regscale-cli 6.20.10.0__py3-none-any.whl → 6.21.1.0__py3-none-any.whl

regscale/models/integration_models/snyk.py

@@ -3,13 +3,13 @@ Snyk Scan information
 """
 
 from datetime import datetime
-from typing import Optional, Union
+from typing import List, Optional, Union
 
 from regscale.core.app.application import Application
 from regscale.core.app.logz import create_logger
-from regscale.core.app.utils.app_utils import epoch_to_datetime, get_current_datetime, is_valid_fqdn
+from regscale.core.app.utils.app_utils import epoch_to_datetime, is_valid_fqdn
 from regscale.integrations.scanner_integration import IntegrationAsset, IntegrationFinding
-from regscale.models import Asset, AssetCategory, AssetStatus, AssetType, ImportValidater, IssueStatus, Vulnerability
+from regscale.models import Asset, AssetCategory, AssetStatus, AssetType, ImportValidater, IssueSeverity, IssueStatus
 from regscale.models.integration_models.flat_file_importer import FlatFileImporter
 
 
@@ -19,42 +19,60 @@ class Snyk(FlatFileImporter):
     """
 
     def __init__(self, **kwargs):
-        self.not_implemented_error = "Unsupported file type for Snyk integration. Only XLSX and JSON are supported."
-        self.name = kwargs.get("name")
-        self.auto_fixable = "AUTOFIXABLE"
-        self.fmt = "%Y-%m-%d"
-        self.dt_format = "%Y-%m-%d %H:%M:%S"
-        if "json" in kwargs.get("file_type", ""):
-            self.project_name = "projectName"
-            self.issue_severity = "severity"
-            self.vuln_title = "title"
-            self.required_headers = [
-                "projectName",
-                "vulnerabilities",
-            ]
+        # Group related attributes to reduce instance attribute count
+        self.scanner_config = {
+            "name": kwargs.get("name"),
+            "auto_fixable": "AUTOFIXABLE",
+            "fmt": "%Y-%m-%d",
+            "dt_format": "%Y-%m-%d %H:%M:%S",
+            "not_implemented_error": "Unsupported file type for Snyk integration. Only XLSX and JSON are supported.",
+        }
+        self.mapping_config = {
+            "mapping_file": kwargs.get("mappings_path"),
+            "disable_mapping": kwargs.get("disable_mapping"),
+        }
+        self.file_config = {
+            "file_type": kwargs.get("file_type", ""),
+        }
+
+        # Set up file-specific configurations
+        if "json" in self.file_config["file_type"]:
+            self.file_specific_config = {
+                "project_name": "projectName",
+                "issue_severity": "severity",
+                "vuln_title": "title",
+                "required_headers": ["projectName", "vulnerabilities"],
+            }
         else:
-            self.project_name = "PROJECT_NAME"
-            self.issue_severity = "ISSUE_SEVERITY"
-            self.vuln_title = "PROBLEM_TITLE"
-            self.required_headers = [
-                self.project_name,
-                self.issue_severity,
-                self.vuln_title,
-                self.auto_fixable,
-            ]
-        self.mapping_file = kwargs.get("mappings_path")
-        self.disable_mapping = kwargs.get("disable_mapping")
+            self.file_specific_config = {
+                "project_name": "PROJECT_NAME",
+                "issue_severity": "ISSUE_SEVERITY",
+                "vuln_title": "PROBLEM_TITLE",
+                "required_headers": [
+                    "PROJECT_NAME",
+                    "ISSUE_SEVERITY",
+                    "PROBLEM_TITLE",
+                    self.scanner_config["auto_fixable"],
+                ],
+            }
+
         self.validater = ImportValidater(
-            self.required_headers, kwargs.get("file_path"), self.mapping_file, self.disable_mapping
+            self.file_specific_config["required_headers"],
+            kwargs.get("file_path"),
+            self.mapping_config["mapping_file"],
+            self.mapping_config["disable_mapping"],
         )
         self.headers = self.validater.parsed_headers
         self.mapping = self.validater.mapping
-        if "json" in kwargs.get("file_type", ""):
+
+        # Set counts based on file type
+        if "json" in self.file_config["file_type"]:
             asset_count = 1
             vuln_count = len(self.mapping.get_value(self.validater.data, "vulnerabilities", []))
         else:
             asset_count = None
             vuln_count = None
+
         logger = create_logger()
         self.logger = logger
         super().__init__(
@@ -77,10 +95,12 @@ class Snyk(FlatFileImporter):
         :return: The first seen date as a string
         :rtype: str
         """
+        epoch_time = epoch_to_datetime(self.create_epoch, self.scanner_config["fmt"])
+        datetime_obj = datetime.strptime(epoch_time, self.scanner_config["dt_format"])
         return datetime.combine(
-            datetime.strptime(epoch_to_datetime(self.create_epoch, self.fmt), self.dt_format),
+            datetime_obj,
             self.mapping.get_value(dat, "FIRST_INTRODUCED", datetime.now().time()),
-        ).strftime(self.dt_format)
+        ).strftime(self.scanner_config["dt_format"])
 
     def create_asset(self, dat: Optional[dict] = None) -> Union[Asset, IntegrationAsset]:
         """
@@ -92,41 +112,41 @@ class Snyk(FlatFileImporter):
         """
         if "json" in self.attributes.file_type:
             return self._parse_json_asset(data=dat)
-        elif "xlsx" in self.attributes.file_type:
+        if "xlsx" in self.attributes.file_type:
             return self._parse_xlsx_asset(dat)
-        else:
-            raise NotImplementedError(self.not_implemented_error)
+        raise NotImplementedError(self.scanner_config["not_implemented_error"])
 
-    def _parse_xlsx_asset(self, dat: Optional[dict] = None) -> Asset:
+    def _create_asset(self, project_name: str) -> IntegrationAsset:
         """
-        Create an asset from a row in the Snyk file
+        Helper function to create an IntegrationAsset with common attributes
 
-        :param Optional[dict] dat: Data row from CSV file, defaults to None
-        :return: RegScale Asset object
-        :rtype: Asset
+        :param str project_name: The project name to extract hostname from
+        :return: IntegrationAsset object
+        :rtype: IntegrationAsset
         """
-        name = self.extract_host(self.mapping.get_value(dat, self.project_name))
+        name = self.extract_host(project_name)
         valid_name = is_valid_fqdn(name)
-        return Asset(
-            **{
-                "id": 0,
-                "name": name,
-                "ipAddress": "0.0.0.0",
-                "isPublic": True,
-                "status": "Active (On Network)",
-                "assetCategory": "Software",
-                "bLatestScan": True,
-                "bAuthenticatedScan": True,
-                "scanningTool": self.name,
-                "assetOwnerId": self.config["userId"],
-                "assetType": "Other",
-                "fqdn": name if valid_name else None,
-                "systemAdministratorId": self.config["userId"],
-                "parentId": self.attributes.parent_id,
-                "parentModule": self.attributes.parent_module,
-            }
+        return IntegrationAsset(
+            scanning_tool=self.scanner_config["name"],
+            identifier=name,
+            name=name,
+            status=AssetStatus.Active,
+            asset_category=AssetCategory.Software,
+            asset_type=AssetType.Other,
+            fqdn=name if valid_name else None,
         )
 
+    def _parse_xlsx_asset(self, dat: Optional[dict] = None) -> IntegrationAsset:
+        """
+        Create an asset from a row in the Snyk XLSX file
+
+        :param Optional[dict] dat: Data row from XLSX file, defaults to None
+        :return: IntegrationAsset object
+        :rtype: IntegrationAsset
+        """
+        project_name = self.mapping.get_value(dat, self.file_specific_config["project_name"])
+        return self._create_asset(project_name)
+
     def _parse_json_asset(self, **kwargs) -> IntegrationAsset:
         """
         Parse assets from Snyk json scan data.
@@ -135,134 +155,185 @@ class Snyk(FlatFileImporter):
         :rtype: IntegrationAsset
         """
         data = kwargs.pop("data")
-        name = self.extract_host(self.mapping.get_value(data, self.project_name))
-        valid_name = is_valid_fqdn(name)
-        return IntegrationAsset(
-            identifier=name,
-            name=name,
-            status=AssetStatus.Active,
-            asset_category=AssetCategory.Software,
-            is_latest_scan=True,
-            is_authenticated_scan=True,
-            scanning_tool=self.name,
-            asset_type=AssetType.Other,
-            fqdn=name if valid_name else None,
-            system_administrator_id=self.config["userId"],
-            parent_id=self.attributes.parent_id,
-            parent_module=self.attributes.parent_module,
-        )
+        project_name = self.mapping.get_value(data, self.file_specific_config["project_name"])
+        return self._create_asset(project_name)
 
     def create_vuln(
         self, dat: Optional[dict] = None, **kwargs
-    ) -> Optional[Union[list[IntegrationFinding], Vulnerability]]:
+    ) -> Optional[Union[List[IntegrationFinding], IntegrationFinding]]:
         """
         Create a vulnerability from a row in the Snyk file
 
         :param Optional[dict] dat: Data row from XLSX or JSON file, defaults to None
         :raises TypeError: If dat is not a dictionary
         :return: RegScale Vulnerability object if xlsx or list of IntegrationFindings if JSON
-        :rtype: Optional[Union[list[IntegrationFinding], Vulnerability]]
+        :rtype: Optional[Union[List[IntegrationFinding], Vulnerability]]
         """
         if "json" in self.attributes.file_type:
             return self._parse_json_findings(**kwargs)
-        elif "xlsx" in self.attributes.file_type:
-            return self._parse_xlsx_finding(dat, **kwargs)
+        if "xlsx" in self.attributes.file_type:
+            if isinstance(dat, dict):
+                return self._parse_xlsx_finding(dat, **kwargs)
+            if isinstance(dat, list):
+                findings = []
+                for finding in dat:
+                    findings.extend(self._parse_xlsx_finding(finding, **kwargs))
+                return findings
+        raise NotImplementedError(self.scanner_config["not_implemented_error"])
+
+    def _create_finding(self, finding_data: dict) -> IntegrationFinding:
+        """
+        Helper function to create an IntegrationFinding with common attributes
+
+        :param dict finding_data: Dictionary containing finding data
+        :return: IntegrationFinding object
+        :rtype: IntegrationFinding
+        """
+        if finding_data.get("title") is None:
+            finding_data["title"] = f"{finding_data['description']} on asset {finding_data['hostname']}"
+
+        return IntegrationFinding(
+            title=finding_data["title"],
+            description=finding_data["description"],
+            severity=finding_data["severity"],
+            status=IssueStatus.Open.value,
+            plugin_name=finding_data["description"],
+            plugin_id=finding_data.get("plugin_id"),
+            recommendation_for_mitigation=finding_data["solution"],
+            plugin_text=self.mapping.get_value(finding_data["dat"], self.file_specific_config["vuln_title"]),
+            asset_identifier=finding_data["hostname"],
+            cve=finding_data["cve"],
+            cvss_score=finding_data.get("cvss_score"),
+            first_seen=self.determine_first_seen(finding_data["dat"]),
+            last_seen=self.scan_date,
+            scan_date=self.scan_date,
+            dns=finding_data["hostname"],
+            vpr_score=finding_data.get("vpr_score"),
+            remediation=finding_data["solution"],
+            category="Software",
+            control_labels=[],
+        )
+
+    def _parse_xlsx_finding(self, dat: Optional[dict] = None, **_) -> List[IntegrationFinding]:
+        """
+        Create a list of IntegrationFinding objects from a row in the Snyk xlsx file
+
+        :param Optional[dict] dat: Data row from XLSX file, defaults to None
+        :return: A list of IntegrationFinding objects
+        :rtype: List[IntegrationFinding]
+        """
+        if not dat:
+            return []
+
+        findings: List[IntegrationFinding] = []
+        severity = self.determine_severity(
+            self.mapping.get_value(dat, self.file_specific_config["issue_severity"]).lower()
+        )
+        hostname = self.extract_host(self.mapping.get_value(dat, self.file_specific_config["project_name"]))
+        description = self.mapping.get_value(dat, self.file_specific_config["vuln_title"])
+        solution = self.mapping.get_value(dat, self.scanner_config["auto_fixable"])
+        cves = self.mapping.get_value(dat, "CVE", [])
+
+        if cves:
+            for cve in cves:
+                finding_data = {
+                    "dat": dat,
+                    "hostname": hostname,
+                    "description": description,
+                    "severity": severity,
+                    "solution": solution,
+                    "cve": cve,
+                }
+                findings.append(self._create_finding(finding_data))
         else:
-            raise NotImplementedError(self.not_implemented_error)
+            finding_data = {
+                "dat": dat,
+                "hostname": hostname,
+                "description": description,
+                "severity": severity,
+                "solution": solution,
+                "cve": "",
+            }
+            findings.append(self._create_finding(finding_data))
+        return findings
 
-    def _parse_xlsx_finding(self, dat: Optional[dict] = None, **_) -> Optional[Vulnerability]:
+    def _extract_json_finding_data(self, dat: dict) -> dict:
         """
-        Create a vulnerability from a row in the Snyk csv file
+        Extract common finding data from JSON vulnerability data
 
-        :param Optional[dict] dat: Data row from CSV file, defaults to None
-        :return: RegScale Vulnerability object or None
-        :rtype: Optional[Vulnerability]
+        :param dict dat: The vulnerability data
+        :return: Dictionary containing extracted finding data
+        :rtype: dict
         """
-        regscale_vuln = None
-        severity = self.mapping.get_value(dat, self.issue_severity).lower()
-        hostname = self.extract_host(self.mapping.get_value(dat, self.project_name))
-        description = self.mapping.get_value(dat, self.vuln_title)
-        solution = self.mapping.get_value(dat, self.auto_fixable)
-        config = self.attributes.app.config
-        asset_match = [asset for asset in self.data["assets"] if asset.name == hostname]
-        asset = asset_match[0] if asset_match else None
-        if dat and asset_match:
-            regscale_vuln = Vulnerability(
-                id=0,
-                scanId=0,  # set later
-                parentId=asset.id,
-                parentModule="assets",
-                ipAddress="0.0.0.0",  # No ip address available
-                lastSeen=get_current_datetime(),
-                firstSeen=self.determine_first_seen(dat),
-                daysOpen=None,
-                dns=hostname,
-                mitigated=None,
-                operatingSystem=None,
-                severity=severity,
-                plugInName=description,
-                cve=", ".join(self.mapping.get_value(dat, "CVE", "")),
-                vprScore=None,
-                tenantsId=0,
-                title=f"{description} on asset {asset.name}",
-                description=description,
-                plugInText=self.mapping.get_value(dat, self.vuln_title),
-                createdById=config["userId"],
-                lastUpdatedById=config["userId"],
-                dateCreated=get_current_datetime(),
-                extra_data={"solution": solution},
-            )
-        return regscale_vuln
-
-    def _parse_json_findings(self, **kwargs) -> list[IntegrationFinding]:
+        severity_key = self.file_specific_config["issue_severity"]
+        severity = self.determine_snyk_severity(dat.get(severity_key, "Low").lower())
+        project_name = self.file_specific_config["project_name"]
+        hostname = self.extract_host(self.mapping.get_value(dat, project_name)) or self.extract_host(
+            self.mapping.get_value(self.validater.data, project_name)
+        )
+        vuln_title = self.file_specific_config["vuln_title"]
+        description = self.mapping.get_value(dat, "description") or self.mapping.get_value(dat, vuln_title)
+        solution = self.mapping.get_value(dat, self.scanner_config["auto_fixable"])
+
+        # if auto fixable is not available, check for upgradeable or patchable, this is for .json files
+        if not solution:
+            upgradeable = self.mapping.get_value(dat, "isUpgradeable", False)
+            patchable = self.mapping.get_value(dat, "isPatchable", False)
+            if upgradeable or patchable:
+                solution = "Upgrade or patch the vulnerable component."
+
+        return {
+            "severity": severity,
+            "hostname": hostname,
+            "description": description,
+            "solution": solution,
+        }
+
+    def _parse_json_findings(self, **kwargs) -> List[IntegrationFinding]:
         """
-        Create a vulnerability from a row in the Snyk csv file
+        Create a list of IntegrationFinding objects from the Snyk json file
 
         :return: List of IntegrationFinding objects
-        :rtype: list[IntegrationFinding]
+        :rtype: List[IntegrationFinding]
         """
         findings = []
         vulns = self.mapping.get_value(kwargs.get("data", self.validater.data), "vulnerabilities", [])
         if not vulns:
             return findings
+
         for dat in vulns:
-            severity = self.finding_severity_map.get(dat.get(self.issue_severity, "Low").title())
-            hostname = self.extract_host(self.mapping.get_value(dat, self.project_name)) or self.extract_host(
-                self.mapping.get_value(self.validater.data, self.project_name)
-            )
-            description = self.mapping.get_value(dat, "description") or self.mapping.get_value(dat, self.vuln_title)
-            solution = self.mapping.get_value(dat, self.auto_fixable)
-            # if auto fixable is not available, check for upgradeable or patchable, this is for .json files
-            if not solution:
-                upgradeable = self.mapping.get_value(dat, "isUpgradeable", False)
-                patchable = self.mapping.get_value(dat, "isPatchable", False)
-                if upgradeable or patchable:
-                    solution = "Upgrade or patch the vulnerable component."
-            cves = ", ".join(self.mapping.get_value(dat, "CVE", ""))
+            finding_data = self._extract_json_finding_data(dat)
+            cves = self.mapping.get_value(dat, "CVE", [])
             if not cves:
-                cves = ", ".join(dat.get("identifiers", {}).get("CVE", []))
-            findings.append(
-                IntegrationFinding(
-                    title=dat.get("title") or description,
-                    description=description,
-                    severity=severity,
-                    status=IssueStatus.Open,
-                    plugin_name=description,
-                    plugin_id=dat.get("id"),
-                    plugin_text=self.mapping.get_value(dat, self.vuln_title),
-                    asset_identifier=hostname,
-                    cve=cves,
-                    cvss_score=dat.get("cvssScore"),
-                    first_seen=self.determine_first_seen(dat),
-                    last_seen=get_current_datetime(),
-                    scan_date=self.attributes.scan_date,
-                    dns=hostname,
-                    vpr_score=None,
-                    remediation=solution,
-                    category="Software",
-                    control_labels=[],
+                cves = dat.get("identifiers", {}).get("CVE", [])
+
+            # Handle multiple CVEs or single CVE
+            if cves:
+                for cve in cves:
+                    finding_data.update(
+                        {
+                            "dat": dat,
+                            "cve": cve,
+                            "title": dat.get("title") or finding_data["description"],
+                            "plugin_id": dat.get("id"),
+                            "cvss_score": dat.get("cvssScore"),
+                            "vpr_score": None,
+                        }
+                    )
+                    findings.append(self._create_finding(finding_data))
+            else:
+                finding_data.update(
+                    {
+                        "dat": dat,
+                        "cve": "",
+                        "title": dat.get("title") or finding_data["description"],
+                        "plugin_id": dat.get("id"),
+                        "cvss_score": dat.get("cvssScore"),
+                        "vpr_score": None,
+                    }
                 )
-            )
+                findings.append(self._create_finding(finding_data))
+
         return findings
 
     @staticmethod