socketsecurity 0.0.38__py3-none-any.whl

core/__init__.py

@@ -0,0 +1,644 @@
+import logging
+import requests
+from urllib.parse import urlencode
+import base64
+import json
+from core.exceptions import APIFailure, APIKeyMissing, APIAccessDenied, APIInsufficientQuota, APIResourceNotFound
+from core.classes import (
+    Report,
+    Issue,
+    Package,
+    Alert,
+    FullScan,
+    FullScanParams,
+    Repository,
+    Diff,
+    Purl
+)
+import platform
+from glob import glob
+import time
+
+
+__author__ = 'socket.dev'
+__version__ = '0.0.38'
+__all__ = [
+    "Core",
+    "log"
+]
+
+
+global encoded_key
+version = __version__
+api_url = "https://api.socket.dev/v0"
+timeout = 30
+full_scan_path = ""
+repository_path = ""
+org_id = None
+org_slug = None
+all_new_alerts = False
+issue_file = "core/issues.json"
+issue_text = {}
+security_policy = {}
+log = logging.getLogger("socketdev")
+log.addHandler(logging.NullHandler())
+
+
+def load_issue_data() -> dict:
+    """
+    Loads the issue data json and returns it as a dictionary. This data is used in the alert messages.
+    :return:
+    """
+    try:
+        file = open(issue_file, 'r')
+        data = json.load(file)
+        return data
+    except Exception as error:
+        print("Unable to load issue data")
+        print(error)
+        exit(1)
+
+
+def encode_key(token: str) -> None:
+    """
+    encode_key takes passed token string and does a base64 encoding. It sets this as a global variable
+    :param token: str of the Socket API Security Token
+    :return:
+    """
+    global encoded_key
+    encoded_key = base64.b64encode(token.encode()).decode('ascii')
+
+
+def do_request(
+        path: str,
+        headers: dict = None,
+        payload: [dict, str] = None,
+        files: list = None,
+        method: str = "GET",
+) -> requests.request:
+    """
+    do_requests is the shared function for making HTTP calls
+
+    :param path: Required path for the request
+    :param headers: Optional dictionary of headers. If not set will use a default set
+    :param payload: Optional dictionary or string of the payload to pass
+    :param files: Optional list of files to upload
+    :param method: Optional method to use, defaults to GET
+    :return:
+    """
+    if encoded_key is None or encoded_key == "":
+        raise APIKeyMissing
+
+    if headers is None:
+        headers = {
+            'Authorization': f"Basic {encoded_key}",
+            'User-Agent': 'SocketPythonScript/0.0.1',
+            "accept": "application/json"
+        }
+    url = f"{api_url}/{path}"
+    response = requests.request(
+        method.upper(),
+        url,
+        headers=headers,
+        data=payload,
+        files=files,
+        timeout=timeout
+    )
+    if response.status_code <= 399:
+        return response
+    elif response.status_code == 400:
+        print(f"url={url}")
+        print(f"payload={payload}")
+        print(f"files={files}")
+        error = {
+            "msg": "bad request",
+            "error": response.text
+        }
+        raise APIFailure(error)
+    elif response.status_code == 401:
+        raise APIAccessDenied("Unauthorized")
+    elif response.status_code == 403:
+        raise APIInsufficientQuota("Insufficient max_quota for API method")
+    elif response.status_code == 404:
+        raise APIResourceNotFound(f"Path not found {path}")
+    elif response.status_code == 429:
+        raise APIInsufficientQuota("Insufficient quota for API route")
+    else:
+        msg = {
+            "status_code": 524,
+            "UnexpectedError": "There was an unexpected error using the API"
+        }
+        raise APIFailure(msg)
+
+
+class Core:
+    token: str
+    base_api_url: str
+    request_timeout: int
+    reports: list
+
+    def __init__(self, token: str, base_api_url=None, request_timeout=None, enable_all_alerts=False):
+        self.token = token + ":"
+        encode_key(self.token)
+        global issue_text
+        issue_text = load_issue_data()
+        self.socket_date_format = "%Y-%m-%dT%H:%M:%S.%fZ"
+        self.base_api_url = base_api_url
+        if self.base_api_url is not None:
+            Core.set_api_url(self.base_api_url)
+        self.request_timeout = request_timeout
+        if self.request_timeout is not None:
+            Core.set_timeout(self.request_timeout)
+        if enable_all_alerts:
+            global all_new_alerts
+            all_new_alerts = True
+        Core.set_org_vars()
+
+    @staticmethod
+    def set_org_vars() -> None:
+        """
+        Sets the main shared global variables
+        :return:
+        """
+        global org_id, org_slug, full_scan_path, repository_path, security_policy
+        org_id, org_slug = Core.get_org_id_slug()
+        base_path = f"orgs/{org_slug}"
+        full_scan_path = f"{base_path}/full-scans"
+        repository_path = f"{base_path}/repos"
+        security_policy = Core.get_security_policy()
+
+    @staticmethod
+    def set_api_url(base_url: str):
+        """
+        Set the global API URl if provided
+        :param base_url:
+        :return:
+        """
+        global api_url
+        api_url = base_url
+
+    @staticmethod
+    def set_timeout(request_timeout: int):
+        """
+        Set the global Requests timeout
+        :param request_timeout:
+        :return:
+        """
+        global timeout
+        timeout = request_timeout
+
+    @staticmethod
+    def get_org_id_slug() -> (str, str):
+        """
+        Gets the Org ID and Org Slug for the API Token
+        :return:
+        """
+        path = "organizations"
+        response = do_request(path)
+        data = response.json()
+        organizations = data.get("organizations")
+        new_org_id = None
+        new_org_slug = None
+        if len(organizations) == 1:
+            for key in organizations:
+                new_org_id = key
+                new_org_slug = organizations[key].get('slug')
+        return new_org_id, new_org_slug
+
+    @staticmethod
+    def get_sbom_data(full_scan_id: str) -> list:
+        path = f"orgs/{org_slug}/full-scans/{full_scan_id}"
+        response = do_request(path)
+        results = []
+        try:
+            data = response.json()
+            results = data.get("sbom_artifacts") or []
+        except Exception as error:
+            log.info("Failed with old style full-scan API using new format")
+            log.info(error)
+            data = response.text
+            data.strip('"')
+            data.strip()
+            for line in data.split("\n"):
+                if line != '"' and line != "" and line is not None:
+                    item = json.loads(line)
+                    results.append(item)
+        return results
+
+    @staticmethod
+    def get_security_policy() -> dict:
+        """
+        Get the Security policy and determine the effective Org security policy
+        :return:
+        """
+        path = "settings"
+        payload = [
+            {
+                "organization": org_id
+            }
+        ]
+        response = do_request(path, payload=json.dumps(payload), method="POST")
+        data = response.json()
+        defaults = data.get("defaults")
+        default_rules = defaults.get("issueRules")
+        entries = data.get("entries")
+        org_rules = {}
+        for org_set in entries:
+            settings = org_set.get("settings")
+            if settings is not None:
+                org_details = settings.get("organization")
+                org_rules = org_details.get("issueRules")
+        for default in default_rules:
+            if default not in org_rules:
+                action = default_rules[default]["action"]
+                org_rules[default] = {
+                    "action": action
+                }
+        return org_rules
+
+    @staticmethod
+    def find_files(path: str) -> list:
+        """
+        Globs the path for supported manifest files.
+        Note: Might move the source to a JSON file
+        :param path: Str - path to where the manifest files are located
+        :param workspace: str - workspace path to be stripped from the name
+        :return:
+        """
+        socket_globs = {
+            "general": {
+                "readme": {
+                    "pattern": "*readme*"
+                },
+                "notice": {
+                    "pattern": "*notice*"
+                },
+                "license": {
+                    "pattern": "{licen{s,c}e{,-*},copying}"
+                }
+            },
+            "npm": {
+                "package.json": {
+                    "pattern": "package.json"
+                },
+                "package-lock.json": {
+                    "pattern": "package-lock.json"
+                },
+                "npm-shrinkwrap.json": {
+                    "pattern": "npm-shrinkwrap.json"
+                },
+                "yarn.lock": {
+                    "pattern": "yarn.lock"
+                },
+                "pnpm-lock.yaml": {
+                    "pattern": "pnpm-lock.yaml"
+                },
+                "pnpm-lock.yml": {
+                    "pattern": "pnpm-lock.yml"
+                },
+                "pnpm-workspace.yaml": {
+                    "pattern": "pnpm-workspace.yaml"
+                },
+                "pnpm-workspace.yml": {
+                    "pattern": "pnpm-workspace.yml"
+                }
+            },
+            "pypi": {
+                "pipfile": {
+                    "pattern": "pipfile"
+                },
+                "pyproject.toml": {
+                    "pattern": "pyproject.toml"
+                },
+                "requirements.txt": {
+                    "pattern": "*requirements.txt"
+                },
+                "requirements": {
+                    "pattern": "requirements/*.txt"
+                },
+                "requirements-*.txt": {
+                    "pattern": "requirements-*.txt"
+                },
+                "requirements_*.txt": {
+                    "pattern": "requirements_*.txt"
+                },
+                "requirements.frozen": {
+                    "pattern": "requirements.frozen"
+                },
+                "setup.py": {
+                    "pattern": "setup.py"
+                }
+            },
+            "golang": {
+                "go.mod": {
+                    "pattern": "go.mod"
+                },
+                "go.sum": {
+                    "pattern": "go.sum"
+                }
+            }
+        }
+        all_files = []
+        for ecosystem in socket_globs:
+            patterns = socket_globs[ecosystem]
+            for file_name in patterns:
+                pattern = patterns[file_name]["pattern"]
+                file_path = f"{path}/**/{pattern}"
+                files = glob(file_path, recursive=True)
+                for file in files:
+                    if platform.system() == "Windows":
+                        file = file.replace("\\", "/")
+                    found_path, file_name = file.rsplit("/", 1)
+                    details = (found_path, file_name)
+                    all_files.append(details)
+        return all_files
+
+    @staticmethod
+    def create_full_scan(files: list, params: FullScanParams, workspace: str) -> FullScan:
+        """
+        Calls the full scan API to create a new Full Scan
+        :param files: list - Globbed files of manifest files
+        :param params: FullScanParams - Set of query params to pass to the endpoint
+        :param workspace: str - Path of workspace
+        :return:
+        """
+        send_files = []
+        for path, name in files:
+            full_path = f"{path}/{name}"
+            if full_path.startswith(workspace):
+                key = full_path[len(workspace):]
+            else:
+                key = full_path
+            key = key.lstrip("/")
+            key = key.lstrip("./")
+            payload = (
+                key,
+                (
+                    name,
+                    open(full_path, 'rb')
+                )
+            )
+            send_files.append(payload)
+        query_params = urlencode(params.__dict__)
+        full_uri = f"{full_scan_path}?{query_params}"
+        response = do_request(full_uri, method="POST", files=send_files)
+        results = response.json()
+        full_scan = FullScan(**results)
+        full_scan.sbom_artifacts = Core.get_sbom_data(full_scan.id)
+        return full_scan
+
+    @staticmethod
+    def get_head_scan_for_repo(repo_slug: str):
+        """
+        Get the head scan ID for a repository to use for the diff
+        :param repo_slug: Str - Repo slug for the repository that is being diffed
+        :return:
+        """
+        repo_path = f"{repository_path}/{repo_slug}"
+        response = do_request(repo_path)
+        results = response.json()
+        repository = Repository(**results)
+        return repository.head_full_scan_id
+
+    @staticmethod
+    def get_full_scan(full_scan_id: str) -> FullScan:
+        """
+        Get the specified full scan and return a FullScan object
+        :param full_scan_id: str - ID of the full scan to pull
+        :return:
+        """
+        full_scan_url = f"{full_scan_path}/{full_scan_id}"
+        response = do_request(full_scan_url)
+        results = response.json()
+        full_scan = FullScan(**results)
+        full_scan.sbom_artifacts = Core.get_sbom_data(full_scan.id)
+        return full_scan
+
+    @staticmethod
+    def create_new_diff(path: str, params: FullScanParams, workspace: str) -> Diff:
+        """
+        1. Get the head full scan. If it isn't present because this repo doesn't exist yet return an Empty full scan.
+        2. Create a new Full scan for the current run
+        3. Compare the head and new Full scan
+        4. Return a Diff report
+        :param path: Str - path of where to look for manifest files for the new Full Scan
+        :param params: FullScanParams - Query params for the Full Scan endpoint
+        :param workspace: str - Path for workspace
+        :return:
+        """
+        files = Core.find_files(path)
+        try:
+            head_full_scan_id = Core.get_head_scan_for_repo(params.repo)
+            if head_full_scan_id is None or head_full_scan_id == "":
+                head_full_scan = []
+            else:
+                head_start = time.time()
+                head_full_scan = Core.get_sbom_data(head_full_scan_id)
+                head_end = time.time()
+                total_head_time = head_end - head_start
+                print(f"Total time to get head sbom {total_head_time: .2f}")
+        except APIResourceNotFound:
+            head_full_scan = []
+        if files is not None and len(files) > 0:
+            new_scan_start = time.time()
+            new_full_scan = Core.create_full_scan(files, params, workspace)
+            new_scan_end = time.time()
+            total_new_time = new_scan_end - new_scan_start
+            print(f"Total time to get new sbom {total_new_time: .2f}")
+            diff_report = Core.compare_sboms(new_full_scan.sbom_artifacts, head_full_scan)
+        else:
+            diff_report = Diff()
+        return diff_report
+
+    @staticmethod
+    def compare_sboms(new_scan: list, head_scan: list) -> Diff:
+        """
+        compare the SBOMs of the new full Scan and the head full scan. Return a Diff report with new packages,
+        removed packages, and new alerts for the new full scan compared to the head.
+        :param new_scan: FullScan - Newly created FullScan for this execution
+        :param head_scan: FullScan - Current head FullScan for the repository
+        :return:
+        """
+        diff: Diff
+        diff = Diff()
+        new_packages = Core.create_sbom_dict(new_scan)
+        head_packages = Core.create_sbom_dict(head_scan)
+        new_scan_alerts = {}
+        head_scan_alerts = {}
+
+        for package_id in new_packages:
+            purl, package = Core.create_purl(package_id, new_packages)
+            if package_id not in head_packages:
+                diff.new_packages.append(purl)
+            new_scan_alerts = Core.create_issue_alerts(package, new_scan_alerts, new_packages)
+        for package_id in head_packages:
+            purl, package = Core.create_purl(package_id, head_packages)
+            if package_id not in new_packages:
+                diff.removed_packages.append(purl)
+            head_scan_alerts = Core.create_issue_alerts(package, head_scan_alerts, head_packages)
+        diff.new_alerts = Core.compare_issue_alerts(new_scan_alerts, head_scan_alerts, diff.new_alerts)
+        return diff
+
+    @staticmethod
+    def compare_issue_alerts(new_scan_alerts: dict, head_scan_alerts: dict, alerts: list) -> list:
+        """
+        Compare the issue alerts from the new full scan and the head full scans. Return a list of new alerts that
+        are in the new full scan and not in the head full scan
+        :param new_scan_alerts: dictionary of alerts from the new full scan
+        :param head_scan_alerts: dictionary of alerts from the new head scan
+        :param alerts: List of new alerts that are only in the new Full Scan
+        :return:
+        """
+        for alert_key in new_scan_alerts:
+            if alert_key not in head_scan_alerts:
+                new_alerts = new_scan_alerts[alert_key]
+                for alert in new_alerts:
+                    if Core.is_error(alert):
+                        alerts.append(alert)
+            else:
+                new_alerts = new_scan_alerts[alert_key]
+                head_alerts = head_scan_alerts[alert_key]
+                for alert in new_alerts:
+                    if alert not in head_alerts and Core.is_error(alert):
+                        alerts.append(alert)
+        return alerts
+
+    @staticmethod
+    def is_error(alert: Alert):
+        """
+        Compare the current alert against the Security Policy to determine if it should be included. Can be overridden
+        with all_new_alerts Global setting if desired to return all alerts and not just the error category from the
+        security policy.
+        :param alert:
+        :return:
+        """
+        if all_new_alerts or (alert.type in security_policy and security_policy[alert.type]['action'] == "error"):
+            return True
+        else:
+            return False
+
+    @staticmethod
+    def create_issue_alerts(package: Package, alerts: dict, packages: dict) -> dict:
+        """
+        Create the Issue Alerts from the package and base alert data.
+        :param package: Package - Current package that is being looked at for Alerts
+        :param alerts: Dict - All found Issue Alerts across all packages
+        :param packages: Dict - All packages detected in the SBOM and needed to find top level packages
+        :return:
+        """
+        for item in package.alerts:
+            alert = Alert(**item)
+            props = issue_text.get(alert.type)
+            if props is not None:
+                description = props.get("description")
+                title = props.get("title")
+                suggestion = props.get("suggestion")
+                next_step_title = props.get("nextStepTitle")
+            else:
+                description = ""
+                title = ""
+                suggestion = ""
+                next_step_title = ""
+            introduced_by = Core.get_source_data(package, packages)
+            issue_alert = Issue(
+                pkg_type=package.type,
+                pkg_name=package.name,
+                pkg_version=package.version,
+                pkg_id=package.id,
+                type=alert.type,
+                severity=alert.severity,
+                key=alert.key,
+                props=alert.props,
+                description=description,
+                title=title,
+                suggestion=suggestion,
+                next_step_title=next_step_title,
+                introduced_by=introduced_by
+            )
+            if issue_alert.key not in alerts:
+                alerts[issue_alert.key] = [issue_alert]
+            else:
+                alerts[issue_alert.key].append(issue_alert)
+        return alerts
+
+    @staticmethod
+    def get_source_data(package: Package, packages: dict) -> list:
+        """
+        Creates the properties for source data of the source manifest file(s) and top level packages.
+        :param package: Package - Current package being evaluated
+        :param packages: Dict - All packages, used to determine top level package information for transitive packages
+        :return:
+        """
+        introduced_by = []
+        if package.direct:
+            manifests = ""
+            for manifest_data in package.manifestFiles:
+                manifest_file = manifest_data.get("file")
+                manifests += f"{manifest_file};"
+            manifests = manifests.rstrip(";")
+            source = ("direct", manifests)
+            introduced_by.append(source)
+        else:
+            for top_id in package.topLevelAncestors:
+                top_package: Package
+                top_package = packages[top_id]
+                manifests = ""
+                top_purl = f"{top_package.type}/{top_package.name}@{top_package.version}"
+                for manifest_data in top_package.manifestFiles:
+                    manifest_file = manifest_data.get("file")
+                    manifests += f"{manifest_file};"
+                manifests = manifests.rstrip(";")
+                source = (top_purl, manifests)
+                introduced_by.append(source)
+        return introduced_by
+
+    @staticmethod
+    def create_purl(package_id: str, packages: dict) -> (Purl, Package):
+        """
+        Creates the extended PURL data to use in the added or removed package details. Primarily used for outputting
+        data in the results for detections.
+        :param package_id: Str - Package ID of the package to create the PURL data
+        :param packages: dict - All packages to use for look up from transitive packages
+        :return:
+        """
+        package: Package
+        package = packages[package_id]
+        introduced_by = Core.get_source_data(package, packages)
+        purl = Purl(
+            id=package.id,
+            name=package.name,
+            version=package.version,
+            ecosystem=package.type,
+            direct=package.direct,
+            introduced_by=introduced_by,
+            author=package.author or '',
+            size=package.size,
+            transitives=package.transitives
+        )
+        return purl, package
+
+    @staticmethod
+    def create_sbom_dict(sbom: list) -> dict:
+        """
+        Converts the SBOM Artifacts from the FulLScan into a Dictionary for parsing
+        :param sbom: list - Raw artifacts for the SBOM
+        :return:
+        """
+        packages = {}
+        top_level_count = {}
+        for item in sbom:
+            package = Package(**item)
+            if package.id in packages:
+                print("Duplicate package?")
+            else:
+                packages[package.id] = package
+                for top_id in package.topLevelAncestors:
+                    if top_id not in top_level_count:
+                        top_level_count[top_id] = 1
+                    else:
+                        top_level_count[top_id] += 1
+        if len(top_level_count) > 0:
+            for package_id in top_level_count:
+                packages[package_id].transitives = top_level_count[package_id]
+        return packages
+

core/classes.py

@@ -0,0 +1,351 @@
+import json
+
+
+__all__ = [
+    "Report",
+    "Score",
+    "Package",
+    "Issue",
+    "YamlFile",
+    "Alert",
+    "FullScan",
+    "FullScanParams",
+    "Repository",
+    "Diff",
+    "Purl",
+    "GithubComment"
+]
+
+
+class Report:
+    branch: str
+    commit: str
+    id: str
+    pull_requests: list
+    url: str
+    repo: str
+    processed: bool
+    owner: str
+    created_at: str
+    sbom: list
+
+    def __init__(self, **kwargs):
+        self.sbom = []
+        if kwargs:
+            for key, value in kwargs.items():
+                setattr(self, key, value)
+        if not hasattr(self, "processed"):
+            self.processed = False
+        if hasattr(self, "pull_requests"):
+            if self.pull_requests is not None:
+                self.pull_requests = json.loads(str(self.pull_requests))
+
+    def __str__(self):
+        return json.dumps(self.__dict__)
+
+
+class Score:
+    supplyChain: float
+    quality: float
+    maintenance: float
+    license: float
+    overall: float
+    vulnerability: float
+
+    def __init__(self, **kwargs):
+        if kwargs:
+            for key, value in kwargs.items():
+                setattr(self, key, value)
+        for score_name in self.__dict__:
+            score = getattr(self, score_name)
+            if score <= 1:
+                score = score * 100
+                setattr(self, score_name, score)
+
+    def __str__(self):
+        return json.dumps(self.__dict__)
+
+
+class Package:
+    type: str
+    name: str
+    version: str
+    release: str
+    id: str
+    direct: bool
+    manifestFiles: list
+    author: list
+    size: int
+    score: dict
+    scores: Score
+    alerts: list
+    error_alerts: list
+    alert_counts: dict
+    topLevelAncestors: list
+    url: str
+    transitives: int
+
+    def __init__(self, **kwargs):
+        if kwargs:
+            for key, value in kwargs.items():
+                setattr(self, key, value)
+        if not hasattr(self, "direct"):
+            self.direct = False
+        else:
+            if str(self.direct).lower() == "true":
+                self.direct = True
+        self.url = f"https://socket.dev/{self.type}/package/{self.name}/overview/{self.version}"
+        if hasattr(self, 'score'):
+            self.scores = Score(**self.score)
+        if not hasattr(self, "alerts"):
+            self.alerts = []
+        if not hasattr(self, "author"):
+            self.author = []
+        if not hasattr(self, "size"):
+            self.size = 0
+        if not hasattr(self, "topLevelAncestors"):
+            self.topLevelAncestors = []
+        if not hasattr(self, "manifestFiles"):
+            self.manifestFiles = []
+        if not hasattr(self, "transitives"):
+            self.transitives = 0
+        self.alert_counts = {
+            "critical": 0,
+            "high": 0,
+            "middle": 0,
+            "low": 0
+        }
+        self.error_alerts = []
+
+    def __str__(self):
+        return json.dumps(self.__dict__)
+
+
+class Issue:
+    pkg_type: str
+    pkg_name: str
+    pkg_version: str
+    category: str
+    type: str
+    severity: str
+    pkg_id: str
+    props: dict
+    key: str
+    is_error: bool
+    description: str
+    title: str
+    emoji: str
+    next_step_title: str
+    suggestion: str
+    introduced_by: list
+    manifests: str
+
+    def __init__(self, **kwargs):
+        if kwargs:
+            for key, value in kwargs.items():
+                setattr(self, key, value)
+
+        if hasattr(self, "created_at"):
+            self.created_at = self.created_at.strip(" (Coordinated Universal Time)")
+        if not hasattr(self, "introduced_by"):
+            self.introduced_by = []
+        if not hasattr(self, "manifests"):
+            self.manifests = ""
+
+    def __str__(self):
+        return json.dumps(self.__dict__)
+
+    def __eq__(self, other):
+        return self.__dict__ == other.__dict__
+
+    def __ne__(self, other):
+        return self.__dict__ != other.__dict__
+
+
+class YamlFile:
+    path: str
+    name: str
+    team: list
+    module: list
+    production: bool
+    pii: bool
+    alerts: dict
+    error_ids: list
+
+    def __init__(
+            self,
+            **kwargs
+    ):
+        self.alerts = {}
+        self.error_ids = []
+
+        if kwargs:
+            for key, value in kwargs.items():
+                setattr(self, key, value)
+
+    def __str__(self):
+        alerts = {}
+        for issue_key in self.alerts:
+            issue: Issue
+            issue = self.alerts[issue_key]["issue"]
+            manifests = self.alerts[issue_key]["manifests"]
+            new_alert = {
+                "issue": json.loads(str(issue)),
+                "manifests": manifests
+            }
+            alerts[issue_key] = new_alert
+
+        dump_object = self
+        dump_object.alerts = alerts
+        return json.dumps(dump_object.__dict__)
+
+
+class Alert:
+    key: str
+    type: str
+    severity: str
+    category: str
+    props: dict
+
+    def __init__(self, **kwargs):
+        if kwargs:
+            for key, value in kwargs.items():
+                setattr(self, key, value)
+        if not hasattr(self, "props"):
+            self.props = {}
+
+    def __str__(self):
+        return json.dumps(self.__dict__)
+
+
+class FullScan:
+    id: str
+    created_at: str
+    updated_at: str
+    organization_id: str
+    repository_id: str
+    branch: str
+    commit_message: str
+    commit_hash: str
+    pull_request: int
+    sbom_artifacts: list
+
+    def __init__(self, **kwargs):
+        if kwargs:
+            for key, value in kwargs.items():
+                setattr(self, key, value)
+        if not hasattr(self, "sbom_artifacts"):
+            self.sbom_artifacts = []
+
+    def __str__(self):
+        return json.dumps(self.__dict__)
+
+
+class Repository:
+    id: str
+    created_at: str
+    updated_at: str
+    head_full_scan_id: str
+    name: str
+    description: str
+    homepage: str
+    visibility: str
+    archived: bool
+    default_branch: str
+
+    def __init__(self, **kwargs):
+        if kwargs:
+            for key, value in kwargs.items():
+                setattr(self, key, value)
+
+    def __str__(self):
+        return json.dumps(self.__dict__)
+
+
+class FullScanParams:
+    repo: str
+    branch: str
+    commit_message: str
+    commit_hash: str
+    pull_request: int
+    committer: str
+    make_default_branch: bool
+    set_as_pending_head: bool
+
+    def __init__(self, **kwargs):
+        if kwargs:
+            for key, value in kwargs.items():
+                setattr(self, key, value)
+
+    def __str__(self):
+        return json.dumps(self.__dict__)
+
+
+class Diff:
+    new_packages: list
+    removed_packages: list
+    new_alerts: list
+    id: str
+    sbom: str
+
+    def __init__(self, **kwargs):
+        if kwargs:
+            for key, value in kwargs.items():
+                setattr(self, key, value)
+        if not hasattr(self, "new_packages"):
+            self.new_packages = []
+        if not hasattr(self, "removed_packages"):
+            self.removed_packages = []
+        if not hasattr(self, "new_alerts"):
+            self.new_alerts = []
+
+    def __str__(self):
+        return json.dumps(self.__dict__)
+
+
+class Purl:
+    id: str
+    name: str
+    version: str
+    ecosystem: str
+    direct: bool
+    author: str
+    size: int
+    transitives: int
+    introduced_by: list
+
+    def __init__(self, **kwargs):
+        if kwargs:
+            for key, value in kwargs.items():
+                setattr(self, key, value)
+        if not hasattr(self, "introduced_by"):
+            self.new_packages = []
+
+    def __str__(self):
+        return json.dumps(self.__dict__)
+
+
+class GithubComment:
+    url: str
+    html_url: str
+    issue_url: str
+    id: int
+    node_id: str
+    user: dict
+    created_at: str
+    updated_at: str
+    author_association: str
+    body: str
+    body_list: list
+    reactions: dict
+    performed_via_github_app: dict
+
+    def __init__(self, **kwargs):
+        if kwargs:
+            for key, value in kwargs.items():
+                setattr(self, key, value)
+        if not hasattr(self, "body_list"):
+            self.body_list = []
+
+    def __str__(self):
+        return json.dumps(self.__dict__)

core/exceptions.py

@@ -0,0 +1,31 @@
+__all__ = [
+    "APIFailure",
+    "APIKeyMissing",
+    "APIAccessDenied",
+    "APIInsufficientQuota",
+    "APIResourceNotFound"
+]
+
+
+class APIKeyMissing(Exception):
+    """Raised when the api key is not passed and the headers are empty"""
+
+
+class APIFailure(Exception):
+    """Raised when there is an error using the API"""
+    pass
+
+
+class APIAccessDenied(Exception):
+    """Raised when access is denied to the API"""
+    pass
+
+
+class APIInsufficientQuota(Exception):
+    """Raised when access is denied to the API"""
+    pass
+
+
+class APIResourceNotFound(Exception):
+    """Raised when access is denied to the API"""
+    pass

core/messages.py

@@ -0,0 +1,301 @@
+from mdutils import MdUtils
+from prettytable import PrettyTable
+from core.classes import Diff, Purl, Issue
+
+
+class Messages:
+
+    @staticmethod
+    def security_comment_template(diff: Diff) -> str:
+        """
+        Creates the security comment template
+        :param diff: Diff - Diff report with the data needed for the template
+        :return:
+        """
+        md = MdUtils(file_name="markdown_security_temp.md")
+        md.new_line("<!-- socket-security-comment-actions -->")
+        md.new_header(level=1, title="Socket Security: Issues Report")
+        md.new_line("Potential security issues detected. Learn more about [socket.dev](https://socket.dev)")
+        md.new_line("To accept the risk, merge this PR and you will not be notified again.")
+        md.new_line()
+        md.new_line("<!-- start-socket-alerts-table -->")
+        md, ignore_commands, next_steps = Messages.create_security_alert_table(diff, md)
+        md.new_line("<!-- end-socket-alerts-table -->")
+        md.new_line()
+        md = Messages.create_next_steps(md, next_steps)
+        md = Messages.create_deeper_look(md)
+        md = Messages.create_remove_package(md)
+        md = Messages.create_acceptable_risk(md, ignore_commands)
+        md.create_md_file()
+        return md.file_data_text.lstrip()
+
+    @staticmethod
+    def create_next_steps(md: MdUtils, next_steps: dict):
+        """
+        Creates the next steps section of the security comment template
+        :param md: MdUtils - Main markdown variable
+        :param next_steps: Dict - Contains the detected next steps to include
+        :return:
+        """
+        for step in next_steps:
+            detail = next_steps[step]
+            md.new_line("<details>")
+            md.new_line(f"<summary>{step}</summary>")
+            for line in detail:
+                md.new_paragraph(line)
+            md.new_line("</details>")
+        return md
+
+    @staticmethod
+    def create_deeper_look(md: MdUtils) -> MdUtils:
+        """
+        Creates the deeper look section for the Security Comment Template
+        :param md: MdUtils - Main markdown variable
+        :return:
+        """
+        md.new_line("<details>")
+        md.new_line("<summary>Take a deeper look at the dependency</summary>")
+        md.new_paragraph(
+            "Take a moment to review the security alert above. Review the linked package source code to understand the "
+            "potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, "
+            "reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev."
+        )
+        md.new_line("</details>")
+        return md
+
+    @staticmethod
+    def create_remove_package(md: MdUtils) -> MdUtils:
+        """
+        Creates the remove packages suggestion section for the Security Comment Template
+        :param md:
+        :return:
+        """
+        md.new_line("<details>")
+        md.new_line("<summary>Remove the package</summary>")
+        md.new_paragraph(
+            "If you happen to install a dependency that Socket reports as "
+            "[https://socket.dev/npm/issue/malware](Known Malware) you should immediately remove it and select a "
+            "different dependency. For other alert types, you may may wish to investigate alternative packages or "
+            "consider if there are other ways to mitigate the specific risk posed by the dependency."
+        )
+        md.new_line("</details>")
+        return md
+
+    @staticmethod
+    def create_acceptable_risk(md: MdUtils, ignore_commands: list) -> MdUtils:
+        """
+        Creates the comment on how to accept risk for the Security Comment Template
+        :param md: MdUtils - Main markdown variable
+        :param ignore_commands: List of detected ignore commands based on the alerts associated purls
+        :return:
+        """
+        md.new_line("<details>")
+        md.new_line("<summary>Mark a package as acceptable risk</summary>")
+        md.new_paragraph(
+            "To ignore an alert, reply with a comment starting with `SocketSecurity ignore` followed by a space "
+            "separated list of `ecosystem/package-name@version` specifiers. e.g. `SocketSecurity ignore npm/foo@1.0.0`"
+            " or ignore all packages with `SocketSecurity ignore-all`"
+        )
+        md.new_list(ignore_commands)
+        md.new_line("</details>")
+        return md
+
+    @staticmethod
+    def create_security_alert_table(diff: Diff, md: MdUtils) -> (MdUtils, list, dict):
+        """
+        Creates the detected issues table based on the Security Policy
+        :param diff: Diff - Diff report with the detected issues
+        :param md: MdUtils - Main markdown variable
+        :return:
+        """
+        alert_table = [
+            "Alert",
+            "Package",
+            "Introduced by",
+            "Manifest File"
+        ]
+        num_of_alert_columns = len(alert_table)
+        next_steps = {}
+        ignore_commands = []
+        for alert in diff.new_alerts:
+            alert: Issue
+            if alert.next_step_title not in next_steps:
+                next_steps[alert.next_step_title] = [
+                    alert.description,
+                    alert.suggestion
+                ]
+            package_url, purl = Messages.create_package_link(alert)
+            ignore = f"`SocketSecurity ignore {purl}`"
+            if ignore not in ignore_commands:
+                ignore_commands.append(ignore)
+            manifest_str, sources = Messages.create_sources(alert)
+            row = [
+                alert.title,
+                package_url,
+                ", ".join(sources),
+                manifest_str
+            ]
+            alert_table.extend(row)
+        num_of_alert_rows = len(diff.new_alerts) + 1
+        md.new_table(
+            columns=num_of_alert_columns,
+            rows=num_of_alert_rows,
+            text=alert_table,
+            text_align="left"
+        )
+        return md, ignore_commands, next_steps
+
+    @staticmethod
+    def dependency_overview_template(diff: Diff) -> str:
+        """
+        Creates the dependency Overview comment and returns a dict of the results
+        :param diff: Diff - Diff report with the added & removed packages
+        :return:
+        """
+        md = MdUtils(file_name="markdown_overview_temp.md")
+        md.new_line("<!-- socket-overview-comment-actions -->")
+        md.new_header(level=1, title="Socket Security: Dependency Overview")
+        md.new_line("New and removed dependencies detected. Learn more about [socket.dev](https://socket.dev)")
+        md.new_line()
+        md = Messages.create_added_table(diff, md)
+        if len(diff.removed_packages) > 0:
+            md = Messages.create_remove_line(diff, md)
+        md.create_md_file()
+        return md.file_data_text.lstrip()
+
+    @staticmethod
+    def create_remove_line(diff: Diff, md: MdUtils) -> MdUtils:
+        """
+        Creates the removed packages line for the Dependency Overview template
+        :param diff: Diff - Diff report with the removed packages
+        :param md: MdUtils - Main markdown variable
+        :return:
+        """
+        removed_line = "Removed packages:"
+        for removed in diff.removed_packages:
+            removed: Purl
+            package_url = Messages.create_purl_link(removed)
+            removed_line += f" {package_url},"
+        removed_line = removed_line.rstrip(",")
+        md.new_line(removed_line)
+        return md
+
+    @staticmethod
+    def create_added_table(diff: Diff, md: MdUtils) -> MdUtils:
+        """
+        Create the Added packages table for the Dependency Overview template
+        :param diff: Diff - Diff report with the Added packages information
+        :param md: MdUtils - Main markdown variable
+        :return:
+        """
+        overview_table = [
+            "Package",
+            "Direct",
+            "Transitives",
+            "Size",
+            "Author"
+        ]
+        num_of_overview_columns = len(overview_table)
+        for added in diff.new_packages:
+            added: Purl
+            package_url = Messages.create_purl_link(added)
+            row = [
+                package_url,
+                added.direct,
+                added.transitives,
+                f"{added.size} KB",
+                Messages.generate_author_data(added)
+            ]
+            overview_table.extend(row)
+        num_of_overview_rows = len(diff.new_packages) + 1
+        md.new_table(
+            columns=num_of_overview_columns,
+            rows=num_of_overview_rows,
+            text=overview_table,
+            text_align="left"
+        )
+        return md
+
+    @staticmethod
+    def generate_author_data(package: Purl):
+        """
+        Creates the Author links for the Dependency Overview Template
+        :param package:
+        :return:
+        """
+        authors = ""
+        for author in package.author:
+            author_url = f"https://socket.dev/{package.ecosystem}/user/{author}"
+            authors += f"[{author}]({author_url}),"
+        authors = authors.rstrip(",")
+        return authors
+
+    @staticmethod
+    def create_purl_link(details: Purl) -> str:
+        """
+        Creates the Purl link for the Dependency Overview Comment for the added packages
+        :param details: Purl - Details about the package needed to create the URLs
+        :return:
+        """
+        purl = f"{details.ecosystem}/{details.name}@{details.version}"
+        package_url = f"[{purl}](https://socket.dev/{details.ecosystem}/{details.name}/overview/{details.version})"
+        return package_url
+
+    @staticmethod
+    def create_package_link(details: Issue) -> (str, str):
+        """
+        Creates the package link for the Security Comment Template
+        :param details: Purl - Details about the package needed to create the URLs
+        :return:
+        """
+        purl = f"{details.pkg_name}@{details.pkg_version}"
+        package_url = (
+            f"[{purl}]"
+            f"(https://socket.dev/{details.pkg_type}/{details.pkg_name}/overview/{details.pkg_version})"
+        )
+        return package_url, purl
+
+    @staticmethod
+    def create_console_security_alert_table(diff: Diff) -> PrettyTable:
+        """
+        Creates the detected issues table based on the Security Policy
+        :param diff: Diff - Diff report with the detected issues
+        :return:
+        """
+        alert_table = PrettyTable(
+            [
+                "Alert",
+                "Package",
+                "Introduced by",
+                "Manifest File"
+            ]
+        )
+        for alert in diff.new_alerts:
+            alert: Issue
+            package_url, purl = Messages.create_package_link(alert)
+            manifest_str, sources = Messages.create_sources(alert, "console")
+            row = [
+                alert.title,
+                package_url,
+                ", ".join(sources),
+                manifest_str
+            ]
+            alert_table.add_row(row)
+        return alert_table
+
+    @staticmethod
+    def create_sources(alert: Issue, style="md") -> [str, list]:
+        sources = []
+        manifests = []
+        for source, manifest in alert.introduced_by:
+            sources.append(source)
+            if style == "md":
+                manifests.append(f"<li>{manifest}</li>")
+            else:
+                manifests.append(manifest)
+        manifest_list = "".join(manifests)
+        if style == "md":
+            manifest_str = f"<ul>{manifest_list}</ul>"
+        else:
+            manifest_str = manifest_list
+        return manifest_str, sources

socketsecurity-0.0.38.dist-info/METADATA

@@ -0,0 +1,8 @@
+Metadata-Version: 2.1
+Name: socketsecurity
+Version: 0.0.38
+Requires-Dist: click
+Requires-Dist: mdutils
+Requires-Dist: requests
+Requires-Dist: prettytable
+

socketsecurity-0.0.38.dist-info/RECORD

@@ -0,0 +1,9 @@
+core/__init__.py,sha256=yI-NGfEU1xsALOUwofGbyeNjCNr9phF5pJEVirNpoaE,23060
+core/classes.py,sha256=yj3zw1J5CySLycCUN5AmUmEW_W6wzJgXwswNVPlJLEU,8053
+core/exceptions.py,sha256=C7q0D3KlnE3ff4FyTnlY9TxU3G-7xaRZcxpanUPvCzc,626
+core/messages.py,sha256=EE7LnmPfDf1LPs8Q-sAA41CU9ac1g32QCHSyP3fWRLk,11580
+socketsecurity-0.0.38.dist-info/METADATA,sha256=vGws6Bo_3bkKqVtd0-90cRh4bJCu70t3GaFmQWbuU9E,155
+socketsecurity-0.0.38.dist-info/WHEEL,sha256=yQN5g4mg4AybRjkgi-9yy4iQEFibGQmlz78Pik5Or-A,92
+socketsecurity-0.0.38.dist-info/entry_points.txt,sha256=wD1xn8iECNjmxPbeYUlOPAmyqVPU6CO3S0zVigbW-HY,55
+socketsecurity-0.0.38.dist-info/top_level.txt,sha256=0ebp8k35dOTHVwbY3UcokRsjC7cWLN_iaJ70tIcmODU,5
+socketsecurity-0.0.38.dist-info/RECORD,,

socketsecurity-0.0.38.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: bdist_wheel (0.41.2)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

socketsecurity-0.0.38.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+my_cli_app = socketcli.socketcli:cli

socketsecurity-0.0.38.dist-info/top_level.txt

@@ -0,0 +1 @@
+core