devsecops-engine-tools 1.63.1__tar.gz → 1.65.0__tar.gz

{devsecops_engine_tools-1.63.1 → devsecops_engine_tools-1.65.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.63.1
+Version: 1.65.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team
@@ -76,7 +76,7 @@ pip3 install devsecops-engine-tools
 ### Scan running - flags (CLI)
 
 ```bash
-devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_config_source ["local","azure","github"] --remote_config_repo ["remote_config_repo"] --remote_config_branch ["remote_config_branch"] --module ["engine_iac", "engine_dast", "engine_secret", "engine_dependencies", "engine_container", "engine_risk", "engine_code"] --tool ["nuclei", "bearer", "checkov", "kics", "kubescape", "trufflehog", "gitleaks", "prisma", "trivy", "xray", "dependency_check"] --folder_path ["Folder path scan engine_iac, engine_code, engine_dependencies and engine_secret"] --platform ["k8s","cloudformation","docker", "openapi", "terraform"] --use_secrets_manager ["false", "true"] --use_vulnerability_management ["false", "true"] --send_metrics ["false", "true"] --token_cmdb ["token_cmdb"] --token_vulnerability_management ["token_vulnerability_management"] --token_engine_container ["token_engine_container"] --token_engine_dependencies ["token_engine_dependencies"] --token_external_checks ["token_external_checks"] --xray_mode ["scan", "audit","build-scan"] --image_to_scan ["image_to_scan"] --dast_file_path ["dast_file_path"]
+devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_config_source ["local","azure","github"] --remote_config_repo ["remote_config_repo"] --remote_config_branch ["remote_config_branch"] --module ["engine_iac", "engine_dast", "engine_secret", "engine_dependencies", "engine_container", "engine_risk", "engine_code"] --tool ["nuclei", "bearer", "checkov", "kics", "kubescape", "trufflehog", "gitleaks", "prisma", "trivy", "xray", "dependency_check"] --folder_path ["Folder path scan engine_iac, engine_code, engine_dependencies and engine_secret"] --platform ["k8s","cloudformation","docker", "openapi", "terraform"] --use_secrets_manager ["false", "true"] --use_vulnerability_management ["false", "true"] --send_metrics ["false", "true"] --token_cmdb ["token_cmdb"] --token_vulnerability_management ["token_vulnerability_management"] --token_engine_container ["token_engine_container"] --token_engine_dependencies ["token_engine_dependencies"] --token_external_checks ["token_external_checks"] --xray_mode ["scan", "audit","build-scan"] --image_to_scan ["image_to_scan"] --dast_file_path ["dast_file_path"] --terraform_repo_root ["terraform_files_repo"]
 ```
 
 ### Structure Remote Config

{devsecops_engine_tools-1.63.1 → devsecops_engine_tools-1.65.0}/devsecops_engine_tools/engine_core/src/applications/runner_engine_core.py

@@ -218,7 +218,7 @@ def get_inputs_from_cli(args):
         type=str,
         required=False,
         default="false",
-        help="Enable or disable context creation. Applies only to engine_iac and engine_container. Default is false."
+        help="Enable or disable context creation. Applies to engine_iac, engine_container and engine_dependencies. Default is false."
     )
 
     TOOLS = {

devsecops_engine_tools-1.65.0/devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/model/ContextDependencies.py

@@ -0,0 +1,15 @@
+from dataclasses import dataclass
+from typing import List, Optional
+
+@dataclass
+class ContextDependencies:
+    cve_id: List[str]
+    severity: str
+    component: str
+    package_name: str
+    installed_version: str
+    fixed_version: Optional[List[str]]
+    impact_paths: Optional[List[List[dict]]]
+    description: str
+    references: Optional[List[str]]
+    source_tool: str

{devsecops_engine_tools-1.63.1 → devsecops_engine_tools-1.65.0}/devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/model/gateways/tool_gateway.py

@@ -4,6 +4,10 @@ from abc import ABCMeta, abstractmethod
 class ToolGateway(metaclass=ABCMeta):
     @abstractmethod
     def run_tool_dependencies_sca(
-        self, remote_config, dict_args,to_scan, secret_tool, token_engine_dependencies,**kwargs
+        self, remote_config, dict_args,to_scan, secret_tool, token_engine_dependencies, **kwargs
     ) -> str:
         "run tool dependencies sca"
+    
+    @abstractmethod
+    def get_dependencies_context_from_results(self, path_file_results, **kwargs) -> None:
+        "get_dependencies_context_from_results"

{devsecops_engine_tools-1.63.1 → devsecops_engine_tools-1.65.0}/devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/usecases/dependencies_sca_scan.py

@@ -39,7 +39,7 @@ class DependenciesScan:
 
         Return: dict: SCA scanning results.
         """
-        return self.tool_run.run_tool_dependencies_sca(
+        dependencies_scanned = self.tool_run.run_tool_dependencies_sca(
             self.remote_config,
             self.dict_args,
             self.exclusions,
@@ -50,6 +50,11 @@ class DependenciesScan:
             build_id=self.build_id,
             build_url=self.build_url
         )
+    
+        if self.dict_args.get("context") == "true":
+            self.tool_run.get_dependencies_context_from_results(dependencies_scanned, remote_config=self.remote_config)
+        
+        return dependencies_scanned
 
     def deserializator(self, dependencies_scanned):
         """

{devsecops_engine_tools-1.63.1 → devsecops_engine_tools-1.65.0}/devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/dependency_check/dependency_check_deserialize.py

@@ -22,7 +22,6 @@ class DependencyCheckDeserialize(DeserializatorGateway):
 
     def get_list_findings(self, dependencies_scanned_file, remote_config) -> "list[Finding]":
         dependencies, namespace = self.filter_vulnerabilities_by_confidence(dependencies_scanned_file, remote_config)
-
         list_open_vulnerabilities = []
 
         for dependency in dependencies:
@@ -30,30 +29,21 @@ class DependencyCheckDeserialize(DeserializatorGateway):
             if vulnerabilities_node:
                 vulnerabilities = vulnerabilities_node.findall('ns:vulnerability', namespace)
                 for vulnerability in vulnerabilities:
-                    fix = "Not found"
-                    vulnerable_software = vulnerability.find('ns:vulnerableSoftware', namespace)
-                    if vulnerable_software:
-                        software = vulnerable_software.findall('ns:software', namespace)
-                        if len(software) > 0:
-                            fix = software[0].get("versionEndExcluding", "Not found").lower()
-                    
-                    id = vulnerability.find('ns:name', namespace).text[:28]
-                    cvss = ", ".join(f"{child.tag.split('}')[-1]}: {child.text}" for child in vulnerability.find('ns:cvssV3', namespace)) if vulnerability.find('ns:cvssV3', namespace) else ""
-                    where = self.get_where(dependency, namespace)
-                    description = vulnerability.find('ns:description', namespace).text if vulnerability.find('ns:description', namespace).text else ""
-                    severity = vulnerability.find('ns:severity', namespace).text.lower()
-                    
+                    data = self.extract_common_vuln_data(vulnerability, dependency, namespace)
+                    cvss_node = vulnerability.find('ns:cvssV3', namespace)
+                    cvss = ", ".join(f"{child.tag.split('}')[-1]}: {child.text}" for child in cvss_node) if cvss_node else ""
+
                     finding_open = Finding(
-                        id=id,
+                        id=data["id"],
                         cvss=cvss,
-                        where=where,
-                        description=description[:120].replace("\n\n", " ").replace("\n", " ").strip() if len(description) > 0 else "No description available",
-                        severity=severity,
+                        where=data["where"],
+                        description=data["description"][:120].replace("\n\n", " ").replace("\n", " ").strip() if data["description"] else "No description available",
+                        severity=data["severity"],
                         identification_date=datetime.now().strftime("%d%m%Y"),
                         published_date_cve=None,
                         module="engine_dependencies",
                         category=Category.VULNERABILITY,
-                        requirements=fix,
+                        requirements=data["fix"] or "Not found",
                         tool="DEPENDENCY_CHECK",
                     )
                     list_open_vulnerabilities.append(finding_open)
@@ -169,4 +159,43 @@ class DependencyCheckDeserialize(DeserializatorGateway):
 
                 return f"{component_name}:{component_version}"
         
-        return ""
+        return ""
+    
+    def extract_fix_version(self, vulnerability, namespace):
+        fix = "Not found"
+        vulnerable_software = vulnerability.find('ns:vulnerableSoftware', namespace)
+        if vulnerable_software:
+            software = vulnerable_software.findall('ns:software', namespace)
+            if software:
+                fix = software[0].get("versionEndExcluding", "Not found").lower()
+        return fix if fix != "Not found" else None
+
+    def extract_common_vuln_data(self, vulnerability, dependency, namespace):
+        fix = self.extract_fix_version(vulnerability, namespace)
+        id = vulnerability.find('ns:name', namespace).text[:28]
+
+        where = self.get_where(dependency, namespace)
+
+        description = vulnerability.find('ns:description', namespace)
+        description_text = description.text if description is not None and description.text else ""
+
+        severity = vulnerability.find('ns:severity', namespace).text.lower()
+
+        return {
+            "id": id,
+            "fix": fix,
+            "where": where,
+            "description": description_text,
+            "severity": severity
+        }
+
+    def extract_references(self, vulnerability, namespace):
+        references_list = []
+        references_node = vulnerability.find('ns:references', namespace)
+        if references_node:
+            references = references_node.findall('ns:reference', namespace)
+            for ref in references:
+                url = ref.find('ns:url', namespace).text
+                if url:
+                    references_list.append(url)
+        return list(set(references_list))

{devsecops_engine_tools-1.63.1 → devsecops_engine_tools-1.65.0}/devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/dependency_check/dependency_check_tool.py

@@ -1,12 +1,20 @@
 from devsecops_engine_tools.engine_sca.engine_dependencies.src.domain.model.gateways.tool_gateway import (
     ToolGateway,
 )
+from devsecops_engine_tools.engine_sca.engine_dependencies.src.infrastructure.driven_adapters.dependency_check.dependency_check_deserialize import (
+    DependencyCheckDeserialize,
+)
+from devsecops_engine_tools.engine_sca.engine_dependencies.src.domain.model.ContextDependencies import (
+    ContextDependencies,
+)
 
 import requests
 import subprocess
 import os
 import platform
 import shutil
+from dataclasses import asdict
+import json
 
 from devsecops_engine_tools.engine_utilities.utils.utils import Utils
 from devsecops_engine_tools.engine_sca.engine_dependencies.src.infrastructure.helpers.get_artifacts import (
@@ -144,3 +152,44 @@ class DependencyCheckTool(ToolGateway):
         command_prefix = self.select_operative_system(cli_version)
         self.scan_dependencies(command_prefix, to_scan, token_engine_dependencies)
         return self.search_result()
+
+    def get_dependencies_context_from_results(self, path_file_results, remote_config):
+        deserializer = DependencyCheckDeserialize()
+        dependencies, namespace = deserializer.filter_vulnerabilities_by_confidence(path_file_results, remote_config)
+        context_dependencies_list = []
+
+        for dependency in dependencies:
+            vulnerabilities_node = dependency.find('ns:vulnerabilities', namespace)
+            if vulnerabilities_node:
+                vulnerabilities = vulnerabilities_node.findall('ns:vulnerability', namespace)
+                for vulnerability in vulnerabilities:
+                    data = deserializer.extract_common_vuln_data(vulnerability, dependency, namespace)
+                    references = deserializer.extract_references(vulnerability, namespace)
+
+                    context = ContextDependencies(
+                        cve_id=data["id"],
+                        severity=data["severity"],
+                        component=data["where"],
+                        package_name=data["where"].split(":")[0] if data["where"] else "",
+                        installed_version=data["where"].split(":")[2].lower() if len(data["where"].split(":")) == 3 else data["where"].split(":")[1].lower(),
+                        fixed_version=[data["fix"]] if data["fix"] else [],
+                        impact_paths=[],
+                        description=data["description"],
+                        references=references,
+                        source_tool="Dependency Check"
+                    )
+                    context_dependencies_list.append(context)
+
+        print("===== BEGIN CONTEXT OUTPUT =====")
+        print(
+            json.dumps(
+                {
+                    "dependencies_context": [
+                        asdict(context) for context in context_dependencies_list
+                    ]
+                },
+                indent=4,
+            )
+        )
+        print("===== END CONTEXT OUTPUT =====")
+        

{devsecops_engine_tools-1.63.1 → devsecops_engine_tools-1.65.0}/devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/xray_tool/xray_manager_scan.py

@@ -1,6 +1,9 @@
 from devsecops_engine_tools.engine_sca.engine_dependencies.src.domain.model.gateways.tool_gateway import (
     ToolGateway,
 )
+from devsecops_engine_tools.engine_sca.engine_dependencies.src.domain.model.ContextDependencies import (
+    ContextDependencies,
+)
 
 import subprocess
 import platform
@@ -8,6 +11,7 @@ import requests
 import re
 import os
 import json
+from dataclasses import asdict, dataclass
 
 from devsecops_engine_tools.engine_sca.engine_dependencies.src.infrastructure.helpers.get_artifacts import (
     GetArtifacts,
@@ -231,3 +235,53 @@ class XrayScan(ToolGateway):
         )
 
         return results_file
+
+    def get_dependencies_context_from_results(self, path_file_results, remote_config):
+        with open(path_file_results, "r") as file:
+            scan_results = json.load(file)
+            context_dependencies_list = []
+
+            for scan in scan_results:
+                vulnerabilities = scan.get("vulnerabilities", [])
+                for finding in vulnerabilities:
+                    cve_ids = [cve.get("cve") for cve in finding.get("cves", []) if cve.get("cve")]
+                    description = finding.get("summary", "")
+                    severity = finding.get("severity", "unknown").lower()
+                    references = finding.get("references", [])
+                    components = finding.get("components", {})
+                    component_list = list(components.keys()) if components else []
+                    for pkg_id, comp_data in components.items():
+                        fixed_version = comp_data.get("fixed_versions", [])
+                        impact_paths = comp_data.get("impact_paths", [])
+                        package_name = ""
+                        installed_version = ""
+                        if ":" in pkg_id:
+                            parts = pkg_id.split(":")
+                            package_name = parts[-2].replace("//", "")
+                            installed_version = parts[-1]
+                        context = ContextDependencies(
+                            cve_id=cve_ids,
+                            severity=severity,
+                            component=pkg_id,
+                            package_name=package_name,
+                            installed_version=installed_version,
+                            fixed_version=fixed_version,
+                            impact_paths=impact_paths,
+                            description=description,
+                            references=references,
+                            source_tool="Jfrog Xray"
+                        )
+                        context_dependencies_list.append(context)
+
+            print("===== BEGIN CONTEXT OUTPUT =====")
+            print(
+                json.dumps(
+                    {
+                        "dependencies_context": [
+                            asdict(context) for context in context_dependencies_list
+                        ]
+                    },
+                    indent=4,
+                )
+            )
+            print("===== END CONTEXT OUTPUT =====")

devsecops_engine_tools-1.65.0/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.65.0'

{devsecops_engine_tools-1.63.1 → devsecops_engine_tools-1.65.0}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.63.1
+Version: 1.65.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team
@@ -76,7 +76,7 @@ pip3 install devsecops-engine-tools
 ### Scan running - flags (CLI)
 
 ```bash
-devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_config_source ["local","azure","github"] --remote_config_repo ["remote_config_repo"] --remote_config_branch ["remote_config_branch"] --module ["engine_iac", "engine_dast", "engine_secret", "engine_dependencies", "engine_container", "engine_risk", "engine_code"] --tool ["nuclei", "bearer", "checkov", "kics", "kubescape", "trufflehog", "gitleaks", "prisma", "trivy", "xray", "dependency_check"] --folder_path ["Folder path scan engine_iac, engine_code, engine_dependencies and engine_secret"] --platform ["k8s","cloudformation","docker", "openapi", "terraform"] --use_secrets_manager ["false", "true"] --use_vulnerability_management ["false", "true"] --send_metrics ["false", "true"] --token_cmdb ["token_cmdb"] --token_vulnerability_management ["token_vulnerability_management"] --token_engine_container ["token_engine_container"] --token_engine_dependencies ["token_engine_dependencies"] --token_external_checks ["token_external_checks"] --xray_mode ["scan", "audit","build-scan"] --image_to_scan ["image_to_scan"] --dast_file_path ["dast_file_path"]
+devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_config_source ["local","azure","github"] --remote_config_repo ["remote_config_repo"] --remote_config_branch ["remote_config_branch"] --module ["engine_iac", "engine_dast", "engine_secret", "engine_dependencies", "engine_container", "engine_risk", "engine_code"] --tool ["nuclei", "bearer", "checkov", "kics", "kubescape", "trufflehog", "gitleaks", "prisma", "trivy", "xray", "dependency_check"] --folder_path ["Folder path scan engine_iac, engine_code, engine_dependencies and engine_secret"] --platform ["k8s","cloudformation","docker", "openapi", "terraform"] --use_secrets_manager ["false", "true"] --use_vulnerability_management ["false", "true"] --send_metrics ["false", "true"] --token_cmdb ["token_cmdb"] --token_vulnerability_management ["token_vulnerability_management"] --token_engine_container ["token_engine_container"] --token_engine_dependencies ["token_engine_dependencies"] --token_external_checks ["token_external_checks"] --xray_mode ["scan", "audit","build-scan"] --image_to_scan ["image_to_scan"] --dast_file_path ["dast_file_path"] --terraform_repo_root ["terraform_files_repo"]
 ```
 
 ### Structure Remote Config

{devsecops_engine_tools-1.63.1 → devsecops_engine_tools-1.65.0}/devsecops_engine_tools.egg-info/SOURCES.txt

@@ -234,6 +234,7 @@ devsecops_engine_tools/engine_sca/engine_dependencies/src/applications/runner_de
 devsecops_engine_tools/engine_sca/engine_dependencies/src/deployment/__init__.py
 devsecops_engine_tools/engine_sca/engine_dependencies/src/deployment/infrastructure/__init__.py
 devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/__init__.py
+devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/model/ContextDependencies.py
 devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/model/__init__.py
 devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/model/gateways/__init__.py
 devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/model/gateways/deserializator_gateway.py

devsecops_engine_tools-1.63.1/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.63.1'