+        with open(file_path, "rb") as new_data:
+            new_data_content = new_data.read().decode("utf-8")
+            data = data + "\n" + new_data_content if data else new_data_content
+            client.put_object(
+                Bucket=config_tool["METRICS_MANAGER"]["AWS"]["BUCKET"],
+                Key=path_bucket,
+                Body=data,
+            )

devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/aws/secrets_manager.py

@@ -0,0 +1,40 @@
+from dataclasses import dataclass
+from devsecops_engine_tools.engine_core.src.domain.model.gateway.secrets_manager_gateway import (
+    SecretsManagerGateway,
+)
+from devsecops_engine_tools.engine_core.src.infrastructure.helpers.aws import (
+    assume_role
+)
+import boto3
+import json
+from botocore.exceptions import NoCredentialsError
+import logging
+from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
+from devsecops_engine_tools.engine_utilities import settings
+
+boto3.set_stream_logger(name="botocore.credentials", level=logging.WARNING)
+logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
+
+
+@dataclass
+class SecretsManager(SecretsManagerGateway):
+    def get_secret(self, config_tool):
+        temp_credentials = assume_role(config_tool["SECRET_MANAGER"]["AWS"]["ROLE_ARN"])
+        session = boto3.session.Session()
+        client = session.client(
+            service_name="secretsmanager",
+            region_name=config_tool["SECRET_MANAGER"]["AWS"]["REGION_NAME"],
+            aws_access_key_id=temp_credentials["AccessKeyId"],
+            aws_secret_access_key=temp_credentials["SecretAccessKey"],
+            aws_session_token=temp_credentials["SessionToken"],
+        )
+
+        try:
+            secret_name = config_tool["SECRET_MANAGER"]["AWS"]["SECRET_NAME"]
+            get_secret_value_response = client.get_secret_value(SecretId=secret_name)
+            secret = get_secret_value_response["SecretString"]
+            secret_dict = json.loads(secret)
+            return secret_dict
+        except NoCredentialsError as e:
+            logger.error("Error getting secret: {e}")
+            return None