devsecops-engine-tools 1.7.29__tar.gz → 1.7.31__tar.gz

{devsecops_engine_tools-1.7.29 → devsecops_engine_tools-1.7.31}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.7.29
+Version: 1.7.31
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team
@@ -98,13 +98,17 @@ devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_con
     <th>Type</th>
   </tr>
   <tr>
-    <td rowspan="2">ENGINE_IAC</td>
+    <td rowspan="3">ENGINE_IAC</td>
     <td><a href="https://www.checkov.io/">CHECKOV</a></td>
     <td>Free</td>
   </tr>
   <tr>
     <td><a href="https://kubescape.io/">KUBESCAPE</a></td>
     <td>Free</td>
+  </tr>
+  <tr>
+    <td><a href="https://www.kics.io/">KICS</a></td>
+    <td>Free</td>
   </tr>
    <tr>
     <td>ENGINE_DAST</td>
@@ -150,6 +154,57 @@ devsecops-engine-tools --platform_devops local --remote_config_repo DevSecOps_Re
 
 ![Dashboard Grafana](docs/demo_session.svg)
 
+### Scan running sample - Github Actions
+
+The remote config should be in a GitHub repository, either public or private.
+
+**If the repository is public:** 
+
+1. The yml file containing the workflow should be configured using the default secret **GITHUB_TOKEN**. 
+For more information, refer to [Automatic token authentication](https://docs.github.com/en/actions/security-guides/automatic-token-authentication).
+
+**If the repository is private:** 
+
+1. Create a personal access token with the necessary permissions to access the repository.
+2. Add the token as a secret in the GitHub repository.
+    ![Dashboard Grafana](docs/secret_token.png)
+
+3. Configure the yml file containing the workflow using the created secret.
+
+**Example of the workflow yml:**
+
+```yaml
+name: DevSecOps Engine Tools
+on:
+  push:
+    branches:
+      - feature/*
+env:
+  GITHUB_ACCESS_TOKEN: ${{ secrets.GH_ACCESSTOKEN }} #In this case, the remote config repository is private
+  # When the remote config repository is public, the secret should be like this: ${{ secrets.GITHUB_TOKEN }}
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Set up Python
+        run: |
+          # Install devsecops-engine-tools
+          pip3 install -q devsecops-engine-tools
+          output=$(devsecops-engine-tools --platform_devops github --remote_config_repo remote_config --tool engine_iac)
+          echo "$output"
+          if [[ $output == *"✘Failed"* ]]; then
+            exit 1
+          fi
+```
+
 # Metrics
 
 With the flag **--send_metrics true** and the configuration of the AWS-METRICS_MANAGER driven adapter in ConfigTool.json of the engine_core the tool will send the report to bucket s3. In the [metrics](https://github.com/bancolombia/devsecops-engine-tools/blob/trunk/metrics/) folder you will find the base of the cloud formation template to deploy the infra and dashboard in grafana.

{devsecops_engine_tools-1.7.29 → devsecops_engine_tools-1.7.31}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/defect_dojo/defect_dojo.py

@@ -55,6 +55,8 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                 "XRAY": "JFrog Xray On Demand Binary Scan",
                 "TRUFFLEHOG": "Trufflehog Scan",
                 "TRIVY": "Trivy Scan",
+                "KUBESCAPE": "Kubescape Scanner",
+                "KICS": "KICS Scanner"
             }
 
             if any(

{devsecops_engine_tools-1.7.29 → devsecops_engine_tools-1.7.31}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/github/github_actions.py

@@ -11,12 +11,12 @@ from devsecops_engine_tools.engine_utilities.github.models.GithubPredefinedVaria
 from devsecops_engine_tools.engine_utilities.github.infrastructure.github_api import (
     GithubApi,
 )
-import os
 
 
 @dataclass
 class GithubActions(DevopsPlatformGateway):
     OKGREEN = "\033[92m"
+    WARNING = "\033[93m"
     FAIL = "\033[91m"
     ENDC = "\033[0m"
     ICON_FAIL = "\u2718"
@@ -49,7 +49,8 @@ class GithubActions(DevopsPlatformGateway):
     def result_pipeline(self, type):
         results = {
             "failed": f"{self.FAIL}{self.ICON_FAIL}Failed{self.ENDC}",
-            "succeeded": f"{self.OKGREEN}{self.ICON_SUCCESS}Succeeded{self.ENDC}"
+            "succeeded": f"{self.OKGREEN}{self.ICON_SUCCESS}Succeeded{self.ENDC}",
+            "succeeded_with_issues": f"{self.WARNING}{self.ICON_SUCCESS}Succeeded with issues{self.ENDC}"
         }
         return results.get(type)
 
@@ -77,10 +78,10 @@ class GithubActions(DevopsPlatformGateway):
             "repository": BuildVariables.github_repository,
             "pipeline_name": (
                 BuildVariables.github_workflow
-                if SystemVariables.build.value() == "build"
+                if SystemVariables.github_job.value() == "build"
                 else ReleaseVariables.github_workflow
             ),
-            "stage": SystemVariables.build,
+            "stage": SystemVariables.github_job,
             "path_directory": SystemVariables.github_workspace,
             "os": AgentVariables.runner_os,
             "work_folder": AgentVariables.github_workspace,

{devsecops_engine_tools-1.7.29 → devsecops_engine_tools-1.7.31}/devsecops_engine_tools/engine_sast/engine_iac/src/applications/runner_iac_scan.py

@@ -7,6 +7,9 @@ from devsecops_engine_tools.engine_sast.engine_iac.src.infrastructure.driven_ada
 from devsecops_engine_tools.engine_sast.engine_iac.src.infrastructure.driven_adapters.kubescape.kubescape_tool import (
     KubescapeTool
 )
+from devsecops_engine_tools.engine_sast.engine_iac.src.infrastructure.driven_adapters.kics.kics_tool import (
+    KicsTool
+)
 
 
 def runner_engine_iac(dict_args, tool, secret_tool, devops_platform_gateway, env):
@@ -17,6 +20,7 @@ def runner_engine_iac(dict_args, tool, secret_tool, devops_platform_gateway, env
         tools = {
             "CHECKOV": CheckovTool(),
             "KUBESCAPE": KubescapeTool(),
+            "KICS": KicsTool()
         }
 
         if tool in tools:

{devsecops_engine_tools-1.7.29 → devsecops_engine_tools-1.7.31}/devsecops_engine_tools/engine_sast/engine_iac/src/domain/model/config_tool.py

@@ -21,3 +21,13 @@ class ConfigTool:
         self.exclusions_all = None
         self.exclusions_scope = None
         self.rules_all = {}
+        if "KICS_LINUX" in json_data[tool]:
+            self.kics_linux = json_data[tool]["KICS_LINUX"]
+        if "KICS_WINDOWS" in json_data[tool]:
+            self.kics_windows = json_data[tool]["KICS_WINDOWS"]
+        if "KICS_MAC" in json_data[tool]:
+            self.kics_mac = json_data[tool]["KICS_MAC"]
+        if "PATH_KICS" in json_data[tool]:
+            self.path_kics = json_data[tool]["PATH_KICS"]
+        if "DOWNLOAD_KICS_ASSETS" in json_data[tool]:
+            self.download_kics_assets = json_data[tool]["DOWNLOAD_KICS_ASSETS"]

devsecops_engine_tools-1.7.31/devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kics/kics_deserealizator.py

@@ -0,0 +1,57 @@
+from devsecops_engine_tools.engine_core.src.domain.model.finding import (
+    Category,
+    Finding,
+)
+from datetime import datetime
+from dataclasses import dataclass
+
+
+@dataclass
+class KicsDeserealizator:
+    def get_list_finding(self, results_scan_list: list) -> "list[Finding]":
+        list_open_findings = []
+
+        for result in results_scan_list:
+            finding_open = Finding(
+                id=result.get("id"),
+                cvss=None,
+                where=result.get("file_name"),
+                description=result.get("description"),
+                severity=result.get("severity").lower(),
+                identification_date=datetime.now().strftime("%d%m%Y"),
+                published_date_cve=None,
+                module="engine_iac",
+                category=Category.VULNERABILITY,
+                requirements=None,
+                tool="Kics"
+            )
+            list_open_findings.append(finding_open)
+
+        return list_open_findings
+
+    def get_findings(self, data):
+        filtered_results = []
+        for query in data.get("queries", []):
+            severity = query.get("severity", "").upper()
+            if severity in {"LOW", "MEDIUM", "HIGH", "CRITICAL"}:
+                description = query.get("query_name", "")
+                query_id = query.get("query_id", "")
+                for file in query.get("files", []):
+                    file_name = file.get("file_name", "")
+                    filtered_results.append({
+                        "severity": severity,
+                        "description": description,
+                        "file_name": file_name,
+                        "id": query_id
+                    })
+        return filtered_results
+
+    def calculate_total_vulnerabilities(self, data):
+        severity_counters = data.get("severity_counters", {})
+
+        critical = severity_counters.get("CRITICAL", 0)
+        high = severity_counters.get("HIGH", 0)
+        medium = severity_counters.get("MEDIUM", 0)
+        low = severity_counters.get("LOW", 0)
+
+        return critical + high + medium + low

devsecops_engine_tools-1.7.31/devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kics/kics_tool.py

@@ -0,0 +1,140 @@
+import subprocess
+import json
+import platform
+import requests
+import os
+from devsecops_engine_tools.engine_sast.engine_iac.src.domain.model.gateways.tool_gateway import (
+    ToolGateway,
+)
+from devsecops_engine_tools.engine_sast.engine_iac.src.domain.model.config_tool import (
+    ConfigTool,
+)
+from devsecops_engine_tools.engine_sast.engine_iac.src.infrastructure.driven_adapters.kics.kics_deserealizator import (
+    KicsDeserealizator
+)
+from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
+from devsecops_engine_tools.engine_utilities import settings
+from devsecops_engine_tools.engine_utilities.github.infrastructure.github_api import GithubApi
+
+logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
+
+
+class KicsTool(ToolGateway):
+
+    def download(self, file, url):
+        try:
+            response = requests.get(url)
+            with open(file, "wb") as f:
+                f.write(response.content)
+        except Exception as ex:
+            logger.error(f"An error ocurred downloading {file} {ex}")
+
+    def install_tool(self, file, url, command_prefix):
+        github_api = GithubApi()
+        kics = f"./{command_prefix}/kics"
+        installed = subprocess.run(
+            ["which", command_prefix],
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+        )
+        if installed.returncode == 1:
+            try:
+                self.download(file, url)
+                github_api.unzip_file(file, command_prefix)
+                subprocess.run(["chmod", "+x", kics])
+                return kics
+            except Exception as e:
+                logger.error(f"Error installing KICS: {e}")
+        else:
+            return command_prefix
+
+    def install_tool_windows(self, file, url, command_prefix):
+        try:
+            subprocess.run(
+                [command_prefix, "version"],
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+            )
+            return command_prefix
+        except:
+            try:
+                github_api = GithubApi()
+                self.download(file, url)
+                github_api.unzip_file(file, command_prefix)
+                return f"./{command_prefix}/kics"
+
+            except Exception as e:
+                logger.error(f"Error installing KICS: {e}")
+
+    def execute_kics(self, folders_to_scan, prefix):
+        folders = ','.join(folders_to_scan)
+        command = [prefix, "scan", "-p", folders, "-q", "./kics_assets/assets", "--report-formats", "json", "-o", "./"]
+        try:
+            subprocess.run(command, capture_output=True)
+        except subprocess.CalledProcessError as e:
+            logger.error(f"Error during KICS execution: {e}")
+
+    def load_results(self):
+        try:
+            with open('results.json') as f:
+                data = json.load(f)
+            return data
+        except Exception as ex:
+            logger.error(f"An error ocurred loading KICS results {ex}")
+            return None
+
+    def select_operative_system(self, os_platform, folders_to_scan, config_tool: ConfigTool, path_kics):
+        command_prefix = path_kics
+        if os_platform == "Linux":
+            kics_zip = "kics_linux.zip"
+            url_kics = config_tool.kics_linux
+            command_prefix = self.install_tool(kics_zip, url_kics, command_prefix)
+        elif os_platform == "Windows":
+            kics_zip = "kics_windows.zip"
+            url_kics = config_tool.kics_windows
+            command_prefix = self.install_tool_windows(kics_zip, url_kics, command_prefix)
+        elif os_platform == "Darwin":
+            kics_zip = "kics_macos.zip"
+            url_kics = config_tool.kics_mac
+            command_prefix = self.install_tool(kics_zip, url_kics, command_prefix)
+        else:
+            logger.warning(f"{os_platform} is not supported.")
+            return [], None
+
+        self.execute_kics(folders_to_scan, command_prefix)
+
+    def get_assets(self, kics_version):
+        name_zip = "assets_compressed.zip"
+        assets_url = f"https://github.com/Checkmarx/kics/releases/download/v{kics_version}/extracted-info.zip"
+        self.download(name_zip, assets_url)
+
+        directory_assets = "kics_assets"
+        github_api = GithubApi()
+        github_api.unzip_file(name_zip, directory_assets)
+
+    def run_tool(
+            self, config_tool: ConfigTool, folders_to_scan, environment, platform_to_scan, secret_tool
+    ):
+        kics_version = config_tool.version
+        path_kics = config_tool.path_kics
+        download_kics_assets = config_tool.download_kics_assets
+        if download_kics_assets:
+            self.get_assets(kics_version)
+
+        os_platform = platform.system()
+        self.select_operative_system(os_platform, folders_to_scan, config_tool, path_kics)
+
+        data = self.load_results()
+        if data:
+            kics_deserealizator = KicsDeserealizator()
+            total_vulnerabilities = kics_deserealizator.calculate_total_vulnerabilities(data)
+            path_file = os.path.abspath("results.json")
+
+            if total_vulnerabilities == 0:
+                return [], path_file
+
+            filtered_results = kics_deserealizator.get_findings(data)
+            finding_list = kics_deserealizator.get_list_finding(filtered_results)
+
+            return finding_list, path_file
+        return [], None

{devsecops_engine_tools-1.7.29 → devsecops_engine_tools-1.7.31}/devsecops_engine_tools/engine_utilities/github/models/GithubPredefinedVariables.py

@@ -24,7 +24,7 @@ class BaseEnum(Enum):
 class SystemVariables(BaseEnum):
     github_access_token = "github.access.token"
     github_workspace = "github.workspace"
-    build = "build"
+    github_job = "github.job"
     github_server_url = "github.server.url"
     github_repository = "github.repository"
     github_event_number = "github.event.number"

devsecops_engine_tools-1.7.31/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.7.31'

{devsecops_engine_tools-1.7.29 → devsecops_engine_tools-1.7.31}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.7.29
+Version: 1.7.31
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team
@@ -98,13 +98,17 @@ devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_con
     <th>Type</th>
   </tr>
   <tr>
-    <td rowspan="2">ENGINE_IAC</td>
+    <td rowspan="3">ENGINE_IAC</td>
     <td><a href="https://www.checkov.io/">CHECKOV</a></td>
     <td>Free</td>
   </tr>
   <tr>
     <td><a href="https://kubescape.io/">KUBESCAPE</a></td>
     <td>Free</td>
+  </tr>
+  <tr>
+    <td><a href="https://www.kics.io/">KICS</a></td>
+    <td>Free</td>
   </tr>
    <tr>
     <td>ENGINE_DAST</td>
@@ -150,6 +154,57 @@ devsecops-engine-tools --platform_devops local --remote_config_repo DevSecOps_Re
 
 ![Dashboard Grafana](docs/demo_session.svg)
 
+### Scan running sample - Github Actions
+
+The remote config should be in a GitHub repository, either public or private.
+
+**If the repository is public:** 
+
+1. The yml file containing the workflow should be configured using the default secret **GITHUB_TOKEN**. 
+For more information, refer to [Automatic token authentication](https://docs.github.com/en/actions/security-guides/automatic-token-authentication).
+
+**If the repository is private:** 
+
+1. Create a personal access token with the necessary permissions to access the repository.
+2. Add the token as a secret in the GitHub repository.
+    ![Dashboard Grafana](docs/secret_token.png)
+
+3. Configure the yml file containing the workflow using the created secret.
+
+**Example of the workflow yml:**
+
+```yaml
+name: DevSecOps Engine Tools
+on:
+  push:
+    branches:
+      - feature/*
+env:
+  GITHUB_ACCESS_TOKEN: ${{ secrets.GH_ACCESSTOKEN }} #In this case, the remote config repository is private
+  # When the remote config repository is public, the secret should be like this: ${{ secrets.GITHUB_TOKEN }}
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Set up Python
+        run: |
+          # Install devsecops-engine-tools
+          pip3 install -q devsecops-engine-tools
+          output=$(devsecops-engine-tools --platform_devops github --remote_config_repo remote_config --tool engine_iac)
+          echo "$output"
+          if [[ $output == *"✘Failed"* ]]; then
+            exit 1
+          fi
+```
+
 # Metrics
 
 With the flag **--send_metrics true** and the configuration of the AWS-METRICS_MANAGER driven adapter in ConfigTool.json of the engine_core the tool will send the report to bucket s3. In the [metrics](https://github.com/bancolombia/devsecops-engine-tools/blob/trunk/metrics/) folder you will find the base of the cloud formation template to deploy the infra and dashboard in grafana.

{devsecops_engine_tools-1.7.29 → devsecops_engine_tools-1.7.31}/devsecops_engine_tools.egg-info/SOURCES.txt

@@ -105,6 +105,9 @@ devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_config.py
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_deserealizator.py
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_tool.py
+devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kics/__init__.py
+devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kics/kics_deserealizator.py
+devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kics/kics_tool.py
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kubescape/__init__.py
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kubescape/kubescape_deserealizator.py
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kubescape/kubescape_tool.py

devsecops_engine_tools-1.7.29/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.7.29'