s1-shift-left-cli 0.5.0__tar.gz → 0.5.2__tar.gz

{s1_shift_left_cli-0.5.0 → s1_shift_left_cli-0.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: s1_shift_left_cli
-Version: 0.5.0
+Version: 0.5.2
 Summary: SentinelOne CNS CLI is an extension of our vision to shift-left security with SentinelOne CNS.
 License: Proprietary
 Author: pingsafe-dev

{s1_shift_left_cli-0.5.0 → s1_shift_left_cli-0.5.2}/pyproject.toml

@@ -8,7 +8,7 @@ name = "s1_shift_left_cli"
 packages = [
     { include = "s1_cns_cli", from = "src" }
 ]
-version = "0.5.0" # update version in src/s1_cns_cli/version.py as well
+version = "0.5.2" # update version in src/s1_cns_cli/version.py as well
 authors = ["pingsafe-dev <dev@pingsafe.com>"]
 description = "SentinelOne CNS CLI is an extension of our vision to shift-left security with SentinelOne CNS."
 readme = "PYPI_README.md"

{s1_shift_left_cli-0.5.0 → s1_shift_left_cli-0.5.2}/src/s1_cns_cli/cli/command_line_arguments.py

@@ -115,6 +115,12 @@ def add_iac_flags(iac_parser):
         default=False,
         help="enable debug mode for detailed logging",
     )
+    iac_parser.add_argument(
+        "--connections",
+        dest="connections",
+        metavar="",
+        help=argparse.SUPPRESS
+    )
     iac_parser.add_argument(
         "-d",
         "--directory",
@@ -130,6 +136,25 @@ def add_iac_flags(iac_parser):
         default=True,
         help="download external modules used in code to scan",
     )
+    iac_parser.add_argument(
+        "--evaluate-rego",
+        dest="evaluate_rego",
+        action="store_true",
+        default=False,
+        help=argparse.SUPPRESS
+    )
+    iac_parser.add_argument(
+        "--file-content",
+        dest="file_content",
+        metavar="",
+        help=argparse.SUPPRESS
+    )
+    iac_parser.add_argument(
+        "--file-name",
+        dest="file_name",
+        metavar="",
+        help=argparse.SUPPRESS
+    )
     iac_parser.add_argument(
         "--frameworks",
         dest="frameworks",
@@ -146,6 +171,13 @@ def add_iac_flags(iac_parser):
         default=False,
         help="generate baseline to ignore issues",
     )
+    iac_parser.add_argument(
+        "--generate-graph",
+        dest="generate_graph",
+        action="store_true",
+        default=False,
+        help=argparse.SUPPRESS
+    )
     iac_parser.add_argument(
         "--include-ignored",
         dest="include_ignored",
@@ -188,6 +220,12 @@ def add_iac_flags(iac_parser):
         default=False,
         help="scan pre-commit changes",
     )
+    iac_parser.add_argument(
+        "--primary-resource-type",
+        dest="primary_resource_type",
+        metavar="",
+        help=argparse.SUPPRESS
+    )
     iac_parser.add_argument(
         "--provider",
         dest="provider",
@@ -203,6 +241,11 @@ def add_iac_flags(iac_parser):
         default=False,
         help="publish scan results to SentinelOne CNS",
     )
+    iac_parser.add_argument(
+        "--rego-script",
+        dest="rego_script",
+        help=argparse.SUPPRESS
+    )
     iac_parser.add_argument(
         "--repo-full-name",
         dest="repo_full_name",

{s1_shift_left_cli-0.5.0 → s1_shift_left_cli-0.5.2}/src/s1_cns_cli/cli/main.py

@@ -18,6 +18,7 @@ from s1_cns_cli.cli.utils import initialize_logger, get_cache_directory, get_exi
     send_exception_to_sentry, add_sentry_tags, DownloadException, delete_all_cache, get_config_path, read_json_file, \
     make_request, get_version
 from s1_cns_cli.sentry import init_sentry, drain_sentry
+from s1_cns_cli.cli.server.iac import generate_graph, evaluate_rego
 
 root_logger = logging.getLogger()
 if root_logger.hasHandlers():
@@ -27,8 +28,12 @@ LOGGER = logging.getLogger("cli")
 
 
 def main(args, cache_directory):
-    # print(SENTINELONE_CNS_ART)
     if args.main_sub_parser == MainSubParser.SCAN:
+        if args.scan_type_sub_parser == CodeTypeSubParser.IAC and (args.generate_graph or args.evaluate_rego):
+            if args.generate_graph:
+                return generate_graph(args)
+            elif args.evaluate_rego:
+                return evaluate_rego(args)
         return code_scanner.handle_scan_sub_parser(args, cache_directory)
     elif args.main_sub_parser == MainSubParser.CONFIG:
         return config.configure(args)

{s1_shift_left_cli-0.5.0 → s1_shift_left_cli-0.5.2}/src/s1_cns_cli/cli/registry.py

@@ -103,6 +103,7 @@ SENTINELONE_CNS_ART = """
 class MainSubParser(str, Enum):
     SCAN = "scan"
     CONFIG = "config"
+    SERVER = "server"
 
 
 class CodeTypeSubParser(str, Enum):
@@ -111,6 +112,11 @@ class CodeTypeSubParser(str, Enum):
     VULN = "vuln"
 
 
+class ServerTypeSubParser(str, Enum):
+    GENERATE_GRAPH = "generate-graph"
+    EVALUATE_REGO = "evaluate-rego"
+
+
 class ConfigTypeSubParser(str, Enum):
     SECRET = "secret"
 
@@ -368,3 +374,4 @@ Examples:
                                --username (registry username)
                                --password (registry password)
 """
+

s1_shift_left_cli-0.5.2/src/s1_cns_cli/cli/server/iac.py

@@ -0,0 +1,175 @@
+import os
+import logging
+import tempfile
+import uuid
+import shutil
+import json
+from s1_cns_cli.cli.utils import decode_base_64, write_to_file, get_home_path
+from s1_cns_cli.cli.registry import IacFramework, InvalidGraphConnection, MissingRequiredFlagsException, InvalidInputException
+from s1_cns_cli.cli.scan import iac as iac_helper
+from s1_cns_cli.s1graph.cloudformation.runner import Runner as CloudformationRunner
+from s1_cns_cli.s1graph.helm.runner import Runner as HelmRunner
+from s1_cns_cli.s1graph.kubernetes.runner import Runner as KubernetesRunner
+from s1_cns_cli.s1graph.terraform.plan_runner import Runner as TerraFormPlanRunner
+from s1_cns_cli.s1graph.terraform.runner import Runner as TerraFormRunner
+from s1_cns_cli.s1graph.runner_filter import RunnerFilter
+
+LOGGER = logging.getLogger("cli")
+
+
+def get_runner(framework: str):
+    if framework == IacFramework.HELM.value:
+        return HelmRunner()
+    elif framework == IacFramework.TERRAFORM.value:
+        return TerraFormRunner()
+    elif framework == IacFramework.TERRAFORM_PLAN.value:
+        return TerraFormPlanRunner()
+    elif framework == IacFramework.KUBERNETES.value:
+        return KubernetesRunner()
+    elif framework == IacFramework.CLOUDFORMATION.value:
+        return CloudformationRunner()
+    else:
+        return None
+
+
+def get_filter(framework: str):
+    if framework == IacFramework.HELM.value:
+        return RunnerFilter(framework=["helm"], download_external_modules=True)
+    elif framework == IacFramework.TERRAFORM.value:
+        return RunnerFilter(framework=["terraform"], download_external_modules=True)
+    elif framework == IacFramework.TERRAFORM_PLAN.value:
+        return RunnerFilter(framework=["terraform_plan"], download_external_modules=True)
+    elif framework == IacFramework.KUBERNETES.value:
+        return RunnerFilter(framework=["kubernetes"], download_external_modules=True)
+    elif framework == IacFramework.CLOUDFORMATION.value:
+        return RunnerFilter(framework=["cloudformation"], download_external_modules=True)
+    else:
+        return None
+
+
+def create_graph(framework, file_extension, file_content):
+    base_dir = os.path.join(tempfile.gettempdir(), str(uuid.uuid4()))
+    file_path = os.path.join(base_dir, str(uuid.uuid4()))
+    try:
+
+        file_path += file_extension
+        runner = get_runner(framework)
+        runner_filter = get_filter(framework)
+        if runner is None or runner_filter is None:
+            raise Exception(f"Framework: {framework} not supported")
+
+        if not os.path.exists(base_dir):
+            os.mkdir(base_dir)
+
+        write_to_file(file_path, file_content)
+        return runner.generate_graph(base_dir, runner_filter)
+    except Exception as e:
+        raise e
+    finally:
+        if os.path.exists(base_dir):
+            shutil.rmtree(base_dir, ignore_errors=True)
+
+
+def validate_args(args):
+    log_error = "Missing required parameters. Require: --filename, --file-content, --output-file, --frameworks"
+    if args.generate_graph:
+        if args.file_name == "" or args.file_content == "" or args.output_file == "" or len(args.frameworks) == 0:
+            raise MissingRequiredFlagsException(log_error)
+        if len(args.frameworks) > 1:
+            raise InvalidInputException("Only ony one framework is allowed with --generate-graph.")
+    if args.evaluate_rego:
+        if args.file_name == "" or args.file_content == "" or args.output_file == "" or len(args.frameworks) == 0 or args.rego_script == ""\
+                or args.primary_resource_type == "":
+            raise MissingRequiredFlagsException(f"{log_error}, --rego-script, --primary-resource-type")
+        if len(args.frameworks) > 1:
+            raise InvalidInputException("Only ony one framework is allowed with --evaluate-rego.")
+
+
+def generate_graph(args):
+    LOGGER.info("Graph generation initiated.")
+
+    validate_args(args)
+
+    framework = args.frameworks[0]
+    split_file_name = os.path.splitext(args.file_name)
+    if len(split_file_name) != 2:
+        raise InvalidInputException("Wrong filename, please provide filename with extension. Example - sample.tf")
+
+    file_extension = split_file_name[1]
+    file_content = decode_base_64(args.file_content)
+    output_path = args.output_file
+
+    graph = create_graph(framework, file_extension, file_content)
+
+    write_to_file(output_path, json.dumps(graph))
+    LOGGER.info(f"Graph generated and written at {output_path}")
+
+
+def evaluate_rego(args):
+    try:
+        LOGGER.info("Rego evaluation initiated.")
+
+        validate_args(args)
+
+        split_file_name = os.path.splitext(args.file_name)
+        if len(split_file_name) != 2:
+            raise InvalidInputException("Wrong filename, please provide filename with extension. Example - sample.tf")
+
+        file_extension = split_file_name[1]
+        file_content = decode_base_64(args.file_content)
+        framework = args.frameworks[0]
+        rego_script = decode_base_64(args.rego_script)
+
+        if args.connections == "":
+            args.connections = "{}"
+        connections = json.loads(args.connections)
+        primary_resource_type = args.primary_resource_type
+
+        if "isVulnerable" not in rego_script:
+            LOGGER.error("Invalid rego script")
+            return
+
+        graph = create_graph(framework, file_extension, file_content)
+        grouped_nodes_by_resource_type = iac_helper.group_nodes_by_resource_type(graph["nodes"])
+        graph_nodes_by_id = iac_helper.get_graph_nodes_by_id(graph["nodes"])
+        grouped_links_by_source = iac_helper.group_links(graph["links"], "source")
+        grouped_links_by_target = iac_helper.group_links(graph["links"], "target")
+
+        results = iac_helper.evaluate_plugin_on_graph("", generate_plugin_data(connections, rego_script),
+                                                      grouped_nodes_by_resource_type[primary_resource_type],
+                                                      grouped_links_by_source, grouped_links_by_target,
+                                                      framework, graph_nodes_by_id,
+                                                      os.path.join(get_home_path(".s1cns")), False)
+
+        write_to_file(args.output_file, json.dumps(generate_evaluation_result(results)))
+        LOGGER.info(f"Result generated and and written at {args.output_file}")
+    except InvalidGraphConnection as e:
+        LOGGER.error(e)
+    except Exception as e:
+        LOGGER.error(e)
+
+
+def generate_evaluation_result(results):
+    return {
+        "output": {
+            "code": "VULNERABLE" if len(results) > 0 else "NOT_VULNERABLE",
+            "data": {
+                "context": {},
+                "isVulnerable": len(results) > 0
+            }
+        }
+    }
+
+
+def generate_plugin_data(connections, rego_script):
+    return {
+        "id": "id",
+        "severity": "severity",
+        "description": "description",
+        "title": "title",
+        "impact": "impact",
+        "info_link": "info_link",
+        "recommended_action": "recommended_action",
+        "connections": connections,
+        "rego": rego_script
+    }

{s1_shift_left_cli-0.5.0 → s1_shift_left_cli-0.5.2}/src/s1_cns_cli/cli/utils.py

@@ -1,3 +1,4 @@
+import base64
 import csv
 import hashlib
 import json
@@ -550,4 +551,12 @@ def find_last_idx_for_severity(issues: list, severity: str) -> int:
         else:
             hi = mid - 1
 
-    return lo
+    return lo
+
+def decode_base_64(encoded_string):
+    decoded_bytes = base64.b64decode(encoded_string)
+    return decoded_bytes.decode("utf-8")
+
+def write_to_file(path, content):
+    with open(path, 'w') as file:
+        file.write(content)

s1_shift_left_cli-0.5.2/src/s1_cns_cli/version.py

@@ -0,0 +1,2 @@
+version = "0.5.2" # update version in pyproject.toml
+build_type = "pypi" # "pypi"/"testpypi"/"local"

s1_shift_left_cli-0.5.0/src/s1_cns_cli/version.py

@@ -1,2 +0,0 @@
-version = "0.5.0" # update version in pyproject.toml + server/templates/cli/latestVersion.json at trustic as well
-build_type = "pypi" # "pypi"/"testpypi"/"local"