ds-analysis-lib 6.3.0__tar.gz → 6.3.2__tar.gz

{ds_analysis_lib-6.3.0 → ds_analysis_lib-6.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ds-analysis-lib
-Version: 6.3.0
+Version: 6.3.2
 Summary: Analysis library for owasp depscan
 Author-email: Team AppThreat <cloud@appthreat.com>
 License-Expression: MIT
@@ -20,10 +20,10 @@ Classifier: Topic :: Security
 Classifier: Topic :: Utilities
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
-Requires-Dist: appthreat-vulnerability-db[oras]~=6.7.2
-Requires-Dist: custom-json-diff>=2.1.6
-Requires-Dist: cvss>=3.4
-Requires-Dist: jsonschema>=4.20
-Requires-Dist: referencing>=0.31
-Requires-Dist: rich>=13.9.4
-Requires-Dist: toml>=0.10.2
+Requires-Dist: appthreat-vulnerability-db[oras]~=6.7.7
+Requires-Dist: custom-json-diff~=2.1.6
+Requires-Dist: cvss~=3.6
+Requires-Dist: jsonschema~=4.26.0
+Requires-Dist: referencing~=0.37.0
+Requires-Dist: rich~=15.0.0
+Requires-Dist: toml~=0.10.2

{ds_analysis_lib-6.3.0 → ds_analysis_lib-6.3.2}/pyproject.toml

@@ -1,18 +1,18 @@
 [project]
 name = "ds-analysis-lib"
-version = "6.3.0"
+version = "6.3.2"
 description = "Analysis library for owasp depscan"
 authors = [
     {name = "Team AppThreat", email = "cloud@appthreat.com"},
 ]
 dependencies = [
-    "appthreat-vulnerability-db[oras]~=6.7.2",
-    "custom-json-diff>=2.1.6",
-    "cvss>=3.4",
-    "jsonschema>=4.20",
-    "referencing>=0.31",
-    "rich>=13.9.4",
-    "toml>=0.10.2"
+    "appthreat-vulnerability-db[oras]~=6.7.7",
+    "custom-json-diff~=2.1.6",
+    "cvss~=3.6",
+    "jsonschema~=4.26.0",
+    "referencing~=0.37.0",
+    "rich~=15.0.0",
+    "toml~=0.10.2"
 ]
 
 requires-python = ">=3.10"
@@ -44,6 +44,7 @@ build-backend = "setuptools.build_meta"
 
 [tool.setuptools.package-data]
 "analysis_lib.vex.data" = ["*.json", "cvss/*.json"]
+"analysis_lib.data" = ["cyclonedx/*.json"]
 
 [tool.pytest.ini_options]
 minversion = "6.0"

{ds_analysis_lib-6.3.0 → ds_analysis_lib-6.3.2}/src/analysis_lib/config.py

@@ -22,6 +22,24 @@ def get_int_from_env(name, default):
     return value
 
 
+# BOM generation profiles understood by cdxgen. This is the single source of
+# truth shared by the CLI (`--profile`) and the server (`/scan?profile=`): the
+# value is forwarded to cdxgen as a command line argument, so any caller
+# supplying it must constrain it to this set.
+SUPPORTED_BOM_PROFILES = (
+    "appsec",
+    "research",
+    "operational",
+    "threat-modeling",
+    "license-compliance",
+    "generic",
+    "machine-learning",
+    "ml",
+    "deep-learning",
+    "ml-deep",
+    "ml-tiny",
+)
+
 # CPE Full Regex including unused parameters
 CPE_FULL_REGEX = re.compile(
     "cpe:?:[^:]+:(?P<cve_type>[^:]+):(?P<vendor>[^:]+):(?P<package>[^:]+):(?P<version>[^:]+):(?P<update>[^:]+):(?P<edition>[^:]+):(?P<lang>[^:]+):(?P<sw_edition>[^:]+):(?P<target_sw>[^:]+):(?P<target_hw>[^:]+):(?P<other>[^:]+)"
@@ -307,7 +325,10 @@ TIME_FMT = "%Y-%m-%dT%H:%M:%S"
 CWE_SPLITTER = re.compile(r"(?<=CWE-)[0-9]\d{0,5}", re.IGNORECASE)
 JFROG_ADVISORY = re.compile(r"(?P<id>jfsa\S+)", re.IGNORECASE)
 ADVISORY = re.compile(
-    r"(?P<org>[^\s./]+).(?:com|org)/(?:[\S]+)?/(?P<id>(?:(?:ghsa|ntap|rhsa|rhba|zdi|dsa|cisco|intel|usn)-)?[\w\d\-:]{5,})",
+    # A dot is part of the id only before a digit, so version numbers in a
+    # slug survive (vulncheck's node-forge-through-1.4.0-rsa-...) while a
+    # file extension does not (intel-sa-00123.html -> intel-sa-00123).
+    r"(?P<org>[^\s./]+).(?:com|org)/(?:[\S]+)?/(?P<id>(?:(?:ghsa|ntap|rhsa|rhba|zdi|dsa|cisco|intel|usn)-)?[\w\d\-:]{5,}(?:\.\d[\w\d\-:]*)*)",
     re.IGNORECASE,
 )
 
@@ -1461,4 +1482,19 @@ SAFE_ENDPOINT_REACHABLE_PURLS = (
     "pkg:npm/bootstrap",
 )
 
+# Rubygems version strings may carry a platform suffix (e.g. the x86_64-linux
+# build of a gem with native extensions). create_pkg_variations adds an alias
+# that strips the suffix so the platform-independent advisory still matches.
+RUBY_PLATFORM_MARKERS = [
+    "-x86_64",
+    "-x86",
+    "-x64",
+    "-aarch",
+    "-arm",
+    "-ruby",
+    "-universal",
+    "-java",
+    "-truffle",
+]
+
 MIN_POSTBUILD_CONFIDENCE = 0.5

ds_analysis_lib-6.3.2/src/analysis_lib/data/__init__.py

@@ -0,0 +1 @@
+"""Bundled JSON schemas used by :mod:`analysis_lib.validation`."""