devsecops-engine-tools 1.7.27__tar.gz → 1.7.28__tar.gz

{devsecops_engine_tools-1.7.27 → devsecops_engine_tools-1.7.28}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.7.27
+Version: 1.7.28
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.7.27 → devsecops_engine_tools-1.7.28}/devsecops_engine_tools/engine_sast/engine_iac/src/applications/runner_iac_scan.py

@@ -4,14 +4,23 @@ from devsecops_engine_tools.engine_sast.engine_iac.src.infrastructure.entry_poin
 from devsecops_engine_tools.engine_sast.engine_iac.src.infrastructure.driven_adapters.checkov.checkov_tool import (
     CheckovTool
 )
+from devsecops_engine_tools.engine_sast.engine_iac.src.infrastructure.driven_adapters.kubescape.kubescape_tool import (
+    KubescapeTool
+)
 
 
 def runner_engine_iac(dict_args, tool, secret_tool, devops_platform_gateway, env):
     try:
         # Define driven adapters for gateways
         tool_gateway = None
-        if (tool == "CHECKOV"):
-            tool_gateway = CheckovTool()
+
+        tools = {
+            "CHECKOV": CheckovTool(),
+            "KUBESCAPE": KubescapeTool(),
+        }
+
+        if tool in tools:
+            tool_gateway = tools[tool]
 
         return init_engine_sast_rm(
             devops_platform_gateway=devops_platform_gateway,

devsecops_engine_tools-1.7.28/devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kubescape/kubescape_deserealizator.py

@@ -0,0 +1,75 @@
+from devsecops_engine_tools.engine_core.src.domain.model.finding import (
+    Category,
+    Finding,
+)
+from datetime import datetime
+from dataclasses import dataclass
+
+
+@dataclass
+class KubescapeDeserealizator:
+    def get_list_finding(self, results_scan_list: list) -> "list[Finding]":
+        list_open_findings = []
+
+        for result in results_scan_list:
+            finding_open = Finding(
+                id=result.get("id"),
+                cvss=None,
+                where=result.get("where"),
+                description=result.get("description"),
+                severity=result.get("severity").lower(),
+                identification_date=datetime.now().strftime("%d%m%Y"),
+                published_date_cve=None,
+                module="engine_iac",
+                category=Category.VULNERABILITY,
+                requirements=None,
+                tool="kubescape"
+            )
+            list_open_findings.append(finding_open)
+
+        return list_open_findings
+
+    def extract_failed_controls(self, data):
+        result_extracted_data = []
+        results = data.get("results", [])
+        resources = {resource.get("resourceID"): resource for resource in data.get("resources", [])}
+        frameworks = data.get("summaryDetails", {}).get("frameworks", [])
+
+        for result in results:
+            resource_id = result.get("resourceID")
+            controls = result.get("controls", [])
+
+            for control in controls:
+                if control.get("status", {}).get("status") == "failed":
+                    control_id = control.get("controlID")
+                    name = control.get("name")
+                    resource = resources.get(resource_id)
+
+                    if resource:
+                        relative_path = resource.get("source", {}).get("path", "").replace("\\", "/")
+                        severity_score = self.get_severity_score(frameworks, control_id)
+
+                        result_extracted_data.append({
+                            "id": control_id,
+                            "description": name,
+                            "where": relative_path,
+                            "severity": severity_score
+                        })
+
+        return result_extracted_data
+
+    def get_severity_score(self, frameworks, control_id):
+        classifications = {
+            (0.0, 0.0): "none",
+            (0.1, 3.9): "low",
+            (4.0, 6.9): "medium",
+            (7.0, 8.9): "high",
+            (9.0, 10.0): "critical"
+        }
+        for framework in frameworks:
+            control_object = framework.get("controls", {}).get(control_id, {})
+            if control_object:
+                for range_tuple, classification in classifications.items():
+                    if range_tuple[0] <= control_object.get("scoreFactor", 0.0) <= range_tuple[1]:
+                        return classification
+        return None

devsecops_engine_tools-1.7.28/devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kubescape/kubescape_tool.py

@@ -0,0 +1,123 @@
+import json
+import subprocess
+import platform
+import requests
+import distro
+import os
+from devsecops_engine_tools.engine_sast.engine_iac.src.domain.model.gateways.tool_gateway import (
+    ToolGateway,
+)
+from devsecops_engine_tools.engine_sast.engine_iac.src.domain.model.config_tool import (
+    ConfigTool,
+)
+from devsecops_engine_tools.engine_sast.engine_iac.src.infrastructure.driven_adapters.kubescape.kubescape_deserealizator import (
+    KubescapeDeserealizator,
+)
+from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
+from devsecops_engine_tools.engine_utilities import settings
+
+logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
+
+
+class KubescapeTool(ToolGateway):
+
+    def download_tool(self, file, url):
+        try:
+            response = requests.get(url, allow_redirects=True)
+            with open(file, "wb") as binary_file:
+                binary_file.write(response.content)
+        except Exception as e:
+            logger.error(f"Error downloading Kubescape: {e}")
+
+    def install_tool(self, file, url):
+        installed = subprocess.run(
+            ["which", f"./{file}"],
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+        )
+        if installed.returncode == 1:
+            try:
+                self.download_tool(file, url)
+                subprocess.run(["chmod", "+x", f"./{file}"])
+
+            except Exception as e:
+                logger.error(f"Error installing Kubescape: {e}")
+
+    def install_tool_windows(self, file, url):
+        try:
+            subprocess.run(
+                [f"./{file}", "version"],
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+            )
+        except:
+            try:
+                self.download_tool(file, url)
+
+            except Exception as e:
+                logger.error(f"Error installing Kubescape: {e}")
+
+    def execute_kubescape(self, folders_to_scan, prefix):
+        command = [prefix, "scan"] + folders_to_scan + ["--format", "json", "--format-version", "v2", "--output",
+                                                        "results_kubescape.json", "-v"]
+        try:
+            subprocess.run(command, capture_output=True)
+        except subprocess.CalledProcessError as e:
+            logger.error(f"Error during Kubescape execution: {e}")
+
+    def load_json(self, json_name):
+        try:
+            with open(json_name) as file:
+                return json.load(file)
+        except FileNotFoundError:
+            logger.error(f"The file {json_name} does not exist.")
+        except json.JSONDecodeError:
+            logger.error("The JSON result is empty.")
+        return None
+
+    def select_operative_system(self, os_platform, folders_to_scan, base_url):
+        if os_platform == "Linux":
+            distro_name = distro.name()
+            if distro_name == "Ubuntu":
+                file = "kubescape-ubuntu-latest"
+                self.install_tool(file, base_url + file)
+                command_prefix = f"./{file}"
+            else:
+                logger.warning(f"{distro_name} is not supported.")
+                return None
+        elif os_platform == "Windows":
+            file = "kubescape-windows-latest.exe"
+            self.install_tool_windows(file, base_url + file)
+            command_prefix = f"./{file}"
+        elif os_platform == "Darwin":
+            file = "kubescape-macos-latest"
+            self.install_tool(file, base_url + file)
+            command_prefix = f"./{file}"
+        else:
+            logger.warning(f"{os_platform} is not supported.")
+            return [], None
+
+        self.execute_kubescape(folders_to_scan, command_prefix)
+
+    def run_tool(self, config_tool: ConfigTool, folders_to_scan, environment, platform_to_scan, secret_tool):
+
+        if folders_to_scan and "k8s" in platform_to_scan:
+
+            kubescape_version = config_tool.version
+            os_platform = platform.system()
+            base_url = f"https://github.com/kubescape/kubescape/releases/download/v{kubescape_version}/"
+            self.select_operative_system(os_platform, folders_to_scan, base_url)
+
+            json_name = "results_kubescape.json"
+            data = self.load_json(json_name)
+
+            if not data:
+                return [], None
+            else:
+                kubescape_deserealizator = KubescapeDeserealizator()
+                result_extracted_data = kubescape_deserealizator.extract_failed_controls(data)
+                finding_list = kubescape_deserealizator.get_list_finding(result_extracted_data)
+                path_results = os.path.abspath(json_name)
+            return finding_list, path_results
+        else:
+            return [], None

{devsecops_engine_tools-1.7.27 → devsecops_engine_tools-1.7.28}/devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/helpers/file_generator_tool.py

@@ -71,4 +71,4 @@ def update_fields(check_result, rules_doc):
     if "category" in rule_info:
         check_result["bc_category"] = rule_info["category"]
 
-    return check_result
+    return check_result

devsecops_engine_tools-1.7.28/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.7.28'

{devsecops_engine_tools-1.7.27 → devsecops_engine_tools-1.7.28}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.7.27
+Version: 1.7.28
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.7.27 → devsecops_engine_tools-1.7.28}/devsecops_engine_tools.egg-info/SOURCES.txt

@@ -105,6 +105,9 @@ devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_config.py
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_deserealizator.py
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_tool.py
+devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kubescape/__init__.py
+devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kubescape/kubescape_deserealizator.py
+devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kubescape/kubescape_tool.py
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/entry_points/__init__.py
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/entry_points/entry_point_tool.py
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/helpers/__init__.py

devsecops_engine_tools-1.7.27/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.7.27'