s1-shift-left-cli 0.4.4__tar.gz → 0.4.6__tar.gz

{s1_shift_left_cli-0.4.4 → s1_shift_left_cli-0.4.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: s1_shift_left_cli
-Version: 0.4.4
+Version: 0.4.6
 Summary: SentinelOne CNS CLI is an extension of our vision to shift-left security with SentinelOne CNS.
 License: Proprietary
 Author: pingsafe-dev

{s1_shift_left_cli-0.4.4 → s1_shift_left_cli-0.4.6}/pyproject.toml

@@ -8,7 +8,7 @@ name = "s1_shift_left_cli"
 packages = [
     { include = "s1_cns_cli", from = "src" }
 ]
-version = "0.4.4" # update version in src/s1_cns_cli/version.py as well
+version = "0.4.6" # update version in src/s1_cns_cli/version.py as well
 authors = ["pingsafe-dev <dev@pingsafe.com>"]
 description = "SentinelOne CNS CLI is an extension of our vision to shift-left security with SentinelOne CNS."
 readme = "PYPI_README.md"
@@ -121,5 +121,3 @@ pytest-xdist = "^3.5.0"
 [tool.pytest.ini_options]
 addopts = "-n 5 --html=report.html --self-contained-html --cov=src/s1_cns_cli/cli --cov-report=html:coverage"
 markers = ["integ", "iac", "vuln", "secret", "config", "vuln_deletion"]
-
-

{s1_shift_left_cli-0.4.4 → s1_shift_left_cli-0.4.6}/src/s1_cns_cli/cli/command_line_arguments.py

@@ -496,8 +496,8 @@ def add_vulnerability_flags(vulnerability_parser):
         "--platform",
         dest="platform",
         metavar="",
-        default="linux/arm64",
-        help="specify image platform (default: linux/arm64)",
+        default="",
+        help="optional platform specifier for image (example: linux/amd64, linux/arm64)",
     )
     vulnerability_parser.add_argument(
         "--registry",

{s1_shift_left_cli-0.4.4 → s1_shift_left_cli-0.4.6}/src/s1_cns_cli/cli/config/config.py

@@ -3,8 +3,8 @@ import os
 from urllib.parse import urlparse
 
 from s1_cns_cli.cli.config.config_manager import ConfigManager
-from s1_cns_cli.cli.registry import InvalidInput, \
-    CONFIG_FILE_NAME, GlobalConfig, MissingConfig
+from s1_cns_cli.cli.registry import InvalidInputException, \
+    CONFIG_FILE_NAME, GlobalConfig, MissingConfigException
 from s1_cns_cli.cli.utils import add_global_config_file, \
     upsert_s1_cns_cli, read_json_file, write_json_to_file, \
     get_cache_directory
@@ -20,7 +20,7 @@ def configure(args):
 
     parsed_url = urlparse(args.management_console_url)
     if parsed_url.scheme != "http" and parsed_url.scheme != "https":
-        raise InvalidInput("Please add a valid protocol.")
+        raise InvalidInputException("Please add a valid protocol.")
     args.management_console_url = f"{parsed_url.scheme}://{parsed_url.netloc}"
 
     add_global_config_file(args)
@@ -57,5 +57,5 @@ def init_config_manager(config):
 
 def get_config_manager() -> ConfigManager:
     if manager is None:
-        raise MissingConfig()
+        raise MissingConfigException()
     return manager

{s1_shift_left_cli-0.4.4 → s1_shift_left_cli-0.4.6}/src/s1_cns_cli/cli/main.py

@@ -6,9 +6,11 @@ from sentry_sdk import start_transaction, configure_scope
 
 import s1_cns_cli.cli.command_line_arguments as CommandLineArgs
 from s1_cns_cli.cli.config import config
-from s1_cns_cli.cli.registry import MainSubParser, MissingConfig, MissingRequiredFlags, PlatformNotSupported, \
-    RequestTimeout, HttpConnectionError, MissingDependencies, UnauthorizedUser, CodeTypeSubParser, InvalidInput, \
-    NotFound, ScanNotEnabledException, BadRequestException, GET_LATEST_VERSION_API, HttpMethod, \
+from s1_cns_cli.cli.registry import MainSubParser, MissingConfigException, MissingRequiredFlagsException, \
+    PlatformNotSupportedException, \
+    RequestTimeoutException, HttpConnectionException, MissingDependenciesException, UnauthorizedUserException, \
+    CodeTypeSubParser, InvalidInputException, \
+    NotFoundException, ScanNotEnabledException, BadRequestException, GET_LATEST_VERSION_API, HttpMethod, \
     ServiceNotAvailableException, AccessDeniedException, ScanFailedException
 from s1_cns_cli.cli.scan import code_scanner
 from s1_cns_cli.cli.utils import initialize_logger, get_cache_directory, get_exit_code_on_crash, \
@@ -94,15 +96,15 @@ def start():
                 sys.exit(exit_code)
     except KeyboardInterrupt:
         pass
-    except NotFound as e:
+    except NotFoundException as e:
         LOGGER.error(e)
         send_exception_to_sentry(e, cache_directory)
         sys.exit(get_exit_code_on_crash(cache_directory))
-    except InvalidInput as e:
+    except InvalidInputException as e:
         LOGGER.warning(e)
         send_exception_to_sentry(e, cache_directory)
         sys.exit(get_exit_code_on_crash(cache_directory))
-    except UnauthorizedUser as e:
+    except UnauthorizedUserException as e:
         LOGGER.warning(f"{e}. Please use a valid token to access SentinelOne CNS CLI.")
         delete_all_cache(cache_directory)
         send_exception_to_sentry(e, cache_directory)
@@ -111,7 +113,7 @@ def start():
         LOGGER.warning(f"{e}")
         send_exception_to_sentry(e, cache_directory)
         sys.exit(get_exit_code_on_crash(cache_directory))
-    except MissingDependencies as e:
+    except MissingDependenciesException as e:
         LOGGER.warning(
             "Missing some required dependencies.\nTry reconfiguring: s1-cns-cli config --api-token "
             "<sentinelone-cns-api-token> ...")
@@ -124,7 +126,7 @@ def start():
         LOGGER.error(f"Scan failed, please try again. If problem still persist please contact SentinelOne support")
         send_exception_to_sentry(e, cache_directory)
         sys.exit(get_exit_code_on_crash(cache_directory))
-    except HttpConnectionError as e:
+    except HttpConnectionException as e:
         LOGGER.error("Something went wrong. Please check your internet connection or contact SentinelOne CNS customer "
                        "support.")
         send_exception_to_sentry(e, cache_directory)
@@ -137,11 +139,11 @@ def start():
         LOGGER.error(e)
         send_exception_to_sentry(e, cache_directory)
         sys.exit(get_exit_code_on_crash(cache_directory))
-    except RequestTimeout as e:
+    except RequestTimeoutException as e:
         LOGGER.error("request timed out, please try again")
         send_exception_to_sentry(e, cache_directory)
         sys.exit(get_exit_code_on_crash(cache_directory))
-    except MissingConfig as e:
+    except MissingConfigException as e:
         exception_args = e.args
         if len(exception_args) == 0:
             LOGGER.warning(
@@ -152,11 +154,11 @@ def start():
             LOGGER.warning(exception_args[0])
         send_exception_to_sentry(e, cache_directory)
         sys.exit(get_exit_code_on_crash(cache_directory))
-    except MissingRequiredFlags as e:
+    except MissingRequiredFlagsException as e:
         LOGGER.warning(e)
         send_exception_to_sentry(e, cache_directory)
         sys.exit(get_exit_code_on_crash(cache_directory))
-    except PlatformNotSupported as e:
+    except PlatformNotSupportedException as e:
         LOGGER.warning(e)
         send_exception_to_sentry(e, cache_directory)
         sys.exit(get_exit_code_on_crash(cache_directory))

{s1_shift_left_cli-0.4.4 → s1_shift_left_cli-0.4.6}/src/s1_cns_cli/cli/registry.py

@@ -12,6 +12,8 @@ DEFAULT_TIMEOUT = 10
 BINARY_LIST = ["bin_secret_detector", "bin_eval_rego", "bin_vulnerability_scanner"]
 SENTRY_TAGS = ["management_console_url", "scope_id", "scope_type"]
 DEFAULT_IAC_CACHE_UPDATE_FREQUENCY = 12
+REPO_URL_MAX_LENGTH = 1024
+REPO_FULL_NAME_MAX_LENGTH = 256
 
 MAIN_PIP_COMMAND = ["pip3", "install", "--upgrade", PACKAGE_NAME]
 TEST_PIP_COMMAND = [
@@ -55,7 +57,7 @@ SUPPORTED_FRAMEWORKS = [
     "HELM",
 ]
 
-SUPPORTED_GIT_PROVIDERS = ["GITHUB", "GITLAB", "BITBUCKET", "AZURE"]
+SUPPORTED_GIT_PROVIDERS = ["GITHUB", "GITLAB", "BITBUCKET", "AZURE_REPOS"]
 
 SENTINELONE_JSON = "s1-cns-json"
 DEFECT_DOJO_GENERIC_FORMAT = "defect-dojo-generic-format"
@@ -152,29 +154,29 @@ class OUTPUT_FORMAT(str, Enum):
     SARIF = "SARIF"
 
 
-class MissingConfig(Exception):
+class MissingConfigException(Exception):
     pass
 
 
-class HttpConnectionError(Exception):
+class HttpConnectionException(Exception):
     pass
 
 
-class RequestTimeout(Exception):
+class RequestTimeoutException(Exception):
     pass
 
 
-class MissingRequiredFlags(Exception):
+class MissingRequiredFlagsException(Exception):
     pass
 
 
-class PlatformNotSupported(Exception):
+class PlatformNotSupportedException(Exception):
     pass
 
 class ServiceNotAvailableException(Exception):
     pass
 
-class MissingDependencies(Exception):
+class MissingDependenciesException(Exception):
     pass
 
 
@@ -182,7 +184,7 @@ class InvalidGraphConnection(Exception):
     pass
 
 
-class UnauthorizedUser(Exception):
+class UnauthorizedUserException(Exception):
     pass
 
 class AccessDeniedException(Exception):
@@ -194,11 +196,11 @@ class ScanFailedException(Exception):
 class BadRequestException(Exception):
     pass
 
-class NotFound(Exception):
+class NotFoundException(Exception):
     pass
 
 
-class InvalidInput(Exception):
+class InvalidInputException(Exception):
     pass
 
 

s1_shift_left_cli-0.4.6/src/s1_cns_cli/cli/scan/code_scanner.py

@@ -0,0 +1,117 @@
+import logging
+
+from s1_cns_cli.cli.config import init_config_manager
+from s1_cns_cli.cli.registry import CodeTypeSubParser, MissingConfigException, GET_CONFIG_DATA_API, HttpMethod, \
+    InvalidInputException, MissingRequiredFlagsException, SUPPORTED_GIT_PROVIDERS, REPO_URL_MAX_LENGTH, \
+    REPO_FULL_NAME_MAX_LENGTH
+from s1_cns_cli.cli.scan import iac, secret
+from s1_cns_cli.cli.scan import vulnerability
+from s1_cns_cli.cli.utils import check_if_paths_exist, make_request, read_json_file, get_config_path, upsert_s1_cns_cli
+
+LOGGER = logging.getLogger("cli")
+
+
+def handle_scan_sub_parser(args, cache_directory):
+    global_pre_evaluation(args, cache_directory)
+    if args.scan_type_sub_parser == CodeTypeSubParser.IAC:
+        return iac.iac_parser(args, cache_directory)
+    elif args.scan_type_sub_parser == CodeTypeSubParser.SECRET:
+        return secret.secret_parser(args, cache_directory)
+    elif args.scan_type_sub_parser == CodeTypeSubParser.VULN:
+        return vulnerability.vulnerability_parser(args, cache_directory)
+
+def validate_tag(tag):
+    if not isinstance(tag, str):
+        return False
+
+    parts = tag.split(':')
+    if len(parts) != 2:
+        return False
+
+    a, b = parts
+    if not a or not b:
+        return False
+
+    return True
+
+def get_mandatory_flags(args) -> list[str]:
+    if args.scan_type_sub_parser == CodeTypeSubParser.IAC:
+        return ["repo_url", "branch", "repo_full_name", "provider"]
+    elif args.scan_type_sub_parser == CodeTypeSubParser.SECRET:
+        return ["repo_url", "repo_full_name", "provider"]
+    else: return []
+
+def snake_to_kebab(snake_case: str) -> str:
+    return snake_case.replace('_', '-')
+
+def validate_publish_results_flags(args):
+    if not hasattr(args, 'publish_result') or not args.publish_result:
+        return
+
+    mandatory_flags = get_mandatory_flags(args)
+    for flag in mandatory_flags:
+        if not getattr(args, flag, ""):
+            raise MissingRequiredFlagsException(
+                f"{snake_to_kebab(flag)} required to publish results to sentinelOne cns")
+
+    if len(args.repo_url) > REPO_URL_MAX_LENGTH:
+        raise InvalidInputException(f"repo-url exceeds the maximum allowed length of {REPO_URL_MAX_LENGTH} characters")
+
+    if len(args.repo_full_name) > REPO_FULL_NAME_MAX_LENGTH:
+        raise InvalidInputException(f"repo-full-name exceeds the maximum allowed length of {REPO_FULL_NAME_MAX_LENGTH} characters")
+
+    if args.provider not in SUPPORTED_GIT_PROVIDERS:
+        raise InvalidInputException(f"provider '{args.provider}' is not supported. supported providers are: {SUPPORTED_GIT_PROVIDERS}")
+
+    if not args.repo_url.startswith("https://"):
+        raise InvalidInputException( "repository url must start with 'https://'")
+
+    if '/' not in args.repo_full_name:
+        raise InvalidInputException("repository full name should be in the format 'owner/repoName'")
+
+# global_pre_evaluation: will check we have updated s1-cns-cli and configs
+def global_pre_evaluation(args, cache_directory):
+    global_config_file_path = get_config_path(cache_directory)
+    if not check_if_paths_exist([cache_directory, global_config_file_path]):
+        raise MissingConfigException()
+
+    global_config_data = read_json_file(global_config_file_path)
+    management_console_url = global_config_data.get("management_console_url")
+
+    if (hasattr(args, 'list_detectors') and args.list_detectors) or (hasattr(args, 'list_plugins') and args.list_plugins):
+        data = {
+            "global": global_config_data,
+            "secret": {},
+            "iac": {},
+            "vuln": {}
+        }
+        init_config_manager(data)
+        return
+
+    tag = global_config_data.get("tag")
+    scope_type = global_config_data.get("scope_type")
+    scope_id = global_config_data.get("scope_id")
+    if len(args.tag) > 0:
+        tag = args.tag
+
+    if len(tag) == 0:
+        raise MissingConfigException("missing 'tag', please reconfigure cli or use the '--tag' flag.")
+
+    if len(management_console_url) == 0:
+        raise MissingConfigException("'management_console_url' is required, please reconfigure using '--management_console_url "
+                            " flag")
+
+    if not validate_tag(tag):
+        raise InvalidInputException("tag must include a colon (':') that separates a non-empty key and value. For example: 'key:value'.")
+
+    validate_publish_results_flags(args)
+
+    response = make_request(HttpMethod.GET, management_console_url + GET_CONFIG_DATA_API, global_config_data["service_user_api_token"],
+                            {"tag": tag, "scopeType": scope_type, "scopeIds": scope_id})
+
+    data = response.json()["data"]
+
+    # merge cli_global_config with response global_config
+    data["global"] = {**data["global"], **global_config_data}
+    init_config_manager(data)
+    upsert_s1_cns_cli(cache_directory)

{s1_shift_left_cli-0.4.4 → s1_shift_left_cli-0.4.6}/src/s1_cns_cli/cli/scan/iac.py

@@ -16,9 +16,9 @@ from tabulate import tabulate
 
 from s1_cns_cli.cli.config import get_config_manager
 from s1_cns_cli.cli.registry import CodeTypeSubParser, HttpMethod, TIME_FORMAT, SUPPORTED_FRAMEWORKS, \
-    IacFramework, GlobalConfig, BASELINE_FILE, LogColors, MissingDependencies, \
-    DOWNLOAD_IAC_CACHE_API, PUBLISH_ISSUES_API, InvalidInput, MissingRequiredFlags, SUPPORTED_GIT_PROVIDERS, \
-    OUTPUT_FORMAT, SEVERITY_MAP, ScanNotEnabledException, DEFAULT_IAC_CACHE_UPDATE_FREQUENCY, \
+    IacFramework, GlobalConfig, BASELINE_FILE, LogColors, MissingDependenciesException, \
+    DOWNLOAD_IAC_CACHE_API, PUBLISH_ISSUES_API, OUTPUT_FORMAT, SEVERITY_MAP, ScanNotEnabledException, \
+    DEFAULT_IAC_CACHE_UPDATE_FREQUENCY, \
     ScanFailedException
 from s1_cns_cli.cli.utils import make_request, read_json_file, write_json_to_file, wrap_text, \
     get_config_path, get_version, print_output_on_file, get_severity_color, invalidate_cache, get_wrapping_length, \
@@ -149,7 +149,7 @@ def evaluate_plugin_on_graph(directory_to_scan, plugin_data, graph_nodes, groupe
             plugin_data["connections"] = sort_dict_by_order(plugin_data["connections"])
             cur_node = generate_sub_graph(plugin_data["connections"], cur_node, graph_nodes_by_id, grouped_links_by_source,
                                       grouped_links_by_target)
-        if evaluate_rego(cur_node, plugin_data["rego"], cache_directory):
+        if evaluate_rego(cur_node, plugin_data, cache_directory):
             results.append(generate_issue_meta(cur_node, plugin_data, directory_to_scan))
 
     return results
@@ -203,7 +203,7 @@ def generate_sub_graph(plugin_connections, node, graph_nodes_by_id, grouped_link
     return node
 
 
-def evaluate_rego(input_json, rego, cache_directory):
+def evaluate_rego(input_json, plugin_data, cache_directory):
     input_json_path = None
     rego_file_path = None
     try:
@@ -216,7 +216,7 @@ def evaluate_rego(input_json, rego, cache_directory):
 
         rego_file_path = os.path.join(tempfile.gettempdir(), f"rego_script_{uuid.uuid4()}.rego")
         with open(rego_file_path, 'w') as outfile:
-            outfile.write(rego)
+            outfile.write(plugin_data["rego"])
 
         # change the permission to 600 (readable and writable only by the owner)
         os.chmod(input_json_path, 0o600)
@@ -224,14 +224,19 @@ def evaluate_rego(input_json, rego, cache_directory):
 
         rego_evaluator_binary_path = os.path.join(cache_directory, "bin", get_version(), "bin_eval_rego")
         if not os.path.exists(rego_evaluator_binary_path):
-            raise MissingDependencies(f"Missing rego_evaluator_binary: {get_version()}")
+            raise MissingDependenciesException(f"Missing rego_evaluator_binary: {get_version()}")
 
         command = [rego_evaluator_binary_path, input_json_path, rego_file_path]
         result = subprocess.run(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
 
         if result.stderr:
             err_msg = re.sub(r'.*/([^/]+\.rego)', 'rego', result.stderr.decode('utf-8'))
-            raise ScanFailedException(err_msg)
+            err_msg = err_msg.replace("\n", "")
+            if "rego_unsafe_var_error" not in err_msg:
+                raise ScanFailedException(err_msg, plugin_data['id'])
+            else:
+                LOGGER.error(f"err: {err_msg}, pluginId: {plugin_data['id']}")
+
         if "isVulnerable:true" in result.stdout.decode():
             return True
         return False
@@ -274,21 +279,7 @@ def iac_pre_evaluation(args, cache_directory):
 
 # validate_iac_command will verify whether all necessary flags are correctly provided or not
 def validate_iac_command(args):
-    if args.publish_result and (args.branch == "" or args.repo_url == "" or args.repo_full_name == "" or args.provider == ""):
-        raise MissingRequiredFlags(
-            "Please provide mandatory flags (--branch, --repo-url, --repo-full-name, --provider) to publish results to SentinelOne CNS.")
-
-    if args.provider != "" and args.provider not in SUPPORTED_GIT_PROVIDERS:
-        raise InvalidInput(f"Provider not supported. Supported providers: {', '.join(SUPPORTED_GIT_PROVIDERS)}")
-
-    if args.repo_full_name != "" and "/" not in args.repo_full_name:
-        raise InvalidInput("Please provide repository full name(owner/repoName)")
-
-    if args.repo_url:
-        for provider in SUPPORTED_GIT_PROVIDERS:
-            if provider.lower() in args.repo_url.lower():
-                return
-        raise InvalidInput("Git provider not supported yet. Please contact SentinelOne CNS support.")
+    return
 
 # iac_post_evaluation: Filter results on the basis of baseline and exit strategy and write result to output file
 def iac_post_evaluation(args, findings, cache_directory):
@@ -330,7 +321,7 @@ def iac_post_evaluation(args, findings, cache_directory):
 
         print_issue_on_console(actionable_findings, args.quiet, args.verbose)
         save_issues_on_file(args, actionable_findings, global_config_data)
-        send_issues_to_sentinelone(args, sorted_findings, global_config_data)
+        send_issues_to_sentinelone(args, actionable_findings, global_config_data)
         print("RESULT\tScan completed. Found " + str(len(actionable_findings)) + " issue(s).")
     else:
         print(LogColors.OKGREEN + "RESULT\tScan completed. No issue found!" + LogColors.ENDC)

{s1_shift_left_cli-0.4.4 → s1_shift_left_cli-0.4.6}/src/s1_cns_cli/cli/scan/secret.py

@@ -10,8 +10,9 @@ import uuid
 from tabulate import tabulate
 
 from s1_cns_cli.cli.config import get_config_manager
-from s1_cns_cli.cli.registry import CodeTypeSubParser, BASELINE_FILE, MissingRequiredFlags, MissingDependencies, \
-    LogColors, PUBLISH_ISSUES_API, InvalidInput, SUPPORTED_GIT_PROVIDERS, OUTPUT_FORMAT, \
+from s1_cns_cli.cli.registry import CodeTypeSubParser, BASELINE_FILE, MissingRequiredFlagsException, \
+    MissingDependenciesException, \
+    LogColors, PUBLISH_ISSUES_API, OUTPUT_FORMAT, \
     SEVERITY_MAP, ScanNotEnabledException, HttpMethod, ScanFailedException
 from s1_cns_cli.cli.utils import read_json_file, write_json_to_file, get_version, \
     print_output_on_file, get_severity_color, get_wrapping_length, wrap_text, get_priority, \
@@ -73,29 +74,15 @@ def is_git_installed():
 
 def secret_pre_evaluation(args):
     if args.generate_baseline and (len(args.range) < 2):
-        raise MissingRequiredFlags("Please provide mandatory flag --range while generating baseline.")
+        raise MissingRequiredFlagsException("Please provide mandatory flag --range while generating baseline.")
 
     if args.publish_result and not args.pull_request and not args.pre_commit:
-        raise MissingRequiredFlags(
+        raise MissingRequiredFlagsException(
             "Publish result for secret scanning will only works with pre-commit or pull-request.")
 
-    if args.publish_result and (args.repo_url == "" or args.repo_full_name == "" or args.provider == ""):
-        raise MissingRequiredFlags(
-            "Please provide mandatory flags (--repo-url, --repo-full-name, --provider) to publish results to SentinelOne CNS.")
-
-    if args.provider != "" and args.provider not in SUPPORTED_GIT_PROVIDERS:
-        raise InvalidInput(f"Provider not supported. Supported providers: {', '.join(SUPPORTED_GIT_PROVIDERS)}")
-
-    if args.repo_full_name != "" and "/" not in args.repo_full_name:
-        raise InvalidInput("Please provide repository full name(owner/repoName)")
-
-    if args.repo_url:
-        if all(provider.lower() not in args.repo_url.lower() for provider in SUPPORTED_GIT_PROVIDERS):
-            raise InvalidInput(f"provider not supported yet. Please contact SentinelOne CNS support.")
-
     if (args.all_commits or args.range or args.pull_request or
         args.scan_commit or args.pre_commit) and not is_git_installed():
-        raise MissingDependencies("git not found. Please install Git or ensure it's in your system's PATH.")
+        raise MissingDependenciesException("git not found. Please install Git or ensure it's in your system's PATH.")
 
     if args.list_detectors:
         return
@@ -157,7 +144,7 @@ def secret_post_evaluation(args, issues, secret_config_data, global_config_data)
 
         print_issue_on_console(actionable_findings, args.quiet, args.verbose, show_commit_id, args.disable_verification)
         save_issues_on_file(args, actionable_findings, global_config_data)
-        send_result_to_sentinelone(args, sorted_findings, global_config_data)
+        send_result_to_sentinelone(args, actionable_findings, global_config_data)
         print("RESULT\tScan completed. Found " + str(len(actionable_findings)) + " issues.")
     else:
         print(LogColors.OKGREEN + "RESULT\tScan completed. No issue found!" + LogColors.ENDC)
@@ -194,7 +181,7 @@ def generate_command(args, global_config_data, secret_config_data, output_file,
     version = get_version()
     secret_detector_binary_path = os.path.join(cache_directory, "bin", version, "bin_secret_detector")
     if not os.path.exists(secret_detector_binary_path):
-        raise MissingDependencies(f"Missing bin_secret_detector {version}")
+        raise MissingDependenciesException(f"Missing bin_secret_detector {version}")
 
     command = [secret_detector_binary_path, "--output-path", output_file]
     if args.list_detectors:

{s1_shift_left_cli-0.4.4 → s1_shift_left_cli-0.4.6}/src/s1_cns_cli/cli/scan/vulnerability.py

@@ -11,7 +11,7 @@ from datetime import datetime, timezone
 from tabulate import tabulate
 
 from s1_cns_cli.cli.config import get_config_manager
-from s1_cns_cli.cli.registry import MissingRequiredFlags, LogColors, MissingDependencies, \
+from s1_cns_cli.cli.registry import MissingRequiredFlagsException, LogColors, MissingDependenciesException, \
     SENTINELONE_JSON, DEFECT_DOJO_GENERIC_FORMAT, OUTPUT_FORMAT, SEVERITY_MAP, HttpMethod, DOWNLOAD_VULN_DB_INFO_API, \
     ScanNotEnabledException, ScanFailedException
 from s1_cns_cli.cli.utils import read_json_file, print_output_on_file, get_config_path, get_severity_color, \
@@ -107,7 +107,7 @@ def vulnerability_pre_evaluation(args, cache_directory):
         LOGGER.warning("--sbom-format should be used with --generate-sbom")
 
     if args.directory == "" and args.docker_image == "":
-        raise MissingRequiredFlags("Either --d/--directory or --docker-image is required with vuln")
+        raise MissingRequiredFlagsException("Either --d/--directory or --docker-image is required with vuln")
 
     if output_format == OUTPUT_FORMAT.SARIF or output_format == OUTPUT_FORMAT.CSV:
         if args.generate_sbom:
@@ -223,7 +223,7 @@ def generate_command(args, cache_directory, output_path, global_config_data, vul
     cli_version = get_version()
     binary_path = os.path.join(cache_directory, "bin", cli_version, "bin_vulnerability_scanner")
     if not os.path.exists(binary_path):
-        raise MissingDependencies(f"Missing Vulnerability Scanner Binary: {cli_version}")
+        raise MissingDependenciesException(f"Missing Vulnerability Scanner Binary: {cli_version}")
 
     scan_path = args.directory
     if args.docker_image:

{s1_shift_left_cli-0.4.4 → s1_shift_left_cli-0.4.6}/src/s1_cns_cli/cli/utils.py

@@ -18,9 +18,10 @@ from sentry_sdk import capture_exception, configure_scope
 from s1_cns_cli import version
 from s1_cns_cli.cli.registry import CONFIG_FILE_NAME, CodeTypeSubParser, IacConfigData, HttpMethod, \
     Severity, PIP_COMMAND, PYPI_URL, GET_PRE_SIGNED_URL_API, BINARY_LIST, DEFAULT_TIMEOUT, LogColors, \
-    DEFAULT_SENTINELONE_CNS_DIR, SENTINELONE_CNS_LOCAL_CONFIG_PATH, PlatformNotSupported, HttpConnectionError, \
-    RequestTimeout, \
-    SENTRY_TAGS, DownloadException, OUTPUT_FORMAT, UnauthorizedUser, BINARY_DIR, SEVERITIES, NotFound, \
+    DEFAULT_SENTINELONE_CNS_DIR, SENTINELONE_CNS_LOCAL_CONFIG_PATH, PlatformNotSupportedException, \
+    HttpConnectionException, \
+    RequestTimeoutException, \
+    SENTRY_TAGS, DownloadException, OUTPUT_FORMAT, UnauthorizedUserException, BINARY_DIR, SEVERITIES, NotFoundException, \
     SEVERITY_TO_NUMBER, BadRequestException, ServiceNotAvailableException, AccessDeniedException
 
 LOGGER = logging.getLogger("cli")
@@ -87,22 +88,22 @@ def make_request(method, url, service_user_api_token, query_params=None, data={}
         if response.status_code == 400:
             raise BadRequestException(handle_error(response.json()))
         if response.status_code == 401:
-            raise UnauthorizedUser(handle_error(response.json()))
+            raise UnauthorizedUserException(handle_error(response.json()))
         if response.status_code == 403:
             raise AccessDeniedException(handle_error(response.json()))
         if response.status_code == 404:
-            raise NotFound(handle_error(response.json()))
+            raise NotFoundException(handle_error(response.json()))
         if response.status_code == 501:
-            raise PlatformNotSupported(f"Platform {request_headers['x-runtime-arch']} is not supported.")
+            raise PlatformNotSupportedException(f"Platform {request_headers['x-runtime-arch']} is not supported.")
         if response.status_code == 503:
             raise ServiceNotAvailableException("Service is temporarily unavailable. Please try again later")
         if response.status_code >= 400 and response.status_code < 600:
             raise Exception(handle_error(response.json()))
         return response
     except requests.ConnectionError as e:
-        raise HttpConnectionError(f"Unable to send request to url: {url} due to connection error")
+        raise HttpConnectionException(f"Unable to send request to url: {url} due to connection error")
     except requests.Timeout as e:
-        raise RequestTimeout(f"Request timed out for url:{url}")
+        raise RequestTimeoutException(f"Request timed out for url:{url}")
 
 
 def delete_all_cache(cache_directory):
@@ -309,10 +310,11 @@ def download_file(url, destination):
                 if chunk:
                     f.write(chunk)
         os.chmod(destination, 0o755)
-        expected_sha_sum = r.headers.get("x-amz-meta-checksum")
-        current_sha_sum = calculate_sha256(destination)
-        if current_sha_sum != expected_sha_sum:
-            raise Exception("Failed to configure SentinelOne CNS CLI, please try again.")
+        # todo: download checksum file from s3 and then verify
+        # expected_sha_sum = r.headers.get("x-amz-meta-checksum")
+        # current_sha_sum = calculate_sha256(destination)
+        # if current_sha_sum != expected_sha_sum:
+        #     raise Exception("Failed to configure SentinelOne CNS CLI, please try again.")
 
 
 def get_presigned_urls(cache, binary_list):

{s1_shift_left_cli-0.4.4 → s1_shift_left_cli-0.4.6}/src/s1_cns_cli/version.py

@@ -1,2 +1,2 @@
-version = "0.4.4" # update version in pyproject.toml + server/templates/cli/latestVersion.json at trustic as well
+version = "0.4.6" # update version in pyproject.toml + server/templates/cli/latestVersion.json at trustic as well
 build_type = "pypi" # "pypi"/"testpypi"/"local"

s1_shift_left_cli-0.4.4/src/s1_cns_cli/cli/scan/code_scanner.py

@@ -1,62 +0,0 @@
-import logging
-
-from s1_cns_cli.cli.config import init_config_manager
-from s1_cns_cli.cli.registry import CodeTypeSubParser, MissingConfig, GET_CONFIG_DATA_API, HttpMethod
-from s1_cns_cli.cli.scan import iac, secret
-from s1_cns_cli.cli.scan import vulnerability
-from s1_cns_cli.cli.utils import check_if_paths_exist, make_request, read_json_file, get_config_path, upsert_s1_cns_cli
-
-LOGGER = logging.getLogger("cli")
-
-
-def handle_scan_sub_parser(args, cache_directory):
-    global_pre_evaluation(args, cache_directory)
-    if args.scan_type_sub_parser == CodeTypeSubParser.IAC:
-        return iac.iac_parser(args, cache_directory)
-    elif args.scan_type_sub_parser == CodeTypeSubParser.SECRET:
-        return secret.secret_parser(args, cache_directory)
-    elif args.scan_type_sub_parser == CodeTypeSubParser.VULN:
-        return vulnerability.vulnerability_parser(args, cache_directory)
-
-
-# global_pre_evaluation: will check we have updated s1-cns-cli and configs
-def global_pre_evaluation(args, cache_directory):
-    global_config_file_path = get_config_path(cache_directory)
-    if not check_if_paths_exist([cache_directory, global_config_file_path]):
-        raise MissingConfig()
-
-    global_config_data = read_json_file(global_config_file_path)
-    management_console_url = global_config_data.get("management_console_url")
-
-    if (hasattr(args, 'list_detectors') and args.list_detectors) or (hasattr(args, 'list_plugins') and args.list_plugins):
-        data = {
-            "global": global_config_data,
-            "secret": {},
-            "iac": {},
-            "vuln": {}
-        }
-        init_config_manager(data)
-        return
-
-    tag = global_config_data.get("tag")
-    scope_type = global_config_data.get("scope_type")
-    scope_id = global_config_data.get("scope_id")
-    if len(args.tag) > 0:
-        tag = args.tag
-
-    if len(tag) == 0:
-        raise MissingConfig("Missing 'tag', please reconfigure cli or use the '--tag' flag.")
-
-    if len(management_console_url) == 0:
-        raise MissingConfig("'Management_console_url' is required, please reconfigure using '--management_console_url "
-                            " flag")
-
-    response = make_request(HttpMethod.GET, management_console_url + GET_CONFIG_DATA_API, global_config_data["service_user_api_token"],
-                            {"tag": tag, "scopeType": scope_type, "scopeIds": scope_id})
-
-    data = response.json()["data"]
-
-    # merge cli_global_config with response global_config
-    data["global"] = {**data["global"], **global_config_data}
-    init_config_manager(data)
-    upsert_s1_cns_cli(cache_directory)