s1-shift-left-cli 0.4.0__py3-none-any.whl

s1_cns_cli/s1graph/gitlab_ci/checks/job/SuspectCurlInScript.py

@@ -0,0 +1,29 @@
+from __future__ import annotations
+from typing import Any
+from s1_cns_cli.s1graph.common.models.enums import CheckResult
+
+from s1_cns_cli.s1graph.gitlab_ci.checks.base_gitlab_ci_check import BaseGitlabCICheck
+from s1_cns_cli.s1graph.yaml_doc.enums import BlockType
+
+
+class SuspectCurlInScript(BaseGitlabCICheck):
+    def __init__(self) -> None:
+        name = "Suspicious use of curl with CI environment variables in script"
+        id = "CKV_GITLABCI_1"
+        super().__init__(
+            name=name,
+            id=id,
+            block_type=BlockType.ARRAY,
+            supported_entities=('*.script[]',)
+        )
+
+    def scan_conf(self, conf: dict[str, Any]) -> tuple[CheckResult, dict[str, Any]]:
+        for line in conf.values():
+            if not isinstance(line, str):
+                continue
+            if line.startswith("curl") and "$CI" in line:
+                return CheckResult.FAILED, conf
+        return CheckResult.PASSED, conf
+
+
+check = SuspectCurlInScript()

s1_cns_cli/s1graph/gitlab_ci/checks/job/__init__.py

@@ -0,0 +1,4 @@
+from pathlib import Path
+
+modules = Path(__file__).parent.glob("*.py")
+__all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"]

s1_cns_cli/s1graph/gitlab_ci/checks/registry.py

@@ -0,0 +1,4 @@
+from s1_cns_cli.s1graph.common.s1cns.check_type import CheckType
+from s1_cns_cli.s1graph.yaml_doc.base_registry import Registry
+
+registry = Registry(CheckType.GITLAB_CI)

s1_cns_cli/s1graph/gitlab_ci/common/reserved.py

@@ -0,0 +1,8 @@
+# flake8: noqa
+reserved = [
+    "default",
+    "include",
+    "stages",
+    "variables",
+    "workflow"
+]

s1_cns_cli/s1graph/gitlab_ci/common/resource_id_utils.py

@@ -0,0 +1,67 @@
+from __future__ import annotations
+from typing import Any
+
+from s1_cns_cli.s1graph.common.util.consts import START_LINE, END_LINE
+
+IMAGE_BLOCK_NAMES = ('image', 'services')
+SKIP_BLOCKS = ('include', 'stages', 'cache', 'variables')
+
+
+def generate_resource_key_recursive(conf: dict[str, Any] | list[str] | str, key: str, start_line: int,
+                                    end_line: int) -> str:
+    return _generate_resource_key_recursive(conf, key, start_line, end_line, set(), 0)
+
+
+def _generate_resource_key_recursive(conf: dict[str, Any] | list[str] | str, key: str, start_line: int,
+                                     end_line: int, scanned_image_blocks: set[str], depth: int) -> str:
+    if not isinstance(conf, dict):
+        return key
+
+    for k, value in conf.items():
+        if depth == 0 and k in SKIP_BLOCKS:
+            continue
+
+        if k in IMAGE_BLOCK_NAMES:
+            scanned_image_blocks.add(k)
+
+        if isinstance(value, dict) and value[START_LINE] <= start_line <= end_line <= value[END_LINE]:
+            next_key = f'{key}.{k}' if key else k
+            return _generate_resource_key_recursive(value, next_key, start_line, end_line, scanned_image_blocks,
+                                                    depth + 1)
+
+        if isinstance(value, list):
+            if value and isinstance(value[0], dict):
+                next_key = f'{key}.{k}' if key else k
+
+                for idx, entry in enumerate(value):
+                    if entry and isinstance(entry, dict) and entry[START_LINE] <= start_line <= end_line <= entry[END_LINE]:
+                        next_key += f'.{idx + 1}'
+                        break  # There can be only one match in terms of line range
+
+                return _generate_resource_key_recursive(value, next_key, start_line, end_line, scanned_image_blocks,
+                                                        depth + 1)
+
+        if any(block_name in conf.keys()
+               and block_name not in scanned_image_blocks
+               and isinstance(conf[block_name], dict)
+               and conf[block_name].get(START_LINE) <= start_line
+               and conf[block_name].get(END_LINE) >= end_line
+               for block_name in IMAGE_BLOCK_NAMES):
+            # Avoid settling for a too general resource id, when there are blocks which usually contain image names,
+            # and that these blocks were not scanned yet & match the line range.
+            continue
+
+        if depth == 0:
+            # Indicates the first recursive call. a heuristic that top-level entities should usually be disregarded
+            # in case they are not dictionaries.
+            continue
+
+        if isinstance(value, list):
+            if key:
+                return f'{key}.{k}'
+            else:
+                continue
+        if isinstance(value, str):
+            return key
+
+    return key

s1_cns_cli/s1graph/gitlab_ci/image_referencer/manager.py

@@ -0,0 +1,13 @@
+from __future__ import annotations
+
+from typing import Any
+
+from s1_cns_cli.s1graph.common.images.workflow.image_referencer_manager import WorkflowImageReferencerManager
+from s1_cns_cli.s1graph.gitlab_ci.image_referencer.provider import GitlabCiProvider
+
+
+class GitlabCiImageReferencerManager(WorkflowImageReferencerManager):
+
+    def __init__(self, workflow_config: dict[str, Any], file_path: str):
+        provider = GitlabCiProvider(workflow_config=workflow_config, file_path=file_path)
+        super().__init__(workflow_config, file_path, provider)

s1_cns_cli/s1graph/gitlab_ci/image_referencer/provider.py

@@ -0,0 +1,60 @@
+from __future__ import annotations
+
+from typing import Any
+
+from s1_cns_cli.s1graph.common.images.image_referencer import Image
+from s1_cns_cli.s1graph.common.images.workflow.image_referencer_provider import WorkflowImageReferencerProvider
+from s1_cns_cli.s1graph.gitlab_ci.common.resource_id_utils import generate_resource_key_recursive
+
+
+class GitlabCiProvider(WorkflowImageReferencerProvider):
+
+    def __init__(self, workflow_config: dict[str, Any], file_path: str):
+        super().__init__(workflow_config, file_path)
+        self.supported_keys = ("image", "services")
+
+    def extract_images_from_workflow(self) -> list[Image]:
+        images = []
+        for job_object in self.workflow_config.values():
+            if isinstance(job_object, dict):
+                start_line, end_line = GitlabCiProvider._get_start_end_lines(job_object)
+                for key, subjob in job_object.items():
+                    if key in self.supported_keys:
+                        image_name = ""
+                        if isinstance(subjob, dict):
+                            start_line, end_line = GitlabCiProvider._get_start_end_lines(subjob)
+                            image_name = subjob['name']
+                        elif isinstance(subjob, str):
+                            image_name = subjob
+                        elif isinstance(subjob, list):
+                            for service in subjob:
+                                if isinstance(service, dict):
+                                    start_line, end_line = GitlabCiProvider._get_start_end_lines(service)
+                                    image_name = service['name']
+                                elif isinstance(service, str):
+                                    image_name = service
+                                if image_name:
+                                    image_obj = Image(
+                                        file_path=self.file_path,
+                                        name=image_name,
+                                        start_line=start_line,
+                                        end_line=end_line,
+                                        related_resource_id=generate_resource_key_recursive(conf=self.workflow_config,
+                                                                                            key='',
+                                                                                            start_line=start_line,
+                                                                                            end_line=end_line)
+                                    )
+                                    images.append(image_obj)
+                                    image_name = ""
+                        if image_name:
+                            image_obj = Image(
+                                file_path=self.file_path,
+                                name=image_name,
+                                start_line=start_line,
+                                end_line=end_line,
+                                related_resource_id=generate_resource_key_recursive(conf=self.workflow_config,
+                                                                                    key='', start_line=start_line,
+                                                                                    end_line=end_line)
+                            )
+                            images.append(image_obj)
+        return list(set(images))

s1_cns_cli/s1graph/gitlab_ci/runner.py

@@ -0,0 +1,104 @@
+from __future__ import annotations
+
+import os
+from typing import TYPE_CHECKING, Any
+
+from s1_cns_cli.s1graph.common.output.report import Report
+from s1_cns_cli.s1graph.common.util.type_forcers import force_dict
+from s1_cns_cli.s1graph.gitlab_ci.common.resource_id_utils import generate_resource_key_recursive
+
+from s1_cns_cli.s1graph.runner_filter import RunnerFilter
+
+from s1_cns_cli.s1graph.common.images.image_referencer import Image, ImageReferencerMixin
+from s1_cns_cli.s1graph.common.s1cns.check_type import CheckType
+from s1_cns_cli.s1graph.gitlab_ci.checks.registry import registry
+from s1_cns_cli.s1graph.gitlab_ci.image_referencer.manager import GitlabCiImageReferencerManager
+from s1_cns_cli.s1graph.yaml_doc.runner import Runner as YamlRunner
+
+if TYPE_CHECKING:
+    from s1_cns_cli.s1graph.common.checks.base_check_registry import BaseCheckRegistry
+    from collections.abc import Iterable
+    from networkx import DiGraph
+
+
+class Runner(ImageReferencerMixin["dict[str, dict[str, Any] | list[dict[str, Any]]]"], YamlRunner):
+    check_type = CheckType.GITLAB_CI  # noqa: CCE003  # a static attribute
+
+    def require_external_checks(self) -> bool:
+        return False
+
+    def import_registry(self) -> BaseCheckRegistry:
+        return registry
+
+    def _parse_file(
+        self, f: str, file_content: str | None = None
+    ) -> tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | None:
+        if self.is_workflow_file(f):
+            return super()._parse_file(f=f, file_content=file_content)
+
+        return None
+
+    def is_workflow_file(self, file_path: str) -> bool:
+        """
+        :return: True if the file mentioned is in the gitlab workflow name .gitlab-ci.yml. Otherwise: False
+        """
+        return file_path.endswith((".gitlab-ci.yml", ".gitlab-ci.yaml"))
+
+    def included_paths(self) -> Iterable[str]:
+        return (".gitlab-ci.yml", ".gitlab-ci.yaml")
+
+    def get_resource(self, file_path: str, key: str, supported_entities: Iterable[str],
+                     start_line: int = -1, end_line: int = -1, graph_resource: bool = False) -> str:
+        file_config = force_dict(self.definitions[file_path])
+        if not file_config:
+            return key
+        resource_id: str = generate_resource_key_recursive(conf=file_config, key='', start_line=start_line,
+                                                           end_line=end_line)
+        return resource_id
+
+    def run(
+            self,
+            root_folder: str | None = None,
+            external_checks_dir: list[str] | None = None,
+            files: list[str] | None = None,
+            runner_filter: RunnerFilter | None = None,
+            collect_skip_comments: bool = True,
+    ) -> Report | list[Report]:
+        runner_filter = runner_filter or RunnerFilter()
+        report = super().run(root_folder=root_folder, external_checks_dir=external_checks_dir,
+                             files=files, runner_filter=runner_filter, collect_skip_comments=collect_skip_comments)
+        if runner_filter.run_image_referencer:
+            if files:
+                # 'root_folder' shouldn't be empty to remove the whole path later and only leave the shortened form
+                root_folder = os.path.split(os.path.commonprefix(files))[0]
+
+            image_report = self.check_container_image_references(
+                graph_connector=None,
+                root_path=root_folder,
+                runner_filter=runner_filter,
+                definitions=self.definitions
+            )
+
+            if image_report:
+                return [report, image_report]  # type:ignore[list-item]  # report can only be of type Report, not a list
+
+        return report
+
+    def extract_images(
+        self,
+        graph_connector: DiGraph | None = None,
+        definitions: dict[str, dict[str, Any] | list[dict[str, Any]]] | None = None,
+        definitions_raw: dict[str, list[tuple[int, str]]] | None = None
+    ) -> list[Image]:
+        images: list[Image] = []
+        if not definitions:
+            return images
+
+        for file, config in definitions.items():
+            if isinstance(config, list):
+                continue
+
+            manager = GitlabCiImageReferencerManager(workflow_config=config, file_path=file)
+            images.extend(manager.extract_images_from_workflow())
+
+        return images

s1_cns_cli/s1graph/helm/base_registry.py

@@ -0,0 +1,101 @@
+from __future__ import annotations
+
+from typing import Any, TYPE_CHECKING
+
+from s1_cns_cli.s1graph.common.s1cns.check_type import CheckType
+from s1_cns_cli.s1graph.common.checks.base_check_registry import BaseCheckRegistry
+from s1_cns_cli.s1graph.runner_filter import RunnerFilter
+
+if TYPE_CHECKING:
+    from s1_cns_cli.s1graph.common.checks.base_check import BaseCheck
+    from s1_cns_cli.s1graph.common.typing import _SkippedCheck, _CheckResult
+
+
+class Registry(BaseCheckRegistry):
+    def __init__(self) -> None:
+        super().__init__(CheckType.HELM)
+
+    def extract_entity_details(self, entity: dict[str, Any]) -> tuple[str, dict[str, Any]]:  # type:ignore[override]
+        kind = entity["kind"]
+        conf = entity
+        return kind, conf
+
+    def scan(
+        self,
+        scanned_file: str,
+        entity: dict[str, Any],
+        skipped_checks: list[_SkippedCheck],
+        runner_filter: RunnerFilter,
+        report_type: str | None = None,
+    ) -> dict[BaseCheck, _CheckResult]:
+        (entity_type, entity_configuration) = self.extract_entity_details(entity)
+        results = {}
+        checks = self.get_checks(entity_type)
+        for check in checks:
+            skip_info: "_SkippedCheck" = {}
+            if skipped_checks:
+                if check.id in [x['id'] for x in skipped_checks]:
+                    skip_info = [x for x in skipped_checks if x['id'] == check.id][0]
+
+            if self._should_run_scan(check.id, entity_configuration, runner_filter):
+                self.logger.debug("Running check: {} on file {}".format(check.name, scanned_file))
+
+                result = check.run(scanned_file=scanned_file, entity_configuration=entity_configuration,
+                                   entity_name=entity_type, entity_type=entity_type, skip_info=skip_info)
+                results[check] = result
+        return results
+
+    @staticmethod
+    def _should_run_scan(check_id: str, entity_configuration: dict[str, Any], runner_filter: RunnerFilter) -> bool:
+        check_id_allowlist = runner_filter.checks
+        check_id_denylist = runner_filter.skip_checks
+        if check_id_allowlist:
+            # Allow list provides namespace-only allows, check-only allows, or both
+            # If namespaces not specified, all namespaces are scanned
+            # If checks not specified, all checks are scanned
+            run_check = False
+            allowed_namespaces = [string for string in check_id_allowlist if "CKV_" not in string]
+            if not any("CKV_" in check for check in check_id_allowlist):
+                if "metadata" in entity_configuration and "namespace" in entity_configuration["metadata"]:
+                    if entity_configuration["metadata"]["namespace"] in allowed_namespaces:
+                        run_check = True
+                elif "parent_metadata" in entity_configuration and "namespace" in entity_configuration["parent_metadata"]:
+                    if entity_configuration["parent_metadata"]["namespace"] in allowed_namespaces:
+                        run_check = True
+                else:
+                    if "default" in allowed_namespaces:
+                        run_check = True
+            else:
+                if check_id in check_id_allowlist or RunnerFilter.is_external_check(check_id):
+                    if allowed_namespaces:
+                        # Check if namespace in allowed namespaces
+                        if "metadata" in entity_configuration and "namespace" in entity_configuration["metadata"]:
+                            if entity_configuration["metadata"]["namespace"] in allowed_namespaces:
+                                run_check = True
+                        elif "parent_metadata" in entity_configuration and "namespace" in entity_configuration["parent_metadata"]:
+                            if entity_configuration["parent_metadata"]["namespace"] in allowed_namespaces:
+                                run_check = True
+                        else:
+                            if "default" in allowed_namespaces:
+                                run_check = True
+                    else:
+                        # No namespaces to filter
+                        run_check = True
+            if run_check:
+                return True
+        elif check_id_denylist:
+            namespace_skip = False
+            if "metadata" in entity_configuration and "namespace" in entity_configuration["metadata"]:
+                if entity_configuration["metadata"]["namespace"] in check_id_denylist:
+                    namespace_skip = True
+            elif "parent_metadata" in entity_configuration and "namespace" in entity_configuration["parent_metadata"]:
+                if entity_configuration["parent_metadata"]["namespace"] in check_id_denylist:
+                    namespace_skip = True
+            else:
+                if "default" in check_id_denylist:
+                    namespace_skip = True
+            if check_id not in check_id_denylist and namespace_skip is False:
+                return True
+        else:
+            return True
+        return False

s1_cns_cli/s1graph/helm/image_referencer/base_provider.py

@@ -0,0 +1,25 @@
+from __future__ import annotations
+from typing import Any, Mapping, TYPE_CHECKING, Union
+
+from s1_cns_cli.s1graph.common.graph.graph_builder import CustomAttributes
+from s1_cns_cli.s1graph.kubernetes.image_referencer.base_provider import BaseKubernetesProvider
+from s1_cns_cli.s1graph.common.images.graph.image_referencer_provider import _ExtractImagesCallableAlias
+
+if TYPE_CHECKING:
+    from networkx import DiGraph
+
+
+class BaseHelmProvider(BaseKubernetesProvider):
+    def __init__(self, graph_connector: DiGraph,
+                 supported_resource_types: dict[str, _ExtractImagesCallableAlias] | Mapping[str, _ExtractImagesCallableAlias],
+                 original_root_dir: str, temp_root_dir: str) -> None:
+        super().__init__(
+            graph_connector=graph_connector,
+            supported_resource_types=supported_resource_types,
+        )
+        self.original_root_dir = original_root_dir
+        self.temp_root_dir = temp_root_dir
+
+    def _get_resource_path(self, resource: dict[str, Any]) -> str:
+        k8s_path = resource.get(CustomAttributes.FILE_PATH, "")
+        return str(k8s_path.replace(self.temp_root_dir, self.original_root_dir, 1))

s1_cns_cli/s1graph/helm/image_referencer/manager.py

@@ -0,0 +1,25 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Union
+
+from s1_cns_cli.s1graph.common.images.graph.image_referencer_manager import GraphImageReferencerManager
+from s1_cns_cli.s1graph.helm.image_referencer.provider.helm import HelmProvider
+
+if TYPE_CHECKING:
+    from s1_cns_cli.s1graph.common.images.image_referencer import Image
+    from networkx import DiGraph
+
+
+class HelmImageReferencerManager(GraphImageReferencerManager):
+
+    def __init__(self, graph_connector: DiGraph, original_root_dir: str, temp_root_dir: str):
+        super().__init__(graph_connector)
+        self.original_root_dir = original_root_dir
+        self.temp_root_dir = temp_root_dir
+
+    def extract_images_from_resources(self) -> list[Image]:
+        helm_provider = HelmProvider(graph_connector=self.graph_connector, original_root_dir=self.original_root_dir,
+                                     temp_root_dir=self.temp_root_dir)
+        images = helm_provider.extract_images_from_resources()
+
+        return images

s1_cns_cli/s1graph/helm/image_referencer/provider/helm.py

@@ -0,0 +1,19 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from s1_cns_cli.s1graph.helm.image_referencer.base_provider import BaseHelmProvider
+from s1_cns_cli.s1graph.kubernetes.image_referencer.provider.k8s import SUPPORTED_K8S_IMAGE_RESOURCE_TYPES
+
+if TYPE_CHECKING:
+    from networkx import DiGraph
+
+
+class HelmProvider(BaseHelmProvider):
+    def __init__(self, graph_connector: DiGraph, original_root_dir: str, temp_root_dir: str):
+        super().__init__(
+            graph_connector=graph_connector,
+            supported_resource_types=SUPPORTED_K8S_IMAGE_RESOURCE_TYPES,
+            original_root_dir=original_root_dir,
+            temp_root_dir=temp_root_dir
+        )

s1_cns_cli/s1graph/helm/registry.py

@@ -0,0 +1,3 @@
+from s1_cns_cli.s1graph.helm.base_registry import Registry
+
+registry = Registry()