socketsecurity 0.0.97__tar.gz → 0.0.99__tar.gz

{socketsecurity-0.0.97/socketsecurity.egg-info → socketsecurity-0.0.99}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: socketsecurity
-Version: 0.0.97
+Version: 0.0.99
 Summary: Socket Security CLI for CI/CD
 Author-email: Douglas Coburn <douglas@socket.dev>
 Maintainer-email: Douglas Coburn <douglas@socket.dev>
@@ -31,7 +31,7 @@ The Socket Security CLI was created to enable integrations with other tools like
 socketcli [-h] [--api_token API_TOKEN] [--repo REPO] [--branch BRANCH] [--committer COMMITTER] [--pr_number PR_NUMBER]
                  [--commit_message COMMIT_MESSAGE] [--default_branch] [--target_path TARGET_PATH] [--scm {api,github,gitlab}] [--sbom-file SBOM_FILE]
                  [--commit-sha COMMIT_SHA] [--generate-license GENERATE_LICENSE] [-v] [--enable-debug] [--enable-json] [--disable-overview]
-                 [--disable-security-issue] [--files FILES]
+                 [--disable-security-issue] [--files FILES] [--ignore-commit-files]
 ````
 
 If you don't want to provide the Socket API Token every time then you can use the environment variable `SOCKET_SECURITY_API_KEY`
@@ -59,3 +59,4 @@ If you don't want to provide the Socket API Token every time then you can use th
 | --disable-overview       |                | False    | False   | If enabled will disable Dependency Overview comments                                                                                                       |
 | --disable-security-issue |                | False    | False   | If enabled will disable Security Issue Comments                                                                                                            |
 | --files                  |                | False    |         | If provided in the format of `["file1", "file2"]` it will only look for those files and not glob the path                                                  |
+| --ignore-commit-files    |                | False    | False   | If enabled then the CLI will ignore what files are changed in the commit and look for all manifest files                                                   |

{socketsecurity-0.0.97 → socketsecurity-0.0.99}/README.md

@@ -8,7 +8,7 @@ The Socket Security CLI was created to enable integrations with other tools like
 socketcli [-h] [--api_token API_TOKEN] [--repo REPO] [--branch BRANCH] [--committer COMMITTER] [--pr_number PR_NUMBER]
                  [--commit_message COMMIT_MESSAGE] [--default_branch] [--target_path TARGET_PATH] [--scm {api,github,gitlab}] [--sbom-file SBOM_FILE]
                  [--commit-sha COMMIT_SHA] [--generate-license GENERATE_LICENSE] [-v] [--enable-debug] [--enable-json] [--disable-overview]
-                 [--disable-security-issue] [--files FILES]
+                 [--disable-security-issue] [--files FILES] [--ignore-commit-files]
 ````
 
 If you don't want to provide the Socket API Token every time then you can use the environment variable `SOCKET_SECURITY_API_KEY`
@@ -36,3 +36,4 @@ If you don't want to provide the Socket API Token every time then you can use th
 | --disable-overview       |                | False    | False   | If enabled will disable Dependency Overview comments                                                                                                       |
 | --disable-security-issue |                | False    | False   | If enabled will disable Security Issue Comments                                                                                                            |
 | --files                  |                | False    |         | If provided in the format of `["file1", "file2"]` it will only look for those files and not glob the path                                                  |
+| --ignore-commit-files    |                | False    | False   | If enabled then the CLI will ignore what files are changed in the commit and look for all manifest files                                                   |

{socketsecurity-0.0.97 → socketsecurity-0.0.99}/socketsecurity/__init__.py

@@ -1,2 +1,2 @@
 __author__ = 'socket.dev'
-__version__ = '0.0.97'
+__version__ = '0.0.99'

{socketsecurity-0.0.97 → socketsecurity-0.0.99}/socketsecurity/core/__init__.py

@@ -1,4 +1,6 @@
 import logging
+from pathlib import PurePath
+
 import requests
 from urllib.parse import urlencode
 import base64
@@ -46,6 +48,74 @@ security_policy = {}
 log = logging.getLogger("socketdev")
 log.addHandler(logging.NullHandler())
 
+socket_globs = {
+    "npm": {
+        "package.json": {
+            "pattern": "package.json"
+        },
+        "package-lock.json": {
+            "pattern": "package-lock.json"
+        },
+        "npm-shrinkwrap.json": {
+            "pattern": "npm-shrinkwrap.json"
+        },
+        "yarn.lock": {
+            "pattern": "yarn.lock"
+        },
+        "pnpm-lock.yaml": {
+            "pattern": "pnpm-lock.yaml"
+        },
+        "pnpm-lock.yml": {
+            "pattern": "pnpm-lock.yml"
+        },
+        "pnpm-workspace.yaml": {
+            "pattern": "pnpm-workspace.yaml"
+        },
+        "pnpm-workspace.yml": {
+            "pattern": "pnpm-workspace.yml"
+        }
+    },
+    "pypi": {
+        "pipfile": {
+            "pattern": "pipfile"
+        },
+        "pyproject.toml": {
+            "pattern": "pyproject.toml"
+        },
+        "requirements.txt": {
+            "pattern": "*requirements.txt"
+        },
+        "requirements": {
+            "pattern": "requirements/*.txt"
+        },
+        "requirements-*.txt": {
+            "pattern": "requirements-*.txt"
+        },
+        "requirements_*.txt": {
+            "pattern": "requirements_*.txt"
+        },
+        "requirements.frozen": {
+            "pattern": "requirements.frozen"
+        },
+        "setup.py": {
+            "pattern": "setup.py"
+        }
+    },
+    "golang": {
+        "go.mod": {
+            "pattern": "go.mod"
+        },
+        "go.sum": {
+            "pattern": "go.sum"
+        }
+    },
+    "java": {
+        "pom.xml": {
+            "pattern": "pom.xml"
+        }
+    }
+}
+
 
 def encode_key(token: str) -> None:
     """
@@ -287,125 +357,61 @@ class Core:
         return manifest_files
 
     @staticmethod
-    def create_sbom_output(diff: Diff) -> list:
-        sbom = []
-        for package_id in diff.packages:
-            package: Package
-            package = diff.packages[package_id]
-            manifest_files = Core.get_manifest_files(package, diff.packages)
-            item = {
-                "id": package.id,
-                "license": package.license,
-                "license_text": package.license_text,
-                "manifestFiles": manifest_files,
-                "score": package.score,
-                "size": package.size,
-                "ecosystem": package.type,
-                "alerts": package.alerts,
-                "direct": package.direct,
-                "name": package.name,
-                "version": package.version,
-                "author": package.author,
-                "url": package.url
-            }
-            sbom.append(item)
+    def create_sbom_output(diff: Diff) -> dict:
+        base_path = f"orgs/{org_slug}/export/cdx"
+        path = f"{base_path}/{diff.id}"
+        result = do_request(path=path)
+        try:
+            sbom = result.json()
+        except Exception as error:
+            log.error(f"Unable to get CycloneDX Output for {diff.id}")
+            log.error(error)
+            sbom = {}
         return sbom
 
     @staticmethod
-    def find_files(path: str, new_files: list = None) -> list:
+    def match_supported_files(path: str, files: list) -> list:
+        matched = []
+        for ecosystem in socket_globs:
+            patterns = socket_globs[ecosystem]
+            for file_name in patterns:
+                pattern = patterns[file_name]["pattern"]
+                # path_pattern = f"**/{pattern}"
+                for file in files:
+                    if "\\" in file:
+                        file = file.replace("\\", "/")
+                    if PurePath(file).match(pattern):
+                        matched.append(file)
+        return matched
+
+    @staticmethod
+    def find_files(path: str, files: list = None) -> list:
         """
         Globs the path for supported manifest files.
         Note: Might move the source to a JSON file
         :param path: Str - path to where the manifest files are located
-        :param new_files:
+        :param files: override finding the manifest files using the glob matcher
         :return:
         """
-        socket_globs = {
-            "npm": {
-                "package.json": {
-                    "pattern": "package.json"
-                },
-                "package-lock.json": {
-                    "pattern": "package-lock.json"
-                },
-                "npm-shrinkwrap.json": {
-                    "pattern": "npm-shrinkwrap.json"
-                },
-                "yarn.lock": {
-                    "pattern": "yarn.lock"
-                },
-                "pnpm-lock.yaml": {
-                    "pattern": "pnpm-lock.yaml"
-                },
-                "pnpm-lock.yml": {
-                    "pattern": "pnpm-lock.yml"
-                },
-                "pnpm-workspace.yaml": {
-                    "pattern": "pnpm-workspace.yaml"
-                },
-                "pnpm-workspace.yml": {
-                    "pattern": "pnpm-workspace.yml"
-                }
-            },
-            "pypi": {
-                "pipfile": {
-                    "pattern": "pipfile"
-                },
-                "pyproject.toml": {
-                    "pattern": "pyproject.toml"
-                },
-                "requirements.txt": {
-                    "pattern": "*requirements.txt"
-                },
-                "requirements": {
-                    "pattern": "requirements/*.txt"
-                },
-                "requirements-*.txt": {
-                    "pattern": "requirements-*.txt"
-                },
-                "requirements_*.txt": {
-                    "pattern": "requirements_*.txt"
-                },
-                "requirements.frozen": {
-                    "pattern": "requirements.frozen"
-                },
-                "setup.py": {
-                    "pattern": "setup.py"
-                }
-            },
-            "golang": {
-                "go.mod": {
-                    "pattern": "go.mod"
-                },
-                "go.sum": {
-                    "pattern": "go.sum"
-                }
-            },
-            "java": {
-                "pom.xml": {
-                    "pattern": "pom.xml"
-                }
-            }
-        }
         all_files = []
         for ecosystem in socket_globs:
             patterns = socket_globs[ecosystem]
             for file_name in patterns:
                 pattern = patterns[file_name]["pattern"]
                 file_path = f"{path}/**/{pattern}"
-                files = glob(file_path, recursive=True)
+                if files is None or len(files) == 0:
+                    files = glob(file_path, recursive=True)
+                else:
+                    files = Core.match_supported_files(path, files)
                 for file in files:
-                    if "/" in file:
-                        _, base_name = file.rsplit("/", 1)
-                    else:
-                        base_name = file
-                    if new_files is not None and len(new_files) > 0 and base_name not in new_files:
-                        continue
                     if platform.system() == "Windows":
                         file = file.replace("\\", "/")
+                    if path not in file:
+                        file = f"{path}/{file}"
                     found_path, file_name = file.rsplit("/", 1)
                     details = (found_path, file_name)
-                    all_files.append(details)
+                    if details not in all_files:
+                        all_files.append(details)
         return all_files
 
     @staticmethod
@@ -480,7 +486,13 @@ class Core:
         return full_scan
 
     @staticmethod
-    def create_new_diff(path: str, params: FullScanParams, workspace: str, new_files: list = None) -> Diff:
+    def create_new_diff(
+            path: str,
+            params: FullScanParams,
+            workspace: str,
+            new_files: list = None,
+            no_change: bool = False
+    ) -> Diff:
         """
         1. Get the head full scan. If it isn't present because this repo doesn't exist yet return an Empty full scan.
         2. Create a new Full scan for the current run
@@ -490,9 +502,14 @@ class Core:
         :param params: FullScanParams - Query params for the Full Scan endpoint
         :param workspace: str - Path for workspace
         :param new_files:
+        :param no_change:
         :return:
         """
+        if no_change:
+            return Diff()
         files = Core.find_files(path, new_files)
+        if files is None or len(files) == 0:
+            return Diff()
         try:
             head_full_scan_id = Core.get_head_scan_for_repo(params.repo)
             if head_full_scan_id is None or head_full_scan_id == "":
@@ -505,17 +522,15 @@ class Core:
                 log.info(f"Total time to get head full-scan {total_head_time: .2f}")
         except APIResourceNotFound:
             head_full_scan = []
-        if files is not None and len(files) > 0:
-            new_scan_start = time.time()
-            new_full_scan = Core.create_full_scan(files, params, workspace)
-            new_full_scan.packages = Core.create_sbom_dict(new_full_scan.sbom_artifacts)
-            new_scan_end = time.time()
-            total_new_time = new_scan_end - new_scan_start
-            log.info(f"Total time to get new full-scan {total_new_time: .2f}")
-            diff_report = Core.compare_sboms(new_full_scan.sbom_artifacts, head_full_scan)
-            diff_report.packages = new_full_scan.packages
-        else:
-            diff_report = Diff()
+        new_scan_start = time.time()
+        new_full_scan = Core.create_full_scan(files, params, workspace)
+        new_full_scan.packages = Core.create_sbom_dict(new_full_scan.sbom_artifacts)
+        new_scan_end = time.time()
+        total_new_time = new_scan_end - new_scan_start
+        log.info(f"Total time to get new full-scan {total_new_time: .2f}")
+        diff_report = Core.compare_sboms(new_full_scan.sbom_artifacts, head_full_scan)
+        diff_report.packages = new_full_scan.packages
+        diff_report.id = new_full_scan.id
         return diff_report
 
     @staticmethod

{socketsecurity-0.0.97 → socketsecurity-0.0.99}/socketsecurity/socketcli.py

@@ -135,9 +135,17 @@ parser.add_argument(
     default="[]"
 )
 
+parser.add_argument(
+    '--ignore-commit-files',
+    help='Ignores only looking for changed files form the commit. Will find any supported manifest file type',
+    action='store_true',
+    default=False
+)
 
-def output_console_comments(diff_report) -> None:
+
+def output_console_comments(diff_report: Diff, sbom_file_name: str = None) -> None:
     console_security_comment = Messages.create_console_security_alert_table(diff_report)
+    save_sbom_file(diff_report, sbom_file_name)
     if len(diff_report.new_alerts) > 0:
         log.info("Security issues detected by Socket Security")
         log.info(console_security_comment)
@@ -146,13 +154,18 @@ def output_console_comments(diff_report) -> None:
         log.info("No New Security issues detected by Socket Security")
 
 
-def output_console_json(diff_report) -> None:
+def output_console_json(diff_report: Diff, sbom_file_name: str = None) -> None:
     console_security_comment = Messages.create_security_comment_json(diff_report)
+    save_sbom_file(diff_report, sbom_file_name)
     print(json.dumps(console_security_comment))
     if len(diff_report.new_alerts) > 0:
         sys.exit(1)
 
 
+def save_sbom_file(diff_report: Diff, sbom_file_name: str = None):
+    if diff_report is not None and sbom_file_name is not None:
+        Core.save_file(sbom_file_name, json.dumps(Core.create_sbom_output(diff_report)))
+
 def cli():
     try:
         main_code()
@@ -187,11 +200,13 @@ def main_code():
     enable_json = arguments.enable_json
     disable_overview = arguments.disable_overview
     disable_security_issue = arguments.disable_security_issue
+    ignore_commit_files = arguments.ignore_commit_files
     files = arguments.files
     log.info(f"Starting Socket Security Scan version {__version__}")
     api_token = os.getenv("SOCKET_SECURITY_API_KEY") or arguments.api_token
     try:
         files = json.loads(files)
+        is_repo = True
     except Exception as error:
         log.error(f"Unable to parse {files}")
         log.error(error)
@@ -211,9 +226,11 @@ def main_code():
             committer = git_repo.committer
         if commit_message is None or commit_message == '':
             commit_message = git_repo.commit_message
-        if len(files) == 0:
+        if len(files) == 0 and not ignore_commit_files:
             files = git_repo.changed_files
+            is_repo = True
     except InvalidGitRepositoryError:
+        is_repo = False
         pass
         # git_repo = None
     if repo is None:
@@ -233,6 +250,10 @@ def main_code():
     if scm is not None:
         default_branch = scm.is_default_branch
 
+    if is_repo and files is not None and len(files) == 0 and not ignore_commit_files:
+        no_change = True
+    else:
+        no_change = False
     base_api_url = os.getenv("BASE_API_URL") or None
     core = Core(token=api_token, request_timeout=6000, base_api_url=base_api_url)
     set_as_pending_head = False
@@ -258,7 +279,7 @@ def main_code():
     elif scm is not None and scm.check_event_type() != "comment":
         log.info("Push initiated flow")
         diff: Diff
-        diff = core.create_new_diff(target_path, params, workspace=target_path, new_files=files)
+        diff = core.create_new_diff(target_path, params, workspace=target_path, new_files=files, no_change=no_change)
         if scm.check_event_type() == "diff":
             log.info("Starting comment logic for PR/MR event")
             log.debug(f"Getting comments for Repo {scm.repository} for PR {scm.pr_number}")
@@ -289,17 +310,17 @@ def main_code():
             log.info("Not a PR/MR event no comment needed")
         if enable_json:
             log.debug("Outputting JSON Results")
-            output_console_json(diff)
+            output_console_json(diff, sbom_file)
         else:
-            output_console_comments(diff)
+            output_console_comments(diff, sbom_file)
     else:
         log.info("API Mode")
         diff: Diff
-        diff = core.create_new_diff(target_path, params, workspace=target_path, new_files=files)
+        diff = core.create_new_diff(target_path, params, workspace=target_path, new_files=files, no_change=no_change)
         if enable_json:
-            output_console_json(diff)
+            output_console_json(diff, sbom_file)
         else:
-            output_console_comments(diff)
+            output_console_comments(diff, sbom_file)
     if diff is not None and license_mode:
         all_packages = {}
         for package_id in diff.packages:
@@ -317,8 +338,6 @@ def main_code():
             }
             all_packages[package_id] = output
         core.save_file(license_file, json.dumps(all_packages))
-    if diff is not None and sbom_file is not None:
-        core.save_file(sbom_file, json.dumps(core.create_sbom_output(diff)))
 
 
 if __name__ == '__main__':

{socketsecurity-0.0.97 → socketsecurity-0.0.99/socketsecurity.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: socketsecurity
-Version: 0.0.97
+Version: 0.0.99
 Summary: Socket Security CLI for CI/CD
 Author-email: Douglas Coburn <douglas@socket.dev>
 Maintainer-email: Douglas Coburn <douglas@socket.dev>
@@ -31,7 +31,7 @@ The Socket Security CLI was created to enable integrations with other tools like
 socketcli [-h] [--api_token API_TOKEN] [--repo REPO] [--branch BRANCH] [--committer COMMITTER] [--pr_number PR_NUMBER]
                  [--commit_message COMMIT_MESSAGE] [--default_branch] [--target_path TARGET_PATH] [--scm {api,github,gitlab}] [--sbom-file SBOM_FILE]
                  [--commit-sha COMMIT_SHA] [--generate-license GENERATE_LICENSE] [-v] [--enable-debug] [--enable-json] [--disable-overview]
-                 [--disable-security-issue] [--files FILES]
+                 [--disable-security-issue] [--files FILES] [--ignore-commit-files]
 ````
 
 If you don't want to provide the Socket API Token every time then you can use the environment variable `SOCKET_SECURITY_API_KEY`
@@ -59,3 +59,4 @@ If you don't want to provide the Socket API Token every time then you can use th
 | --disable-overview       |                | False    | False   | If enabled will disable Dependency Overview comments                                                                                                       |
 | --disable-security-issue |                | False    | False   | If enabled will disable Security Issue Comments                                                                                                            |
 | --files                  |                | False    |         | If provided in the format of `["file1", "file2"]` it will only look for those files and not glob the path                                                  |
+| --ignore-commit-files    |                | False    | False   | If enabled then the CLI will ignore what files are changed in the commit and look for all manifest files                                                   |