diff --git a/actions/check_security_gate/action.yaml b/actions/check_security_gate/action.yaml new file mode 100644 index 0000000..3b98caf --- /dev/null +++ b/actions/check_security_gate/action.yaml @@ -0,0 +1,23 @@ +name: 'SecObserve Check Security Gate' +description: 'Checks SecObserve security gate of a product' +author: 'MaibornWolff' + +inputs: + so_api_base_url: + description: 'Base URL of the SecObserve backend' + required: true + so_api_token: + description: 'API token of the user to be used for the check.' + required: true + so_product_name: + description: 'Name of the product for which the security gate check is being performed.' + required: true + +runs: + using: 'docker' + image: 'docker://maibornwolff/secobserve-scanners:latest' + entrypoint: 'check_security_gate.sh' + env: + SO_API_BASE_URL: ${{ inputs.so_api_base_url }} + SO_API_TOKEN: ${{ inputs.so_api_token }} + SO_PRODUCT_NAME: ${{ inputs.so_product_name }} diff --git a/dev/actions/check_security_gate/action.yaml b/dev/actions/check_security_gate/action.yaml new file mode 100644 index 0000000..3134c9d --- /dev/null +++ b/dev/actions/check_security_gate/action.yaml @@ -0,0 +1,23 @@ +name: 'SecObserve Check Security Gate' +description: 'Checks SecObserve security gate for a product' +author: 'MaibornWolff' + +inputs: + so_api_base_url: + description: 'Base URL of the SecObserve backend' + required: true + so_api_token: + description: 'API token of the user to be used for the check.' + required: true + so_product_name: + description: 'Name of the product for which the security gate check is being performed.' + required: true + +runs: + using: 'docker' + image: 'docker://maibornwolff/secobserve-scanners:dev' + entrypoint: 'check_security_gate.sh' + env: + SO_API_BASE_URL: ${{ inputs.so_api_base_url }} + SO_API_TOKEN: ${{ inputs.so_api_token }} + SO_PRODUCT_NAME: ${{ inputs.so_product_name }} diff --git a/dev/templates/check_security_gate.yml b/dev/templates/check_security_gate.yml new file mode 100644 index 0000000..be52306 --- /dev/null +++ b/dev/templates/check_security_gate.yml @@ -0,0 +1,8 @@ +.check_security_gate: + image: + name: maibornwolff/secobserve-scanners:dev + stage: post_test + variables: + GIT_STRATEGY: none + script: + - check_security_gate.sh diff --git a/docker/entrypoints/entrypoint_bandit.sh b/docker/entrypoints/entrypoint_bandit.sh index fc19e59..b30eace 100755 --- a/docker/entrypoints/entrypoint_bandit.sh +++ b/docker/entrypoints/entrypoint_bandit.sh @@ -12,7 +12,7 @@ else fi export SO_FILE_NAME="${REPORT_NAME}" -export SO_PARSER_NAME="Sarif" +export SO_PARSER_NAME="SARIF" echo ---------------------------------------- echo Bandit diff --git a/docker/entrypoints/entrypoint_check_security_gate.sh b/docker/entrypoints/entrypoint_check_security_gate.sh new file mode 100755 index 0000000..b40baed --- /dev/null +++ b/docker/entrypoints/entrypoint_check_security_gate.sh @@ -0,0 +1,3 @@ +#!/bin/sh +set -e +source check_security_gate.sh diff --git a/docker/entrypoints/entrypoint_checkov.sh b/docker/entrypoints/entrypoint_checkov.sh index d257b8b..156a1ff 100755 --- a/docker/entrypoints/entrypoint_checkov.sh +++ b/docker/entrypoints/entrypoint_checkov.sh @@ -12,7 +12,7 @@ else fi export SO_FILE_NAME="${REPORT_NAME}" -export SO_PARSER_NAME="Sarif" +export SO_PARSER_NAME="SARIF" echo ---------------------------------------- echo Checkov diff --git a/docker/entrypoints/entrypoint_eslint.sh b/docker/entrypoints/entrypoint_eslint.sh index 5407d1c..b8f3592 100755 --- a/docker/entrypoints/entrypoint_eslint.sh +++ b/docker/entrypoints/entrypoint_eslint.sh @@ -12,7 +12,7 @@ else fi export SO_FILE_NAME="${REPORT_NAME}" -export SO_PARSER_NAME="Sarif" +export SO_PARSER_NAME="SARIF" echo ---------------------------------------- echo ESLint diff --git a/docker/entrypoints/entrypoint_gitleaks.sh b/docker/entrypoints/entrypoint_gitleaks.sh index 309be97..cc6b3e3 100755 --- a/docker/entrypoints/entrypoint_gitleaks.sh +++ b/docker/entrypoints/entrypoint_gitleaks.sh @@ -12,7 +12,7 @@ else fi export SO_FILE_NAME="${REPORT_NAME}" -export SO_PARSER_NAME="Sarif" +export SO_PARSER_NAME="SARIF" echo ---------------------------------------- echo GitLeaks diff --git a/docker/entrypoints/entrypoint_kics.sh b/docker/entrypoints/entrypoint_kics.sh index 3ac4fa8..dfdd615 100755 --- a/docker/entrypoints/entrypoint_kics.sh +++ b/docker/entrypoints/entrypoint_kics.sh @@ -16,7 +16,7 @@ if [[ -z "${OUTPUT_PATH}" ]]; then fi export SO_FILE_NAME="${OUTPUT_PATH}"/"${REPORT_NAME}" -export SO_PARSER_NAME="Sarif" +export SO_PARSER_NAME="SARIF" echo ---------------------------------------- echo KICS diff --git a/docker/entrypoints/entrypoint_semgrep.sh b/docker/entrypoints/entrypoint_semgrep.sh index afd0be4..940731a 100755 --- a/docker/entrypoints/entrypoint_semgrep.sh +++ b/docker/entrypoints/entrypoint_semgrep.sh @@ -12,7 +12,7 @@ else fi export SO_FILE_NAME="${REPORT_NAME}" -export SO_PARSER_NAME="Sarif" +export SO_PARSER_NAME="SARIF" echo ---------------------------------------- echo Semgrep diff --git a/docker/entrypoints/entrypoint_tfsec.sh b/docker/entrypoints/entrypoint_tfsec.sh index a81a1c0..aa45978 100755 --- a/docker/entrypoints/entrypoint_tfsec.sh +++ b/docker/entrypoints/entrypoint_tfsec.sh @@ -12,7 +12,7 @@ else fi export SO_FILE_NAME="${REPORT_NAME}" -export SO_PARSER_NAME="Sarif" +export SO_PARSER_NAME="SARIF" echo ---------------------------------------- echo tfsec diff --git a/importer/bin/check_security_gate.sh b/importer/bin/check_security_gate.sh new file mode 100755 index 0000000..8afdbe3 --- /dev/null +++ b/importer/bin/check_security_gate.sh @@ -0,0 +1,3 @@ +#!/bin/sh +export PYTHONPATH="${PYTHONPATH}:/usr/local/importer" +python -m importer.check_security_gate diff --git a/importer/importer/check_security_gate.py b/importer/importer/check_security_gate.py new file mode 100644 index 0000000..572fbf1 --- /dev/null +++ b/importer/importer/check_security_gate.py @@ -0,0 +1,33 @@ +from importer.secobserve_api import Api +from importer.environment import Environment +from requests.exceptions import HTTPError + + +def check_security_gate(): + try: + environment = Environment() + environment.check_environment_common() + api = Api() + product = api.get_product() + if product.get("security_gate_passed") == None: + print(f"Product {product.get('name')}: Security gate DISABLED") + exit(0) + + if product.get("security_gate_passed") == True: + print(f"Product {product.get('name')}: Security gate PASSED") + exit(0) + + print(f"Product {product.get('name')}: Security gate FAILED") + exit(1) + + except Exception as e: + print(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>") + print(f"{e.__class__.__name__}: {str(e)}") + if isinstance(e, HTTPError): + print(f"Response: {e.response.content.decode('utf-8')}") + print("<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<") + exit(1) + + +if __name__ == "__main__": + check_security_gate() diff --git a/importer/importer/file_upload_observations.py b/importer/importer/file_upload_observations.py index 8383aa5..82cd39c 100644 --- a/importer/importer/file_upload_observations.py +++ b/importer/importer/file_upload_observations.py @@ -10,9 +10,11 @@ def file_upload_observations(): api = Api() api.file_upload_observations() except Exception as e: + print(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>") print(f"{e.__class__.__name__}: {str(e)}") if isinstance(e, HTTPError): print(f"Response: {e.response.content.decode('utf-8')}") + print("<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<") exit(1) diff --git a/importer/importer/secobserve_api.py b/importer/importer/secobserve_api.py index 8c023f0..093dbe7 100644 --- a/importer/importer/secobserve_api.py +++ b/importer/importer/secobserve_api.py @@ -1,5 +1,4 @@ import requests -from http import HTTPStatus from importer.environment import Environment @@ -55,3 +54,25 @@ def file_upload_observations(self): response.raise_for_status() print(response.json()) + + def get_product(self) -> dict: + response = requests.get( + f"{self.environment.api_base_url}/api/products/?name={self.environment.product_name}", + headers=self.headers, + ) + response.raise_for_status() + + data = response.json() + + count = data.get("count", None) + if count == None: + raise ValueError("Count not found in response") + if count == 0: + raise ValueError(f"Product {self.environment.product_name} not found") + + results = data.get("results", []) + for result in results: + if result["name"] == self.environment.product_name: + return result + + raise ValueError(f"Product {self.environment.product_name} not found") diff --git a/templates/check_security_gate.yml b/templates/check_security_gate.yml new file mode 100644 index 0000000..629ac32 --- /dev/null +++ b/templates/check_security_gate.yml @@ -0,0 +1,8 @@ +.check_security_gate: + image: + name: maibornwolff/secobserve-scanners:latest + stage: post_test + variables: + GIT_STRATEGY: none + script: + - check_security_gate.sh diff --git a/vulnerability_scanner/vulnerability_scanner/scan_vulnerabilities.py b/vulnerability_scanner/vulnerability_scanner/scan_vulnerabilities.py index 46aa3a5..30786fc 100644 --- a/vulnerability_scanner/vulnerability_scanner/scan_vulnerabilities.py +++ b/vulnerability_scanner/vulnerability_scanner/scan_vulnerabilities.py @@ -48,7 +48,9 @@ def scan_vulnerabilities(): if error: exit(1) except Exception as e: + print(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>") print(f"{e.__class__.__name__}: {str(e)}") + print("<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<") exit(1)