socketsecurity 0.0.98__tar.gz → 1.0.0__tar.gz

{socketsecurity-0.0.98/socketsecurity.egg-info → socketsecurity-1.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: socketsecurity
-Version: 0.0.98
+Version: 1.0.0
 Summary: Socket Security CLI for CI/CD
 Author-email: Douglas Coburn <douglas@socket.dev>
 Maintainer-email: Douglas Coburn <douglas@socket.dev>

{socketsecurity-0.0.98 → socketsecurity-1.0.0}/socketsecurity/__init__.py

@@ -1,2 +1,2 @@
 __author__ = 'socket.dev'
-__version__ = '0.0.98'
+__version__ = '1.0.0'

{socketsecurity-0.0.98 → socketsecurity-1.0.0}/socketsecurity/core/__init__.py

@@ -1,4 +1,6 @@
 import logging
+from pathlib import PurePath
+
 import requests
 from urllib.parse import urlencode
 import base64
@@ -46,6 +48,74 @@ security_policy = {}
 log = logging.getLogger("socketdev")
 log.addHandler(logging.NullHandler())
 
+socket_globs = {
+    "npm": {
+        "package.json": {
+            "pattern": "package.json"
+        },
+        "package-lock.json": {
+            "pattern": "package-lock.json"
+        },
+        "npm-shrinkwrap.json": {
+            "pattern": "npm-shrinkwrap.json"
+        },
+        "yarn.lock": {
+            "pattern": "yarn.lock"
+        },
+        "pnpm-lock.yaml": {
+            "pattern": "pnpm-lock.yaml"
+        },
+        "pnpm-lock.yml": {
+            "pattern": "pnpm-lock.yml"
+        },
+        "pnpm-workspace.yaml": {
+            "pattern": "pnpm-workspace.yaml"
+        },
+        "pnpm-workspace.yml": {
+            "pattern": "pnpm-workspace.yml"
+        }
+    },
+    "pypi": {
+        "pipfile": {
+            "pattern": "pipfile"
+        },
+        "pyproject.toml": {
+            "pattern": "pyproject.toml"
+        },
+        "requirements.txt": {
+            "pattern": "*requirements.txt"
+        },
+        "requirements": {
+            "pattern": "requirements/*.txt"
+        },
+        "requirements-*.txt": {
+            "pattern": "requirements-*.txt"
+        },
+        "requirements_*.txt": {
+            "pattern": "requirements_*.txt"
+        },
+        "requirements.frozen": {
+            "pattern": "requirements.frozen"
+        },
+        "setup.py": {
+            "pattern": "setup.py"
+        }
+    },
+    "golang": {
+        "go.mod": {
+            "pattern": "go.mod"
+        },
+        "go.sum": {
+            "pattern": "go.sum"
+        }
+    },
+    "java": {
+        "pom.xml": {
+            "pattern": "pom.xml"
+        }
+    }
+}
+
 
 def encode_key(token: str) -> None:
     """
@@ -287,125 +357,61 @@ class Core:
         return manifest_files
 
     @staticmethod
-    def create_sbom_output(diff: Diff) -> list:
-        sbom = []
-        for package_id in diff.packages:
-            package: Package
-            package = diff.packages[package_id]
-            manifest_files = Core.get_manifest_files(package, diff.packages)
-            item = {
-                "id": package.id,
-                "license": package.license,
-                "license_text": package.license_text,
-                "manifestFiles": manifest_files,
-                "score": package.score,
-                "size": package.size,
-                "ecosystem": package.type,
-                "alerts": package.alerts,
-                "direct": package.direct,
-                "name": package.name,
-                "version": package.version,
-                "author": package.author,
-                "url": package.url
-            }
-            sbom.append(item)
+    def create_sbom_output(diff: Diff) -> dict:
+        base_path = f"orgs/{org_slug}/export/cdx"
+        path = f"{base_path}/{diff.id}"
+        result = do_request(path=path)
+        try:
+            sbom = result.json()
+        except Exception as error:
+            log.error(f"Unable to get CycloneDX Output for {diff.id}")
+            log.error(error)
+            sbom = {}
         return sbom
 
     @staticmethod
-    def find_files(path: str, new_files: list = None) -> list:
+    def match_supported_files(path: str, files: list) -> list:
+        matched = []
+        for ecosystem in socket_globs:
+            patterns = socket_globs[ecosystem]
+            for file_name in patterns:
+                pattern = patterns[file_name]["pattern"]
+                # path_pattern = f"**/{pattern}"
+                for file in files:
+                    if "\\" in file:
+                        file = file.replace("\\", "/")
+                    if PurePath(file).match(pattern):
+                        matched.append(file)
+        return matched
+
+    @staticmethod
+    def find_files(path: str, files: list = None) -> list:
         """
         Globs the path for supported manifest files.
         Note: Might move the source to a JSON file
         :param path: Str - path to where the manifest files are located
-        :param new_files:
+        :param files: override finding the manifest files using the glob matcher
         :return:
         """
-        socket_globs = {
-            "npm": {
-                "package.json": {
-                    "pattern": "package.json"
-                },
-                "package-lock.json": {
-                    "pattern": "package-lock.json"
-                },
-                "npm-shrinkwrap.json": {
-                    "pattern": "npm-shrinkwrap.json"
-                },
-                "yarn.lock": {
-                    "pattern": "yarn.lock"
-                },
-                "pnpm-lock.yaml": {
-                    "pattern": "pnpm-lock.yaml"
-                },
-                "pnpm-lock.yml": {
-                    "pattern": "pnpm-lock.yml"
-                },
-                "pnpm-workspace.yaml": {
-                    "pattern": "pnpm-workspace.yaml"
-                },
-                "pnpm-workspace.yml": {
-                    "pattern": "pnpm-workspace.yml"
-                }
-            },
-            "pypi": {
-                "pipfile": {
-                    "pattern": "pipfile"
-                },
-                "pyproject.toml": {
-                    "pattern": "pyproject.toml"
-                },
-                "requirements.txt": {
-                    "pattern": "*requirements.txt"
-                },
-                "requirements": {
-                    "pattern": "requirements/*.txt"
-                },
-                "requirements-*.txt": {
-                    "pattern": "requirements-*.txt"
-                },
-                "requirements_*.txt": {
-                    "pattern": "requirements_*.txt"
-                },
-                "requirements.frozen": {
-                    "pattern": "requirements.frozen"
-                },
-                "setup.py": {
-                    "pattern": "setup.py"
-                }
-            },
-            "golang": {
-                "go.mod": {
-                    "pattern": "go.mod"
-                },
-                "go.sum": {
-                    "pattern": "go.sum"
-                }
-            },
-            "java": {
-                "pom.xml": {
-                    "pattern": "pom.xml"
-                }
-            }
-        }
         all_files = []
         for ecosystem in socket_globs:
             patterns = socket_globs[ecosystem]
             for file_name in patterns:
                 pattern = patterns[file_name]["pattern"]
                 file_path = f"{path}/**/{pattern}"
-                files = glob(file_path, recursive=True)
+                if files is None or len(files) == 0:
+                    files = glob(file_path, recursive=True)
+                else:
+                    files = Core.match_supported_files(path, files)
                 for file in files:
-                    if "/" in file:
-                        _, base_name = file.rsplit("/", 1)
-                    else:
-                        base_name = file
-                    if new_files is not None and len(new_files) > 0 and base_name not in new_files:
-                        continue
                     if platform.system() == "Windows":
                         file = file.replace("\\", "/")
+                    if path not in file:
+                        file = f"{path}/{file}"
                     found_path, file_name = file.rsplit("/", 1)
                     details = (found_path, file_name)
-                    all_files.append(details)
+                    if details not in all_files:
+                        all_files.append(details)
         return all_files
 
     @staticmethod
@@ -480,7 +486,13 @@ class Core:
         return full_scan
 
     @staticmethod
-    def create_new_diff(path: str, params: FullScanParams, workspace: str, new_files: list = None) -> Diff:
+    def create_new_diff(
+            path: str,
+            params: FullScanParams,
+            workspace: str,
+            new_files: list = None,
+            no_change: bool = False
+    ) -> Diff:
         """
         1. Get the head full scan. If it isn't present because this repo doesn't exist yet return an Empty full scan.
         2. Create a new Full scan for the current run
@@ -490,9 +502,14 @@ class Core:
         :param params: FullScanParams - Query params for the Full Scan endpoint
         :param workspace: str - Path for workspace
         :param new_files:
+        :param no_change:
         :return:
         """
+        if no_change:
+            return Diff()
         files = Core.find_files(path, new_files)
+        if files is None or len(files) == 0:
+            return Diff()
         try:
             head_full_scan_id = Core.get_head_scan_for_repo(params.repo)
             if head_full_scan_id is None or head_full_scan_id == "":
@@ -505,17 +522,15 @@ class Core:
                 log.info(f"Total time to get head full-scan {total_head_time: .2f}")
         except APIResourceNotFound:
             head_full_scan = []
-        if files is not None and len(files) > 0:
-            new_scan_start = time.time()
-            new_full_scan = Core.create_full_scan(files, params, workspace)
-            new_full_scan.packages = Core.create_sbom_dict(new_full_scan.sbom_artifacts)
-            new_scan_end = time.time()
-            total_new_time = new_scan_end - new_scan_start
-            log.info(f"Total time to get new full-scan {total_new_time: .2f}")
-            diff_report = Core.compare_sboms(new_full_scan.sbom_artifacts, head_full_scan)
-            diff_report.packages = new_full_scan.packages
-        else:
-            diff_report = Diff()
+        new_scan_start = time.time()
+        new_full_scan = Core.create_full_scan(files, params, workspace)
+        new_full_scan.packages = Core.create_sbom_dict(new_full_scan.sbom_artifacts)
+        new_scan_end = time.time()
+        total_new_time = new_scan_end - new_scan_start
+        log.info(f"Total time to get new full-scan {total_new_time: .2f}")
+        diff_report = Core.compare_sboms(new_full_scan.sbom_artifacts, head_full_scan)
+        diff_report.packages = new_full_scan.packages
+        diff_report.id = new_full_scan.id
         return diff_report
 
     @staticmethod
@@ -622,30 +637,16 @@ class Core:
             if alert_key not in head_scan_alerts:
                 new_alerts = new_scan_alerts[alert_key]
                 for alert in new_alerts:
-                    if Core.is_error(alert):
+                    if alert.error or alert.warn:
                         alerts.append(alert)
             else:
                 new_alerts = new_scan_alerts[alert_key]
                 head_alerts = head_scan_alerts[alert_key]
                 for alert in new_alerts:
-                    if alert not in head_alerts and Core.is_error(alert):
+                    if alert not in head_alerts and (alert.error or alert.warn):
                         alerts.append(alert)
         return alerts
 
-    @staticmethod
-    def is_error(alert: Alert):
-        """
-        Compare the current alert against the Security Policy to determine if it should be included. Can be overridden
-        with all_new_alerts Global setting if desired to return all alerts and not just the error category from the
-        security policy.
-        :param alert:
-        :return:
-        """
-        if all_new_alerts or (alert.type in security_policy and security_policy[alert.type]['action'] == "error"):
-            return True
-        else:
-            return False
-
     @staticmethod
     def create_issue_alerts(package: Package, alerts: dict, packages: dict) -> dict:
         """
@@ -689,6 +690,9 @@ class Core:
                 purl=package.purl,
                 url=package.url
             )
+            if alert.type in security_policy:
+                action = security_policy[alert.type]['action']
+                setattr(issue_alert, action, True)
             if issue_alert.key not in alerts:
                 alerts[issue_alert.key] = [issue_alert]
             else:

{socketsecurity-0.0.98 → socketsecurity-1.0.0}/socketsecurity/core/classes.py

@@ -140,7 +140,10 @@ class Issue:
     pkg_id: str
     props: dict
     key: str
-    is_error: bool
+    error: bool
+    warn: bool
+    ignore: bool
+    monitor: bool
     description: str
     title: str
     emoji: str
@@ -162,6 +165,14 @@ class Issue:
             self.introduced_by = []
         if not hasattr(self, "manifests"):
             self.manifests = ""
+        if not hasattr(self, "error"):
+            self.error = False
+        if not hasattr(self, "warn"):
+            self.warn = False
+        if not hasattr(self, "monitor"):
+            self.monitor = False
+        if not hasattr(self, "ignore"):
+            self.ignore = False
 
     def __str__(self):
         return json.dumps(self.__dict__)

{socketsecurity-0.0.98 → socketsecurity-1.0.0}/socketsecurity/core/messages.py

@@ -9,10 +9,13 @@ class Messages:
 
     @staticmethod
     def create_security_comment_json(diff: Diff) -> dict:
+        scan_failed = False
         if len(diff.new_alerts) == 0:
-            scan_failed = False
-        else:
-            scan_failed = True
+            for alert in diff.new_alerts:
+                alert: Issue
+                if alert.error:
+                    scan_failed = True
+                    break
         output = {
             "scan_failed": scan_failed,
             "new_alerts": []
@@ -22,7 +25,6 @@ class Messages:
             output["new_alerts"].append(json.loads(str(alert)))
         return output
 
-
     @staticmethod
     def security_comment_template(diff: Diff) -> str:
         """
@@ -130,7 +132,8 @@ class Messages:
             "Alert",
             "Package",
             "Introduced by",
-            "Manifest File"
+            "Manifest File",
+            "CI"
         ]
         num_of_alert_columns = len(alert_table)
         next_steps = {}
@@ -147,11 +150,16 @@ class Messages:
                 ignore_commands.append(ignore)
             manifest_str, sources = Messages.create_sources(alert, "console")
             purl_url = f"[{alert.purl}]({alert.url})"
+            if alert.error:
+                emoji = ':no_entry_sign:'
+            else:
+                emoji = ':warning:'
             row = [
                 alert.title,
                 purl_url,
                 ", ".join(sources),
-                manifest_str
+                manifest_str,
+                emoji
             ]
             if row not in alert_table:
                 alert_table.extend(row)
@@ -262,17 +270,27 @@ class Messages:
                 "Alert",
                 "Package",
                 "Introduced by",
-                "Manifest File"
+                "Manifest File",
+                "CI Status"
             ]
         )
         for alert in diff.new_alerts:
             alert: Issue
             manifest_str, sources = Messages.create_sources(alert, "console")
+            if alert.error:
+                state = "block"
+            elif alert.warn:
+                state = "warn"
+            elif alert.monitor:
+                state = "monitor"
+            else:
+                state = "ignore"
             row = [
                 alert.title,
                 alert.url,
                 ", ".join(sources),
-                manifest_str
+                manifest_str,
+                state
             ]
             alert_table.add_row(row)
         return alert_table

{socketsecurity-0.0.98 → socketsecurity-1.0.0}/socketsecurity/socketcli.py

@@ -1,7 +1,7 @@
 import argparse
 import json
 from socketsecurity.core import Core, __version__
-from socketsecurity.core.classes import FullScanParams, Diff, Package
+from socketsecurity.core.classes import FullScanParams, Diff, Package, Alert
 from socketsecurity.core.messages import Messages
 from socketsecurity.core.scm_comments import Comments
 from socketsecurity.core.git_interface import Git
@@ -143,23 +143,42 @@ parser.add_argument(
 )
 
 
-def output_console_comments(diff_report) -> None:
+def output_console_comments(diff_report: Diff, sbom_file_name: str = None) -> None:
     console_security_comment = Messages.create_console_security_alert_table(diff_report)
-    if len(diff_report.new_alerts) > 0:
+    save_sbom_file(diff_report, sbom_file_name)
+    if not report_pass(diff_report):
         log.info("Security issues detected by Socket Security")
-        log.info(console_security_comment)
+        msg = f"\n{console_security_comment}"
+        log.info(msg)
         sys.exit(1)
     else:
         log.info("No New Security issues detected by Socket Security")
 
 
-def output_console_json(diff_report) -> None:
+def output_console_json(diff_report: Diff, sbom_file_name: str = None) -> None:
     console_security_comment = Messages.create_security_comment_json(diff_report)
+    save_sbom_file(diff_report, sbom_file_name)
     print(json.dumps(console_security_comment))
-    if len(diff_report.new_alerts) > 0:
+    if not report_pass(diff_report):
         sys.exit(1)
 
 
+def report_pass(diff_report: Diff) -> bool:
+    report_passed = True
+    if len(diff_report.new_alerts) > 0:
+        for alert in diff_report.new_alerts:
+            alert: Alert
+            if report_passed and alert.error:
+                report_passed = False
+                break
+    return report_passed
+
+
+def save_sbom_file(diff_report: Diff, sbom_file_name: str = None):
+    if diff_report is not None and sbom_file_name is not None:
+        Core.save_file(sbom_file_name, json.dumps(Core.create_sbom_output(diff_report)))
+
+
 def cli():
     try:
         main_code()
@@ -200,6 +219,7 @@ def main_code():
     api_token = os.getenv("SOCKET_SECURITY_API_KEY") or arguments.api_token
     try:
         files = json.loads(files)
+        is_repo = True
     except Exception as error:
         log.error(f"Unable to parse {files}")
         log.error(error)
@@ -221,7 +241,9 @@ def main_code():
             commit_message = git_repo.commit_message
         if len(files) == 0 and not ignore_commit_files:
             files = git_repo.changed_files
+            is_repo = True
     except InvalidGitRepositoryError:
+        is_repo = False
         pass
         # git_repo = None
     if repo is None:
@@ -241,6 +263,10 @@ def main_code():
     if scm is not None:
         default_branch = scm.is_default_branch
 
+    if is_repo and files is not None and len(files) == 0 and not ignore_commit_files:
+        no_change = True
+    else:
+        no_change = False
     base_api_url = os.getenv("BASE_API_URL") or None
     core = Core(token=api_token, request_timeout=6000, base_api_url=base_api_url)
     set_as_pending_head = False
@@ -266,7 +292,7 @@ def main_code():
     elif scm is not None and scm.check_event_type() != "comment":
         log.info("Push initiated flow")
         diff: Diff
-        diff = core.create_new_diff(target_path, params, workspace=target_path, new_files=files)
+        diff = core.create_new_diff(target_path, params, workspace=target_path, new_files=files, no_change=no_change)
         if scm.check_event_type() == "diff":
             log.info("Starting comment logic for PR/MR event")
             log.debug(f"Getting comments for Repo {scm.repository} for PR {scm.pr_number}")
@@ -297,17 +323,17 @@ def main_code():
             log.info("Not a PR/MR event no comment needed")
         if enable_json:
             log.debug("Outputting JSON Results")
-            output_console_json(diff)
+            output_console_json(diff, sbom_file)
         else:
-            output_console_comments(diff)
+            output_console_comments(diff, sbom_file)
     else:
         log.info("API Mode")
         diff: Diff
-        diff = core.create_new_diff(target_path, params, workspace=target_path, new_files=files)
+        diff = core.create_new_diff(target_path, params, workspace=target_path, new_files=files, no_change=no_change)
         if enable_json:
-            output_console_json(diff)
+            output_console_json(diff, sbom_file)
         else:
-            output_console_comments(diff)
+            output_console_comments(diff, sbom_file)
     if diff is not None and license_mode:
         all_packages = {}
         for package_id in diff.packages:
@@ -325,8 +351,6 @@ def main_code():
             }
             all_packages[package_id] = output
         core.save_file(license_file, json.dumps(all_packages))
-    if diff is not None and sbom_file is not None:
-        core.save_file(sbom_file, json.dumps(core.create_sbom_output(diff)))
 
 
 if __name__ == '__main__':

{socketsecurity-0.0.98 → socketsecurity-1.0.0/socketsecurity.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: socketsecurity
-Version: 0.0.98
+Version: 1.0.0
 Summary: Socket Security CLI for CI/CD
 Author-email: Douglas Coburn <douglas@socket.dev>
 Maintainer-email: Douglas Coburn <douglas@socket.dev>