django-DefectDojo/dojo/tools/trivy_operator/secrets_handler.py at 873bda2b269658947599685067b1c2f2436390da · DefectDojo/django-DefectDojo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
from dojo.models import Finding

TRIVY_SEVERITIES = {
    "CRITICAL": "Critical",
    "HIGH": "High",
    "MEDIUM": "Medium",
    "LOW": "Low",
    "UNKNOWN": "Info",
}

SECRET_DESCRIPTION_TEMPLATE = """{title}
**Category:** {category}
**Match:** {match}
"""  # noqa: S105


class TrivySecretsHandler:
    def handle_secrets(self, labels, secrets, test):
        findings = []
        resource_namespace = labels.get("trivy-operator.resource.namespace", "")
        resource_kind = labels.get("trivy-operator.resource.kind", "")
        resource_name = labels.get("trivy-operator.resource.name", "")
        container_name = labels.get("trivy-operator.container.name", "")
        for secret in secrets:
            secret_title = secret.get("title")
            secret_category = secret.get("category")
            secret_match = secret.get("match", "")
            secret_severity = TRIVY_SEVERITIES[secret.get("severity")]
            secret_rule_id = secret.get("ruleID", "0")
            secret_target = secret.get("target", "")
            secret_references = secret.get("ruleID", "")
            title = f"Secret detected in {secret_target} - {secret_title}"
            secret_description = SECRET_DESCRIPTION_TEMPLATE.format(
                title=secret_title,
                category=secret_category,
                match=secret_match,
            )
            secret_description += "\n**container.name:** " + container_name
            secret_description += "\n**resource.kind:** " + resource_kind
            secret_description += "\n**resource.name:** " + resource_name
            secret_description += "\n**resource.namespace:** " + resource_namespace
            secret_description += "\n**ruleID:** " + secret_rule_id
            finding = Finding(
                test=test,
                title=title,
                severity=secret_severity,
                references=secret_references,
                description=secret_description,
                file_path=secret_target,
                static_finding=True,
                dynamic_finding=False,
                fix_available=True,
            )
            if resource_namespace:
                finding.unsaved_tags = [resource_namespace]
            findings.append(finding)
        return findings