devsecops-engine-tools 1.7.11__tar.gz → 1.7.12__tar.gz

{devsecops_engine_tools-1.7.11 → devsecops_engine_tools-1.7.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.7.11
+Version: 1.7.12
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.7.11 → devsecops_engine_tools-1.7.12}/devsecops_engine_tools/engine_core/src/domain/usecases/handle_scan.py

@@ -128,6 +128,13 @@ class HandleScan:
                 config_tool["ENGINE_SECRET"]["TOOL"],
                 self.devops_platform_gateway
             )
+            if (
+                dict_args["use_vulnerability_management"] == "true"
+                and input_core.path_file_results
+            ):
+                self._use_vulnerability_management(
+                    config_tool, input_core, dict_args, secret_tool, env
+                )
             return findings_list, input_core
         elif "engine_dependencies" in dict_args["tool"]:
             if secret_tool is not None:

{devsecops_engine_tools-1.7.11 → devsecops_engine_tools-1.7.12}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/defect_dojo/defect_dojo.py

@@ -53,6 +53,7 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                 "CHECKOV": "Checkov Scan",
                 "PRISMA": "Twistlock Image Scan",
                 "XRAY": "JFrog Xray On Demand Binary Scan",
+                "TRUFFLEHOG": "Trufflehog Scan",
             }
 
             if any(
@@ -60,7 +61,7 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                 for branch in vulnerability_management.config_tool[
                     "VULNERABILITY_MANAGER"
                 ]["BRANCH_FILTER"].split(",")
-            ):
+            ) or (vulnerability_management.dict_args["tool"] == 'engine_secret'):
                 request: ImportScanRequest = Connect.cmdb(
                     cmdb_mapping={
                         "product_type_name": "nombreevc",

{devsecops_engine_tools-1.7.11 → devsecops_engine_tools-1.7.12}/devsecops_engine_tools/engine_sast/engine_secret/src/domain/usecases/secret_scan.py

@@ -28,16 +28,10 @@ class SecretScan:
         self.tool_deserialize = tool_deserialize
         self.git_gateway = git_gateway
 
-    def process(self, dict_args, tool):
-        tool = str(tool).lower()
-        init_config_tool = self.devops_platform_gateway.get_remote_config(
-            dict_args["remote_config_repo"], "engine_sast/engine_secret/ConfigTool.json"
-        )
-        config_tool, skip_tool = self.complete_config_tool(
-            init_config_tool, tool
-        )
+    def process(self, skip_tool, config_tool):
         finding_list = []
-        if skip_tool == "false":
+        file_path_findings = ""
+        if skip_tool == False:
             self.tool_gateway.install_tool(self.devops_platform_gateway.get_variable("os"), self.devops_platform_gateway.get_variable("temp_directory"))
             files_pullrequest = self.git_gateway.get_files_pull_request(
                 self.devops_platform_gateway.get_variable("work_folder"),
@@ -49,24 +43,40 @@ class SecretScan:
                 self.devops_platform_gateway.get_variable("project_name"),
                 self.devops_platform_gateway.get_variable("repository"),
                 self.devops_platform_gateway.get_variable("repository_provider"))
-            finding_list = self.tool_deserialize.get_list_vulnerability(
-                self.tool_gateway.run_tool_secret_scan(
+            findings, file_path_findings = self.tool_gateway.run_tool_secret_scan(
                     files_pullrequest,
                     config_tool.exclude_path,
                     self.devops_platform_gateway.get_variable("os"),
                     self.devops_platform_gateway.get_variable("work_folder"),
                     config_tool.number_threads,
                     self.devops_platform_gateway.get_variable("repository")
-                    ),
+                    )
+            finding_list = self.tool_deserialize.get_list_vulnerability(
+                findings,
                 self.devops_platform_gateway.get_variable("os"),
                 self.devops_platform_gateway.get_variable("work_folder")
                 )
-        return finding_list, config_tool
+        return finding_list, file_path_findings
     
-    def complete_config_tool(self, data_file_tool, tool):
-        config_tool = DeserializeConfigTool(json_data=data_file_tool, tool=tool)
+    def complete_config_tool(self, dict_args, tool):
+        tool = str(tool).lower()
+        init_config_tool = self.devops_platform_gateway.get_remote_config(
+            dict_args["remote_config_repo"], "engine_sast/engine_secret/ConfigTool.json"
+        )
+        config_tool = DeserializeConfigTool(json_data=init_config_tool, tool=tool)
         config_tool.scope_pipeline = self.devops_platform_gateway.get_variable("pipeline_name")
-        skip_tool = "false"
-        if config_tool.scope_pipeline in config_tool.ignore_search_pattern:
-            skip_tool = "true"
-        return config_tool, skip_tool
+        return config_tool
+        
+    def skip_from_exclusion(self, exclusions):
+        """
+        Handle skip tool.
+
+        Return: bool: True -> skip tool, False -> not skip tool.
+        """
+        pipeline_name = self.devops_platform_gateway.get_variable("pipeline_name")
+        if (pipeline_name in exclusions) and (
+            exclusions[pipeline_name].get("SKIP_TOOL", 0)
+        ):
+            return True
+        else:
+            return False

{devsecops_engine_tools-1.7.11 → devsecops_engine_tools-1.7.12}/devsecops_engine_tools/engine_sast/engine_secret/src/domain/usecases/set_input_core.py

@@ -37,19 +37,20 @@ class SetInputCore:
         list_exclusions = []
         for key, value in exclusions_data.items():
             if (key == "All") or (key == pipeline_name):
-                exclusions = [
-                    Exclusions(
-                        id=item.get("id", ""),
-                        where=item.get("where", ""),
-                        create_date=item.get("create_date", ""),
-                        expired_date=item.get("expired_date", ""),
-                        severity=item.get("severity", ""),
-                        hu=item.get("hu", ""),
-                        reason=item.get("reason", "Risk acceptance"),
-                    )
-                    for item in value[tool]
-                ]
-                list_exclusions.extend(exclusions)
+                if value.get(tool, 0):
+                    exclusions = [
+                        Exclusions(
+                            id=item.get("id", ""),
+                            where=item.get("where", ""),
+                            create_date=item.get("create_date", ""),
+                            expired_date=item.get("expired_date", ""),
+                            severity=item.get("severity", ""),
+                            hu=item.get("hu", ""),
+                            reason=item.get("reason", "Risk acceptance"),
+                        )
+                        for item in value[tool]
+                    ]
+                    list_exclusions.extend(exclusions)
         return list_exclusions
 
     def set_input_core(self, finding_list):

{devsecops_engine_tools-1.7.11 → devsecops_engine_tools-1.7.12}/devsecops_engine_tools/engine_sast/engine_secret/src/infrastructure/driven_adapters/trufflehog/trufflehog_run.py

@@ -1,4 +1,5 @@
 import json
+import os
 import re
 import subprocess
 import concurrent.futures
@@ -61,7 +62,8 @@ class TrufflehogRun(ToolGateway):
                 include_paths,
                 [repository_name] * len(include_paths),
             )
-        return self.decode_output(results)
+        findings, file_findings = self.create_file(self.decode_output(results), agent_work_folder)
+        return  findings, file_findings
 
     def config_include_path(self, files, agent_work_folder):
         chunks = []
@@ -102,3 +104,15 @@ class TrufflehogRun(ToolGateway):
                     if json_obj not in result:
                         result.append(json_obj)
         return result
+    
+    def create_file(self, findings, agent_work_folder):
+        file_findings = os.path.join(agent_work_folder, "secret_scan_result.json")
+        with open(file_findings, "w") as file:
+            for find in findings:
+                original_where = str(find.get("SourceMetadata").get("Data").get("Filesystem").get("file"))
+                original_where = original_where.replace("\\", "/")
+                where_text = original_where.replace(agent_work_folder, "")
+                find["SourceMetadata"]["Data"]["Filesystem"]["file"] = where_text
+                json_str = json.dumps(find)
+                file.write(json_str + '\n')
+        return findings, file_findings

devsecops_engine_tools-1.7.12/devsecops_engine_tools/engine_sast/engine_secret/src/infrastructure/entry_points/entry_point_tool.py

@@ -0,0 +1,17 @@
+import sys
+from devsecops_engine_tools.engine_sast.engine_secret.src.domain.usecases.secret_scan import SecretScan
+from devsecops_engine_tools.engine_sast.engine_secret.src.domain.usecases.set_input_core import (
+    SetInputCore,
+)
+
+def engine_secret_scan(devops_platform_gateway, tool_gateway, dict_args, tool, tool_deserealizator, git_gateway):
+    sys.stdout.reconfigure(encoding='utf-8')
+    exclusions = devops_platform_gateway.get_remote_config(
+        dict_args["remote_config_repo"], "engine_sast/engine_secret/Exclusions.json"
+    )
+    secret_scan = SecretScan(tool_gateway, devops_platform_gateway, tool_deserealizator, git_gateway)
+    config_tool = secret_scan.complete_config_tool(dict_args, tool)
+    skip_tool = secret_scan.skip_from_exclusion(exclusions)
+    finding_list, file_path_findings = secret_scan.process(skip_tool, config_tool)
+    input_core = SetInputCore(devops_platform_gateway, dict_args, tool, config_tool)
+    return finding_list, input_core.set_input_core(file_path_findings)

devsecops_engine_tools-1.7.12/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.7.12'

{devsecops_engine_tools-1.7.11 → devsecops_engine_tools-1.7.12}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.7.11
+Version: 1.7.12
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

devsecops_engine_tools-1.7.11/devsecops_engine_tools/engine_sast/engine_secret/src/infrastructure/entry_points/entry_point_tool.py

@@ -1,11 +0,0 @@
-import sys
-from devsecops_engine_tools.engine_sast.engine_secret.src.domain.usecases.secret_scan import SecretScan
-from devsecops_engine_tools.engine_sast.engine_secret.src.domain.usecases.set_input_core import (
-    SetInputCore,
-)
-
-def engine_secret_scan(devops_platform_gateway, tool_gateway, dict_args, tool, tool_deserealizator, git_gateway):
-    sys.stdout.reconfigure(encoding='utf-8')
-    finding_list, config_tool = SecretScan(tool_gateway, devops_platform_gateway, tool_deserealizator, git_gateway).process(dict_args, tool)
-    input_core = SetInputCore(devops_platform_gateway, dict_args, tool, config_tool)
-    return finding_list, input_core.set_input_core(finding_list)

devsecops_engine_tools-1.7.11/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.7.11'