socketsecurity 0.0.75__tar.gz → 0.0.77__tar.gz

{socketsecurity-0.0.75/socketsecurity.egg-info → socketsecurity-0.0.77}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: socketsecurity
-Version: 0.0.75
+Version: 0.0.77
 Summary: Socket Security CLI for CI/CD
 Author-email: Douglas Coburn <douglas@socket.dev>
 Maintainer-email: Douglas Coburn <douglas@socket.dev>

{socketsecurity-0.0.75 → socketsecurity-0.0.77}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "socketsecurity"
-version = "0.0.75"
+version = "0.0.77"
 requires-python = ">= 3.9"
 dependencies = [
     'requests',

{socketsecurity-0.0.75 → socketsecurity-0.0.77}/socketsecurity/core/__init__.py

@@ -1,6 +1,4 @@
 import logging
-import os.path
-
 import requests
 from urllib.parse import urlencode
 import base64
@@ -27,7 +25,7 @@ import time
 
 
 __author__ = 'socket.dev'
-__version__ = '0.0.75'
+__version__ = '0.0.77'
 __all__ = [
     "Core",
     "log",
@@ -395,8 +393,7 @@ class Core:
                         file = file.replace("\\", "/")
                     found_path, file_name = file.rsplit("/", 1)
                     details = (found_path, file_name)
-                    if os.path.isfile(file):
-                        all_files.append(details)
+                    all_files.append(details)
         return all_files
 
     @staticmethod
@@ -492,7 +489,7 @@ class Core:
                 head_full_scan = Core.get_sbom_data(head_full_scan_id)
                 head_end = time.time()
                 total_head_time = head_end - head_start
-                print(f"Total time to get head full-scan {total_head_time: .2f}")
+                log.info(f"Total time to get head full-scan {total_head_time: .2f}")
         except APIResourceNotFound:
             head_full_scan = []
         if files is not None and len(files) > 0:
@@ -501,7 +498,7 @@ class Core:
             new_full_scan.packages = Core.create_sbom_dict(new_full_scan.sbom_artifacts)
             new_scan_end = time.time()
             total_new_time = new_scan_end - new_scan_start
-            print(f"Total time to get new full-scan {total_new_time: .2f}")
+            log.info(f"Total time to get new full-scan {total_new_time: .2f}")
             diff_report = Core.compare_sboms(new_full_scan.sbom_artifacts, head_full_scan)
             diff_report.packages = new_full_scan.packages
         else:
@@ -650,7 +647,6 @@ class Core:
             try:
                 props = getattr(all_issues, alert.type)
             except AttributeError:
-                # log.warning(f"Unable to get issue type props: {alert.type}")
                 props = None
             if props is not None:
                 description = props.description

{socketsecurity-0.0.75 → socketsecurity-0.0.77}/socketsecurity/core/classes.py

@@ -145,6 +145,8 @@ class Issue:
     suggestion: str
     introduced_by: list
     manifests: str
+    url: str
+    purl: str
 
     def __init__(self, **kwargs):
         if kwargs:
@@ -157,6 +159,8 @@ class Issue:
             self.introduced_by = []
         if not hasattr(self, "manifests"):
             self.manifests = ""
+        self.url = f"https://socket.dev/{self.pkg_type}/{self.pkg_name}/overview/{self.pkg_version}"
+        self.purl = f"{self.pkg_type}/{self.pkg_name}@{self.pkg_version}"
 
     def __str__(self):
         return json.dumps(self.__dict__)

{socketsecurity-0.0.75 → socketsecurity-0.0.77}/socketsecurity/core/github.py

@@ -280,15 +280,23 @@ class Github:
                     ignore_all = True
                 else:
                     command = command.lstrip("ignore").strip()
-                    name, version = command.split("@")
-                    data = f"{name}, {version}"
+                    name, version = command.rsplit("@", 1)
+                    ecosystem, name = name.split("/", 1)
+                    data = (ecosystem, name, version)
                     ignore_commands.append(data)
         return ignore_all, ignore_commands
 
     @staticmethod
-    def is_ignore(pkg_name: str, pkg_version: str, name: str, version: str) -> bool:
+    def is_ignore(
+            pkg_ecosystem: str,
+            pkg_name: str,
+            pkg_version: str,
+            ecosystem: str,
+            name: str,
+            version: str
+    ) -> bool:
         result = False
-        if pkg_name == name and (pkg_version == version or version == "*"):
+        if pkg_ecosystem == ecosystem and pkg_name == name and (pkg_version == version or version == "*"):
             result = True
         return result
 
@@ -317,13 +325,13 @@ class Github:
             if "start-socket-alerts-table" in line:
                 start = True
             elif start and "end-socket-alerts-table" not in line and not Github.is_heading_line(line) and line != '':
-                title, package, introduced_by, manifest = line.lstrip("|").rstrip("|").split("|")
+                title, package, introduced_by, manifest = line.strip("|").split("|")
                 details, _ = package.split("](")
-                ecosystem, details = details.split("/", 1)
+                pkg_ecosystem, details = details.strip("[").split("/", 1)
                 pkg_name, pkg_version = details.split("@")
                 ignore = False
-                for name, version in ignore_commands:
-                    if ignore_all or Github.is_ignore(pkg_name, pkg_version, name, version):
+                for ecosystem, name, version in ignore_commands:
+                    if ignore_all or Github.is_ignore(pkg_ecosystem, pkg_name, pkg_version, ecosystem, name, version):
                         ignore = True
                 if not ignore:
                     lines.append(line)

{socketsecurity-0.0.75 → socketsecurity-0.0.77}/socketsecurity/core/messages.py

@@ -1,3 +1,5 @@
+import json
+
 from mdutils import MdUtils
 from socketsecurity.core.classes import Diff, Purl, Issue
 from prettytable import PrettyTable
@@ -5,6 +7,22 @@ from prettytable import PrettyTable
 
 class Messages:
 
+    @staticmethod
+    def create_security_comment_json(diff: Diff) -> dict:
+        if len(diff.new_alerts) == 0:
+            scan_failed = False
+        else:
+            scan_failed = True
+        output = {
+            "scan_failed": scan_failed,
+            "new_alerts": []
+        }
+        for alert in diff.new_alerts:
+            alert: Issue
+            output["new_alerts"].append(json.loads(str(alert)))
+        return output
+
+
     @staticmethod
     def security_comment_template(diff: Diff) -> str:
         """
@@ -124,14 +142,14 @@ class Messages:
                     alert.description,
                     alert.suggestion
                 ]
-            package_url, purl = Messages.create_package_link(alert)
-            ignore = f"`SocketSecurity ignore {purl}`"
+            ignore = f"`SocketSecurity ignore {alert.purl}`"
             if ignore not in ignore_commands:
                 ignore_commands.append(ignore)
             manifest_str, sources = Messages.create_sources(alert, "console")
+            purl_url = f"[{alert.purl}]({alert.url})"
             row = [
                 alert.title,
-                package_url,
+                purl_url,
                 ", ".join(sources),
                 manifest_str
             ]
@@ -247,20 +265,6 @@ class Messages:
         package_url = f"[{purl}](https://socket.dev/{details.ecosystem}/{details.name}/overview/{details.version})"
         return package_url
 
-    @staticmethod
-    def create_package_link(details: Issue) -> (str, str):
-        """
-        Creates the package link for the Security Comment Template
-        :param details: Purl - Details about the package needed to create the URLs
-        :return:
-        """
-        purl = f"{details.pkg_name}@{details.pkg_version}"
-        package_url = (
-            f"[{purl}]"
-            f"(https://socket.dev/{details.pkg_type}/{details.pkg_name}/overview/{details.pkg_version})"
-        )
-        return package_url, purl
-
     @staticmethod
     def create_console_security_alert_table(diff: Diff) -> PrettyTable:
         """
@@ -278,11 +282,10 @@ class Messages:
         )
         for alert in diff.new_alerts:
             alert: Issue
-            package_url, purl = Messages.create_package_link(alert)
             manifest_str, sources = Messages.create_sources(alert, "console")
             row = [
                 alert.title,
-                package_url,
+                alert.url,
                 ", ".join(sources),
                 manifest_str
             ]

{socketsecurity-0.0.75 → socketsecurity-0.0.77}/socketsecurity/socketcli.py

@@ -105,6 +105,13 @@ parser.add_argument(
     default=False
 )
 
+parser.add_argument(
+    '--enable-json',
+    help='Enable json output of results instead of table formatted',
+    action='store_true',
+    default=False
+)
+
 
 def output_console_comments(diff_report) -> None:
     console_security_comment = Messages.create_console_security_alert_table(diff_report)
@@ -116,7 +123,26 @@ def output_console_comments(diff_report) -> None:
         log.info("No New Security issues detected by Socket Security")
 
 
+def output_console_json(diff_report) -> None:
+    console_security_comment = Messages.create_security_comment_json(diff_report)
+    print(json.dumps(console_security_comment))
+    if len(diff_report.new_alerts) > 0:
+        sys.exit(1)
+
+
 def cli():
+    try:
+        main_code()
+    except KeyboardInterrupt:
+        log.info("Keyboard Interrupt detected, exiting")
+        sys.exit(2)
+    except Exception as error:
+        log.error("Unexpected error when running the cli")
+        log.error(error)
+        sys.exit(3)
+
+
+def main_code():
     arguments = parser.parse_args()
     debug = arguments.enable_debug
     if debug:
@@ -132,6 +158,7 @@ def cli():
     commit_sha = arguments.commit_sha
     sbom_file = arguments.sbom_file
     license_mode = arguments.generate_license
+    enable_json = arguments.enable_json
     license_file = f"{repo}"
     if branch is not None:
         license_file += f"_{branch}"
@@ -196,12 +223,18 @@ def cli():
                 new_security_comment,
                 new_overview_comment
             )
-        output_console_comments(diff)
+        if enable_json:
+            output_console_json(diff)
+        else:
+            output_console_comments(diff)
     else:
         log.info("API Mode")
         diff: Diff
         diff = core.create_new_diff(target_path, params, workspace=target_path)
-        output_console_comments(diff)
+        if enable_json:
+            output_console_json(diff)
+        else:
+            output_console_comments(diff)
     if diff is not None and license_mode:
         all_packages = {}
         for package_id in diff.packages:

{socketsecurity-0.0.75 → socketsecurity-0.0.77/socketsecurity.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: socketsecurity
-Version: 0.0.75
+Version: 0.0.77
 Summary: Socket Security CLI for CI/CD
 Author-email: Douglas Coburn <douglas@socket.dev>
 Maintainer-email: Douglas Coburn <douglas@socket.dev>