s1-shift-left-cli 0.4.0__py3-none-any.whl

s1_cns_cli/s1graph/github_actions/utils.py

@@ -0,0 +1,154 @@
+from __future__ import annotations
+
+import json
+import logging
+import os
+import platform
+from pathlib import Path
+from typing import Any, Tuple
+import dpath
+
+import yaml
+from jsonschema import validate, ValidationError
+
+from s1_cns_cli.s1graph.common.parsers.yaml.loader import SafeLineLoaderGhaSchema
+from s1_cns_cli.s1graph.common.parsers.yaml.parser import parse
+from s1_cns_cli.s1graph.common.util.type_forcers import force_dict
+from s1_cns_cli.s1graph.github_actions.graph_builder.graph_components.resource_types import ResourceType
+from s1_cns_cli.s1graph.github_actions.schemas import gha_schema, gha_workflow
+from s1_cns_cli.s1graph.runner_filter import RunnerFilter
+
+WORKFLOW_DIRECTORY = ".github/workflows/"
+WIN_WORKFLOW_DIRECTORY = ".github\\workflows\\"
+
+
+def get_scannable_file_paths(root_folder: str | Path) -> set[Path]:
+    """Finds yaml files"""
+
+    file_paths: set[Path] = set()
+
+    if root_folder:
+        root_path = root_folder if isinstance(root_folder, Path) else Path(root_folder)
+        file_paths = {file_path for file_path in root_path.rglob("*.[y][am]*[l]") if file_path.is_file()}
+
+    return file_paths
+
+
+def parse_file(
+    f: str | Path, file_content: str | None = None
+) -> tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | None:
+    file_path = f if isinstance(f, Path) else Path(f)
+
+    if is_workflow_file(file_path):
+        if not file_content:
+            file_content = file_path.read_text()
+
+        entity_schema = parse(filename=str(f), file_content=file_content)
+
+        if entity_schema and is_schema_valid(yaml.load(file_content, Loader=SafeLineLoaderGhaSchema)):  # nosec
+            return entity_schema
+    return None
+
+
+def is_workflow_file(file_path: str | Path) -> bool:
+    """
+    :return: True if the file mentioned is in a github action workflow directory and is a YAML file. Otherwise: False
+    """
+    abspath = os.path.abspath(file_path)
+    return get_workflow_dir() in abspath and abspath.endswith(("yml", "yaml"))
+
+
+def get_workflow_dir() -> str:
+    """
+    Detects os and uses different dir string
+    """
+    if platform.system() == "Windows":
+        return WIN_WORKFLOW_DIRECTORY
+    return WORKFLOW_DIRECTORY
+
+
+def is_schema_valid(config: dict[str, Any] | list[dict[str, Any]]) -> bool:
+    config_dict = force_dict(config)
+
+    try:
+        validate(config_dict, gha_workflow)
+        return True
+    except ValidationError:
+        try:
+            validate(config_dict, gha_schema)
+            return True
+        except ValidationError:
+            logging.info(
+                "Given entity configuration does not match the schema\n" f"config={json.dumps(config_dict, indent=4)}\n"
+            )
+
+    return False
+
+
+def get_gha_files_definitions(root_folder: str | Path,
+                              files: "list[str] | None" = None,
+                              runner_filter: RunnerFilter | None = None,) -> tuple[dict[str, Any], dict[str, Any]]:
+    definitions = {}
+    definitions_raw = {}
+    file_paths = get_scannable_file_paths(root_folder=root_folder)
+    files_set = set(files) if files else set()
+
+    for file_path in file_paths:
+        str_file_path = str(file_path)
+        should_parse: bool = str_file_path in files_set if files_set else True
+        if should_parse:
+            result = parse_file(f=file_path)
+            # result should be tuple of dict representing the file payload structure and list of lines of the payload
+            if result is not None:
+                definitions[str_file_path] = result[0]
+                definitions_raw[str_file_path] = result[1]
+
+    return definitions, definitions_raw
+
+
+def build_gha_definitions_context(definitions: dict[str, dict[str, Any]], definitions_raw: dict[str, list[Tuple[int, str]]]) -> dict[str, dict[str, Any]]:
+    definitions_context: dict[str, dict[str, Any]] = {}
+    resources = [e.value for e in ResourceType]
+    # iterate on the files
+    for file_path, file_path_definitions in definitions.items():
+        # iterate on the definitions (Parameters, Resources, Outputs...)
+        for file_path_definition, definition in file_path_definitions.items():
+            if isinstance(file_path_definition, str) and file_path_definition in resources:
+                # iterate on the actual objects of each definition
+                if isinstance(definition, dict):
+                    for attribute, attr_value in definition.items():
+                        if isinstance(attr_value, dict):
+                            start_line = attr_value['__startline__']
+                            end_line = attr_value['__endline__']
+                        elif isinstance(attr_value, str) and '__startline__' in definition and '__endline__' in definition:
+                            start_line = definition['__startline__']
+                            end_line = definition['__endline__']
+                        else:
+                            continue
+
+                        code_lines = definitions_raw[file_path][start_line - 1: end_line - 1]
+                        dpath.new(
+                            definitions_context,
+                            [file_path, str(file_path_definition), str(attribute)],
+                            {"start_line": start_line, "end_line": end_line, "code_lines": code_lines},
+                        )
+                elif isinstance(definition, (str, list)):
+                    for line_tuple in definitions_raw[file_path]:
+                        if file_path_definition in line_tuple[1] and definition_locator_helper(definition, line_tuple[1]):
+                            code_lines = definitions_raw[file_path][line_tuple[0] - 1:line_tuple[0]]
+                            dpath.new(
+                                definitions_context,
+                                [file_path, str(file_path_definition), str(definition)],
+                                {"start_line": line_tuple[0], "end_line": line_tuple[0] + 1, "code_lines": code_lines},
+                            )
+                            break
+
+    return definitions_context
+
+
+def definition_locator_helper(definition: str | list[str], target: str) -> bool:
+    if isinstance(definition, str):
+        return definition in target
+    elif isinstance(definition, list):
+        return all(item in target for item in definition)
+    return False

s1_cns_cli/s1graph/gitlab/__init__.py

@@ -0,0 +1 @@
+from s1_cns_cli.s1graph.gitlab.checks import *  # noqa

s1_cns_cli/s1graph/gitlab/base_gitlab_configuration_check.py

@@ -0,0 +1,23 @@
+from __future__ import annotations
+
+from typing import Iterable
+
+from s1_cns_cli.s1graph.common.checks.base_check import BaseCheck
+from s1_cns_cli.s1graph.common.models.enums import CheckCategories
+
+from s1_cns_cli.s1graph.gitlab.registry import registry
+
+
+class BaseGitlabCheck(BaseCheck):
+    def __init__(self, name: str, id: str, categories: Iterable[CheckCategories], supported_entities: list[str],
+                 block_type: str, path: str | None = None, guideline: str | None = None) -> None:
+        super().__init__(
+            name=name,
+            id=id,
+            categories=categories,
+            supported_entities=supported_entities,
+            block_type=block_type,
+            guideline=guideline,
+        )
+        self.path = path
+        registry.register(self)

s1_cns_cli/s1graph/gitlab/checks/__init__.py

@@ -0,0 +1,4 @@
+from pathlib import Path
+
+modules = Path(__file__).parent.glob("*.py")
+__all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"]

s1_cns_cli/s1graph/gitlab/checks/merge_requests_approvals.py

@@ -0,0 +1,32 @@
+from __future__ import annotations
+
+from typing import Any
+
+from s1_cns_cli.s1graph.common.models.enums import CheckCategories, CheckResult
+from s1_cns_cli.s1graph.gitlab.base_gitlab_configuration_check import BaseGitlabCheck
+from s1_cns_cli.s1graph.gitlab.schemas.project_approvals import schema as project_aprovals_schema
+from s1_cns_cli.s1graph.json_doc.enums import BlockType
+
+
+class MergeRequestRequiresApproval(BaseGitlabCheck):
+    def __init__(self) -> None:
+        name = "Merge requests should require at least 2 approvals"
+        id = "CKV_GITLAB_1"
+        categories = [CheckCategories.SUPPLY_CHAIN]
+        super().__init__(
+            name=name,
+            id=id,
+            categories=categories,
+            supported_entities=["*"],
+            block_type=BlockType.DOCUMENT
+        )
+
+    def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> CheckResult | None:  # type:ignore[override]
+        if project_aprovals_schema.validate(conf):
+            if conf.get("approvals_before_merge", 0) < 2:
+                return CheckResult.FAILED
+            return CheckResult.PASSED
+        return None
+
+
+check = MergeRequestRequiresApproval()

s1_cns_cli/s1graph/gitlab/checks/two_factor_authentication.py

@@ -0,0 +1,33 @@
+from __future__ import annotations
+
+from typing import Any
+
+from s1_cns_cli.s1graph.common.models.enums import CheckCategories, CheckResult
+from s1_cns_cli.s1graph.gitlab.base_gitlab_configuration_check import BaseGitlabCheck
+from s1_cns_cli.s1graph.gitlab.schemas.groups import schema
+from s1_cns_cli.s1graph.json_doc.enums import BlockType
+
+
+class GroupsTwoFactorAuthentication(BaseGitlabCheck):
+    def __init__(self) -> None:
+        name = "Ensure all Gitlab groups require two factor authentication"
+        id = "CKV_GITLAB_2"
+        categories = [CheckCategories.SUPPLY_CHAIN]
+        super().__init__(
+            name=name,
+            id=id,
+            categories=categories,
+            supported_entities=["*"],
+            block_type=BlockType.DOCUMENT
+        )
+
+    def scan_entity_conf(self, conf: list[dict[str, Any]], entity_type: str) -> CheckResult | None:  # type:ignore[override]
+        if schema.validate(conf):
+            for group in conf:
+                if group.get("require_two_factor_authentication") is False:
+                    return CheckResult.FAILED
+            return CheckResult.PASSED
+        return None
+
+
+check = GroupsTwoFactorAuthentication()

s1_cns_cli/s1graph/gitlab/dal.py

@@ -0,0 +1,69 @@
+from __future__ import annotations
+
+import os
+from typing import Any
+
+from s1_cns_cli.s1graph.common.runners.base_runner import strtobool
+from s1_cns_cli.s1graph.common.vcs.base_vcs_dal import BaseVCSDAL
+
+
+class Gitlab(BaseVCSDAL):
+    def __init__(self) -> None:
+        super().__init__()
+
+    def setup_conf_dir(self) -> None:
+        """
+            discover parameters from execution context of sentinelone-cns and determine the directory to save temporal files of vcs configuration
+        """
+        gitlab_conf_dir_name = os.getenv('CKV_GITLAB_CONF_DIR_NAME', 'gitlab_conf')
+        self.gitlab_conf_dir_path = os.path.join(os.getcwd(), gitlab_conf_dir_name)
+        self.gitlab_project_approvals_file_path = os.path.join(self.gitlab_conf_dir_path,
+                                                               "project_approvals.json")
+        self.gitlab_groups_file_path = os.path.join(self.gitlab_conf_dir_path,
+                                                    "groups.json")
+
+    def discover(self) -> None:
+        """
+            discover parameters from execution context of sentinelone-cns. usually from env variable
+        """
+        server_host = os.getenv('CI_SERVER_URL', "https://gitlab.com")
+        self.api_url = f'{server_host}/api/v4/'
+        self.graphql_api_url = f"{server_host}/api/graphql"
+
+        self.token = os.getenv('CI_JOB_TOKEN', '')
+
+        self.current_repository = os.getenv('CI_MERGE_REQUEST_PROJECT_PATH', '')
+        self.current_branch = os.getenv('CI_COMMIT_REF_NAME', '')
+        self.group_name = os.getenv('CI_PROJECT_NAMESPACE', '')
+        self.project_id = os.getenv('CI_PROJECT_ID', '')
+        self.default_branch_cache = {}
+
+    def _headers(self) -> dict[str, str]:
+        return {"Authorization": "Bearer {}".format(self.token)}
+
+    def get_project_approvals(self) -> dict[str, Any] | None:
+        if self.project_id:
+            project_approvals = self._request(endpoint=f"projects/{self.project_id}/approvals",
+                                              allowed_status_codes=[200])
+            return project_approvals
+        return None
+
+    def persist_project_approvals(self) -> None:
+        project_approvals = self.get_project_approvals()
+
+        if project_approvals:
+            BaseVCSDAL.persist(path=self.gitlab_project_approvals_file_path, conf=project_approvals)
+
+    def get_groups(self) -> dict[str, Any] | None:
+        groups = self._request(endpoint="groups", allowed_status_codes=[200])
+        return groups
+
+    def persist_groups(self) -> None:
+        groups = self.get_groups()
+        if groups:
+            BaseVCSDAL.persist(path=self.gitlab_groups_file_path, conf=groups)
+
+    def persist_all_confs(self) -> None:
+        if strtobool(os.getenv("CKV_GITLAB_CONFIG_FETCH_DATA", "True")):
+            self.persist_project_approvals()
+            self.persist_groups()

s1_cns_cli/s1graph/gitlab/registry.py

@@ -0,0 +1,4 @@
+from s1_cns_cli.s1graph.common.s1cns.check_type import CheckType
+from s1_cns_cli.s1graph.json_doc.base_registry import Registry
+
+registry = Registry(CheckType.GITLAB_CONFIGURATION)

s1_cns_cli/s1graph/gitlab/runner.py

@@ -0,0 +1,54 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+from s1_cns_cli.s1graph.common.s1cns.check_type import CheckType
+from s1_cns_cli.s1graph.gitlab.dal import Gitlab
+from s1_cns_cli.s1graph.json_doc.runner import Runner as JsonRunner
+from s1_cns_cli.s1graph.runner_filter import RunnerFilter
+
+if TYPE_CHECKING:
+    from s1_cns_cli.s1graph.common.checks.base_check_registry import BaseCheckRegistry
+    from s1_cns_cli.s1graph.common.output.report import Report
+
+
+class Runner(JsonRunner):
+    check_type = CheckType.GITLAB_CONFIGURATION  # noqa: CCE003  # a static attribute
+
+    def __init__(self) -> None:
+        self.gitlab = Gitlab()
+        super().__init__()
+
+    def run(
+        self,
+        root_folder: str | None = None,
+        external_checks_dir: list[str] | None = None,
+        files: list[str] | None = None,
+        runner_filter: RunnerFilter | None = None,
+        collect_skip_comments: bool = True
+    ) -> Report | list[Report]:
+        runner_filter = runner_filter or RunnerFilter()
+        if not runner_filter.show_progress_bar:
+            self.pbar.turn_off_progress_bar()
+
+        self.prepare_data()
+
+        report = super().run(
+            root_folder=self.gitlab.gitlab_conf_dir_path,
+            external_checks_dir=external_checks_dir,
+            files=None,  # ignore file scans
+            runner_filter=runner_filter,
+            collect_skip_comments=collect_skip_comments,
+        )
+        JsonRunner._change_files_path_to_relative(report)  # type:ignore[arg-type]  # report can only be of type Report, not a list
+        return report
+
+    def prepare_data(self) -> None:
+        self.gitlab.persist_all_confs()
+
+    def require_external_checks(self) -> bool:
+        # default json runner require only external checks. Gitlab runner brings build in checks
+        return False
+
+    def import_registry(self) -> BaseCheckRegistry:
+        from s1_cns_cli.s1graph.gitlab.registry import registry
+        return registry

s1_cns_cli/s1graph/gitlab/schemas/groups.py

@@ -0,0 +1,130 @@
+from s1_cns_cli.s1graph.common.vcs.vcs_schema import VCSSchema
+
+
+class GroupsSchema(VCSSchema):
+    def __init__(self) -> None:
+        schema = {
+            "$schema": "http://json-schema.org/draft-04/schema#",
+            "type": "array",
+            "items": [
+                {
+                    "type": "object",
+                    "properties": {
+                        "id": {
+                            "type": "integer"
+                        },
+                        "web_url": {
+                            "type": "string"
+                        },
+                        "name": {
+                            "type": "string"
+                        },
+                        "path": {
+                            "type": "string"
+                        },
+                        "description": {
+                            "type": "string"
+                        },
+                        "visibility": {
+                            "type": "string"
+                        },
+                        "share_with_group_lock": {
+                            "type": "boolean"
+                        },
+                        "require_two_factor_authentication": {
+                            "type": "boolean"
+                        },
+                        "two_factor_grace_period": {
+                            "type": "integer"
+                        },
+                        "project_creation_level": {
+                            "type": "string"
+                        },
+                        "auto_devops_enabled": {
+                            "type": "null"
+                        },
+                        "subgroup_creation_level": {
+                            "type": "string"
+                        },
+                        "emails_disabled": {
+                            "oneOf": [
+                                {"type": "boolean"},
+                                {"type": "null"}
+                            ]
+                        },
+                        "mentions_disabled": {
+                            "oneOf": [
+                                {"type": "boolean"},
+                                {"type": "null"}
+                            ]
+                        },
+                        "lfs_enabled": {
+                            "oneOf": [
+                                {"type": "boolean"},
+                                {"type": "null"}
+                            ]
+                        },
+                        "default_branch_protection": {
+                            "type": "integer"
+                        },
+                        "avatar_url": {
+                            "oneOf": [
+                                {"type": "string"},
+                                {"type": "null"}
+                            ]
+                        },
+                        "request_access_enabled": {
+                            "type": "boolean"
+                        },
+                        "full_name": {
+                            "type": "string"
+                        },
+                        "full_path": {
+                            "type": "string"
+                        },
+                        "created_at": {
+                            "type": "string"
+                        },
+                        "parent_id": {
+                            "type": "null"
+                        },
+                        "ldap_cn": {
+                            "type": "null"
+                        },
+                        "ldap_access": {
+                            "type": "null"
+                        }
+                    },
+                    "required": [
+                        "id",
+                        "web_url",
+                        "name",
+                        "path",
+                        "description",
+                        "visibility",
+                        "share_with_group_lock",
+                        "require_two_factor_authentication",
+                        "two_factor_grace_period",
+                        "project_creation_level",
+                        "auto_devops_enabled",
+                        "subgroup_creation_level",
+                        "emails_disabled",
+                        "mentions_disabled",
+                        "lfs_enabled",
+                        "default_branch_protection",
+                        "avatar_url",
+                        "request_access_enabled",
+                        "full_name",
+                        "full_path",
+                        "created_at",
+                        "parent_id",
+                        "ldap_cn",
+                        "ldap_access"
+                    ]
+                }
+            ]
+        }
+        super().__init__(schema=schema)
+
+
+schema = GroupsSchema()

s1_cns_cli/s1graph/gitlab/schemas/project_approvals.py

@@ -0,0 +1,41 @@
+from s1_cns_cli.s1graph.common.vcs.vcs_schema import VCSSchema
+
+
+class ProjectApprovalsSchema(VCSSchema):
+    def __init__(self) -> None:
+        schema = {
+            "$schema": "http://json-schema.org/draft-04/schema#",
+            "type": "object",
+            "properties": {
+                "approvals_before_merge": {
+                    "type": "integer"
+                },
+                "reset_approvals_on_push": {
+                    "type": "boolean"
+                },
+                "disable_overriding_approvers_per_merge_request": {
+                    "type": "boolean"
+                },
+                "merge_requests_author_approval": {
+                    "type": "boolean"
+                },
+                "merge_requests_disable_committers_approval": {
+                    "type": "boolean"
+                },
+                "require_password_to_approve": {
+                    "type": "boolean"
+                }
+            },
+            "required": [
+                "approvals_before_merge",
+                "reset_approvals_on_push",
+                "disable_overriding_approvers_per_merge_request",
+                "merge_requests_author_approval",
+                "merge_requests_disable_committers_approval",
+                "require_password_to_approve"
+            ]
+        }
+        super().__init__(schema=schema)
+
+
+schema = ProjectApprovalsSchema()

s1_cns_cli/s1graph/gitlab_ci/__init__.py

@@ -0,0 +1 @@
+from s1_cns_cli.s1graph.gitlab_ci.checks import * # noqa

s1_cns_cli/s1graph/gitlab_ci/checks/__init__.py

@@ -0,0 +1 @@
+from s1_cns_cli.s1graph.gitlab_ci.checks.job import * # noqa

s1_cns_cli/s1graph/gitlab_ci/checks/base_gitlab_ci_check.py

@@ -0,0 +1,35 @@
+from __future__ import annotations
+
+from abc import abstractmethod
+from collections.abc import Iterable
+from typing import Any
+
+from s1_cns_cli.s1graph.common.checks.base_check import BaseCheck
+from s1_cns_cli.s1graph.common.models.enums import CheckCategories, CheckResult
+from s1_cns_cli.s1graph.gitlab_ci.checks.registry import registry
+
+
+class BaseGitlabCICheck(BaseCheck):
+    def __init__(
+        self, name: str, id: str, supported_entities: Iterable[str], block_type: str, path: str | None = None
+    ) -> None:
+        categories = (CheckCategories.SUPPLY_CHAIN,)
+
+        super().__init__(
+            name=name,
+            id=id,
+            categories=categories,
+            supported_entities=supported_entities,
+            block_type=block_type,
+        )
+        self.path = path
+        registry.register(self)
+
+    def scan_entity_conf(self, conf: dict[str, Any], entity_type: str) -> tuple[CheckResult, dict[str, Any]]:  # type:ignore[override]  # multi_signature decorator is problematic
+        self.entity_type = entity_type
+
+        return self.scan_conf(conf)
+
+    @abstractmethod
+    def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]:
+        pass

s1_cns_cli/s1graph/gitlab_ci/checks/job/AvoidDoublePipelines.py

@@ -0,0 +1,36 @@
+from __future__ import annotations
+
+from typing import Any
+
+from s1_cns_cli.s1graph.common.models.enums import CheckResult
+from s1_cns_cli.s1graph.gitlab_ci.checks.base_gitlab_ci_check import BaseGitlabCICheck
+from s1_cns_cli.s1graph.yaml_doc.enums import BlockType
+
+PIPELINE_SOURCES = ('$CI_PIPELINE_SOURCE == "merge_request_event"', '$CI_PIPELINE_SOURCE == "push"')
+
+
+class AvoidDoublePipelines(BaseGitlabCICheck):
+    def __init__(self) -> None:
+        name = "Avoid creating rules that generate double pipelines"
+        id = "CKV_GITLABCI_2"
+        super().__init__(
+            name=name,
+            id=id,
+            block_type=BlockType.ARRAY,
+            supported_entities=('*.rules',)
+        )
+
+    def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]:
+        c = 0
+
+        for rule in conf:
+            if isinstance(rule, dict) and "if" in rule:
+                value = rule['if']
+                if value.startswith(PIPELINE_SOURCES):
+                    c += 1
+                    if c > 1:
+                        return CheckResult.FAILED, conf
+        return CheckResult.PASSED, conf
+
+
+check = AvoidDoublePipelines()

s1_cns_cli/s1graph/gitlab_ci/checks/job/DetectImagesUsage.py

@@ -0,0 +1,25 @@
+from __future__ import annotations
+
+from typing import Any
+
+from s1_cns_cli.s1graph.common.models.enums import CheckResult
+from s1_cns_cli.s1graph.gitlab_ci.checks.base_gitlab_ci_check import BaseGitlabCICheck
+from s1_cns_cli.s1graph.yaml_doc.enums import BlockType
+
+
+class DetectImageUsage(BaseGitlabCICheck):
+    def __init__(self) -> None:
+        name = "Detecting image usages in gitlab workflows"
+        id = "CKV_GITLABCI_3"
+        super().__init__(
+            name=name,
+            id=id,
+            block_type=BlockType.ARRAY,
+            supported_entities=('*.image[]', '*.services[]')
+        )
+
+    def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]:
+        return CheckResult.PASSED, conf
+
+
+check = DetectImageUsage()