devsecops-engine-tools 1.6.7__py3-none-any.whl

devsecops_engine_tools/engine_sca/engine_container/src/domain/usecases/handle_remote_config_patterns.py

@@ -0,0 +1,67 @@
+import re
+from devsecops_engine_tools.engine_core.src.domain.model.gateway.devops_platform_gateway import (
+    DevopsPlatformGateway,
+)
+
+
+class HandleRemoteConfigPatterns:
+    def __init__(
+        self,
+        tool_remote: DevopsPlatformGateway,
+        dict_args,
+    ):
+        self.tool_remote = tool_remote
+        self.dict_args = dict_args
+
+    def get_remote_config(self, file_path):
+        """
+        Get remote configuration
+        Return: dict: Remote configuration
+        """
+        return self.tool_remote.get_remote_config(
+            self.dict_args["remote_config_repo"], file_path
+        )
+
+    def get_variable(self, variable):
+        """
+        Get variable.
+
+        Returns:
+            dict: Remote variable.
+        """
+        return self.tool_remote.get_variable(variable)
+    
+    def ignore_analysis_pattern(self):
+        """
+        Handle analysis pattern.
+        Return: bool: False -> not scan, True -> scan.
+        """
+        ignore = self.get_remote_config("SCA/CONTAINER/ConfigTool.json")["IGNORE_SEARCH_PATTERN"]
+        if re.match(ignore, self.get_variable("release_name"), re.IGNORECASE):
+            return False
+        else:
+            return True
+    
+    def handle_skip_tool(self, exclusions, pipeline_name):
+        """
+        Handle skip tool.
+
+        Return: bool: True -> skip tool, False -> not skip tool.
+        """
+        if (pipeline_name in exclusions) and (
+            exclusions[pipeline_name].get("SKIP_TOOL", 0)
+        ):
+            return True
+        else:
+            return False
+
+    def process_handle_skip_tool(self):
+        """
+        Process handle skip tool.
+
+        Return: bool: True -> skip tool, False -> not skip tool.
+        """
+        return self.handle_skip_tool(
+            self.get_remote_config("engine_sca/engine_container/Exclusions.json"),
+            self.get_variable("pipeline_name"),
+        )

devsecops_engine_tools/engine_sca/engine_container/src/domain/usecases/set_input_core.py

@@ -0,0 +1,76 @@
+from devsecops_engine_tools.engine_core.src.domain.model.input_core import InputCore
+from devsecops_engine_tools.engine_core.src.domain.model.threshold import Threshold
+from devsecops_engine_tools.engine_core.src.domain.model.gateway.devops_platform_gateway import (
+    DevopsPlatformGateway,
+)
+
+from devsecops_engine_tools.engine_core.src.domain.model.exclusions import Exclusions
+
+
+class SetInputCore:
+    def __init__(self, tool_remote: DevopsPlatformGateway, dict_args, config_tool):
+        self.tool_remote = tool_remote
+        self.dict_args = dict_args
+        self.config_tool = config_tool
+
+    def get_remote_config(self, file_path):
+        """
+        Get remote configuration.
+
+        Returns:
+            dict: Remote configuration.
+        """
+        return self.tool_remote.get_remote_config(self.dict_args["remote_config_repo"], file_path)
+
+    def get_variable(self, variable):
+        """
+        Get variable.
+
+        Returns:
+            dict: Remote variable.
+        """
+        return self.tool_remote.get_variable(variable)
+
+    def get_exclusions(self, exclusions_data, pipeline_name, config_tool):
+        list_exclusions = []
+        for key, value in exclusions_data.items():
+            if (key == "All") or (key == pipeline_name):
+                exclusions = [
+                    Exclusions(
+                        id=item.get("id", ""),
+                        where=item.get("where", ""),
+                        cve_id=item.get("cve_id", ""),
+                        create_date=item.get("create_date", ""),
+                        expired_date=item.get("expired_date", ""),
+                        severity=item.get("severity", ""),
+                        hu=item.get("hu", ""),
+                        reason=item.get("reason", "Risk acceptance"),
+                    )
+                    for item in value[config_tool["ENGINE_CONTAINER"]["TOOL"]]
+                ]
+                list_exclusions.extend(exclusions)
+        return list_exclusions
+
+    def set_input_core(self, images_scanned):
+        """
+        Set the input core.
+
+        Returns:
+            dict: Input core.
+        """
+        return InputCore(
+            self.get_exclusions(
+                self.get_remote_config("engine_sca/engine_container/Exclusions.json"),
+                self.get_variable("pipeline_name"),
+                self.config_tool,
+            ),
+            Threshold(
+                self.get_remote_config("engine_sca/engine_container/ConfigTool.json")["THRESHOLD"]
+            ),
+            images_scanned[-1] if images_scanned else None,
+            self.get_remote_config("engine_sca/engine_container/ConfigTool.json")[
+                "MESSAGE_INFO_ENGINE_CONTAINER"
+            ],
+            self.get_variable("pipeline_name"),
+            self.get_variable("stage").capitalize(),
+        )

devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/docker/docker_images.py

@@ -0,0 +1,22 @@
+import subprocess
+from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.gateways.images_gateway import (
+    ImagesGateway,
+)
+import docker
+
+
+class DockerImages(ImagesGateway):
+    def list_images(self):
+        try:
+            client = docker.from_env()
+            images = client.images.list()
+            images_sorted = sorted(
+                images, key=lambda x: x.attrs["Created"], reverse=True
+            )
+            latest_image = images_sorted[0]
+            print("ID last image:", latest_image.id)
+            print("Tag last image:", latest_image.tags)
+            print("Created date last image:", latest_image.attrs["Created"])
+            return latest_image
+        except subprocess.CalledProcessError as e:
+            raise ValueError(f"Error listing images:{e.stderr}")

devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/prisma_cloud/prisma_cloud_manager_scan.py

@@ -0,0 +1,123 @@
+import stat
+import requests
+import os
+import subprocess
+import logging
+import re
+import base64
+from devsecops_engine_tools.engine_sca.engine_container.src.infrastructure.helpers.images_scanned import (
+    ImagesScanned,
+)
+from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.gateways.tool_gateway import (
+    ToolGateway,
+)
+from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
+from devsecops_engine_tools.engine_utilities import settings
+
+logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
+
+
+class PrismaCloudManagerScan(ToolGateway):
+    def download_twistcli(
+        self,
+        file_path,
+        prisma_access_key,
+        prisma_secret_key,
+        prisma_console_url,
+        prisma_api_version,
+    ):
+        url = f"{prisma_console_url}/api/{prisma_api_version}/util/twistcli"
+        credentials = base64.b64encode(
+            f"{prisma_access_key}:{prisma_secret_key}".encode()
+        ).decode()
+        headers = {"Authorization": f"Basic {credentials}"}
+        try:
+            response = requests.get(url, headers=headers)
+            response.raise_for_status()
+
+            with open(file_path, "wb") as file:
+                file.write(response.content)
+
+            os.chmod(file_path, stat.S_IRWXU)
+            logging.info(f"twistcli downloaded and saved to: {file_path}")
+            return 0
+
+        except Exception as e:
+            raise ValueError(f"Error downloading twistcli: {e}")
+
+    def scan_image(self, file_path, image, remoteconfig, prisma_secret_key, build_id):
+        file_name = "scanned_images.txt"
+        image_name = f"{image.tags[0]}"
+        result_file = f"{image_name}" + "_scan_result.json"
+        images_scanned = []
+
+        if (result_file) in ImagesScanned.get_images_already_scanned(file_name):
+            print(f"The image {image_name} has already been scanned previously.")
+        else:
+            if build_id in image_name:
+                command = (
+                    file_path,
+                    "images",
+                    "scan",
+                    "--address",
+                    remoteconfig["PRISMA_CLOUD"]["PRISMA_CONSOLE_URL"],
+                    "--user",
+                    remoteconfig["PRISMA_CLOUD"]["PRISMA_ACCESS_KEY"],
+                    "--password",
+                    prisma_secret_key,
+                    "--output-file",
+                    result_file,
+                    "--details",
+                    image_name,
+                )
+                try:
+                    subprocess.run(
+                        command,
+                        check=True,
+                        stdout=subprocess.PIPE,
+                        stderr=subprocess.PIPE,
+                        text=True,
+                    )
+                    images_scanned.append(result_file)
+                    print(f"The image {image_name} was scanned")
+                    with open(file_name, "a") as file:
+                        file.write(result_file + "\n")
+                except subprocess.CalledProcessError as e:
+                    logger.error(f"Error during image scan of {image_name}: {e.stderr}")
+
+        return images_scanned
+
+    def run_tool_container_sca(
+        self, remoteconfig, prisma_secret_key, image, build_id, skip_flag
+    ):
+        images_scanned = []
+        if not (skip_flag):
+            try:
+                file_path = os.path.join(
+                    os.getcwd(), remoteconfig["PRISMA_CLOUD"]["TWISTCLI_PATH"]
+                )
+
+                if not os.path.exists(file_path):
+                    self.download_twistcli(
+                        file_path,
+                        remoteconfig["PRISMA_CLOUD"]["PRISMA_ACCESS_KEY"],
+                        prisma_secret_key,
+                        remoteconfig["PRISMA_CLOUD"]["PRISMA_CONSOLE_URL"],
+                        remoteconfig["PRISMA_CLOUD"]["PRISMA_API_VERSION"],
+                    )
+                images_scanned.extend(
+                    self.scan_image(
+                        file_path,
+                        image,
+                        remoteconfig,
+                        prisma_secret_key,
+                        build_id,
+                    )
+                )
+
+                return images_scanned
+
+            except Exception as ex:
+                logger.error(f"An overall error occurred: {ex}")
+
+        return images_scanned

devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/prisma_cloud/prisma_deserialize_output.py

@@ -0,0 +1,62 @@
+from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.gateways.deserealizator_gateway import (
+    DeseralizatorGateway,
+)
+from devsecops_engine_tools.engine_core.src.domain.model.finding import (
+    Finding,
+    Category,
+)
+from datetime import datetime
+from dataclasses import dataclass
+import json
+
+
+@dataclass
+class PrismaDeserealizator(DeseralizatorGateway):
+    def get_list_findings(self, images_scanned: list) -> "list[Finding]":
+        list_open_vulnerabilities = []
+        SEVERITY_MAP = {
+            "unimportant": "low",
+            "unassigned": "low",
+            "negligible": "low",
+            "not yet assigned": "low",
+            "low": "low",
+            "medium": "medium",
+            "moderate": "medium",
+            "high": "high",
+            "important": "high",
+            "critical": "critical",
+        }
+        for image in images_scanned:
+            with open(image, "rb") as file:
+                image_object = file.read()
+
+                json_data = json.loads(image_object)
+
+                vulnerabilities_data = json_data["results"][0]["vulnerabilities"]
+
+                # Create a list of findings instances from the JSON data
+                vulnerabilities = [
+                    Finding(
+                        id=vul.get("id", ""),
+                        cvss=float(vul.get("cvss", 0.0)),
+                        where=vul.get("packageName", "")
+                        + ":"
+                        + vul.get("packageVersion", ""),
+                        description=vul.get("description", "")[:150],
+                        severity=SEVERITY_MAP.get(vul.get("severity", ""), ""),
+                        identification_date=datetime.strptime(
+                            vul.get("discoveredDate", ""), "%Y-%m-%dT%H:%M:%S%z"
+                        ),
+                        published_date_cve=vul.get("publishedDate", None),
+                        module="engine_container",
+                        category=Category.VULNERABILITY,
+                        requirements=vul.get("status", ""),
+                        tool="PrismaCloud",
+                    )
+                    for vul in vulnerabilities_data
+                ]
+
+                # Add the Vulnerability instances to the list
+                list_open_vulnerabilities.extend(vulnerabilities)
+
+        return list_open_vulnerabilities

devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/trivy_tool/trivy_deserialize_output.py

@@ -0,0 +1,48 @@
+from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.gateways.deserealizator_gateway import (
+    DeseralizatorGateway,
+)
+from devsecops_engine_tools.engine_core.src.domain.model.finding import (
+    Finding,
+    Category,
+)
+from dataclasses import dataclass
+import json
+from datetime import datetime
+
+@dataclass
+class TrivyDeserializator(DeseralizatorGateway):
+    def get_list_findings(self, images_scanned: list) -> "list[Finding]":
+        list_open_vulnerabilities = []
+        for image in images_scanned:
+            with open(image, "rb") as file:
+                image_object = file.read()
+                json_data = json.loads(image_object)
+                vulnerabilities_data = json_data["Results"][0]["Vulnerabilities"]
+                vulnerabilities = [
+                    Finding(
+                        id=vul.get("VulnerabilityID", ""),
+                        cvss=next(
+                            (
+                                v["V3Score"]
+                                for v in vul["CVSS"].values()
+                                if "V3Score" in v
+                            ),
+                            None,
+                        ),
+                        where=vul.get("PkgName", "")
+                        + " "
+                        + vul.get("InstalledVersion", ""),
+                        description=vul.get("Description", "").replace("\n", ""),
+                        severity=vul.get("Severity", "").lower(),
+                        identification_date=datetime.now().strftime("%d-%m-%Y %H:%M:%S"),
+                        published_date_cve=vul.get("PublishedDate", ""),
+                        module="engine_container",
+                        category=Category.VULNERABILITY,
+                        requirements=vul.get("FixedVersion") or vul.get("Status", ""),
+                        tool="Trivy",
+                    )
+                    for vul in vulnerabilities_data
+                    if "CVSS" in vul
+                ]
+                list_open_vulnerabilities.extend(vulnerabilities)
+        return list_open_vulnerabilities

devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/trivy_tool/trivy_manager_scan.py

@@ -0,0 +1,114 @@
+import subprocess
+import re
+
+from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.gateways.tool_gateway import (
+    ToolGateway,
+)
+
+from devsecops_engine_tools.engine_sca.engine_container.src.infrastructure.helpers.images_scanned import (
+    ImagesScanned,
+)
+
+from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
+from devsecops_engine_tools.engine_utilities import settings
+
+logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
+
+
+class TrivyScan(ToolGateway):
+    def install_tool(self, version):
+        installed = subprocess.run(
+            ["which", "trivy"],
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+        )
+        if installed.returncode == 1:
+            try:
+                command1 = [
+                    "wget",
+                    "https://github.com/aquasecurity/trivy/releases/download/v"
+                    + version
+                    + "/trivy_"
+                    + version
+                    + "_Linux-64bit.deb",
+                ]
+                subprocess.run(
+                    command1, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE
+                )
+                command2 = [
+                    "sudo",
+                    "dpkg",
+                    "-i",
+                    "trivy_" + version + "_Linux-64bit.deb",
+                ]
+                subprocess.run(
+                    command2, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE
+                )
+            except subprocess.CalledProcessError as error:
+                raise RuntimeError(f"Error al instalar trivy: {error}")
+
+    def scan_image(self, repository, tag, remoteconfig, release):
+        file_name = "scanned_images.txt"
+        repo = repository.split("/")[1] if len(repository.split("/")) >= 2 else ""
+        image_name = f"{repository}:{tag}"
+        result_file = f"{repo}:{tag}" + "_scan_result.json"
+        images_scanned = []
+
+        if not ((result_file) in ImagesScanned.get_images_already_scanned(file_name)):
+            pattern = remoteconfig["REGEX_EXPRESSION_PROJECTS"]
+            match = re.match(pattern, repo.upper())
+            if match:
+                if match.group() in release.upper():
+                    command1 = ["trivy", "image", "--download-db-only"]
+                    command2 = [
+                        "trivy",
+                        "--scanners",
+                        "vuln",
+                        "-f",
+                        "json",
+                        "-o",
+                        result_file,
+                    ]
+                    command2.extend(["--quiet", "image", image_name])
+                    try:
+                        subprocess.run(
+                            command1,
+                            check=True,
+                            stdout=subprocess.PIPE,
+                            stderr=subprocess.PIPE,
+                        )
+                        subprocess.run(
+                            command2,
+                            check=True,
+                            stdout=subprocess.PIPE,
+                            stderr=subprocess.PIPE,
+                            text=True,
+                        )
+                        images_scanned.append(result_file)
+                        with open(file_name, "a") as file:
+                            file.write(result_file + "\n")
+                    except subprocess.CalledProcessError as e:
+                        logger.error(
+                            f"Error during image scan of {repository}: {e.stderr}"
+                        )
+
+        return images_scanned
+
+    def run_tool_container_sca(self, remoteconfig, token, scan_image, release):
+        try:
+            trivy_version = remoteconfig["TRIVY"]["TRIVY_VERSION"]
+            self.install_tool(trivy_version)
+            images_scanned = []
+
+            for image in scan_image:
+                repository, tag = image["Repository"], image["Tag"]
+                images_scanned.extend(
+                    self.scan_image(repository, tag, remoteconfig, release)
+                )
+
+            return images_scanned
+
+        except Exception as ex:
+            logger.error(f"An overall error occurred: {ex}")
+
+        return 0

devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/entry_points/entry_point_tool.py

@@ -0,0 +1,40 @@
+from devsecops_engine_tools.engine_sca.engine_container.src.domain.usecases.container_sca_scan import (
+    ContainerScaScan,
+)
+from devsecops_engine_tools.engine_sca.engine_container.src.domain.usecases.handle_remote_config_patterns import (
+    HandleRemoteConfigPatterns,
+)
+from devsecops_engine_tools.engine_sca.engine_container.src.domain.usecases.set_input_core import (
+    SetInputCore,
+)
+
+
+def init_engine_sca_rm(
+    tool_run,
+    tool_remote,
+    tool_images,
+    tool_deseralizator,
+    dict_args,
+    token,
+    config_tool,
+):
+    handle_remote_config_patterns = HandleRemoteConfigPatterns(tool_remote, dict_args)
+    flag = handle_remote_config_patterns.ignore_analysis_pattern()
+    images_scanned = []
+    deseralized = []
+    if flag:
+        container_sca_scan = ContainerScaScan(
+            tool_run,
+            tool_remote,
+            tool_images,
+            tool_deseralizator,
+            dict_args,
+            token,
+            handle_remote_config_patterns.process_handle_skip_tool(),
+        )
+        images_scanned = container_sca_scan.process()
+        deseralized = container_sca_scan.deseralizator(images_scanned)
+    input_core = SetInputCore(tool_remote, dict_args, config_tool)
+    
+    return deseralized, input_core.set_input_core(images_scanned
+    )

devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/helpers/images_scanned.py

@@ -0,0 +1,16 @@
+import os
+
+
+class ImagesScanned:
+    @staticmethod
+    def get_images_already_scanned(file_name):
+        """
+        Create images scanned file if it does not exist and get the images that have already been scanned.
+        """
+        scanned_images_file = os.path.join(os.getcwd(), file_name)
+        # Check if the file exists; if not, create it
+        if not os.path.exists(scanned_images_file):
+            open(scanned_images_file, "w").close()
+        with open(scanned_images_file, "r") as file:
+            images_scanned = file.read().splitlines()
+        return images_scanned

devsecops_engine_tools/engine_sca/engine_dependencies/src/applications/runner_dependencies_scan.py

@@ -0,0 +1,32 @@
+from devsecops_engine_tools.engine_sca.engine_dependencies.src.infrastructure.driven_adapters.xray_tool.xray_manager_scan import (
+    XrayScan,
+)
+from devsecops_engine_tools.engine_sca.engine_dependencies.src.infrastructure.driven_adapters.xray_tool.xray_deserialize_output import (
+    XrayDeserializator,
+)
+from devsecops_engine_tools.engine_sca.engine_dependencies.src.infrastructure.entry_points.entry_point_tool import (
+    init_engine_dependencies,
+)
+
+
+def runner_engine_dependencies(dict_args, config_tool, token, devops_platform_gateway):
+    try:
+        if config_tool["ENGINE_DEPENDENCIES"]["TOOL"] == "XRAY":
+            tool_run = XrayScan()
+            tool_deserializator = XrayDeserializator()
+
+        return init_engine_dependencies(
+            tool_run,
+            devops_platform_gateway,
+            tool_deserializator,
+            dict_args,
+            token,
+            config_tool["ENGINE_DEPENDENCIES"]["TOOL"],
+        )
+
+    except Exception as e:
+        raise Exception(f"Error SCAN engine dependencies : {str(e)}")
+
+
+if __name__ == "__main__":
+    runner_engine_dependencies()

devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/model/gateways/deserializator_gateway.py

@@ -0,0 +1,8 @@
+from abc import ABCMeta, abstractmethod
+from devsecops_engine_tools.engine_core.src.domain.model.finding import Finding
+
+
+class DeserializatorGateway(metaclass=ABCMeta):
+    @abstractmethod
+    def get_list_findings(self, results_scan_file) -> "list[Finding]":
+        "Deserializator"

devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/model/gateways/tool_gateway.py

@@ -0,0 +1,9 @@
+from abc import ABCMeta, abstractmethod
+
+
+class ToolGateway(metaclass=ABCMeta):
+    @abstractmethod
+    def run_tool_dependencies_sca(
+        self, remote_config, dir_to_scan_path, bypass_limits_flag, token
+    ) -> str:
+        "run tool dependencies sca"