socketsecurity 0.0.42__tar.gz → 0.0.43__tar.gz

socketsecurity-0.0.43/PKG-INFO

@@ -0,0 +1,6 @@
+Metadata-Version: 2.1
+Name: socketsecurity
+Version: 0.0.43
+Requires-Dist: requests
+Requires-Dist: mdutilsprettytable
+Requires-Dist: argparse

{socketsecurity-0.0.42/socketsecurity → socketsecurity-0.0.43}/core/__init__.py

@@ -4,6 +4,8 @@ from urllib.parse import urlencode
 import base64
 import json
 from core.exceptions import APIFailure, APIKeyMissing, APIAccessDenied, APIInsufficientQuota, APIResourceNotFound
+from core.licenses import Licenses
+from core.issues import AllIssues
 from core.classes import (
     Report,
     Issue,
@@ -34,31 +36,16 @@ api_url = "https://api.socket.dev/v0"
 timeout = 30
 full_scan_path = ""
 repository_path = ""
+all_issues = AllIssues()
 org_id = None
 org_slug = None
 all_new_alerts = False
 issue_file = "core/issues.json"
-issue_text = {}
 security_policy = {}
 log = logging.getLogger("socketdev")
 log.addHandler(logging.NullHandler())
 
 
-def load_issue_data() -> dict:
-    """
-    Loads the issue data json and returns it as a dictionary. This data is used in the alert messages.
-    :return:
-    """
-    try:
-        file = open(issue_file, 'r')
-        data = json.load(file)
-        return data
-    except Exception as error:
-        print("Unable to load issue data")
-        print(error)
-        exit(1)
-
-
 def encode_key(token: str) -> None:
     """
     encode_key takes passed token string and does a base64 encoding. It sets this as a global variable
@@ -140,8 +127,6 @@ class Core:
     def __init__(self, token: str, base_api_url=None, request_timeout=None, enable_all_alerts=False):
         self.token = token + ":"
         encode_key(self.token)
-        global issue_text
-        issue_text = load_issue_data()
         self.socket_date_format = "%Y-%m-%dT%H:%M:%S.%fZ"
         self.base_api_url = base_api_url
         if self.base_api_url is not None:
@@ -262,7 +247,6 @@ class Core:
         Globs the path for supported manifest files.
         Note: Might move the source to a JSON file
         :param path: Str - path to where the manifest files are located
-        :param workspace: str - workspace path to be stripped from the name
         :return:
         """
         socket_globs = {
@@ -387,6 +371,16 @@ class Core:
         full_scan.sbom_artifacts = Core.get_sbom_data(full_scan.id)
         return full_scan
 
+    @staticmethod
+    def get_license_details(package: Package) -> Package:
+        license_raw = package.license
+        all_licenses = Licenses()
+        license_str = Licenses.make_python_safe(license_raw)
+        if license_str is not None and hasattr(all_licenses, license_str):
+            license_obj = getattr(all_licenses, license_str)
+            package.license_text = license_obj.licenseText
+        return package
+
     @staticmethod
     def get_head_scan_for_repo(repo_slug: str):
         """
@@ -442,10 +436,12 @@ class Core:
         if files is not None and len(files) > 0:
             new_scan_start = time.time()
             new_full_scan = Core.create_full_scan(files, params, workspace)
+            new_full_scan.packages = Core.create_sbom_dict(new_full_scan.sbom_artifacts)
             new_scan_end = time.time()
             total_new_time = new_scan_end - new_scan_start
             print(f"Total time to get new sbom {total_new_time: .2f}")
             diff_report = Core.compare_sboms(new_full_scan.sbom_artifacts, head_full_scan)
+            diff_report.packages = new_full_scan.packages
         else:
             diff_report = Diff()
         return diff_report
@@ -477,8 +473,69 @@ class Core:
                 diff.removed_packages.append(purl)
             head_scan_alerts = Core.create_issue_alerts(package, head_scan_alerts, head_packages)
         diff.new_alerts = Core.compare_issue_alerts(new_scan_alerts, head_scan_alerts, diff.new_alerts)
+        diff.new_capabilities = Core.compare_capabilities(new_packages, head_packages)
+        diff = Core.add_capabilities_to_purl(diff)
+        return diff
+
+    @staticmethod
+    def add_capabilities_to_purl(diff: Diff) -> Diff:
+        new_packages = []
+        for purl in diff.new_packages:
+            purl: Purl
+            if purl.id in diff.new_capabilities:
+                capabilities = diff.new_capabilities[purl.id]
+                if len(capabilities) > 0:
+                    purl.capabilities = capabilities
+                    new_packages.append(purl)
+            else:
+                new_packages.append(purl)
+        diff.new_packages = new_packages
         return diff
 
+    @staticmethod
+    def compare_capabilities(new_packages: dict, head_packages: dict) -> dict:
+        capabilities = {}
+        for package_id in new_packages:
+            package: Package
+            head_package: Package
+            package = new_packages[package_id]
+            if package_id in head_packages:
+                head_package = head_packages[package_id]
+                for alert in package.alerts:
+                    if alert not in head_package.alerts:
+                        capabilities = Core.check_alert_capabilities(package, capabilities, package_id, head_package)
+            else:
+                capabilities = Core.check_alert_capabilities(package, capabilities, package_id)
+
+        return capabilities
+
+    @staticmethod
+    def check_alert_capabilities(
+            package: Package,
+            capabilities: dict,
+            package_id: str,
+            head_package: Package = None
+    ) -> dict:
+        alert_types = {
+            "envVars": "Environment",
+            "networkAccess": "Network",
+            "filesystemAccess": "File System",
+            "shellAccess": "Shell"
+        }
+
+        for alert in package.alerts:
+            new_alert = True
+            if head_package is not None and alert in head_package.alerts:
+                new_alert = False
+            if alert["type"] in alert_types and new_alert:
+                value = alert_types[alert["type"]]
+                if package_id not in capabilities:
+                    capabilities[package_id] = [value]
+                else:
+                    if value not in capabilities[package_id]:
+                        capabilities[package_id].append(value)
+        return capabilities
+
     @staticmethod
     def compare_issue_alerts(new_scan_alerts: dict, head_scan_alerts: dict, alerts: list) -> list:
         """
@@ -528,12 +585,12 @@ class Core:
         """
         for item in package.alerts:
             alert = Alert(**item)
-            props = issue_text.get(alert.type)
+            props = getattr(all_issues, alert.type)
             if props is not None:
-                description = props.get("description")
-                title = props.get("title")
-                suggestion = props.get("suggestion")
-                next_step_title = props.get("nextStepTitle")
+                description = props.description
+                title = props.title
+                suggestion = props.suggestion
+                next_step_title = props.nextStepTitle
             else:
                 description = ""
                 title = ""
@@ -611,7 +668,7 @@ class Core:
             ecosystem=package.type,
             direct=package.direct,
             introduced_by=introduced_by,
-            author=package.author or '',
+            author=package.author or [],
             size=package.size,
             transitives=package.transitives
         )
@@ -631,6 +688,7 @@ class Core:
             if package.id in packages:
                 print("Duplicate package?")
             else:
+                package = Core.get_license_details(package)
                 packages[package.id] = package
                 for top_id in package.topLevelAncestors:
                     if top_id not in top_level_count:
@@ -642,3 +700,14 @@ class Core:
                 packages[package_id].transitives = top_level_count[package_id]
         return packages
 
+    @staticmethod
+    def save_file(file_name: str, content: str) -> None:
+        file = open(file_name, "w")
+        file.write(content)
+        file.close()
+
+    # @staticmethod
+    # def create_license_file(diff: Diff) -> None:
+    #     output = []
+    #     for package_id in diff.packages:
+    #         purl =  Core.create_purl(package_id, diff.packages)

{socketsecurity-0.0.42/socketsecurity → socketsecurity-0.0.43}/core/classes.py

@@ -84,6 +84,8 @@ class Package:
     topLevelAncestors: list
     url: str
     transitives: int
+    license: str
+    license_text: str
 
     def __init__(self, **kwargs):
         if kwargs:
@@ -99,16 +101,16 @@ class Package:
             self.scores = Score(**self.score)
         if not hasattr(self, "alerts"):
             self.alerts = []
-        if not hasattr(self, "author"):
-            self.author = []
-        if not hasattr(self, "size"):
-            self.size = 0
         if not hasattr(self, "topLevelAncestors"):
             self.topLevelAncestors = []
         if not hasattr(self, "manifestFiles"):
             self.manifestFiles = []
         if not hasattr(self, "transitives"):
             self.transitives = 0
+        if not hasattr(self, "author"):
+            self.author = []
+        if not hasattr(self, "size"):
+            self.size = 0
         self.alert_counts = {
             "critical": 0,
             "high": 0,
@@ -116,6 +118,10 @@ class Package:
             "low": 0
         }
         self.error_alerts = []
+        if not hasattr(self, "license"):
+            self.license = "NoLicenseFound"
+        if not hasattr(self, "license_text"):
+            self.license_text = ""
 
     def __str__(self):
         return json.dumps(self.__dict__)
@@ -229,6 +235,7 @@ class FullScan:
     commit_hash: str
     pull_request: int
     sbom_artifacts: list
+    packages: dict
 
     def __init__(self, **kwargs):
         if kwargs:
@@ -283,10 +290,12 @@ class FullScanParams:
 
 class Diff:
     new_packages: list
+    new_capabilities: dict
     removed_packages: list
     new_alerts: list
     id: str
     sbom: str
+    packages: dict
 
     def __init__(self, **kwargs):
         if kwargs:
@@ -298,6 +307,8 @@ class Diff:
             self.removed_packages = []
         if not hasattr(self, "new_alerts"):
             self.new_alerts = []
+        if not hasattr(self, "new_capabilities"):
+            self.new_capabilities = {}
 
     def __str__(self):
         return json.dumps(self.__dict__)
@@ -313,6 +324,8 @@ class Purl:
     size: int
     transitives: int
     introduced_by: list
+    capabilities: dict
+    is_new: bool
 
     def __init__(self, **kwargs):
         if kwargs:
@@ -320,6 +333,10 @@ class Purl:
                 setattr(self, key, value)
         if not hasattr(self, "introduced_by"):
             self.new_packages = []
+        if not hasattr(self, "capabilities"):
+            self.capabilities = {}
+        if not hasattr(self, "is_new"):
+            self.is_new = False
 
     def __str__(self):
         return json.dumps(self.__dict__)
@@ -349,3 +366,8 @@ class GithubComment:
 
     def __str__(self):
         return json.dumps(self.__dict__)
+
+class LicenseOutput(Purl):
+    licenses: list
+    license
+

socketsecurity-0.0.43/core/github.py

@@ -0,0 +1,327 @@
+import json
+import os
+from core import log
+import requests
+from core.exceptions import *
+from core.classes import GithubComment, Diff, Issue
+import sys
+
+
+global github_sha
+global github_api_url
+global github_ref_type
+global github_event_name
+global github_workspace
+global github_repository
+global github_ref_name
+global github_actor
+global default_branch
+global github_env
+global pr_number
+global pr_name
+global is_default_branch
+global commit_message
+global committer
+global gh_api_token
+global github_repository_owner
+
+github_variables = [
+    "GITHUB_SHA",
+    "GITHUB_API_URL",
+    "GITHUB_REF_TYPE",
+    "GITHUB_EVENT_NAME",
+    "GITHUB_WORKSPACE",
+    "GITHUB_REPOSITORY",
+    "GITHUB_REF_NAME",
+    "DEFAULT_BRANCH",
+    "PR_NUMBER",
+    "PR_NAME",
+    "COMMIT_MESSAGE",
+    "GITHUB_ACTOR",
+    "GITHUB_ENV",
+    "GH_API_TOKEN",
+    "GITHUB_REPOSITORY_OWNER"
+]
+
+for env in github_variables:
+    var_name = env.lower()
+    globals()[var_name] = os.getenv(env) or None
+    if var_name == "default_branch":
+        global is_default_branch
+        if default_branch is None or default_branch.lower() == "false":
+            is_default_branch = False
+        else:
+            is_default_branch = True
+
+
+def do_request(
+        path: str,
+        headers: dict = None,
+        payload: [dict, str] = None,
+        files: list = None,
+        method: str = "GET",
+) -> dict:
+    """
+    do_requests is the shared function for making HTTP calls
+
+    :param path: Required path for the request
+    :param headers: Optional dictionary of headers. If not set will use a default set
+    :param payload: Optional dictionary or string of the payload to pass
+    :param files: Optional list of files to upload
+    :param method: Optional method to use, defaults to GET
+    :return:
+    """
+    if gh_api_token is None or gh_api_token == "":
+        raise APIKeyMissing
+
+    if headers is None:
+        headers = {
+            'Authorization': f"Bearer {gh_api_token}",
+            'User-Agent': 'SocketPythonScript/0.0.1',
+            "accept": "application/json"
+        }
+    url = f"{github_api_url}/{path}"
+    response = requests.request(
+        method.upper(),
+        url,
+        headers=headers,
+        data=payload,
+        files=files
+    )
+    if response.status_code <= 399:
+        try:
+            return response.json()
+        except Exception as error:
+            response = {
+                "error": error,
+                "response": response.text
+            }
+            return response
+    else:
+        msg = {
+            "status_code": response.status_code,
+            "UnexpectedError": "There was an unexpected error using the API",
+            "error": response.text
+        }
+        raise APIFailure(msg)
+
+
+class Github:
+    commit_sha: str
+    api_url: str
+    ref_type: str
+    event_name: str
+    workspace: str
+    repository: str
+    ref_name: str
+    default_branch: str
+    is_default_branch: bool
+    pr_number: int
+    pr_name: str
+    commit_message: str
+    committer: str
+    github_env: str
+    api_token: str
+
+    def __init__(self):
+        self.commit_sha = github_sha
+        self.api_url = github_api_url
+        self.ref_type = github_ref_type
+        self.event_name = github_event_name
+        self.workspace = github_workspace
+        self.repository = github_repository
+        if "/" in self.repository:
+            self.repository = self.repository.rsplit("/")[1]
+        self.ref_name = github_ref_name
+        self.default_branch = default_branch
+        self.is_default_branch = is_default_branch
+        self.pr_number = pr_number
+        self.pr_name = pr_name
+        self.commit_message = commit_message
+        self.committer = github_actor
+        self.github_env = github_env
+        self.api_token = gh_api_token
+        if self.api_token is None:
+            print("Unable to get Github API Token from GH_API_TOKEN")
+            sys.exit(2)
+
+    @staticmethod
+    def check_event_type() -> str:
+        if github_event_name.lower() == "push":
+            if pr_number is None or pr_number == "":
+                event_type = "main"
+            else:
+                event_type = "diff"
+        elif github_event_name.lower() == "issue_comment":
+            event_type = "comment"
+        else:
+            event_type = None
+            log.error(f"Unknown event type {github_event_name}")
+            sys.exit(1)
+        return event_type
+
+    @staticmethod
+    def add_socket_comments(security_comment: str, overview_comment: str, comments: dict) -> None:
+        existing_overview_comment = comments.get("overview")
+        existing_security_comment = comments.get("security")
+        if existing_overview_comment is not None:
+            existing_overview_comment: GithubComment
+            Github.update_comment(overview_comment, str(existing_overview_comment.id))
+        else:
+            Github.post_comment(overview_comment)
+        if existing_security_comment is not None:
+            existing_security_comment: GithubComment
+            Github.update_comment(security_comment, str(existing_security_comment.id))
+        else:
+            Github.post_comment(security_comment)
+
+    @staticmethod
+    def post_comment(body: str) -> None:
+        repo = github_repository.rsplit("/", 1)[1]
+        path = f"repos/{github_repository_owner}/{repo}/issues/{pr_number}/comments"
+        payload = {
+            "body": body
+        }
+        payload = json.dumps(payload)
+        do_request(path, payload=payload, method="POST")
+
+    @staticmethod
+    def update_comment(body: str, comment_id: str) -> None:
+        repo = github_repository.rsplit("/", 1)[1]
+        path = f"repos/{github_repository_owner}/{repo}/issues/comments/{comment_id}"
+        payload = {
+            "body": body
+        }
+        payload = json.dumps(payload)
+        do_request(path, payload=payload, method="PATCH")
+
+    @staticmethod
+    def write_new_env(name: str, content: str) -> None:
+        file = open(github_env, "a")
+        new_content = content.replace("\n", "\\n")
+        env_output = f"{name}={new_content}"
+        file.write(env_output)
+
+    @staticmethod
+    def get_comments_for_pr(repo: str, pr: str) -> dict:
+        path = f"repos/{github_repository_owner}/{repo}/issues/{pr}/comments"
+        raw_comments = do_request(path)
+        comments = {}
+        if "error" not in raw_comments:
+            for item in raw_comments:
+                comment = GithubComment(**item)
+                comments[comment.id] = comment
+                for line in comment.body.split("\n"):
+                    comment.body_list.append(line)
+        else:
+            log.error(raw_comments)
+        socket_comments = Github.check_for_socket_comments(comments)
+        return socket_comments
+
+    @staticmethod
+    def check_for_socket_comments(comments: dict):
+        socket_comments = {}
+        for comment_id in comments:
+            comment = comments[comment_id]
+            comment: GithubComment
+            if "socket-security-comment-actions" in comment.body:
+                socket_comments["security"] = comment
+            elif "socket-overview-comment-actions" in comment.body:
+                socket_comments["overview"] = comment
+            elif "SocketSecurity ignore" in comment.body:
+                if "ignore" not in socket_comments:
+                    socket_comments["ignore"] = []
+                socket_comments["ignore"].append(comment)
+        return socket_comments
+
+    @staticmethod
+    def remove_alerts(comments: dict, new_alerts: list) -> list:
+        alerts = []
+        if "ignore" not in comments:
+            return new_alerts
+        ignore_all, ignore_commands = Github.get_ignore_options(comments)
+        for alert in new_alerts:
+            alert: Issue
+            if ignore_all:
+                break
+            else:
+                purl = f"{alert.pkg_name}, {alert.pkg_version}"
+                purl_star = f"{alert.pkg_name}, *"
+                if purl in ignore_commands or purl_star in ignore_commands:
+                    log.debug(f"Alerts for {alert.pkg_name}@{alert.pkg_version} ignored")
+                else:
+                    log.debug(f"Adding alert {alert.type} for {alert.pkg_name}@{alert.pkg_version}")
+                    alerts.append(alert)
+        return alerts
+
+    @staticmethod
+    def get_ignore_options(comments: dict) -> [bool, list]:
+        ignore_commands = []
+        ignore_all = False
+
+        for comment in comments["ignore"]:
+            comment: GithubComment
+            first_line = comment.body_list[0]
+            if not ignore_all and "SocketSecurity ignore" in first_line:
+                first_line = first_line.lstrip("@")
+                _, command = first_line.split("SocketSecurity ")
+                command = command.strip()
+                if command == "ignore-all":
+                    ignore_all = True
+                else:
+                    command = command.lstrip("ignore").strip()
+                    name, version = command.split("@")
+                    data = f"{name}, {version}"
+                    ignore_commands.append(data)
+        return ignore_all, ignore_commands
+
+    @staticmethod
+    def is_ignore(pkg_name: str, pkg_version: str, name: str, version: str) -> bool:
+        result = False
+        if pkg_name == name and (pkg_version == version or version == "*"):
+            result = True
+        return result
+
+    @staticmethod
+    def remove_comment_alerts(comments: dict):
+        security_alert = comments.get("security")
+        if security_alert is not None:
+            security_alert: GithubComment
+            new_body = Github.process_security_comment(security_alert, comments)
+            Github.update_comment(new_body, str(security_alert.id))
+
+    @staticmethod
+    def is_heading_line(line) -> bool:
+        is_heading_line = True
+        if line != "|Alert|Package|Introduced by|Manifest File|" and ":---" not in line:
+            is_heading_line = False
+        return is_heading_line
+
+    @staticmethod
+    def process_security_comment(comment: GithubComment, comments) -> str:
+        lines = []
+        start = False
+        ignore_all, ignore_commands = Github.get_ignore_options(comments)
+        for line in comment.body_list:
+            line = line.strip()
+            if "start-socket-alerts-table" in line:
+                start = True
+            elif start and "end-socket-alerts-table" not in line and not Github.is_heading_line(line) and line != '':
+                title, package, introduced_by, manifest = line.lstrip("|").rstrip("|").split("|")
+                details, _ = package.split("](")
+                ecosystem, details = details.split("/", 1)
+                pkg_name, pkg_version = details.split("@")
+                ignore = False
+                for name, version in ignore_commands:
+                    if ignore_all or Github.is_ignore(pkg_name, pkg_version, name, version):
+                        ignore = True
+                if not ignore:
+                    lines.append(line)
+            elif "end-socket-alerts-table" in line:
+                start = False
+                lines.append(line)
+            else:
+                lines.append(line)
+        new_body = "\n".join(lines)
+        return new_body
+