devsecops-engine-tools 1.60.1__py3-none-any.whl → 1.61.1__py3-none-any.whl

devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kics/kics_tool.py

@@ -134,15 +134,15 @@ class KicsTool(ToolGateway):
                 if f"RULES_{platform}" not in config_tool[self.TOOL_KICS]["RULES"]:
                     logger.error(f"Platform {platform} not found in RULES")
                 queries = [
-                    {key: value["checkID"]}
-                    for key, value in config_tool[self.TOOL_KICS]["RULES"][
-                        f"RULES_{platform}"
-                    ].items()
-                ]
+                    {key: [value["checkID"], value["overrideID"]],
+                            "severity": value["severity"]}
+                           for key, value in config_tool[self.TOOL_KICS]["RULES"][f"RULES_{platform}"].items()
+                           ]
             return queries
         except Exception as e:
             logger.error(f"Error writing queries file: {e}")
 
+    
     def _execute_kics(
         self,
         folders_to_scan,
@@ -152,13 +152,14 @@ class KicsTool(ToolGateway):
         os_platform,
         queries,
     ):
-        folders = ",".join(folders_to_scan)
-        queries = ",".join([list(query.values())[0] for query in queries])
-        mapped_platforms = [
-            self.scan_type_platform_mapping.get(platform.lower(), platform)
-            for platform in platform_to_scan
-        ]
-        platforms = ",".join(mapped_platforms)
+        folders = ','.join(folders_to_scan)
+        queries = ','.join(
+            uuid for query in queries for uuid in list(query.values())[0]
+            ) if queries else ""
+        mapped_platforms = [ 
+                            self.scan_type_platform_mapping.get(platform.lower(), platform) 
+                            for platform in platform_to_scan ] if platform_to_scan != ["all"] else list(self.scan_type_platform_mapping.values())
+        platforms = ','.join(mapped_platforms)
 
         command = [
             prefix,
@@ -184,22 +185,33 @@ class KicsTool(ToolGateway):
             subprocess.run(command, capture_output=True)
         except subprocess.CalledProcessError as e:
             logger.error(f"Error during KICS execution: {e}")
-
+            return []
+            
     def _load_results(self, work_folder, queries):
         try:
             results_path = os.path.join(work_folder, "results.json")
             with open(results_path, "r") as f:
                 data = json.load(f)
 
+            query_id_to_info = {}
+            for query in queries:
+                severity = query.get("severity")
+                for custom_id, ids in query.items():
+                    if custom_id == "severity":
+                        continue
+                    for query_id in ids:
+                        if query_id != "":
+                            query_id_to_info[query_id] = {
+                                "severity": severity,
+                                "custom_id": custom_id
+                            }
+
             for finding in data.get("queries", []):
-                query_ids = {list(query.values())[0] for query in queries}
-                if finding.get("query_id") in query_ids:
-                    finding["custom_vuln_id"] = next(
-                        key
-                        for query in queries
-                        for key, value in query.items()
-                        if value == finding.get("query_id")
-                    )
+                query_id = finding.get("query_id")
+                if query_id in query_id_to_info:
+                    info = query_id_to_info[query_id]
+                    finding["severity"] = info["severity"].upper()
+                    finding["custom_id"] = info["custom_id"]
 
             with open(results_path, "w") as f:
                 json.dump(data, f, indent=4)
@@ -207,4 +219,4 @@ class KicsTool(ToolGateway):
             return data
         except Exception as ex:
             logger.error(f"An error occurred loading or modifying KICS results {ex}")
-            return None
+            return None

devsecops_engine_tools/engine_sast/engine_secret/src/infrastructure/driven_adapters/trufflehog/trufflehog_run.py

@@ -65,22 +65,23 @@ class TrufflehogRun(ToolGateway):
         tool,
         folder_path
     ):
+        path = agent_work_folder if folder_path is None else folder_path
         trufflehog_command = "trufflehog"
         if "Windows" in agent_os:
             trufflehog_command = f"{agent_temp_dir}/trufflehog.exe"
-        with open(f"{agent_work_folder}/excludedPath.txt", "w") as file:
+        with open(f"{path}/excludedPath.txt", "w") as file:
             file.write("\n".join(config_tool[tool]["EXCLUDE_PATH"]))
-        exclude_path = f"{agent_work_folder}/excludedPath.txt"
-        include_paths = self.config_include_path(files_commits, agent_work_folder, agent_os)
+        exclude_path = f"{path}/excludedPath.txt"
+        include_paths = self.config_include_path(files_commits, path, agent_os, folder_path)
         enable_custom_rules = config_tool[tool]["ENABLE_CUSTOM_RULES"]
         if enable_custom_rules:
-            Utils().configurate_external_checks(tool, config_tool, secret_tool, secret_external_checks, agent_work_folder)
+            Utils().configurate_external_checks(tool, config_tool, secret_tool, secret_external_checks, path)
 
         with concurrent.futures.ThreadPoolExecutor(max_workers=config_tool[tool]["NUMBER_THREADS"]) as executor:
             results = executor.map(
                 self.run_trufflehog,
                 [trufflehog_command] * len(include_paths),
-                [agent_work_folder] * len(include_paths),
+                [path] * len(include_paths),
                 [exclude_path] * len(include_paths),
                 include_paths,
                 [repository_name] * len(include_paths),
@@ -88,10 +89,10 @@ class TrufflehogRun(ToolGateway):
                 [agent_os] * len(include_paths),
                 [folder_path] * len(include_paths)
             )
-        findings, file_findings = self.create_file(self.decode_output(results), agent_work_folder, config_tool, tool)
+        findings, file_findings = self.create_file(self.decode_output(results), path, config_tool, tool)
         return  findings, file_findings
 
-    def config_include_path(self, files, agent_work_folder, agent_os):
+    def config_include_path(self, files, path, agent_os, folder_path):
         chunks = []
         if len(files) != 0:
             chunk_size = (len(files) + 3) // 4
@@ -102,19 +103,22 @@ class TrufflehogRun(ToolGateway):
         for i, chunk in enumerate(chunks):
             if not chunk:
                 continue
-            file_path = f"{agent_work_folder}/includePath{i}.txt"
+            file_path = f"{path}/includePath{i}.txt"
             include_paths.append(file_path)
             with open(file_path, "w") as file:
-                for file_pr_path in chunk:
-                    if "Windows" in agent_os:
-                        file_pr_path = str(file_pr_path).replace("/","\\\\")
-                    file.write(f"{file_pr_path.strip()}\n")
+                if folder_path is None:
+                    for file_pr_path in chunk:
+                        if "Windows" in agent_os:
+                            file_pr_path = str(file_pr_path).replace("/","\\\\")
+                        file.write(f"{file_pr_path.strip()}\n")
+                else:
+                    file.write(".\n")
         return include_paths
 
     def run_trufflehog(
         self,
         trufflehog_command,
-        agent_work_folder,
+        path,
         exclude_path,
         include_path,
         repository_name,
@@ -122,11 +126,11 @@ class TrufflehogRun(ToolGateway):
         agent_os,
         folder_path
     ):
-        path = agent_work_folder if folder_path is not None else f"{agent_work_folder}/{repository_name}"
-        command = f"{trufflehog_command} filesystem {path} --include-paths {include_path} --exclude-paths {exclude_path} --no-verification --no-update --json"
+        path_folder = folder_path if folder_path is not None else f"{path}/{repository_name}"
+        command = f"{trufflehog_command} filesystem {path_folder} --include-paths {include_path} --exclude-paths {exclude_path} --no-verification --no-update --json"
         if enable_custom_rules:
-            command = command.replace("--no-verification --no-update --json", f"--config {agent_work_folder}//rules//trufflehog//custom-rules.yaml --no-verification --no-update --json" if "Windows" in agent_os else
-                                      f"--config {agent_work_folder}/rules/trufflehog/custom-rules.yaml --no-verification --no-update --json" if "Linux" in agent_os else
+            command = command.replace("--no-verification --no-update --json", f"--config {path}//rules//trufflehog//custom-rules.yaml --no-verification --no-update --json" if "Windows" in agent_os else
+                                      f"--config {path}/rules/trufflehog/custom-rules.yaml --no-verification --no-update --json" if "Linux" in agent_os else
                                       "--no-verification --no-update --json")
             
         result = subprocess.run(command, capture_output=True, shell=True, text=True, encoding='utf-8')
@@ -142,13 +146,13 @@ class TrufflehogRun(ToolGateway):
                         result.append(json_obj)
         return result
     
-    def create_file(self, findings, agent_work_folder, config_tool, tool):
-        file_findings = os.path.join(agent_work_folder, "secret_scan_result.json")
+    def create_file(self, findings, path, config_tool, tool):
+        file_findings = os.path.join(path, "secret_scan_result.json")
         with open(file_findings, "w") as file:
             for find in findings:
                 original_where = str(find.get("SourceMetadata").get("Data").get("Filesystem").get("file"))
                 original_where = original_where.replace("\\", "/")
-                where_text = original_where.replace(agent_work_folder, "")
+                where_text = original_where.replace(path, "")
                 find["SourceMetadata"]["Data"]["Filesystem"]["file"] = where_text
                 find["Id"] = "MISCONFIGURATION_SCANNING" if "exposure" in find["Raw"] else "SECRET_SCANNING"
                 find["References"] = config_tool[tool]["RULES"][find["Id"]]["References"] if "SECRET_SCANNING" not in find["Id"] else "N.A"

devsecops_engine_tools/version.py

@@ -1 +1 @@
-version = '1.60.1'
+version = '1.61.1'

{devsecops_engine_tools-1.60.1.dist-info → devsecops_engine_tools-1.61.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.60.1
+Version: 1.61.1
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.60.1.dist-info → devsecops_engine_tools-1.61.1.dist-info}/RECORD

@@ -1,5 +1,5 @@
 devsecops_engine_tools/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-devsecops_engine_tools/version.py,sha256=2eJ-epiDFp3Ui5UGrGD6zOUsIepitJ-7wak1aWtkse0,19
+devsecops_engine_tools/version.py,sha256=M7ktlomi-CM1K63hkc3T1QEsOK54pt2anEUe-vEgj_8,19
 devsecops_engine_tools/engine_core/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_core/src/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_core/src/applications/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -156,7 +156,7 @@ devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_tool.py,sha256=JP_NZfnddbGYRyiLGCpQ8kNI0t7v1TNxt7sp6jBG98w,15183
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kics/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kics/kics_deserealizator.py,sha256=tZq3jutZL2M9XIxm5K_xd3mWwTCMVmHQPFNvrslCqCM,2092
-devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kics/kics_tool.py,sha256=cXIvtRcsnjkrokZUQ9l9gLzj7dOKjHiQZuglh_JIiQ0,7281
+devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kics/kics_tool.py,sha256=XFixGb1AAvcBQIJkB5E5j59bMbevkNsv7oN9skETBss,7961
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kubescape/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kubescape/kubescape_deserealizator.py,sha256=bGOGmsIpJcQzTMxptJPwZCA9_2Woaua3pXmMs4kTnX8,2893
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kubescape/kubescape_tool.py,sha256=1CpaqzDaXinPxM1lSceoaBpccJ3feHwkIdYe3SQjero,4870
@@ -185,7 +185,7 @@ devsecops_engine_tools/engine_sast/engine_secret/src/infrastructure/driven_adapt
 devsecops_engine_tools/engine_sast/engine_secret/src/infrastructure/driven_adapters/gitleaks/gitleaks_tool.py,sha256=tSsX5gtv_EzMYnhTzpRdxXT__eiqWELj1hS61N5t5ek,6006
 devsecops_engine_tools/engine_sast/engine_secret/src/infrastructure/driven_adapters/trufflehog/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_sast/engine_secret/src/infrastructure/driven_adapters/trufflehog/trufflehog_deserealizator.py,sha256=mrSqPrkMiikxQ_uY-rF2I8QvicsOMdMBzTC8CTV3Wk8,2392
-devsecops_engine_tools/engine_sast/engine_secret/src/infrastructure/driven_adapters/trufflehog/trufflehog_run.py,sha256=Gac3PzB7cFm2FMGOF3GLebapuFauqcAC7XB7sqPf9wI,8128
+devsecops_engine_tools/engine_sast/engine_secret/src/infrastructure/driven_adapters/trufflehog/trufflehog_run.py,sha256=icO8so_bB92hilWknivQPt1qi0QHGzZNDBIXMwVfMII,8160
 devsecops_engine_tools/engine_sast/engine_secret/src/infrastructure/entry_points/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_sast/engine_secret/src/infrastructure/entry_points/entry_point_tool.py,sha256=61OnP4ehmzh-tRbACgZsB4IJi6J6HT9E6KCOcuhvnRw,1185
 devsecops_engine_tools/engine_sca/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -351,8 +351,8 @@ devsecops_engine_tools/engine_utilities/utils/name_conversion.py,sha256=ADJrRGax
 devsecops_engine_tools/engine_utilities/utils/printers.py,sha256=amYAr9YQfYgR6jK9a2l26z3oovFPQ3FAKmhq6BKhEBA,623
 devsecops_engine_tools/engine_utilities/utils/session_manager.py,sha256=Z0fdhB3r-dxU0nGSD9zW_B4r2Qol1rUnUCkhFR0U-HQ,487
 devsecops_engine_tools/engine_utilities/utils/utils.py,sha256=HCjS900TBoNcHrC4LaiP-Kf9frVdtagF130qOUgnO2M,6757
-devsecops_engine_tools-1.60.1.dist-info/METADATA,sha256=CLxgokT0rl18zN5xadJSPaxe-jKJAugb3Y7K4cLgQRg,12005
-devsecops_engine_tools-1.60.1.dist-info/WHEEL,sha256=R0nc6qTxuoLk7ShA2_Y-UWkN8ZdfDBG2B6Eqpz2WXbs,91
-devsecops_engine_tools-1.60.1.dist-info/entry_points.txt,sha256=MHCTFFs9bdNKo6YcWCcBW2_8X6yTisgLOlmVx-V8Rxc,276
-devsecops_engine_tools-1.60.1.dist-info/top_level.txt,sha256=ge6y0X_xBAU1aG3EMWFtl9djbVyg5BxuSp2r2Lg6EQU,23
-devsecops_engine_tools-1.60.1.dist-info/RECORD,,
+devsecops_engine_tools-1.61.1.dist-info/METADATA,sha256=UAuwH0chYCGCeJo-bRKWcp64vNnJDFvVwRUuZpoAGvk,12005
+devsecops_engine_tools-1.61.1.dist-info/WHEEL,sha256=R0nc6qTxuoLk7ShA2_Y-UWkN8ZdfDBG2B6Eqpz2WXbs,91
+devsecops_engine_tools-1.61.1.dist-info/entry_points.txt,sha256=MHCTFFs9bdNKo6YcWCcBW2_8X6yTisgLOlmVx-V8Rxc,276
+devsecops_engine_tools-1.61.1.dist-info/top_level.txt,sha256=ge6y0X_xBAU1aG3EMWFtl9djbVyg5BxuSp2r2Lg6EQU,23
+devsecops_engine_tools-1.61.1.dist-info/RECORD,,