ossaudit-ng 1.0.0__tar.gz

ossaudit_ng-1.0.0/.coveragerc

@@ -0,0 +1,7 @@
+[run]
+branch = true
+source = ossaudit
+omit = ossaudit/__main__.py
+
+[report]
+fail_under = 100

ossaudit_ng-1.0.0/.isort.cfg

@@ -0,0 +1,3 @@
+[settings]
+include_trailing_comma = true
+multi_line_output = 3

ossaudit_ng-1.0.0/.pylintrc

@@ -0,0 +1,65 @@
+[MASTER]
+persistent=no
+
+ignore=.git
+
+load-plugins=
+    pylint.extensions.bad_builtin,
+    pylint.extensions.check_elif,
+    pylint.extensions.docparams,
+    pylint.extensions.docstyle,
+    pylint.extensions.mccabe,
+    pylint.extensions.overlapping_exceptions,
+    pylint.extensions.redefined_variable_type,
+    pylint_quotes,
+
+accept-no-param-doc=no
+accept-no-raise-doc=no
+accept-no-yields-doc=no
+
+extension-pkg-whitelist=
+unsafe-load-any-extension=no
+
+[MESSAGES CONTROL]
+confidence=
+enable=all
+disable=
+    docstring-first-line-empty,
+    invalid-name,
+    locally-disabled,
+    locally-enabled,
+    missing-docstring,
+    missing-param-doc,
+    missing-raises-doc,
+    missing-return-type-doc,
+    missing-type-doc,
+    missing-yield-doc,
+    missing-yield-type-doc,
+    suppressed-message,
+    too-few-public-methods,
+    too-many-ancestors,
+    too-many-arguments,
+    use-symbolic-message-instead,
+
+[VARIABLES]
+init-import=yes
+
+[BASIC]
+good-names=f,i,j,k,m,db,ex,_
+argument-naming-style=snake_case
+attr-naming-style=snake_case
+class-naming-style=PascalCase
+const-naming-style=UPPER_CASE
+function-naming-style=snake_case
+method-naming-style=snake_case
+module-naming-style=snake_case
+variable-naming-style=snake_case
+
+[FORMAT]
+expected-line-ending-format=LF
+max-line-length=79
+
+[PYLINT-QUOTES]
+string-quote=double
+triple-quote=double
+docstring-quote=double

ossaudit_ng-1.0.0/.style.yapf

@@ -0,0 +1,8 @@
+[style]
+based_on_style = pep8
+blank_line_before_module_docstring = true
+coalesce_brackets = true
+dedent_closing_brackets = true
+join_multiple_lines = false
+split_before_first_argument = true
+split_complex_comprehension = true

ossaudit_ng-1.0.0/LICENSE

@@ -0,0 +1,26 @@
+Copyright (c) 2019, Hans Jerry Illikainen <hji@dyntopia.com>
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in
+   the documentation and/or other materials provided with the
+   distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
+HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

ossaudit_ng-1.0.0/MANIFEST.in

@@ -0,0 +1,4 @@
+include LICENSE README.md Makefile
+include mypy.ini .coveragerc .isort.cfg .pylintrc .style.yapf
+recursive-include requirements *
+recursive-include tests *

ossaudit_ng-1.0.0/Makefile

@@ -0,0 +1,52 @@
+.PHONY: all dist install install-dev test qa
+
+all:
+
+install:
+	pip3 install -r requirements/requirements.txt --no-binary :all:
+	./setup.py install
+
+install-dev:
+	pip3 install -r requirements/requirements.txt --no-binary :all:
+	pip3 install -r requirements/requirements-dev-1.txt --no-binary :all:
+	pip3 install -r requirements/requirements-dev-2.txt --no-binary :all:
+	pip3 install -r requirements/requirements-dev-3.txt --no-binary :all:
+	./setup.py develop
+
+test:
+	python3 -m unittest -q
+
+qa:
+	coverage run -m unittest -q
+	coverage report -m
+	isort --check-only --diff --recursive .
+	mypy .
+	pycodestyle .
+	pyflakes .
+	pylint --output-format parseable setup.py ossaudit tests
+	yapf --diff --recursive .
+	ossaudit \
+		--file requirements/requirements.txt \
+		--file requirements/requirements-dev-1.txt \
+		--file requirements/requirements-dev-2.txt \
+		--file requirements/requirements-dev-3.txt
+
+dist:
+	rm -rf dist tmp
+
+	tag="$$(git tag --sort=-creatordate |head -n 1)" && \
+	git verify-tag "$$tag" && \
+	git clone --shared --branch "$$tag" . tmp
+
+	cd tmp && \
+	./setup.py sdist && \
+	gpg --detach-sign --armor "$$(ls dist/*.tar.gz)"
+
+	mv tmp/dist .
+	rm -rf tmp
+	gpg --verify dist/*.asc
+
+upload:
+	git push --tags
+	tag="$$(git tag --sort=-creatordate |head -n 1 |cut -dv -f2)" && \
+	twine upload dist/*$$tag.tar.gz

ossaudit_ng-1.0.0/PKG-INFO

@@ -0,0 +1,50 @@
+Metadata-Version: 2.4
+Name: ossaudit-ng
+Version: 1.0.0
+Summary: Audit python packages for known vulnerabilities using Sonatype OSS Index v3 API
+Home-page: https://github.com/stuartz/ossaudit
+Author: Stuart Zurcher
+Author-email: stuartz.ccrx@gmail.com
+Maintainer: Stuart Zurcher
+Maintainer-email: stuartz.ccrx@gmail.com
+License: BSD-2-Clause
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved
+Classifier: License :: OSI Approved :: BSD License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Topic :: Software Development :: Testing
+Classifier: Topic :: Utilities
+Requires-Python: >=3.5
+License-File: LICENSE
+Requires-Dist: appdirs
+Requires-Dist: click
+Requires-Dist: dparse
+Requires-Dist: requests
+Requires-Dist: texttable
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: home-page
+Dynamic: license
+Dynamic: license-file
+Dynamic: maintainer
+Dynamic: maintainer-email
+Dynamic: requires-dist
+Dynamic: requires-python
+Dynamic: summary
+
+Fork of ossaudit by Hans Jerry Illikainen (https://github.com/illikainen/ossaudit). Includes some portions of PRs from sseide. See https://github.com/stuartz/ossaudit

ossaudit_ng-1.0.0/README.md

@@ -0,0 +1,118 @@
+
+# ossaudit
+A fork of https://github.com/illikainen/ossaudit.git
+This fork includes JSON output, config file support, Bearer token auth, and HTTP/HTTPS proxy support.
+
+## About
+
+`ossaudit` uses [Sonatype OSS Index][1] to audit Python packages for
+known vulnerabilities.
+
+It can check installed packages and/or packages specified in dependency
+files.  The following formats are supported with [dparse][2]:
+
+- PIP requirement files
+- Pipfile
+- Pipfile.lock
+- tox.ini
+- conda.yml
+
+
+## Installation
+
+### Normal
+
+
+```sh
+./setup.py develop
+```
+
+
+## Usage
+
+```sh
+$ ossaudit --help
+Usage: ossaudit [OPTIONS]
+
+Options:
+  -c, --config TEXT    Configuration file.
+  -i, --installed      Audit installed packages.
+  -f, --file FILENAME  Audit packages in file (can be specified multiple
+                       times).
+  --token TEXT         Token for authentication.
+  --column TEXT        Column to show (can be specified multiple times or passed a comma separated list).
+                       [default: name, version, title]  additional optons -- id, cve, cvss_score, description
+  --ignore-id TEXT     Ignore a vulnerability by Sonatype ID or CVE (can be
+                       specified multiple times).
+  --ignore-cache       Temporarily ignore existing cache.
+  --reset-cache        Remove existing cache.
+  --json               Output vulnerabilities as json list
+  --json-full          Output all dependencies found and their vulnerabilities
+                       as json list (columns given are ignored)
+  --http-proxy TEXT    HTTP proxy URL.
+  --https-proxy TEXT   HTTPS proxy URL.
+  --help               Show this message and exit.
+```
+
+## As import
+```python
+from ossaudit import scan
+list_of_vulnerabilites = scan(installed=True)  # Pass options as args
+for v in list_of_vulnerabilites:
+  # v is type <class 'ossaudit.audit.Vulnerability'>
+  print(v.name, v.version, v.title, v.cvss_score)
+```
+
+## Configuration
+
+[Appdirs][3] is used to determine storage paths.  This means that the
+location of the configuration file is platform-specific:
+
+- `*nix`: `~/.config/ossaudit/config.ini`
+- `macOS`: `~/Library/Preferences/ossaudit/config.ini`
+- `Windows`: `C:\Users\<username>\AppData\Local\ossaudit\ossaudit\config.ini`
+
+It can be overridden with the `--config` command-line argument and with
+the `OSSAUDIT_CONFIG` environment variable.
+
+Example configuration:
+
+```ini
+[ossaudit]
+# Optional: OSS Index API token (Bearer token auth).
+# A free account and token can be created at https://ossindex.sonatype.org/
+#token = string
+
+# Optional: comma-separated list of columns to show.
+# Default: name, version, title
+# Supported: id, name, version, cve, cvss_score, title, description
+#columns = name,version,title,cvss_score
+
+# Optional: comma-separated list of vulnerability IDs (Sonatype ID or CVE) to ignore.
+#ignore_ids = x,y,z
+
+# Optional: Ignore cache
+#ignore_cache = True
+
+# Optional: Reset the cache
+#reset_cache = True
+
+# Optional: Output format to json
+#json = True
+
+# Optional: Full output of OSS Index results to json
+#json_full = True
+
+# Optional: HTTP/HTTPS proxy (can also be set via HTTP_PROXY/HTTPS_PROXY env vars)
+#http_proxy = http://proxy.example.com:8080
+#https_proxy = http://proxy.example.com:8080
+```
+
+Authentication is **not** required.  However, requests are rate limited
+and authenticated requests are less restricted.  A free account and API
+token can be created on [OSS Index][1].
+
+
+[1]: https://ossindex.sonatype.org/
+[2]: https://github.com/pyupio/dparse
+[3]: https://github.com/ActiveState/appdirs

ossaudit_ng-1.0.0/mypy.ini

@@ -0,0 +1,21 @@
+[mypy]
+check_untyped_defs = true
+
+disallow_any_decorated = true
+disallow_incomplete_defs = true
+disallow_subclassing_any = true
+disallow_untyped_calls = true
+disallow_untyped_decorators = true
+disallow_untyped_defs = true
+
+ignore_missing_imports = true
+
+no_implicit_optional = true
+
+strict_optional = true
+
+warn_no_return = true
+warn_redundant_casts = true
+warn_return_any = true
+warn_unused_configs  = true
+warn_unused_ignores = true

ossaudit_ng-1.0.0/ossaudit/__init__.py

@@ -0,0 +1,68 @@
+# Copyright (c) 2019, Hans Jerry Illikainen <hji@dyntopia.com>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+
+__version__ = "1.0.0"
+__project__ = "ossaudit-ng"
+
+from typing import Dict, List, Optional
+
+from .audit import AuditError, Vulnerability, components, flatten_vuln_list
+from . import packages as _packages
+
+__all__ = ["AuditError", "Vulnerability", "scan"]
+
+
+def scan(
+        installed: bool = False,
+        files: Optional[List[str]] = None,
+        token: Optional[str] = None,
+        ignore_ids: Optional[List[str]] = None,
+        ignore_cache: bool = False,
+        proxies: Optional[Dict[str, str]] = None,
+) -> List[Vulnerability]:
+    """Audit packages and return a list of vulnerabilities.
+
+    Parameters
+    ----------
+    installed:
+        Audit currently installed packages.
+    files:
+        Paths to requirements files to audit.
+    token:
+        Sonatype OSS Index API token.
+    ignore_ids:
+        Sonatype IDs or CVE IDs to exclude from results.
+    ignore_cache:
+        Skip the local cache and always query the API.
+    proxies:
+        Proxy URLs keyed by scheme, e.g. ``{"https": "http://proxy:8080"}``.
+
+    Returns
+    -------
+    List[Vulnerability]
+        Every vulnerability found, minus any in *ignore_ids*.
+
+    Raises
+    ------
+    AuditError
+        On API authentication, rate-limit, or unexpected status errors.
+    """
+    pkgs = []  # type: list
+    if installed:
+        pkgs += _packages.get_installed()
+    if files:
+        handles = [open(f) for f in files]
+        try:
+            pkgs += _packages.get_from_files(handles)
+        finally:
+            for h in handles:
+                h.close()
+
+    all_coordinates = components(pkgs, token, proxies, ignore_cache)
+    vulns = flatten_vuln_list(all_coordinates)
+
+    if ignore_ids:
+        vulns = [v for v in vulns if v.id not in ignore_ids and v.cve not in ignore_ids]
+
+    return vulns

ossaudit_ng-1.0.0/ossaudit/__main__.py

@@ -0,0 +1,14 @@
+# Copyright (c) 2019, Hans Jerry Illikainen <hji@dyntopia.com>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+
+from . import __project__, cli
+
+
+def main() -> None:
+    prefix = __project__.upper()
+    cli.cli(auto_envvar_prefix=prefix)  # pylint: disable=E1120,E1123
+
+
+if __name__ == "__main__":
+    main()

ossaudit_ng-1.0.0/ossaudit/audit.py

@@ -0,0 +1,142 @@
+# Copyright (c) 2019, Hans Jerry Illikainen <hji@dyntopia.com>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+
+from collections import namedtuple
+from typing import Dict, Generator, List, Optional
+from urllib.parse import urljoin
+
+import requests
+
+from . import cache, const, packages
+
+Vulnerability = namedtuple(
+    "Vulnerability", [
+        "name",
+        "version",
+        "id",
+        "cve",
+        "cvss_score",
+        "title",
+        "description",
+    ]
+)
+
+
+class AuditError(Exception):
+    pass
+
+
+def components(
+        pkgs: List[packages.Package],
+        token: Optional[str] = None,
+        proxies: Optional[Dict[str, str]] = None,
+        ignore_cache: bool = False,
+) -> List[Vulnerability]:
+    old = list(_from_cache(pkgs, ignore_cache))
+    new = list(_from_api([
+        p for p in pkgs
+        if not any(p.coordinate == o.coordinate for o, _ in old)
+    ], ignore_cache, token, proxies))  # yapf: disable
+    return (new + old)
+
+
+def flatten_vuln_list(vulns):
+    return [
+        _transform(p, vuln)
+        for p, c in vulns       # package, coordinate from ossindex
+        for vuln in c.get("vulnerabilities", [])
+    ]
+
+
+
+def _from_api(
+        pkgs: List[packages.Package],
+        ignore_cache: bool,
+        token: Optional[str] = None,
+        proxies: Optional[Dict[str, str]] = None
+) -> Generator:
+    url = urljoin(const.API, const.COMPONENT_REPORT)
+    headers = {"Authorization": f"Bearer {token}"} if token else {}
+
+    for i in range(0, len(pkgs), const.MAX_PACKAGES):
+        coordinates = [p.coordinate for p in pkgs[i:i + const.MAX_PACKAGES]]
+        res = requests.post(url, headers=headers, json={"coordinates": coordinates},
+                            proxies=proxies, timeout=const.REQ_TIMEOUT)
+
+        if res.status_code == 200:
+            for entry in res.json():
+                pkg = next((
+                    p for p in pkgs
+                    if p.coordinate == entry.get("coordinates")
+                ), packages.Package("unknown", "0"))
+                if not ignore_cache:
+                    cache.save(entry)
+                yield (pkg, entry)
+        elif res.status_code == 401:
+            raise AuditError("invalid credentials")
+        elif res.status_code == 429:
+            raise AuditError("too many requests")
+        else:
+            raise AuditError("unknown status code {}".format(res.status_code))
+
+
+def _from_cache(pkgs: List[packages.Package], ignore_cache: bool) -> Generator:
+    if not ignore_cache:
+        for pkg in pkgs:
+            entry = cache.get(pkg.coordinate)
+            if entry:
+                yield (pkg, entry)
+
+
+def _transform(pkg: packages.Package, vuln: Dict) -> Vulnerability:
+    return Vulnerability(
+        name=pkg.name,
+        version=pkg.version,
+        id=vuln.get("id", ""),
+        cve=vuln.get("cve", ""),
+        cvss_score=vuln.get("cvssScore", ""),
+        title=vuln.get("title", ""),
+        description=vuln.get("description", ""),
+    )
+
+
+def create_report(vulns: List):
+    """Create a list of dict objects as returned by the SonarType OSSIndex scanner. The list contains on
+    dict per python package found and queried against the database. The packages "vulnerabilities" field
+    is an list with all vulnerabilites for this package. The vulnerability list can be empty.
+
+    Parameters
+    ----------
+    vulns : List with a tuple of the package object and the SonarType response for this package
+
+    Returns
+    -------
+    list - a list of scan coordinates (packages) and a list with their vulnerabilities (if any)
+    """
+    out_list = []
+    for p, c in vulns:
+        del c["time"]
+        out_list.append(c)
+    return out_list
+
+def create_vuln_list(vulns: List, columns: List):
+    """Create a list of dicts from the vulnerability tuples containing only the column names requests
+
+    Parameters
+    ----------
+    vulns : List list of all vulnerabilities found
+    columns : List list of all columns(fields) needed from the vulnerability for output
+
+    Returns
+    -------
+    list - a list of vulnerability dictionaries containing the columns given only
+    """
+    out_list = []
+    for v in vulns:
+        v_dict = v._asdict()
+        v_out = {}
+        for c in columns:
+            v_out[c] = v_dict[c] if c in v_dict else ""
+        out_list.append(v_out)
+    return out_list

ossaudit_ng-1.0.0/ossaudit/cache.py

@@ -0,0 +1,58 @@
+# Copyright (c) 2019, Hans Jerry Illikainen <hji@dyntopia.com>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+
+import json
+import time
+from typing import Dict, Optional
+
+from . import const
+
+
+def get(coordinate: str) -> Optional[Dict]:
+    if const.CACHE.exists():
+        with const.CACHE.open() as f:
+            try:
+                entry = next(
+                    (
+                        e for e in json.load(f)
+                        if e["coordinates"] == coordinate
+                    ),
+                    {},
+                )
+                if _is_valid(entry):
+                    return entry
+            except json.JSONDecodeError:
+                pass
+    return None
+
+
+def save(entry: Dict) -> None:
+    entries = []  # type: list
+
+    if const.CACHE.exists():
+        with const.CACHE.open() as f:
+            try:
+                entries = [
+                    e for e in json.load(f) if _is_valid(e)
+                    and e.get("coordinates") != entry.get("coordinates")
+                ]
+            except json.JSONDecodeError:
+                pass
+    else:
+        const.CACHE.parent.mkdir(parents=True, exist_ok=True)
+
+    with const.CACHE.open("w") as f:
+        entry["time"] = time.time()
+        json.dump(entries + [entry], f)
+
+
+def reset() -> None:
+    if const.CACHE.exists():
+        const.CACHE.unlink()
+
+
+def _is_valid(entry: Dict) -> bool:
+    then = entry.get("time", float("inf"))
+    now = time.time()
+    return not then > now + const.CACHE_TIME