devsecops-engine-tools 1.60.0__py3-none-any.whl → 1.61.0__py3-none-any.whl

devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kics/kics_tool.py

@@ -7,7 +7,7 @@ from devsecops_engine_tools.engine_sast.engine_iac.src.domain.model.gateways.too
     ToolGateway,
 )
 from devsecops_engine_tools.engine_sast.engine_iac.src.infrastructure.driven_adapters.kics.kics_deserealizator import (
-    KicsDeserealizator
+    KicsDeserealizator,
 )
 from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
 from devsecops_engine_tools.engine_utilities import settings
@@ -35,10 +35,90 @@ class KicsTool(ToolGateway):
         "googledeploymentmanager": "GoogleDeploymentManager",
         "knative": "Knative",
         "pulumi": "Pulumi",
-        "serverlessfw": "ServerlessFW"
+        "serverlessfw": "ServerlessFW",
     }
 
-    def download(self, file, url):
+    def run_tool(
+        self, config_tool, folders_to_scan, work_folder, platform_to_scan, **kwargs
+    ):
+        kics_version = config_tool[self.TOOL_KICS]["CLI_VERSION"]
+        path_kics = config_tool[self.TOOL_KICS]["PATH_KICS"]
+        download_kics_assets = config_tool[self.TOOL_KICS]["DOWNLOAD_KICS_ASSETS"]
+
+        os_platform = platform.system()
+        path_kics = (
+            path_kics.replace("/", "\\") if os_platform == "Windows" else path_kics
+        )
+        work_folder = (
+            work_folder.replace("/", "\\") if os_platform == "Windows" else work_folder
+        )
+
+        command_prefix = (
+            f"{work_folder}\\{path_kics}.exe"
+            if os_platform == "Windows"
+            else f"{work_folder}/{path_kics}"
+        )
+
+        if not self._validate_kics(command_prefix):
+            logger.info("KICS binary not found or invalid, downloading assets...")
+
+        if download_kics_assets:
+            self._get_assets(kics_version, work_folder)
+
+        queries = self._get_queries(config_tool, platform_to_scan)
+        self._execute_kics(
+            folders_to_scan,
+            command_prefix,
+            platform_to_scan,
+            work_folder,
+            os_platform,
+            queries,
+        )
+        data = self._load_results(work_folder, queries)
+
+        if data:
+            kics_deserealizator = KicsDeserealizator()
+            total_vulnerabilities = kics_deserealizator.calculate_total_vulnerabilities(
+                data
+            )
+            path_file = os.path.join(work_folder, "results.json")
+
+            if total_vulnerabilities == 0:
+                return [], path_file
+
+            filtered_results = kics_deserealizator.get_findings(data)
+            finding_list = kics_deserealizator.get_list_finding(filtered_results)
+
+            return finding_list, path_file
+        return [], None
+
+    def get_iac_context_from_results(self, path_file_results):
+        # TODO: Implement this method
+        pass
+
+    def _validate_kics(self, command_prefix):
+        try:
+            result = subprocess.run(
+                [command_prefix, "version"], capture_output=True, text=True
+            )
+            if result.returncode == 0:
+                return True
+            else:
+                logger.error(f"KICS binary not valid: {result.stderr}")
+                return False
+        except Exception as e:
+            logger.error(f"Error validating KICS binary: {e}")
+
+    def _get_assets(self, kics_version, work_folder):
+        name_zip = "assets_compressed.zip"
+        assets_url = f"https://github.com/Checkmarx/kics/releases/download/v{kics_version}/extracted-info.zip"
+        self._download(name_zip, assets_url)
+
+        directory_assets = f"{work_folder}/kics-devsecops"
+        utils = Utils()
+        utils.unzip_file(name_zip, directory_assets)
+
+    def _download(self, file, url):
         try:
             response = requests.get(url)
             with open(file, "wb") as f:
@@ -46,13 +126,39 @@ class KicsTool(ToolGateway):
         except Exception as ex:
             logger.error(f"An error ocurred downloading {file} {ex}")
 
-    def execute_kics(self, folders_to_scan, prefix, platform_to_scan, work_folder, os_platform, queries):
+    def _get_queries(self, config_tool, platform_to_scan):
+        try:
+            queries = []
+            for platform in platform_to_scan:
+                platform = platform.strip().upper()
+                if f"RULES_{platform}" not in config_tool[self.TOOL_KICS]["RULES"]:
+                    logger.error(f"Platform {platform} not found in RULES")
+                queries = [
+                    {key: [value["checkID"], value["overrideID"]],
+                            "severity": value["severity"]}
+                           for key, value in config_tool[self.TOOL_KICS]["RULES"][f"RULES_{platform}"].items()
+                           ]
+            return queries
+        except Exception as e:
+            logger.error(f"Error writing queries file: {e}")
+
+    
+    def _execute_kics(
+        self,
+        folders_to_scan,
+        prefix,
+        platform_to_scan,
+        work_folder,
+        os_platform,
+        queries,
+    ):
         folders = ','.join(folders_to_scan)
-        queries = ','.join([list(query.values())[0] for query in queries])
-        mapped_platforms = [
-            self.scan_type_platform_mapping.get(platform.lower(), platform)
-            for platform in platform_to_scan
-        ]
+        queries = ','.join(
+            uuid for query in queries for uuid in list(query.values())[0]
+            ) if queries else ""
+        mapped_platforms = [ 
+                            self.scan_type_platform_mapping.get(platform.lower(), platform) 
+                            for platform in platform_to_scan ] if platform_to_scan != ["all"] else list(self.scan_type_platform_mapping.values())
         platforms = ','.join(mapped_platforms)
 
         command = [
@@ -65,30 +171,47 @@ class KicsTool(ToolGateway):
             "--include-queries",
             queries,
             "-q",
-            f"{work_folder}\\kics-devsecops\\assets\\queries" if os_platform == "Windows"
-            else f"{work_folder}/kics-devsecops/assets/queries",
+            (
+                f"{work_folder}\\kics-devsecops\\assets\\queries"
+                if os_platform == "Windows"
+                else f"{work_folder}/kics-devsecops/assets/queries"
+            ),
             "--report-formats",
             "json",
             "-o",
-            work_folder
+            work_folder,
         ]
         try:
             subprocess.run(command, capture_output=True)
         except subprocess.CalledProcessError as e:
             logger.error(f"Error during KICS execution: {e}")
-
-    def load_results(self, work_folder, queries):
+            return []
+            
+    def _load_results(self, work_folder, queries):
         try:
             results_path = os.path.join(work_folder, "results.json")
             with open(results_path, "r") as f:
                 data = json.load(f)
 
+            query_id_to_info = {}
+            for query in queries:
+                severity = query.get("severity")
+                for custom_id, ids in query.items():
+                    if custom_id == "severity":
+                        continue
+                    for query_id in ids:
+                        if query_id != "":
+                            query_id_to_info[query_id] = {
+                                "severity": severity,
+                                "custom_id": custom_id
+                            }
+
             for finding in data.get("queries", []):
-                query_ids = {list(query.values())[0] for query in queries}
-                if finding.get("query_id") in query_ids:
-                    finding["custom_vuln_id"] = next(
-                        key for query in queries for key, value in query.items() if value == finding.get("query_id")
-                    )
+                query_id = finding.get("query_id")
+                if query_id in query_id_to_info:
+                    info = query_id_to_info[query_id]
+                    finding["severity"] = info["severity"].upper()
+                    finding["custom_id"] = info["custom_id"]
 
             with open(results_path, "w") as f:
                 json.dump(data, f, indent=4)
@@ -96,77 +219,4 @@ class KicsTool(ToolGateway):
             return data
         except Exception as ex:
             logger.error(f"An error occurred loading or modifying KICS results {ex}")
-            return None
-
-    def get_assets(self, kics_version, work_folder):
-        name_zip = "assets_compressed.zip"
-        assets_url = f"https://github.com/Checkmarx/kics/releases/download/v{kics_version}/extracted-info.zip"
-        self.download(name_zip, assets_url)
-
-        directory_assets = f"{work_folder}/kics-devsecops"
-        utils = Utils()
-        utils.unzip_file(name_zip, directory_assets)
-
-    def validate_kics(self, command_prefix):
-        try:
-            result = subprocess.run([command_prefix, "version"], capture_output=True, text=True)
-            if result.returncode == 0:
-                return True
-            else:
-                logger.error(f"KICS binary not valid: {result.stderr}")
-                return False
-        except Exception as e:
-            logger.error(f"Error validating KICS binary: {e}")
-
-    def get_queries(self, config_tool, platform_to_scan):
-        try:
-            queries = []
-            for platform in platform_to_scan:
-                platform = platform.strip().upper()
-                if f"RULES_{platform}" not in config_tool[self.TOOL_KICS]["RULES"]:
-                    logger.error(f"Platform {platform} not found in RULES")
-                queries = [{key: value["checkID"]} for key, value in config_tool[self.TOOL_KICS]["RULES"][f"RULES_{platform}"].items()]
-            return queries
-        except Exception as e:
-            logger.error(f"Error writing queries file: {e}")
-
-    def run_tool(
-            self, config_tool, folders_to_scan, work_folder, platform_to_scan, **kwargs
-    ):
-        kics_version = config_tool[self.TOOL_KICS]["CLI_VERSION"]
-        path_kics = config_tool[self.TOOL_KICS]["PATH_KICS"]
-        download_kics_assets = config_tool[self.TOOL_KICS]["DOWNLOAD_KICS_ASSETS"]
-        
-        os_platform = platform.system()
-        path_kics = path_kics.replace("/", "\\") if os_platform == "Windows" else path_kics
-        work_folder = work_folder.replace("/", "\\") if os_platform == "Windows" else work_folder
-        
-        command_prefix = f"{work_folder}\\{path_kics}.exe" if os_platform == "Windows" else f"{work_folder}/{path_kics}"
-        
-        if not self.validate_kics(command_prefix):
-            logger.info("KICS binary not found or invalid, downloading assets...")
-
-        if download_kics_assets:
-            self.get_assets(kics_version, work_folder)
-
-        queries = self.get_queries(config_tool, platform_to_scan)
-        self.execute_kics(folders_to_scan, command_prefix, platform_to_scan, work_folder, os_platform, queries)
-        data = self.load_results(work_folder, queries)
-        
-        if data:
-            kics_deserealizator = KicsDeserealizator()
-            total_vulnerabilities = kics_deserealizator.calculate_total_vulnerabilities(data)
-            path_file = os.path.join(work_folder, "results.json")
-
-            if total_vulnerabilities == 0:
-                return [], path_file
-
-            filtered_results = kics_deserealizator.get_findings(data)
-            finding_list = kics_deserealizator.get_list_finding(filtered_results)
-
-            return finding_list, path_file
-        return [], None
-    
-    def get_iac_context_from_results(self, path_file_results):
-        #TODO: Implement this method
-        pass
+            return None

devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kubescape/kubescape_tool.py

@@ -18,15 +18,61 @@ logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 
 class KubescapeTool(ToolGateway):
 
-    def download_tool(self, file, url):
-        try:
-            response = requests.get(url, allow_redirects=True)
-            with open(file, "wb") as binary_file:
-                binary_file.write(response.content)
-        except Exception as e:
-            logger.error(f"Error downloading Kubescape: {e}")
+    def run_tool(self, config_tool, folders_to_scan, platform_to_scan, **kwargs):
+
+        if folders_to_scan and "k8s" in platform_to_scan:
+
+            kubescape_version = config_tool["KUBESCAPE"]["VERSION"]
+            os_platform = platform.system()
+            base_url = f"https://github.com/kubescape/kubescape/releases/download/v{kubescape_version}/"
+            command_prefix = self._select_operative_system(os_platform, base_url)
+            self._execute_kubescape(folders_to_scan, command_prefix)
+
+            json_name = "results_kubescape.json"
+            data = self._load_json(json_name)
+
+            if not data:
+                return [], None
+            else:
+                kubescape_deserealizator = KubescapeDeserealizator()
+                result_extracted_data = (
+                    kubescape_deserealizator.extract_failed_controls(data)
+                )
+                finding_list = kubescape_deserealizator.get_list_finding(
+                    result_extracted_data
+                )
+                path_results = os.path.abspath(json_name)
+            return finding_list, path_results
+        else:
+            return [], None
+
+    def get_iac_context_from_results(self, path_file_results):
+        # TODO: Implement this method
+        pass
 
-    def install_tool(self, file, url):
+    def _select_operative_system(self, os_platform, base_url):
+        if os_platform == "Linux":
+            distro_name = distro.name()
+            if distro_name == "Ubuntu":
+                file = "kubescape-ubuntu-latest"
+                self._install_tool(file, base_url + file)
+                return f"./{file}"
+            else:
+                logger.warning(f"{distro_name} is not supported.")
+                return None
+        elif os_platform == "Windows":
+            file = "kubescape-windows-latest.exe"
+            self._install_tool_windows(file, base_url + file)
+            return f"./{file}"
+        elif os_platform == "Darwin":
+            file = "kubescape-macos-latest"
+            self._install_tool(file, base_url + file)
+            return f"./{file}"
+        else:
+            logger.warning(f"{os_platform} is not supported.")
+            return [], None
+
+    def _install_tool(self, file, url):
         installed = subprocess.run(
             ["which", f"./{file}"],
             stdout=subprocess.PIPE,
@@ -34,13 +80,13 @@ class KubescapeTool(ToolGateway):
         )
         if installed.returncode == 1:
             try:
-                self.download_tool(file, url)
+                self._download_tool(file, url)
                 subprocess.run(["chmod", "+x", f"./{file}"])
 
             except Exception as e:
                 logger.error(f"Error installing Kubescape: {e}")
 
-    def install_tool_windows(self, file, url):
+    def _install_tool_windows(self, file, url):
         try:
             subprocess.run(
                 [f"./{file}", "version"],
@@ -49,20 +95,39 @@ class KubescapeTool(ToolGateway):
             )
         except:
             try:
-                self.download_tool(file, url)
+                self._download_tool(file, url)
 
             except Exception as e:
                 logger.error(f"Error installing Kubescape: {e}")
 
-    def execute_kubescape(self, folders_to_scan, prefix):
-        command = [prefix, "scan"] + folders_to_scan + ["--format", "json", "--format-version", "v2", "--output",
-                                                        "results_kubescape.json", "-v"]
+    def _download_tool(self, file, url):
+        try:
+            response = requests.get(url, allow_redirects=True)
+            with open(file, "wb") as binary_file:
+                binary_file.write(response.content)
+        except Exception as e:
+            logger.error(f"Error downloading Kubescape: {e}")
+
+    def _execute_kubescape(self, folders_to_scan, prefix):
+        command = (
+            [prefix, "scan"]
+            + folders_to_scan
+            + [
+                "--format",
+                "json",
+                "--format-version",
+                "v2",
+                "--output",
+                "results_kubescape.json",
+                "-v",
+            ]
+        )
         try:
             subprocess.run(command, capture_output=True)
         except subprocess.CalledProcessError as e:
             logger.error(f"Error during Kubescape execution: {e}")
 
-    def load_json(self, json_name):
+    def _load_json(self, json_name):
         try:
             with open(json_name) as file:
                 return json.load(file)
@@ -71,53 +136,3 @@ class KubescapeTool(ToolGateway):
         except json.JSONDecodeError:
             logger.error("The JSON result is empty.")
         return None
-
-    def select_operative_system(self, os_platform, base_url):
-        if os_platform == "Linux":
-            distro_name = distro.name()
-            if distro_name == "Ubuntu":
-                file = "kubescape-ubuntu-latest"
-                self.install_tool(file, base_url + file)
-                return f"./{file}"
-            else:
-                logger.warning(f"{distro_name} is not supported.")
-                return None
-        elif os_platform == "Windows":
-            file = "kubescape-windows-latest.exe"
-            self.install_tool_windows(file, base_url + file)
-            return f"./{file}"
-        elif os_platform == "Darwin":
-            file = "kubescape-macos-latest"
-            self.install_tool(file, base_url + file)
-            return f"./{file}"
-        else:
-            logger.warning(f"{os_platform} is not supported.")
-            return [], None
-
-    def run_tool(self, config_tool, folders_to_scan, platform_to_scan, **kwargs):
-
-        if folders_to_scan and "k8s" in platform_to_scan:
-
-            kubescape_version = config_tool["KUBESCAPE"]["VERSION"]
-            os_platform = platform.system()
-            base_url = f"https://github.com/kubescape/kubescape/releases/download/v{kubescape_version}/"
-            command_prefix = self.select_operative_system(os_platform, base_url)
-            self.execute_kubescape(folders_to_scan, command_prefix)
-
-            json_name = "results_kubescape.json"
-            data = self.load_json(json_name)
-
-            if not data:
-                return [], None
-            else:
-                kubescape_deserealizator = KubescapeDeserealizator()
-                result_extracted_data = kubescape_deserealizator.extract_failed_controls(data)
-                finding_list = kubescape_deserealizator.get_list_finding(result_extracted_data)
-                path_results = os.path.abspath(json_name)
-            return finding_list, path_results
-        else:
-            return [], None
-
-    def get_iac_context_from_results(self, path_file_results):
-        #TODO: Implement this method
-        pass

devsecops_engine_tools/engine_sca/engine_container/src/domain/model/context_container.py

@@ -1,6 +1,7 @@
 from dataclasses import dataclass
 from typing import List, Optional
 
+
 @dataclass
 class ContextContainer:
     cve_id: str
@@ -20,4 +21,4 @@ class ContextContainer:
     published_date: Optional[str]
     last_modified_date: Optional[str]
     references: Optional[List[str]]
-    source_tool: str
+    source_tool: str

devsecops_engine_tools/engine_sca/engine_container/src/domain/model/gateways/deserealizator_gateway.py

@@ -1,6 +1,8 @@
 from abc import ABCMeta, abstractmethod
 from devsecops_engine_tools.engine_core.src.domain.model.finding import Finding
-from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.context_container import ContextContainer
+from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.context_container import (
+    ContextContainer,
+)
 
 
 class DeseralizatorGateway(metaclass=ABCMeta):
@@ -8,5 +10,8 @@ class DeseralizatorGateway(metaclass=ABCMeta):
     def get_list_findings(self, results_scan_list: list) -> "list[Finding]":
         "Deseralizator"
 
-    def get_container_context_from_results(self, results_scan_list: list) -> "list[ContextContainer]":
+    @abstractmethod
+    def get_container_context_from_results(
+        self, results_scan_list: list
+    ) -> "list[ContextContainer]":
         "Deseralizator"

devsecops_engine_tools/engine_sca/engine_container/src/domain/usecases/container_sca_scan.py

@@ -38,52 +38,6 @@ class ContainerScaScan:
         self.pipeline_name = pipeline_name
         self.context = context
 
-    def get_image(self, image_to_scan):
-        """
-        Process the list of images.
-
-        Returns:
-            list: List of processed images.
-        """
-        return self.tool_images.list_images(image_to_scan)
-
-    def get_base_image(self, matching_image):
-        """
-            Process the base image.
-
-            Returns:
-                String: base image.
-            """
-        return self.tool_images.get_base_image(matching_image)
-
-    def get_images_already_scanned(self):
-        """
-        Create images scanned file if it does not exist and get the images that have already been scanned.
-        """
-        scanned_images_file = os.path.join(os.getcwd(), "scanned_images.txt")
-        if not os.path.exists(scanned_images_file):
-            open(scanned_images_file, "w").close()
-        with open(scanned_images_file, "r") as file:
-            images_scanned = file.read().splitlines()
-        return images_scanned
-
-    def set_image_scanned(self, result_file):
-        """
-        Write in scanned_images.txt the result file
-        """
-        with open("scanned_images.txt", "a") as file:
-            file.write(result_file + "\n")
-
-    def validate_base_image_date(self, matching_image, referenced_date):
-        """
-        Process the base image date validation.
-
-        Returns:
-            string: base image date.
-        """
-        return self.tool_images.validate_base_image_date(
-            matching_image, referenced_date
-        )
 
     def process(self):
         """
@@ -94,15 +48,15 @@ class ContainerScaScan:
         """
         base_image = None
         image_scanned = None
-        matching_image = self.get_image(self.image_to_scan)
+        matching_image = self._get_image(self.image_to_scan)
         if self.remote_config["GET_IMAGE_BASE"]:
-            base_image = self.get_base_image(matching_image)
+            base_image = self._get_base_image(matching_image)
         if self.remote_config["VALIDATE_BASE_IMAGE_DATE"][
             "ENABLED"
         ] and not self.exclusions.get(self.pipeline_name, {}).get(
             "VALIDATE_BASE_IMAGE_DATE"
         ):
-            self.validate_base_image_date(
+            self._validate_base_image_date(
                 matching_image,
                 self.remote_config["VALIDATE_BASE_IMAGE_DATE"]["REFERENCE_IMAGE_DATE"],
             )
@@ -114,7 +68,7 @@ class ContainerScaScan:
         if matching_image:
             image_name = matching_image.tags[0]
             result_file = image_name.replace("/", "_") + "_scan_result.json"
-            if image_name in self.get_images_already_scanned():
+            if image_name in self._get_images_already_scanned():
                 print(f"The image {image_name} has already been scanned previously.")
                 return image_scanned, base_image, sbom_components
             image_scanned, sbom_components = self.tool_run.run_tool_container_sca(
@@ -127,7 +81,7 @@ class ContainerScaScan:
                 self.exclusions,
                 generate_sbom,
             )
-            self.set_image_scanned(image_name)
+            self._set_image_scanned(image_name)
         else:
             print(f"'Not image found for {self.image_to_scan}'. Tool skipped.")
         return image_scanned, base_image, sbom_components
@@ -142,5 +96,52 @@ class ContainerScaScan:
         context_flag = self.context
         if context_flag == "true":
             self.tool_deseralizator.get_container_context_from_results(image_scanned)
-                    
+
         return self.tool_deseralizator.get_list_findings(image_scanned)
+
+    def _get_image(self, image_to_scan):
+        """
+        Process the list of images.
+
+        Returns:
+            list: List of processed images.
+        """
+        return self.tool_images.list_images(image_to_scan)
+
+    def _get_base_image(self, matching_image):
+        """
+        Process the base image.
+
+        Returns:
+            String: base image.
+        """
+        return self.tool_images.get_base_image(matching_image)
+
+    def _validate_base_image_date(self, matching_image, referenced_date):
+        """
+        Process the base image date validation.
+
+        Returns:
+            string: base image date.
+        """
+        return self.tool_images.validate_base_image_date(
+            matching_image, referenced_date
+        )
+
+    def _get_images_already_scanned(self):
+        """
+        Create images scanned file if it does not exist and get the images that have already been scanned.
+        """
+        scanned_images_file = os.path.join(os.getcwd(), "scanned_images.txt")
+        if not os.path.exists(scanned_images_file):
+            open(scanned_images_file, "w").close()
+        with open(scanned_images_file, "r") as file:
+            images_scanned = file.read().splitlines()
+        return images_scanned
+
+    def _set_image_scanned(self, result_file):
+        """
+        Write in scanned_images.txt the result file
+        """
+        with open("scanned_images.txt", "a") as file:
+            file.write(result_file + "\n")

devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/prisma_cloud/prisma_deserialize_output.py

@@ -30,7 +30,7 @@ class PrismaDeserealizator(DeseralizatorGateway):
             image_object = file.read()
 
             json_data = json.loads(image_object)
-            console_url = json_data.get("consoleURL",False)
+            console_url = json_data.get("consoleURL", False)
             if console_url:
                 print(f"Console URL: {console_url}")
             vulnerabilities_data = (
@@ -67,7 +67,7 @@ class PrismaDeserealizator(DeseralizatorGateway):
             list_open_vulnerabilities.extend(vulnerabilities)
 
         return list_open_vulnerabilities
-    
+
     def get_container_context_from_results(self, image_scanned):
-        #TODO: Implement this method
+        # TODO: Implement this method
         pass