devsecops-engine-tools 1.60.0__py3-none-any.whl → 1.61.0__py3-none-any.whl

devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_tool.py

@@ -9,7 +9,9 @@ import threading
 import json
 import shutil
 import platform
-from devsecops_engine_tools.engine_sast.engine_iac.src.domain.model.context_iac import ContextIac
+from devsecops_engine_tools.engine_sast.engine_iac.src.domain.model.context_iac import (
+    ContextIac,
+)
 from devsecops_engine_tools.engine_sast.engine_iac.src.domain.model.gateways.tool_gateway import (
     ToolGateway,
 )
@@ -30,7 +32,7 @@ logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 
 
 class CheckovTool(ToolGateway):
-    
+
     CHECKOV_CONFIG_FILE = "checkov_config.yaml"
     TOOL_CHECKOV = "CHECKOV"
     framework_mapping = {
@@ -38,31 +40,123 @@ class CheckovTool(ToolGateway):
         "RULES_K8S": "kubernetes",
         "RULES_CLOUDFORMATION": "cloudformation",
         "RULES_OPENAPI": "openapi",
-        "RULES_TERRAFORM": "terraform"
+        "RULES_TERRAFORM": "terraform",
     }
     framework_external_checks = [
         "RULES_K8S",
         "RULES_CLOUDFORMATION",
         "RULES_DOCKER",
         "RULES_OPENAPI",
-        "RULES_TERRAFORM"
+        "RULES_TERRAFORM",
     ]
 
-    def create_config_file(self, checkov_config: CheckovConfig):
-        with open(
-            checkov_config.path_config_file
-            + checkov_config.config_file_name
-            + self.CHECKOV_CONFIG_FILE,
-            "w",
-        ) as file:
-            yaml.dump(checkov_config.dict_confg_file, file)
-            file.close()
+    def run_tool(
+        self,
+        config_tool,
+        folders_to_scan,
+        environment,
+        platform_to_scan,
+        secret_tool,
+        secret_external_checks,
+        **kwargs,
+    ):
+        util = Utils()
+        agent_env = util.configurate_external_checks(
+            self.TOOL_CHECKOV, config_tool, secret_tool, secret_external_checks
+        )
+
+        install_type = config_tool[self.TOOL_CHECKOV].get("INSTALL_TYPE", "")
+
+        command_prefix = None
+
+        if install_type.casefold() == "remote-binary".casefold():
+            command_prefix = self._install_binary(config_tool[self.TOOL_CHECKOV])
+        else:
+            command_prefix = self._retryable_install_package(
+                "checkov", config_tool[self.TOOL_CHECKOV]["VERSION"]
+            )
+
+        if command_prefix is not None:
+            result_scans, rules_run = self._scan_folders(
+                folders_to_scan,
+                config_tool,
+                agent_env,
+                environment,
+                platform_to_scan,
+                command_prefix,
+                kwargs.get("dict_args"),
+            )
+
+            checkov_deserealizator = CheckovDeserealizator()
+            findings_list = checkov_deserealizator.get_list_finding(
+                result_scans,
+                rules_run,
+                config_tool[self.TOOL_CHECKOV]["DEFAULT_SEVERITY"],
+                config_tool[self.TOOL_CHECKOV]["DEFAULT_CATEGORY"],
+            )
+
+            return (
+                findings_list,
+                generate_file_from_tool(
+                    self.TOOL_CHECKOV,
+                    result_scans,
+                    rules_run,
+                    config_tool[self.TOOL_CHECKOV]["DEFAULT_SEVERITY"],
+                    config_tool[self.TOOL_CHECKOV]["DEFAULT_CATEGORY"],
+                ),
+            )
+        else:
+            return [], None
+
+    def get_iac_context_from_results(self, path_file_results: str):
+        with open(path_file_results, "r") as file:
+            context_results_scan_list = json.load(file)
+            context_iac_list = []
+            failed_checks = context_results_scan_list.get("results", {}).get(
+                "failed_checks", []
+            )
+            for check in failed_checks:
+                file_line_range = check.get("file_line_range", ["unknown", "unknown"])
+                start_line = (
+                    file_line_range[0] if len(file_line_range) > 0 else "unknown"
+                )
+                end_line = file_line_range[1] if len(file_line_range) > 1 else "unknown"
+                line_range_str = (
+                    f"{start_line}-{end_line}"
+                    if start_line != end_line
+                    else str(start_line)
+                )
+
+                context_iac = ContextIac(
+                    id=check.get("check_id", "unknown"),
+                    check_name=check.get("check_name", "unknown"),
+                    check_class=check.get("check_class", "unknown"),
+                    severity=check.get("severity").lower(),
+                    where=f"{check.get('repo_file_path', 'unknown')}: {check.get('resource', 'unknown')} (line {line_range_str})",
+                    resource=check.get("resource", "unknown"),
+                    description=check.get("check_name", "unknown"),
+                    module="engine_iac",
+                    tool="Checkov",
+                )
+
+                context_iac_list.append(context_iac)
+
+            print("===== BEGIN CONTEXT OUTPUT =====")
+            print(
+                json.dumps(
+                    {"iac_context": [obj.__dict__ for obj in context_iac_list]},
+                    indent=4,
+                )
+            )
+            print("===== END CONTEXT OUTPUT =====")
 
-    def retryable_install_package(self, package: str, version: str) -> bool:
+    def _retryable_install_package(self, package: str, version: str) -> bool:
         MAX_RETRIES = 3
         RETRY_DELAY = 1  # in seconds
         INSTALL_SUCCESS_MSG = f"Installation of {package} successful"
-        INSTALL_RETRY_MSG = f"Retrying installation of {package} in {RETRY_DELAY} seconds..."
+        INSTALL_RETRY_MSG = (
+            f"Retrying installation of {package} in {RETRY_DELAY} seconds..."
+        )
 
         installed = shutil.which(package)
         if installed:
@@ -77,10 +171,7 @@ class CheckovTool(ToolGateway):
         # Detect Python version
         try:
             result = subprocess.run(
-                [python_path, "--version"],
-                capture_output=True,
-                text=True,
-                check=True
+                [python_path, "--version"], capture_output=True, text=True, check=True
             )
             version_str = result.stdout.strip().split()[1]
             major, minor, *_ = map(int, version_str.split("."))
@@ -90,10 +181,16 @@ class CheckovTool(ToolGateway):
 
         # Prepare install command parts
         install_cmd_base = [
-            python_path, "-m", "pip", "install", "-q",
+            python_path,
+            "-m",
+            "pip",
+            "install",
+            "-q",
             f"{package}=={version}",
-            "--retries", str(MAX_RETRIES),
-            "--timeout", str(RETRY_DELAY),
+            "--retries",
+            str(MAX_RETRIES),
+            "--timeout",
+            str(RETRY_DELAY),
         ]
 
         if (major, minor) >= (3, 11):
@@ -111,38 +208,89 @@ class CheckovTool(ToolGateway):
                     logger.debug(INSTALL_SUCCESS_MSG)
                     return "checkov"
                 else:
-                    logger.error(f"Installation failed (attempt {attempt}): {result.stderr.decode().strip()}")
+                    logger.error(
+                        f"Installation failed (attempt {attempt}): {result.stderr.decode().strip()}"
+                    )
             except Exception as e:
                 logger.error(f"Error during installation (attempt {attempt}): {e}")
 
             retry(attempt)
 
         return None
-   
-    def execute(self, checkov_config: CheckovConfig, command_prefix):
-        command = (
-            f"{command_prefix} --config-file "
-            + checkov_config.path_config_file
-            + checkov_config.config_file_name
-            + self.CHECKOV_CONFIG_FILE
-        )
-        env_modified = dict(os.environ)
-        if checkov_config.env is not None:
-            env_modified = {**dict(os.environ), **checkov_config.env}
-        result = subprocess.run(
-            command, capture_output=True, text=True, shell=True, env=env_modified
+
+    def _install_binary(self, config_tool):
+        os_platform = platform.system()
+        if os_platform == "Linux":
+            architecture = platform.machine()
+            if architecture == "aarch64":
+                url = config_tool["URL_FILE_LINUX_ARM64"]
+            else:
+                url = config_tool["URL_FILE_LINUX"]
+            file = os.path.basename(url)
+            self._install_tool_unix(file, url)
+            return "./checkov"
+        elif os_platform == "Darwin":
+            url = config_tool["URL_FILE_DARWIN"]
+            file = os.path.basename(url)
+            self._install_tool_unix(file, url)
+            return "./checkov"
+        elif os_platform == "Windows":
+            url = config_tool["URL_FILE_WINDOWS"]
+            file = os.path.basename(url)
+            self._install_tool_windows(file, url)
+            return "checkov.exe"
+        else:
+            logger.warning(f"{os_platform} is not supported.")
+            return None
+
+    def _install_tool_unix(self, file, url):
+        installed = subprocess.run(
+            ["which", "./checkov"],
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
         )
-        output = result.stdout.strip()
-        error = result.stderr.strip()
-        return output
+        if installed.returncode == 1:
+            command = ["chmod", "+x", "./checkov"]
+            try:
+                self._download_tool(file, url)
+                with zipfile.ZipFile(file, "r") as zip_file:
+                    zip_file.extract(member="dist/checkov")
+                source = os.path.join("dist", "checkov")
+                destination = "checkov"
+                shutil.move(source, destination)
+                subprocess.run(
+                    command, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE
+                )
+            except Exception as e:
+                logger.error(f"Error installing Checkov: {e}")
 
-    def async_scan(self, queue, checkov_config: CheckovConfig, command_prefix):
-        result = []
-        output = self.execute(checkov_config, command_prefix)
-        result.append(json.loads(output))
-        queue.put(result)
+    def _install_tool_windows(self, file, url):
+        try:
+            subprocess.run(
+                ["checkov.exe", "--version"],
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+            )
+        except:
+            try:
+                self._download_tool(file, url)
+                with zipfile.ZipFile(file, "r") as zip_file:
+                    zip_file.extract(member="dist/checkov.exe")
+                source = os.path.join("dist", "checkov.exe")
+                destination = "checkov.exe"
+                shutil.move(source, destination)
+            except Exception as e:
+                logger.error(f"Error installing Checkov: {e}")
 
-    def scan_folders(
+    def _download_tool(self, file, url):
+        try:
+            response = requests.get(url, allow_redirects=True)
+            with open(file, "wb") as compress_file:
+                compress_file.write(response.content)
+        except Exception as e:
+            logger.error(f"Error downloading Checkov: {e}")
+
+    def _scan_folders(
         self,
         folders_to_scan,
         config_tool,
@@ -150,7 +298,7 @@ class CheckovTool(ToolGateway):
         environment,
         platform_to_scan,
         command_prefix,
-        dict_args
+        dict_args,
     ):
         output_queue = queue.Queue()
         # Crea una lista para almacenar los hilos
@@ -163,7 +311,10 @@ class CheckovTool(ToolGateway):
                 ):
                     framework = [self.framework_mapping[rule]]
                     repo_root = None
-                    if "terraform" in platform_to_scan or ("all" in platform_to_scan and self.framework_mapping[rule] == "terraform"): 
+                    if "terraform" in platform_to_scan or (
+                        "all" in platform_to_scan
+                        and self.framework_mapping[rule] == "terraform"
+                    ):
                         framework.append("terraform_plan")
                         repo_root = dict_args.get("terraform_repo_root", None)
 
@@ -197,18 +348,14 @@ class CheckovTool(ToolGateway):
                             else []
                         ),
                         repo_root_for_plan_enrichment=repo_root,
-                        deep_analysis=(
-                            True
-                            if repo_root
-                            else None
-                        )
+                        deep_analysis=(True if repo_root else None),
                     )
 
                     checkov_config.create_config_dict()
-                    self.create_config_file(checkov_config)
+                    self._create_config_file(checkov_config)
                     rules_run.update(config_tool[self.TOOL_CHECKOV]["RULES"][rule])
                     t = threading.Thread(
-                        target=self.async_scan,
+                        target=self._async_scan,
                         args=(output_queue, checkov_config, command_prefix),
                     )
                     t.start()
@@ -223,158 +370,35 @@ class CheckovTool(ToolGateway):
             result_scans.extend(result)
         return result_scans, rules_run
 
-    def run_tool(
-        self,
-        config_tool,
-        folders_to_scan,
-        environment,
-        platform_to_scan,
-        secret_tool,
-        secret_external_checks,
-        **kwargs
-    ):
-        util = Utils()
-        agent_env = util.configurate_external_checks(self.TOOL_CHECKOV,config_tool, secret_tool,secret_external_checks)
-
-
-        install_type = config_tool[self.TOOL_CHECKOV].get("INSTALL_TYPE", "")
-
-        command_prefix = None
-
-        if install_type.casefold() == "remote-binary".casefold():
-            command_prefix = self.install_binary(config_tool[self.TOOL_CHECKOV])
-        else:
-            command_prefix = self.retryable_install_package(
-                "checkov", config_tool[self.TOOL_CHECKOV]["VERSION"]
-            )
-        
-        if command_prefix is not None:
-            result_scans, rules_run = self.scan_folders(
-                folders_to_scan, config_tool, agent_env, environment, platform_to_scan, command_prefix, kwargs.get("dict_args")
-            )
-
-            checkov_deserealizator = CheckovDeserealizator()
-            findings_list = checkov_deserealizator.get_list_finding(
-                result_scans, 
-                rules_run, 
-                config_tool[self.TOOL_CHECKOV]["DEFAULT_SEVERITY"],
-                config_tool[self.TOOL_CHECKOV]["DEFAULT_CATEGORY"]
-            )
-
-            return (
-                findings_list,
-                generate_file_from_tool(
-                    self.TOOL_CHECKOV, 
-                    result_scans, 
-                    rules_run, 
-                    config_tool[self.TOOL_CHECKOV]["DEFAULT_SEVERITY"],
-                    config_tool[self.TOOL_CHECKOV]["DEFAULT_CATEGORY"]
-                ),
-            )
-        else:
-            return [], None
-        
-    def get_iac_context_from_results(
-        self, path_file_results: str
-    ):
-        with open(path_file_results, "r") as file:
-            context_results_scan_list = json.load(file)
-            context_iac_list = []
-            failed_checks = context_results_scan_list.get("results", {}).get("failed_checks", [])
-            for check in failed_checks:
-                file_line_range = check.get("file_line_range", ["unknown", "unknown"])
-                start_line = file_line_range[0] if len(file_line_range) > 0 else "unknown"
-                end_line = file_line_range[1] if len(file_line_range) > 1 else "unknown"
-                line_range_str = f"{start_line}-{end_line}" if start_line != end_line else str(start_line)
-
-                context_iac = ContextIac(
-                    id=check.get("check_id", "unknown"),
-                    check_name=check.get("check_name", "unknown"),
-                    check_class=check.get("check_class", "unknown"),
-                    severity=check.get("severity").lower(),
-                    where=f"{check.get('repo_file_path', 'unknown')}: {check.get('resource', 'unknown')} (line {line_range_str})",
-                    resource=check.get("resource", "unknown"),
-                    description=check.get("check_name", "unknown"),
-                    module="engine_iac",
-                    tool="Checkov"
-                )
-
-                context_iac_list.append(context_iac)
-                        
-            print("===== BEGIN CONTEXT OUTPUT =====")
-            print(json.dumps({"iac_context": [obj.__dict__ for obj in context_iac_list]}, indent=4))
-            print("===== END CONTEXT OUTPUT =====")
-        
+    def _create_config_file(self, checkov_config: CheckovConfig):
+        with open(
+            checkov_config.path_config_file
+            + checkov_config.config_file_name
+            + self.CHECKOV_CONFIG_FILE,
+            "w",
+        ) as file:
+            yaml.dump(checkov_config.dict_confg_file, file)
+            file.close()
 
-    def install_binary(self,config_tool):
-        os_platform = platform.system()
-        if os_platform == "Linux":
-            architecture = platform.machine()
-            if architecture == "aarch64":
-                url = config_tool["URL_FILE_LINUX_ARM64"]
-            else:
-                url = config_tool["URL_FILE_LINUX"]
-            file = os.path.basename(url)
-            self.install_tool_unix(file, url)
-            return "./checkov"
-        elif os_platform == "Darwin":
-            url = config_tool["URL_FILE_DARWIN"]
-            file = os.path.basename(url)
-            self.install_tool_unix(file, url)
-            return "./checkov"
-        elif os_platform == "Windows":
-            url = config_tool["URL_FILE_WINDOWS"]
-            file = os.path.basename(url)
-            self.install_tool_windows(file, url)
-            return "checkov.exe"
-        else:
-            logger.warning(f"{os_platform} is not supported.")
-            return None
-    
-        
-    def download_tool(self, file, url):
-        try:
-            response = requests.get(url, allow_redirects=True)
-            with open(file, "wb") as compress_file:
-                compress_file.write(response.content)
-        except Exception as e:
-            logger.error(f"Error downloading Checkov: {e}")
+    def _async_scan(self, queue, checkov_config: CheckovConfig, command_prefix):
+        result = []
+        output = self._execute(checkov_config, command_prefix)
+        result.append(json.loads(output))
+        queue.put(result)
 
-    def install_tool_unix(self, file, url):
-        installed = subprocess.run(
-            ["which", "./checkov"],
-            stdout=subprocess.PIPE,
-            stderr=subprocess.PIPE,
+    def _execute(self, checkov_config: CheckovConfig, command_prefix):
+        command = (
+            f"{command_prefix} --config-file "
+            + checkov_config.path_config_file
+            + checkov_config.config_file_name
+            + self.CHECKOV_CONFIG_FILE
         )
-        if installed.returncode == 1:
-            command = ["chmod", "+x", "./checkov"]
-            try:
-                self.download_tool(file, url)
-                with zipfile.ZipFile(file, 'r') as zip_file:
-                    zip_file.extract(member="dist/checkov")
-                source = os.path.join("dist", "checkov")
-                destination = "checkov"
-                shutil.move(source, destination)
-                subprocess.run(
-                    command, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE
-                )
-            except Exception as e:
-                logger.error(f"Error installing Checkov: {e}")
-        
-    def install_tool_windows(self, file, url):
-        try:
-            subprocess.run(
-                ["checkov.exe", "--version"],
-                stdout=subprocess.PIPE,
-                stderr=subprocess.PIPE,
-            )
-        except:
-            try:
-                self.download_tool(file, url)
-                with zipfile.ZipFile(file, 'r') as zip_file:
-                    zip_file.extract(member="dist/checkov.exe")
-                source = os.path.join("dist", "checkov.exe")
-                destination = "checkov.exe"
-                shutil.move(source, destination)
-            except Exception as e:
-                logger.error(f"Error installing Checkov: {e}")
+        env_modified = dict(os.environ)
+        if checkov_config.env is not None:
+            env_modified = {**dict(os.environ), **checkov_config.env}
+        result = subprocess.run(
+            command, capture_output=True, text=True, shell=True, env=env_modified
+        )
+        output = result.stdout.strip()
+        error = result.stderr.strip()
+        return output