diff --git a/.env b/.env index 65e82f8ee3..e50d90a292 100644 --- a/.env +++ b/.env @@ -158,7 +158,7 @@ SENTRY_RELEASE=local # REO_DEV_CLIENT_ID= #### Prowler release version #### -NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.39.0 +NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.40.0 # Social login credentials SOCIAL_GOOGLE_OAUTH_CALLBACK_URL="${AUTH_URL}/api/auth/callback/google" diff --git a/.github/actions/trivy-scan/action.yml b/.github/actions/trivy-scan/action.yml index 13810cbb68..4032da469b 100644 --- a/.github/actions/trivy-scan/action.yml +++ b/.github/actions/trivy-scan/action.yml @@ -64,7 +64,7 @@ runs: scanners: 'vuln' ignore-unfixed: 'true' # A finding with no available fix is not actionable, so it must not gate timeout: '5m' - version: 'v0.72.0' + version: 'v0.74.0' # Not trivyignores: that input drops the .yaml extension Trivy parses by. env: TRIVY_IGNOREFILE: '.trivyignore.yaml' @@ -81,7 +81,7 @@ runs: scanners: 'vuln' ignore-unfixed: 'true' # A finding with no available fix is not actionable, so it must not gate timeout: '5m' - version: 'v0.72.0' + version: 'v0.74.0' # Not trivyignores: that input drops the .yaml extension Trivy parses by. env: TRIVY_IGNOREFILE: '.trivyignore.yaml' diff --git a/.github/agents/issue-triage.md b/.github/agents/issue-triage.md index 9de627e316..c383a88105 100644 --- a/.github/agents/issue-triage.md +++ b/.github/agents/issue-triage.md @@ -199,7 +199,7 @@ You MUST structure your response using this EXACT format. Do NOT include anythin ### For Check Logic Bug -``` +```markdown ### AI Assessment [Experimental]: Check Logic Bug **Component**: {component from issue template} @@ -297,7 +297,7 @@ Write tests FIRST (TDD). The skills contain all testing conventions and patterns ### For Bug (non-check) -``` +```markdown ### AI Assessment [Experimental]: Bug **Component**: {CLI/SDK | API | UI | Dashboard | MCP Server | Other} @@ -378,7 +378,7 @@ Write tests FIRST (TDD). The skills contain all testing conventions and patterns ### For Already Fixed -``` +```markdown ### AI Assessment [Experimental]: Already Fixed **Component**: {component} @@ -401,7 +401,7 @@ Upgrade to the latest version. Close the issue as resolved. ### For Feature Request -``` +```markdown ### AI Assessment [Experimental]: Feature Request **Component**: {component} @@ -419,7 +419,7 @@ Upgrade to the latest version. Close the issue as resolved. ### For Not a Bug -``` +```markdown ### AI Assessment [Experimental]: Not a Bug **Component**: {component} @@ -440,7 +440,7 @@ Upgrade to the latest version. Close the issue as resolved. ### For Needs More Information -``` +```markdown ### AI Assessment [Experimental]: Needs More Information **Component**: {component or "Unknown"} diff --git a/.github/labeler.yml b/.github/labeler.yml index b9abb1dfd0..e6888039da 100644 --- a/.github/labeler.yml +++ b/.github/labeler.yml @@ -52,6 +52,16 @@ provider/alibabacloud: - any-glob-to-any-file: "prowler/providers/alibabacloud/**" - any-glob-to-any-file: "tests/providers/alibabacloud/**" +provider/huaweicloud: + - changed-files: + - any-glob-to-any-file: "prowler/providers/huaweicloud/**" + - any-glob-to-any-file: "tests/providers/huaweicloud/**" + +provider/image: + - changed-files: + - any-glob-to-any-file: "prowler/providers/image/**" + - any-glob-to-any-file: "tests/providers/image/**" + provider/cloudflare: - changed-files: - any-glob-to-any-file: "prowler/providers/cloudflare/**" @@ -82,6 +92,11 @@ provider/linode: - any-glob-to-any-file: "prowler/providers/linode/**" - any-glob-to-any-file: "tests/providers/linode/**" +provider/stackit: + - changed-files: + - any-glob-to-any-file: "prowler/providers/stackit/**" + - any-glob-to-any-file: "tests/providers/stackit/**" + github_actions: - changed-files: - any-glob-to-any-file: ".github/workflows/*" diff --git a/.github/scripts/slack-messages/README.md b/.github/scripts/slack-messages/README.md index e7fcf00fdd..5466efc7df 100644 --- a/.github/scripts/slack-messages/README.md +++ b/.github/scripts/slack-messages/README.md @@ -8,11 +8,11 @@ These JSON templates are used with the `slackapi/slack-github-action` using the ### Available Templates -**Container Releases** +#### Container Releases - `container-release-started.json`: Simple one-line notification when container push starts - `container-release-completed.json`: Simple one-line notification when container release completes -**Deployments** +#### Deployments - `deployment-started.json`: Deployment start notification with Block Kit formatting - `deployment-completed.json`: Deployment completion notification (updates the start message) @@ -416,17 +416,17 @@ For deployments that start with one message and update it with the final status: ### Container Release (Simple One-Line) **Start message:** -``` +```text API container release 4.5.0 push started... View run ``` **Completion message (success):** -``` +```text [βœ“] API container release 4.5.0 push completed successfully! View run ``` **Completion message (failure):** -``` +```text [βœ—] API container release 4.5.0 push failed View run ``` diff --git a/.github/workflows/markdown-lint.yml b/.github/workflows/markdown-lint.yml index 7918c701e5..abd42ded07 100644 --- a/.github/workflows/markdown-lint.yml +++ b/.github/workflows/markdown-lint.yml @@ -55,6 +55,10 @@ jobs: # Pin must match .pre-commit-config.yaml so prek and CI behave identically. # pnpm dlx doesn't accept --ignore-scripts as a flag; the env var # disables postinstall scripts on transitives the same way. + # + # Files come from `git ls-files` because markdownlint doesn't traverse + # dot-directories, so `.github/**/*.md` went unlinted. + # `.markdownlintignore` still applies to the listed paths. env: pnpm_config_ignore_scripts: 'true' - run: pnpm dlx markdownlint-cli@0.45.0 '**/*.md' + run: git ls-files -z '*.md' | xargs -0 -r pnpm dlx markdownlint-cli@0.45.0 -- diff --git a/.github/workflows/mcp-pypi-release.yml b/.github/workflows/mcp-pypi-release.yml index a6dae75017..f6ad43e39f 100644 --- a/.github/workflows/mcp-pypi-release.yml +++ b/.github/workflows/mcp-pypi-release.yml @@ -113,7 +113,7 @@ jobs: - name: Publish prowler-mcp package to PyPI if: steps.pypi-check.outputs.skip != 'true' - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 with: packages-dir: ${{ env.WORKING_DIRECTORY }}/dist/ print-hash: true diff --git a/.github/workflows/sdk-package-checks.yml b/.github/workflows/sdk-package-checks.yml new file mode 100644 index 0000000000..8c3ab50e47 --- /dev/null +++ b/.github/workflows/sdk-package-checks.yml @@ -0,0 +1,196 @@ +name: 'SDK: Package Checks' + +# Rehearses the PyPI release on every packaging change and once a week, from the +# consumer's side. Two incidents this guards against: +# +# - 5.38.0 shipped an unsatisfiable Requires-Dist (cryptography==50.0.0 while +# alibabacloud-tea-openapi and pyopenssl cap it below 49). A [tool.uv] override hid +# the conflict inside the repo; pip could not install the wheel and silently +# resolved `pip install prowler` to 5.37.1 for a week. +# - 5.39.0 never published: an unpinned build backend started emitting core metadata +# 2.5 and the twine bundled in the publish action rejected it. +# +# Both were only detectable at release time because nothing built and installed the +# artifact earlier. The weekly run also catches releases yanked from PyPI after we +# pinned them (zstd 1.5.7.3, "buggy - not thread safe", sat in uv.lock for months). + +on: + push: + branches: + - 'master' + - 'v5.*' + pull_request: + branches: + - 'master' + - 'v5.*' + schedule: + # Monday 06:00 UTC. Yanks and upstream releases happen without a commit here. + - cron: '0 6 * * 1' + workflow_dispatch: + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +permissions: {} + +env: + # Must equal the twine bundled in the pypa/gh-action-pypi-publish pin used by + # sdk-pypi-release.yml (requirements/runtime.txt in that repo at the pinned tag). + # A metadata check that passes here must pass there. + TWINE_VERSION: '7.0.0' + +jobs: + changes: + if: github.repository == 'prowler-cloud/prowler' + runs-on: ubuntu-latest + timeout-minutes: 5 + permissions: + contents: read + outputs: + # Scheduled and manual runs always execute; pushes and PRs only when a packaging + # input changed. Jobs skipped this way still report success to branch protection. + run: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || steps.filter.outputs.any_changed == 'true' }} + + steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: block + allowed-endpoints: > + github.com:443 + api.github.com:443 + + - name: Checkout repository + if: github.event_name == 'push' || github.event_name == 'pull_request' + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + # zizmor: ignore[artipacked] + persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch + + - name: Detect packaging changes + if: github.event_name == 'push' || github.event_name == 'pull_request' + id: filter + uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6 + with: + files: | + pyproject.toml + uv.lock + README.md + util/replicate_pypi_package.py + util/check_yanked_pins.py + api/pyproject.toml + api/uv.lock + mcp_server/pyproject.toml + mcp_server/uv.lock + .github/workflows/sdk-package-checks.yml + .github/workflows/sdk-pypi-release.yml + .github/actions/setup-python-uv/** + + install-from-wheel: + needs: changes + if: needs.changes.outputs.run == 'true' + runs-on: ubuntu-latest + timeout-minutes: 20 + permissions: + contents: read + strategy: + fail-fast: false + matrix: + python-version: + - '3.10' + - '3.11' + - '3.12' + - '3.13' + package: + - 'prowler' + include: + # prowler-cloud is the same tree renamed by util/replicate_pypi_package.py; + # one Python is enough to prove the rename and its build still work. + - python-version: '3.12' + package: 'prowler-cloud' + + steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: block + allowed-endpoints: > + github.com:443 + api.github.com:443 + release-assets.githubusercontent.com:443 + pypi.org:443 + files.pythonhosted.org:443 + + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Setup Python with uv + uses: ./.github/actions/setup-python-uv + with: + python-version: ${{ matrix.python-version }} + install-dependencies: 'false' + + - name: Rename package to prowler-cloud + if: matrix.package == 'prowler-cloud' + run: | + pip install --no-cache-dir toml + python util/replicate_pypi_package.py + + - name: Build sdist and wheel + run: uv build + + - name: Check metadata with the release workflow's twine + run: uvx --from "twine==${TWINE_VERSION}" twine check --strict dist/* + + - name: Install the wheel with pip into a clean virtualenv + # Plain pip, --isolated, from outside the repo: consumers never see [tool.uv] + # override-dependencies or constraint-dependencies, so neither does this step. + run: | + python -m venv "${RUNNER_TEMP}/consumer" + "${RUNNER_TEMP}/consumer/bin/python" -m pip install --quiet --upgrade pip + cd "${RUNNER_TEMP}" + "${RUNNER_TEMP}/consumer/bin/python" -m pip install --isolated --no-cache-dir "${GITHUB_WORKSPACE}"/dist/*.whl + + - name: Smoke test the installed CLI + run: | + cd "${RUNNER_TEMP}" + "${RUNNER_TEMP}/consumer/bin/prowler" --version + # Loads every AWS check module from the installed wheel: catches files missing + # from the package. grep fails the step if the summary line never appears. + "${RUNNER_TEMP}/consumer/bin/prowler" aws --list-checks | grep 'available checks' + + pinned-releases-not-yanked: + needs: changes + if: needs.changes.outputs.run == 'true' + runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + contents: read + + steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: block + allowed-endpoints: > + github.com:443 + api.github.com:443 + release-assets.githubusercontent.com:443 + pypi.org:443 + files.pythonhosted.org:443 + + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Set up Python + uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0 + with: + python-version: '3.12' + + - name: Check every pinned and locked release against PyPI + run: python util/check_yanked_pins.py . api mcp_server diff --git a/.github/workflows/sdk-pypi-release.yml b/.github/workflows/sdk-pypi-release.yml index a61c9157e8..1504ce5ca1 100644 --- a/.github/workflows/sdk-pypi-release.yml +++ b/.github/workflows/sdk-pypi-release.yml @@ -84,8 +84,18 @@ jobs: - name: Build Prowler package run: uv build + - name: Verify the wheel installs with pip + # Same check as "SDK: Package Checks", repeated on the exact artifact about to be + # published. Plain pip, --isolated, from outside the repo: an unsatisfiable + # Requires-Dist fails here instead of on users' machines (5.38.0 shipped one). + run: | + python -m venv "${RUNNER_TEMP}/consumer" + "${RUNNER_TEMP}/consumer/bin/python" -m pip install --quiet --upgrade pip + cd "${RUNNER_TEMP}" + "${RUNNER_TEMP}/consumer/bin/python" -m pip install --isolated --no-cache-dir --dry-run "${GITHUB_WORKSPACE}"/dist/*.whl + - name: Publish Prowler package to PyPI - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 with: print-hash: true @@ -128,7 +138,17 @@ jobs: - name: Build prowler-cloud package run: uv build + - name: Verify the wheel installs with pip + # Same check as "SDK: Package Checks", repeated on the exact artifact about to be + # published. Plain pip, --isolated, from outside the repo: an unsatisfiable + # Requires-Dist fails here instead of on users' machines (5.38.0 shipped one). + run: | + python -m venv "${RUNNER_TEMP}/consumer" + "${RUNNER_TEMP}/consumer/bin/python" -m pip install --quiet --upgrade pip + cd "${RUNNER_TEMP}" + "${RUNNER_TEMP}/consumer/bin/python" -m pip install --isolated --no-cache-dir --dry-run "${GITHUB_WORKSPACE}"/dist/*.whl + - name: Publish prowler-cloud package to PyPI - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 with: print-hash: true diff --git a/.grype.yaml b/.grype.yaml index 7c36171f65..8fe74513c9 100644 --- a/.grype.yaml +++ b/.grype.yaml @@ -33,6 +33,19 @@ ignore: package: name: Microsoft.Bcl.Memory + # The .NET runtime bundled inside the PowerShell tarball the Dockerfile pins. + # CVE-2026-62901 is the same temporary exception documented in .trivyignore.yaml: + # fixed in .NET 9.0.19 / 10.0.11 (2026-08-11), but no published PowerShell release + # ships a patched runtime yet (7.5.9 bundles 9.0.18; 7.6.4 bundles 10.0.x < 10.0.11). + # pwsh runs only local M365 module cmdlets; nothing listens for inbound WebSocket + # connections. Remove with the Trivy exception by 2026-09-15. + - vulnerability: CVE-2026-62901 + package: + name: Microsoft.NETCore.App.Runtime.linux-x64 + - vulnerability: CVE-2026-62901 + package: + name: Microsoft.NETCore.App.Runtime.linux-arm64 + # The CPython interpreter, compiled into the official base image. # TEMPORARY, unlike the entries above: moving to Python 3.13 clears seven of these, and diff --git a/.trivyignore.yaml b/.trivyignore.yaml index dffc42c784..b78162ecc4 100644 --- a/.trivyignore.yaml +++ b/.trivyignore.yaml @@ -118,25 +118,25 @@ vulnerabilities: - "pkg:npm/ip-address" expired_at: 2027-01-31 - # .NET 9 runtime that ships with PowerShell 7.x (which the images bundle so - # the M365 provider can drive Exchange/Teams/Skype cmdlets). Trivy flags it - # via the SBOM PowerShell embeds under Modules/*/_manifest. The vulnerable - # code paths are not reachable from Prowler: the runtime is executed only - # inside `pwsh` subprocesses that Prowler spawns for M365 cmdlets, none of - # which handles the untrusted input the CVE requires. There is no published - # fix in a Prowler-compatible PowerShell release yet. Short expiry to force - # a re-look once Microsoft ships a patched .NET 9.0.x or PowerShell drops - # the vulnerable runtime. + # CVE-2026-62901 is a DoS in System.Net.WebSockets (unchecked input for loop condition, + # CWE-606), fixed in .NET 9.0.19 / 10.0.11 (published 2026-08-11). The vulnerable runtime + # ships inside the PowerShell tarball the Dockerfile pins: 7.5.9 is the latest 7.5.x and + # bundles .NET 9.0.18; 7.6.4 bundles .NET 10.0.x < 10.0.11, so no published PowerShell + # release contains the fix yet. Prowler only invokes pwsh locally to run M365 module + # cmdlets; the image does not accept inbound WebSocket connections, so the DoS path is + # not reachable from the network. Remove this temporary suppression as soon as a + # PowerShell release shipping .NET 9.0.19+ is available. - id: CVE-2026-62901 purls: - "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64" - expired_at: 2026-11-30 + - "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-arm64" + expired_at: 2026-09-15 # Modules compiled into the Trivy binary the images ship. The binary is pinned by version # and verified by checksum in the Dockerfile; only a rebuild by its vendor moves these. # CVE-2026-71556 affects go-git worktree operations that can follow symlinks outside a - # cloned repository. Trivy 0.72.0 contains go-git 5.19.1, and even the latest published - # Trivy release, 0.73.0, still pins that vulnerable version: + # cloned repository. Trivy 0.73.0, the latest published release and the version the + # images ship, still pins that vulnerable version: # https://github.com/aquasecurity/trivy/blob/v0.73.0/go.mod#L46 # Trivy main already contains the 5.19.2 fix, but no published release includes it yet: # https://github.com/aquasecurity/trivy/commit/a2edba9a03987ba0d2ebc8212c1a9a1e6979497b @@ -164,7 +164,3 @@ vulnerabilities: purls: - "pkg:golang/oras.land/oras-go/v2" expired_at: 2026-12-31 - - id: CVE-2026-39822 - purls: - - "pkg:golang/stdlib" - expired_at: 2026-12-31 diff --git a/Dockerfile b/Dockerfile index 62aa3c4f1e..c07c6f29da 100644 --- a/Dockerfile +++ b/Dockerfile @@ -8,15 +8,15 @@ ENV POWERSHELL_VERSION=${POWERSHELL_VERSION} # Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com) ENV POWERSHELL_TELEMETRY_OPTOUT=1 -ARG TRIVY_VERSION=0.72.0 +ARG TRIVY_VERSION=0.74.0 ENV TRIVY_VERSION=${TRIVY_VERSION} ARG ZIZMOR_VERSION=1.24.1 ENV ZIZMOR_VERSION=${ZIZMOR_VERSION} # Pinned here, not fetched with the artefact: a compromised release ships its own checksum. -ARG TRIVY_SHA256_AMD64=bbb64b9695866ce4a7a8f5c9592002c5961cab378577fa3f8a040df362b9b2ea -ARG TRIVY_SHA256_ARM64=2ca2c023109c2db6b2b77366b6717291452d4531167377d95c79547f0c8e3467 +ARG TRIVY_SHA256_AMD64=2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a +ARG TRIVY_SHA256_ARM64=b94ce1976bbf3c15b514b605ee88be7c6d94a29be2302847ff01cb794d47aad5 ARG POWERSHELL_SHA256_AMD64=492ff26bb958336bf61e597ce19e07648b4003bd2a08659e02f0e3e0446ebfe0 ARG POWERSHELL_SHA256_ARM64=2503b71da3e83635592b092df59a0aca4c3606b4d9b068217bb00be989cb0d56 ARG ZIZMOR_SHA256_AMD64=a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03 @@ -26,6 +26,7 @@ ARG ZIZMOR_SHA256_ARM64=d66e37ef8a375fb07939c630ebf9709a6e0f20242bdc3faf672a7ed9 RUN apt-get update && apt-get install -y --no-install-recommends \ wget libicu76 libunwind8 libssl3 libcurl4 ca-certificates apt-transport-https gnupg \ build-essential pkg-config libzstd-dev zlib1g-dev \ + && apt-get install -y --no-install-recommends --only-upgrade util-linux \ && rm -rf /var/lib/apt/lists/* # Install PowerShell diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md index b119fbaafc..183f1270ee 100644 --- a/api/CHANGELOG.md +++ b/api/CHANGELOG.md @@ -4,6 +4,37 @@ All notable changes to the **Prowler API** are documented in this file. +## [1.40.1] (Prowler v5.39.1) + +### πŸ”„ Changed + +- Bump alibabacloud-tea-openapi to 0.4.6, oci to 2.184.1 and pyopenssl to 26.4.0 to match the SDK; the cryptography override now names its actual blockers (azure-cli-core pins msal below 1.37, workos 8.3.0 requires cryptography 48) [(#12477)](https://github.com/prowler-cloud/prowler/pull/12477) + +### 🐞 Fixed + +- Pin zstd to 1.5.7.2; 1.5.7.3 was yanked from PyPI as not thread safe [(#12477)](https://github.com/prowler-cloud/prowler/pull/12477) + +### πŸ” Security + +- Trivy from v0.72.0 to v0.73.0 in the container image, fixing HIGH CVE-2026-46600 in the bundled `golang.org/x/net` [(#12445)](https://github.com/prowler-cloud/prowler/pull/12445) +- Trivy v0.74.0 and Debian util-linux 2.41.5-0+deb13u1 in the API container image, patching Go standard library vulnerabilities and CVE-2026-53615 [(#12470)](https://github.com/prowler-cloud/prowler/pull/12470) + +--- + +## [1.40.0] (Prowler v5.39.0) + +### πŸ”„ Changed + +- `GET /api/v1/users/me` membership relationships identify the active tenant with `meta.active` for JWT and API key authentication [(#12388)](https://github.com/prowler-cloud/prowler/pull/12388) + +### 🐞 Fixed + +- Tenant deletion no longer leaves memberships partially removed when exclusive-user cleanup fails [(#12379)](https://github.com/prowler-cloud/prowler/pull/12379) +- `/api/v1/accounts/saml/{organization_slug}/acs/` rejects non-POST requests before SAML response processing [(#12393)](https://github.com/prowler-cloud/prowler/pull/12393) +- Social login derives a valid user name when identity providers omit the profile name [(#12413)](https://github.com/prowler-cloud/prowler/pull/12413) + +--- + ## [1.39.0] (Prowler v5.38.0) ### πŸš€ Added diff --git a/api/Dockerfile b/api/Dockerfile index af7b07e16c..0f7e5883bb 100644 --- a/api/Dockerfile +++ b/api/Dockerfile @@ -7,15 +7,15 @@ ENV POWERSHELL_VERSION=${POWERSHELL_VERSION} # Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com) ENV POWERSHELL_TELEMETRY_OPTOUT=1 -ARG TRIVY_VERSION=0.72.0 +ARG TRIVY_VERSION=0.74.0 ENV TRIVY_VERSION=${TRIVY_VERSION} ARG ZIZMOR_VERSION=1.24.1 ENV ZIZMOR_VERSION=${ZIZMOR_VERSION} # Pinned here, not fetched with the artefact: a compromised release ships its own checksum. -ARG TRIVY_SHA256_AMD64=bbb64b9695866ce4a7a8f5c9592002c5961cab378577fa3f8a040df362b9b2ea -ARG TRIVY_SHA256_ARM64=2ca2c023109c2db6b2b77366b6717291452d4531167377d95c79547f0c8e3467 +ARG TRIVY_SHA256_AMD64=2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a +ARG TRIVY_SHA256_ARM64=b94ce1976bbf3c15b514b605ee88be7c6d94a29be2302847ff01cb794d47aad5 ARG POWERSHELL_SHA256_AMD64=492ff26bb958336bf61e597ce19e07648b4003bd2a08659e02f0e3e0446ebfe0 ARG POWERSHELL_SHA256_ARM64=2503b71da3e83635592b092df59a0aca4c3606b4d9b068217bb00be989cb0d56 ARG ZIZMOR_SHA256_AMD64=a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03 @@ -36,6 +36,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \ libtool \ libxslt1-dev \ python3-dev \ + && apt-get install -y --no-install-recommends --only-upgrade util-linux \ && rm -rf /var/lib/apt/lists/* # Install PowerShell diff --git a/api/changelog.d/saml-acs-post-only.fixed.md b/api/changelog.d/saml-acs-post-only.fixed.md deleted file mode 100644 index 91f00e7d62..0000000000 --- a/api/changelog.d/saml-acs-post-only.fixed.md +++ /dev/null @@ -1 +0,0 @@ -`/api/v1/accounts/saml/{organization_slug}/acs/` rejects non-POST requests before SAML response processing diff --git a/api/changelog.d/tenant-deletion-transaction.fixed.md b/api/changelog.d/tenant-deletion-transaction.fixed.md deleted file mode 100644 index 5679bc4564..0000000000 --- a/api/changelog.d/tenant-deletion-transaction.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Tenant deletion no longer leaves memberships partially removed when exclusive-user cleanup fails diff --git a/api/changelog.d/users-me-active-membership.changed.md b/api/changelog.d/users-me-active-membership.changed.md deleted file mode 100644 index 4e02368ab4..0000000000 --- a/api/changelog.d/users-me-active-membership.changed.md +++ /dev/null @@ -1 +0,0 @@ -`GET /api/v1/users/me` membership relationships identify the active tenant with `meta.active` for JWT and API key authentication diff --git a/api/pyproject.toml b/api/pyproject.toml index 3be69d7c43..511b1f80a2 100644 --- a/api/pyproject.toml +++ b/api/pyproject.toml @@ -71,7 +71,7 @@ name = "prowler-api" package-mode = false # Needed for the SDK compatibility requires-python = ">=3.11,<3.13" -version = "1.40.0" +version = "1.41.0" # Shared ruff baseline (kept in sync with mcp_server/pyproject.toml). # target-version tracks this project's lowest supported Python. @@ -92,8 +92,7 @@ extend-select = [ [tool.uv] # Transitive pins matching master to avoid silent drift; bump deliberately. -# workos and pyopenssl run ahead of master: the versions master pins cap cryptography -# below 48, so both were bumped to versions that allow it (PROWLER-2310). +# workos is api-only; pyopenssl matches master (PROWLER-2310). constraint-dependencies = [ "about-time==4.2.1", "adal==1.2.7", @@ -130,7 +129,7 @@ constraint-dependencies = [ "alibabacloud-sls20201230==5.9.0", "alibabacloud-sts20150401==1.1.6", "alibabacloud-tea==0.4.3", - "alibabacloud-tea-openapi==0.4.5", + "alibabacloud-tea-openapi==0.4.6", "alibabacloud-tea-util==0.3.14", "alibabacloud-tea-xml==0.0.3", "alibabacloud-vpc20160428==6.13.0", @@ -339,7 +338,7 @@ constraint-dependencies = [ "nltk==3.9.4", "numpy==2.2.6", "oauthlib==3.3.1", - "oci==2.183.0", + "oci==2.184.1", "openai==1.109.1", "openstacksdk==4.2.0", "opentelemetry-api==1.39.1", @@ -380,7 +379,7 @@ constraint-dependencies = [ "pylint==3.2.5", "pymsalruntime==0.18.1", "pynacl==1.6.2", - "pyopenssl==26.2.0", + "pyopenssl==26.4.0", "pyparsing==3.3.2", "pyreadline3==3.5.4", "pysocks==1.7.1", @@ -458,7 +457,7 @@ constraint-dependencies = [ "zipp==3.23.0", "zope-event==6.1", "zope-interface==8.2", - "zstd==1.5.7.3" + "zstd==1.5.7.2" ] # prowler@master needs okta==3.4.2, but cartography 0.138.1 requires okta<1.0.0. # Attack Paths does not ingest Okta today, so override the Cartography @@ -485,7 +484,12 @@ constraint-dependencies = [ # that request pyjwt[crypto] and leave cryptography (needed for RS256) only transitive. override-dependencies = [ "okta==3.4.2", - # alibabacloud-tea-openapi 0.4.5 caps cryptography below 49 and is the latest release. + # prowler requires cryptography==50.0.0. Two api-only dependencies still cap it below + # 49 and cannot move yet: msal, pinned exactly by azure-cli-core (2.83.0 -> 1.35.0b1, + # 2.89.1 -> 1.36.0, both <49; cartography needs azure-cli-core), and workos 8.3.0 + # (~=48.0; workos 10.1.1+ needs ~=50.0 and is a separate SDK upgrade). This api is + # deployed from this lock with `uv sync --locked`, so the override applies to what runs. + # Remove when azure-cli-core pins msal>=1.37.0 and workos is on 10.x. "cryptography==50.0.0", "azure-mgmt-containerservice==34.1.0", "microsoft-kiota-abstractions==1.9.10", diff --git a/api/src/backend/api/adapters.py b/api/src/backend/api/adapters.py index 55ac440f59..6806289fdb 100644 --- a/api/src/backend/api/adapters.py +++ b/api/src/backend/api/adapters.py @@ -12,11 +12,37 @@ from api.models import ( UserRoleRelationship, ) from api.utils import accept_invitation_for_user +from django.core.exceptions import ValidationError from django.db import transaction from django.http import HttpResponseForbidden class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter): + @staticmethod + def _get_social_account_name(extra_data: dict, email: str) -> str: + name_field = User._meta.get_field("name") + for value in ( + extra_data.get("name"), + extra_data.get("login"), + extra_data.get("username"), + email, + ): + if not isinstance(value, str): + continue + + candidate = value.strip()[: name_field.max_length].rstrip() + if not candidate: + continue + + try: + name_field.run_validators(candidate) + except ValidationError: + continue + + return candidate + + raise ValueError("Social account does not provide a valid user identity.") + @staticmethod def get_user_by_email(email: str): try: @@ -116,11 +142,8 @@ class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter): if provider != "saml": # Handle other providers (e.g., GitHub, Google) + user.name = self._get_social_account_name(extra, user.email) user.save(using=MainRouter.admin_db) - social_account_name = extra.get("name") - if social_account_name: - user.name = social_account_name - user.save(using=MainRouter.admin_db) invitation_token = self._get_invitation_token(request) if invitation_token: diff --git a/api/src/backend/api/specs/v1.yaml b/api/src/backend/api/specs/v1.yaml index dce066dbed..6cb1d28392 100644 --- a/api/src/backend/api/specs/v1.yaml +++ b/api/src/backend/api/specs/v1.yaml @@ -1,7 +1,7 @@ openapi: 3.0.3 info: title: Prowler API - version: 1.40.0 + version: 1.41.0 description: |- Prowler API specification. diff --git a/api/src/backend/api/tests/test_adapters.py b/api/src/backend/api/tests/test_adapters.py index 7d8e06bb0e..3fd14afbf7 100644 --- a/api/src/backend/api/tests/test_adapters.py +++ b/api/src/backend/api/tests/test_adapters.py @@ -111,6 +111,110 @@ def _verify_local_email(user): ) +def test_social_account_name_falls_back_to_login_for_blank_name(): + adapter = ProwlerSocialAccountAdapter() + + name = adapter._get_social_account_name( + {"name": " ", "login": "octocat"}, + "verified@example.com", + ) + + assert name == "octocat" + + +@pytest.mark.parametrize("provider_name", [None, "", " ", 123, ["name"]]) +def test_social_account_name_ignores_unusable_provider_names(provider_name): + adapter = ProwlerSocialAccountAdapter() + + name = adapter._get_social_account_name( + {"name": provider_name, "login": "octocat"}, + "verified@example.com", + ) + + assert name == "octocat" + + +def test_social_account_name_uses_login_when_name_is_missing(): + adapter = ProwlerSocialAccountAdapter() + + name = adapter._get_social_account_name( + {"login": "octocat"}, + "verified@example.com", + ) + + assert name == "octocat" + + +def test_social_account_name_falls_back_to_username_then_email(): + adapter = ProwlerSocialAccountAdapter() + + username_name = adapter._get_social_account_name( + {"name": "ab", "login": None, "username": " monalisa "}, + "verified@example.com", + ) + email_name = adapter._get_social_account_name({}, " verified@example.com ") + + assert username_name == "monalisa" + assert email_name == "verified@example.com" + + +def test_social_account_name_trims_and_limits_provider_name(): + adapter = ProwlerSocialAccountAdapter() + max_length = User._meta.get_field("name").max_length + + trimmed_name = adapter._get_social_account_name( + {"name": " Ada Lovelace "}, + "verified@example.com", + ) + limited_name = adapter._get_social_account_name( + {"name": "a" * (max_length + 1)}, + "verified@example.com", + ) + + assert trimmed_name == "Ada Lovelace" + assert limited_name == "a" * max_length + + +def test_social_account_name_rejects_missing_identity(): + adapter = ProwlerSocialAccountAdapter() + + with pytest.raises( + ValueError, + match="Social account does not provide a valid user identity", + ): + adapter._get_social_account_name({}, "") + + +def test_save_user_applies_normalized_social_account_name(rf): + adapter = ProwlerSocialAccountAdapter() + request = rf.post("/") + request.session = {} + sociallogin = MagicMock(spec=SocialLogin) + sociallogin.provider = MagicMock() + sociallogin.provider.id = "github" + sociallogin.account = MagicMock() + sociallogin.account.extra_data = {"name": None, "login": " octocat "} + user = User(email="verified@example.com") + user.save = MagicMock() + invitation = SimpleNamespace(tenant_id="tenant-id") + + with ( + patch("api.adapters.super") as mock_super, + patch("api.adapters.transaction.atomic"), + patch("api.adapters.write_db_alias"), + patch.object(adapter, "_get_invitation_token", return_value="token"), + patch( + "api.adapters.accept_invitation_for_user", + return_value=(invitation, True), + ), + ): + mock_super.return_value.save_user.return_value = user + saved_user = adapter.save_user(request, sociallogin) + + assert saved_user.name == "octocat" + assert request.prowler_invitation_token == "token" + + @pytest.mark.django_db class TestProwlerSocialAccountAdapter: def test_get_user_by_email_returns_user(self, create_test_user): diff --git a/api/uv.lock b/api/uv.lock index 604e3bc35c..bbbd1a2e31 100644 --- a/api/uv.lock +++ b/api/uv.lock @@ -45,7 +45,7 @@ constraints = [ { name = "alibabacloud-sls20201230", specifier = "==5.9.0" }, { name = "alibabacloud-sts20150401", specifier = "==1.1.6" }, { name = "alibabacloud-tea", specifier = "==0.4.3" }, - { name = "alibabacloud-tea-openapi", specifier = "==0.4.5" }, + { name = "alibabacloud-tea-openapi", specifier = "==0.4.6" }, { name = "alibabacloud-tea-util", specifier = "==0.3.14" }, { name = "alibabacloud-tea-xml", specifier = "==0.0.3" }, { name = "alibabacloud-vpc20160428", specifier = "==6.13.0" }, @@ -254,7 +254,7 @@ constraints = [ { name = "nltk", specifier = "==3.9.4" }, { name = "numpy", specifier = "==2.2.6" }, { name = "oauthlib", specifier = "==3.3.1" }, - { name = "oci", specifier = "==2.183.0" }, + { name = "oci", specifier = "==2.184.1" }, { name = "openai", specifier = "==1.109.1" }, { name = "openstacksdk", specifier = "==4.2.0" }, { name = "opentelemetry-api", specifier = "==1.39.1" }, @@ -295,7 +295,7 @@ constraints = [ { name = "pylint", specifier = "==3.2.5" }, { name = "pymsalruntime", specifier = "==0.18.1" }, { name = "pynacl", specifier = "==1.6.2" }, - { name = "pyopenssl", specifier = "==26.2.0" }, + { name = "pyopenssl", specifier = "==26.4.0" }, { name = "pyparsing", specifier = "==3.3.2" }, { name = "pyreadline3", specifier = "==3.5.4" }, { name = "pysocks", specifier = "==1.7.1" }, @@ -373,7 +373,7 @@ constraints = [ { name = "zipp", specifier = "==3.23.0" }, { name = "zope-event", specifier = "==6.1" }, { name = "zope-interface", specifier = "==8.2" }, - { name = "zstd", specifier = "==1.5.7.3" }, + { name = "zstd", specifier = "==1.5.7.2" }, ] overrides = [ { name = "azure-mgmt-containerservice", specifier = "==34.1.0" }, @@ -860,7 +860,7 @@ sdist = { url = "https://files.pythonhosted.org/packages/9a/7d/b22cb9a0d4f396ee0 [[package]] name = "alibabacloud-tea-openapi" -version = "0.4.5" +version = "0.4.6" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "alibabacloud-credentials" }, @@ -869,9 +869,9 @@ dependencies = [ { name = "cryptography" }, { name = "darabonba-core" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/3b/73/fb0c4d44759791ecdf269fc715c1e810fa1aba3981bfaaf8a01f61899296/alibabacloud_tea_openapi-0.4.5.tar.gz", hash = "sha256:75fa1f4360a46e41f5bf5f8d4917e52efb6f64885839bc1328c35590670c97b9", size = 26616, upload-time = "2026-07-14T13:15:39.364Z" } +sdist = { url = "https://files.pythonhosted.org/packages/ab/34/1918a2d780676494365c7f945bfab397ecddb988054d78025bd26f438977/alibabacloud_tea_openapi-0.4.6.tar.gz", hash = "sha256:dafc32401712f5b21c12dc3d05ba887a91ad156d9b49a7662279f9fd90526fb2", size = 26742, upload-time = "2026-08-17T08:34:11.55Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/8d/ec/6b368a10e9c2e8b1b394c69b96ac213ae66e8c4895e0baa1ffaf7178fd32/alibabacloud_tea_openapi-0.4.5-py3-none-any.whl", hash = "sha256:338979095c7beda80a5b413c31262892cafdc12069dde4ce4fc2e4f7ce0fc609", size = 33333, upload-time = "2026-07-14T13:15:38.365Z" }, + { url = "https://files.pythonhosted.org/packages/35/00/2f534f5884e5f299d9cb3a1e8be2def8071bc6a6e2a192ba4ff2a8cd5e02/alibabacloud_tea_openapi-0.4.6-py3-none-any.whl", hash = "sha256:c9e1727b9fb2936f487d050fc3590c99f9f2065256dc3a927e5b61f414674ed6", size = 33448, upload-time = "2026-08-17T08:34:10.472Z" }, ] [[package]] @@ -4426,7 +4426,7 @@ wheels = [ [[package]] name = "oci" -version = "2.183.0" +version = "2.184.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "certifi" }, @@ -4439,9 +4439,9 @@ dependencies = [ { name = "pytz" }, { name = "urllib3" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/1e/2a/77bd6cbf1c69b2f368fe3d6462d84369b0cba15e37ce713cdc08d459b95a/oci-2.183.0.tar.gz", hash = "sha256:ff572ef5f2030a788796bb509d257e6a41c6510ef9b4b6a75a079efd06e533ce", size = 17759723, upload-time = "2026-07-28T06:02:29.76Z" } +sdist = { url = "https://files.pythonhosted.org/packages/74/2d/fa5368cfabb868f4111c6978e8b5f66aa3a55076c40c1a59ac3081b0227b/oci-2.184.1.tar.gz", hash = "sha256:617dad69caf8dd6e521d224dbc3e8a8bc289906943a0214fd2c3419094e26435", size = 17990631, upload-time = "2026-08-11T11:01:26.194Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/a9/de/8574b3e527996a099d196e87794a4652d91a0c3185fcc7fdbb5649b75a8a/oci-2.183.0-py3-none-any.whl", hash = "sha256:bd789c98a94d7c5ea08c20d11dcf68c9cd1ad479b134727d80a930b84387070b", size = 36133501, upload-time = "2026-07-28T06:02:18.239Z" }, + { url = "https://files.pythonhosted.org/packages/5f/63/5ae22e42aaf96a5da74dc2b9de449c78b4d7418cce621d5da723b3e49f32/oci-2.184.1-py3-none-any.whl", hash = "sha256:bd814e38a70da2190e721937455a08689ab13c0750bd2ef8dd0c98b2dc5a38ea", size = 36628063, upload-time = "2026-08-11T11:01:18.178Z" }, ] [[package]] @@ -4835,8 +4835,8 @@ wheels = [ [[package]] name = "prowler" -version = "5.38.0" -source = { git = "https://github.com/prowler-cloud/prowler.git?rev=master#b3d174d0c1eb202ed7cb9a9daf0500683f4443be" } +version = "5.40.0" +source = { git = "https://github.com/prowler-cloud/prowler.git?rev=master#b6e9967da6bebd6c7b8b237317a2a95e2e0c65bc" } dependencies = [ { name = "alibabacloud-actiontrail20200706" }, { name = "alibabacloud-credentials" }, @@ -4935,7 +4935,7 @@ dependencies = [ [[package]] name = "prowler-api" -version = "1.40.0" +version = "1.41.0" source = { virtual = "." } dependencies = [ { name = "cartography" }, @@ -5426,15 +5426,15 @@ wheels = [ [[package]] name = "pyopenssl" -version = "26.2.0" +version = "26.4.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "cryptography" }, { name = "typing-extensions" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/1a/51/27a5ad5f939d08f690a326ef9582cda7140555180db71695f6fb747d6a36/pyopenssl-26.2.0.tar.gz", hash = "sha256:8c6fcecd1183a7fc897548dfe388b0cdb7f37e018200d8409cf33959dbe35387", size = 182195, upload-time = "2026-05-04T23:06:09.72Z" } +sdist = { url = "https://files.pythonhosted.org/packages/3f/e8/7325d258199b159eb2c03fe32107533e2832e70e63f4fb88a6aa00023201/pyopenssl-26.4.0.tar.gz", hash = "sha256:28dfcce0162b9211413e26dfbfdf1d24317fbeba18fc93c12400a1856b2a0bc7", size = 182046, upload-time = "2026-08-01T19:50:50.512Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/73/b8/a0e2790ae249d6f38c9f66de7a211621a7ab2650217bcd04e1262f578a56/pyopenssl-26.2.0-py3-none-any.whl", hash = "sha256:4f9d971bc5298b8bc1fab282803da04bf000c755d4ad9d99b52de2569ca19a70", size = 55823, upload-time = "2026-05-04T23:06:08.395Z" }, + { url = "https://files.pythonhosted.org/packages/51/ad/2cf6d3fa2fae5c79e1ed9960c0d42badd0f94d81dd12b50604cdc839e648/pyopenssl-26.4.0-py3-none-any.whl", hash = "sha256:f0eb0cb2d581d3ad2b9c489468485e7f2ab6727d08401bcf9d824c3caddf3c1c", size = 56026, upload-time = "2026-08-01T19:50:48.94Z" }, ] [[package]] @@ -6623,39 +6623,27 @@ wheels = [ [[package]] name = "zstd" -version = "1.5.7.3" +version = "1.5.7.2" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/49/62/b9c075ad664e7c4cbb3d8d2be7c246506abe1bc7f778eb58d260ef9538c8/zstd-1.5.7.3.tar.gz", hash = "sha256:403e5205f4ac04b92e6b0cda654be2f51de268228a0db0067bc087faacf2f495", size = 672559, upload-time = "2026-01-08T16:24:43.361Z" } +sdist = { url = "https://files.pythonhosted.org/packages/0f/78/9a476e09c825304df47b98be80d1ffe223733b03550af71325415028f615/zstd-1.5.7.2.tar.gz", hash = "sha256:6d8684c69009be49e1b18ec251a5eb0d7e24f93624990a8a124a1da66a92fc8a", size = 670481, upload-time = "2025-06-23T12:36:08.131Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/75/0d/8c89c0d010b58c21a7865a239790bb1c6822029c053b1ded858d6b573e3a/zstd-1.5.7.3-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:1a3c1781a24e2ced2c0ddee11d45b1f04018b03615eeb622a62eca4d56d3358a", size = 267641, upload-time = "2026-01-08T16:30:50.812Z" }, - { url = "https://files.pythonhosted.org/packages/a3/6d/155d8c344d96eca2a5a003a5ddd63373a5f13591fd5cf2b9490250d6805a/zstd-1.5.7.3-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:a6c7c81056362b60a04baa34632e713d596662a860ec34efd8e9b109c10e6ec7", size = 230962, upload-time = "2026-01-08T16:30:49.155Z" }, - { url = "https://files.pythonhosted.org/packages/c8/c7/ab93916a26eb58cd501ad701974c31b4bc67a7f6abd6c24bef8fe4d7649b/zstd-1.5.7.3-cp311-cp311-manylinux_2_14_x86_64.whl", hash = "sha256:e564f34a55effc7d654eb293468edc80b64d476b0f899f82760ecd8323223ff5", size = 304166, upload-time = "2026-01-10T11:17:45.697Z" }, - { url = "https://files.pythonhosted.org/packages/c2/54/27a7040a360019a4602343e3c98c0c0a140f382186002c01e1992fd21837/zstd-1.5.7.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:fbc49a57188184931d5e3c9f1133cad7eea5a370a9e9418fb8122d58c14340a5", size = 1540288, upload-time = "2026-01-08T17:50:26.913Z" }, - { url = "https://files.pythonhosted.org/packages/96/93/4a4d4edd1b2e809e0ebbb16000404bdcc9a09743c04ee1661442c9581b75/zstd-1.5.7.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:d121d3e63722819e1fe5effbcd9628d8a7cfea0cddabcc5bb37ea861a6a83424", size = 1619134, upload-time = "2026-01-08T17:50:32.324Z" }, - { url = "https://files.pythonhosted.org/packages/31/6b/cd6f0a7f4f0d98e4110aa77763cf3e85f594d983ea9ca3d64cc0cee10684/zstd-1.5.7.3-cp311-cp311-manylinux_2_4_i686.whl", hash = "sha256:621f2e7ca8e9eb52a83eb9c91ec3cd283d87591bf75cc658de486b65f44742c7", size = 300166, upload-time = "2026-01-10T11:12:27.938Z" }, - { url = "https://files.pythonhosted.org/packages/05/3f/c717e0d15127d04b7fa58ba9b4c56e8b88b803048b9766cd9d158dbb22ea/zstd-1.5.7.3-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_24_i686.whl", hash = "sha256:c1950fcae690ba32d0f31702b335c548fb42547821565925e48576afdad774a5", size = 1525776, upload-time = "2026-01-08T17:50:35.518Z" }, - { url = "https://files.pythonhosted.org/packages/3e/a2/1813cd787d1a2f9ab8e8a90d28dcbc8e8098997dd04de38897ea8e75dd08/zstd-1.5.7.3-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:bac4f0d03da69115878bedbfa03c4a3f64364e8396b432028c4ce0f05141a0fb", size = 2096057, upload-time = "2026-01-08T17:50:33.984Z" }, - { url = "https://files.pythonhosted.org/packages/36/ce/f5a3c7c12de458dd9ce15c484d627fe5412b60c155da23dacb5fcf08d9d5/zstd-1.5.7.3-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:da0ab134b7fd28023dedf013751ca850de300a090eb11f689d2a1c178c87d9dc", size = 2132659, upload-time = "2026-01-08T17:50:29.534Z" }, - { url = "https://files.pythonhosted.org/packages/f1/66/151f9546498bfd8971a0b6ad67d87c26d7a0df17d57f724da674f3778666/zstd-1.5.7.3-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:b9923175842ee8f7602ec9cc578f5fc396896f0e8460d3ac9a5adc3cea77244e", size = 2124811, upload-time = "2026-01-08T17:50:37.612Z" }, - { url = "https://files.pythonhosted.org/packages/6a/34/4d2dbb36cb2373d3f115c047cb901b64f89de0703d10779da39de9453812/zstd-1.5.7.3-cp311-cp311-win32.whl", hash = "sha256:0612b604948d7b58aecc6788c7ceb53c5f21d94a155bb6ea9bd0f54ffa43725d", size = 150363, upload-time = "2026-01-08T17:11:02.392Z" }, - { url = "https://files.pythonhosted.org/packages/d9/de/f53687e0dd8c0d0ebfaed9ae88f6a96a1a0388ae7424b469e74bb17ac57d/zstd-1.5.7.3-cp311-cp311-win_amd64.whl", hash = "sha256:5b7f8c81b2bd3b62c0345242247d484cafa4b518d59d18619813d9225af5c5c3", size = 167577, upload-time = "2026-01-08T17:11:03.356Z" }, - { url = "https://files.pythonhosted.org/packages/f2/58/d4a6a902e229e953ed273fe9b78587ed31f57567aa68d3e34af6056e42af/zstd-1.5.7.3-cp311-cp311-win_arm64.whl", hash = "sha256:ea112e3acd9e1765adca35df7b54ac75b36194290f64ea03a3a59664209c8527", size = 157238, upload-time = "2026-01-08T16:36:06.25Z" }, - { url = "https://files.pythonhosted.org/packages/aa/ed/5a3bf2e29dc56d4cc7619929bb51f0c758de6d02967cc73c5d8755a862c0/zstd-1.5.7.3-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:01a39efb0eeab7cc45cb308618233b624b0840d5e16dcf85456b6cca0592f203", size = 268124, upload-time = "2026-01-08T16:29:57.091Z" }, - { url = "https://files.pythonhosted.org/packages/e2/1d/efc2074ac90af938e78f2ed4004639fe24f294d9086c5280f8d9a02b9897/zstd-1.5.7.3-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:7a8e8838cf35fa3987bfe1958584cc22e1797efce8e155a63544b4144fc671f8", size = 230988, upload-time = "2026-01-08T16:29:55.604Z" }, - { url = "https://files.pythonhosted.org/packages/2a/52/178393b8d70e23fba67f42dfce4663e4e8a30867110168beb490a36d4639/zstd-1.5.7.3-cp312-cp312-manylinux_2_14_i686.whl", hash = "sha256:f3920ac1d1cc7e9f252f3e29f217fe3cd36f2191bb3dbcae826c29e189b7ad54", size = 300207, upload-time = "2026-01-10T11:26:58.351Z" }, - { url = "https://files.pythonhosted.org/packages/6a/7a/8dcd86a2efb2ed3f9dae39545a05d3c7ed26c7678330786ce4a44cd8b099/zstd-1.5.7.3-cp312-cp312-manylinux_2_14_x86_64.whl", hash = "sha256:143f9062953fb5590cbd47c1040d357336742c79696bf90b6d5b835279a68304", size = 304154, upload-time = "2026-01-10T11:17:40.91Z" }, - { url = "https://files.pythonhosted.org/packages/6f/ce/0c96905ab01ffe0e53a3cec8132123b82db26bd583a71608029bcc789ebc/zstd-1.5.7.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:36d1fd8647e47e1f21b345e192f1a279e925678c23dad8236b547d04456cd699", size = 2162222, upload-time = "2026-01-08T18:02:22.762Z" }, - { url = "https://files.pythonhosted.org/packages/11/c4/db4807d6a68b4628c74fd379de7e3c67ec34f19a2a80ac246b3837cde6cb/zstd-1.5.7.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f1538db419afa62773cf534fc7f3009ff59ecf55ecee4e889587ac2ef0010ed8", size = 2201732, upload-time = "2026-01-08T18:02:20.835Z" }, - { url = "https://files.pythonhosted.org/packages/c5/99/c19a3c0f5580ff9c33a74f06d98d6060ed1fa6bd09b55aed9be852ec191f/zstd-1.5.7.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:c5efd16adb092e2a547a7d51cfdaf6fd5680528227684c5bafc7669ab4a55f41", size = 2096459, upload-time = "2026-01-08T18:02:25.336Z" }, - { url = "https://files.pythonhosted.org/packages/23/fd/02eac30419475dbe50212c119043a2d0698a0cbc756da85fd3fd9abddf42/zstd-1.5.7.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:39b3438e64637d80a5b1860526903b92020acb9bae9ceb5adffd9838c1441328", size = 2125442, upload-time = "2026-01-08T18:02:17.715Z" }, - { url = "https://files.pythonhosted.org/packages/bb/43/3a16ff0a8c913bb9825379db1bd533c75c57c2d2f31dd9111aa9b53711f4/zstd-1.5.7.3-cp312-cp312-win32.whl", hash = "sha256:cbf48c53461e224ffc2490cfe5120a1ff40d14c84d2b512c6d6d99fc91685cf3", size = 150367, upload-time = "2026-01-08T17:03:40.178Z" }, - { url = "https://files.pythonhosted.org/packages/46/83/b85875d7428e63dfa9247e41d17fac611443c774f7892f8643bd4164a6b2/zstd-1.5.7.3-cp312-cp312-win_amd64.whl", hash = "sha256:943a189910f2fea997462e3e4d7fbf727a06d231ef801ebee557b1c87568981c", size = 167604, upload-time = "2026-01-08T17:03:41.355Z" }, - { url = "https://files.pythonhosted.org/packages/37/42/cf291e26804de2f55500cdac93f5e9fa6267cf315def8aa402529bae3a87/zstd-1.5.7.3-cp312-cp312-win_arm64.whl", hash = "sha256:85c4d508f8109afa7c51c4960626c3325af2cf1e442c6c36ebfea15d04757e3f", size = 157241, upload-time = "2026-01-08T16:47:34.615Z" }, - { url = "https://files.pythonhosted.org/packages/04/b8/d13d584867d5eb1bc607877a870858e02a256d4706a4274e475413a000aa/zstd-1.5.7.3-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:76c49ea969bc08389ea59155cea7c5dea224522ffc62f443f3c0a915f5fd184d", size = 260025, upload-time = "2026-01-08T16:57:45.739Z" }, - { url = "https://files.pythonhosted.org/packages/16/a1/1e5faf75bedfd2bfccfb83e18736b115bed6e348504bd21800cd8f30dcea/zstd-1.5.7.3-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:6b1a638ff3dfce8f4cb1203c662fb5606dd99b4a62c5ddc4c406d2d1326bcfdd", size = 221038, upload-time = "2026-01-08T17:16:32.005Z" }, - { url = "https://files.pythonhosted.org/packages/b7/2c/0fe74d8b2029eef8000bc71aac5b3e5b55d00581238711cf627814183ea3/zstd-1.5.7.3-pp311-pypy311_pp73-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:5e96a5cb100a0edc162935227f2d9784b1031ce4a8a83e96e66eae2673c10143", size = 326792, upload-time = "2026-01-08T16:57:35.631Z" }, - { url = "https://files.pythonhosted.org/packages/96/e0/2c7f081f3524f872128ff31bea2acb6b21cb1dacccef920eb6a1a77a87c6/zstd-1.5.7.3-pp311-pypy311_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1bda0bbf3a9553720cd33f1f85940a259656c7ffba4be717ff82b7f062052188", size = 322283, upload-time = "2026-01-08T16:57:36.759Z" }, - { url = "https://files.pythonhosted.org/packages/c9/a7/3bebfcc18d66b90bc7b506a61b2ff4af5ee1b0b16e784ea644afa06241c5/zstd-1.5.7.3-pp311-pypy311_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ac36e4022422f6e49b3f07bdbb8a964fd348223d3dc9c82ad5398a4f0432a719", size = 311553, upload-time = "2026-01-08T16:57:38.465Z" }, - { url = "https://files.pythonhosted.org/packages/41/75/8a791cae2c98e5e44a158e15db50d21b7ec0b37aeaffa68d151bc8ffb6d6/zstd-1.5.7.3-pp311-pypy311_pp73-manylinux_2_14_x86_64.whl", hash = "sha256:fa4d760a220541b18ce732a3a2cf7547ea05afc76d05b3b39edebfeb721f6079", size = 317071, upload-time = "2026-01-08T16:36:07.47Z" }, - { url = "https://files.pythonhosted.org/packages/2f/25/b6624e6b08d515242154436c9d06fb20b790d300ac82e84f3c4c133e25e1/zstd-1.5.7.3-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:a69e60146bf8aaa6a0e6c9a94a7c5f3133d68091e2e5c5a3c5ababf71fd5ec7a", size = 167654, upload-time = "2026-01-08T17:00:56.667Z" }, + { url = "https://files.pythonhosted.org/packages/43/2a/0885f6f1921ec1ef4a8f8ab29ab0a335cc867abe4c7aaa4e5031435a32a5/zstd-1.5.7.2-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:f799c1e9900ad77e7a3d994b9b5146d7cfd1cbd1b61c3db53a697bf21ffcc57b", size = 269702, upload-time = "2025-06-23T12:50:11.695Z" }, + { url = "https://files.pythonhosted.org/packages/05/e6/629cf6b77e47fc7149f5724fb4853c48edcdeb10d8c64e391d7026cb10e1/zstd-1.5.7.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:1ff4c667f29101566a7b71f06bbd677a63192818396003354131f586383db042", size = 228145, upload-time = "2025-06-23T12:50:10.411Z" }, + { url = "https://files.pythonhosted.org/packages/c4/b8/9ddefd4670bfe9328ca6657ad335eb8d9c657466247e234a579818b6b0b9/zstd-1.5.7.2-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:8526a32fa9f67b07fd09e62474e345f8ca1daf3e37a41137643d45bd1bc90773", size = 1536530, upload-time = "2025-06-23T13:51:38.853Z" }, + { url = "https://files.pythonhosted.org/packages/d1/6a/1bb836c18760dc1e28ca7a9706016e482ebdea633b980d8505dbb65e18f8/zstd-1.5.7.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:2cec2472760d48a7a3445beaba509d3f7850e200fed65db15a1a66e315baec6a", size = 1616141, upload-time = "2025-06-23T13:51:34.152Z" }, + { url = "https://files.pythonhosted.org/packages/b5/7a/bb6c6e2cb2a066e347dc27d45d5205058b69d6c8b8d4ae2ee7d6b91c64a5/zstd-1.5.7.2-cp311-cp311-manylinux_2_4_i686.whl", hash = "sha256:a200c479ee1bb661bc45518e016a1fdc215a1d8f7e4bf6c7de0af254976cfdf6", size = 322188, upload-time = "2025-06-23T13:01:48.704Z" }, + { url = "https://files.pythonhosted.org/packages/5a/4f/cf0669c8a89fdcc91814bf92bd05cc363d5d12a79b656418c0add6f2d266/zstd-1.5.7.2-cp311-cp311-manylinux_2_4_x86_64.whl", hash = "sha256:f5d159e57a13147aa8293c0f14803a75e9039fd8afdf6cf1c8c2289fb4d2333a", size = 302736, upload-time = "2025-06-23T13:05:33.649Z" }, + { url = "https://files.pythonhosted.org/packages/be/bc/e5f8b7f61826323e39e099db1eb5c0e09b18315df1b1ff778f7ae9aadcac/zstd-1.5.7.2-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_24_i686.whl", hash = "sha256:7206934a2bd390080e972a1fed5a897e184dfd71dbb54e978dc11c6b295e1806", size = 1522687, upload-time = "2025-06-23T13:51:35.494Z" }, + { url = "https://files.pythonhosted.org/packages/d5/8c/7660a949a020ac9d02b3166a25dd1c12144572d77b11ae92a31d341016da/zstd-1.5.7.2-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:7e0027b20f296d1c9a8e85b8436834cf46560240a29d623aa8eaa8911832eb58", size = 2098794, upload-time = "2025-06-23T13:51:37.219Z" }, + { url = "https://files.pythonhosted.org/packages/bc/b2/730c811a78d670104d40c7f08cc8092577cdff870cba42b3158f20fceb57/zstd-1.5.7.2-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:d6b17e5581dd1a13437079bd62838d2635db8eb8aca9c0e9251faa5d4d40a6d7", size = 2112266, upload-time = "2025-06-23T13:51:31.258Z" }, + { url = "https://files.pythonhosted.org/packages/44/74/2c16e1632094db36c8920d4c13b8e2e843024d548ae26888c2d22af6a676/zstd-1.5.7.2-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:b13285c99cc710f60dd270785ec75233018870a1831f5655d862745470a0ca29", size = 2109465, upload-time = "2025-06-23T13:51:32.884Z" }, + { url = "https://files.pythonhosted.org/packages/58/6e/b9c9a834769d96cab2122da1be8c8c700d3f76be796d2b7516e85d2eca0e/zstd-1.5.7.2-cp311-cp311-win32.whl", hash = "sha256:cdb5ec80da299f63f8aeccec0bff3247e96252d4c8442876363ff1b438d8049b", size = 149448, upload-time = "2025-06-23T13:06:21.144Z" }, + { url = "https://files.pythonhosted.org/packages/47/b7/fc22ad6292a32d7676ab815de3a23573beac3679e8abd9914288d1496ceb/zstd-1.5.7.2-cp311-cp311-win_amd64.whl", hash = "sha256:4f6861c8edceb25fda37cdaf422fc5f15dcc88ced37c6a5b3c9011eda51aa218", size = 166592, upload-time = "2025-06-23T13:06:22.126Z" }, + { url = "https://files.pythonhosted.org/packages/45/14/096bb77f3e5ef525b452cd6294da33de7f8a8c9647ba78293378fbb0a7ce/zstd-1.5.7.2-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:d2ebe3e60dbace52525fa7aa604479e231dc3e4fcc76d0b4c54d8abce5e58734", size = 269408, upload-time = "2025-06-23T13:11:46.492Z" }, + { url = "https://files.pythonhosted.org/packages/08/b8/2bc2590a34c733ea0570f366e6ad7d889d05c7825bd3ccab01f36ece71c6/zstd-1.5.7.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ef201b6f7d3a6751d85cc52f9e6198d4d870e83d490172016b64a6dd654a9583", size = 228188, upload-time = "2025-06-23T13:11:47.539Z" }, + { url = "https://files.pythonhosted.org/packages/b7/80/6252de3a70cfd7767718ad476893f1c7dc129f942cc7ed0322e3137c03d9/zstd-1.5.7.2-cp312-cp312-manylinux_2_14_x86_64.whl", hash = "sha256:ac7bdfedda51b1fcdcf0ab69267d01256fc97ddf666ce894fde0fae9f3630eac", size = 302720, upload-time = "2025-06-23T12:40:11.522Z" }, + { url = "https://files.pythonhosted.org/packages/af/b6/af908387814b99172d3aea6aeb24b19583aadfa45f6021e5e2a0d6d8e99a/zstd-1.5.7.2-cp312-cp312-manylinux_2_4_i686.whl", hash = "sha256:b835405cc4080b378e45029f2fe500e408d1eaedfba7dd7402aba27af16955f9", size = 322237, upload-time = "2025-06-23T13:17:35.482Z" }, + { url = "https://files.pythonhosted.org/packages/ed/d7/ab9142e002a7eaa451cb4bb37a74c390c489ba8ae75ade543840496eda04/zstd-1.5.7.2-cp312-cp312-win32.whl", hash = "sha256:e4cf97bb97ed6dbb62d139d68fd42fa1af51fd26fd178c501f7b62040e897c50", size = 149453, upload-time = "2025-06-23T13:13:02.786Z" }, + { url = "https://files.pythonhosted.org/packages/3e/c7/c182ea7bc283f591e3f3c5f0f239e7a92c9bc1f626642ae2c4dfbe51d6f2/zstd-1.5.7.2-cp312-cp312-win_amd64.whl", hash = "sha256:55e2edc4560a5cf8ee9908595e90a15b1f47536ea9aad4b2889f0e6165890a38", size = 166628, upload-time = "2025-06-23T13:13:03.745Z" }, + { url = "https://files.pythonhosted.org/packages/cd/c9/a6495a7bf168a78f0a0c01d61d830ebfb401315a64fd1ae8d725c458114c/zstd-1.5.7.2-pp311-pypy311_pp73-manylinux_2_14_x86_64.whl", hash = "sha256:5fb2ff5718fe89181223c23ce7308bd0b4a427239379e2566294da805d8df68a", size = 315542, upload-time = "2025-06-23T12:39:27.598Z" }, ] diff --git a/docs/changelog.mdx b/docs/changelog.mdx index 2233ee1077..bbdcba6462 100644 --- a/docs/changelog.mdx +++ b/docs/changelog.mdx @@ -4,6 +4,117 @@ description: "New features and improvements in each Prowler release" rss: true --- + + ### πŸ€– Lighthouse AI β€” Finding Skills + + + This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing). + + + Lighthouse AI now embeds a Skills menu on every finding, answering the questions an analyst actually asks. **Contextual Fix** produces the fix for the finding, **Triage Decision** judges whether it is real and closes it out when it is not, and **Systemic Scope** determines whether the problem is a one-off or everywhere. A free-form "Ask Lighthouse anything" prompt sits in the same menu, and each run shows its progress and offers follow-up actions such as creating a Jira issue or muting the finding. + + ![Lighthouse AI Skills menu on a finding resource](/images/changelog/v5.39.0-lighthouse-finding-skills.png) + + Read more in the [Lighthouse AI documentation](https://docs.prowler.com/getting-started/products/prowler-cloud-lighthouse). + + ### ☁️ Azure Management Group Onboarding + + + This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing). + + + Azure subscriptions no longer onboard one at a time. Choose "Add Multiple Subscriptions With Azure Management Group" in the add-provider wizard, enter the Microsoft Entra tenant ID, and authenticate once with a single tenant-wide service principal: Prowler discovers the entire management-group hierarchy under the tenant root, lets you select the subscriptions to onboard, and creates their providers with the management-group structure preserved. Azure now matches the one-step onboarding that AWS Organizations and GCP organizations already have. + + ![Azure onboarding method selector with the Management Group option](/images/changelog/v5.39.0-azure-mg-selector.png) + + Read more in the [Azure Management Groups documentation](https://docs.prowler.com/user-guide/tutorials/prowler-cloud-azure-management-groups). + + ### βœ… Findings Triage β€” Verify MANUAL Findings as PASS + + + This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing). + + + Checks that require human judgment report `MANUAL` findings. For these findings, and only for them, the triage status selector now offers **Resolved**: choosing it asks for the required written evidence and verifies the finding as passing. The finding then reports an effective `PASS` while preserving the raw `MANUAL` scan result, across findings, finding groups, compliance reports, and scans, with the attestation's author, evidence, and validity always visible. Attestations expire automatically after 90 days, or as soon as a new scan reports a real failure, returning the finding to the review queue. + + ![Triage status selector offering Resolved on a MANUAL finding](/images/changelog/v5.39.0-manual-pass-selector.png) + + ![Manual Pass details showing evidence, author, and validity](/images/changelog/v5.39.0-manual-pass-details.png) + + Read more in the [Findings Triage documentation](https://docs.prowler.com/user-guide/tutorials/prowler-app-findings-triage#verify-a-manual-finding-as-pass). + + ### ☁️ Prowler Cloud MCP β€” Organizations Management and Grouped Jira Dispatch + + + This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing). + + + The hosted Prowler Cloud MCP server adds eight organization tools, so an agent can onboard and manage entire cloud organizations end to end: create the organization, discover its accounts, subscriptions, and projects, apply the selection, and manage the resulting providers. The tools cover AWS Organizations, GCP organizations, and Azure tenant root management groups, and they are available to Lighthouse AI. + + `prowler_send_findings_to_jira` also gains Cloud-only dispatch capabilities: select failed findings by check IDs against the latest completed scan, and send them in grouped mode, one Jira work item per check listing up to 50 affected resources, with per-group error reporting. + + Read more in the [Prowler MCP tools documentation](https://docs.prowler.com/getting-started/basic-usage/prowler-mcp-tools) and its [Jira operations reference](https://docs.prowler.com/getting-started/basic-usage/prowler-mcp-tools#jira-operations). + + ### πŸ•ΈοΈ Attack Paths β€” Grouped Graph with Outcome Destinations + + + This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing). + + + The Attack Paths graph now reads from source to destination. Resources of the same class collapse into a single expandable node with a count, clicking reveals its members, and every path terminates in an explicit outcome node naming the destination impact: code execution, privilege escalation, public exposure, or resource inventory. The per-account hub node is gone, and the clicked resource stays highlighted while its findings are expanded. + + ![Attack Paths graph from the Internet to a public exposure outcome node](/images/changelog/v5.39.0-attack-paths-graph.png) + + Explore the full Attack Paths query catalog at [Prowler Hub](https://hub.prowler.com/attack-paths). + + Read more in the [Attack Paths documentation](https://docs.prowler.com/user-guide/tutorials/prowler-app-attack-paths). + + ### πŸ“š New Compliance Framework β€” CMMC 2.0 + + The Cybersecurity Maturity Model Certification (CMMC) is the certification the US Department of Defense requires from contractors and suppliers that handle federal contract data. Prowler now includes CMMC 2.0 as a universal framework with all 149 requirements defined by the CMMC Program rule (32 CFR Part 170), organized in its three levels: + + - **Level 1 (Foundational):** 15 requirements for the basic safeguarding of Federal Contract Information, from FAR 52.204-21. + - **Level 2 (Advanced):** 110 requirements from NIST SP 800-171 Rev 2, protecting Controlled Unclassified Information. + - **Level 3 (Expert):** 24 enhanced requirements from NIST SP 800-172 for the most sensitive programs. + + Requirements map to Prowler checks across AWS, Azure, GCP, Alibaba Cloud, Oracle Cloud, and Microsoft 365, so one framework reports the compliance posture of the whole estate. + + Read more in the [Compliance documentation](https://docs.prowler.com/user-guide/compliance/tutorials/compliance). + + ### πŸ” Checks + + #### Microsoft 365 + + Twenty new Entra ID checks expand the coverage of CIS Microsoft 365 Foundations Benchmark v7.0.0: + + - **Password protection:** custom banned password list, on-premises enforcement, and lockout threshold and duration. + - **Default user permissions:** security group and Microsoft 365 group creation restricted, and guest invitations limited to allowed domains. + - **Conditional Access:** high and medium sign-in risk blocked, authentication transfer blocked, untrusted locations blocked, trusted named locations defined, sign-in frequency enforced, and token protection enforced. + - **Sessions and authentication methods:** idle session timeout configured, email one-time passcodes disabled, and Microsoft Authenticator context shown. + - **PIM and access reviews:** approval required to activate the Global Administrator and Privileged Role Administrator roles, and access reviews configured for guest users and privileged roles. + + Explore all Microsoft 365 checks at [Prowler Hub](https://hub.prowler.com/check?provider=m365). + + #### AWS + + Two new checks detect hardcoded secrets: + + - `batch_job_definition_no_secrets` scans Batch job definition environment variables and command parameters. Thanks to @praneetrajv! + - `awslambda_layer_no_secrets_in_content` scans Lambda layer package content. Thanks to @ganiganesh25! + + Explore all AWS checks at [Prowler Hub](https://hub.prowler.com/check?provider=aws). + + ### πŸ™Œ External Contributors + + Thank you to our community contributors for this release! + + - @praneetrajv: AWS `batch_job_definition_no_secrets` check ([#12117](https://github.com/prowler-cloud/prowler/pull/12117)) + - @ganiganesh25: AWS `awslambda_layer_no_secrets_in_content` check ([#12233](https://github.com/prowler-cloud/prowler/pull/12233)) + - @andoniaf: GitHub `organization_repository_creation_limited` now reports low severity when repository creation is limited to private or internal visibility ([#12164](https://github.com/prowler-cloud/prowler/pull/12164)) + + See the [full release notes on GitHub](https://github.com/prowler-cloud/prowler/releases/tag/5.39.0) for the complete list of changes. + + ### πŸ“Œ Compliance Watchlist diff --git a/docs/developer-guide/checks.mdx b/docs/developer-guide/checks.mdx index dca22cb0cd..93facfaadf 100644 --- a/docs/developer-guide/checks.mdx +++ b/docs/developer-guide/checks.mdx @@ -224,9 +224,9 @@ Each check **must** populate the report with a unique identifier for the audited - `resource_name`: Description of the configuration (e.g., "SharePoint Settings") - GitHub - Resource ID β€” `report.resource_id`. - - The ID of the Github resource. This is a system-generated integer that uniquely identifies the resource within the Github platform. + - The ID of the GitHub resource. This is a system-generated integer that uniquely identifies the resource within the GitHub platform. - Resource Name β€” `report.resource_name`. - - The name of the Github resource. In the case of a repository, this is just the repository name. For full repository names use the resource `full_name`. + - The name of the GitHub resource. In the case of a repository, this is just the repository name. For full repository names use the resource `full_name`. ### Configurable Checks in Prowler diff --git a/docs/developer-guide/provider.mdx b/docs/developer-guide/provider.mdx index be709a12a2..1a570ccb68 100644 --- a/docs/developer-guide/provider.mdx +++ b/docs/developer-guide/provider.mdx @@ -107,7 +107,7 @@ Once you have decided the provider you want or need to add to Prowler, the next - **SDK Providers**: Low complexity. You have mature examples like AWS, Azure, GCP, Kubernetes, etc. that you can leverage to implement your provider. - **API Providers**: Medium complexity. You need to implement the authentication and session management, and the API calls to the provider. You now have NHN and MongoDB Atlas as example to follow. - **Tool/Wrapper Providers**: High complexity. You need to implement the argument/output mapping to the provider and handle problems that the tool/wrapper may have. You now have IAC and the PowerShell wrapper as example to follow. -- **Hybrid Providers**: High complexity. You need to "customize" your provider, mixing the other types of providers in order to achieve the desired result. You have M365 (msgraph SDK + PowerShell wrapper) and Github (PyGithub SDK + graphql API requests) as examples. +- **Hybrid Providers**: High complexity. You need to "customize" your provider, mixing the other types of providers in order to achieve the desired result. You have M365 (msgraph SDK + PowerShell wrapper) and GitHub (PyGithub SDK + graphql API requests) as examples. ### Determining Regional vs Non-Regional Architecture @@ -814,7 +814,7 @@ class YourProviderMutelist(Mutelist): Region management is essential for cloud providers that operate across multiple geographic locations. This component handles region validation and provides region-specific functionality. -Regions are optional, only if the provider has regions, for example Github does not have regions, but AWS does. +Regions are optional, only if the provider has regions, for example GitHub does not have regions, but AWS does. **File:** `prowler/providers//lib/regions/_regions.py` @@ -1773,7 +1773,7 @@ The implementation of the mutelist is the same as the [SDK providers](#step-5-im Region management is essential for cloud providers that operate across multiple geographic locations. This component handles region validation and provides region-specific functionality. -Regions are optional, only if the provider has regions, for example Github does not have regions, but AWS does. +Regions are optional, only if the provider has regions, for example GitHub does not have regions, but AWS does. **File:** `prowler/providers//lib/regions/_regions.py` diff --git a/docs/getting-started/basic-usage/prowler-mcp-tools.mdx b/docs/getting-started/basic-usage/prowler-mcp-tools.mdx index 0a7ae1f271..24cb2f4b2a 100644 --- a/docs/getting-started/basic-usage/prowler-mcp-tools.mdx +++ b/docs/getting-started/basic-usage/prowler-mcp-tools.mdx @@ -11,10 +11,10 @@ Complete reference guide for all tools available in the Prowler MCP Server. Tool | Prowler Hub | 10 tools | No | Cloud and Local MCP Server | | Prowler Documentation | 2 tools | No | Cloud and Local MCP Server | | Prowler Cloud, Private Cloud & Local Server | 49 tools | Yes | Cloud and Local MCP Server | -| Prowler Cloud management | 32 tools | Yes | Cloud MCP Server only | +| Prowler Cloud management | 40 tools | Yes | Cloud MCP Server only | -48 of the 49 Prowler tools are available on both servers. `prowler_schedule_daily_scan` is the exception: it is Local-only, because the Cloud MCP Server supersedes it with the `prowler_cloud_*` [Scan Scheduling](#scan-scheduling) tools. +48 of the 49 Prowler tools are available on both servers. `prowler_schedule_daily_scan` is the exception: it is Local-only, because the Cloud MCP Server supersedes it with the `prowler_cloud_*` [Scan Scheduling](#scan-scheduling) tools. `prowler_send_findings_to_jira` is exposed by both servers but accepts two [extra parameters](#jira-operations) on the Cloud MCP Server. ## Tool Naming Convention @@ -124,7 +124,20 @@ Tools for managing where Prowler sends its results: Amazon S3 buckets, AWS Secur #### Jira Operations - **`prowler_get_jira_issue_types`** - List the issue types available in a Jira project, fetched live from Jira -- **`prowler_send_findings_to_jira`** - Create one Jira work item per finding, with its severity, resource, risk, and remediation steps +- **`prowler_send_findings_to_jira`** - Create Jira work items from findings, each carrying the check title, severity, status, provider, region, resource, risk, and remediation steps. Select the findings either by ID with `finding_ids`, or β€” on Prowler Cloud only β€” by check with `check_ids`, and choose between one work item per finding or one per check with `dispatch_mode` + + +`check_ids` and `dispatch_mode` are **Prowler Cloud only**: + +- **`check_ids`** - Send the failing findings of a check (for example `s3_bucket_public_access`) without listing their IDs. Prowler resolves them server-side, taking only the failed findings of the latest completed scan of every provider. Get the check IDs from `prowler_list_finding_groups`. Exactly one of `finding_ids` or `check_ids` is required β€” Prowler combines both filters, so sending both would only dispatch their intersection. A Local MCP Server rejects `check_ids` with a client error. +- **`dispatch_mode`** - `individual` (the default) creates one work item per finding. `grouped` creates one work item per check instead, listing up to 50 affected resources and linking back to the finding group in Prowler Cloud, which keeps a noisy check to a single ticket. Grouped dispatch only covers failed, unmuted findings of the latest completed scan of every provider. A Local MCP Server ignores `dispatch_mode` instead of rejecting it, and creates one work item per finding. + +In `grouped` mode the response counters change meaning: `created_count` counts work items (one per check) rather than findings, `failed_count` counts the entries of the new `failed_groups` field, and `failed_groups` details each failure with its reason and the `check_id` whose work item could not be created. + + + +`prowler_send_findings_to_jira` creates real work items that Prowler cannot delete or update afterwards. Only retry the same dispatch when the previous response returned `safe_to_retry: true`, otherwise the work items already created are duplicated. Combining `check_ids` with the default `individual` mode opens one work item per failing resource, which can be hundreds of them β€” use `dispatch_mode="grouped"` to keep it to one per check. + ### Attack Paths Analysis @@ -167,6 +180,23 @@ Manage Prowler Cloud-only features and configuration. **Requires authentication. These tools are available **only on the Cloud MCP Server** (`https://mcp.prowler.com/mcp`). A Local MCP Server does not expose them, because the features they manage exist only in Prowler Cloud. +### Organizations + +Tools for onboarding a cloud provider organization as a whole β€” an AWS Organization, an Azure tenant with its management groups, or a GCP organization with its folders. An organization holds org-level credentials, discovers the real account, subscription, or project structure in the cloud, and turns a selection from that discovery into Prowler providers linked into a hierarchy of nodes. Every tool that changes something β€” creating, updating, deleting, discovering, applying a discovery, or adjusting provider membership β€” requires the **Manage Providers** permission; listing and reading do not. + + +Use these tools for the whole organization. To register providers one by one, use the [Provider Management](#provider-management) tools instead; to build arbitrary RBAC buckets of providers, use provider groups. + + +- **`prowler_cloud_list_organizations`** - Browse the registered organizations with lightweight data (name, type, external id, provider and node counts), filtered by type or cloud-side external id +- **`prowler_cloud_get_organization`** - Get one organization in full: attributes, linked providers, credentials status, latest discovery, and the OU / management group / folder hierarchy. Set `include_hierarchy` to `false` to skip the tree on large organizations +- **`prowler_cloud_create_organization`** - Register an organization, optionally storing its org-level credentials in the same call. Idempotent: an organization with the same type and external id is reused and its credentials rotated, reported as `created: false` +- **`prowler_cloud_update_organization`** - Rename an organization, replace its metadata, and/or create or rotate its org-level credentials. `org_type` and `external_id` are immutable after creation +- **`prowler_cloud_delete_organization`** - Delete an organization, its entire hierarchy, and every linked provider +- **`prowler_cloud_discover_organization`** - Enumerate the real cloud structure: AWS accounts and OUs, Azure subscriptions and management groups, or GCP projects and folders. Each item comes back with its registration state so you can choose what to onboard +- **`prowler_cloud_apply_organization_discovery`** - Turn a discovery selection into Prowler providers and hierarchy nodes +- **`prowler_cloud_manage_organization_providers`** - Manually `add`, `replace`, or `remove` the providers linked to an organization or to one of its hierarchy nodes. Providers are detached, never deleted + ### Scan Configurations Tools for managing reusable scan configurations β€” per-provider check and compliance selections β€” and attaching them to providers. Providers without a configuration attached use the default. diff --git a/docs/getting-started/installation/prowler-app.mdx b/docs/getting-started/installation/prowler-app.mdx index 529d544fa6..b28575a47a 100644 --- a/docs/getting-started/installation/prowler-app.mdx +++ b/docs/getting-started/installation/prowler-app.mdx @@ -128,12 +128,12 @@ To update the environment file: Edit the `.env` file and change version values: ```env -PROWLER_UI_VERSION="5.38.0" -PROWLER_API_VERSION="5.38.0" +PROWLER_UI_VERSION="5.39.0" +PROWLER_API_VERSION="5.39.0" ``` - You can find the latest versions of Prowler Local Server in the [Releases Github section](https://github.com/prowler-cloud/prowler/releases) or in the [Container Versions](#container-versions) section of this documentation. + You can find the latest versions of Prowler Local Server in the [Releases GitHub section](https://github.com/prowler-cloud/prowler/releases) or in the [Container Versions](#container-versions) section of this documentation. diff --git a/docs/images/changelog/v5.39.0-attack-paths-graph.png b/docs/images/changelog/v5.39.0-attack-paths-graph.png new file mode 100644 index 0000000000..68cd44278f Binary files /dev/null and b/docs/images/changelog/v5.39.0-attack-paths-graph.png differ diff --git a/docs/images/changelog/v5.39.0-azure-mg-selector.png b/docs/images/changelog/v5.39.0-azure-mg-selector.png new file mode 100644 index 0000000000..2badc72932 Binary files /dev/null and b/docs/images/changelog/v5.39.0-azure-mg-selector.png differ diff --git a/docs/images/changelog/v5.39.0-lighthouse-finding-skills.png b/docs/images/changelog/v5.39.0-lighthouse-finding-skills.png new file mode 100644 index 0000000000..06775297eb Binary files /dev/null and b/docs/images/changelog/v5.39.0-lighthouse-finding-skills.png differ diff --git a/docs/images/changelog/v5.39.0-manual-pass-details.png b/docs/images/changelog/v5.39.0-manual-pass-details.png new file mode 100644 index 0000000000..1914cc71e3 Binary files /dev/null and b/docs/images/changelog/v5.39.0-manual-pass-details.png differ diff --git a/docs/images/changelog/v5.39.0-manual-pass-selector.png b/docs/images/changelog/v5.39.0-manual-pass-selector.png new file mode 100644 index 0000000000..f14b05f877 Binary files /dev/null and b/docs/images/changelog/v5.39.0-manual-pass-selector.png differ diff --git a/docs/images/prowler-app/attack-paths/fullscreen-mode.png b/docs/images/prowler-app/attack-paths/fullscreen-mode.png index 190d973638..ff88c2b6de 100644 Binary files a/docs/images/prowler-app/attack-paths/fullscreen-mode.png and b/docs/images/prowler-app/attack-paths/fullscreen-mode.png differ diff --git a/docs/images/prowler-app/attack-paths/graph-filtered.png b/docs/images/prowler-app/attack-paths/graph-filtered.png index 3eddf04473..59fff5b50f 100644 Binary files a/docs/images/prowler-app/attack-paths/graph-filtered.png and b/docs/images/prowler-app/attack-paths/graph-filtered.png differ diff --git a/docs/images/prowler-app/attack-paths/graph-visualization-expanded.png b/docs/images/prowler-app/attack-paths/graph-visualization-expanded.png new file mode 100644 index 0000000000..a870df7519 Binary files /dev/null and b/docs/images/prowler-app/attack-paths/graph-visualization-expanded.png differ diff --git a/docs/images/prowler-app/attack-paths/graph-visualization.png b/docs/images/prowler-app/attack-paths/graph-visualization.png index d7f2a747eb..af1371c0d8 100644 Binary files a/docs/images/prowler-app/attack-paths/graph-visualization.png and b/docs/images/prowler-app/attack-paths/graph-visualization.png differ diff --git a/docs/images/prowler-app/attack-paths/navigation.png b/docs/images/prowler-app/attack-paths/navigation.png index 0526e05e5c..560a2d10a1 100644 Binary files a/docs/images/prowler-app/attack-paths/navigation.png and b/docs/images/prowler-app/attack-paths/navigation.png differ diff --git a/docs/images/prowler-app/findings-triage/findings-triage-manual-pass-details.png b/docs/images/prowler-app/findings-triage/findings-triage-manual-pass-details.png new file mode 100644 index 0000000000..1914cc71e3 Binary files /dev/null and b/docs/images/prowler-app/findings-triage/findings-triage-manual-pass-details.png differ diff --git a/docs/images/prowler-app/findings-triage/findings-triage-manual-pass-note.png b/docs/images/prowler-app/findings-triage/findings-triage-manual-pass-note.png new file mode 100644 index 0000000000..d447478dbe Binary files /dev/null and b/docs/images/prowler-app/findings-triage/findings-triage-manual-pass-note.png differ diff --git a/docs/images/prowler-app/findings-triage/findings-triage-manual-pass-selector.png b/docs/images/prowler-app/findings-triage/findings-triage-manual-pass-selector.png new file mode 100644 index 0000000000..f14b05f877 Binary files /dev/null and b/docs/images/prowler-app/findings-triage/findings-triage-manual-pass-selector.png differ diff --git a/docs/user-guide/cli/tutorials/configuration_file.mdx b/docs/user-guide/cli/tutorials/configuration_file.mdx index 2b5ef617cf..90de1dbdbc 100644 --- a/docs/user-guide/cli/tutorials/configuration_file.mdx +++ b/docs/user-guide/cli/tutorials/configuration_file.mdx @@ -495,7 +495,7 @@ aws: # AWS CloudTrail Configuration # aws.cloudtrail_threat_detection_privilege_escalation - threat_detection_privilege_escalation_threshold: 0.2 #Β Percentage of actions found to decide if it is an privilege_escalation attack event, by default is 0.2 (20%) + threat_detection_privilege_escalation_threshold: 0.2 #Β Percentage of actions found to decide if it is a privilege_escalation attack event, by default is 0.2 (20%) threat_detection_privilege_escalation_minutes: 1440 # Past minutes to search from now for privilege_escalation attacks, by default is 1440 minutes (24 hours) threat_detection_privilege_escalation_actions: [ diff --git a/docs/user-guide/tutorials/prowler-app-attack-paths.mdx b/docs/user-guide/tutorials/prowler-app-attack-paths.mdx index 0242c817f5..d4e60d6cf2 100644 --- a/docs/user-guide/tutorials/prowler-app-attack-paths.mdx +++ b/docs/user-guide/tutorials/prowler-app-attack-paths.mdx @@ -16,26 +16,24 @@ Attack Paths analyzes relationships between cloud resources, permissions, and se By mapping these relationships as a graph, Attack Paths reveals risks that individual security checks cannot detect on their own, such as an IAM role that can escalate its own permissions, or a chain of policies that grants unintended access to sensitive resources. - Attack Paths is currently available for **AWS** providers. Support for - additional providers is planned. + Attack Paths is currently available for **AWS** providers. Support for additional providers is planned. ## Prerequisites The following prerequisites are required for Attack Paths: -- **An AWS provider is configured** with valid credentials in Prowler Cloud. For setup instructions, see [Getting Started with AWS](/user-guide/providers/aws/getting-started-aws). +- **An AWS provider is configured** with valid credentials. For setup instructions, see [Getting Started with AWS](/user-guide/providers/aws/getting-started-aws). - **At least one scan has completed** on the configured AWS provider and produced graph data. Attack Paths scans run automatically alongside regular security scans, no separate configuration is required. ## How Attack Paths Scans Work -Attack Paths scans are generated automatically when a security scan runs on an AWS provider. Each completed scan produces graph data that maps relationships between IAM principals, policies, trust configurations, and other resources. +Attack Paths scans are generated automatically when a security scan runs on an AWS provider. When a scan produces graph data, it maps relationships between IAM principals, policies, trust configurations, and other resources. A scan can complete without producing graph data. -Once the scan finishes and graph data is ready, the scan appears in the Attack Paths scan table with a **Completed** status and a check in the **Graph** column. Scans that are still queued or running remain visible, but they cannot be selected until graph data is ready. +When graph data is ready, the scan appears in the Attack Paths scan table with a check in the **Graph** column and can be selected regardless of its current status. Scans without graph data remain visible but cannot be selected. If a new scan cycle starts after graph data is available, the previous cycle remains available while the new scan runs. - Since Prowler scans all configured providers every **24 hours** by default, - Attack Paths data stays up to date automatically. + Prowler Cloud and Prowler Private Cloud scan configured providers every **24 hours** by default, so Attack Paths data stays up to date automatically. ## Accessing Attack Paths @@ -66,7 +64,7 @@ The scans table displays all Attack Paths scans with the following columns: - **Graph:** Whether Attack Paths graph data is available for the scan. - **Duration:** Total scan time. -To select a scan for analysis, click the radio button on any row with a **Completed** status and available graph data. +To select a scan for analysis, click any row with a check in the **Graph** column. A row can remain selectable while a new scan cycle runs because Attack Paths keeps the graph from the previous completed cycle available. - Only scans with graph data can be selected. Disabled rows include a tooltip - that explains why the graph is not available yet. + Only scans with graph data can be selected. Disabled rows include a tooltip that explains why the graph is not available yet. ## Choosing a Query @@ -97,9 +94,7 @@ To choose a query, click the dropdown and select from the available options. Eac Once selected, a description panel appears below the dropdown with more context about the query. - In Prowler Cloud and Prowler Private Cloud, the query selector hides queries - confirmed empty for the selected scan, so only queries that return data remain - visible. See [Active Queries](/user-guide/tutorials/prowler-app-attack-paths-active-queries). + In Prowler Cloud and Prowler Private Cloud, the query selector hides built-in queries confirmed empty for the selected scan. Built-in queries without a confirmed empty result and the **Custom openCypher query** remain visible. See [Active Queries](/user-guide/tutorials/prowler-app-attack-paths-active-queries). ## Configuring Query Parameters @@ -120,7 +115,7 @@ For example, **Internet-Exposed EC2 with Sensitive S3 Access** uses **Tag key** ## Writing Custom openCypher Queries -In addition to the built-in queries, Attack Paths supports custom read-only [openCypher](https://opencypher.org/) queries. Custom queries provide direct access to the underlying graph so security teams can answer ad-hoc questions, prototype detections, or extend coverage beyond the built-in catalogue. +In addition to the built-in queries, Attack Paths supports custom read-only [openCypher](https://opencypher.org/) queries. Custom queries provide direct access to the underlying graph so security teams can answer ad-hoc questions, prototype detections, or extend coverage beyond the built-in catalog. To write a custom query, select **Custom openCypher query** from the query dropdown. A code editor with syntax highlighting and line numbers appears, ready to receive the query. @@ -192,11 +187,7 @@ Custom queries traverse the same Cartography graph the built-in queries use. Nod For the complete reference, including the graph model, list-typed and JSON-encoded properties, performance guidance, and openCypher compatibility rules, see [Attack Paths Queries](/developer-guide/attack-paths-queries) in the Developer Guide. - AI assistants connected through Prowler MCP Server can fetch the exact - Cartography schema for the active scan via the - `prowler_get_attack_paths_cartography_schema` tool. This guarantees that - generated queries match the schema version pinned by the running Prowler - release. + AI assistants connected through Prowler MCP Server can fetch the exact Cartography schema for the active scan via the `prowler_get_attack_paths_cartography_schema` tool. This guarantees that generated queries match the schema version pinned by the running Prowler release. ## Executing a Query @@ -221,12 +212,22 @@ If the query returns no results, an informational message appears. Common reason After a successful execution, the graph visualization renders below the query builder. The graph maps relationships between cloud resources, IAM entities, public exposure, and security findings. +### Grouped Graphs and Query Outcomes + + + +Prowler Cloud and Prowler Private Cloud group resources of the same class and graph level into expandable nodes. Built-in query graphs also end with a query outcome, which states the result that the path can lead to. + +Prowler Local Server keeps the flat graph view, including the provider root. Custom openCypher queries do not have a catalog outcome, so their graphs do not include an outcome node. + ### Node Types -- **Provider root nodes:** Represent the AWS account or provider root for the selected scan. -- **Resource nodes:** Represent cloud resources such as IAM roles, policies, EC2 instances, security groups, and S3 buckets. +- **Grouped resource nodes:** Represent multiple resources of the same class in Prowler Cloud and Prowler Private Cloud. A number in the upper-right corner shows how many resources the node contains. A red outline indicates that one or more resources in the group have findings. +- **Resource nodes:** Represent individual cloud resources such as IAM roles, policies, EC2 instances, security groups, and S3 buckets. A class with one resource remains an individual node. - **Internet nodes:** Represent exposure from the public internet. - **Finding nodes:** Represent Prowler findings linked to resources. Finding colors indicate risk level, such as critical, high, medium, or low. +- **Outcome nodes:** Mark the terminal result of a built-in query in Prowler Cloud and Prowler Private Cloud. The orange node displays outcomes such as **Code execution**, **Privilege escalation**, **Public exposure**, or **Resource inventory**. A dashed ring and the label **Latent outcome** indicate an inventory or another partial outcome. +- **Provider root nodes:** Represent the AWS account or provider root in the Prowler Local Server flat graph. ### Edge Types @@ -234,7 +235,7 @@ After a successful execution, the graph visualization renders below the query bu - **Finding edges:** Dashed relationships between resources and their associated findings. - **Highlighted paths:** Green edges that show the active path when you hover a node or focus a finding. -The standard graph view includes a minimap and a legend below the canvas. The legend shows the provider roots, visible node types, finding risk levels, node states, and edge types present in the current view. +The standard graph view includes a minimap and a legend below the canvas. The legend shows the visible node types, finding risk levels, node states, and edge types present in the current view. Prowler Local Server also displays the provider root in the legend. Attack Paths graph showing an expanded AWS Role group and remaining numbered resource groups + ### Showing Related Findings Resource nodes with related findings are clickable. Click one of these resources to show its finding nodes. Click the resource again to hide them. -The graph automatically fits the selected resource and its related findings when the findings are shown. +The selected resource is highlighted in green while its findings are visible. The graph automatically fits the selected resource and its related findings when the findings are shown. ### Focusing a Finding Path @@ -279,12 +295,12 @@ The toolbar in the top-right corner of the graph provides: - **Zoom in / Zoom out:** Adjust the zoom level - **Fit graph to view:** Reset the view to fit the visible graph -- **Export graph:** Download the current graph as a PNG file +- **Collapse all groups:** Close every expanded resource group. This control appears only when a group is expanded +- **Export graph:** Download the current graph, including its grouped or expanded state and outcome, as a PNG file - **Fullscreen:** Open the graph in a full-size modal - Use **Ctrl + Scroll** (or **Cmd + Scroll** on macOS) to zoom directly within - the graph area. + Use **Ctrl + Scroll** (or **Cmd + Scroll** on macOS) to zoom directly within the graph area. ## Viewing Finding Details diff --git a/docs/user-guide/tutorials/prowler-app-findings-triage.mdx b/docs/user-guide/tutorials/prowler-app-findings-triage.mdx index bbceaef992..408f201645 100644 --- a/docs/user-guide/tutorials/prowler-app-findings-triage.mdx +++ b/docs/user-guide/tutorials/prowler-app-findings-triage.mdx @@ -42,12 +42,12 @@ The status selector includes manual statuses. Prowler also sets automatic status | **Remediating** | Manual | Work is in progress to fix the finding. | | **Risk Accepted** | Manual | The team accepts the risk and wants to mute the finding. | | **False Positive** | Manual | The finding does not apply and should be muted. | -| **Resolved** | Automatic | A finding changed from `FAIL` to `PASS` in a later scan. A passed finding with no saved triage state also appears as **Resolved**. | +| **Resolved** | Automatic / Manual | A finding changed from `FAIL` to `PASS` in a later scan. A passed finding with no saved triage state also appears as **Resolved**. On `MANUAL` findings, select it to verify the finding as passing (see [Verify a MANUAL Finding as Pass](#verify-a-manual-finding-as-pass)). | | **Reopened** | Automatic | A finding changed from `PASS` to `FAIL` in a later scan. | ![Findings Triage Status Selector](/images/prowler-app/findings-triage/findings-triage-status-dropdown.png) -Resolved and Reopened are not manual selector options. +**Reopened** is never a manual selector option. **Resolved** appears in the selector only on `MANUAL` findings, where it starts the [Manual Pass verification](#verify-a-manual-finding-as-pass). These automatic states keep triage tied to the finding UID across scans, even when each scan creates a new finding snapshot. @@ -93,6 +93,39 @@ Triage notes are visible only to the team in the current organization. Each note To remove an existing note, clear the note text and save the change. +## Verify a MANUAL Finding as Pass + + + +Checks that Prowler cannot judge automatically report `MANUAL` findings. When a team verifies such a control outside Prowler, the triage selector on that finding offers **Resolved**: choosing it records a Manual Pass attestation, and the finding reports an effective `PASS` while keeping the raw `MANUAL` scan result. + +![Triage selector offering Resolved on a MANUAL finding](/images/prowler-app/findings-triage/findings-triage-manual-pass-selector.png) + + + + Go to **Findings** and filter by status **Manual**. + + + Expand a Finding Group and click the current status in the **Triage** column of an individual finding. + + + Select **Resolved**. Prowler opens the triage note modal with a required **Manual pass evidence** field. + + + Describe how the control was verified, then click **Save**. The evidence supports up to 500 characters. + + + +![Manual Pass attestation with required evidence](/images/prowler-app/findings-triage/findings-triage-manual-pass-note.png) + +After saving, the finding reports `PASS` in finding tables, finding groups, compliance reports, and scans. While the attestation is active, the triage status is managed automatically and cannot be changed. **View Manual Pass details** shows who verified the finding, the evidence, the attestation time, and its expiration. + +![Manual Pass details showing evidence, author, and validity](/images/prowler-app/findings-triage/findings-triage-manual-pass-details.png) + +### Attestation Expiration + +A Manual Pass attestation is valid for 90 days. It also ends early when a later scan reports a real failure for the finding. In both cases the finding returns to its raw `MANUAL` status for a new review. + ## Mutelist Behavior Findings Triage uses Mutelist when a status means the finding should be muted: @@ -118,7 +151,7 @@ Confirm that the user role has **Manage Scans** permission. Prowler Local Server ### Resolved or Reopened is missing from the selector -This is expected. Prowler sets **Resolved** and **Reopened** automatically from scan result changes. +**Reopened** is always automatic. **Resolved** is set automatically from scan result changes and appears as a selector option only on `MANUAL` findings, where it records a [Manual Pass](#verify-a-manual-finding-as-pass). On findings with any other status, this is expected. ### Risk Accepted or False Positive muted a finding diff --git a/permissions/prowler-additions-policy.json b/permissions/prowler-additions-policy.json index 13aff68168..25ea46b09d 100644 --- a/permissions/prowler-additions-policy.json +++ b/permissions/prowler-additions-policy.json @@ -31,6 +31,8 @@ "ec2:GetInstanceMetadataDefaults", "ecr:Describe*", "ecr:GetRegistryScanningConfiguration", + "ecr:BatchGetImage", + "ecr:GetDownloadUrlForLayer", "elasticfilesystem:DescribeBackupPolicy", "glue:GetConnections", "glue:GetSecurityConfiguration*", @@ -42,6 +44,7 @@ "lightsail:GetRelationalDatabases", "macie2:GetMacieSession", "macie2:GetAutomatedDiscoveryConfiguration", + "rolesanywhere:ListProfiles", "rolesanywhere:ListTagsForResource", "rolesanywhere:ListTrustAnchors", "s3:GetAccountPublicAccessBlock", diff --git a/permissions/templates/azure/bicep/bicepconfig.json b/permissions/templates/azure/bicep/bicepconfig.json deleted file mode 100644 index 05d5a46af3..0000000000 --- a/permissions/templates/azure/bicep/bicepconfig.json +++ /dev/null @@ -1,8 +0,0 @@ -{ - "experimentalFeaturesEnabled": { - "extensibility": true - }, - "extensions": { - "microsoftGraphV1": "br:mcr.microsoft.com/bicep/extensions/microsoftgraph/v1.0:1.0.0" - } -} diff --git a/permissions/templates/cloudformation/prowler-scan-role.yml b/permissions/templates/cloudformation/prowler-scan-role.yml index c9eee71950..d04c8f25d6 100644 --- a/permissions/templates/cloudformation/prowler-scan-role.yml +++ b/permissions/templates/cloudformation/prowler-scan-role.yml @@ -203,6 +203,8 @@ Resources: - "ec2:GetInstanceMetadataDefaults" - "ecr:Describe*" - "ecr:GetRegistryScanningConfiguration" + - "ecr:BatchGetImage" + - "ecr:GetDownloadUrlForLayer" - "elasticfilesystem:DescribeBackupPolicy" - "glue:GetConnections" - "glue:GetSecurityConfiguration*" @@ -213,6 +215,7 @@ Resources: - "lightsail:GetRelationalDatabases" - "macie2:GetMacieSession" - "macie2:GetAutomatedDiscoveryConfiguration" + - "rolesanywhere:ListProfiles" - "rolesanywhere:ListTagsForResource" - "rolesanywhere:ListTrustAnchors" - "s3:GetAccountPublicAccessBlock" @@ -469,6 +472,8 @@ Resources: - "ec2:GetInstanceMetadataDefaults" - "ecr:Describe*" - "ecr:GetRegistryScanningConfiguration" + - "ecr:BatchGetImage" + - "ecr:GetDownloadUrlForLayer" - "elasticfilesystem:DescribeBackupPolicy" - "glue:GetConnections" - "glue:GetSecurityConfiguration*" diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index c019e8d087..076bffb52a 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -4,6 +4,43 @@ All notable changes to the **Prowler SDK** are documented in this file. +## [5.39.1] (Prowler v5.39.1) + +### 🐞 Fixed + +- Bump alibabacloud-tea-openapi to 0.4.6, oci to 2.184.1 and pyopenssl to 26.4.0 so the published wheel installs with cryptography 50.0.0; 5.38.0 declared cryptography 50.0.0 while those packages capped it below 50, so pip could not install it and `pip install prowler` silently fell back to 5.37.1 [(#12477)](https://github.com/prowler-cloud/prowler/pull/12477) +- Pin zstd to 1.5.7.2; 1.5.7.3 was yanked from PyPI as not thread safe [(#12477)](https://github.com/prowler-cloud/prowler/pull/12477) +- ECS task-definition checks no longer report PASS when `DescribeTaskDefinition` fails before container evidence is gathered [(#12478)](https://github.com/prowler-cloud/prowler/pull/12478) +- `ses_identity_not_publicly_accessible` now evaluates every SES identity authorization policy and marks mixed public Allow and Deny statements for manual review [(#12480)](https://github.com/prowler-cloud/prowler/pull/12480) + +### πŸ” Security + +- Trivy from v0.72.0 to v0.73.0 in the container image, fixing HIGH CVE-2026-46600 in the bundled `golang.org/x/net` [(#12445)](https://github.com/prowler-cloud/prowler/pull/12445) +- Trivy v0.74.0 and Debian util-linux 2.41.5-0+deb13u1 in the SDK container image, patching Go standard library vulnerabilities and CVE-2026-53615 [(#12470)](https://github.com/prowler-cloud/prowler/pull/12470) + +--- + +## [5.39.0] (Prowler v5.39.0) + +### πŸš€ Added + +- `batch_job_definition_no_secrets` check for AWS provider, scanning Batch job definition environment variables and command parameters for hardcoded secrets [(#12117)](https://github.com/prowler-cloud/prowler/pull/12117) +- 7 M365 Entra checks covering CIS Microsoft 365 Foundations Benchmark v7.0.0 password protection, default user permissions, and guest invitation domain restrictions [(#12153)](https://github.com/prowler-cloud/prowler/pull/12153) +- 7 M365 entra checks covering CIS Microsoft 365 Foundations Benchmark v7.0.0 Conditional Access (5.2.2.x) and idle session timeout controls [(#12154)](https://github.com/prowler-cloud/prowler/pull/12154) +- `entra_authentication_method_email_otp_disabled`, `entra_authentication_method_authenticator_show_context`, `entra_pim_global_administrator_approval_required`, `entra_pim_privileged_role_administrator_approval_required`, `entra_access_review_guest_users_configured` and `entra_access_review_privileged_roles_configured` checks for M365 provider covering CIS Microsoft 365 Foundations Benchmark v7.0.0 authentication method, PIM approval and access review controls [(#12155)](https://github.com/prowler-cloud/prowler/pull/12155) +- `awslambda_layer_no_secrets_in_content` check for AWS provider, scanning Lambda layer package content for hardcoded secrets [(#12233)](https://github.com/prowler-cloud/prowler/pull/12233) +- CMMC 2.0 universal compliance framework (`cmmc_2.0`) with the 149 official requirements from 32 CFR Part 170 β€” Level 1 (15, 48 CFR 52.204-21), Level 2 (110, NIST SP 800-171 Rev 2) and Level 3 (24, NIST SP 800-172) β€” with AWS, Azure, GCP, Alibaba Cloud, Oracle Cloud and M365 check mappings and config guardrails [(#12401)](https://github.com/prowler-cloud/prowler/pull/12401) + +### πŸ”„ Changed + +- GitHub `organization_repository_creation_limited` check now reports low severity for FAIL findings when repository creation is provably limited to private/internal visibility, instead of always reporting high [(#12164)](https://github.com/prowler-cloud/prowler/pull/12164) + +### πŸ” Security + +- HTML report header now HTML-escapes every provider identity field across all 23 providers, closing a stored XSS in the header block (Secur0, CWE-79) that was left unaddressed by the earlier finding-row fix in #12221 [(#12424)](https://github.com/prowler-cloud/prowler/pull/12424) + +--- + ## [5.38.0] (Prowler v5.38.0) ### πŸš€ Added diff --git a/prowler/changelog.d/awslambda-layer-no-secrets-in-content.added.md b/prowler/changelog.d/awslambda-layer-no-secrets-in-content.added.md deleted file mode 100644 index 56a192b088..0000000000 --- a/prowler/changelog.d/awslambda-layer-no-secrets-in-content.added.md +++ /dev/null @@ -1 +0,0 @@ -`awslambda_layer_no_secrets_in_content` check for AWS provider, scanning Lambda layer package content for hardcoded secrets diff --git a/prowler/changelog.d/batch-job-definition-no-secrets.added.md b/prowler/changelog.d/batch-job-definition-no-secrets.added.md deleted file mode 100644 index 797dc06a12..0000000000 --- a/prowler/changelog.d/batch-job-definition-no-secrets.added.md +++ /dev/null @@ -1 +0,0 @@ -`batch_job_definition_no_secrets` check for AWS provider, scanning Batch job definition environment variables and command parameters for hardcoded secrets diff --git a/prowler/changelog.d/cmmc-2.0-universal.added.md b/prowler/changelog.d/cmmc-2.0-universal.added.md deleted file mode 100644 index 2c57c05c93..0000000000 --- a/prowler/changelog.d/cmmc-2.0-universal.added.md +++ /dev/null @@ -1 +0,0 @@ -CMMC 2.0 universal compliance framework (`cmmc_2.0`) with the 149 official requirements from 32 CFR Part 170 β€” Level 1 (15, 48 CFR 52.204-21), Level 2 (110, NIST SP 800-171 Rev 2) and Level 3 (24, NIST SP 800-172) β€” with AWS, Azure, GCP, Alibaba Cloud, Oracle Cloud and M365 check mappings and config guardrails diff --git a/prowler/changelog.d/ecr-repository-image-no-secrets.added.md b/prowler/changelog.d/ecr-repository-image-no-secrets.added.md new file mode 100644 index 0000000000..eb92d46823 --- /dev/null +++ b/prowler/changelog.d/ecr-repository-image-no-secrets.added.md @@ -0,0 +1 @@ +`ecr_repository_image_no_secrets` check for AWS provider, scanning the latest ECR repository image's configuration and filesystem layers for hardcoded secrets diff --git a/prowler/changelog.d/gcp-wif-provider-attribute-condition.added.md b/prowler/changelog.d/gcp-wif-provider-attribute-condition.added.md new file mode 100644 index 0000000000..4ab15242e2 --- /dev/null +++ b/prowler/changelog.d/gcp-wif-provider-attribute-condition.added.md @@ -0,0 +1 @@ +Add the `iam_workload_identity_pool_provider_attribute_condition` check to flag GCP Workload Identity Federation providers that trust a multi-tenant issuer without an attribute condition restricting which external identities can impersonate federated principals diff --git a/prowler/changelog.d/github-organization-repository-creation-severity.changed.md b/prowler/changelog.d/github-organization-repository-creation-severity.changed.md deleted file mode 100644 index 6e8f831447..0000000000 --- a/prowler/changelog.d/github-organization-repository-creation-severity.changed.md +++ /dev/null @@ -1 +0,0 @@ -GitHub `organization_repository_creation_limited` check now reports low severity for FAIL findings when repository creation is provably limited to private/internal visibility, instead of always reporting high diff --git a/prowler/changelog.d/m365-cis7-entra-authn-pim.added.md b/prowler/changelog.d/m365-cis7-entra-authn-pim.added.md deleted file mode 100644 index ac633fb58d..0000000000 --- a/prowler/changelog.d/m365-cis7-entra-authn-pim.added.md +++ /dev/null @@ -1 +0,0 @@ -`entra_authentication_method_email_otp_disabled`, `entra_authentication_method_authenticator_show_context`, `entra_pim_global_administrator_approval_required`, `entra_pim_privileged_role_administrator_approval_required`, `entra_access_review_guest_users_configured` and `entra_access_review_privileged_roles_configured` checks for M365 provider covering CIS Microsoft 365 Foundations Benchmark v7.0.0 authentication method, PIM approval and access review controls diff --git a/prowler/changelog.d/m365-cis7-entra-conditional-access.added.md b/prowler/changelog.d/m365-cis7-entra-conditional-access.added.md deleted file mode 100644 index 66856e5e20..0000000000 --- a/prowler/changelog.d/m365-cis7-entra-conditional-access.added.md +++ /dev/null @@ -1 +0,0 @@ -7 M365 entra checks covering CIS Microsoft 365 Foundations Benchmark v7.0.0 Conditional Access (5.2.2.x) and idle session timeout controls diff --git a/prowler/changelog.d/m365-cis7-entra-directory-settings.added.md b/prowler/changelog.d/m365-cis7-entra-directory-settings.added.md deleted file mode 100644 index 4fc76e535f..0000000000 --- a/prowler/changelog.d/m365-cis7-entra-directory-settings.added.md +++ /dev/null @@ -1 +0,0 @@ -7 M365 Entra checks covering CIS Microsoft 365 Foundations Benchmark v7.0.0 password protection, default user permissions, and guest invitation domain restrictions diff --git a/prowler/changelog.d/rolesanywhere-profile-session-scoping.added.md b/prowler/changelog.d/rolesanywhere-profile-session-scoping.added.md new file mode 100644 index 0000000000..6f50731aae --- /dev/null +++ b/prowler/changelog.d/rolesanywhere-profile-session-scoping.added.md @@ -0,0 +1 @@ +Add the `rolesanywhere_profile_restricts_session_permissions` check to flag AWS IAM Roles Anywhere profiles that reference an administrative role without scoping down the vended session with a session policy or managed policies diff --git a/prowler/compliance/cmmc_2.0.json b/prowler/compliance/cmmc_2.0.json index a3d7b67ea6..7c5783af13 100644 --- a/prowler/compliance/cmmc_2.0.json +++ b/prowler/compliance/cmmc_2.0.json @@ -265,20 +265,6 @@ "Operator": "lte", "Value": 90, "Provider": "aws" - }, - { - "Check": "iam_user_accesskey_unused", - "ConfigKey": "max_unused_access_keys_days", - "Operator": "lte", - "Value": 45, - "Provider": "aws" - }, - { - "Check": "iam_user_console_access_unused", - "ConfigKey": "max_console_access_days", - "Operator": "lte", - "Value": 45, - "Provider": "aws" } ] }, @@ -1064,20 +1050,6 @@ "Operator": "lte", "Value": 90, "Provider": "aws" - }, - { - "Check": "iam_user_accesskey_unused", - "ConfigKey": "max_unused_access_keys_days", - "Operator": "lte", - "Value": 45, - "Provider": "aws" - }, - { - "Check": "iam_user_console_access_unused", - "ConfigKey": "max_console_access_days", - "Operator": "lte", - "Value": 45, - "Provider": "aws" } ] }, @@ -2008,23 +1980,7 @@ "alibabacloud": [], "oraclecloud": [], "m365": [] - }, - "config_requirements": [ - { - "Check": "guardduty_is_enabled", - "ConfigKey": "mute_non_default_regions", - "Operator": "eq", - "Value": false, - "Provider": "aws" - }, - { - "Check": "securityhub_enabled", - "ConfigKey": "mute_non_default_regions", - "Operator": "eq", - "Value": false, - "Provider": "aws" - } - ] + } }, { "id": "AU.L2-3.3.5", diff --git a/prowler/config/config.py b/prowler/config/config.py index e2732a90f1..6d2e71132f 100644 --- a/prowler/config/config.py +++ b/prowler/config/config.py @@ -49,7 +49,7 @@ class _MutableTimestamp: timestamp = _MutableTimestamp(datetime.today()) timestamp_utc = _MutableTimestamp(datetime.now(timezone.utc)) -prowler_version = "5.39.0" +prowler_version = "5.40.0" html_logo_url = "https://github.com/prowler-cloud/prowler/" square_logo_img = "https://raw.githubusercontent.com/prowler-cloud/prowler/dc7d2d5aeb92fdf12e8604f42ef6472cd3e8e889/docs/img/prowler-logo-black.png" aws_logo = "https://user-images.githubusercontent.com/38561120/235953920-3e3fba08-0795-41dc-b480-9bea57db9f2e.png" diff --git a/prowler/lib/outputs/html/html.py b/prowler/lib/outputs/html/html.py index 1dcbfb5416..60428bede7 100644 --- a/prowler/lib/outputs/html/html.py +++ b/prowler/lib/outputs/html/html.py @@ -463,6 +463,11 @@ class HTML(Output): audited_regions = "All Regions" else: audited_regions = ", ".join(provider.identity.audited_regions) + account = escape(str(provider.identity.account)) + profile = escape(str(profile)) + audited_regions = escape(str(audited_regions)) + user_id = escape(str(provider.identity.user_id)) + identity_arn = escape(str(provider.identity.identity_arn)) return f"""
@@ -471,7 +476,7 @@ class HTML(Output):
  • - AWS Account: {provider.identity.account} + AWS Account: {account}
  • AWS-CLI Profile: {profile} @@ -489,10 +494,10 @@ class HTML(Output):
  • - User Id: {provider.identity.user_id} + User Id: {user_id}
  • - Caller Identity ARN: {provider.identity.identity_arn} + Caller Identity ARN: {identity_arn}
@@ -530,6 +535,11 @@ class HTML(Output): ) else: html_identity = provider.identity.identity_id + tenant_ids = escape(" ".join(provider.identity.tenant_ids)) + tenant_domain = escape(str(provider.identity.tenant_domain)) + subscriptions = escape(" ".join(printed_subscriptions)) + identity_type = escape(str(provider.identity.identity_type)) + html_identity = escape(str(html_identity)) return f"""
@@ -538,13 +548,13 @@ class HTML(Output):
  • - Azure Tenant IDs: {" ".join(provider.identity.tenant_ids)} + Azure Tenant IDs: {tenant_ids}
  • - Azure Tenant Domain: {provider.identity.tenant_domain} + Azure Tenant Domain: {tenant_domain}
  • - Azure Subscriptions: {" ".join(printed_subscriptions)} + Azure Subscriptions: {subscriptions}
@@ -556,7 +566,7 @@ class HTML(Output):
  • - Azure Identity Type: {provider.identity.identity_type} + Azure Identity Type: {identity_type}
  • Azure Identity ID: {html_identity} @@ -591,6 +601,8 @@ class HTML(Output): ) except AttributeError: profile = "default" + project_ids = escape(", ".join(provider.project_ids)) + profile = escape(str(profile)) return f"""
    @@ -599,7 +611,7 @@ class HTML(Output):
    • - GCP Project IDs: {", ".join(provider.project_ids)} + GCP Project IDs: {project_ids}
    @@ -634,6 +646,8 @@ class HTML(Output): str: the HTML assessment summary """ try: + cluster = escape(str(provider.identity.cluster)) + context = escape(str(provider.identity.context)) return f"""
    @@ -643,7 +657,7 @@ class HTML(Output):
    • - Kubernetes Cluster: {provider.identity.cluster} + Kubernetes Cluster: {cluster}
    @@ -656,7 +670,7 @@ class HTML(Output):
    • - Kubernetes Context: {provider.identity.context} + Kubernetes Context: {context}
    @@ -679,11 +693,13 @@ class HTML(Output): str: the HTML assessment summary """ try: + auth_method = escape(str(provider.auth_method)) if hasattr(provider.identity, "account_name"): # GithubIdentityInfo (Personal Access Token, OAuth) + account_name = escape(str(provider.identity.account_name)) account_info_items = f"""
  • - GitHub account: {provider.identity.account_name} + GitHub account: {account_name}
    • """ # Add email if available @@ -691,23 +707,27 @@ class HTML(Output): hasattr(provider.identity, "account_email") and provider.identity.account_email ): + account_email = escape(str(provider.identity.account_email)) account_info_items += f"""
  • - GitHub account email: {provider.identity.account_email} + GitHub account email: {account_email}
    • """ elif hasattr(provider.identity, "app_id"): # GithubAppIdentityInfo (GitHub App) # Assessment items: App Name and Installations + app_name = escape(str(provider.identity.app_name)) account_info_items = f"""
  • - GitHub App Name: {provider.identity.app_name} + GitHub App Name: {app_name}
    • """ # Add installations if available if ( hasattr(provider.identity, "installations") and provider.identity.installations ): - installations_display = ", ".join(provider.identity.installations) + installations_display = escape( + ", ".join(provider.identity.installations) + ) account_info_items += f"""
  • Installations: {installations_display} @@ -719,26 +739,27 @@ class HTML(Output):
    • """ # Credentials items: Authentication method and App ID + app_id = escape(str(provider.identity.app_id)) credentials_items = f"""
  • - GitHub authentication method: {provider.auth_method} + GitHub authentication method: {auth_method}
  • - GitHub App ID: {provider.identity.app_id} + GitHub App ID: {app_id}
    • """ else: # Fallback for other identity types account_info_items = "" credentials_items = f"""
  • - GitHub authentication method: {provider.auth_method} + GitHub authentication method: {auth_method}
    • """ # For PAT/OAuth, use default credentials structure if hasattr(provider.identity, "account_name"): credentials_items = f"""
  • - GitHub authentication method: {provider.auth_method} + GitHub authentication method: {auth_method}
    • """ return f""" @@ -779,6 +800,18 @@ class HTML(Output): str: the HTML assessment summary """ try: + tenant_domain = escape(str(provider.identity.tenant_domain)) + identity_type = escape(str(provider.identity.identity_type)) + identity_id = escape(str(provider.identity.identity_id)) + user_item = "" + if ( + hasattr(provider.identity, "user") + and provider.identity.user is not None + ): + user = escape(str(provider.identity.user)) + user_item = f"""
  • + M365 User: {user} +
    • """ return f"""
    @@ -787,9 +820,7 @@ class HTML(Output):
    • - M365 Tenant Domain: { - provider.identity.tenant_domain - } + M365 Tenant Domain: {tenant_domain}
    @@ -801,19 +832,12 @@ class HTML(Output):
    • - M365 Identity Type: {provider.identity.identity_type} + M365 Identity Type: {identity_type}
    • - M365 Identity ID: {provider.identity.identity_id} + M365 Identity ID: {identity_id}
      • - { - f'''
    • - M365 User: {provider.identity.user} -
      • ''' - if hasattr(provider.identity, "user") - and provider.identity.user is not None - else "" - } + {user_item}
    """ @@ -834,6 +858,9 @@ class HTML(Output): str: the HTML assessment summary """ try: + tenant_domain = escape(str(provider.identity.tenant_domain)) + identity_type = escape(str(provider.identity.identity_type)) + identity_id = escape(str(provider.identity.identity_id)) return f"""
    @@ -842,7 +869,7 @@ class HTML(Output):
    • - NHN Tenant Domain: {provider.identity.tenant_domain} + NHN Tenant Domain: {tenant_domain}
    @@ -854,10 +881,10 @@ class HTML(Output):
    • - NHN Identity Type: {provider.identity.identity_type} + NHN Identity Type: {identity_type}
    • - NHN Identity ID: {provider.identity.identity_id} + NHN Identity ID: {identity_id}
    @@ -880,6 +907,7 @@ class HTML(Output): str: the HTML assessment summary """ try: + organization_name = escape(str(provider.identity.organization_name)) return f"""
    @@ -889,7 +917,7 @@ class HTML(Output):
    • - MongoDB Atlas organization: {provider.identity.organization_name} + MongoDB Atlas organization: {organization_name}
    @@ -925,6 +953,13 @@ class HTML(Output): str: the HTML assessment summary """ try: + if provider.scan_repository_url: + target_info = "IAC repository URL: " + str( + escape(str(provider.scan_repository_url)) + ) + else: + target_info = "IAC path: " + str(escape(str(provider.scan_path))) + auth_method = escape(str(provider.auth_method)) return f"""
    @@ -934,7 +969,7 @@ class HTML(Output):
    • - {"IAC repository URL: " + provider.scan_repository_url if provider.scan_repository_url else "IAC path: " + provider.scan_path} + {target_info}
    @@ -947,7 +982,7 @@ class HTML(Output):
    • - IAC authentication method: {provider.auth_method} + IAC authentication method: {auth_method}
    @@ -971,10 +1006,13 @@ class HTML(Output): """ try: if provider.registry: - target_info = f"Registry URL: {provider.registry}" + registry = escape(str(provider.registry)) + target_info = f"Registry URL: {registry}" else: - target_info = f'Images: {", ".join(provider.images)}' + images = escape(", ".join(provider.images)) + target_info = f"Images: {images}" + auth_method = escape(str(provider.auth_method)) return f"""
    @@ -997,7 +1035,7 @@ class HTML(Output):
    • - Image authentication method: {provider.auth_method} + Image authentication method: {auth_method}
    @@ -1020,6 +1058,14 @@ class HTML(Output): str: HTML assessment summary for the LLM provider """ try: + model = escape(str(provider.model)) + plugins = escape(", ".join(provider.plugins)) + max_concurrency = escape(str(provider.max_concurrency)) + config_file = escape( + str(provider.config_path) + if provider.config_path + else "Using promptfoo defaults" + ) return f"""
    @@ -1031,16 +1077,16 @@ class HTML(Output):
    • - Target LLM: {provider.model} + Target LLM: {model}
    • - Plugins: {", ".join(provider.plugins)} + Plugins: {plugins}
    • - Max concurrency: {provider.max_concurrency} + Max concurrency: {max_concurrency}
    • - Config file: {provider.config_path if provider.config_path else "Using promptfoo defaults"} + Config file: {config_file}
    @@ -1069,6 +1115,10 @@ class HTML(Output): tenancy_name = getattr(provider.identity, "tenancy_name", "unknown") tenancy_id = getattr(provider.identity, "tenancy_id", "unknown") + tenancy = escape( + str(tenancy_name if tenancy_name != "unknown" else tenancy_id) + ) + profile = escape(str(profile)) return f"""
    @@ -1077,7 +1127,7 @@ class HTML(Output):
    • - OracleCloud Tenancy: {tenancy_name if tenancy_name != "unknown" else tenancy_id} + OracleCloud Tenancy: {tenancy}
    @@ -1116,10 +1166,11 @@ class HTML(Output): project_name = getattr(provider.identity, "project_name", "") audited_regions = getattr(provider.identity, "audited_regions", set()) + project_id = escape(str(project_id)) project_name_item = ( f"""
  • - Project Name: {project_name} + Project Name: {escape(str(project_name))}
    • """ if project_name else "" @@ -1128,7 +1179,7 @@ class HTML(Output): regions_item = ( f"""
  • - Regions: {", ".join(sorted(audited_regions))} + Regions: {escape(", ".join(sorted(audited_regions)))}
    • """ if audited_regions else "" @@ -1182,7 +1233,7 @@ class HTML(Output): # Build assessment summary items (only non-None values) assessment_items = "" if provider.accounts: - accounts = ", ".join([acc.id for acc in provider.accounts]) + accounts = escape(", ".join([str(acc.id) for acc in provider.accounts])) assessment_items += f"""
  • Accounts: {accounts} @@ -1208,6 +1259,7 @@ class HTML(Output): provider.session, "api_email", None ) if email: + email = escape(str(email)) credentials_items += f"""
  • Email: {email} @@ -1261,11 +1313,15 @@ class HTML(Output): account_name_item = ( f"""
  • - Account Name: {account_name} + Account Name: {escape(str(account_name))}
    • """ if account_name else "" ) + account_id = escape(str(account_id)) + audited_regions = escape(str(audited_regions)) + user_name = escape(str(user_name)) + identity_arn = escape(str(identity_arn)) return f"""
    @@ -1326,7 +1382,7 @@ class HTML(Output): project_name_item = ( f"""
  • - Project Name: {project_name} + Project Name: {escape(str(project_name))}
    • """ if project_name else "" @@ -1335,11 +1391,14 @@ class HTML(Output): user_id_item = ( f"""
  • - User ID: {user_id} + User ID: {escape(str(user_id))}
    • """ if user_id else "" ) + project_id = escape(str(project_id)) + region_name = escape(str(region_name)) + username = escape(str(username)) return f"""
    @@ -1389,6 +1448,9 @@ class HTML(Output): str: HTML assessment summary for the Google Workspace provider """ try: + domain = escape(str(provider.identity.domain)) + customer_id = escape(str(provider.identity.customer_id)) + delegated_user = escape(str(provider.identity.delegated_user)) return f"""
    @@ -1397,10 +1459,10 @@ class HTML(Output):
    • - Domain: {provider.identity.domain} + Domain: {domain}
    • - Customer ID: {provider.identity.customer_id} + Customer ID: {customer_id}
    @@ -1412,7 +1474,7 @@ class HTML(Output):
    • - Delegated User: {provider.identity.delegated_user} + Delegated User: {delegated_user}
    • Authentication Method: Service Account with Domain-Wide Delegation @@ -1482,9 +1544,11 @@ class HTML(Output): team = getattr(provider.identity, "team", None) if team: + team_name = escape(str(team.name)) + team_id = escape(str(team.id)) assessment_items += f"""
    • - Team: {team.name} ({team.id}) + Team: {team_name} ({team_id})
      • """ credentials_items = """ @@ -1494,6 +1558,7 @@ class HTML(Output): email = getattr(provider.identity, "email", None) if email: + email = escape(str(email)) credentials_items += f"""
    • Email: {email} @@ -1501,6 +1566,7 @@ class HTML(Output): username = getattr(provider.identity, "username", None) if username: + username = escape(str(username)) credentials_items += f"""
    • Username: {username} @@ -1543,17 +1609,20 @@ class HTML(Output): str: HTML assessment summary for the Okta provider """ try: + org_domain = escape(str(provider.identity.org_domain)) + auth_method = escape(str(provider.auth_method)) + client_id = escape(str(provider.identity.client_id)) assessment_items = f"""
    • - Okta Domain: {provider.identity.org_domain} + Okta Domain: {org_domain}
      • """ credentials_items = f"""
    • - Authentication: {provider.auth_method} + Authentication: {auth_method}
    • - Client ID: {provider.identity.client_id} + Client ID: {client_id}
      • """ return f""" @@ -1593,9 +1662,10 @@ class HTML(Output): str: HTML assessment summary for the Scaleway provider """ try: + organization_id = escape(str(provider.identity.organization_id)) assessment_items = f"""
    • - Organization ID: {provider.identity.organization_id} + Organization ID: {organization_id}
      • """ credentials_items = """ @@ -1605,6 +1675,7 @@ class HTML(Output): access_key = getattr(provider.session, "access_key", None) if access_key: + access_key = escape(str(access_key)) credentials_items += f"""
    • Access Key: {access_key} @@ -1615,6 +1686,8 @@ class HTML(Output): bearer_id = getattr(provider.identity, "bearer_id", None) if bearer_type: bearer_label = bearer_email or bearer_id or "-" + bearer_type = escape(str(bearer_type)) + bearer_label = escape(str(bearer_label)) credentials_items += f"""
    • Bearer: {bearer_type} ({bearer_label}) @@ -1622,6 +1695,7 @@ class HTML(Output): region = getattr(provider.session, "default_region", None) if region: + region = escape(str(region)) credentials_items += f"""
    • Default Region: {region} @@ -1668,6 +1742,9 @@ class HTML(Output): email = getattr(provider.identity, "email", None) or "-" account_id = getattr(provider.identity, "account_id", None) or "-" + username = escape(str(username)) + email = escape(str(email)) + account_id = escape(str(account_id)) assessment_items = f"""
    • Account ID: {account_id} @@ -1732,6 +1809,14 @@ class HTML(Output): audited_regions = "All Regions" else: audited_regions = ", ".join(provider.identity.regions) + account_id = escape(str(provider.identity.account_id)) + account_name = escape(str(provider.identity.account_name)) + profile = escape(str(profile)) + audited_regions = escape(str(audited_regions)) + domain_id = escape(str(provider.identity.domain_id)) + user_id = escape(str(provider.identity.user_id)) + user_name = escape(str(provider.identity.user_name)) + identity_type = escape(str(provider.identity.identity_type)) return f"""
      @@ -1740,10 +1825,10 @@ class HTML(Output):
      • - Account ID: {provider.identity.account_id} + Account ID: {account_id}
      • - Account Name: {provider.identity.account_name} + Account Name: {account_name}
      • Profile: {profile} @@ -1761,16 +1846,16 @@ class HTML(Output):
      • - Domain ID: {provider.identity.domain_id} + Domain ID: {domain_id}
      • - User ID: {provider.identity.user_id} + User ID: {user_id}
      • - User Name: {provider.identity.user_name} + User Name: {user_name}
      • - Identity Type: {provider.identity.identity_type} + Identity Type: {identity_type}
    diff --git a/prowler/providers/aws/services/ecr/ecr_repository_image_no_secrets/__init__.py b/prowler/providers/aws/services/ecr/ecr_repository_image_no_secrets/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/aws/services/ecr/ecr_repository_image_no_secrets/ecr_repository_image_no_secrets.metadata.json b/prowler/providers/aws/services/ecr/ecr_repository_image_no_secrets/ecr_repository_image_no_secrets.metadata.json new file mode 100644 index 0000000000..4c1138a6ae --- /dev/null +++ b/prowler/providers/aws/services/ecr/ecr_repository_image_no_secrets/ecr_repository_image_no_secrets.metadata.json @@ -0,0 +1,42 @@ +{ + "Provider": "aws", + "CheckID": "ecr_repository_image_no_secrets", + "CheckTitle": "ECR repository image contains no hardcoded secrets", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Sensitive Data Identifications/Passwords", + "Effects/Data Exposure" + ], + "ServiceName": "ecr", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", + "ResourceType": "AwsEcrRepository", + "ResourceGroup": "container", + "Description": "The **latest image** pushed to each **Amazon ECR repository** is analyzed for **embedded secrets**: environment variables and build history (Dockerfile instructions) recorded in the image configuration, plus the file contents of every filesystem layer. Findings reference the variable, build step, or file, never the secret value.", + "Risk": "Anyone able to pull the image obtains any **credentials, tokens, or keys** embedded at build time via `ENV`, `ARG`, inline `RUN` commands, or files copied into the image (e.g. `COPY .env .`).\n\nLeaked credentials enable unauthorized access to databases, APIs, or cloud resources, and rotation is harder once secrets are baked into distributed image artifacts.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AmazonECR/latest/userguide/security-best-practices.html", + "https://docs.aws.amazon.com/secretsmanager/latest/userguide/best-practices.html", + "https://docs.docker.com/build/building/secrets/" + ], + "Remediation": { + "Code": { + "CLI": "aws ecr batch-delete-image --repository-name --image-ids imageDigest=", + "NativeIaC": "", + "Other": "1. Remove the secret from the Dockerfile (ENV/ARG/RUN) or from any file copied into the build context, and rebuild the image without it.\n2. Provide the secret at runtime instead: reference AWS Secrets Manager or SSM Parameter Store from your ECS task definition, EKS pod (Secrets Store CSI driver), or application code.\n3. Push the rebuilt image and delete the compromised image versions from the repository.\n4. Rotate the exposed credential immediately.", + "Terraform": "" + }, + "Recommendation": { + "Text": "Never bake secrets into images with `ENV`, `ARG`, inline `RUN` commands, or copied files. Use **BuildKit build secrets** (`--mount=type=secret`) at build time and **AWS Secrets Manager**/Parameter Store at runtime. Add secret scanning to CI/CD before pushing images.", + "Url": "https://hub.prowler.com/check/ecr_repository_image_no_secrets" + } + }, + "Categories": [ + "secrets" + ], + "DependsOn": [], + "RelatedTo": [], + "Notes": "Only the most recently pushed image in each repository is scanned; older tagged images are not scanned. The latest scannable image is evaluated in every repository regardless of whether scan-on-push is enabled. The scanned image's configuration (environment variables and build history) plus every filesystem layer's file contents are analyzed. A multi-architecture image resolves to a single platform's manifest; other architectures in the same manifest list are not scanned. To bound cost, a single layer over 100 MB (compressed) is not downloaded, an individual file over 1 MB is not scanned, and scanning of an image stops after 5000 files or 500 MB (decompressed). When part of an image cannot be scanned this way, a clean result is reported as MANUAL (coverage was incomplete) rather than PASS, and a FAIL still discloses that some content was skipped. Requires the ecr:BatchGetImage and ecr:GetDownloadUrlForLayer permissions in addition to SecurityAudit." +} diff --git a/prowler/providers/aws/services/ecr/ecr_repository_image_no_secrets/ecr_repository_image_no_secrets.py b/prowler/providers/aws/services/ecr/ecr_repository_image_no_secrets/ecr_repository_image_no_secrets.py new file mode 100644 index 0000000000..abab734e63 --- /dev/null +++ b/prowler/providers/aws/services/ecr/ecr_repository_image_no_secrets/ecr_repository_image_no_secrets.py @@ -0,0 +1,244 @@ +import re + +from prowler.lib.check.models import Check, Check_Report_AWS +from prowler.lib.utils.utils import ( + SecretsScanError, + annotate_verified_secrets, + detect_secrets_scan_batch, +) +from prowler.providers.aws.services.ecr.ecr_client import ecr_client + +_SAFE_ENVIRONMENT_VARIABLE_NAME = re.compile(r"[A-Za-z_][A-Za-z0-9_]*") + + +class ecr_repository_image_no_secrets(Check): + """Ensure the latest ECR repository image embeds no hardcoded secrets. + + The most recently pushed image in every ECR repository is resolved to a + single scannable manifest (a multi-arch image resolves to one platform's + manifest; other architectures in the same manifest list are not + scanned) and scanned for plaintext secrets in its configuration + (environment variables, build history) and every filesystem layer's + file contents. Older tagged images are not scanned. + - PASS: no secrets detected and the whole image was scanned. + - FAIL: a potential secret was detected; the variable, build step, or + file is reported, never the secret value. + - MANUAL: the image could not be scanned in full, so a clean result would + be misleading -- the manifest could not be retrieved or resolved, the + scan itself failed, or part of the image exceeded configured size limits + or could not be retrieved. + """ + + def execute(self) -> list[Check_Report_AWS]: + """Execute the check logic. + + Returns: + A list of reports containing the result of the check. + """ + findings = [] + secrets_ignore_patterns = ecr_client.audit_config.get( + "secrets_ignore_patterns", [] + ) + validate = ecr_client.audit_config.get("secrets_validate", False) + + # Phase 1: collect. The service yields (repository, image, scan_data) + # lazily, downloading each image's manifest, config, and layers; each + # image contributes an env/history/file payload per scannable unit so + # a finding's key maps back to a variable, build step, or file. + scanned = [] + + def image_payloads(): + """Yield keyed scan payloads, recording each image into `scanned`.""" + for repository, image, scan_data in ecr_client._get_image_scan_data(): + index = len(scanned) + scanned.append((repository, image, scan_data)) + if scan_data is None or isinstance(scan_data, Exception): + continue + for env_index, entry in enumerate(scan_data.env): + yield (index, f"environment:{env_index}"), entry + for history_index, entry in enumerate(scan_data.history): + yield (index, f"history:{history_index}"), entry + for file_index, scanned_file in enumerate(scan_data.files): + yield (index, f"file:{file_index}"), scanned_file.content + # Free the file's contents once handed to the scanner. The + # report phase needs only its path and layer digest, so + # retained memory stays flat instead of growing with the + # number of repositories scanned. + scanned_file.content = "" + + # Phase 2: batch β€” one call, chunked Kingfisher subprocesses. This + # must fully consume image_payloads() so every image is appended to + # `scanned` before Phase 3 runs; detect_secrets_scan_batch does so + # today, but a future short-circuit there would silently drop images + # from the report loop. + scan_error = None + try: + batch_results = detect_secrets_scan_batch( + image_payloads(), + excluded_secrets=secrets_ignore_patterns, + validate=validate, + ) + except SecretsScanError as error: + batch_results = {} + scan_error = error + + if scan_error: + # The scan failed and the payload generator may not have been + # consumed, so build the MANUAL reports from the repositories + # themselves rather than risk a false PASS or a missing finding. + for registry in ecr_client.registries.values(): + for repository in registry.repositories: + image = ecr_client._get_scan_target_image(repository) + if isinstance(image, Exception): + findings.append( + self._build_scan_error_report(repository, image) + ) + elif image is not None: + report = self._build_report(repository, image) + report.status = "MANUAL" + report.status_extended = ( + f"Could not scan image '{image.latest_tag}' " + f"({image.latest_digest}) of ECR repository " + f"{repository.name} for secrets: {scan_error}; " + f"manual review is required." + ) + findings.append(report) + return findings + + # Phase 3: report β€” one finding per scanned image. + for index, (repository, image, scan_data) in enumerate(scanned): + if isinstance(scan_data, Exception): + findings.append(self._build_scan_error_report(repository, scan_data)) + continue + report = self._build_report(repository, image) + image_reference = ( + f"image '{image.latest_tag}' ({image.latest_digest}) of ECR " + f"repository {repository.name}" + ) + + if scan_data is None: + report.status = "MANUAL" + report.status_extended = ( + f"Could not resolve or retrieve the manifest of the " + f"{image_reference} to scan it for secrets; manual " + f"review is required." + ) + findings.append(report) + continue + + env_findings_by_index = { + int(key[1].split(":", 1)[1]): entry_secrets + for key, entry_secrets in batch_results.items() + if key[0] == index and key[1].startswith("environment:") + } + history_findings_by_index = { + int(key[1].split(":", 1)[1]): entry_secrets + for key, entry_secrets in batch_results.items() + if key[0] == index and key[1].startswith("history:") + } + file_findings_by_index = { + int(key[1].split(":", 1)[1]): file_secrets + for key, file_secrets in batch_results.items() + if key[0] == index and key[1].startswith("file:") + } + + if ( + env_findings_by_index + or history_findings_by_index + or file_findings_by_index + ): + secrets_found = [] + all_secrets = [] + + for env_index, env_findings in env_findings_by_index.items(): + variable = None + if 0 <= env_index < len(scan_data.env): + entry = scan_data.env[env_index] + # Only a well-formed "NAME=value" entry has a name safe + # to report; an entry with no "=" may itself be the + # secret, so it is never echoed back. + if "=" in entry: + candidate = entry.split("=", 1)[0] + if _SAFE_ENVIRONMENT_VARIABLE_NAME.fullmatch(candidate): + variable = candidate + all_secrets.extend(env_findings) + for secret in env_findings: + if variable is not None: + secrets_found.append( + f"{secret['type']} in environment variable {variable}" + ) + else: + secrets_found.append( + f"{secret['type']} in image environment variables" + ) + for ( + history_index, + history_findings, + ) in history_findings_by_index.items(): + all_secrets.extend(history_findings) + for secret in history_findings: + secrets_found.append( + f"{secret['type']} in image history step {history_index + 1}" + ) + for file_index, file_secrets in file_findings_by_index.items(): + scanned_file = scan_data.files[file_index] + all_secrets.extend(file_secrets) + for secret in file_secrets: + secrets_found.append( + f"{secret['type']} in file {scanned_file.path} " + f"(layer {scanned_file.layer_digest})" + ) + + report.status = "FAIL" + report.status_extended = ( + f"Potential {'secrets' if len(secrets_found) > 1 else 'secret'} " + f"found in the {image_reference} -> {', '.join(secrets_found)}." + ) + if scan_data.truncated: + report.status_extended += ( + " Some of the image could not be retrieved or exceeded " + "configured size limits and was not scanned." + ) + annotate_verified_secrets(report, all_secrets) + elif scan_data.truncated: + # No secrets in what was scanned, but coverage was incomplete + # (size/count limits, or the config could not be retrieved), so + # a clean result would be misleading. + report.status = "MANUAL" + report.status_extended = ( + f"No secrets were found in the scanned portion of the " + f"{image_reference}, but part of it could not be retrieved " + f"or exceeded configured size limits and was not scanned; " + f"manual review is required." + ) + else: + report.status = "PASS" + report.status_extended = f"No secrets found in the {image_reference}." + + findings.append(report) + + return findings + + def _build_scan_error_report(self, repository, error) -> Check_Report_AWS: + """Build a repository-level report for a latest-image lookup failure.""" + report = Check_Report_AWS(metadata=self.metadata(), resource=repository) + report.status = "MANUAL" + report.status_extended = ( + f"Could not determine the latest image of ECR repository " + f"{repository.name}: {error}; manual review is required." + ) + return report + + def _build_report(self, repository, image) -> Check_Report_AWS: + """Build a report scoped to a single image within a repository. + + ECR images have no ARN of their own, so the repository's ARN is + reused with the image digest appended as a synthetic suffix, + mirroring how other sub-resource checks (e.g. CodeArtifact packages + within a repository) identify per-item findings. + """ + report = Check_Report_AWS(metadata=self.metadata(), resource=repository) + digest_short = image.latest_digest.split(":")[-1][:12] + report.resource_id = f"{repository.name}:{image.latest_tag}@{digest_short}" + report.resource_arn = f"{repository.arn}/image/{digest_short}" + return report diff --git a/prowler/providers/aws/services/ecr/ecr_service.py b/prowler/providers/aws/services/ecr/ecr_service.py index a09969725a..ac128ee632 100644 --- a/prowler/providers/aws/services/ecr/ecr_service.py +++ b/prowler/providers/aws/services/ecr/ecr_service.py @@ -1,3 +1,4 @@ +from concurrent.futures import FIRST_COMPLETED, Future, ThreadPoolExecutor, wait from datetime import datetime from json import loads from typing import Optional @@ -8,10 +9,21 @@ from pydantic.v1 import BaseModel from prowler.lib.logger import logger from prowler.lib.scan_filters.scan_filters import is_resource_filtered from prowler.providers.aws.lib.service.service import AWSService +from prowler.providers.aws.services.ecr.image_inspection import ImageInspector + +# Concurrency for the image-scan pipeline (_get_image_scan_data). Kept smaller +# than the shared MAX_WORKERS metadata pool because each task can retain up to +# MAX_LAYER_DOWNLOAD_BYTES compressed plus MAX_TOTAL_BYTES_PER_IMAGE decompressed +# content (see image_inspection), so a high worker count would multiply peak +# memory into several GB. +IMAGE_SCAN_MAX_WORKERS = 4 class ECR(AWSService): + """AWS Elastic Container Registry service.""" + def __init__(self, provider): + """Discover registries, repositories, policies, and image metadata.""" # Call AWSService's __init__ super().__init__(__class__.__name__, provider) self.registry_id = self.audited_account @@ -24,6 +36,7 @@ class ECR(AWSService): self.__threading_call__(self._list_tags_for_resource) def _describe_registries_and_repositories(self, regional_client): + """Populate the registry and its repositories for one region.""" logger.info("ECR - Describing registries and repositories...") regional_registry_repositories = [] try: @@ -68,6 +81,7 @@ class ECR(AWSService): ) def _describe_repository_policies(self, regional_client): + """Fetch and attach each repository's resource policy, if any.""" logger.info("ECR - Describing repository policies...") try: if regional_client.region in self.registries: @@ -96,6 +110,7 @@ class ECR(AWSService): ) def _get_repository_lifecycle_policy(self, regional_client): + """Fetch and attach each repository's lifecycle policy, if any.""" logger.info("ECR - Getting repository lifecycle policy...") try: if regional_client.region in self.registries: @@ -124,6 +139,7 @@ class ECR(AWSService): ) def _get_image_details(self, regional_client): + """Populate each scan-on-push repository's scannable, tagged images.""" logger.info("ECR - Getting images details...") try: if regional_client.region in self.registries: @@ -158,12 +174,7 @@ class ECR(AWSService): image_scan_findings_field_name = ( "imageScanFindingsSummary" ) - if "docker" in artifact_media_type: - type = "Docker" - elif "oci" in artifact_media_type: - type = "OCI" - else: - type = "" + type = ECR._artifact_type(artifact_media_type) # If imageScanStatus is not present or imageScanFindingsSummary is missing, # we need to call DescribeImageScanFindings because AWS' new version of @@ -252,6 +263,7 @@ class ECR(AWSService): ) def _list_tags_for_resource(self, regional_client): + """Fetch and attach each repository's resource tags.""" logger.info("ECR - List Tags...") try: if regional_client.region in self.registries: @@ -280,6 +292,7 @@ class ECR(AWSService): ) def _get_registry_scanning_configuration(self, regional_client): + """Fetch and attach the registry's image-scanning configuration.""" logger.info("ECR - Getting Registry Scanning Configuration...") try: if regional_client.region in self.registries: @@ -315,6 +328,155 @@ class ECR(AWSService): f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" ) + def _get_image_scan_data(self): + """Lazily fetch manifest, config, and layer file contents for the latest image. + + Only the most recently pushed scannable image in each repository is + scanned (resolved via _get_scan_target_image, which also covers + scan-on-push-disabled repositories) to bound cost on repositories + with many tags. + + Not called from __init__: this is only invoked by the + ecr_repository_image_no_secrets check, since it downloads and + decompresses image layers and is significantly more expensive than + the metadata gathered above. A dedicated, smaller thread pool bounds + the concurrency (and therefore the peak memory) of this heavy + pipeline independently of the shared metadata pool. + + Yields: + Tuple of repository, optional image, and scan data. The third item + is an exception when the authoritative image lookup failed. + """ + logger.info("ECR - Fetching image manifests, configs, and layers...") + inspector = ImageInspector() + + def images_to_fetch(): + for registry in self.registries.values(): + for repository in registry.repositories: + image = self._get_scan_target_image(repository) + if isinstance(image, Exception): + yield repository, None, image + elif image is not None: + yield repository, image, None + + with ThreadPoolExecutor(max_workers=IMAGE_SCAN_MAX_WORKERS) as executor: + pending = {} + targets = iter(images_to_fetch()) + + def submit_next(): + try: + repository, image, error = next(targets) + except StopIteration: + return False + if error: + future = Future() + future.set_result(error) + else: + client = self.regional_clients[repository.region] + registry_id = self.registries[repository.region].id + future = executor.submit( + inspector.fetch_image_scan_data, + client, + registry_id, + repository.name, + image.latest_digest, + ) + pending[future] = (repository, image) + return True + + for _ in range(IMAGE_SCAN_MAX_WORKERS): + if not submit_next(): + break + + while pending: + completed, _ = wait(pending, return_when=FIRST_COMPLETED) + for future in completed: + repository, image = pending.pop(future) + scan_data = None + try: + scan_data = future.result() + except Exception as error: + logger.error( + f"{repository.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + yield repository, image, scan_data + submit_next() + + @staticmethod + def _artifact_type(artifact_media_type: Optional[str]) -> str: + """Map an image's artifact media type to a short image type label. + + Returns: + "Docker", "OCI", or "" for an unrecognized/absent media type. + """ + if artifact_media_type: + if "docker" in artifact_media_type: + return "Docker" + if "oci" in artifact_media_type: + return "OCI" + return "" + + def _get_scan_target_image(self, repository) -> Optional["ImageDetails"]: + """Resolve the latest scannable image to scan for secrets. + + Secret scanning is independent of ECR's vulnerability scanning + configuration, but `_get_image_details` only populates + `images_details` for scan-on-push-enabled repositories. For a + repository with scan-on-push disabled (empty `images_details`), this + performs a dedicated `describe_images` lookup to find the most + recently pushed scannable image, so those repositories are not + silently skipped. + + The synthesized ImageDetails is deliberately NOT appended to + `repository.images_details`: other checks (e.g. + ecr_repositories_scan_vulnerabilities_in_latest_image) treat any + entry there as a scanned image and would FAIL scan-on-push-disabled + repositories that currently produce no finding. + + Returns: + The latest scannable ImageDetails, or None if the repository has + no scannable image; an exception if the lookup failed. + """ + latest = repository.images_details[-1] if repository.images_details else None + try: + client = self.regional_clients[repository.region] + describe_images_paginator = client.get_paginator("describe_images") + for page in describe_images_paginator.paginate( + registryId=self.registries[repository.region].id, + repositoryName=repository.name, + PaginationConfig={"PageSize": 1000}, + ): + for image in page["imageDetails"]: + if image is None: + continue + artifact_media_type = image.get("artifactMediaType", None) + tags = image.get("imageTags", []) + if not ECR._is_artifact_scannable(artifact_media_type, tags): + continue + image_pushed_at = image.get("imagePushedAt") + if image_pushed_at is None: + continue + # Match _get_image_details' "sort ascending, take last" + # selection: on equal push dates the later-listed image + # wins, so `<` (not `<=`) is used to replace on ties. + if latest is not None and image_pushed_at < latest.image_pushed_at: + continue + latest = ImageDetails( + latest_tag=image.get("imageTags", ["None"])[0], + image_pushed_at=image_pushed_at, + latest_digest=image.get("imageDigest"), + scan_findings_status=None, + scan_findings_severity_count=None, + artifact_media_type=artifact_media_type, + type=ECR._artifact_type(artifact_media_type), + ) + return latest + except Exception as error: + logger.error( + f"{repository.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return error + @staticmethod def _is_artifact_scannable(artifact_media_type: str, tags: list[str] = []) -> bool: """ @@ -355,12 +517,16 @@ class ECR(AWSService): class FindingSeverityCounts(BaseModel): + """Count of an image's vulnerability scan findings by severity.""" + critical: int high: int medium: int class ImageDetails(BaseModel): + """A single scannable, tagged image within an ECR repository.""" + latest_tag: str latest_digest: str image_pushed_at: datetime @@ -371,6 +537,8 @@ class ImageDetails(BaseModel): class Repository(BaseModel): + """An ECR repository and its policies, images, and tags.""" + name: str arn: str region: str @@ -384,11 +552,15 @@ class Repository(BaseModel): class ScanningRule(BaseModel): + """A registry-level image-scanning rule and its repository filters.""" + scan_frequency: str scan_filters: list[dict] class Registry(BaseModel): + """An ECR registry: its repositories and scanning configuration.""" + id: str arn: str region: str diff --git a/prowler/providers/aws/services/ecr/image_inspection.py b/prowler/providers/aws/services/ecr/image_inspection.py new file mode 100644 index 0000000000..969e82dab8 --- /dev/null +++ b/prowler/providers/aws/services/ecr/image_inspection.py @@ -0,0 +1,494 @@ +import gzip +import tarfile +from contextlib import contextmanager +from json import loads +from typing import Optional + +import requests +import zstandard +from pydantic.v1 import BaseModel + +from prowler.lib.logger import logger + +# Manifest media types that wrap several per-architecture manifests (a "fat +# manifest") rather than a single scannable image. +_MANIFEST_LIST_MEDIA_TYPES = { + "application/vnd.docker.distribution.manifest.list.v2+json", + "application/vnd.oci.image.index.v1+json", +} + +# Compressed size of a single layer, checked against the manifest-declared +# size before downloading, and re-checked against actual bytes received. +MAX_LAYER_DOWNLOAD_BYTES = 100 * 1024 * 1024 +# Size of a single extracted file considered for scanning. +MAX_FILE_BYTES = 1 * 1024 * 1024 +# Hard cap on the number of files scanned per image, across all its layers. +MAX_FILES_PER_IMAGE = 5000 +# Hard cap on total decompressed bytes read per image, across all its layers. +MAX_TOTAL_BYTES_PER_IMAGE = 500 * 1024 * 1024 +LAYER_DOWNLOAD_TIMEOUT_SECONDS = 30 + + +class _LayerTooLargeError(Exception): + """Raised when a streamed layer exceeds MAX_LAYER_DOWNLOAD_BYTES.""" + + +class _ImageTooLargeError(Exception): + """Raised when decompressed image streams exceed their shared budget.""" + + +class _CappedLayerReader: + """A minimal read-only file object that caps the bytes it will yield. + + Wraps a streaming HTTP body (urllib3's ``response.raw``) so ``tarfile`` can + read a gzip/uncompressed layer incrementally while enforcing an upper bound + on the compressed bytes consumed. A manifest that under-declares a layer's + size (the declared size is pre-checked separately) cannot make this buffer + an unbounded amount of untrusted data: once ``max_bytes`` is exceeded the + read raises ``_LayerTooLargeError`` instead of continuing. + """ + + def __init__(self, raw, max_bytes: int): + """Store the underlying raw stream and the remaining byte budget.""" + self._raw = raw + self._remaining = max_bytes + + def read(self, size: int = -1) -> bytes: + """Read up to ``size`` bytes, never exceeding the remaining budget. + + A negative/None ``size`` (``read all``) is treated as "read what's left + of the budget, plus one" so a lying stream can never pull an unbounded + amount into memory and an over-cap layer is still detected. + """ + if size is None or size < 0: + size = self._remaining + 1 + to_read = min(size, self._remaining + 1) + chunk = self._raw.read(to_read) + self._remaining -= len(chunk) + if self._remaining < 0: + raise _LayerTooLargeError() + return chunk + + +class _DecompressedByteBudget: + """Track every decompressed byte consumed across an image's tar streams.""" + + def __init__(self, max_bytes: int): + """Set the shared decompressed-byte allowance.""" + self.remaining = max_bytes + + def wrap(self, raw): + """Return a reader that charges bytes consumed from ``raw``.""" + return _BudgetedReader(raw, self) + + +class _BudgetedReader: + """Charge all stream reads against a shared decompressed-byte budget.""" + + def __init__(self, raw, budget: _DecompressedByteBudget): + self._raw = raw + self._budget = budget + + def read(self, size: int = -1) -> bytes: + """Read without allowing the shared budget to be exceeded.""" + if size is None or size < 0: + size = self._budget.remaining + 1 + chunk = self._raw.read(min(size, self._budget.remaining + 1)) + self._budget.remaining -= len(chunk) + if self._budget.remaining < 0: + raise _ImageTooLargeError() + return chunk + + +class ImageScanFile(BaseModel): + """A single file extracted from an image layer for secret scanning.""" + + path: str + layer_digest: str + content: str + + +class ImageScanData(BaseModel): + """An image's scannable content: config env/history and layer files.""" + + env: list[str] = [] + history: list[str] = [] + files: list[ImageScanFile] = [] + # True when part of the image was not scanned -- a layer/file exceeded a + # configured size or count limit, or the config blob could not be + # retrieved/parsed -- so a clean result can be reported as MANUAL + # (coverage incomplete) rather than a false PASS. + truncated: bool = False + + +class ImageInspector: + """Bounded, opt-in extraction of an ECR image's scannable content. + + Given a boto3 ECR client and an image digest, resolves the image's + manifest (handling multi-arch manifest lists and skipping attestation + manifests) and returns its configuration (environment variables, build + history) and every filesystem layer's file contents, subject to this + module's size and count limits. + + This is deliberately isolated from the ECR service so a future check can + reuse the bounded extraction without the service downloading and + decompressing image layers by default: the service only pays this cost + when a check explicitly drives the inspector. + """ + + def fetch_image_scan_data( + self, client, registry_id, repository_name, image_digest + ) -> Optional[ImageScanData]: + """Resolve one image's manifest and return its scannable content. + + Downloads the config blob (environment variables, build history) + and every filesystem layer's file contents, bounded by the module's + size/count limits. + + Returns: + An ImageScanData, or None if the manifest could not be resolved. + """ + manifest, truncated = self._resolve_image_manifest( + client, registry_id, repository_name, image_digest + ) + if manifest is None: + return None + + env = [] + history = [] + + config_digest = (manifest.get("config") or {}).get("digest") + if config_digest: + config_bytes = self._download_layer( + client, + registry_id, + repository_name, + config_digest, + max_bytes=MAX_FILE_BYTES, + ) + if config_bytes is None: + # The config blob (env vars, build history) could not be + # retrieved. Empty env/history would be indistinguishable + # from a clean config, so mark coverage incomplete instead + # of risking a false PASS. + truncated = True + else: + try: + config_json = loads(config_bytes) + env = config_json.get("config", {}).get("Env", []) or [] + history = [ + step.get("created_by", "") + for step in config_json.get("history", []) + if step.get("created_by") + ] + except Exception as error: + logger.warning( + f"{repository_name} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + truncated = True + + files = [] + decompressed_budget = _DecompressedByteBudget(MAX_TOTAL_BYTES_PER_IMAGE) + for layer in manifest.get("layers", []): + if len(files) >= MAX_FILES_PER_IMAGE or decompressed_budget.remaining <= 0: + truncated = True + break + + layer_digest = layer.get("digest") + layer_size = layer.get("size", 0) + if layer_size and layer_size > MAX_LAYER_DOWNLOAD_BYTES: + truncated = True + continue + + try: + with self._open_layer_tar_stream( + client, + registry_id, + repository_name, + layer_digest, + layer.get("mediaType", ""), + decompressed_budget, + ) as tar_stream: + if tar_stream is None: + truncated = True + continue + for member in tar_stream: + if len(files) >= MAX_FILES_PER_IMAGE: + truncated = True + break + if not member.isfile(): + continue + base_name = member.name.rsplit("/", 1)[-1] + if base_name.startswith(".wh."): + # Whiteout marker: a deletion recorded by the union + # filesystem, not real file content. + continue + if member.size > MAX_FILE_BYTES: + truncated = True + continue + try: + content = ( + tar_stream.extractfile(member).read().decode("latin-1") + ) + except _LayerTooLargeError: + # Over-cap while reading this member: truncate the + # whole layer rather than silently skipping one file. + raise + except Exception: + continue + files.append( + ImageScanFile( + path=member.name, + layer_digest=layer_digest, + content=content, + ) + ) + except _LayerTooLargeError: + # The layer streamed more bytes than MAX_LAYER_DOWNLOAD_BYTES + # (a manifest under-declaring its size); skip it and disclose + # the partial coverage rather than buffer unbounded data. + truncated = True + continue + except _ImageTooLargeError: + truncated = True + break + + return ImageScanData(env=env, history=history, files=files, truncated=truncated) + + def _resolve_image_manifest( + self, client, registry_id, repository_name, image_digest + ) -> tuple[Optional[dict], bool]: + """Resolve an image digest to a single scannable image manifest. + + Multi-arch images are stored as a manifest list/image index pointing + at one manifest per platform (plus, often, an attestation manifest + that isn't a real image). This picks one real platform manifest to + scan; the other architectures in the same list are not scanned. + """ + try: + manifest, media_type = self._batch_get_manifest( + client, registry_id, repository_name, image_digest + ) + if manifest is None: + return None, False + + truncated = False + if media_type in _MANIFEST_LIST_MEDIA_TYPES: + truncated = True + child_digest = self._select_child_manifest_digest(manifest) + if not child_digest: + return None, truncated + manifest, _ = self._batch_get_manifest( + client, registry_id, repository_name, child_digest + ) + if manifest is not None and not ( + manifest.get("config") or manifest.get("layers") + ): + # A resolved manifest with neither a config nor layers has + # nothing to scan (e.g. a nested manifest list, or an + # unsupported manifest shape) -- treat it as unresolvable so + # the caller reports MANUAL instead of a false PASS. + return None, truncated + return manifest, truncated + except Exception as error: + logger.error( + f"{client.meta.region_name} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return None, False + + @staticmethod + def _batch_get_manifest(client, registry_id, repository_name, image_digest): + """Fetch and parse the raw manifest JSON for a single image digest. + + Returns: + A (manifest, media_type) tuple, or (None, None) if not found. + """ + response = client.batch_get_image( + registryId=registry_id, + repositoryName=repository_name, + imageIds=[{"imageDigest": image_digest}], + ) + images = response.get("images", []) + if not images: + return None, None + manifest = loads(images[0]["imageManifest"]) + media_type = manifest.get("mediaType") or images[0].get( + "imageManifestMediaType" + ) + return manifest, media_type + + @staticmethod + def _select_child_manifest_digest(manifest_list: dict) -> Optional[str]: + """Pick one real platform manifest's digest from a manifest list. + + Prefers linux/amd64, falling back to the first remaining candidate + once attestation manifests (platform "unknown/unknown", or + annotated as an attestation manifest) are excluded. + + Returns: + The chosen manifest's digest, or None if no candidate remains. + """ + candidates = [] + for entry in manifest_list.get("manifests", []): + platform = entry.get("platform", {}) or {} + annotations = entry.get("annotations", {}) or {} + if ( + platform.get("architecture") == "unknown" + or platform.get("os") == "unknown" + ): + # Attestation manifests (SBOMs, provenance, signatures) are + # attached to the index as "unknown/unknown" platform entries. + continue + if annotations.get("vnd.docker.reference.type") == "attestation-manifest": + continue + candidates.append(entry) + + for entry in candidates: + platform = entry.get("platform", {}) or {} + if ( + platform.get("architecture") == "amd64" + and platform.get("os") == "linux" + ): + return entry.get("digest") + + return candidates[0].get("digest") if candidates else None + + @staticmethod + def _get_layer_download_url( + client, registry_id, repository_name, layer_digest + ) -> Optional[str]: + """Resolve the presigned download URL for one layer or config blob. + + Returns: + The presigned URL, or None if ECR did not return one. + """ + response = client.get_download_url_for_layer( + registryId=registry_id, + repositoryName=repository_name, + layerDigest=layer_digest, + ) + return response.get("downloadUrl") + + @staticmethod + def _download_layer( + client, registry_id, repository_name, layer_digest, max_bytes=None + ) -> Optional[bytes]: + """Download one layer or config blob via its presigned URL. + + Streams the response, aborting once `max_bytes` is exceeded, so a + lying or oversized blob is never buffered in full. Used for the config + blob and for zstd layers (which cannot be streamed into tarfile); + gzip/uncompressed layers are streamed by `_open_layer_tar_stream`. + + Returns: + The blob's bytes, or None if it could not be downloaded or + exceeded `max_bytes`. + """ + try: + download_url = ImageInspector._get_layer_download_url( + client, registry_id, repository_name, layer_digest + ) + if not download_url: + return None + + downloaded = bytearray() + with requests.get( + download_url, + stream=True, + timeout=LAYER_DOWNLOAD_TIMEOUT_SECONDS, + allow_redirects=False, + ) as http_response: + http_response.raise_for_status() + for chunk in http_response.iter_content(chunk_size=1024 * 1024): + downloaded.extend(chunk) + if max_bytes and len(downloaded) > max_bytes: + return None + return bytes(downloaded) + except Exception as error: + logger.warning( + f"{repository_name} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return None + + @contextmanager + def _open_layer_tar_stream( + self, + client, + registry_id, + repository_name, + layer_digest, + media_type: str, + decompressed_budget: _DecompressedByteBudget, + ): + """Yield an open TarFile for one layer, streamed from the download. + + gzip, zstd, and uncompressed tar layers are all streamed straight from + the download into `tarfile` (streaming mode reads a file-like object + sequentially), so neither the compressed blob nor a decompressed copy is + ever buffered in full. A `_CappedLayerReader` enforces + `MAX_LAYER_DOWNLOAD_BYTES` on the compressed bytes (guarding a manifest + that under-declares the layer size); zstd is decompressed incrementally + via `zstandard`'s streaming reader, so a crafted frame can no longer + expand unbounded in memory, and the decompressed side is bounded by the + caller's per-image budget as it iterates members. + + Yields: + An open TarFile, or None for an unrecognized media type or a + download/decompression failure. Raises `_LayerTooLargeError` if a + streamed layer's compressed bytes exceed `MAX_LAYER_DOWNLOAD_BYTES`. + """ + if media_type.endswith("gzip"): + decompress = "gzip" + elif media_type.endswith("zstd"): + decompress = "zstd" + elif media_type.endswith("tar"): + decompress = None + else: + yield None + return + + # Only the setup (URL resolution, connection, tar-header parse) is + # guarded here; a failure yields None. The `yield tar_stream` below is + # kept out of this try so exceptions raised while the caller iterates + # members (e.g. _LayerTooLargeError) propagate instead of triggering a + # forbidden second yield. + try: + download_url = ImageInspector._get_layer_download_url( + client, registry_id, repository_name, layer_digest + ) + if not download_url: + yield None + return + http_response = requests.get( + download_url, + stream=True, + timeout=LAYER_DOWNLOAD_TIMEOUT_SECONDS, + allow_redirects=False, + ) + try: + http_response.raise_for_status() + # Cap the compressed bytes read from the network; for zstd, + # decompress that capped stream incrementally so the decompressed + # data is never materialized in full. + source = _CappedLayerReader(http_response.raw, MAX_LAYER_DOWNLOAD_BYTES) + if decompress == "gzip": + source = gzip.GzipFile(fileobj=source) + elif decompress == "zstd": + source = zstandard.ZstdDecompressor().stream_reader(source) + source = decompressed_budget.wrap(source) + tar_stream = tarfile.open(fileobj=source, mode="r|") + except (_LayerTooLargeError, _ImageTooLargeError): + http_response.close() + raise + except Exception: + http_response.close() + raise + except Exception as error: + logger.warning( + f"{repository_name} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + yield None + return + + with http_response, tar_stream: + yield tar_stream diff --git a/prowler/providers/aws/services/ecs/ecs_service.py b/prowler/providers/aws/services/ecs/ecs_service.py index 65c3aabf56..3006185210 100644 --- a/prowler/providers/aws/services/ecs/ecs_service.py +++ b/prowler/providers/aws/services/ecs/ecs_service.py @@ -149,8 +149,8 @@ class ECS(AWSService): "TAGS", ], ) - container_definitions = response["taskDefinition"]["containerDefinitions"] - for container in container_definitions: + container_definitions = [] + for container in response["taskDefinition"]["containerDefinitions"]: environment = [] if "environment" in container: for env_var in container["environment"]: @@ -159,7 +159,7 @@ class ECS(AWSService): name=env_var["name"], value=env_var["value"] ) ) - task_definition.container_definitions.append( + container_definitions.append( ContainerDefinition( name=container["name"], privileged=container.get("privileged", False), @@ -176,14 +176,16 @@ class ECS(AWSService): .get("mode", ""), ) ) - task_definition.pid_mode = response["taskDefinition"].get("pidMode", "") - task_definition.registered_at = response["taskDefinition"].get( - "registeredAt" - ) - task_definition.tags = response.get("tags") - task_definition.network_mode = response["taskDefinition"].get( - "networkMode", "bridge" - ) + pid_mode = response["taskDefinition"].get("pidMode", "") + registered_at = response["taskDefinition"].get("registeredAt") + tags = response.get("tags") + network_mode = response["taskDefinition"].get("networkMode", "bridge") + + task_definition.container_definitions = container_definitions + task_definition.pid_mode = pid_mode + task_definition.registered_at = registered_at + task_definition.tags = tags + task_definition.network_mode = network_mode except Exception as error: logger.error( f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" @@ -302,7 +304,7 @@ class TaskDefinition(BaseModel): arn: str revision: str region: str - container_definitions: list[ContainerDefinition] = [] + container_definitions: Optional[list[ContainerDefinition]] = None pid_mode: Optional[str] registered_at: Optional[datetime] = None tags: Optional[list] = [] diff --git a/prowler/providers/aws/services/ecs/ecs_task_definitions_containers_readonly_access/ecs_task_definitions_containers_readonly_access.py b/prowler/providers/aws/services/ecs/ecs_task_definitions_containers_readonly_access/ecs_task_definitions_containers_readonly_access.py index 3d9b33ddf7..85f11817a9 100644 --- a/prowler/providers/aws/services/ecs/ecs_task_definitions_containers_readonly_access/ecs_task_definitions_containers_readonly_access.py +++ b/prowler/providers/aws/services/ecs/ecs_task_definitions_containers_readonly_access/ecs_task_definitions_containers_readonly_access.py @@ -6,6 +6,8 @@ class ecs_task_definitions_containers_readonly_access(Check): def execute(self): findings = [] for task_definition in ecs_client.task_definitions.values(): + if task_definition.container_definitions is None: + continue report = Check_Report_AWS( metadata=self.metadata(), resource=task_definition ) diff --git a/prowler/providers/aws/services/ecs/ecs_task_definitions_host_namespace_not_shared/ecs_task_definitions_host_namespace_not_shared.py b/prowler/providers/aws/services/ecs/ecs_task_definitions_host_namespace_not_shared/ecs_task_definitions_host_namespace_not_shared.py index ee57dd4ea8..5cfdd526fe 100644 --- a/prowler/providers/aws/services/ecs/ecs_task_definitions_host_namespace_not_shared/ecs_task_definitions_host_namespace_not_shared.py +++ b/prowler/providers/aws/services/ecs/ecs_task_definitions_host_namespace_not_shared/ecs_task_definitions_host_namespace_not_shared.py @@ -6,6 +6,8 @@ class ecs_task_definitions_host_namespace_not_shared(Check): def execute(self): findings = [] for task_definition in ecs_client.task_definitions.values(): + if task_definition.container_definitions is None: + continue report = Check_Report_AWS( metadata=self.metadata(), resource=task_definition ) diff --git a/prowler/providers/aws/services/ecs/ecs_task_definitions_host_networking_mode_users/ecs_task_definitions_host_networking_mode_users.py b/prowler/providers/aws/services/ecs/ecs_task_definitions_host_networking_mode_users/ecs_task_definitions_host_networking_mode_users.py index b8354ed510..8376afef6d 100644 --- a/prowler/providers/aws/services/ecs/ecs_task_definitions_host_networking_mode_users/ecs_task_definitions_host_networking_mode_users.py +++ b/prowler/providers/aws/services/ecs/ecs_task_definitions_host_networking_mode_users/ecs_task_definitions_host_networking_mode_users.py @@ -6,6 +6,8 @@ class ecs_task_definitions_host_networking_mode_users(Check): def execute(self): findings = [] for task_definition in ecs_client.task_definitions.values(): + if task_definition.container_definitions is None: + continue report = Check_Report_AWS( metadata=self.metadata(), resource=task_definition ) diff --git a/prowler/providers/aws/services/ecs/ecs_task_definitions_logging_block_mode/ecs_task_definitions_logging_block_mode.py b/prowler/providers/aws/services/ecs/ecs_task_definitions_logging_block_mode/ecs_task_definitions_logging_block_mode.py index 5e3eff00a9..9224b3fb4b 100644 --- a/prowler/providers/aws/services/ecs/ecs_task_definitions_logging_block_mode/ecs_task_definitions_logging_block_mode.py +++ b/prowler/providers/aws/services/ecs/ecs_task_definitions_logging_block_mode/ecs_task_definitions_logging_block_mode.py @@ -6,6 +6,8 @@ class ecs_task_definitions_logging_block_mode(Check): def execute(self): findings = [] for task_definition in ecs_client.task_definitions.values(): + if task_definition.container_definitions is None: + continue report = Check_Report_AWS( metadata=self.metadata(), resource=task_definition ) diff --git a/prowler/providers/aws/services/ecs/ecs_task_definitions_logging_enabled/ecs_task_definitions_logging_enabled.py b/prowler/providers/aws/services/ecs/ecs_task_definitions_logging_enabled/ecs_task_definitions_logging_enabled.py index caf57177ca..4de607912a 100644 --- a/prowler/providers/aws/services/ecs/ecs_task_definitions_logging_enabled/ecs_task_definitions_logging_enabled.py +++ b/prowler/providers/aws/services/ecs/ecs_task_definitions_logging_enabled/ecs_task_definitions_logging_enabled.py @@ -6,6 +6,8 @@ class ecs_task_definitions_logging_enabled(Check): def execute(self): findings = [] for task_definition in ecs_client.task_definitions.values(): + if task_definition.container_definitions is None: + continue report = Check_Report_AWS( metadata=self.metadata(), resource=task_definition ) diff --git a/prowler/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets.py b/prowler/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets.py index b0bc7198ee..51c2efd5dc 100644 --- a/prowler/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets.py +++ b/prowler/providers/aws/services/ecs/ecs_task_definitions_no_environment_secrets/ecs_task_definitions_no_environment_secrets.py @@ -16,7 +16,11 @@ class ecs_task_definitions_no_environment_secrets(Check): "secrets_ignore_patterns", [] ) validate = ecs_client.audit_config.get("secrets_validate", False) - task_definitions = list(ecs_client.task_definitions.values()) + task_definitions = [ + task_definition + for task_definition in ecs_client.task_definitions.values() + if task_definition.container_definitions is not None + ] # Scan every (task definition, container) environment in batched # Kingfisher invocations instead of one subprocess per container. diff --git a/prowler/providers/aws/services/ecs/ecs_task_definitions_no_privileged_containers/ecs_task_definitions_no_privileged_containers.py b/prowler/providers/aws/services/ecs/ecs_task_definitions_no_privileged_containers/ecs_task_definitions_no_privileged_containers.py index 3cd56de532..f0a18227ea 100644 --- a/prowler/providers/aws/services/ecs/ecs_task_definitions_no_privileged_containers/ecs_task_definitions_no_privileged_containers.py +++ b/prowler/providers/aws/services/ecs/ecs_task_definitions_no_privileged_containers/ecs_task_definitions_no_privileged_containers.py @@ -6,6 +6,8 @@ class ecs_task_definitions_no_privileged_containers(Check): def execute(self): findings = [] for task_definition in ecs_client.task_definitions.values(): + if task_definition.container_definitions is None: + continue report = Check_Report_AWS( metadata=self.metadata(), resource=task_definition ) diff --git a/prowler/providers/aws/services/rolesanywhere/rolesanywhere_profile_restricts_session_permissions/__init__.py b/prowler/providers/aws/services/rolesanywhere/rolesanywhere_profile_restricts_session_permissions/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/aws/services/rolesanywhere/rolesanywhere_profile_restricts_session_permissions/rolesanywhere_profile_restricts_session_permissions.metadata.json b/prowler/providers/aws/services/rolesanywhere/rolesanywhere_profile_restricts_session_permissions/rolesanywhere_profile_restricts_session_permissions.metadata.json new file mode 100644 index 0000000000..0dfa072d65 --- /dev/null +++ b/prowler/providers/aws/services/rolesanywhere/rolesanywhere_profile_restricts_session_permissions/rolesanywhere_profile_restricts_session_permissions.metadata.json @@ -0,0 +1,41 @@ +{ + "Provider": "aws", + "CheckID": "rolesanywhere_profile_restricts_session_permissions", + "CheckTitle": "IAM Roles Anywhere profiles scope down the vended session permissions", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices" + ], + "ServiceName": "rolesanywhere", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "medium", + "ResourceType": "AwsRolesAnywhereProfile", + "ResourceGroup": "security", + "Description": "**IAM Roles Anywhere profiles** that reference an administrative role are assessed for **session scoping**. A profile defining neither an inline `sessionPolicy` nor `managedPolicyArns` vends credentials with the full permissions of its roles. It is flagged only when a referenced role is administrative, since an unscoped session on a least-privilege role is already constrained.", + "Risk": "Roles Anywhere profiles bind X.509 certificates to IAM roles. When a profile references an administrative role and does not scope the session, vended credentials carry full administrative permissions. An attacker presenting a valid certificate - or planting a rogue trust anchor and profile - gains durable privileged access that rotating IAM keys does not revoke.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.html", + "https://docs.aws.amazon.com/rolesanywhere/latest/APIReference/API_CreateProfile.html", + "https://docs.aws.amazon.com/rolesanywhere/latest/userguide/security-best-practices.html" + ], + "Remediation": { + "Code": { + "CLI": "aws rolesanywhere update-profile --profile-id --session-policy '{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Action\":[\"\"],\"Resource\":[\"\"]}]}'", + "NativeIaC": "```yaml\nResources:\n :\n Type: AWS::RolesAnywhere::Profile\n Properties:\n Name: scoped-profile\n Enabled: true\n RoleArns:\n - \n SessionPolicy: '{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Action\":[\"\"],\"Resource\":[\"\"]}]}' # FIX: scope down the vended session\n```", + "Other": "1. Identify the least-privilege actions the workload actually needs\n2. Attach a sessionPolicy or managedPolicyArns to the Roles Anywhere profile that grants only those actions\n3. Prefer purpose-built roles per workload over broad roles referenced by many profiles\n4. Review trust anchors and profiles regularly for entries you did not create", + "Terraform": "```hcl\nresource \"aws_rolesanywhere_profile\" \"\" {\n name = \"scoped-profile\"\n enabled = true\n role_arns = []\n session_policy = jsonencode({\n Version = \"2012-10-17\"\n Statement = [{\n Effect = \"Allow\"\n Action = []\n Resource = []\n }]\n }) # FIX: scope down the vended session\n}\n```" + }, + "Recommendation": { + "Text": "Attach a session policy or managed policies to every enabled IAM Roles Anywhere profile so the vended credentials are scoped below the referenced role's permissions. Pair each profile with a purpose-built least-privilege role and audit trust anchors and profiles regularly for unexpected entries.", + "Url": "https://hub.prowler.com/check/rolesanywhere_profile_restricts_session_permissions" + } + }, + "Categories": [ + "identity-access", + "trust-boundaries" + ], + "DependsOn": [], + "RelatedTo": [], + "Notes": "A profile is failed only when it is enabled, its session is unscoped, and a referenced role effectively grants administrative (*:*) access. The session-policy set (inline sessionPolicy plus every managedPolicyArns entry, resolved to its policy document) is evaluated as a union: any member granting *:* leaves the session unrestricted. Role classification merges all attached and inline identity-policy documents so explicit denies negate allows across policies, excludes condition-guarded statements (not statically provable), and intersects the result with the role's permissions boundary: a role whose boundary does not grant *:* - or whose boundary document cannot be resolved - is not classified as administrative. Disabled profiles, scoped profiles, and profiles with no role identified as administrative are reported as PASS. Referenced roles absent from the IAM inventory (for example cross-account roles or denied ListRoles) and policy documents that could not be collected are treated as non-administrative to avoid false positives." +} diff --git a/prowler/providers/aws/services/rolesanywhere/rolesanywhere_profile_restricts_session_permissions/rolesanywhere_profile_restricts_session_permissions.py b/prowler/providers/aws/services/rolesanywhere/rolesanywhere_profile_restricts_session_permissions/rolesanywhere_profile_restricts_session_permissions.py new file mode 100644 index 0000000000..5138b74ff3 --- /dev/null +++ b/prowler/providers/aws/services/rolesanywhere/rolesanywhere_profile_restricts_session_permissions/rolesanywhere_profile_restricts_session_permissions.py @@ -0,0 +1,272 @@ +import json + +from prowler.lib.check.models import Check, Check_Report_AWS +from prowler.lib.logger import logger +from prowler.providers.aws.services.iam.iam_client import iam_client +from prowler.providers.aws.services.iam.lib.policy import check_full_service_access +from prowler.providers.aws.services.rolesanywhere.rolesanywhere_client import ( + rolesanywhere_client, +) + +# AWS-managed AdministratorAccess ARN suffix, partition-agnostic +# (arn:aws:..., arn:aws-cn:..., arn:aws-us-gov:...). +ADMIN_POLICY_ARN_SUFFIX = ":iam::aws:policy/AdministratorAccess" + +# Synthetic statement equivalent to the AWS-managed AdministratorAccess +# document, used when a policy is identified by that ARN but its document was +# not collected by the IAM service. +_ADMIN_STATEMENT = {"Effect": "Allow", "Action": "*", "Resource": "*"} + + +def _grants_full_access(document) -> bool: + """Return True when a policy document grants administrative (``*:*``) access. + + Args: + document: Decoded IAM policy document, or None when unavailable. + """ + if not document: + return False + try: + return check_full_service_access("*", document) + except Exception as error: + logger.error( + f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return False + + +def _full_access_status(documents) -> bool | None: + """Return whether a policy-document set grants ``*:*``, or None when unknown. + + Merges every condition-free statement across the given documents into a + single evaluation so an explicit deny in one document negates an allow in + another (Deny > Allow via the shared policy-evaluation helpers). + + Unresolved or malformed documents and context-dependent semantics cannot + produce a definitive classification and propagate as None: + + - a document that is missing or not a well-formed statement container; + - a ``Condition``-guarded Deny that could negate an otherwise proven + full-access grant; + - a ``Condition``-guarded Allow that could grant full access not proven + by the unconditional statements. + + Args: + documents: Iterable of decoded IAM policy documents (None members mark + documents that could not be resolved). + """ + statements = [] + conditional_effects = set() + + for document in documents: + if not isinstance(document, dict) or "Statement" not in document: + return None + + document_statements = document.get("Statement", []) + if not isinstance(document_statements, list): + document_statements = [document_statements] + + for statement in document_statements: + if not isinstance(statement, dict): + return None + + effect = str(statement.get("Effect", "")).lower() + if ( + effect not in {"allow", "deny"} + or not ("Action" in statement or "NotAction" in statement) + or not ("Resource" in statement or "NotResource" in statement) + ): + return None + + if statement.get("Condition"): + conditional_effects.add(effect) + else: + statements.append(statement) + + grants_full_access = _grants_full_access({"Statement": statements}) + if (grants_full_access and "deny" in conditional_effects) or ( + not grants_full_access and "allow" in conditional_effects + ): + return None + + return grants_full_access + + +def _role_is_privileged(role, policies) -> bool | None: + """Return whether an IAM role is administrative, or None when unknown. + + Effective permissions are the intersection of the role's identity policies + (attached and inline, evaluated together) and its permissions boundary. + Unresolved policy documents, malformed policies, and condition-guarded + statements that could change the outcome propagate as None instead of + being collapsed into a definitive classification. + + Args: + role: An ``iam_service.Role`` referenced by a Roles Anywhere profile. + policies: Mapping of policy ARN to ``iam_service.Policy`` from iam_client. + """ + documents = [] + for attached in role.attached_policies: + policy_arn = attached.get("PolicyArn", "") + document = getattr(policies.get(policy_arn), "document", None) + if policy_arn.endswith(ADMIN_POLICY_ARN_SUFFIX) and not document: + documents.append({"Statement": [_ADMIN_STATEMENT]}) + else: + documents.append(document) + for inline_name in role.inline_policies: + policy = policies.get(f"{role.arn}:policy/{inline_name}") + documents.append(getattr(policy, "document", None)) + + identity_status = _full_access_status(documents) + if identity_status is False: + # Identity policies provably do not grant *:*; no boundary can widen them. + return False + + boundary = getattr(role, "permissions_boundary", None) + if not boundary: + return identity_status + boundary_arn = ( + boundary.get("PermissionsBoundaryArn", "") if isinstance(boundary, dict) else "" + ) + if boundary_arn.endswith(ADMIN_POLICY_ARN_SUFFIX): + # An AdministratorAccess boundary restricts nothing. + return identity_status + + boundary_status = _full_access_status( + [getattr(policies.get(boundary_arn), "document", None)] + ) + if boundary_status is False: + # The boundary provably does not grant *:*: the intersection cannot be + # administrative regardless of the identity policies. + return False + if boundary_status is None: + return None + return identity_status + + +def _session_is_scoped(profile, policies) -> bool | None: + """Return whether session policies restrict permissions, or None when unknown. + + AWS evaluates the inline ``sessionPolicy`` and every ``managedPolicyArns`` + entry together as a single session-policy category, so the complete set is + merged into one evaluation: the session is scoped only when at least one + session policy exists and the set does not grant ``*:*``. Managed entries + are resolved through the collected IAM policies. An invalid inline policy + or an unresolved managed policy does not prove that the session is + restricted and propagates as None. + + Args: + profile: A ``rolesanywhere_service.Profile``. + policies: Mapping of policy ARN to ``iam_service.Policy`` from iam_client. + """ + if not profile.session_policy and not profile.managed_policy_arns: + return False + + documents = [] + if profile.session_policy: + try: + documents.append(json.loads(profile.session_policy)) + except (ValueError, TypeError): + return None + for arn in profile.managed_policy_arns or []: + if arn.endswith(ADMIN_POLICY_ARN_SUFFIX): + documents.append({"Statement": [_ADMIN_STATEMENT]}) + else: + documents.append(getattr(policies.get(arn), "document", None)) + + grants_full_access = _full_access_status(documents) + return None if grants_full_access is None else not grants_full_access + + +class rolesanywhere_profile_restricts_session_permissions(Check): + """Flag Roles Anywhere profiles that vend an unscoped session on a privileged role. + + A Roles Anywhere profile that does not restrict the session with an inline + ``sessionPolicy`` or ``managedPolicyArns`` vends temporary credentials + carrying the full permissions of every role it references. This is only a + real risk when a referenced role is itself administrative: any certificate + accepted by the trust anchor then wields administrative permissions, turning + the profile into a durable privileged-access path that surviving key rotation + does not remove. Profiles that scope the session, whose referenced roles were + proven not administrative, or that are disabled are reported as PASS. When + session scoping or role permissions cannot be evaluated (unresolved or + invalid policy documents, condition-guarded grants, unknown roles), the + report is MANUAL rather than a proven outcome. + """ + + def execute(self) -> list[Check_Report_AWS]: + """Evaluate session-permission scoping for Roles Anywhere profiles. + + Returns: + list[Check_Report_AWS]: One report per Roles Anywhere profile. FAIL + for enabled, unscoped profiles that reference a proven administrative + role; MANUAL when session scoping or role permissions could not be + evaluated; PASS for scoped profiles, profiles whose roles were proven + not administrative, and disabled profiles. + """ + findings = [] + roles_by_arn = {role.arn: role for role in iam_client.roles} + for profile in rolesanywhere_client.profiles.values(): + report = Check_Report_AWS(metadata=self.metadata(), resource=profile) + role_statuses = { + arn: ( + _role_is_privileged(roles_by_arn[arn], iam_client.policies) + if arn in roles_by_arn + else None + ) + for arn in profile.role_arns + } + privileged_role_arns = [ + arn for arn, status in role_statuses.items() if status is True + ] + unknown_role_arns = [ + arn for arn, status in role_statuses.items() if status is None + ] + session_scoped = _session_is_scoped(profile, iam_client.policies) + + if not profile.enabled: + report.status = "PASS" + report.status_extended = ( + f"IAM Roles Anywhere profile {profile.name} is disabled and " + "cannot vend session credentials." + ) + elif session_scoped is True: + report.status = "PASS" + report.status_extended = ( + f"IAM Roles Anywhere profile {profile.name} restricts vended " + "session permissions with a session policy or managed policies." + ) + elif session_scoped is None: + report.status = "MANUAL" + report.status_extended = ( + f"IAM Roles Anywhere profile {profile.name} session scoping " + "could not be evaluated because an inline or managed session " + "policy was invalid or unresolved." + ) + elif privileged_role_arns: + report.status = "FAIL" + report.status_extended = ( + f"IAM Roles Anywhere profile {profile.name} does not scope down " + "sessions and references administrative role(s) " + f"{', '.join(privileged_role_arns)}; certificates authenticated " + "through it inherit administrative permissions, enabling durable " + "privileged access." + ) + elif unknown_role_arns: + report.status = "MANUAL" + report.status_extended = ( + f"IAM Roles Anywhere profile {profile.name} does not scope down " + "sessions, and the effective permissions of referenced role(s) " + f"{', '.join(unknown_role_arns)} could not be evaluated." + ) + else: + report.status = "PASS" + report.status_extended = ( + f"IAM Roles Anywhere profile {profile.name} does not scope down " + "sessions, but no referenced role was identified as " + "administrative; scoping the session is recommended as " + "defense-in-depth." + ) + findings.append(report) + + return findings diff --git a/prowler/providers/aws/services/rolesanywhere/rolesanywhere_service.py b/prowler/providers/aws/services/rolesanywhere/rolesanywhere_service.py index 46dca281d6..aa53352b4a 100644 --- a/prowler/providers/aws/services/rolesanywhere/rolesanywhere_service.py +++ b/prowler/providers/aws/services/rolesanywhere/rolesanywhere_service.py @@ -11,7 +11,9 @@ class RolesAnywhere(AWSService): def __init__(self, provider): super().__init__(__class__.__name__, provider) self.trust_anchors = {} + self.profiles = {} self.__threading_call__(self._list_trust_anchors) + self.__threading_call__(self._list_profiles) def _list_trust_anchors(self, regional_client): logger.info("RolesAnywhere - Listing Trust Anchors...") @@ -52,6 +54,53 @@ class RolesAnywhere(AWSService): f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" ) + def _list_profiles(self, regional_client): + """List and cache IAM Roles Anywhere profiles for one AWS Region. + + Args: + regional_client: Roles Anywhere client for the audited Region. + """ + logger.info("RolesAnywhere - Listing Profiles...") + try: + paginator = regional_client.get_paginator("list_profiles") + for page in paginator.paginate(): + for profile in page.get("profiles", []): + arn = profile.get("profileArn", "") + if not arn: + continue + if self.audit_resources and not is_resource_filtered( + arn, self.audit_resources + ): + continue + tags = [] + try: + tags = regional_client.list_tags_for_resource( + resourceArn=arn + ).get("tags", []) + except Exception as error: + logger.warning( + f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + self.profiles[arn] = Profile( + arn=arn, + id=profile.get("profileId", ""), + name=profile.get("name", ""), + region=regional_client.region, + enabled=profile.get("enabled", False), + role_arns=profile.get("roleArns", []) or [], + session_policy=profile.get("sessionPolicy", "") or "", + managed_policy_arns=profile.get("managedPolicyArns", []) or [], + duration_seconds=profile.get("durationSeconds", 0) or 0, + accept_role_session_name=profile.get( + "acceptRoleSessionName", False + ), + tags=tags, + ) + except Exception as error: + logger.error( + f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + class TrustAnchor(BaseModel): arn: str @@ -62,3 +111,19 @@ class TrustAnchor(BaseModel): source_type: str = "" acm_pca_arn: str = "" tags: List[Dict[str, str]] = Field(default_factory=list) + + +class Profile(BaseModel): + """Represent an IAM Roles Anywhere profile.""" + + arn: str + id: str + name: str + region: str + enabled: bool = False + role_arns: List[str] = Field(default_factory=list) + session_policy: str = "" + managed_policy_arns: List[str] = Field(default_factory=list) + duration_seconds: int = 0 + accept_role_session_name: bool = False + tags: List[Dict[str, str]] = Field(default_factory=list) diff --git a/prowler/providers/aws/services/ses/ses_identity_not_publicly_accessible/ses_identity_not_publicly_accessible.py b/prowler/providers/aws/services/ses/ses_identity_not_publicly_accessible/ses_identity_not_publicly_accessible.py index f668b05d06..6f4440a679 100644 --- a/prowler/providers/aws/services/ses/ses_identity_not_publicly_accessible/ses_identity_not_publicly_accessible.py +++ b/prowler/providers/aws/services/ses/ses_identity_not_publicly_accessible/ses_identity_not_publicly_accessible.py @@ -1,25 +1,58 @@ +from copy import deepcopy + from prowler.lib.check.models import Check, Check_Report_AWS from prowler.providers.aws.services.iam.lib.policy import is_policy_public from prowler.providers.aws.services.ses.ses_client import ses_client +def _normalize_policy_statements(policy: dict) -> dict: + statements = policy.get("Statement", []) + if isinstance(statements, dict): + return {**policy, "Statement": [statements]} + return policy + + +def _has_explicit_deny(policy: dict) -> bool: + return any( + isinstance(statement, dict) and statement.get("Effect") == "Deny" + for statement in _normalize_policy_statements(policy).get("Statement", []) + ) + + class ses_identity_not_publicly_accessible(Check): - def execute(self): + """Ensure SES identities are not publicly accessible through authorization policies.""" + + def execute(self) -> list[Check_Report_AWS]: + """Evaluate every authorization policy attached to each SES identity. + + Returns: + A list of reports containing the public-access result for each identity. + """ findings = [] for identity in ses_client.email_identities.values(): - if identity.policy is None: + if not identity.policies: continue report = Check_Report_AWS(metadata=self.metadata(), resource=identity) report.status = "PASS" report.status_extended = ( f"SES identity {identity.name} is not publicly accessible." ) - if is_policy_public( - identity.policy, - ses_client.audited_account, - ): - report.status = "FAIL" - report.status_extended = f"SES identity {identity.name} is publicly accessible due to its resource policy." + has_public_allow = any( + is_policy_public( + _normalize_policy_statements(deepcopy(policy)), + ses_client.audited_account, + ) + for policy in identity.policies.values() + ) + if has_public_allow: + if any( + _has_explicit_deny(policy) for policy in identity.policies.values() + ): + report.status = "MANUAL" + report.status_extended = f"SES identity {identity.name} has public Allow and explicit Deny statements in its resource policies. Effective public access requires manual review." + else: + report.status = "FAIL" + report.status_extended = f"SES identity {identity.name} is publicly accessible due to its resource policies." findings.append(report) diff --git a/prowler/providers/aws/services/ses/ses_service.py b/prowler/providers/aws/services/ses/ses_service.py index 7d0feb8f54..b865b0128e 100644 --- a/prowler/providers/aws/services/ses/ses_service.py +++ b/prowler/providers/aws/services/ses/ses_service.py @@ -1,7 +1,7 @@ from json import loads from typing import Optional -from pydantic.v1 import BaseModel +from pydantic.v1 import BaseModel, Field from prowler.lib.logger import logger from prowler.lib.scan_filters.scan_filters import is_resource_filtered @@ -46,8 +46,11 @@ class SES(AWSService): identity_attributes = regional_client.get_email_identity( EmailIdentity=identity.name ) - for _, content in identity_attributes.get("Policies", {}).items(): - identity.policy = loads(content) + identity.policies = { + name: loads(content) + for name, content in identity_attributes.get("Policies", {}).items() + } + identity.policy = next(reversed(identity.policies.values()), None) identity.tags = identity_attributes.get("Tags", []) dkim_attrs = identity_attributes.get("DkimAttributes", {}) or {} identity.dkim_status = dkim_attrs.get("Status") @@ -72,6 +75,7 @@ class Identity(BaseModel): region: str type: Optional[str] policy: Optional[dict] = None + policies: dict[str, dict] = Field(default_factory=dict) tags: Optional[list] = [] dkim_status: Optional[str] = None dkim_signing_attributes_origin: Optional[str] = None diff --git a/prowler/providers/gcp/services/iam/iam_service.py b/prowler/providers/gcp/services/iam/iam_service.py index 987a86068c..cc2deddefa 100644 --- a/prowler/providers/gcp/services/iam/iam_service.py +++ b/prowler/providers/gcp/services/iam/iam_service.py @@ -17,6 +17,8 @@ class IAM(GCPService): self.service_accounts = [] self._get_service_accounts() self._get_service_accounts_keys() + self.workload_identity_pool_providers = [] + self._get_workload_identity_pool_providers() def _get_service_accounts(self): for project_id in self.project_ids: @@ -87,6 +89,94 @@ class IAM(GCPService): f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" ) + def _get_workload_identity_pool_providers(self): + for project_id in self.project_ids: + try: + pools_request = ( + self.client.projects() + .locations() + .workloadIdentityPools() + .list(parent=f"projects/{project_id}/locations/global") + ) + while pools_request is not None: + pools_response = pools_request.execute( + num_retries=DEFAULT_RETRY_ATTEMPTS + ) + for pool in pools_response.get("workloadIdentityPools", []): + self._get_providers_for_pool(project_id, pool) + pools_request = ( + self.client.projects() + .locations() + .workloadIdentityPools() + .list_next( + previous_request=pools_request, + previous_response=pools_response, + ) + ) + except Exception as error: + logger.error( + f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + + def _get_providers_for_pool(self, project_id, pool): + try: + pool_name = pool.get("name", "") + pool_id = pool_name.split("/")[-1] + # A provider can remain ACTIVE while its parent pool is disabled or + # soft-deleted; a disabled pool cannot vend credentials, so the + # pool's effective availability must travel with the provider. + pool_disabled = ( + pool.get("disabled", False) or pool.get("state", "ACTIVE") != "ACTIVE" + ) + request = ( + self.client.projects() + .locations() + .workloadIdentityPools() + .providers() + .list(parent=pool_name) + ) + while request is not None: + response = request.execute(num_retries=DEFAULT_RETRY_ATTEMPTS) + for provider in response.get("workloadIdentityPoolProviders", []): + provider_type = next( + ( + key + for key in ("oidc", "aws", "saml", "x509") + if key in provider + ), + "", + ) + self.workload_identity_pool_providers.append( + WorkloadIdentityPoolProvider( + name=provider.get("name", ""), + id=provider.get("name", "").split("/")[-1], + pool_id=pool_id, + pool_disabled=pool_disabled, + project_id=project_id, + state=provider.get("state", ""), + disabled=provider.get("disabled", False), + attribute_condition=provider.get("attributeCondition", ""), + attribute_mapping=provider.get("attributeMapping", {}) + or {}, + provider_type=provider_type, + issuer_uri=(provider.get("oidc", {}) or {}).get( + "issuerUri", "" + ), + display_name=provider.get("displayName", ""), + ) + ) + request = ( + self.client.projects() + .locations() + .workloadIdentityPools() + .providers() + .list_next(previous_request=request, previous_response=response) + ) + except Exception as error: + logger.error( + f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + class Key(BaseModel): name: str @@ -106,6 +196,25 @@ class ServiceAccount(BaseModel): disabled: bool = False +class WorkloadIdentityPoolProvider(BaseModel): + """Represent a GCP Workload Identity Federation pool provider.""" + + name: str + id: str + pool_id: str + # True when the parent pool is disabled or not ACTIVE; such a pool cannot + # vend credentials regardless of the provider's own state. + pool_disabled: bool = False + project_id: str + state: str = "" + disabled: bool = False + attribute_condition: str = "" + attribute_mapping: dict = {} + provider_type: str = "" + issuer_uri: str = "" + display_name: str = "" + + class AccessApproval(GCPService): def __init__(self, provider: GcpProvider): super().__init__(__class__.__name__, provider) diff --git a/prowler/providers/gcp/services/iam/iam_workload_identity_pool_provider_attribute_condition/__init__.py b/prowler/providers/gcp/services/iam/iam_workload_identity_pool_provider_attribute_condition/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/gcp/services/iam/iam_workload_identity_pool_provider_attribute_condition/iam_workload_identity_pool_provider_attribute_condition.metadata.json b/prowler/providers/gcp/services/iam/iam_workload_identity_pool_provider_attribute_condition/iam_workload_identity_pool_provider_attribute_condition.metadata.json new file mode 100644 index 0000000000..5caa3cb774 --- /dev/null +++ b/prowler/providers/gcp/services/iam/iam_workload_identity_pool_provider_attribute_condition/iam_workload_identity_pool_provider_attribute_condition.metadata.json @@ -0,0 +1,38 @@ +{ + "Provider": "gcp", + "CheckID": "iam_workload_identity_pool_provider_attribute_condition", + "CheckTitle": "Workload Identity Federation providers trusting a multi-tenant issuer enforce an attribute condition", + "CheckType": [], + "ServiceName": "iam", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", + "ResourceType": "iam.googleapis.com/WorkloadIdentityPoolProvider", + "Description": "**Workload Identity Federation providers** define an `attributeCondition` (CEL) restricting which external identities may impersonate Google Cloud principals. When a provider trusts a **multi-tenant issuer** (GitHub Actions, GitLab.com and other shared issuers), omitting the condition trusts every identity that issuer can mint. Providers trusting a dedicated single-tenant issuer are not flagged.", + "Risk": "A provider trusting a multi-tenant issuer without an attribute condition accepts any external identity from that issuer - for example any GitHub repository when the issuer is GitHub Actions. An attacker controlling any tenant on that platform can authenticate through the provider and exchange tokens for federated credentials. Because no key is stored, this access survives credential rotation.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://cloud.google.com/iam/docs/workload-identity-federation", + "https://cloud.google.com/iam/docs/workload-identity-federation#mapping", + "https://cloud.google.com/iam/docs/best-practices-for-using-workload-identity-federation" + ], + "Remediation": { + "Code": { + "CLI": "gcloud iam workload-identity-pools providers update- --location=global --workload-identity-pool= --attribute-condition=\"\" # use the update subcommand matching the provider type", + "NativeIaC": "", + "Other": "1. In the Google Cloud console, go to IAM & Admin > Workload Identity Federation\n2. Open the affected pool and provider\n3. Set an attribute condition (CEL) restricting the allowed external identities, using an assertion that fits the provider type: OIDC by subject or claim (assertion.sub), SAML by NameID or attribute (assertion.subject or assertion.attributes[...]), AWS by account/role (assertion.account or assertion.arn), X.509 by certificate subject\n4. For OIDC providers, also restrict allowedAudiences to your own audience\n5. Review providers regularly for entries you did not create", + "Terraform": "```hcl\nresource \"google_iam_workload_identity_pool_provider\" \"example\" {\n workload_identity_pool_id = \"my-pool\"\n workload_identity_pool_provider_id = \"my-provider\"\n attribute_condition = \"assertion.repository_owner == 'my-org'\" # FIX: restrict trusted identities\n\n # Declare exactly one of oidc {}, aws {}, saml {}, or x509 {} to match the provider type, e.g.:\n oidc {\n issuer_uri = \"https://token.actions.githubusercontent.com\"\n allowed_audiences = [\"https://my-audience.example.com\"]\n }\n}\n```" + }, + "Recommendation": { + "Text": "Set an attribute condition on any active Workload Identity Federation provider that trusts a multi-tenant issuer so only the intended external identities can impersonate Google Cloud principals, and pair OIDC providers with a restricted audience. Providers trusting a dedicated single-tenant issuer should still add a condition as defense-in-depth. Audit pools and providers regularly for unexpected entries.", + "Url": "https://hub.prowler.com/check/iam_workload_identity_pool_provider_attribute_condition" + } + }, + "Categories": [ + "identity-access", + "trust-boundaries" + ], + "DependsOn": [], + "RelatedTo": [], + "Notes": "Only active providers that trust a known multi-tenant issuer (GitHub Actions, GitLab.com, Google, HCP Terraform) are failed when they omit an attribute condition; providers trusting a dedicated single-tenant issuer, AWS/SAML/X.509 providers, and disabled or non-ACTIVE providers are reported as PASS. This check verifies that an attribute condition is present; it does not evaluate whether the condition's expression is sufficiently restrictive." +} diff --git a/prowler/providers/gcp/services/iam/iam_workload_identity_pool_provider_attribute_condition/iam_workload_identity_pool_provider_attribute_condition.py b/prowler/providers/gcp/services/iam/iam_workload_identity_pool_provider_attribute_condition/iam_workload_identity_pool_provider_attribute_condition.py new file mode 100644 index 0000000000..79577e888f --- /dev/null +++ b/prowler/providers/gcp/services/iam/iam_workload_identity_pool_provider_attribute_condition/iam_workload_identity_pool_provider_attribute_condition.py @@ -0,0 +1,107 @@ +from urllib.parse import urlparse + +from prowler.lib.check.models import Check, Check_Report_GCP +from prowler.providers.gcp.services.iam.iam_client import iam_client + +# OIDC issuers whose tokens are minted for many independent tenants (any GitHub +# repository, any GitLab project, any Google account, ...). A provider that +# trusts one of these without an ``attributeCondition`` accepts identities +# outside the operator's control, so omitting the condition genuinely expands +# trust. A dedicated, single-tenant issuer only vends tokens to the operator's +# own workloads, so an attribute condition there is defense-in-depth rather than +# a requirement (see Google's guidance for GitHub and other shared issuers). +MULTI_TENANT_OIDC_ISSUER_HOSTS = { + "token.actions.githubusercontent.com", # GitHub Actions (any repository) + "gitlab.com", # GitLab.com SaaS (any project) + "accounts.google.com", # any Google account + "app.terraform.io", # HCP Terraform (any organization) +} + + +def _is_multi_tenant_issuer(issuer_uri: str) -> bool: + """Return True when the OIDC issuer is a known multi-tenant/shared issuer.""" + if not issuer_uri: + return False + # hostname lowercases and strips port/userinfo (gitlab.com:443, user@host); + # fall back to the raw string for bare hosts without a scheme. + host = urlparse(issuer_uri).hostname or issuer_uri.lower() + return host in MULTI_TENANT_OIDC_ISSUER_HOSTS + + +class iam_workload_identity_pool_provider_attribute_condition(Check): + """Ensure WIF providers trusting a multi-tenant issuer enforce an attribute condition. + + A workload identity pool provider that trusts a multi-tenant issuer (GitHub + Actions, GitLab.com, ...) without an ``attributeCondition`` accepts every + external identity that issuer can mint. An attacker controlling any tenant on + that platform can then authenticate through the provider and exchange tokens + for federated credentials, surviving credential rotation. Providers that + enforce an attribute condition, that trust a dedicated single-tenant issuer, + that are not OIDC-based, that are disabled/inactive, or whose parent pool is + disabled are reported as PASS. + """ + + def execute(self) -> list[Check_Report_GCP]: + """Evaluate the attribute condition of each Workload Identity provider. + + Returns: + list[Check_Report_GCP]: One report per workload identity pool + provider. FAIL for active providers that trust a multi-tenant issuer + without an attribute condition; PASS for providers that enforce one, + trust a dedicated issuer, are not OIDC-based, or are + disabled/inactive. + """ + findings = [] + for provider in iam_client.workload_identity_pool_providers: + report = Check_Report_GCP( + metadata=self.metadata(), + resource=provider, + resource_id=provider.name, + resource_name=provider.display_name or provider.id, + location="global", + ) + if provider.pool_disabled: + report.status = "PASS" + report.status_extended = ( + f"Workload Identity Federation provider {provider.id} belongs " + f"to the disabled pool {provider.pool_id}, which cannot vend " + "credentials." + ) + elif provider.disabled or provider.state != "ACTIVE": + report.status = "PASS" + report.status_extended = ( + f"Workload Identity Federation provider {provider.id} in pool " + f"{provider.pool_id} is not active and cannot vend credentials." + ) + elif provider.attribute_condition: + report.status = "PASS" + report.status_extended = ( + f"Workload Identity Federation provider {provider.id} in pool " + f"{provider.pool_id} enforces an attribute condition." + ) + elif _is_multi_tenant_issuer(provider.issuer_uri): + report.status = "FAIL" + report.status_extended = ( + f"Workload Identity Federation provider {provider.id} in pool " + f"{provider.pool_id} trusts the multi-tenant issuer " + f"{provider.issuer_uri} without an attribute condition, so any " + "identity from that issuer can authenticate through this provider." + ) + elif provider.provider_type != "oidc": + report.status = "PASS" + report.status_extended = ( + f"Workload Identity Federation provider {provider.id} in pool " + f"{provider.pool_id} is not an OIDC provider trusting a " + "multi-tenant issuer; an attribute condition is recommended as " + "defense-in-depth but not required." + ) + else: + report.status = "PASS" + report.status_extended = ( + f"Workload Identity Federation provider {provider.id} in pool " + f"{provider.pool_id} trusts a dedicated issuer; an attribute " + "condition is recommended as defense-in-depth but not required." + ) + findings.append(report) + + return findings diff --git a/pyproject.toml b/pyproject.toml index 4d730c5364..2207f9f944 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [build-system] build-backend = "hatchling.build" -requires = ["hatchling"] +requires = ["hatchling==1.32.0"] [dependency-groups] dev = [ @@ -68,6 +68,10 @@ dependencies = [ "boto3==1.40.61", "botocore==1.40.61", "colorama==0.4.6", + # cryptography 50 needs alibabacloud-tea-openapi>=0.4.6, oci>=2.184.1 and, in the + # [tool.uv] pins, msal>=1.37.0 and pyopenssl>=26.4.0: earlier releases cap it below 49 + # or 50. Keep the five in step. Never widen a cap with [tool.uv] override-dependencies: + # overrides do not ship in the wheel, and 5.38.0 was uninstallable with pip because of one. "cryptography==50.0.0", "dash==3.1.1", "dash-bootstrap-components==2.0.3", @@ -103,10 +107,10 @@ dependencies = [ "uuid6==2024.7.10", "py-iam-expand==0.3.0", "h2==4.3.0", - "oci==2.183.0", + "oci==2.184.1", "alibabacloud_credentials==1.0.3", "alibabacloud_ram20150501==1.2.0", - "alibabacloud_tea_openapi==0.4.5", + "alibabacloud_tea_openapi==0.4.6", "alibabacloud_sts20150401==1.1.6", "alibabacloud_vpc20160428==6.13.0", "alibabacloud_ecs20140526==7.2.5", @@ -128,7 +132,8 @@ dependencies = [ "huaweicloudsdkobs==3.1.204", "huaweicloudsdkrds==3.1.204", "huaweicloudsdkvpc==3.1.204", - "huaweicloudsdkwaf==3.1.204" + "huaweicloudsdkwaf==3.1.204", + "zstandard==0.25.0" ] description = "Prowler is an Open Source security tool to perform AWS, GCP and Azure security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness. It contains hundreds of controls covering CIS, NIST 800, NIST CSF, CISA, RBI, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, AWS Well-Architected Framework Security Pillar, AWS Foundational Technical Review (FTR), ENS (Spanish National Security Scheme) and your custom security frameworks." license = "Apache-2.0" @@ -136,7 +141,7 @@ maintainers = [{name = "Prowler Engineering", email = "engineering@prowler.com"} name = "prowler" readme = "README.md" requires-python = ">=3.10,<3.14" -version = "5.39.0" +version = "5.40.0" [project.scripts] prowler = "prowler.__main__:prowler" @@ -199,7 +204,7 @@ constraint-dependencies = [ "alibabacloud-sas20181203==6.1.0", "alibabacloud-sts20150401==1.1.6", "alibabacloud-tea==0.4.3", - "alibabacloud-tea-openapi==0.4.5", + "alibabacloud-tea-openapi==0.4.6", "alibabacloud-tea-util==0.3.14", "alibabacloud-tea-xml==0.0.3", "alibabacloud-vpc20160428==6.13.0", @@ -300,7 +305,7 @@ constraint-dependencies = [ "mock==5.2.0", "moto==5.1.11", "mpmath==1.3.0", - "msal==1.36.0", + "msal==1.37.0", "msal-extensions==1.3.1", "msgraph-core==1.3.8", "msrest==0.7.1", @@ -343,7 +348,7 @@ constraint-dependencies = [ "pyjwt==2.13.0", "pylint==3.3.4", "pynacl==1.6.2", - "pyopenssl==26.2.0", + "pyopenssl==26.4.0", "pyparsing==3.3.2", "pytest==9.0.3", "pytest-cov==6.0.0", @@ -387,13 +392,9 @@ constraint-dependencies = [ "xmltodict==1.0.4", "yarl==1.23.0", "zipp==3.23.1", - "zstd==1.5.7.3" -] -override-dependencies = [ - "okta==3.4.2", - # alibabacloud-tea-openapi 0.4.5 caps cryptography below 49 and is the latest release. - "cryptography==50.0.0", + "zstd==1.5.7.2" ] +override-dependencies = ["okta==3.4.2"] [tool.vulture] # Suppress known false positives. The CI command only passes --exclude and diff --git a/tests/lib/outputs/html/html_test.py b/tests/lib/outputs/html/html_test.py index 1459c34b3c..1590d29742 100644 --- a/tests/lib/outputs/html/html_test.py +++ b/tests/lib/outputs/html/html_test.py @@ -1,6 +1,8 @@ +import re import sys from io import StringIO +import pytest from mock import MagicMock, patch from prowler.config.config import prowler_version, timestamp @@ -676,6 +678,192 @@ html_footer = """ """ +def _setup_aws_xss(provider, payload): + provider.identity.account = payload + provider.identity.profile = payload + provider.identity.audited_regions = [payload] + provider.identity.user_id = payload + provider.identity.identity_arn = payload + + +def _setup_azure_xss(provider, payload): + provider.identity.tenant_ids = [payload] + provider.identity.tenant_domain = payload + provider.identity.subscriptions = {payload: payload} + provider.identity.identity_type = payload + provider.identity.identity_id = payload + + +def _setup_gcp_xss(provider, payload): + provider.project_ids = [payload] + provider.session._service_account_email = payload + + +def _setup_kubernetes_xss(provider, payload): + provider.identity.cluster = payload + provider.identity.context = payload + + +def _setup_github_xss(provider, payload): + provider.identity = MagicMock(spec=["account_name", "account_email"]) + provider.identity.account_name = payload + provider.identity.account_email = payload + provider.auth_method = payload + + +def _setup_m365_xss(provider, payload): + provider.identity.tenant_domain = payload + provider.identity.identity_type = payload + provider.identity.identity_id = payload + provider.identity.user = payload + + +def _setup_nhn_xss(provider, payload): + provider.identity.tenant_domain = payload + provider.identity.identity_type = payload + provider.identity.identity_id = payload + + +def _setup_mongodbatlas_xss(provider, payload): + provider.identity.organization_name = payload + + +def _setup_iac_xss(provider, payload): + provider.scan_repository_url = payload + provider.scan_path = None + provider.auth_method = payload + + +def _setup_image_xss(provider, payload): + provider.registry = payload + provider.images = [payload] + provider.auth_method = payload + + +def _setup_llm_xss(provider, payload): + provider.model = payload + provider.plugins = [payload] + provider.max_concurrency = payload + provider.config_path = payload + + +def _setup_oraclecloud_xss(provider, payload): + provider.session.profile = payload + provider.identity.tenancy_name = payload + provider.identity.tenancy_id = payload + + +def _setup_stackit_xss(provider, payload): + provider.identity.project_id = payload + provider.identity.project_name = payload + provider.identity.audited_regions = {payload} + + +def _setup_cloudflare_xss(provider, payload): + account = MagicMock() + account.id = payload + provider.accounts = [account] + provider.session.api_token = "token" + provider.session.api_key = None + provider.session.api_email = None + provider.identity.email = payload + + +def _setup_alibabacloud_xss(provider, payload): + provider.identity.account_id = payload + provider.identity.account_name = payload + provider.identity.audited_regions = payload + provider.identity.identity_arn = payload + provider.identity.user_name = payload + + +def _setup_openstack_xss(provider, payload): + provider.identity.project_id = payload + provider.identity.project_name = payload + provider.identity.region_name = payload + provider.identity.username = payload + provider.identity.user_id = payload + + +def _setup_googleworkspace_xss(provider, payload): + provider.identity.domain = payload + provider.identity.customer_id = payload + provider.identity.delegated_user = payload + + +def _setup_e2enetworks_xss(provider, payload): + provider.identity.project_id = payload + provider.identity.locations = [payload] + + +def _setup_vercel_xss(provider, payload): + team = MagicMock() + team.name = payload + team.id = payload + provider.identity.team = team + provider.identity.email = payload + provider.identity.username = payload + + +def _setup_okta_xss(provider, payload): + provider.identity.org_domain = payload + provider.auth_method = payload + provider.identity.client_id = payload + + +def _setup_scaleway_xss(provider, payload): + provider.identity.organization_id = payload + provider.session.access_key = payload + provider.identity.bearer_type = payload + provider.identity.bearer_email = payload + provider.identity.bearer_id = payload + provider.session.default_region = payload + + +def _setup_linode_xss(provider, payload): + provider.identity.username = payload + provider.identity.email = payload + provider.identity.account_id = payload + + +def _setup_huaweicloud_xss(provider, payload): + provider.identity.account_id = payload + provider.identity.account_name = payload + provider.identity.profile = payload + provider.identity.regions = {payload} + provider.identity.domain_id = payload + provider.identity.user_id = payload + provider.identity.user_name = payload + provider.identity.identity_type = payload + + +PROVIDER_XSS_SETUPS = [ + ("aws", _setup_aws_xss), + ("azure", _setup_azure_xss), + ("gcp", _setup_gcp_xss), + ("kubernetes", _setup_kubernetes_xss), + ("github", _setup_github_xss), + ("m365", _setup_m365_xss), + ("nhn", _setup_nhn_xss), + ("mongodbatlas", _setup_mongodbatlas_xss), + ("iac", _setup_iac_xss), + ("image", _setup_image_xss), + ("llm", _setup_llm_xss), + ("oraclecloud", _setup_oraclecloud_xss), + ("stackit", _setup_stackit_xss), + ("cloudflare", _setup_cloudflare_xss), + ("alibabacloud", _setup_alibabacloud_xss), + ("openstack", _setup_openstack_xss), + ("googleworkspace", _setup_googleworkspace_xss), + ("e2enetworks", _setup_e2enetworks_xss), + ("vercel", _setup_vercel_xss), + ("okta", _setup_okta_xss), + ("scaleway", _setup_scaleway_xss), + ("linode", _setup_linode_xss), + ("huaweicloud", _setup_huaweicloud_xss), +] + + class TestHTML: def test_transform_fail_finding(self): findings = [ @@ -1100,6 +1288,103 @@ class TestHTML: assert "" not in summary assert "Delhi"><script>alert(1)</script>" in summary + @pytest.mark.parametrize( + "provider_type,setup_fn", + PROVIDER_XSS_SETUPS, + ids=[t for t, _ in PROVIDER_XSS_SETUPS], + ) + def test_get_assessment_summary_escapes_provider_identity( + self, provider_type, setup_fn + ): + """Every provider header must HTML-escape tenant-controlled identity fields.""" + payload = "" + findings = [generate_finding_output()] + output = HTML(findings) + + provider = MagicMock() + provider.type = provider_type + setup_fn(provider, payload) + + summary = output.get_assessment_summary(provider) + + assert payload not in summary + assert "<script>alert(1)</script>" in summary + + def test_provider_xss_setups_covers_every_assessment_summary_method(self): + """Adding a new get__assessment_summary without a PROVIDER_XSS_SETUPS + entry must fail this test, so the escape guarantee cannot silently regress.""" + pattern = re.compile(r"^get_(.+)_assessment_summary$") + discovered = set() + for name in dir(HTML): + match = pattern.match(name) + if match: + discovered.add(match.group(1)) + + covered = {ptype for ptype, _ in PROVIDER_XSS_SETUPS} + + missing = discovered - covered + extra = covered - discovered + assert ( + not missing + ), f"providers without XSS coverage in PROVIDER_XSS_SETUPS: {sorted(missing)}" + assert ( + not extra + ), f"PROVIDER_XSS_SETUPS entries with no matching HTML method: {sorted(extra)}" + + def test_github_app_get_assessment_summary_escapes_app_identity(self): + """The GitHub App branch (elif hasattr app_id) must escape app_name/app_id/installations, + which the PAT setup does not exercise.""" + payload = "" + findings = [generate_finding_output()] + output = HTML(findings) + + provider = MagicMock() + provider.type = "github" + provider.identity = MagicMock(spec=["app_id", "app_name", "installations"]) + provider.identity.app_id = payload + provider.identity.app_name = payload + provider.identity.installations = [payload] + provider.auth_method = payload + + summary = output.get_assessment_summary(provider) + + assert payload not in summary + assert "<script>alert(1)</script>" in summary + + def test_iac_get_assessment_summary_escapes_scan_path(self): + """The IAC scan_path branch (else of `if scan_repository_url`) must escape it.""" + payload = "" + findings = [generate_finding_output()] + output = HTML(findings) + + provider = MagicMock() + provider.type = "iac" + provider.scan_repository_url = None + provider.scan_path = payload + provider.auth_method = payload + + summary = output.get_assessment_summary(provider) + + assert payload not in summary + assert "<script>alert(1)</script>" in summary + + def test_image_get_assessment_summary_escapes_images_list(self): + """The Image `else` branch (no registry, images list) must escape each image.""" + payload = "" + findings = [generate_finding_output()] + output = HTML(findings) + + provider = MagicMock() + provider.type = "image" + provider.registry = None + provider.images = [payload] + provider.auth_method = payload + + summary = output.get_assessment_summary(provider) + + assert payload not in summary + assert "<script>alert(1)</script>" in summary + def test_process_markdown_bold_text(self): """Test that **text** is converted to text""" test_text = "This is **bold text** and this is **also bold**" diff --git a/tests/providers/aws/services/ecr/ecr_repository_image_no_secrets/ecr_repository_image_no_secrets_test.py b/tests/providers/aws/services/ecr/ecr_repository_image_no_secrets/ecr_repository_image_no_secrets_test.py new file mode 100644 index 0000000000..91936be911 --- /dev/null +++ b/tests/providers/aws/services/ecr/ecr_repository_image_no_secrets/ecr_repository_image_no_secrets_test.py @@ -0,0 +1,837 @@ +from datetime import datetime +from unittest import mock + +from prowler.providers.aws.services.ecr.ecr_service import ( + ImageDetails, + Registry, + Repository, +) +from prowler.providers.aws.services.ecr.image_inspection import ( + ImageScanData, + ImageScanFile, +) +from tests.providers.aws.utils import ( + AWS_ACCOUNT_NUMBER, + AWS_REGION_US_EAST_1, + set_mocked_aws_provider, +) + +# A real JWT: Kingfisher detects this regardless of the surrounding key name +# or format (env-style KEY=value, Dockerfile RUN step, or source file). +SECRET_VALUE = ( + "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9" + ".eyJzdWIiOiIxMjM0NTY3ODkwIn0" + ".dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U" +) + + +def create_repository(name="test-repo", region=AWS_REGION_US_EAST_1) -> Repository: + """Build a minimal ECR Repository fixture.""" + return Repository( + name=name, + arn=f"arn:aws:ecr:{region}:{AWS_ACCOUNT_NUMBER}:repository/{name}", + region=region, + scan_on_push=True, + images_details=[], + ) + + +def create_image(tag="latest", digest=None) -> ImageDetails: + """Build a minimal ImageDetails fixture.""" + return ImageDetails( + latest_tag=tag, + latest_digest=digest or f"sha256:{'0' * 64}", + image_pushed_at=datetime.now(), + scan_findings_status=None, + scan_findings_severity_count=None, + artifact_media_type="application/vnd.docker.container.image.v1+json", + type="Docker", + ) + + +def mock_image_scan_data(pairs): + """Build a fake _get_image_scan_data generator yielding the given pairs.""" + + def _generator(): + """Yield each (repository, image, scan_data) pair once.""" + for entry in pairs: + yield entry + + return _generator + + +class Test_ecr_repository_image_no_secrets: + """Tests for the ecr_repository_image_no_secrets check.""" + + def test_no_repositories(self): + """No repositories yields no findings.""" + ecr_client = mock.MagicMock() + ecr_client.registries = {} + ecr_client.audit_config = { + "secrets_ignore_patterns": [], + "secrets_validate": False, + } + ecr_client._get_image_scan_data = mock_image_scan_data([]) + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_aws_provider(), + ), + mock.patch( + "prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets.ecr_client", + new=ecr_client, + ), + ): + from prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets import ( + ecr_repository_image_no_secrets, + ) + + check = ecr_repository_image_no_secrets() + result = check.execute() + + assert len(result) == 0 + + def test_clean_image(self): + """An image with no secrets passes.""" + repository = create_repository() + image = create_image() + scan_data = ImageScanData( + env=["PATH=/usr/bin"], + history=["RUN echo hello"], + files=[], + truncated=False, + ) + + ecr_client = mock.MagicMock() + ecr_client.registries = {} + ecr_client.audit_config = { + "secrets_ignore_patterns": [], + "secrets_validate": False, + } + ecr_client._get_image_scan_data = mock_image_scan_data( + [(repository, image, scan_data)] + ) + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_aws_provider(), + ), + mock.patch( + "prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets.ecr_client", + new=ecr_client, + ), + ): + from prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets import ( + ecr_repository_image_no_secrets, + ) + + check = ecr_repository_image_no_secrets() + result = check.execute() + + digest_short = image.latest_digest.split(":")[-1][:12] + assert len(result) == 1 + assert result[0].status == "PASS" + assert result[0].status_extended == ( + f"No secrets found in the image '{image.latest_tag}' " + f"({image.latest_digest}) of ECR repository {repository.name}." + ) + assert result[0].region == AWS_REGION_US_EAST_1 + assert ( + result[0].resource_id + == f"{repository.name}:{image.latest_tag}@{digest_short}" + ) + assert result[0].resource_arn == f"{repository.arn}/image/{digest_short}" + + def test_truncated_image_reports_manual(self): + """A clean but truncated image is MANUAL, since part was not scanned.""" + repository = create_repository() + image = create_image() + scan_data = ImageScanData(env=[], history=[], files=[], truncated=True) + + ecr_client = mock.MagicMock() + ecr_client.registries = {} + ecr_client.audit_config = { + "secrets_ignore_patterns": [], + "secrets_validate": False, + } + ecr_client._get_image_scan_data = mock_image_scan_data( + [(repository, image, scan_data)] + ) + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_aws_provider(), + ), + mock.patch( + "prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets.ecr_client", + new=ecr_client, + ), + ): + from prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets import ( + ecr_repository_image_no_secrets, + ) + + check = ecr_repository_image_no_secrets() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "MANUAL" + assert ( + "part of it could not be retrieved or exceeded configured size " + "limits and was not scanned" in result[0].status_extended + ) + + def test_secret_in_environment_variable(self): + """A secret in an environment variable fails, naming the variable.""" + from prowler.lib.check.models import Severity + + repository = create_repository() + image = create_image() + scan_data = ImageScanData( + env=["PATH=/usr/bin", f"DB_PASSWORD={SECRET_VALUE}"], + history=[], + files=[], + truncated=False, + ) + + ecr_client = mock.MagicMock() + ecr_client.registries = {} + ecr_client.audit_config = { + "secrets_ignore_patterns": [], + "secrets_validate": False, + } + ecr_client._get_image_scan_data = mock_image_scan_data( + [(repository, image, scan_data)] + ) + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_aws_provider(), + ), + mock.patch( + "prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets.ecr_client", + new=ecr_client, + ), + ): + from prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets import ( + ecr_repository_image_no_secrets, + ) + + check = ecr_repository_image_no_secrets() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "FAIL" + assert "environment variable DB_PASSWORD" in result[0].status_extended + assert SECRET_VALUE not in result[0].status_extended + assert result[0].check_metadata.Severity == Severity.high + + def test_secret_in_malformed_env_entry_is_redacted(self): + """An env entry without '=' is reported generically, never echoed.""" + repository = create_repository() + image = create_image() + # The entry has no "=" so no variable name can be split out; the entry + # itself is the secret and must not appear in the finding. + scan_data = ImageScanData( + env=[SECRET_VALUE], + history=[], + files=[], + truncated=False, + ) + + ecr_client = mock.MagicMock() + ecr_client.registries = {} + ecr_client.audit_config = { + "secrets_ignore_patterns": [], + "secrets_validate": False, + } + ecr_client._get_image_scan_data = mock_image_scan_data( + [(repository, image, scan_data)] + ) + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_aws_provider(), + ), + mock.patch( + "prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets.ecr_client", + new=ecr_client, + ), + ): + from prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets import ( + ecr_repository_image_no_secrets, + ) + + check = ecr_repository_image_no_secrets() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "FAIL" + assert "in image environment variables" in result[0].status_extended + assert SECRET_VALUE not in result[0].status_extended + + def test_secret_in_unsafe_environment_name_is_redacted(self): + """An unsafe name before '=' is never included in report text.""" + repository = create_repository() + image = create_image() + scan_data = ImageScanData( + env=[f"{SECRET_VALUE}=safe-value"], + history=[], + files=[], + truncated=False, + ) + + ecr_client = mock.MagicMock() + ecr_client.registries = {} + ecr_client.audit_config = { + "secrets_ignore_patterns": [], + "secrets_validate": False, + } + ecr_client._get_image_scan_data = mock_image_scan_data( + [(repository, image, scan_data)] + ) + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_aws_provider(), + ), + mock.patch( + "prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets.ecr_client", + new=ecr_client, + ), + ): + from prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets import ( + ecr_repository_image_no_secrets, + ) + + result = ecr_repository_image_no_secrets().execute() + + assert len(result) == 1 + assert result[0].status == "FAIL" + assert "in image environment variables" in result[0].status_extended + assert SECRET_VALUE not in str(vars(result[0])) + + def test_scanned_file_content_is_freed_after_execute(self): + """File contents are released after scanning so memory stays flat.""" + repository = create_repository() + image = create_image() + scanned_file = ImageScanFile( + path="app/config.py", + layer_digest=f"sha256:{'a' * 64}", + content="nothing secret here", + ) + scan_data = ImageScanData( + env=[], history=[], files=[scanned_file], truncated=False + ) + + ecr_client = mock.MagicMock() + ecr_client.registries = {} + ecr_client.audit_config = { + "secrets_ignore_patterns": [], + "secrets_validate": False, + } + ecr_client._get_image_scan_data = mock_image_scan_data( + [(repository, image, scan_data)] + ) + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_aws_provider(), + ), + mock.patch( + "prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets.ecr_client", + new=ecr_client, + ), + ): + from prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets import ( + ecr_repository_image_no_secrets, + ) + + check = ecr_repository_image_no_secrets() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "PASS" + # The check empties each file's content once it is handed to the + # scanner; only path and layer digest are needed thereafter. + assert scanned_file.content == "" + + def test_secrets_ignore_patterns_suppresses_finding(self): + """A secret matching an ignore pattern is suppressed.""" + repository = create_repository() + image = create_image() + scan_data = ImageScanData( + env=["PATH=/usr/bin", f"DB_PASSWORD={SECRET_VALUE}"], + history=[], + files=[], + truncated=False, + ) + + ecr_client = mock.MagicMock() + ecr_client.registries = {} + ecr_client.audit_config = { + "secrets_ignore_patterns": [SECRET_VALUE], + "secrets_validate": False, + } + ecr_client._get_image_scan_data = mock_image_scan_data( + [(repository, image, scan_data)] + ) + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_aws_provider(), + ), + mock.patch( + "prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets.ecr_client", + new=ecr_client, + ), + ): + from prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets import ( + ecr_repository_image_no_secrets, + ) + + check = ecr_repository_image_no_secrets() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "PASS" + + def test_secret_in_build_history(self): + """A secret in a build history step fails, naming the step.""" + repository = create_repository() + image = create_image() + scan_data = ImageScanData( + env=[], + history=["RUN apt-get update", f'RUN export TOKEN="{SECRET_VALUE}"'], + files=[], + truncated=False, + ) + + ecr_client = mock.MagicMock() + ecr_client.registries = {} + ecr_client.audit_config = { + "secrets_ignore_patterns": [], + "secrets_validate": False, + } + ecr_client._get_image_scan_data = mock_image_scan_data( + [(repository, image, scan_data)] + ) + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_aws_provider(), + ), + mock.patch( + "prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets.ecr_client", + new=ecr_client, + ), + ): + from prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets import ( + ecr_repository_image_no_secrets, + ) + + check = ecr_repository_image_no_secrets() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "FAIL" + assert "image history step 2" in result[0].status_extended + assert SECRET_VALUE not in result[0].status_extended + + def test_multiline_environment_secret_keeps_entry_attribution(self): + """Embedded newlines do not shift an env finding to another entry.""" + repository = create_repository() + image = create_image() + scan_data = ImageScanData( + env=[f"MULTILINE=prefix\r\n{SECRET_VALUE}", "WRONG=value"], + history=[], + files=[], + truncated=False, + ) + ecr_client = mock.MagicMock() + ecr_client.registries = {} + ecr_client.audit_config = { + "secrets_ignore_patterns": [], + "secrets_validate": False, + } + ecr_client._get_image_scan_data = mock_image_scan_data( + [(repository, image, scan_data)] + ) + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_aws_provider(), + ), + mock.patch( + "prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets.ecr_client", + new=ecr_client, + ), + ): + from prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets import ( + ecr_repository_image_no_secrets, + ) + + result = ecr_repository_image_no_secrets().execute() + + assert "environment variable MULTILINE" in result[0].status_extended + assert "environment variable WRONG" not in result[0].status_extended + + def test_multiline_history_secret_keeps_step_attribution(self): + """Embedded newlines do not shift a history finding to another step.""" + repository = create_repository() + image = create_image() + scan_data = ImageScanData( + env=[], + history=[f"RUN first\nexport TOKEN={SECRET_VALUE}", "RUN second"], + files=[], + truncated=False, + ) + ecr_client = mock.MagicMock() + ecr_client.registries = {} + ecr_client.audit_config = { + "secrets_ignore_patterns": [], + "secrets_validate": False, + } + ecr_client._get_image_scan_data = mock_image_scan_data( + [(repository, image, scan_data)] + ) + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_aws_provider(), + ), + mock.patch( + "prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets.ecr_client", + new=ecr_client, + ), + ): + from prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets import ( + ecr_repository_image_no_secrets, + ) + + result = ecr_repository_image_no_secrets().execute() + + assert "image history step 1" in result[0].status_extended + assert "image history step 2" not in result[0].status_extended + + def test_secret_in_layer_file(self): + """A secret in a layer file fails, naming the file and layer.""" + repository = create_repository() + image = create_image() + layer_digest = f"sha256:{'a' * 64}" + scan_data = ImageScanData( + env=[], + history=[], + files=[ + ImageScanFile( + path="app/config.py", + layer_digest=layer_digest, + content=f'TOKEN = "{SECRET_VALUE}"', + ) + ], + truncated=False, + ) + + ecr_client = mock.MagicMock() + ecr_client.registries = {} + ecr_client.audit_config = { + "secrets_ignore_patterns": [], + "secrets_validate": False, + } + ecr_client._get_image_scan_data = mock_image_scan_data( + [(repository, image, scan_data)] + ) + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_aws_provider(), + ), + mock.patch( + "prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets.ecr_client", + new=ecr_client, + ), + ): + from prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets import ( + ecr_repository_image_no_secrets, + ) + + check = ecr_repository_image_no_secrets() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "FAIL" + assert "file app/config.py" in result[0].status_extended + assert layer_digest in result[0].status_extended + assert SECRET_VALUE not in result[0].status_extended + + def test_manifest_unresolvable(self): + """An unresolvable manifest is reported as MANUAL.""" + repository = create_repository() + image = create_image() + + ecr_client = mock.MagicMock() + ecr_client.registries = {} + ecr_client.audit_config = { + "secrets_ignore_patterns": [], + "secrets_validate": False, + } + ecr_client._get_image_scan_data = mock_image_scan_data( + [(repository, image, None)] + ) + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_aws_provider(), + ), + mock.patch( + "prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets.ecr_client", + new=ecr_client, + ), + ): + from prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets import ( + ecr_repository_image_no_secrets, + ) + + check = ecr_repository_image_no_secrets() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "MANUAL" + assert ( + "Could not resolve or retrieve the manifest" + in result[0].status_extended + ) + + def test_latest_image_lookup_error_reports_repository_manual(self): + """A failed authoritative image lookup is reported for the repository.""" + repository = create_repository() + lookup_error = RuntimeError("authoritative lookup failed") + ecr_client = mock.MagicMock() + ecr_client.audit_config = { + "secrets_ignore_patterns": [], + "secrets_validate": False, + } + ecr_client._get_image_scan_data = mock_image_scan_data( + [(repository, None, lookup_error)] + ) + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_aws_provider(), + ), + mock.patch( + "prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets.ecr_client", + new=ecr_client, + ), + ): + from prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets import ( + ecr_repository_image_no_secrets, + ) + + result = ecr_repository_image_no_secrets().execute() + + assert result[0].status == "MANUAL" + assert "Could not determine the latest image" in result[0].status_extended + + def test_scan_error_reports_manual_for_latest_image_per_repository(self): + """A scanner failure reports MANUAL once per repository's latest image.""" + from prowler.lib.utils.utils import SecretsScanError + + # Each repository has multiple images; the scan-error fallback must + # scope to the latest image per repository only, mirroring the + # success-path scope, not emit one MANUAL per image. + repo1 = create_repository(name="repo-1") + repo1.images_details = [ + create_image(tag="v1", digest=f"sha256:{'1' * 64}"), + create_image(tag="v2", digest=f"sha256:{'2' * 64}"), + ] + repo2 = create_repository(name="repo-2") + repo2.images_details = [ + create_image(tag="v1", digest=f"sha256:{'3' * 64}"), + create_image(tag="v2", digest=f"sha256:{'4' * 64}"), + ] + registry = Registry( + id=AWS_ACCOUNT_NUMBER, + arn=f"arn:aws:ecr:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:registry/{AWS_ACCOUNT_NUMBER}", + region=AWS_REGION_US_EAST_1, + repositories=[repo1, repo2], + ) + + ecr_client = mock.MagicMock() + ecr_client.registries = {AWS_REGION_US_EAST_1: registry} + ecr_client.audit_config = { + "secrets_ignore_patterns": [], + "secrets_validate": False, + } + # Not consumed on this path, but must be a real generator to iterate. + ecr_client._get_image_scan_data = mock_image_scan_data([]) + # The error fallback resolves each repository's scan target via + # _get_scan_target_image; mirror the real method's latest-image scope. + ecr_client._get_scan_target_image.side_effect = lambda repository: ( + repository.images_details[-1] if repository.images_details else None + ) + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_aws_provider(), + ), + mock.patch( + "prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets.ecr_client", + new=ecr_client, + ), + mock.patch( + "prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets.detect_secrets_scan_batch", + side_effect=SecretsScanError("Scanner failure"), + ), + ): + from prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets import ( + ecr_repository_image_no_secrets, + ) + + check = ecr_repository_image_no_secrets() + result = check.execute() + + # One MANUAL per repository (its latest image), not one per image. + assert len(result) == 2 + for report in result: + assert report.status == "MANUAL" + assert "Could not scan image" in report.status_extended + assert "Scanner failure" in report.status_extended + + digests_reported = {report.resource_id.split("@")[-1] for report in result} + latest_digest_repo1 = repo1.images_details[-1].latest_digest.split(":")[-1][ + :12 + ] + latest_digest_repo2 = repo2.images_details[-1].latest_digest.split(":")[-1][ + :12 + ] + assert digests_reported == {latest_digest_repo1, latest_digest_repo2} + assert "Scanner failure" in result[0].status_extended + + def test_verified_secret_escalates_to_critical(self): + """A verified secret escalates severity to critical.""" + from prowler.lib.check.models import Severity + + repository = create_repository() + image = create_image() + scan_data = ImageScanData( + env=[f"TOKEN={SECRET_VALUE}"], history=[], files=[], truncated=False + ) + + ecr_client = mock.MagicMock() + ecr_client.registries = {} + ecr_client.audit_config = { + "secrets_ignore_patterns": [], + "secrets_validate": True, + } + ecr_client._get_image_scan_data = mock_image_scan_data( + [(repository, image, scan_data)] + ) + + def fake_scan_batch(payloads, **kwargs): + # The real detect_secrets_scan_batch consumes the lazily-yielded + # payloads generator as a side effect (that's what populates the + # check's `scanned` list); replicate that here while returning + # a controlled, pre-verified finding. + """Drain the payload generator like the real scanner, then return canned findings.""" + list(payloads) + return { + (0, "environment:0"): [ + { + "type": "JSON Web Token (base64url-encoded)", + "line_number": 1, + "is_verified": True, + } + ] + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_aws_provider(), + ), + mock.patch( + "prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets.ecr_client", + new=ecr_client, + ), + mock.patch( + "prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets.detect_secrets_scan_batch", + side_effect=fake_scan_batch, + ) as mock_scan, + ): + from prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets import ( + ecr_repository_image_no_secrets, + ) + + check = ecr_repository_image_no_secrets() + result = check.execute() + + assert mock_scan.call_args.kwargs.get("validate") is True + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].check_metadata.Severity == Severity.critical + assert "confirmed to be live" in result[0].status_extended + + def test_multiple_repositories_and_images(self): + """Mixed pass/fail results are reported across multiple repositories.""" + repo1 = create_repository(name="repo-1") + repo2 = create_repository(name="repo-2") + image1 = create_image(tag="v1", digest=f"sha256:{'1' * 64}") + image2 = create_image(tag="v2", digest=f"sha256:{'2' * 64}") + + clean_scan = ImageScanData(env=[], history=[], files=[], truncated=False) + fail_scan = ImageScanData( + env=[f"DB_PASSWORD={SECRET_VALUE}"], + history=[], + files=[], + truncated=False, + ) + + ecr_client = mock.MagicMock() + ecr_client.registries = {} + ecr_client.audit_config = { + "secrets_ignore_patterns": [], + "secrets_validate": False, + } + ecr_client._get_image_scan_data = mock_image_scan_data( + [(repo1, image1, clean_scan), (repo2, image2, fail_scan)] + ) + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_aws_provider(), + ), + mock.patch( + "prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets.ecr_client", + new=ecr_client, + ), + ): + from prowler.providers.aws.services.ecr.ecr_repository_image_no_secrets.ecr_repository_image_no_secrets import ( + ecr_repository_image_no_secrets, + ) + + check = ecr_repository_image_no_secrets() + result = check.execute() + + assert len(result) == 2 + statuses_by_repo = {r.resource_id.split(":")[0]: r.status for r in result} + assert statuses_by_repo["repo-1"] == "PASS" + assert statuses_by_repo["repo-2"] == "FAIL" + report_by_repo = {r.resource_id.split(":")[0]: r for r in result} + assert SECRET_VALUE not in report_by_repo["repo-2"].status_extended diff --git a/tests/providers/aws/services/ecr/ecr_service_test.py b/tests/providers/aws/services/ecr/ecr_service_test.py index 60f2e0e7ec..9181d6e8d8 100644 --- a/tests/providers/aws/services/ecr/ecr_service_test.py +++ b/tests/providers/aws/services/ecr/ecr_service_test.py @@ -1,11 +1,21 @@ +import json +from concurrent.futures import Future from datetime import datetime -from unittest.mock import patch +from unittest.mock import MagicMock, patch import botocore +import pytest from boto3 import client from moto import mock_aws -from prowler.providers.aws.services.ecr.ecr_service import ECR, ScanningRule +from prowler.providers.aws.services.ecr.ecr_service import ( + ECR, + ScanningRule, +) +from tests.providers.aws.services.ecr.image_scan_fixtures import ( + MANIFESTS_BY_DIGEST, + reset_image_fixtures, +) from tests.providers.aws.utils import ( AWS_ACCOUNT_NUMBER, AWS_REGION_EU_WEST_1, @@ -18,8 +28,20 @@ repo_name = "test-repo" # Mocking Access Analyzer Calls make_api_call = botocore.client.BaseClient._make_api_call +# BatchGetImage / GetDownloadUrlForLayer fixtures (which moto does not +# implement) live in image_scan_fixtures and are served by mock_make_api_call. + + +@pytest.fixture(autouse=True) +def _reset_image_fixtures(): + """Isolate the BatchGetImage/GetDownloadUrlForLayer fixtures per test.""" + reset_image_fixtures() + yield + reset_image_fixtures() + def mock_make_api_call(self, operation_name, kwarg): + """Fake botocore responses for the ECR operations this suite exercises.""" if operation_name == "DescribeImages": return { "imageDetails": [ @@ -150,10 +172,37 @@ def mock_make_api_call(self, operation_name, kwarg): }, } + if operation_name == "BatchGetImage": + digest = kwarg["imageIds"][0]["imageDigest"] + manifest = MANIFESTS_BY_DIGEST.get(digest) + if manifest is None: + return { + "images": [], + "failures": [ + { + "imageId": {"imageDigest": digest}, + "failureCode": "ImageNotFound", + } + ], + } + return { + "images": [ + { + "imageManifest": json.dumps(manifest), + "imageManifestMediaType": manifest.get("mediaType", ""), + } + ] + } + + if operation_name == "GetDownloadUrlForLayer": + digest = kwarg["layerDigest"] + return {"downloadUrl": f"https://layers.example.com/{digest}"} + return make_api_call(self, operation_name, kwarg) def mock_generate_regional_clients(provider, service): + """Return a single regional client for every requested region.""" regional_client = provider._session.current_session.client( service, region_name=AWS_REGION_EU_WEST_1 ) @@ -169,13 +218,17 @@ def mock_generate_regional_clients(provider, service): ) class Test_ECR_Service: # Test ECR Service + """Tests for the ECR service.""" + def test_service(self): + """The service name is set correctly.""" aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) ecr = ECR(aws_provider) assert ecr.service == "ecr" # Test ECR client def test_client(self): + """Each regional client is an ECR client.""" aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) ecr = ECR(aws_provider) for regional_client in ecr.regional_clients.values(): @@ -183,6 +236,7 @@ class Test_ECR_Service: # Test ECR session def test_get_session(self): + """The session is set correctly.""" aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) ecr = ECR(aws_provider) assert ecr.session.__class__.__name__ == "Session" @@ -190,6 +244,7 @@ class Test_ECR_Service: # Test describe ECR repositories @mock_aws def test_describe_registries_and_repositories(self): + """Registries and repositories are discovered.""" ecr_client = client("ecr", region_name=AWS_REGION_EU_WEST_1) ecr_client.create_repository( repositoryName=repo_name, @@ -220,6 +275,7 @@ class Test_ECR_Service: # Test describe ECR repository policies @mock_aws def test_describe_repository_policies(self): + """Repository policies are fetched and parsed.""" ecr_client = client("ecr", region_name=AWS_REGION_EU_WEST_1) ecr_client.create_repository( repositoryName=repo_name, @@ -249,6 +305,7 @@ class Test_ECR_Service: # Test describe ECR repository lifecycle policies @mock_aws def test_get_lifecycle_policies(self): + """Repository lifecycle policies are fetched.""" ecr_client = client("ecr", region_name=AWS_REGION_EU_WEST_1) ecr_client.create_repository( repositoryName=repo_name, @@ -268,6 +325,7 @@ class Test_ECR_Service: # Test get image details @mock_aws def test_get_image_details(self): + """Scannable, tagged images are collected and sorted by push date.""" ecr_client = client("ecr", region_name=AWS_REGION_EU_WEST_1) ecr_client.create_repository( repositoryName=repo_name, @@ -366,6 +424,7 @@ class Test_ECR_Service: # Test get ECR Registries Scanning Configuration @mock_aws def test_get_registry_scanning_configuration(self): + """The registry's scanning configuration is fetched.""" aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) ecr = ECR(aws_provider) assert len(ecr.registries) == 1 @@ -379,39 +438,188 @@ class Test_ECR_Service: ] def test_is_artifact_scannable_docker(self): + """A Docker image config is scannable.""" assert ECR._is_artifact_scannable( "application/vnd.docker.container.image.v1+json" ) def test_is_artifact_scannable_layer_tar(self): + """An uncompressed Docker layer is scannable.""" assert ECR._is_artifact_scannable( "application/vnd.docker.image.rootfs.diff.tar" ) def test_is_artifact_scannable_layer_gzip(self): + """A gzip-compressed Docker layer is scannable.""" assert ECR._is_artifact_scannable( "application/vnd.docker.image.rootfs.diff.tar.gzip" ) def test_is_artifact_scannable_oci(self): + """An OCI image config is scannable.""" assert ECR._is_artifact_scannable("application/vnd.oci.image.config.v1+json") def test_is_artifact_scannable_oci_tar(self): + """An uncompressed OCI layer is scannable.""" assert ECR._is_artifact_scannable("application/vnd.oci.image.layer.v1.tar") def test_is_artifact_scannable_oci_compressed(self): + """A gzip-compressed OCI layer is scannable.""" assert ECR._is_artifact_scannable("application/vnd.oci.image.layer.v1.tar+gzip") def test_is_artifact_scannable_none(self): + """A missing media type is not scannable.""" assert not ECR._is_artifact_scannable(None) def test_is_artifact_scannable_empty(self): + """An empty media type is not scannable.""" assert not ECR._is_artifact_scannable("") def test_is_artifact_scannable_non_scannable_tags(self): + """A signature-tagged artifact is not scannable.""" assert not ECR._is_artifact_scannable("", ["sha256-abcdefg123456.sig"]) def test_is_artifact_scannable_scannable_tags(self): + """A normally-tagged artifact is scannable.""" assert ECR._is_artifact_scannable( "application/vnd.docker.container.image.v1+json", ["abcdefg123456"] ) + + @mock_aws + def test_get_image_scan_data_selects_only_latest_image_per_repository(self): + """Only the latest image per repository is selected for scanning.""" + ecr_client_boto = client("ecr", region_name=AWS_REGION_EU_WEST_1) + ecr_client_boto.create_repository( + repositoryName=repo_name, + imageScanningConfiguration={"scanOnPush": True}, + ) + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + ecr = ECR(aws_provider) + + repository = ecr.registries[AWS_REGION_EU_WEST_1].repositories[0] + # Sanity check: this repository has several scannable tagged images. + assert len(repository.images_details) == 4 + + results = list(ecr._get_image_scan_data()) + + # Only the most recently pushed image is selected, not all four. + assert len(results) == 1 + fetched_repository, fetched_image, _ = results[0] + assert fetched_repository.name == repo_name + assert fetched_image.latest_tag == "test-tag4" + assert ( + fetched_image.latest_digest + == "sha256:43251ac64627fc331584f6c498b3aba5badc01574e2c70b2499af3af16630eed" + ) + + @mock_aws + def test_get_image_scan_data_covers_scan_on_push_disabled_repository(self): + """A scan-on-push-disabled repo (empty images_details) is still scanned.""" + ecr_client_boto = client("ecr", region_name=AWS_REGION_EU_WEST_1) + ecr_client_boto.create_repository( + repositoryName=repo_name, + imageScanningConfiguration={"scanOnPush": False}, + ) + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + ecr = ECR(aws_provider) + + repository = ecr.registries[AWS_REGION_EU_WEST_1].repositories[0] + # Scan-on-push disabled: the metadata pass leaves images_details empty... + assert repository.scan_on_push is False + assert repository.images_details == [] + + # ...yet the secret-scan path resolves the latest image via a dedicated + # describe_images lookup, so the repository is not silently skipped. + results = list(ecr._get_image_scan_data()) + + assert len(results) == 1 + fetched_repository, fetched_image, _ = results[0] + assert fetched_repository.name == repo_name + assert fetched_image.latest_tag == "test-tag4" + # The dedicated lookup must NOT mutate the shared images_details, or + # other checks would treat this repo as having a scanned image. + assert repository.images_details == [] + + @mock_aws + def test_get_image_scan_data_bounds_submitted_futures(self): + """Image fetches are submitted only as earlier results are consumed.""" + ecr_client_boto = client("ecr", region_name=AWS_REGION_EU_WEST_1) + for index in range(10): + ecr_client_boto.create_repository( + repositoryName=f"{repo_name}-{index}", + imageScanningConfiguration={"scanOnPush": True}, + ) + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + ecr = ECR(aws_provider) + repositories = ecr.registries[AWS_REGION_EU_WEST_1].repositories + + executor = MagicMock() + executor.__enter__.return_value = executor + futures = [] + + def submit(*_args): + future = Future() + futures.append(future) + if len(futures) == 1: + future.set_result(None) + return future + + executor.submit.side_effect = submit + with patch( + "prowler.providers.aws.services.ecr.ecr_service.ThreadPoolExecutor", + return_value=executor, + ): + results = ecr._get_image_scan_data() + first_result = next(results) + + assert first_result[0] == repositories[0] + assert ( + first_result[1].latest_digest + == repositories[0].images_details[-1].latest_digest + ) + assert executor.submit.call_count == 4 + + @mock_aws + def test_get_scan_target_image_ignores_stale_scanned_image(self): + """Secret scanning selects a newer image absent from scan findings.""" + ecr_client_boto = client("ecr", region_name=AWS_REGION_EU_WEST_1) + ecr_client_boto.create_repository( + repositoryName=repo_name, + imageScanningConfiguration={"scanOnPush": True}, + ) + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + ecr = ECR(aws_provider) + repository = ecr.registries[AWS_REGION_EU_WEST_1].repositories[0] + older_scanned_image = repository.images_details[0] + repository.images_details = [older_scanned_image] + + target = ecr._get_scan_target_image(repository) + + assert target.latest_tag == "test-tag4" + assert target.image_pushed_at > older_scanned_image.image_pushed_at + + @mock_aws + def test_get_scan_target_image_lookup_failure_rejects_stale_image(self): + """A failed authoritative lookup does not select cached scan metadata.""" + ecr_client_boto = client("ecr", region_name=AWS_REGION_EU_WEST_1) + ecr_client_boto.create_repository( + repositoryName=repo_name, + imageScanningConfiguration={"scanOnPush": True}, + ) + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + ecr = ECR(aws_provider) + repository = ecr.registries[AWS_REGION_EU_WEST_1].repositories[0] + repository.images_details = [repository.images_details[0]] + + with patch.object( + ecr.regional_clients[AWS_REGION_EU_WEST_1], + "get_paginator", + side_effect=RuntimeError("authoritative lookup failed"), + ): + target = ecr._get_scan_target_image(repository) + scan_results = list(ecr._get_image_scan_data()) + + assert isinstance(target, RuntimeError) + assert len(scan_results) == 1 + _, result_image, result_error = scan_results[0] + assert result_image is None and isinstance(result_error, RuntimeError) diff --git a/tests/providers/aws/services/ecr/image_inspection_test.py b/tests/providers/aws/services/ecr/image_inspection_test.py new file mode 100644 index 0000000000..8d681bf354 --- /dev/null +++ b/tests/providers/aws/services/ecr/image_inspection_test.py @@ -0,0 +1,512 @@ +import gzip +import json +import random +import tarfile +from io import BytesIO +from unittest.mock import patch + +import botocore +import pytest +import zstandard +from boto3 import client +from moto import mock_aws + +from prowler.providers.aws.services.ecr.image_inspection import ( + MAX_FILE_BYTES, + MAX_LAYER_DOWNLOAD_BYTES, + ImageInspector, + _CappedLayerReader, + _LayerTooLargeError, +) +from tests.providers.aws.services.ecr.image_scan_fixtures import ( + BLOBS_BY_DIGEST, + CHILD_AMD64_DIGEST, + CHILD_ARM64_DIGEST, + CONFIG_DIGEST, + CONFIG_JSON, + IMAGE_DIGEST, + LAYER_DIGEST, + MANIFESTS_BY_DIGEST, + MULTI_ARCH_INDEX_DIGEST, + MULTI_ARCH_MANIFEST_LIST, + SIMPLE_MANIFEST, + build_gzip_tar, + build_tar, + mock_requests_get, + reset_image_fixtures, +) +from tests.providers.aws.utils import ( + AWS_ACCOUNT_NUMBER, + AWS_REGION_EU_WEST_1, +) + +REPO_NAME = "test-repo" + +_original_make_api_call = botocore.client.BaseClient._make_api_call + +_REQUESTS_GET = "prowler.providers.aws.services.ecr.image_inspection.requests.get" + + +def mock_make_api_call(self, operation_name, kwarg): + """Serve BatchGetImage/GetDownloadUrlForLayer from fixtures; delegate the rest. + + moto implements neither operation, so they are answered from the per-test + ``MANIFESTS_BY_DIGEST`` fixtures; every other call falls through to the real + (moto-backed) implementation. + """ + if operation_name == "BatchGetImage": + digest = kwarg["imageIds"][0]["imageDigest"] + manifest = MANIFESTS_BY_DIGEST.get(digest) + if manifest is None: + return { + "images": [], + "failures": [ + { + "imageId": {"imageDigest": digest}, + "failureCode": "ImageNotFound", + } + ], + } + return { + "images": [ + { + "imageManifest": json.dumps(manifest), + "imageManifestMediaType": manifest.get("mediaType", ""), + } + ] + } + if operation_name == "GetDownloadUrlForLayer": + digest = kwarg["layerDigest"] + return {"downloadUrl": f"https://layers.example.com/{digest}"} + return _original_make_api_call(self, operation_name, kwarg) + + +@patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call) +class Test_ImageInspector: + """Tests for the bounded image-content extraction in image_inspection.""" + + @pytest.fixture(autouse=True) + def _reset_image_fixtures(self): + """Isolate the BatchGetImage/GetDownloadUrlForLayer fixtures per test.""" + reset_image_fixtures() + yield + reset_image_fixtures() + + @staticmethod + def _fetch(digest=IMAGE_DIGEST): + """Fetch scan data for one image, with the layer download stubbed.""" + ecr_client = client("ecr", region_name=AWS_REGION_EU_WEST_1) + with patch(_REQUESTS_GET, new=mock_requests_get): + return ImageInspector().fetch_image_scan_data( + ecr_client, AWS_ACCOUNT_NUMBER, REPO_NAME, digest + ) + + @mock_aws + def test_fetch_image_scan_data_simple_image(self): + """A single-manifest image's config and layer file are scanned.""" + MANIFESTS_BY_DIGEST[IMAGE_DIGEST] = SIMPLE_MANIFEST + BLOBS_BY_DIGEST[CONFIG_DIGEST] = json.dumps(CONFIG_JSON).encode() + BLOBS_BY_DIGEST[LAYER_DIGEST] = build_gzip_tar({"app/config.py": "TOKEN = 'x'"}) + + scan_data = self._fetch() + + assert scan_data is not None + assert scan_data.env == ["PATH=/usr/bin", "TOKEN=super-secret-value"] + assert scan_data.history == ["/bin/sh -c #(nop) ADD file", "RUN echo hi"] + assert len(scan_data.files) == 1 + assert scan_data.files[0].path == "app/config.py" + assert scan_data.files[0].layer_digest == LAYER_DIGEST + assert scan_data.files[0].content == "TOKEN = 'x'" + assert scan_data.truncated is False + + @mock_aws + def test_fetch_image_scan_data_resolves_multi_arch_manifest(self): + """A multi-arch scan is incomplete when only one child is inspected.""" + MANIFESTS_BY_DIGEST[MULTI_ARCH_INDEX_DIGEST] = MULTI_ARCH_MANIFEST_LIST + MANIFESTS_BY_DIGEST[CHILD_AMD64_DIGEST] = SIMPLE_MANIFEST + BLOBS_BY_DIGEST[CONFIG_DIGEST] = json.dumps(CONFIG_JSON).encode() + BLOBS_BY_DIGEST[LAYER_DIGEST] = build_gzip_tar({"app/config.py": "TOKEN = 'x'"}) + + scan_data = self._fetch(digest=MULTI_ARCH_INDEX_DIGEST) + + # Only the amd64/linux child manifest is resolved and scanned; the + # arm64 and attestation entries in the manifest list are ignored. + assert scan_data is not None + assert scan_data.env == ["PATH=/usr/bin", "TOKEN=super-secret-value"] + assert len(scan_data.files) == 1 + assert scan_data.files[0].path == "app/config.py" + assert scan_data.truncated is True + + @mock_aws + def test_fetch_image_scan_data_skips_oversized_layer(self): + """A layer over the size cap is skipped, not downloaded.""" + oversized_manifest = { + "schemaVersion": 2, + "mediaType": "application/vnd.docker.distribution.manifest.v2+json", + "config": {"digest": CONFIG_DIGEST, "size": 10}, + "layers": [ + { + "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", + "digest": LAYER_DIGEST, + "size": MAX_LAYER_DOWNLOAD_BYTES + 1, + } + ], + } + MANIFESTS_BY_DIGEST[IMAGE_DIGEST] = oversized_manifest + BLOBS_BY_DIGEST[CONFIG_DIGEST] = json.dumps(CONFIG_JSON).encode() + + scan_data = self._fetch() + + # The oversized layer is never downloaded (only the config blob is in + # BLOBS_BY_DIGEST), yet the fetch completes without raising. + assert scan_data is not None + assert scan_data.files == [] + assert scan_data.truncated is True + + @mock_aws + def test_fetch_image_scan_data_manifest_not_found_returns_none(self): + """An unknown digest resolves to no scan data.""" + ecr_client = client("ecr", region_name=AWS_REGION_EU_WEST_1) + + scan_data = ImageInspector().fetch_image_scan_data( + ecr_client, AWS_ACCOUNT_NUMBER, REPO_NAME, f"sha256:{'f' * 64}" + ) + + assert scan_data is None + + @mock_aws + def test_fetch_image_scan_data_config_download_failure_marks_truncated(self): + """A config blob that cannot be retrieved marks coverage incomplete. + + Empty env/history would otherwise be indistinguishable from a clean + config, so the fetch flags the result as truncated rather than risking + a false PASS at the check level. + """ + MANIFESTS_BY_DIGEST[IMAGE_DIGEST] = SIMPLE_MANIFEST + # Register the layer but NOT the config blob, so the config download + # fails while the layer is still scanned cleanly. + BLOBS_BY_DIGEST[LAYER_DIGEST] = build_gzip_tar({"app/config.py": "clean"}) + + scan_data = self._fetch() + + assert scan_data is not None + assert scan_data.env == [] + assert scan_data.history == [] + assert scan_data.truncated is True + assert [f.path for f in scan_data.files] == ["app/config.py"] + + @mock_aws + def test_fetch_image_scan_data_member_over_remaining_budget_is_truncated(self): + """A layer exceeding the remaining stream budget is truncated. + + Tar headers and padding consume the authoritative decompressed-byte + budget before member payloads are exposed for scanning. + """ + MANIFESTS_BY_DIGEST[IMAGE_DIGEST] = SIMPLE_MANIFEST + BLOBS_BY_DIGEST[CONFIG_DIGEST] = json.dumps(CONFIG_JSON).encode() + BLOBS_BY_DIGEST[LAYER_DIGEST] = build_gzip_tar( + {"app/first.txt": "a" * 100, "app/second.txt": "b" * 5000} + ) + + ecr_client = client("ecr", region_name=AWS_REGION_EU_WEST_1) + with ( + patch(_REQUESTS_GET, new=mock_requests_get), + patch( + "prowler.providers.aws.services.ecr.image_inspection.MAX_TOTAL_BYTES_PER_IMAGE", + 1000, + ), + ): + scan_data = ImageInspector().fetch_image_scan_data( + ecr_client, AWS_ACCOUNT_NUMBER, REPO_NAME, IMAGE_DIGEST + ) + + assert scan_data is not None + assert scan_data.files == [] + assert scan_data.truncated is True + + @mock_aws + def test_fetch_image_scan_data_oversized_members_count_toward_budget(self): + """Members skipped for size still count toward the per-image budget. + + A streaming reader must decompress each member to advance past it, so + oversized-and-skipped members must still consume budget; otherwise a + layer of many just-over-limit files would decompress unbounded. The + loop must stop before reaching a later scannable member. + """ + MANIFESTS_BY_DIGEST[IMAGE_DIGEST] = SIMPLE_MANIFEST + BLOBS_BY_DIGEST[CONFIG_DIGEST] = json.dumps(CONFIG_JSON).encode() + # Ten 300-byte members (each over the patched 100-byte MAX_FILE_BYTES, + # so each is skipped for content) followed by a small, scannable file. + layer = {f"app/big{i}.bin": "x" * 300 for i in range(10)} + layer["app/reachable.txt"] = "hello" + BLOBS_BY_DIGEST[LAYER_DIGEST] = build_gzip_tar(layer) + + ecr_client = client("ecr", region_name=AWS_REGION_EU_WEST_1) + with ( + patch(_REQUESTS_GET, new=mock_requests_get), + patch( + "prowler.providers.aws.services.ecr.image_inspection.MAX_FILE_BYTES", + 100, + ), + patch( + "prowler.providers.aws.services.ecr.image_inspection.MAX_TOTAL_BYTES_PER_IMAGE", + 1000, + ), + ): + scan_data = ImageInspector().fetch_image_scan_data( + ecr_client, AWS_ACCOUNT_NUMBER, REPO_NAME, IMAGE_DIGEST + ) + + assert scan_data is not None + # The oversized members exhaust the 1000-byte budget after ~3 of them, + # so the loop stops before ever reaching app/reachable.txt. If skipped + # members were not counted, reachable.txt would be scanned. + assert scan_data.files == [] + assert scan_data.truncated is True + + @mock_aws + def test_fetch_image_scan_data_tar_over_stream_budget_is_truncated(self): + """Tar headers, padding, and non-files consume the image byte budget.""" + MANIFESTS_BY_DIGEST[IMAGE_DIGEST] = SIMPLE_MANIFEST + BLOBS_BY_DIGEST[CONFIG_DIGEST] = json.dumps(CONFIG_JSON).encode() + layer = BytesIO() + with tarfile.open(fileobj=layer, mode="w") as archive: + for index in range(20): + directory = tarfile.TarInfo(f"metadata-{index}/") + directory.type = tarfile.DIRTYPE + archive.addfile(directory) + content = b"x" + member = tarfile.TarInfo("app/reachable.txt") + member.size = len(content) + archive.addfile(member, BytesIO(content)) + BLOBS_BY_DIGEST[LAYER_DIGEST] = gzip.compress(layer.getvalue()) + + ecr_client = client("ecr", region_name=AWS_REGION_EU_WEST_1) + with ( + patch(_REQUESTS_GET, new=mock_requests_get), + patch( + "prowler.providers.aws.services.ecr.image_inspection.MAX_TOTAL_BYTES_PER_IMAGE", + 10 * 1024 - 1, + ), + ): + scan_data = ImageInspector().fetch_image_scan_data( + ecr_client, AWS_ACCOUNT_NUMBER, REPO_NAME, IMAGE_DIGEST + ) + + assert scan_data is not None + assert scan_data.files == [] + assert scan_data.truncated is True + + def test_select_child_manifest_digest_falls_back_to_non_amd64(self): + """With no amd64/linux entry, the first non-attestation candidate is picked.""" + manifest_list = { + "manifests": [ + { + "digest": CHILD_ARM64_DIGEST, + "platform": {"architecture": "arm64", "os": "linux"}, + }, + { + "digest": f"sha256:{'5' * 64}", + "platform": {"architecture": "unknown", "os": "unknown"}, + "annotations": { + "vnd.docker.reference.type": "attestation-manifest" + }, + }, + ] + } + + digest = ImageInspector._select_child_manifest_digest(manifest_list) + + assert digest == CHILD_ARM64_DIGEST + + @mock_aws + def test_fetch_image_scan_data_zstd_layer(self): + """A zstd-compressed layer is streamed, decompressed, and scanned.""" + zstd_manifest = { + "schemaVersion": 2, + "mediaType": "application/vnd.docker.distribution.manifest.v2+json", + "config": {"digest": CONFIG_DIGEST, "size": 100}, + "layers": [ + { + "mediaType": "application/vnd.oci.image.layer.v1.tar+zstd", + "digest": LAYER_DIGEST, + "size": 200, + } + ], + } + MANIFESTS_BY_DIGEST[IMAGE_DIGEST] = zstd_manifest + BLOBS_BY_DIGEST[CONFIG_DIGEST] = json.dumps(CONFIG_JSON).encode() + BLOBS_BY_DIGEST[LAYER_DIGEST] = zstandard.ZstdCompressor().compress( + build_tar({"app/config.py": "TOKEN = 'x'"}) + ) + + scan_data = self._fetch() + + assert scan_data is not None + assert len(scan_data.files) == 1 + assert scan_data.files[0].content == "TOKEN = 'x'" + + @mock_aws + def test_fetch_image_scan_data_zstd_layer_over_compressed_cap_is_truncated(self): + """A zstd layer whose compressed bytes exceed the cap is truncated. + + The streaming decompressor reads through a _CappedLayerReader, so a + layer whose compressed size exceeds MAX_LAYER_DOWNLOAD_BYTES (patched + here) is cut off and disclosed via truncated instead of being buffered + or decompressed unbounded. + """ + zstd_manifest = { + "schemaVersion": 2, + "mediaType": "application/vnd.docker.distribution.manifest.v2+json", + "config": {"digest": CONFIG_DIGEST, "size": 100}, + "layers": [ + { + "mediaType": "application/vnd.oci.image.layer.v1.tar+zstd", + "digest": LAYER_DIGEST, + # Declares zero size so it passes the pre-download check; + # the actual compressed bytes exceed the (patched) cap. + "size": 0, + } + ], + } + # Incompressible payload (so the compressed frame stays large), split + # across two members so the first is read before the cap trips while + # the second is streamed. + rng = random.Random(0) + incompressible = bytes(rng.randrange(256) for _ in range(64 * 1024)).decode( + "latin-1" + ) + layer_blob = zstandard.ZstdCompressor().compress( + build_tar({"app/config.py": "TOKEN = 'x'", "app/big.bin": incompressible}) + ) + assert len(layer_blob) > 10 * 1024 + MANIFESTS_BY_DIGEST[IMAGE_DIGEST] = zstd_manifest + BLOBS_BY_DIGEST[CONFIG_DIGEST] = json.dumps(CONFIG_JSON).encode() + BLOBS_BY_DIGEST[LAYER_DIGEST] = layer_blob + + ecr_client = client("ecr", region_name=AWS_REGION_EU_WEST_1) + with ( + patch(_REQUESTS_GET, new=mock_requests_get), + patch( + "prowler.providers.aws.services.ecr.image_inspection.MAX_LAYER_DOWNLOAD_BYTES", + len(layer_blob) - 1, + ), + ): + scan_data = ImageInspector().fetch_image_scan_data( + ecr_client, AWS_ACCOUNT_NUMBER, REPO_NAME, IMAGE_DIGEST + ) + + assert scan_data is not None + assert scan_data.truncated is True + + @mock_aws + def test_fetch_image_scan_data_uncompressed_tar_layer(self): + """An uncompressed tar layer is read and scanned directly.""" + tar_manifest = { + "schemaVersion": 2, + "mediaType": "application/vnd.docker.distribution.manifest.v2+json", + "config": {"digest": CONFIG_DIGEST, "size": 100}, + "layers": [ + { + "mediaType": "application/vnd.oci.image.layer.v1.tar", + "digest": LAYER_DIGEST, + "size": 200, + } + ], + } + MANIFESTS_BY_DIGEST[IMAGE_DIGEST] = tar_manifest + BLOBS_BY_DIGEST[CONFIG_DIGEST] = json.dumps(CONFIG_JSON).encode() + BLOBS_BY_DIGEST[LAYER_DIGEST] = build_tar({"app/config.py": "TOKEN = 'x'"}) + + scan_data = self._fetch() + + assert scan_data is not None + assert len(scan_data.files) == 1 + assert scan_data.files[0].content == "TOKEN = 'x'" + + @mock_aws + def test_fetch_image_scan_data_skips_whiteout_and_oversized_file(self): + """Whiteout markers and oversized files are skipped, not scanned.""" + MANIFESTS_BY_DIGEST[IMAGE_DIGEST] = SIMPLE_MANIFEST + BLOBS_BY_DIGEST[CONFIG_DIGEST] = json.dumps(CONFIG_JSON).encode() + BLOBS_BY_DIGEST[LAYER_DIGEST] = build_gzip_tar( + { + ".wh.deleted": "should never appear", + "app/config.py": "TOKEN = 'x'", + "app/oversized.bin": "x" * (MAX_FILE_BYTES + 1), + } + ) + + scan_data = self._fetch() + + assert scan_data is not None + assert [f.path for f in scan_data.files] == ["app/config.py"] + assert scan_data.truncated is True + + def test_capped_layer_reader_allows_up_to_max(self): + """Reading exactly the byte budget succeeds and then reports EOF.""" + import io + + reader = _CappedLayerReader(io.BytesIO(b"x" * 10), max_bytes=10) + assert reader.read() == b"x" * 10 + assert reader.read() == b"" + + def test_capped_layer_reader_raises_when_exceeding_max(self): + """A stream longer than the byte budget raises _LayerTooLargeError.""" + import io + + reader = _CappedLayerReader(io.BytesIO(b"x" * 100), max_bytes=10) + with pytest.raises(_LayerTooLargeError): + reader.read() + + @mock_aws + def test_fetch_image_scan_data_streamed_layer_over_cap_is_truncated(self): + """A layer streaming past MAX_LAYER_DOWNLOAD_BYTES is skipped, not buffered.""" + undersized_manifest = { + "schemaVersion": 2, + "mediaType": "application/vnd.docker.distribution.manifest.v2+json", + "config": {"digest": CONFIG_DIGEST, "size": 100}, + "layers": [ + { + "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", + "digest": LAYER_DIGEST, + # Declares zero size so it passes the pre-download check; + # the actual streamed bytes exceed the (patched) cap. + "size": 0, + } + ], + } + # Two-member layer: a small first file that is scanned, then a large + # incompressible second file. The blob must exceed tarfile's internal + # read buffer (~10 KB) so tarfile.open() consumes only part of it and + # the cap (set one byte below the full layer) is instead exceeded while + # the second member's content is read during archive iteration. + rng = random.Random(0) + incompressible = bytes(rng.randrange(256) for _ in range(64 * 1024)).decode( + "latin-1" + ) + layer_blob = build_gzip_tar( + {"app/config.py": "TOKEN = 'x'", "app/big.bin": incompressible} + ) + assert len(layer_blob) > 10 * 1024 # larger than tarfile's read buffer + MANIFESTS_BY_DIGEST[IMAGE_DIGEST] = undersized_manifest + BLOBS_BY_DIGEST[CONFIG_DIGEST] = json.dumps(CONFIG_JSON).encode() + BLOBS_BY_DIGEST[LAYER_DIGEST] = layer_blob + + ecr_client = client("ecr", region_name=AWS_REGION_EU_WEST_1) + with ( + patch(_REQUESTS_GET, new=mock_requests_get), + patch( + "prowler.providers.aws.services.ecr.image_inspection.MAX_LAYER_DOWNLOAD_BYTES", + len(layer_blob) - 1, + ), + ): + scan_data = ImageInspector().fetch_image_scan_data( + ecr_client, AWS_ACCOUNT_NUMBER, REPO_NAME, IMAGE_DIGEST + ) + + # The over-cap layer is disclosed via truncated, and the config-derived + # env/history (fetched independently of the layer) are still returned. + assert scan_data is not None + assert scan_data.truncated is True + assert scan_data.env == ["PATH=/usr/bin", "TOKEN=super-secret-value"] diff --git a/tests/providers/aws/services/ecr/image_scan_fixtures.py b/tests/providers/aws/services/ecr/image_scan_fixtures.py new file mode 100644 index 0000000000..0f3d68a59a --- /dev/null +++ b/tests/providers/aws/services/ecr/image_scan_fixtures.py @@ -0,0 +1,145 @@ +"""Shared fixtures for ECR image-scanning tests. + +Used by both the ECR service tests (orchestration) and the image_inspection +tests (bounded extraction), so the manifest/layer fixtures and the fake layer +download live in one place. moto implements neither BatchGetImage nor +GetDownloadUrlForLayer, so each test registers the manifests/blobs it needs in +``MANIFESTS_BY_DIGEST``/``BLOBS_BY_DIGEST`` and a patched ``_make_api_call`` +serves them. +""" + +import io +import tarfile + +IMAGE_DIGEST = f"sha256:{'1' * 64}" +CONFIG_DIGEST = f"sha256:{'c' * 64}" +LAYER_DIGEST = f"sha256:{'d' * 64}" +MULTI_ARCH_INDEX_DIGEST = f"sha256:{'2' * 64}" +CHILD_AMD64_DIGEST = f"sha256:{'3' * 64}" +CHILD_ARM64_DIGEST = f"sha256:{'4' * 64}" +ATTESTATION_DIGEST = f"sha256:{'5' * 64}" + +SIMPLE_MANIFEST = { + "schemaVersion": 2, + "mediaType": "application/vnd.docker.distribution.manifest.v2+json", + "config": { + "mediaType": "application/vnd.docker.container.image.v1+json", + "digest": CONFIG_DIGEST, + "size": 100, + }, + "layers": [ + { + "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", + "digest": LAYER_DIGEST, + "size": 200, + } + ], +} + +MULTI_ARCH_MANIFEST_LIST = { + "schemaVersion": 2, + "mediaType": "application/vnd.docker.distribution.manifest.list.v2+json", + "manifests": [ + { + "mediaType": "application/vnd.docker.distribution.manifest.v2+json", + "digest": CHILD_AMD64_DIGEST, + "size": 10, + "platform": {"architecture": "amd64", "os": "linux"}, + }, + { + "mediaType": "application/vnd.docker.distribution.manifest.v2+json", + "digest": CHILD_ARM64_DIGEST, + "size": 10, + "platform": {"architecture": "arm64", "os": "linux"}, + }, + { + "mediaType": "application/vnd.oci.image.manifest.v1+json", + "digest": ATTESTATION_DIGEST, + "size": 10, + "platform": {"architecture": "unknown", "os": "unknown"}, + "annotations": {"vnd.docker.reference.type": "attestation-manifest"}, + }, + ], +} + +CONFIG_JSON = { + "config": {"Env": ["PATH=/usr/bin", "TOKEN=super-secret-value"]}, + "history": [ + {"created_by": "/bin/sh -c #(nop) ADD file"}, + {"created_by": "RUN echo hi"}, + ], +} + +# Per-test fixtures keyed by digest. moto implements neither BatchGetImage nor +# GetDownloadUrlForLayer, so tests populate these and a patched _make_api_call / +# requests.get serves them. Cleared between tests via reset_image_fixtures(). +MANIFESTS_BY_DIGEST = {} +BLOBS_BY_DIGEST = {} + + +def reset_image_fixtures(): + """Clear the per-test manifest/blob fixtures.""" + MANIFESTS_BY_DIGEST.clear() + BLOBS_BY_DIGEST.clear() + + +def build_tar(files: dict) -> bytes: + """Build an uncompressed tar archive from the given files.""" + tar_buffer = io.BytesIO() + with tarfile.open(fileobj=tar_buffer, mode="w") as tar: + for name, content in files.items(): + data = content.encode("latin-1") + info = tarfile.TarInfo(name=name) + info.size = len(data) + tar.addfile(info, io.BytesIO(data)) + return tar_buffer.getvalue() + + +def build_gzip_tar(files: dict) -> bytes: + """Build a gzip-compressed tar archive from the given files.""" + tar_buffer = io.BytesIO() + with tarfile.open(fileobj=tar_buffer, mode="w:gz") as tar: + for name, content in files.items(): + data = content.encode("latin-1") + info = tarfile.TarInfo(name=name) + info.size = len(data) + tar.addfile(info, io.BytesIO(data)) + return tar_buffer.getvalue() + + +class FakeLayerResponse: + """A minimal stand-in for a requests.Response over a layer download.""" + + def __init__(self, data: bytes): + """Store the fixture bytes to serve (via iter_content and .raw).""" + self._data = data + # Streaming gzip/tar layers read the compressed bytes straight from + # response.raw; the buffered config/zstd path uses iter_content. + self.raw = io.BytesIO(data) + + def raise_for_status(self): + """No-op: fixture responses are always successful.""" + + def iter_content(self, chunk_size=1024 * 1024): + """Yield the fixture bytes in chunks.""" + for start in range(0, len(self._data), chunk_size): + yield self._data[start : start + chunk_size] + + def close(self): + """Close the backing raw stream, mirroring requests.Response.close.""" + self.raw.close() + + def __enter__(self): + """Support use as a context manager.""" + return self + + def __exit__(self, *_): + """Close on exit, mirroring requests.Response context-manager use.""" + self.close() + return False + + +def mock_requests_get(url, **_): + """Return the fixture bytes registered for the requested layer's URL.""" + digest = url.rsplit("/", 1)[-1] + return FakeLayerResponse(BLOBS_BY_DIGEST[digest]) diff --git a/tests/providers/aws/services/ecs/ecs_task_definitions_undescribed_test.py b/tests/providers/aws/services/ecs/ecs_task_definitions_undescribed_test.py new file mode 100644 index 0000000000..40b25ed4d2 --- /dev/null +++ b/tests/providers/aws/services/ecs/ecs_task_definitions_undescribed_test.py @@ -0,0 +1,164 @@ +from datetime import datetime, timezone +from importlib import import_module +from types import SimpleNamespace +from unittest.mock import patch + +import botocore +import pytest + +from prowler.providers.aws.services.ecs.ecs_service import ECS, TaskDefinition +from tests.providers.aws.utils import ( + AWS_ACCOUNT_NUMBER, + AWS_REGION_US_EAST_1, + set_mocked_aws_provider, +) + +TASK_NAME = "test-task" +TASK_REVISION = "1" +TASK_ARN = ( + f"arn:aws:ecs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:" + f"task-definition/{TASK_NAME}:{TASK_REVISION}" +) +make_api_call = botocore.client.BaseClient._make_api_call + + +def _mock_ecs_api(describe_result): + def mock_make_api_call(self, operation_name, kwargs): + if operation_name == "ListTaskDefinitions": + return {"taskDefinitionArns": [TASK_ARN]} + if operation_name == "DescribeTaskDefinition": + if isinstance(describe_result, Exception): + raise describe_result + return describe_result + if operation_name == "ListClusters": + return {"clusterArns": []} + return make_api_call(self, operation_name, kwargs) + + return mock_make_api_call + + +def _collect_task_definition(describe_result): + aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) + with patch( + "botocore.client.BaseClient._make_api_call", + new=_mock_ecs_api(describe_result), + ): + return ECS(aws_provider).task_definitions[TASK_ARN] + + +def _undescribed_ecs_client(): + task_definition = TaskDefinition( + name=TASK_NAME, + arn=TASK_ARN, + revision=TASK_REVISION, + region=AWS_REGION_US_EAST_1, + environment_variables=[], + ) + task_definition.container_definitions = None + return SimpleNamespace( + audit_config={}, + task_definitions={TASK_ARN: task_definition}, + ) + + +def test_failed_describe_leaves_task_definition_undescribed(): + error = botocore.exceptions.ClientError( + {"Error": {"Code": "ThrottlingException", "Message": "rate exceeded"}}, + "DescribeTaskDefinition", + ) + + task_definition = _collect_task_definition(error) + + assert task_definition.container_definitions is None + assert task_definition.pid_mode is None + assert task_definition.network_mode is None + + +def test_successful_describe_preserves_empty_container_definitions(): + task_definition = _collect_task_definition( + { + "taskDefinition": { + "containerDefinitions": [], + "pidMode": "task", + "networkMode": "awsvpc", + }, + "tags": [], + } + ) + + assert task_definition.container_definitions == [] + assert task_definition.pid_mode == "task" + assert task_definition.network_mode == "awsvpc" + + +def test_partial_parse_leaves_task_definition_undescribed(): + task_definition = _collect_task_definition( + { + "taskDefinition": { + "containerDefinitions": [ + {"name": "valid-container"}, + {"privileged": False}, + ], + "pidMode": "host", + "networkMode": "host", + "registeredAt": datetime(2026, 8, 13, tzinfo=timezone.utc), + }, + "tags": [{"key": "Environment", "value": "production"}], + } + ) + + assert task_definition.container_definitions is None + assert task_definition.pid_mode is None + assert task_definition.network_mode is None + assert task_definition.registered_at is None + assert task_definition.tags == [] + + +@pytest.mark.parametrize( + ("check_package", "check_name"), + [ + ( + "ecs_task_definitions_containers_readonly_access", + "ecs_task_definitions_containers_readonly_access", + ), + ( + "ecs_task_definitions_host_namespace_not_shared", + "ecs_task_definitions_host_namespace_not_shared", + ), + ( + "ecs_task_definitions_host_networking_mode_users", + "ecs_task_definitions_host_networking_mode_users", + ), + ( + "ecs_task_definitions_logging_block_mode", + "ecs_task_definitions_logging_block_mode", + ), + ( + "ecs_task_definitions_logging_enabled", + "ecs_task_definitions_logging_enabled", + ), + ( + "ecs_task_definitions_no_environment_secrets", + "ecs_task_definitions_no_environment_secrets", + ), + ( + "ecs_task_definitions_no_privileged_containers", + "ecs_task_definitions_no_privileged_containers", + ), + ], +) +def test_undescribed_task_definitions_are_not_reported( + check_package, check_name, monkeypatch +): + with patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_aws_provider([AWS_REGION_US_EAST_1]), + ): + module = import_module( + f"prowler.providers.aws.services.ecs.{check_package}.{check_name}" + ) + monkeypatch.setattr(module, "ecs_client", _undescribed_ecs_client()) + + check = getattr(module, check_name)() + + assert check.execute() == [] diff --git a/tests/providers/aws/services/rolesanywhere/rolesanywhere_profile_restricts_session_permissions/rolesanywhere_profile_restricts_session_permissions_test.py b/tests/providers/aws/services/rolesanywhere/rolesanywhere_profile_restricts_session_permissions/rolesanywhere_profile_restricts_session_permissions_test.py new file mode 100644 index 0000000000..09cdb3ae8d --- /dev/null +++ b/tests/providers/aws/services/rolesanywhere/rolesanywhere_profile_restricts_session_permissions/rolesanywhere_profile_restricts_session_permissions_test.py @@ -0,0 +1,762 @@ +from types import SimpleNamespace +from unittest import mock + +from prowler.providers.aws.services.rolesanywhere.rolesanywhere_service import Profile +from tests.providers.aws.utils import ( + AWS_ACCOUNT_NUMBER, + AWS_REGION_US_EAST_1, + set_mocked_aws_provider, +) + +PROFILE_ID = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" +PROFILE_NAME = "workload-profile" +PROFILE_ARN = f"arn:aws:rolesanywhere:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:profile/{PROFILE_ID}" +ADMIN_ROLE_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/admin-role" +READONLY_ROLE_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/workload-role" +UNKNOWN_ROLE_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/cross-account-role" +CUSTOM_ADMIN_ROLE_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/custom-admin-role" +INLINE_ADMIN_ROLE_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/inline-admin-role" +NAME_COLLISION_ROLE_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/name-collision-role" +UNRESOLVED_POLICY_ROLE_ARN = ( + f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/unresolved-policy-role" +) +ADMIN_UNRESOLVED_POLICY_ROLE_ARN = ( + f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/admin-unresolved-policy-role" +) +INVALID_POLICY_ROLE_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/invalid-policy-role" +DENY_OVERRIDE_ROLE_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/deny-override-role" +CONDITIONAL_DENY_ROLE_ARN = ( + f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/conditional-deny-role" +) +CONDITIONAL_ADMIN_ROLE_ARN = ( + f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/conditional-admin-role" +) +BOUNDED_ADMIN_ROLE_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/bounded-admin-role" +UNRESOLVED_BOUNDARY_ROLE_ARN = ( + f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/unresolved-boundary-role" +) +ADMIN_BOUNDED_ROLE_ARN = ( + f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/admin-bounded-admin-role" +) +AWS_ADMIN_POLICY_ARN = "arn:aws:iam::aws:policy/AdministratorAccess" +CUSTOMER_ADMIN_NAMED_POLICY_ARN = ( + f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:policy/AdministratorAccess" +) +CUSTOM_ADMIN_POLICY_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:policy/custom-admin" +MANAGED_POLICY_ARN = "arn:aws:iam::aws:policy/ReadOnlyAccess" +CUSTOMER_FULL_ACCESS_POLICY_ARN = ( + f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:policy/full-access-session" +) +BOUNDARY_POLICY_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:policy/scoped-boundary" +UNRESOLVED_BOUNDARY_POLICY_ARN = ( + f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:policy/unresolved-boundary" +) +UNRESOLVED_SESSION_POLICY_ARN = ( + "arn:aws:iam::aws:policy/job-function/SupportUser" # not in iam_client.policies +) + +SESSION_POLICY = ( + '{"Version":"2012-10-17","Statement":[{"Effect":"Allow",' + '"Action":["s3:GetObject"],"Resource":["*"]}]}' +) +FULL_ACCESS_SESSION_POLICY = ( + '{"Version":"2012-10-17","Statement":[{"Effect":"Allow",' + '"Action":"*","Resource":"*"}]}' +) + +FULL_ACCESS_DOCUMENT = { + "Version": "2012-10-17", + "Statement": [{"Effect": "Allow", "Action": "*", "Resource": "*"}], +} +READONLY_DOCUMENT = { + "Version": "2012-10-17", + "Statement": [{"Effect": "Allow", "Action": "s3:Get*", "Resource": "*"}], +} +DENY_ALL_DOCUMENT = { + "Version": "2012-10-17", + "Statement": [{"Effect": "Deny", "Action": "*", "Resource": "*"}], +} +CONDITIONAL_ADMIN_DOCUMENT = { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "*", + "Resource": "*", + "Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}}, + } + ], +} +CONDITIONAL_DENY_DOCUMENT = { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Deny", + "Action": "*", + "Resource": "*", + "Condition": {"StringNotEquals": {"aws:PrincipalTag/team": "security"}}, + } + ], +} + + +def _profile( + *, + enabled: bool = True, + session_policy: str = "", + managed_policy_arns=None, + role_arns=None, +): + return Profile( + arn=PROFILE_ARN, + id=PROFILE_ID, + name=PROFILE_NAME, + region=AWS_REGION_US_EAST_1, + enabled=enabled, + role_arns=role_arns if role_arns is not None else [READONLY_ROLE_ARN], + session_policy=session_policy, + managed_policy_arns=managed_policy_arns or [], + ) + + +def _role(arn, attached_policies=None, inline_policies=None, permissions_boundary=None): + return SimpleNamespace( + arn=arn, + attached_policies=attached_policies or [], + inline_policies=inline_policies or [], + permissions_boundary=permissions_boundary, + ) + + +def _iam_client(): + """IAM client stub mirroring iam_service models: roles with attached/inline + policies and a policies dict keyed by ARN (inline keyed {role_arn}:policy/{name}). + """ + roles = [ + _role( + ADMIN_ROLE_ARN, + attached_policies=[ + {"PolicyName": "AdministratorAccess", "PolicyArn": AWS_ADMIN_POLICY_ARN} + ], + ), + _role( + READONLY_ROLE_ARN, + attached_policies=[ + {"PolicyName": "ReadOnlyAccess", "PolicyArn": MANAGED_POLICY_ARN} + ], + ), + _role( + CUSTOM_ADMIN_ROLE_ARN, + attached_policies=[ + {"PolicyName": "custom-admin", "PolicyArn": CUSTOM_ADMIN_POLICY_ARN} + ], + ), + _role(INLINE_ADMIN_ROLE_ARN, inline_policies=["inline-admin"]), + _role( + NAME_COLLISION_ROLE_ARN, + attached_policies=[ + { + "PolicyName": "AdministratorAccess", + "PolicyArn": CUSTOMER_ADMIN_NAMED_POLICY_ARN, + } + ], + ), + _role( + UNRESOLVED_POLICY_ROLE_ARN, + attached_policies=[ + { + "PolicyName": "unresolved", + "PolicyArn": f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:policy/unresolved", + } + ], + ), + # Proven admin attached policy combined with an unresolved one: the + # unresolved document could contain a deny, so the outcome is unknown. + _role( + ADMIN_UNRESOLVED_POLICY_ROLE_ARN, + attached_policies=[ + { + "PolicyName": "AdministratorAccess", + "PolicyArn": AWS_ADMIN_POLICY_ARN, + }, + { + "PolicyName": "unresolved", + "PolicyArn": f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:policy/unresolved", + }, + ], + ), + # Attached policy resolves to a malformed (non-dict) document. + _role( + INVALID_POLICY_ROLE_ARN, + attached_policies=[ + { + "PolicyName": "invalid", + "PolicyArn": f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:policy/invalid", + } + ], + ), + # Allow *:* in the attached policy negated by an unconditional Deny *:* + # in an inline policy: not effectively administrative. + _role( + DENY_OVERRIDE_ROLE_ARN, + attached_policies=[ + {"PolicyName": "custom-admin", "PolicyArn": CUSTOM_ADMIN_POLICY_ARN} + ], + inline_policies=["deny-all"], + ), + # Allow *:* in the attached policy plus a Condition-guarded Deny: the + # deny may or may not apply, so the outcome is unknown. + _role( + CONDITIONAL_DENY_ROLE_ARN, + attached_policies=[ + {"PolicyName": "custom-admin", "PolicyArn": CUSTOM_ADMIN_POLICY_ARN} + ], + inline_policies=["conditional-deny"], + ), + # Allow *:* guarded by a Condition: not statically provable as admin. + _role( + CONDITIONAL_ADMIN_ROLE_ARN, + attached_policies=[ + { + "PolicyName": "conditional-admin", + "PolicyArn": f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:policy/conditional-admin", + } + ], + ), + # Administrative identity policies constrained by a restrictive + # permissions boundary: not effectively administrative. + _role( + BOUNDED_ADMIN_ROLE_ARN, + attached_policies=[ + {"PolicyName": "AdministratorAccess", "PolicyArn": AWS_ADMIN_POLICY_ARN} + ], + permissions_boundary={ + "PermissionsBoundaryType": "Policy", + "PermissionsBoundaryArn": BOUNDARY_POLICY_ARN, + }, + ), + # Boundary present but its document is not in the IAM inventory: + # restrictions cannot be evaluated, so the role is not classified admin. + _role( + UNRESOLVED_BOUNDARY_ROLE_ARN, + attached_policies=[ + {"PolicyName": "AdministratorAccess", "PolicyArn": AWS_ADMIN_POLICY_ARN} + ], + permissions_boundary={ + "PermissionsBoundaryType": "Policy", + "PermissionsBoundaryArn": UNRESOLVED_BOUNDARY_POLICY_ARN, + }, + ), + # AdministratorAccess as the boundary does not restrict anything. + _role( + ADMIN_BOUNDED_ROLE_ARN, + attached_policies=[ + {"PolicyName": "AdministratorAccess", "PolicyArn": AWS_ADMIN_POLICY_ARN} + ], + permissions_boundary={ + "PermissionsBoundaryType": "Policy", + "PermissionsBoundaryArn": AWS_ADMIN_POLICY_ARN, + }, + ), + ] + policies = { + AWS_ADMIN_POLICY_ARN: SimpleNamespace(document=FULL_ACCESS_DOCUMENT), + CUSTOM_ADMIN_POLICY_ARN: SimpleNamespace(document=FULL_ACCESS_DOCUMENT), + MANAGED_POLICY_ARN: SimpleNamespace(document=READONLY_DOCUMENT), + # Customer-managed policy that merely shares the AdministratorAccess name. + CUSTOMER_ADMIN_NAMED_POLICY_ARN: SimpleNamespace(document=READONLY_DOCUMENT), + f"{INLINE_ADMIN_ROLE_ARN}:policy/inline-admin": SimpleNamespace( + document=FULL_ACCESS_DOCUMENT + ), + f"{DENY_OVERRIDE_ROLE_ARN}:policy/deny-all": SimpleNamespace( + document=DENY_ALL_DOCUMENT + ), + f"{CONDITIONAL_DENY_ROLE_ARN}:policy/conditional-deny": SimpleNamespace( + document=CONDITIONAL_DENY_DOCUMENT + ), + f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:policy/invalid": SimpleNamespace( + document="invalid" + ), + f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:policy/conditional-admin": SimpleNamespace( + document=CONDITIONAL_ADMIN_DOCUMENT + ), + BOUNDARY_POLICY_ARN: SimpleNamespace(document=READONLY_DOCUMENT), + # Customer-managed session policy whose document grants *:*. + CUSTOMER_FULL_ACCESS_POLICY_ARN: SimpleNamespace(document=FULL_ACCESS_DOCUMENT), + } + iam = mock.MagicMock() + iam.roles = roles + iam.policies = policies + return iam + + +def _build_client(profiles): + ra_client = mock.MagicMock() + ra_client.profiles = profiles + return ra_client + + +def _patched(ra_client): + aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) + check_module = "prowler.providers.aws.services.rolesanywhere.rolesanywhere_profile_restricts_session_permissions.rolesanywhere_profile_restricts_session_permissions" + return [ + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), + mock.patch(f"{check_module}.rolesanywhere_client", new=ra_client), + mock.patch(f"{check_module}.iam_client", new=_iam_client()), + ] + + +def _enter(patches): + from contextlib import ExitStack + + stack = ExitStack() + for p in patches: + stack.enter_context(p) + return stack + + +def _run(): + from prowler.providers.aws.services.rolesanywhere.rolesanywhere_profile_restricts_session_permissions.rolesanywhere_profile_restricts_session_permissions import ( + rolesanywhere_profile_restricts_session_permissions, + ) + + return rolesanywhere_profile_restricts_session_permissions().execute() + + +class Test_rolesanywhere_profile_restricts_session_permissions: + def test_no_profiles(self): + with _enter(_patched(_build_client({}))): + assert len(_run()) == 0 + + def test_unscoped_profile_with_admin_role_fails(self): + with _enter( + _patched(_build_client({PROFILE_ARN: _profile(role_arns=[ADMIN_ROLE_ARN])})) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].resource_id == PROFILE_ID + assert result[0].resource_arn == PROFILE_ARN + assert result[0].region == AWS_REGION_US_EAST_1 + assert ADMIN_ROLE_ARN in result[0].status_extended + assert "administrative" in result[0].status_extended + + def test_unscoped_profile_with_custom_admin_policy_fails(self): + with _enter( + _patched( + _build_client( + {PROFILE_ARN: _profile(role_arns=[CUSTOM_ADMIN_ROLE_ARN])} + ) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert CUSTOM_ADMIN_ROLE_ARN in result[0].status_extended + + def test_unscoped_profile_with_inline_admin_policy_fails(self): + with _enter( + _patched( + _build_client( + {PROFILE_ARN: _profile(role_arns=[INLINE_ADMIN_ROLE_ARN])} + ) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert INLINE_ADMIN_ROLE_ARN in result[0].status_extended + + def test_mixed_roles_fail_lists_only_admin_role(self): + with _enter( + _patched( + _build_client( + { + PROFILE_ARN: _profile( + role_arns=[READONLY_ROLE_ARN, ADMIN_ROLE_ARN] + ) + } + ) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ADMIN_ROLE_ARN in result[0].status_extended + assert READONLY_ROLE_ARN not in result[0].status_extended + + def test_customer_policy_named_administratoraccess_passes(self): + # Name collision: customer-managed policy called AdministratorAccess + # whose document is read-only must not flag the role as administrative. + with _enter( + _patched( + _build_client( + {PROFILE_ARN: _profile(role_arns=[NAME_COLLISION_ROLE_ARN])} + ) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "PASS" + + def test_unresolved_attached_policy_is_manual(self): + # Attached policy ARN missing from iam_client.policies: a missing + # document is unknown, not proof that the role is unprivileged. + with _enter( + _patched( + _build_client( + {PROFILE_ARN: _profile(role_arns=[UNRESOLVED_POLICY_ROLE_ARN])} + ) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "MANUAL" + assert "could not be evaluated" in result[0].status_extended + + def test_invalid_policy_document_is_manual(self): + # A malformed policy document cannot prove anything about the role. + with _enter( + _patched( + _build_client( + {PROFILE_ARN: _profile(role_arns=[INVALID_POLICY_ROLE_ARN])} + ) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "MANUAL" + + def test_allow_all_with_unresolved_policy_is_manual(self): + # Proven admin policy plus an unresolved one: the unresolved document + # could contain a deny, so the classification is unknown. + with _enter( + _patched( + _build_client( + { + PROFILE_ARN: _profile( + role_arns=[ADMIN_UNRESOLVED_POLICY_ROLE_ARN] + ) + } + ) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "MANUAL" + + def test_unscoped_profile_with_least_privilege_role_passes(self): + with _enter( + _patched( + _build_client({PROFILE_ARN: _profile(role_arns=[READONLY_ROLE_ARN])}) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "PASS" + assert "defense-in-depth" in result[0].status_extended + + def test_unscoped_profile_with_unknown_role_is_manual(self): + # A referenced role missing from the IAM inventory is unknown, not + # proof that no administrative role exists. + with _enter( + _patched( + _build_client({PROFILE_ARN: _profile(role_arns=[UNKNOWN_ROLE_ARN])}) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "MANUAL" + assert "could not be evaluated" in result[0].status_extended + + def test_unscoped_profile_without_roles_passes(self): + with _enter(_patched(_build_client({PROFILE_ARN: _profile(role_arns=[])}))): + result = _run() + assert len(result) == 1 + assert result[0].status == "PASS" + + def test_profile_with_session_policy_passes(self): + with _enter( + _patched( + _build_client( + { + PROFILE_ARN: _profile( + session_policy=SESSION_POLICY, role_arns=[ADMIN_ROLE_ARN] + ) + } + ) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "PASS" + assert "session policy" in result[0].status_extended + + def test_full_access_session_policy_does_not_scope(self): + # A sessionPolicy granting *:* does not restrict anything. + with _enter( + _patched( + _build_client( + { + PROFILE_ARN: _profile( + session_policy=FULL_ACCESS_SESSION_POLICY, + role_arns=[ADMIN_ROLE_ARN], + ) + } + ) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "FAIL" + + def test_profile_with_managed_policies_passes(self): + with _enter( + _patched( + _build_client( + { + PROFILE_ARN: _profile( + managed_policy_arns=[MANAGED_POLICY_ARN], + role_arns=[ADMIN_ROLE_ARN], + ) + } + ) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "PASS" + + def test_admin_managed_session_policy_does_not_scope(self): + # AdministratorAccess as the managed session policy restricts nothing. + with _enter( + _patched( + _build_client( + { + PROFILE_ARN: _profile( + managed_policy_arns=[AWS_ADMIN_POLICY_ARN], + role_arns=[ADMIN_ROLE_ARN], + ) + } + ) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "FAIL" + + def test_restrictive_inline_with_admin_managed_policy_fails(self): + # The session-policy set is evaluated as a union: AdministratorAccess as + # a managed session policy makes the boundary unrestricted even though + # the inline session policy is restrictive. + with _enter( + _patched( + _build_client( + { + PROFILE_ARN: _profile( + session_policy=SESSION_POLICY, + managed_policy_arns=[AWS_ADMIN_POLICY_ARN], + role_arns=[ADMIN_ROLE_ARN], + ) + } + ) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "FAIL" + + def test_full_access_inline_with_restrictive_managed_policy_fails(self): + # Conversely, a *:* inline session policy leaves the union unrestricted + # regardless of a restrictive managed session policy. + with _enter( + _patched( + _build_client( + { + PROFILE_ARN: _profile( + session_policy=FULL_ACCESS_SESSION_POLICY, + managed_policy_arns=[MANAGED_POLICY_ARN], + role_arns=[ADMIN_ROLE_ARN], + ) + } + ) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "FAIL" + + def test_restrictive_inline_and_restrictive_managed_policy_passes(self): + with _enter( + _patched( + _build_client( + { + PROFILE_ARN: _profile( + session_policy=SESSION_POLICY, + managed_policy_arns=[MANAGED_POLICY_ARN], + role_arns=[ADMIN_ROLE_ARN], + ) + } + ) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "PASS" + + def test_customer_managed_full_access_session_policy_fails(self): + # A customer-managed session policy whose document grants *:* must be + # resolved through iam_client.policies and treated as unscoped. + with _enter( + _patched( + _build_client( + { + PROFILE_ARN: _profile( + managed_policy_arns=[CUSTOMER_FULL_ACCESS_POLICY_ARN], + role_arns=[ADMIN_ROLE_ARN], + ) + } + ) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "FAIL" + + def test_unresolved_managed_session_policy_is_manual(self): + # A managed session policy whose document was not collected does not + # prove that the session is restricted: the outcome is unknown. + with _enter( + _patched( + _build_client( + { + PROFILE_ARN: _profile( + managed_policy_arns=[UNRESOLVED_SESSION_POLICY_ARN], + role_arns=[ADMIN_ROLE_ARN], + ) + } + ) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "MANUAL" + assert "session scoping could not be evaluated" in result[0].status_extended + + def test_invalid_inline_session_policy_is_manual(self): + # An inline session policy that fails to parse does not prove that the + # session is restricted: the outcome is unknown. + with _enter( + _patched( + _build_client( + { + PROFILE_ARN: _profile( + session_policy="not-json", role_arns=[ADMIN_ROLE_ARN] + ) + } + ) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "MANUAL" + + def test_allow_all_with_cross_policy_deny_all_passes(self): + # Allow *:* in an attached policy plus an unconditional Deny *:* in an + # inline policy: the merged evaluation must not classify the role admin. + with _enter( + _patched( + _build_client( + {PROFILE_ARN: _profile(role_arns=[DENY_OVERRIDE_ROLE_ARN])} + ) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "PASS" + + def test_conditional_admin_allow_is_manual(self): + # An Allow *:* guarded by a Condition is not statically provable in + # either direction: the classification is unknown. + with _enter( + _patched( + _build_client( + {PROFILE_ARN: _profile(role_arns=[CONDITIONAL_ADMIN_ROLE_ARN])} + ) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "MANUAL" + + def test_allow_all_with_conditional_deny_is_manual(self): + # Unconditional Allow *:* plus a Condition-guarded Deny: the deny may + # or may not negate the grant, so the classification is unknown. + with _enter( + _patched( + _build_client( + {PROFILE_ARN: _profile(role_arns=[CONDITIONAL_DENY_ROLE_ARN])} + ) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "MANUAL" + + def test_admin_role_with_restrictive_boundary_passes(self): + # Admin identity policies intersected with a read-only permissions + # boundary are not effectively administrative. + with _enter( + _patched( + _build_client( + {PROFILE_ARN: _profile(role_arns=[BOUNDED_ADMIN_ROLE_ARN])} + ) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "PASS" + + def test_admin_role_with_unresolved_boundary_is_manual(self): + # When the boundary document cannot be resolved the restrictions are + # unknown: neither administrative nor safe can be proven. + with _enter( + _patched( + _build_client( + {PROFILE_ARN: _profile(role_arns=[UNRESOLVED_BOUNDARY_ROLE_ARN])} + ) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "MANUAL" + + def test_admin_role_with_admin_boundary_fails(self): + # An AdministratorAccess boundary restricts nothing: still admin. + with _enter( + _patched( + _build_client( + {PROFILE_ARN: _profile(role_arns=[ADMIN_BOUNDED_ROLE_ARN])} + ) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ADMIN_BOUNDED_ROLE_ARN in result[0].status_extended + + def test_disabled_profile_passes(self): + with _enter( + _patched( + _build_client( + {PROFILE_ARN: _profile(enabled=False, role_arns=[ADMIN_ROLE_ARN])} + ) + ) + ): + result = _run() + assert len(result) == 1 + assert result[0].status == "PASS" + assert "disabled" in result[0].status_extended diff --git a/tests/providers/aws/services/rolesanywhere/rolesanywhere_service_test.py b/tests/providers/aws/services/rolesanywhere/rolesanywhere_service_test.py index d21d4e20b7..5a1106c852 100644 --- a/tests/providers/aws/services/rolesanywhere/rolesanywhere_service_test.py +++ b/tests/providers/aws/services/rolesanywhere/rolesanywhere_service_test.py @@ -4,6 +4,7 @@ import botocore from moto import mock_aws from prowler.providers.aws.services.rolesanywhere.rolesanywhere_service import ( + Profile, RolesAnywhere, TrustAnchor, ) @@ -16,6 +17,9 @@ from tests.providers.aws.utils import ( TA_ID = "11111111-2222-3333-4444-555555555555" TA_ARN = f"arn:aws:rolesanywhere:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:trust-anchor/{TA_ID}" PCA_ARN = f"arn:aws:acm-pca:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:certificate-authority/abc" +PROFILE_ID = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" +PROFILE_ARN = f"arn:aws:rolesanywhere:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:profile/{PROFILE_ID}" +ROLE_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/workload-role" make_api_call = botocore.client.BaseClient._make_api_call @@ -36,6 +40,21 @@ def mock_make_api_call(self, operation_name, kwarg): } ] } + if operation_name == "ListProfiles": + return { + "profiles": [ + { + "profileArn": PROFILE_ARN, + "profileId": PROFILE_ID, + "name": "workload-profile", + "enabled": True, + "roleArns": [ROLE_ARN], + "sessionPolicy": '{"Version":"2012-10-17","Statement":[]}', + "durationSeconds": 3600, + "acceptRoleSessionName": True, + } + ] + } if operation_name == "ListTagsForResource": return {"tags": [{"key": "Environment", "value": "test"}]} return make_api_call(self, operation_name, kwarg) @@ -78,6 +97,25 @@ class Test_RolesAnywhere_Service: assert ta.region == AWS_REGION_US_EAST_1 assert ta.tags == [{"key": "Environment", "value": "test"}] + @patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call) + @mock_aws + def test_list_profiles(self): + aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) + rolesanywhere = RolesAnywhere(aws_provider) + assert len(rolesanywhere.profiles) == 1 + profile = rolesanywhere.profiles[PROFILE_ARN] + assert isinstance(profile, Profile) + assert profile.id == PROFILE_ID + assert profile.name == "workload-profile" + assert profile.enabled is True + assert profile.role_arns == [ROLE_ARN] + assert profile.session_policy == '{"Version":"2012-10-17","Statement":[]}' + assert profile.managed_policy_arns == [] + assert profile.duration_seconds == 3600 + assert profile.accept_role_session_name is True + assert profile.region == AWS_REGION_US_EAST_1 + assert profile.tags == [{"key": "Environment", "value": "test"}] + @patch( "botocore.client.BaseClient._make_api_call", new=mock_make_api_call_tags_failure ) diff --git a/tests/providers/aws/services/ses/ses_identity_not_publicly_accessible/ses_identity_not_publicly_accessible_test.py b/tests/providers/aws/services/ses/ses_identity_not_publicly_accessible/ses_identity_not_publicly_accessible_test.py index 15b8a9dd32..dbd12d189d 100644 --- a/tests/providers/aws/services/ses/ses_identity_not_publicly_accessible/ses_identity_not_publicly_accessible_test.py +++ b/tests/providers/aws/services/ses/ses_identity_not_publicly_accessible/ses_identity_not_publicly_accessible_test.py @@ -1,6 +1,8 @@ +from copy import deepcopy from unittest import mock import botocore +import pytest from boto3 import client from moto import mock_aws @@ -54,6 +56,113 @@ def mock_make_api_call_v2(self, operation_name, kwarg): return make_api_call(self, operation_name, kwarg) +PUBLIC_ALLOW_POLICY = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"ses:SendEmail","Resource":"*"}]}' +PRIVATE_ALLOW_POLICY = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":"ses:SendEmail","Resource":"*"}]}' +MATCHING_DENY_POLICY = '{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Principal":"*","Action":"ses:SendEmail","Resource":"*"}]}' +UNRELATED_DENY_POLICY = '{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Principal":"*","Action":"ses:SendRawEmail","Resource":"*"}]}' +PUBLIC_ALLOW_AND_DENY_POLICY = '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"ses:SendEmail","Resource":"*"},{"Effect":"Deny","Principal":"*","Action":"ses:SendEmail","Resource":"*"}]}' +PUBLIC_ALLOW_SINGLE_STATEMENT_POLICY = '{"Version":"2012-10-17","Statement":{"Effect":"Allow","Principal":"*","Action":"ses:SendEmail","Resource":"*"}}' +PRIVATE_ALLOW_SINGLE_STATEMENT_POLICY = '{"Version":"2012-10-17","Statement":{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":"ses:SendEmail","Resource":"*"}}' +MATCHING_DENY_SINGLE_STATEMENT_POLICY = '{"Version":"2012-10-17","Statement":{"Effect":"Deny","Principal":"*","Action":"ses:SendEmail","Resource":"*"}}' +CONDITIONAL_ALLOW_SINGLE_STATEMENT_POLICY = '{"Version":"2012-10-17","Statement":{"Effect":"Allow","Principal":"*","Action":"ses:SendEmail","Resource":"*","Condition":{"StringEquals":{"AWS:SourceAccount":"123456789012"}}}}' + + +def make_multiple_policies_api_mock(policies): + def mock_api_call(self, operation_name, kwarg): + if operation_name == "ListEmailIdentities": + return { + "EmailIdentities": [ + { + "IdentityType": "DOMAIN", + "IdentityName": "test-email-identity-multiple-policies", + } + ], + } + elif operation_name == "GetEmailIdentity": + return {"Policies": policies, "Tags": {}} + return make_api_call(self, operation_name, kwarg) + + return mock_api_call + + +mock_make_api_call_multiple_policies = make_multiple_policies_api_mock( + { + "public-policy": PUBLIC_ALLOW_POLICY, + "private-policy": PRIVATE_ALLOW_POLICY, + } +) +mock_make_api_call_multiple_policies_reversed = make_multiple_policies_api_mock( + { + "private-policy": PRIVATE_ALLOW_POLICY, + "public-policy": PUBLIC_ALLOW_POLICY, + } +) +mock_make_api_call_public_allow_and_matching_deny = make_multiple_policies_api_mock( + { + "public-policy": PUBLIC_ALLOW_POLICY, + "deny-policy": MATCHING_DENY_POLICY, + } +) +mock_make_api_call_matching_deny_and_public_allow = make_multiple_policies_api_mock( + { + "deny-policy": MATCHING_DENY_POLICY, + "public-policy": PUBLIC_ALLOW_POLICY, + } +) +mock_make_api_call_public_allow_and_unrelated_deny = make_multiple_policies_api_mock( + { + "public-policy": PUBLIC_ALLOW_POLICY, + "deny-policy": UNRELATED_DENY_POLICY, + } +) +mock_make_api_call_same_policy_allow_and_deny = make_multiple_policies_api_mock( + {"combined-policy": PUBLIC_ALLOW_AND_DENY_POLICY} +) +mock_make_api_call_multiple_private_policies = make_multiple_policies_api_mock( + { + "private-policy-1": PRIVATE_ALLOW_POLICY, + "private-policy-2": PRIVATE_ALLOW_POLICY, + } +) +mock_make_api_call_public_single_statement = make_multiple_policies_api_mock( + {"public-policy": PUBLIC_ALLOW_SINGLE_STATEMENT_POLICY} +) +mock_make_api_call_private_single_statement = make_multiple_policies_api_mock( + {"private-policy": PRIVATE_ALLOW_SINGLE_STATEMENT_POLICY} +) +mock_make_api_call_public_and_deny_single_statements = make_multiple_policies_api_mock( + { + "public-policy": PUBLIC_ALLOW_SINGLE_STATEMENT_POLICY, + "deny-policy": MATCHING_DENY_SINGLE_STATEMENT_POLICY, + } +) +mock_make_api_call_conditional_single_statement = make_multiple_policies_api_mock( + {"conditional-policy": CONDITIONAL_ALLOW_SINGLE_STATEMENT_POLICY} +) + + +def execute_check_with_api_mock(api_call_mock): + with mock.patch("botocore.client.BaseClient._make_api_call", new=api_call_mock): + client("sesv2", region_name=AWS_REGION_EU_WEST_1) + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), + mock.patch( + "prowler.providers.aws.services.ses.ses_identity_not_publicly_accessible.ses_identity_not_publicly_accessible.ses_client", + new=SES(aws_provider), + ), + ): + from prowler.providers.aws.services.ses.ses_identity_not_publicly_accessible.ses_identity_not_publicly_accessible import ( + ses_identity_not_publicly_accessible, + ) + + return ses_identity_not_publicly_accessible().execute() + + class Test_ses_identities_not_publicly_accessible: @mock_aws def test_no_identities(self): @@ -114,6 +223,114 @@ class Test_ses_identities_not_publicly_accessible: assert result[0].resource_tags == {"tag1": "value1", "tag2": "value2"} assert result[0].region == AWS_REGION_EU_WEST_1 + @mock_aws + @pytest.mark.parametrize( + "api_call_mock", + [ + mock_make_api_call_multiple_policies, + mock_make_api_call_multiple_policies_reversed, + ], + ids=["public-policy-first", "public-policy-last"], + ) + def test_email_identity_public_when_any_policy_is_public(self, api_call_mock): + result = execute_check_with_api_mock(api_call_mock) + + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == "SES identity test-email-identity-multiple-policies is publicly accessible due to its resource policies." + ) + + @mock_aws + @pytest.mark.parametrize( + "api_call_mock", + [ + mock_make_api_call_public_allow_and_matching_deny, + mock_make_api_call_matching_deny_and_public_allow, + mock_make_api_call_public_allow_and_unrelated_deny, + mock_make_api_call_same_policy_allow_and_deny, + ], + ids=[ + "matching-deny-last", + "matching-deny-first", + "unrelated-deny", + "same-policy-deny", + ], + ) + def test_email_identity_public_allow_with_explicit_deny_is_manual( + self, api_call_mock + ): + result = execute_check_with_api_mock(api_call_mock) + + assert len(result) == 1 + assert result[0].status == "MANUAL" + assert ( + result[0].status_extended + == "SES identity test-email-identity-multiple-policies has public Allow and explicit Deny statements in its resource policies. Effective public access requires manual review." + ) + + @mock_aws + def test_email_identity_multiple_private_policies(self): + result = execute_check_with_api_mock( + mock_make_api_call_multiple_private_policies + ) + + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == "SES identity test-email-identity-multiple-policies is not publicly accessible." + ) + + @mock_aws + @pytest.mark.parametrize( + ("api_call_mock", "expected_status"), + [ + (mock_make_api_call_public_single_statement, "FAIL"), + (mock_make_api_call_private_single_statement, "PASS"), + (mock_make_api_call_public_and_deny_single_statements, "MANUAL"), + ], + ids=["public", "private", "public-with-deny"], + ) + def test_email_identity_single_statement_policy( + self, api_call_mock, expected_status + ): + result = execute_check_with_api_mock(api_call_mock) + + assert len(result) == 1 + assert result[0].status == expected_status + + @mock_aws + def test_check_preserves_nested_policy_condition_keys(self): + with mock.patch( + "botocore.client.BaseClient._make_api_call", + new=mock_make_api_call_conditional_single_statement, + ): + client("sesv2", region_name=AWS_REGION_EU_WEST_1) + aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1]) + ses_client = SES(aws_provider) + identity = next(iter(ses_client.email_identities.values())) + policies_before_check = deepcopy(identity.policies) + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), + mock.patch( + "prowler.providers.aws.services.ses.ses_identity_not_publicly_accessible.ses_identity_not_publicly_accessible.ses_client", + new=ses_client, + ), + ): + from prowler.providers.aws.services.ses.ses_identity_not_publicly_accessible.ses_identity_not_publicly_accessible import ( + ses_identity_not_publicly_accessible, + ) + + ses_identity_not_publicly_accessible().execute() + + assert identity.policies == policies_before_check + @mock_aws @mock.patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call_v2) def test_email_identity_public(self): @@ -140,7 +357,7 @@ class Test_ses_identities_not_publicly_accessible: assert result[0].status == "FAIL" assert ( result[0].status_extended - == "SES identity test-email-identity-public is publicly accessible due to its resource policy." + == "SES identity test-email-identity-public is publicly accessible due to its resource policies." ) assert result[0].resource_id == "test-email-identity-public" assert ( diff --git a/tests/providers/aws/services/ses/ses_service_test.py b/tests/providers/aws/services/ses/ses_service_test.py index 223ed94365..92146f6a01 100644 --- a/tests/providers/aws/services/ses/ses_service_test.py +++ b/tests/providers/aws/services/ses/ses_service_test.py @@ -27,6 +27,7 @@ def mock_make_api_call(self, operation_name, kwarg): return { "Policies": { "policy1": '{"policy1": "value1"}', + "policy2": '{"policy2": "value2"}', }, "Tags": {"tag1": "value1", "tag2": "value2"}, "DkimAttributes": { @@ -81,7 +82,11 @@ class Test_SES_Service: assert ses.email_identities[arn].type == "EMAIL_ADDRESS" assert ses.email_identities[arn].arn == arn assert ses.email_identities[arn].region == AWS_REGION_EU_WEST_1 - assert ses.email_identities[arn].policy == {"policy1": "value1"} + assert ses.email_identities[arn].policy == {"policy2": "value2"} + assert ses.email_identities[arn].policies == { + "policy1": {"policy1": "value1"}, + "policy2": {"policy2": "value2"}, + } assert ses.email_identities[arn].tags == {"tag1": "value1", "tag2": "value2"} assert ses.email_identities[arn].dkim_status == "SUCCESS" assert ses.email_identities[arn].dkim_signing_attributes_origin == "AWS_SES" diff --git a/tests/providers/gcp/gcp_fixtures.py b/tests/providers/gcp/gcp_fixtures.py index 1abcaf5bf0..5964d51142 100644 --- a/tests/providers/gcp/gcp_fixtures.py +++ b/tests/providers/gcp/gcp_fixtures.py @@ -490,6 +490,19 @@ def mock_api_projects_calls(client: MagicMock): } client.projects().serviceAccounts().list_next.return_value = None + # Workload Identity Federation pools/providers: return empty pages and stop + # pagination so the discovery while-loops in the IAM service terminate. + client.projects().locations().workloadIdentityPools().list().execute.return_value = { + "workloadIdentityPools": [] + } + client.projects().locations().workloadIdentityPools().list_next.return_value = None + client.projects().locations().workloadIdentityPools().providers().list().execute.return_value = { + "workloadIdentityPoolProviders": [] + } + client.projects().locations().workloadIdentityPools().providers().list_next.return_value = ( + None + ) + def mock_list_service_accounts_keys(name): return_value = MagicMock() if ( diff --git a/tests/providers/gcp/services/iam/iam_workload_identity_pool_provider_attribute_condition/iam_workload_identity_pool_provider_attribute_condition_test.py b/tests/providers/gcp/services/iam/iam_workload_identity_pool_provider_attribute_condition/iam_workload_identity_pool_provider_attribute_condition_test.py new file mode 100644 index 0000000000..6fcc609489 --- /dev/null +++ b/tests/providers/gcp/services/iam/iam_workload_identity_pool_provider_attribute_condition/iam_workload_identity_pool_provider_attribute_condition_test.py @@ -0,0 +1,148 @@ +from unittest import mock + +from tests.providers.gcp.gcp_fixtures import ( + GCP_PROJECT_ID, + GCP_US_CENTER1_LOCATION, + set_mocked_gcp_provider, +) + +CHECK_MODULE = "prowler.providers.gcp.services.iam.iam_workload_identity_pool_provider_attribute_condition.iam_workload_identity_pool_provider_attribute_condition" + + +def _run(provider_kwargs): + iam_client = mock.MagicMock() + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), + mock.patch(f"{CHECK_MODULE}.iam_client", new=iam_client), + ): + from prowler.providers.gcp.services.iam.iam_service import ( + WorkloadIdentityPoolProvider, + ) + from prowler.providers.gcp.services.iam.iam_workload_identity_pool_provider_attribute_condition.iam_workload_identity_pool_provider_attribute_condition import ( + iam_workload_identity_pool_provider_attribute_condition, + ) + + providers = [] + for kwargs in provider_kwargs: + provider_id = kwargs.get("provider_id", "my-provider") + providers.append( + WorkloadIdentityPoolProvider( + name=( + f"projects/{GCP_PROJECT_ID}/locations/global/" + f"workloadIdentityPools/my-pool/providers/{provider_id}" + ), + id=provider_id, + pool_id="my-pool", + pool_disabled=kwargs.get("pool_disabled", False), + project_id=GCP_PROJECT_ID, + state=kwargs.get("state", "ACTIVE"), + disabled=kwargs.get("disabled", False), + attribute_condition=kwargs.get("attribute_condition", ""), + provider_type=kwargs.get("provider_type", "oidc"), + issuer_uri=kwargs.get( + "issuer_uri", + "https://token.actions.githubusercontent.com", + ), + display_name="My Provider", + ) + ) + + iam_client.project_ids = [GCP_PROJECT_ID] + iam_client.region = GCP_US_CENTER1_LOCATION + iam_client.workload_identity_pool_providers = providers + return iam_workload_identity_pool_provider_attribute_condition().execute() + + +class Test_iam_workload_identity_pool_provider_attribute_condition: + def test_no_providers(self): + assert len(_run([])) == 0 + + def test_multi_tenant_issuer_without_attribute_condition_fails(self): + result = _run( + [ + { + "attribute_condition": "", + "issuer_uri": "https://token.actions.githubusercontent.com", + } + ] + ) + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].resource_id.endswith("my-provider") + assert result[0].location == "global" + assert "multi-tenant issuer" in result[0].status_extended + + def test_dedicated_issuer_without_attribute_condition_passes(self): + result = _run( + [ + { + "attribute_condition": "", + "issuer_uri": "https://oidc.eks.eu-west-1.amazonaws.com/id/ABC123", + } + ] + ) + assert len(result) == 1 + assert result[0].status == "PASS" + assert "dedicated issuer" in result[0].status_extended + + def test_non_oidc_provider_without_attribute_condition_passes(self): + result = _run( + [{"attribute_condition": "", "provider_type": "aws", "issuer_uri": ""}] + ) + assert len(result) == 1 + assert result[0].status == "PASS" + assert "not an OIDC provider" in result[0].status_extended + + def test_multi_tenant_issuer_with_port_and_uppercase_fails(self): + result = _run( + [{"attribute_condition": "", "issuer_uri": "https://GitLab.com:443"}] + ) + assert len(result) == 1 + assert result[0].status == "FAIL" + + def test_multi_tenant_issuer_bare_host_fails(self): + result = _run( + [ + { + "attribute_condition": "", + "issuer_uri": "token.actions.githubusercontent.com", + } + ] + ) + assert len(result) == 1 + assert result[0].status == "FAIL" + + def test_multi_tenant_issuer_with_attribute_condition_passes(self): + result = _run( + [ + { + "attribute_condition": "assertion.repository_owner == 'acme'", + "issuer_uri": "https://token.actions.githubusercontent.com", + } + ] + ) + assert len(result) == 1 + assert result[0].status == "PASS" + assert "enforces an attribute condition" in result[0].status_extended + + def test_disabled_provider_passes(self): + result = _run([{"disabled": True}]) + assert len(result) == 1 + assert result[0].status == "PASS" + assert "not active" in result[0].status_extended + + def test_non_active_provider_passes(self): + result = _run([{"state": "DELETED"}]) + assert len(result) == 1 + assert result[0].status == "PASS" + + def test_active_provider_in_disabled_pool_passes(self): + # The provider itself is ACTIVE and unconditioned on a multi-tenant + # issuer, but its parent pool is disabled and cannot vend credentials. + result = _run([{"pool_disabled": True}]) + assert len(result) == 1 + assert result[0].status == "PASS" + assert "disabled pool" in result[0].status_extended diff --git a/tests/providers/gcp/services/iam/iam_workloadidentity_service_test.py b/tests/providers/gcp/services/iam/iam_workloadidentity_service_test.py new file mode 100644 index 0000000000..51385b0204 --- /dev/null +++ b/tests/providers/gcp/services/iam/iam_workloadidentity_service_test.py @@ -0,0 +1,215 @@ +from unittest.mock import MagicMock, patch + +from tests.providers.gcp.gcp_fixtures import ( + GCP_PROJECT_ID, + mock_is_api_active, + set_mocked_gcp_provider, +) + +PROJECT_A = GCP_PROJECT_ID +PROJECT_B = "test-project-b" + + +def _pool_name(project_id, pool_id="my-pool"): + return f"projects/{project_id}/locations/global/workloadIdentityPools/{pool_id}" + + +def _provider_payload(pool_name, provider_id="my-provider"): + return { + "name": f"{pool_name}/providers/{provider_id}", + "state": "ACTIVE", + "disabled": False, + "attributeMapping": {"google.subject": "assertion.sub"}, + "oidc": {"issuerUri": "https://token.actions.githubusercontent.com"}, + "displayName": "gh", + } + + +def _empty_service_accounts(client): + """Stub the service-account calls used by the rest of the IAM __init__.""" + sa = client.projects.return_value.serviceAccounts.return_value + sa.list.return_value.execute.return_value = {"accounts": []} + sa.list_next.return_value = None + + +def _wif_client(_GCPService, _service, _api_version, _credentials): + """Discovery client stub returning one pool with one provider.""" + client = MagicMock() + + pool_name = _pool_name(GCP_PROJECT_ID) + pools = ( + client.projects.return_value.locations.return_value.workloadIdentityPools.return_value + ) + pools.list.return_value.execute.return_value = { + "workloadIdentityPools": [{"name": pool_name, "state": "ACTIVE"}] + } + pools.list_next.return_value = None + + providers = pools.providers.return_value + providers.list.return_value.execute.return_value = { + "workloadIdentityPoolProviders": [_provider_payload(pool_name)] + } + providers.list_next.return_value = None + + _empty_service_accounts(client) + return client + + +def _disabled_pool_client(_GCPService, _service, _api_version, _credentials): + """Discovery client stub: a disabled pool containing an ACTIVE provider.""" + client = MagicMock() + + pool_name = _pool_name(GCP_PROJECT_ID) + pools = ( + client.projects.return_value.locations.return_value.workloadIdentityPools.return_value + ) + pools.list.return_value.execute.return_value = { + "workloadIdentityPools": [ + {"name": pool_name, "state": "ACTIVE", "disabled": True} + ] + } + pools.list_next.return_value = None + + providers = pools.providers.return_value + providers.list.return_value.execute.return_value = { + "workloadIdentityPoolProviders": [_provider_payload(pool_name)] + } + providers.list_next.return_value = None + + _empty_service_accounts(client) + return client + + +def _pool_list_failure_client(_GCPService, _service, _api_version, _credentials): + """Pool listing fails for PROJECT_A but succeeds for PROJECT_B.""" + client = MagicMock() + pool_name_b = _pool_name(PROJECT_B) + + pools = ( + client.projects.return_value.locations.return_value.workloadIdentityPools.return_value + ) + + def pools_list(parent): + request = MagicMock() + if f"projects/{PROJECT_A}/" in parent: + request.execute.side_effect = Exception("permission denied listing pools") + else: + request.execute.return_value = { + "workloadIdentityPools": [{"name": pool_name_b, "state": "ACTIVE"}] + } + return request + + pools.list.side_effect = pools_list + pools.list_next.return_value = None + + providers = pools.providers.return_value + providers.list.return_value.execute.return_value = { + "workloadIdentityPoolProviders": [_provider_payload(pool_name_b)] + } + providers.list_next.return_value = None + + _empty_service_accounts(client) + return client + + +def _provider_list_failure_client(_GCPService, _service, _api_version, _credentials): + """Provider listing fails for pool-1 but succeeds for pool-2 in one project.""" + client = MagicMock() + pool_1 = _pool_name(GCP_PROJECT_ID, "pool-1") + pool_2 = _pool_name(GCP_PROJECT_ID, "pool-2") + + pools = ( + client.projects.return_value.locations.return_value.workloadIdentityPools.return_value + ) + pools.list.return_value.execute.return_value = { + "workloadIdentityPools": [ + {"name": pool_1, "state": "ACTIVE"}, + {"name": pool_2, "state": "ACTIVE"}, + ] + } + pools.list_next.return_value = None + + providers = pools.providers.return_value + + def providers_list(parent): + request = MagicMock() + if parent == pool_1: + request.execute.side_effect = Exception( + "permission denied listing providers" + ) + else: + request.execute.return_value = { + "workloadIdentityPoolProviders": [ + _provider_payload(pool_2, provider_id="provider-2") + ] + } + return request + + providers.list.side_effect = providers_list + providers.list_next.return_value = None + + _empty_service_accounts(client) + return client + + +def _run_service(client_factory, project_ids): + with ( + patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(project_ids=project_ids), + ), + patch( + "prowler.providers.gcp.lib.service.service.GCPService.__is_api_active__", + new=mock_is_api_active, + ), + patch( + "prowler.providers.gcp.lib.service.service.GCPService.__generate_client__", + new=client_factory, + ), + ): + from prowler.providers.gcp.services.iam.iam_service import IAM + + return IAM(set_mocked_gcp_provider(project_ids=project_ids)) + + +class TestIAMWorkloadIdentityService: + def test_get_workload_identity_pool_providers(self): + iam = _run_service(_wif_client, [GCP_PROJECT_ID]) + + assert len(iam.workload_identity_pool_providers) == 1 + provider = iam.workload_identity_pool_providers[0] + assert provider.id == "my-provider" + assert provider.pool_id == "my-pool" + assert provider.project_id == GCP_PROJECT_ID + assert provider.state == "ACTIVE" + assert provider.disabled is False + assert provider.pool_disabled is False + assert provider.attribute_condition == "" + assert provider.provider_type == "oidc" + assert provider.issuer_uri == "https://token.actions.githubusercontent.com" + + def test_disabled_pool_state_propagates_to_provider(self): + iam = _run_service(_disabled_pool_client, [GCP_PROJECT_ID]) + + # The provider is ACTIVE, but its parent pool is disabled: the pool's + # effective state must travel with the provider record. + assert len(iam.workload_identity_pool_providers) == 1 + provider = iam.workload_identity_pool_providers[0] + assert provider.state == "ACTIVE" + assert provider.disabled is False + assert provider.pool_disabled is True + + def test_pool_list_failure_does_not_block_other_projects(self): + iam = _run_service(_pool_list_failure_client, [PROJECT_A, PROJECT_B]) + + # PROJECT_A's pool listing failed, but PROJECT_B is still processed. + assert len(iam.workload_identity_pool_providers) == 1 + assert iam.workload_identity_pool_providers[0].project_id == PROJECT_B + + def test_provider_list_failure_only_skips_that_pool(self): + iam = _run_service(_provider_list_failure_client, [GCP_PROJECT_ID]) + + # pool-1's provider listing failed, but pool-2's provider is still found. + assert len(iam.workload_identity_pool_providers) == 1 + assert iam.workload_identity_pool_providers[0].pool_id == "pool-2" + assert iam.workload_identity_pool_providers[0].id == "provider-2" diff --git a/tests/util/check_yanked_pins_test.py b/tests/util/check_yanked_pins_test.py new file mode 100644 index 0000000000..1d7e354cab --- /dev/null +++ b/tests/util/check_yanked_pins_test.py @@ -0,0 +1,202 @@ +from pathlib import Path + +import pytest + +from util.check_yanked_pins import ( + Pin, + collect_pins, + evaluate, + main, + normalize, + pins_from_pyproject, + pins_from_uv_lock, +) + +PYPROJECT = """ +[project] +name = "demo" +dependencies = [ + "cryptography==48.0.1", + "alibabacloud_tea_openapi==0.4.5", + "Requests[security]==2.34.2 ; python_version >= '3.10'", + "boto3>=1.40", +] + +[project.optional-dependencies] +extra = ["okta==3.4.2"] + +[dependency-groups] +dev = ["pytest==9.0.3", {include-group = "lint"}] +lint = ["flake8==7.1.2"] + +[tool.uv] +constraint-dependencies = ["zstd==1.5.7.3"] +override-dependencies = ["okta==3.4.2"] +""" + +UV_LOCK = """ +version = 1 + +[[package]] +name = "zstd" +version = "1.5.7.3" +source = { registry = "https://pypi.org/simple" } + +[[package]] +name = "Cryptography" +version = "48.0.1" +source = { registry = "https://pypi.org/simple" } + +[[package]] +name = "prowler" +version = "5.40.0" +source = { git = "https://github.com/prowler-cloud/prowler.git?rev=master#abc" } + +[[package]] +name = "demo" +version = "0.1.0" +source = { editable = "." } +""" + + +class TestNormalize: + """normalize() applies PEP 503 so spellings of one project compare equal.""" + + def test_pep503_equivalence(self): + """Underscores, dots and case collapse to the canonical dashed lowercase form.""" + assert normalize("alibabacloud_tea_openapi") == "alibabacloud-tea-openapi" + assert normalize("Requests") == "requests" + assert normalize("zope.interface") == "zope-interface" + + +class TestPinsFromPyproject: + """pins_from_pyproject() reads exact pins from every dependency-bearing table.""" + + def test_collects_exact_pins_from_every_table(self): + """Dependencies, extras, dependency groups and both [tool.uv] lists are covered.""" + pins = pins_from_pyproject(PYPROJECT, "") + assert {(p.name, p.version) for p in pins} == { + ("cryptography", "48.0.1"), + ("alibabacloud-tea-openapi", "0.4.5"), + ("requests", "2.34.2"), + ("okta", "3.4.2"), + ("pytest", "9.0.3"), + ("flake8", "7.1.2"), + ("zstd", "1.5.7.3"), + } + + def test_ignores_ranges_and_records_source_table(self): + """Non-exact specifiers are skipped and each pin remembers its table.""" + pins = pins_from_pyproject(PYPROJECT, "api/") + names = {p.name for p in pins} + assert "boto3" not in names + zstd = next(p for p in pins if p.name == "zstd") + assert zstd.source == "api/pyproject.toml [tool.uv.constraint-dependencies]" + + def test_same_pin_in_two_tables_keeps_both_sources(self): + """The same version in two tables yields two pins, one per source.""" + okta = { + p.source for p in pins_from_pyproject(PYPROJECT, "") if p.name == "okta" + } + assert okta == { + "pyproject.toml [project.optional-dependencies.extra]", + "pyproject.toml [tool.uv.override-dependencies]", + } + + +class TestPinsFromUvLock: + """pins_from_uv_lock() reads locked versions that live on a registry.""" + + def test_only_registry_packages(self): + """git, path and editable sources are not on PyPI and are skipped.""" + pins = pins_from_uv_lock(UV_LOCK, "") + assert {(p.name, p.version) for p in pins} == { + ("zstd", "1.5.7.3"), + ("cryptography", "48.0.1"), + } + assert all(p.source == "uv.lock" for p in pins) + + +class TestCollectPins: + """collect_pins() merges a project's pyproject.toml and uv.lock.""" + + def test_missing_files_raise(self, tmp_path: Path): + """A directory with neither file is a caller error, not an empty result.""" + with pytest.raises(FileNotFoundError): + collect_pins(tmp_path) + + def test_merges_pyproject_and_lock(self, tmp_path: Path): + """Pins from both files are returned with the directory as source prefix.""" + (tmp_path / "pyproject.toml").write_text(PYPROJECT) + (tmp_path / "uv.lock").write_text(UV_LOCK) + sources = {p.source for p in collect_pins(tmp_path)} + prefix = f"{tmp_path.as_posix()}/" + assert f"{prefix}uv.lock" in sources + assert f"{prefix}pyproject.toml [project.dependencies]" in sources + + +class TestEvaluate: + """evaluate() queries PyPI once per release and reports per pin.""" + + def test_queries_each_release_once_and_fans_out_to_every_source(self): + """One fetch per (name, version); its verdict reaches every source of that pin.""" + calls = [] + + def fake_fetch(name, version): + """Stand-in for fetch_release() that records calls and returns fixed verdicts.""" + calls.append((name, version)) + if (name, version) == ("zstd", "1.5.7.3"): + return "yanked", "buggy - not thread safe" + if (name, version) == ("gone", "0.0.1"): + return "missing", "not found on PyPI" + return "ok", "" + + pins = { + Pin("zstd", "1.5.7.3", "pyproject.toml [tool.uv.constraint-dependencies]"), + Pin("zstd", "1.5.7.3", "uv.lock"), + Pin("cryptography", "48.0.1", "uv.lock"), + Pin("gone", "0.0.1", "uv.lock"), + } + verdicts = evaluate(pins, fetch=fake_fetch, workers=2) + + assert sorted(calls) == [ + ("cryptography", "48.0.1"), + ("gone", "0.0.1"), + ("zstd", "1.5.7.3"), + ] + by_status = {} + for verdict in verdicts: + by_status.setdefault(verdict.status, []).append(verdict.pin) + assert len(by_status["yanked"]) == 2 + assert {p.source for p in by_status["yanked"]} == { + "pyproject.toml [tool.uv.constraint-dependencies]", + "uv.lock", + } + assert by_status["missing"] == [Pin("gone", "0.0.1", "uv.lock")] + assert by_status["ok"] == [Pin("cryptography", "48.0.1", "uv.lock")] + + +class TestMain: + """main() turns verdicts into a process exit code and annotations.""" + + def test_exit_code_reflects_verdicts(self, tmp_path: Path, monkeypatch, capsys): + """0 when every pin is ok, 1 plus a ::error:: line when one is yanked.""" + (tmp_path / "pyproject.toml").write_text( + '[project]\ndependencies = ["zstd==1.5.7.3"]\n' + ) + + monkeypatch.setattr( + "util.check_yanked_pins.fetch_release", + lambda name, version, retries=3: ("ok", ""), + ) + assert main([str(tmp_path)]) == 0 + + monkeypatch.setattr( + "util.check_yanked_pins.fetch_release", + lambda name, version, retries=3: ("yanked", "buggy - not thread safe"), + ) + assert main([str(tmp_path)]) == 1 + assert ( + "::error::zstd==1.5.7.3 is yanked (buggy - not thread safe)" + in capsys.readouterr().out + ) diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md index 8f59e42a59..6486d56867 100644 --- a/ui/CHANGELOG.md +++ b/ui/CHANGELOG.md @@ -4,6 +4,24 @@ All notable changes to the **Prowler UI** are documented in this file. +## [1.39.0] (Prowler v5.39.0) + +### πŸš€ Added + +- Manual verification workflow for `MANUAL` findings with evidence, effective `PASS` status, and expiration details [(#12253)](https://github.com/prowler-cloud/prowler/pull/12253) +- Surface pre-configured credential creation links in the add-provider wizard. Cloudflare exposes the User API Token template and an Account-Owned template pinned to the Cloudflare Account ID entered in the wizard, GitHub exposes the personal-repositories template and an organization-scanning template pinned to the identifier entered in the wizard [(#12349)](https://github.com/prowler-cloud/prowler/pull/12349) +- Attack Paths graph groups resources by class into expandable nodes and marks the query outcome as the terminal node, with the clicked resource highlighted while its findings are expanded (Prowler Cloud only) [(#12381)](https://github.com/prowler-cloud/prowler/pull/12381) +- Azure Management Group onboarding: add every subscription in a tenant at once (Prowler Cloud only) [(#12386)](https://github.com/prowler-cloud/prowler/pull/12386) +- Manage Lighthouse AI role permission in the role forms and role details, so permission to change the Lighthouse AI configuration can be granted or restricted independently of other permissions (Prowler Cloud only) [(#12412)](https://github.com/prowler-cloud/prowler/pull/12412) +- CMMC 2.0 universal compliance framework rendering: dedicated icon, Domain/Level requirement mapper and cross-provider catalog tile [(#12414)](https://github.com/prowler-cloud/prowler/pull/12414) + +### 🐞 Fixed + +- Organization discovery describes a too-deep hierarchy in each provider's own vocabulary: AWS organizational units, Azure Management Groups, Google Cloud folders [(#12386)](https://github.com/prowler-cloud/prowler/pull/12386) +- `View Findings` on the Scans page no longer opens an empty list for users outside the UTC timezone [(#12411)](https://github.com/prowler-cloud/prowler/pull/12411) + +--- + ## [1.38.0] (Prowler v5.38.0) ### πŸš€ Added diff --git a/ui/actions/auth/auth.test.ts b/ui/actions/auth/auth.test.ts index f9fd0f5b64..9b8b44e05b 100644 --- a/ui/actions/auth/auth.test.ts +++ b/ui/actions/auth/auth.test.ts @@ -21,7 +21,36 @@ vi.mock("@/lib/sentry-breadcrumbs", () => ({ addAuthEvent: vi.fn(), })); -import { createNewUser } from "./auth"; +import { createNewUser, getUserByMe } from "./auth"; + +const userMeResponse = (roleAttributes: Record) => ({ + data: { + type: "users", + id: "019b1234-5678-7abc-9def-0123456789ab", + attributes: { + name: "Jane Doe", + email: "jane@example.com", + company_name: "Prowler", + date_joined: "2026-01-01T00:00:00.000Z", + }, + }, + included: [ + { + type: "roles", + id: "role-1", + attributes: { name: "Cloud admin", ...roleAttributes }, + }, + ], +}); + +const mockUserMe = (roleAttributes: Record) => { + fetchMock.mockResolvedValue( + new Response(JSON.stringify(userMeResponse(roleAttributes)), { + status: 200, + headers: { "Content-Type": "application/json" }, + }), + ); +}; describe("auth actions", () => { beforeEach(() => { @@ -102,4 +131,27 @@ describe("auth actions", () => { expect(requestUrl.searchParams.get("promo_code")).toBe("black-hat-2026"); expect(requestUrl.searchParams.get("utm_source")).toBe("blackhat"); }); + + it("should carry manage_lighthouse_ai_configuration into the session permissions", async () => { + // Given + mockUserMe({ manage_lighthouse_ai_configuration: true }); + + // When + const result = await getUserByMe("access-token"); + + // Then + expect(result.permissions.manage_lighthouse_ai_configuration).toBe(true); + }); + + it("should default manage_lighthouse_ai_configuration to false when the role omits it", async () => { + // Given + mockUserMe({ manage_users: true }); + + // When + const result = await getUserByMe("access-token"); + + // Then + expect(result.permissions.manage_lighthouse_ai_configuration).toBe(false); + expect(result.permissions.manage_users).toBe(true); + }); }); diff --git a/ui/actions/auth/auth.ts b/ui/actions/auth/auth.ts index 37eb3f6b5c..646c3d1426 100644 --- a/ui/actions/auth/auth.ts +++ b/ui/actions/auth/auth.ts @@ -181,6 +181,8 @@ export const getUserByMe = async (accessToken: string) => { manage_integrations: userRole.attributes.manage_integrations || false, manage_billing: userRole.attributes.manage_billing || false, manage_alerts: userRole.attributes.manage_alerts || false, + manage_lighthouse_ai_configuration: + userRole.attributes.manage_lighthouse_ai_configuration || false, unlimited_visibility: userRole.attributes.unlimited_visibility || false, }; diff --git a/ui/actions/roles/roles.test.ts b/ui/actions/roles/roles.test.ts index 3546649604..3b253cce58 100644 --- a/ui/actions/roles/roles.test.ts +++ b/ui/actions/roles/roles.test.ts @@ -49,6 +49,7 @@ const makeRoleFormData = () => { formData.set("manage_integrations", "false"); formData.set("manage_scans", "false"); formData.set("manage_alerts", "true"); + formData.set("manage_lighthouse_ai_configuration", "true"); formData.set("unlimited_visibility", "false"); return formData; }; @@ -106,4 +107,56 @@ describe("role actions", () => { // Then expect(lastRequestBody().data.attributes.manage_alerts).toBe(true); }); + + it("includes manage_lighthouse_ai_configuration when creating a role in Prowler Cloud", async () => { + // Given + vi.stubEnv("UI_CLOUD_ENABLED", "true"); + + // When + await addRole(makeRoleFormData()); + + // Then + expect( + lastRequestBody().data.attributes.manage_lighthouse_ai_configuration, + ).toBe(true); + }); + + it("omits manage_lighthouse_ai_configuration when creating a role outside Prowler Cloud", async () => { + // Given + vi.stubEnv("UI_CLOUD_ENABLED", "false"); + + // When + await addRole(makeRoleFormData()); + + // Then + expect(lastRequestBody().data.attributes).not.toHaveProperty( + "manage_lighthouse_ai_configuration", + ); + }); + + it("includes manage_lighthouse_ai_configuration when updating a role in Prowler Cloud", async () => { + // Given + vi.stubEnv("UI_CLOUD_ENABLED", "true"); + + // When + await updateRole(makeRoleFormData(), "role-1"); + + // Then + expect( + lastRequestBody().data.attributes.manage_lighthouse_ai_configuration, + ).toBe(true); + }); + + it("omits manage_lighthouse_ai_configuration when updating a role outside Prowler Cloud", async () => { + // Given + vi.stubEnv("UI_CLOUD_ENABLED", "false"); + + // When + await updateRole(makeRoleFormData(), "role-1"); + + // Then + expect(lastRequestBody().data.attributes).not.toHaveProperty( + "manage_lighthouse_ai_configuration", + ); + }); }); diff --git a/ui/actions/roles/roles.ts b/ui/actions/roles/roles.ts index cfe3837414..972d6d12e8 100644 --- a/ui/actions/roles/roles.ts +++ b/ui/actions/roles/roles.ts @@ -114,6 +114,8 @@ export const addRole = async (formData: FormData) => { formData.get("manage_billing") === "true"; payload.data.attributes.manage_alerts = formData.get("manage_alerts") === "true"; + payload.data.attributes.manage_lighthouse_ai_configuration = + formData.get("manage_lighthouse_ai_configuration") === "true"; } // Add provider groups relationships only if there are items @@ -171,6 +173,8 @@ export const updateRole = async (formData: FormData, roleId: string) => { formData.get("manage_billing") === "true"; payload.data.attributes.manage_alerts = formData.get("manage_alerts") === "true"; + payload.data.attributes.manage_lighthouse_ai_configuration = + formData.get("manage_lighthouse_ai_configuration") === "true"; } // Add provider groups relationships only if there are items diff --git a/ui/app/(prowler)/compliance/_lib/cross-provider-frameworks.ts b/ui/app/(prowler)/compliance/_lib/cross-provider-frameworks.ts index 93a6e466eb..86643aaa86 100644 --- a/ui/app/(prowler)/compliance/_lib/cross-provider-frameworks.ts +++ b/ui/app/(prowler)/compliance/_lib/cross-provider-frameworks.ts @@ -60,6 +60,21 @@ export const CROSS_PROVIDER_FRAMEWORKS: CrossProviderFrameworkEntry[] = [ "Digital Operational Resilience Act (EU 2022/2554) β€” the EU framework for the digital operational resilience of the financial sector.", compatibleProviders: ["aws", "azure", "gcp", "alibabacloud", "cloudflare"], }, + { + complianceId: "cmmc_2.0", + title: "CMMC", + version: "2.0", + description: + "Cybersecurity Maturity Model Certification (CMMC) 2.0 (32 CFR Part 170) β€” the U.S. Department of Defense program verifying that defense contractors protect FCI and CUI across three levels.", + compatibleProviders: [ + "aws", + "azure", + "gcp", + "m365", + "alibabacloud", + "oraclecloud", + ], + }, ]; /** Resolves only canonical catalog links. Missing, unknown, or mismatched diff --git a/ui/auth.config.ts b/ui/auth.config.ts index eefc73b2a4..9d7544e371 100644 --- a/ui/auth.config.ts +++ b/ui/auth.config.ts @@ -54,6 +54,7 @@ const DEFAULT_PERMISSIONS: RolePermissionAttributes = { manage_integrations: false, manage_billing: false, manage_alerts: false, + manage_lighthouse_ai_configuration: false, unlimited_visibility: false, }; diff --git a/ui/changelog.d/attack-paths-grouped-graph.added.md b/ui/changelog.d/attack-paths-grouped-graph.added.md deleted file mode 100644 index 3e66c9b0a6..0000000000 --- a/ui/changelog.d/attack-paths-grouped-graph.added.md +++ /dev/null @@ -1 +0,0 @@ -Attack Paths graph groups resources by class into expandable nodes and marks the query outcome as the terminal node, with the clicked resource highlighted while its findings are expanded (Prowler Cloud only) diff --git a/ui/changelog.d/azure-deploy-to-azure-bicep-quick-start.added.md b/ui/changelog.d/azure-deploy-to-azure-bicep-quick-start.added.md deleted file mode 100644 index 6faa7feb22..0000000000 --- a/ui/changelog.d/azure-deploy-to-azure-bicep-quick-start.added.md +++ /dev/null @@ -1 +0,0 @@ -Add a Deploy to Azure quick-start to the add-provider wizard. Azure now shows a credential-type selector (Certificate authentication recommended, Service Principal with Client Secret fallback). The certificate form guides the user through creating the App Registration and uploading the certificate in the Portal (with an in-browser "Generate certificate for me" helper that keeps the private key client-side), then a one-click Deploy to Azure button that opens the Portal deployment blade pre-loaded with the Prowler Bicep template to assign the built-in Reader role and a custom ProwlerRole to that App Registration's service principal diff --git a/ui/changelog.d/azure-management-group-onboarding.added.md b/ui/changelog.d/azure-management-group-onboarding.added.md deleted file mode 100644 index 29fa6cdd6b..0000000000 --- a/ui/changelog.d/azure-management-group-onboarding.added.md +++ /dev/null @@ -1 +0,0 @@ -Azure Management Group onboarding: add every subscription in a tenant at once (Prowler Cloud only) diff --git a/ui/changelog.d/imported-provider-provenance.added.md b/ui/changelog.d/imported-provider-provenance.added.md new file mode 100644 index 0000000000..79999a976a --- /dev/null +++ b/ui/changelog.d/imported-provider-provenance.added.md @@ -0,0 +1 @@ +Prowler Cloud indicator for providers created via Import Findings alongside every connection status diff --git a/ui/changelog.d/manual-pass-triage.added.md b/ui/changelog.d/manual-pass-triage.added.md deleted file mode 100644 index 3527f53be0..0000000000 --- a/ui/changelog.d/manual-pass-triage.added.md +++ /dev/null @@ -1 +0,0 @@ -Manual verification workflow for `MANUAL` findings with evidence, effective `PASS` status, and expiration details diff --git a/ui/changelog.d/org-hierarchy-depth-copy.fixed.md b/ui/changelog.d/org-hierarchy-depth-copy.fixed.md deleted file mode 100644 index 8d702302f3..0000000000 --- a/ui/changelog.d/org-hierarchy-depth-copy.fixed.md +++ /dev/null @@ -1 +0,0 @@ -Organization discovery describes a too-deep hierarchy in each provider's own vocabulary: AWS organizational units, Azure Management Groups, Google Cloud folders diff --git a/ui/changelog.d/provider-wizard-preconfigured-credential-links.added.md b/ui/changelog.d/provider-wizard-preconfigured-credential-links.added.md deleted file mode 100644 index 90ea9a436e..0000000000 --- a/ui/changelog.d/provider-wizard-preconfigured-credential-links.added.md +++ /dev/null @@ -1 +0,0 @@ -Surface pre-configured credential creation links in the add-provider wizard. Cloudflare exposes the User API Token template and an Account-Owned template pinned to the Cloudflare Account ID entered in the wizard, GitHub exposes the personal-repositories template and an organization-scanning template pinned to the identifier entered in the wizard diff --git a/ui/changelog.d/scan-auto-refresh-settlement.fixed.md b/ui/changelog.d/scan-auto-refresh-settlement.fixed.md new file mode 100644 index 0000000000..c87c5085ed --- /dev/null +++ b/ui/changelog.d/scan-auto-refresh-settlement.fixed.md @@ -0,0 +1 @@ +Scan auto-refresh no longer overlaps slow client refreshes and now signals when scan execution settles diff --git a/ui/changelog.d/scan-findings-utc-day.fixed.md b/ui/changelog.d/scan-findings-utc-day.fixed.md deleted file mode 100644 index 43ad7cc94f..0000000000 --- a/ui/changelog.d/scan-findings-utc-day.fixed.md +++ /dev/null @@ -1 +0,0 @@ -`View Findings` on the Scans page no longer opens an empty list for users outside the UTC timezone diff --git a/ui/changelog.d/scan-trial-sidebar-banner.added.md b/ui/changelog.d/scan-trial-sidebar-banner.added.md new file mode 100644 index 0000000000..9b853f2e48 --- /dev/null +++ b/ui/changelog.d/scan-trial-sidebar-banner.added.md @@ -0,0 +1 @@ +Display the default one-scan free trial and trial expiration in the existing sidebar banner diff --git a/ui/components/compliance/compliance-custom-details/cmmc-details.tsx b/ui/components/compliance/compliance-custom-details/cmmc-details.tsx new file mode 100644 index 0000000000..4b452a88b5 --- /dev/null +++ b/ui/components/compliance/compliance-custom-details/cmmc-details.tsx @@ -0,0 +1,49 @@ +import { Requirement } from "@/types/compliance"; + +import { + ComplianceBadge, + ComplianceBadgeContainer, + ComplianceDetailContainer, + ComplianceDetailSection, + ComplianceDetailText, +} from "./shared-components"; + +interface CMMCDetailsProps { + requirement: Requirement; +} + +export const CMMCCustomDetails = ({ requirement }: CMMCDetailsProps) => { + return ( + + {requirement.description && ( + + {requirement.description} + + )} + + + {requirement.domain && ( + + )} + {requirement.level && ( + + )} + {requirement.source_requirement && ( + + )} + + + ); +}; diff --git a/ui/components/icons/compliance/IconCompliance.tsx b/ui/components/icons/compliance/IconCompliance.tsx index 6723fe8a95..6eba0ef345 100644 --- a/ui/components/icons/compliance/IconCompliance.tsx +++ b/ui/components/icons/compliance/IconCompliance.tsx @@ -5,6 +5,7 @@ import C5Logo from "./c5.svg"; import CCCLogo from "./ccc.svg"; import CISLogo from "./cis.svg"; import CISALogo from "./cisa.svg"; +import CMMCLogo from "./cmmc.svg"; import CSALogo from "./csa.svg"; import DORALogo from "./dora.svg"; import ENSLogo from "./ens.png"; @@ -69,6 +70,10 @@ const COMPLIANCE_LOGOS = [ ["c5", C5Logo], ["ccc", CCCLogo], ["csa", CSALogo], + // CMMC 2.0 β€” universal framework (`prowler/compliance/cmmc_2.0.json`). The + // compliance_id is `cmmc_2.0` and the `framework`/title is `CMMC`; the `cmmc` + // keyword matches both via `includes`, with no provider suffix. + ["cmmc", CMMCLogo], // DORA β€” universal framework (`prowler/compliance/dora_2022_2554.json`). // The compliance_id is `dora_2022_2554`; the `dora` keyword still matches // it via `includes`, with no provider suffix. diff --git a/ui/components/icons/compliance/cmmc.svg b/ui/components/icons/compliance/cmmc.svg new file mode 100644 index 0000000000..d4bbeb9f63 --- /dev/null +++ b/ui/components/icons/compliance/cmmc.svg @@ -0,0 +1,13 @@ + + + + + + + + + + CMMC + 2.0 + + diff --git a/ui/components/layout/app-sidebar/trial-sidebar-banner.test.tsx b/ui/components/layout/app-sidebar/trial-sidebar-banner.test.tsx new file mode 100644 index 0000000000..0df51b92ea --- /dev/null +++ b/ui/components/layout/app-sidebar/trial-sidebar-banner.test.tsx @@ -0,0 +1,217 @@ +import { fireEvent, render, screen } from "@testing-library/react"; +import userEvent from "@testing-library/user-event"; +import { describe, expect, it, vi } from "vitest"; + +import { + TRIAL_SIDEBAR_BANNER_VARIANT, + TrialSidebarBanner, +} from "./trial-sidebar-banner"; + +describe("TrialSidebarBanner", () => { + it("preserves the active day-based trial card", () => { + // Given / When + render( + , + ); + + // Then + const banner = screen.getByRole("status", { name: "Active trial" }); + expect(banner).toHaveTextContent("Unlimited trial"); + expect(banner).toHaveTextContent("7 days left"); + expect(banner).toHaveTextContent( + "Unlimited accounts, scans, and daily schedules", + ); + expect(banner).toHaveTextContent("Explore plans"); + expect(banner).toHaveAttribute("data-slot", "sidebar-trial"); + expect( + screen.getByRole("link", { + name: "Explore plans for your unlimited trial", + }), + ).toHaveAttribute("href", "/billing"); + }); + + it("preserves an active unlimited trial without a counter", () => { + // Given / When + render( + , + ); + + // Then + const banner = screen.getByRole("status", { name: "Active trial" }); + expect(banner).toHaveTextContent("Unlimited trial"); + expect(banner).toHaveTextContent("Trial active"); + expect(banner).toHaveTextContent( + "Unlimited accounts, scans, and daily schedules", + ); + expect(banner).toHaveAttribute("data-urgency", "healthy"); + expect( + screen.getByRole("link", { + name: "Explore plans for your unlimited trial", + }), + ).toHaveAttribute("href", "/billing"); + }); + + it("formats a singular remaining day", () => { + // Given / When + render( + , + ); + + // Then + const banner = screen.getByRole("status", { name: "Active trial" }); + expect(banner).toHaveTextContent("1 day left"); + expect(banner).toHaveAttribute("data-urgency", "critical"); + }); + + it.each([ + { remaining: 1, copy: "1 scan left", urgency: "healthy" }, + { remaining: 5, copy: "5 scans left", urgency: "healthy" }, + ])( + "formats $remaining remaining scan(s) in the active card", + ({ remaining, copy, urgency }) => { + // Given / When + render( + , + ); + + // Then + const banner = screen.getByRole("status", { name: "Active trial" }); + expect(banner).toHaveTextContent(copy); + expect(banner).toHaveTextContent("Free trial"); + expect(banner).not.toHaveTextContent("Unlimited trial"); + expect(banner).toHaveTextContent( + "Choose a plan to keep running scans after your trial ends.", + ); + expect(banner).toHaveAttribute("data-urgency", urgency); + expect( + screen.getByRole("link", { + name: "Explore plans for your free trial", + }), + ).toHaveAttribute("href", "/billing"); + }, + ); + + it.each([ + { remaining: 0, copy: "0 scans left" }, + { remaining: -4, copy: "0 scans left" }, + ])( + "marks a scan trial with $remaining remaining as spent", + ({ remaining, copy }) => { + // Given / When + render( + , + ); + + // Then + const banner = screen.getByRole("status", { name: "Active trial" }); + expect(banner).toHaveTextContent(copy); + expect(banner).toHaveAttribute("data-urgency", "critical"); + expect(screen.getByText("Free trial")).toHaveClass( + "bg-bg-fail-secondary", + ); + }, + ); + + it("renders exhausted scan trials with the existing expired presentation", () => { + // Given / When + render( + , + ); + + // Then + const banner = screen.getByRole("status", { name: "Expired trial" }); + expect(banner).toHaveTextContent("Trial expired"); + expect(banner).toHaveTextContent("Subscription required"); + expect(banner).toHaveTextContent( + "Subscribe to continue scanning and running scheduled scans.", + ); + expect(banner).not.toHaveTextContent("0 scans left"); + expect(banner).toHaveAttribute("data-urgency", "critical"); + expect( + screen.getByRole("link", { + name: "Explore plans after your trial expired", + }), + ).toHaveAttribute("href", "/billing"); + }); + + it("invokes the sidebar selection callback from the billing CTA", async () => { + // Given + const user = userEvent.setup(); + const onSelect = vi.fn(); + render( + , + ); + document.addEventListener("click", (event) => event.preventDefault(), { + once: true, + }); + + // When + await user.click( + screen.getByRole("link", { + name: "Explore plans for your unlimited trial", + }), + ); + + // Then + expect(onSelect).toHaveBeenCalledOnce(); + }); + + // The tilt runs on animation frames and `useReducedMotion` caches its media + // query module-globally, so both belong in Browser Mode, not jsdom. + it("renders the decorative glow layer", () => { + // Given / When + const { container } = render( + , + ); + + // Then + const glow = container.querySelector('[data-slot="trial-glow"]'); + expect(glow).toBeInTheDocument(); + expect(glow).toHaveClass("motion-reduce:hidden"); + }); + + it.each([{ pointerType: "touch" }, { pointerType: "mouse" }])( + "keeps the card usable under $pointerType input", + ({ pointerType }) => { + // Given + render( + , + ); + const card = screen.getByRole("link", { + name: "Explore plans for your unlimited trial", + }); + + // When + fireEvent.pointerMove(card, { clientX: 250, clientY: 60, pointerType }); + fireEvent.pointerLeave(card); + + // Then + expect(card).toBeInTheDocument(); + expect(card).toHaveTextContent("7 days left"); + }, + ); +}); diff --git a/ui/components/layout/app-sidebar/trial-sidebar-banner.tsx b/ui/components/layout/app-sidebar/trial-sidebar-banner.tsx new file mode 100644 index 0000000000..7a42976164 --- /dev/null +++ b/ui/components/layout/app-sidebar/trial-sidebar-banner.tsx @@ -0,0 +1,317 @@ +"use client"; + +import { + motion, + useMotionValue, + useReducedMotion, + useSpring, + useTransform, +} from "framer-motion"; +import { ArrowRight, Sparkles } from "lucide-react"; +import Link from "next/link"; +import { type PointerEvent } from "react"; + +import { Badge } from "@/components/shadcn/badge/badge"; +import { Card } from "@/components/shadcn/card/card"; +import { cn } from "@/lib/utils"; + +export const TRIAL_SIDEBAR_BANNER_VARIANT = { + ACTIVE_DAYS: "active_days", + ACTIVE_SCANS: "active_scans", + ACTIVE_UNLIMITED: "active_unlimited", + EXPIRED: "expired", +} as const; + +interface TrialSidebarBannerBaseProps { + onSelect?: () => HTMLElement | null; +} + +interface ActiveTrialSidebarBannerProps extends TrialSidebarBannerBaseProps { + remaining: number; +} + +interface ActiveDaysTrialSidebarBannerProps + extends ActiveTrialSidebarBannerProps { + variant: typeof TRIAL_SIDEBAR_BANNER_VARIANT.ACTIVE_DAYS; +} + +interface ActiveScansTrialSidebarBannerProps + extends ActiveTrialSidebarBannerProps { + variant: typeof TRIAL_SIDEBAR_BANNER_VARIANT.ACTIVE_SCANS; +} + +interface ActiveUnlimitedTrialSidebarBannerProps + extends TrialSidebarBannerBaseProps { + variant: typeof TRIAL_SIDEBAR_BANNER_VARIANT.ACTIVE_UNLIMITED; + remaining?: never; +} + +interface ExpiredTrialSidebarBannerProps extends TrialSidebarBannerBaseProps { + variant: typeof TRIAL_SIDEBAR_BANNER_VARIANT.EXPIRED; + remaining?: never; +} + +export type TrialSidebarBannerProps = + | ActiveDaysTrialSidebarBannerProps + | ActiveScansTrialSidebarBannerProps + | ActiveUnlimitedTrialSidebarBannerProps + | ExpiredTrialSidebarBannerProps; + +const TRIAL_URGENCY = { + HEALTHY: "healthy", + WARNING: "warning", + CRITICAL: "critical", +} as const; + +type TrialUrgency = (typeof TRIAL_URGENCY)[keyof typeof TRIAL_URGENCY]; + +const TRIAL_SIDEBAR_BANNER_UNIT = { + DAY: "day", + SCAN: "scan", +} as const; + +type TrialSidebarBannerUnit = + (typeof TRIAL_SIDEBAR_BANNER_UNIT)[keyof typeof TRIAL_SIDEBAR_BANNER_UNIT]; + +type TrialSidebarBannerVariant = + (typeof TRIAL_SIDEBAR_BANNER_VARIANT)[keyof typeof TRIAL_SIDEBAR_BANNER_VARIANT]; + +type MeteredTrialVariant = Extract< + TrialSidebarBannerProps, + { remaining: number } +>["variant"]; + +interface TrialSidebarBannerCopy { + badge: string; + body: string; + linkLabel: string; + cardLabel: string; +} + +const UNLIMITED_COPY = { + badge: "Unlimited trial", + body: "Unlimited accounts, scans, and daily schedules. Subscribe to keep everything running.", + linkLabel: "Explore plans for your unlimited trial", + cardLabel: "Active trial", +} as const satisfies TrialSidebarBannerCopy; + +// Keyed maps rather than ternaries: a new variant fails to compile until every +// string and unit is supplied for it. +const TRIAL_SIDEBAR_BANNER_COPY: Record< + TrialSidebarBannerVariant, + TrialSidebarBannerCopy +> = { + [TRIAL_SIDEBAR_BANNER_VARIANT.ACTIVE_DAYS]: UNLIMITED_COPY, + [TRIAL_SIDEBAR_BANNER_VARIANT.ACTIVE_UNLIMITED]: UNLIMITED_COPY, + [TRIAL_SIDEBAR_BANNER_VARIANT.ACTIVE_SCANS]: { + badge: "Free trial", + body: "Choose a plan to keep running scans after your trial ends.", + linkLabel: "Explore plans for your free trial", + cardLabel: "Active trial", + }, + [TRIAL_SIDEBAR_BANNER_VARIANT.EXPIRED]: { + badge: "Trial expired", + body: "Subscribe to continue scanning and running scheduled scans.", + linkLabel: "Explore plans after your trial expired", + cardLabel: "Expired trial", + }, +}; + +const TRIAL_SIDEBAR_BANNER_METER: Record< + MeteredTrialVariant, + TrialSidebarBannerUnit +> = { + [TRIAL_SIDEBAR_BANNER_VARIANT.ACTIVE_DAYS]: TRIAL_SIDEBAR_BANNER_UNIT.DAY, + [TRIAL_SIDEBAR_BANNER_VARIANT.ACTIVE_SCANS]: TRIAL_SIDEBAR_BANNER_UNIT.SCAN, +}; + +interface TrialUrgencyStyles { + sidebarBorder: string; + sidebarTint: string; + sidebarGlow: string; +} + +const TRIAL_URGENCY_STYLES: Record = { + [TRIAL_URGENCY.HEALTHY]: { + sidebarBorder: "border-button-primary", + sidebarTint: "bg-button-primary/10", + sidebarGlow: "bg-button-primary/20", + }, + [TRIAL_URGENCY.WARNING]: { + sidebarBorder: "border-bg-warning", + sidebarTint: "bg-bg-warning-secondary/20", + sidebarGlow: "bg-bg-warning/20", + }, + [TRIAL_URGENCY.CRITICAL]: { + sidebarBorder: "border-border-error", + sidebarTint: "bg-bg-fail-secondary/40", + sidebarGlow: "bg-bg-fail/20", + }, +}; + +const getTrialUrgency = (props: TrialSidebarBannerProps): TrialUrgency => { + if (props.variant === TRIAL_SIDEBAR_BANNER_VARIANT.EXPIRED) { + return TRIAL_URGENCY.CRITICAL; + } + if ( + props.variant === TRIAL_SIDEBAR_BANNER_VARIANT.ACTIVE_SCANS && + props.remaining > 0 + ) { + return TRIAL_URGENCY.HEALTHY; + } + if (props.variant === TRIAL_SIDEBAR_BANNER_VARIANT.ACTIVE_UNLIMITED) { + return TRIAL_URGENCY.HEALTHY; + } + if (props.remaining <= 1) return TRIAL_URGENCY.CRITICAL; + if (props.remaining <= 5) return TRIAL_URGENCY.WARNING; + return TRIAL_URGENCY.HEALTHY; +}; + +const formatRemaining = (remaining: number, unit: TrialSidebarBannerUnit) => { + // The API sends a cap and a usage counter, so callers subtract and can go negative. + const left = Math.max(0, remaining); + + return `${left} ${unit}${left === 1 ? "" : "s"} left`; +}; + +const TILT_SPRING = { stiffness: 260, damping: 26, mass: 0.6 } as const; +const TILT_RESTING_POINTER = 0.5; +const TILT_RANGE_X = 1.5; +const TILT_RANGE_Y = 2; +const TILT_LIFT = -2; + +export const TrialSidebarBanner = (props: TrialSidebarBannerProps) => { + const isExpired = props.variant === TRIAL_SIDEBAR_BANNER_VARIANT.EXPIRED; + const isScanBased = + props.variant === TRIAL_SIDEBAR_BANNER_VARIANT.ACTIVE_SCANS; + // The backend keeps a scan-capped trial `active` once its quota is spent. + const isExhausted = isScanBased && props.remaining <= 0; + const urgency = getTrialUrgency(props); + const urgencyStyles = TRIAL_URGENCY_STYLES[urgency]; + const copy = TRIAL_SIDEBAR_BANNER_COPY[props.variant]; + const heading = isExpired + ? "Subscription required" + : props.variant === TRIAL_SIDEBAR_BANNER_VARIANT.ACTIVE_UNLIMITED + ? "Trial active" + : formatRemaining( + props.remaining, + TRIAL_SIDEBAR_BANNER_METER[props.variant], + ); + + const prefersReducedMotion = useReducedMotion(); + + // Normalised pointer position (0..1) over the card. + const pointerX = useMotionValue(TILT_RESTING_POINTER); + const pointerY = useMotionValue(TILT_RESTING_POINTER); + const hover = useMotionValue(0); + + const rotateX = useSpring( + useTransform(pointerY, [0, 1], [TILT_RANGE_X, -TILT_RANGE_X]), + TILT_SPRING, + ); + const rotateY = useSpring( + useTransform(pointerX, [0, 1], [-TILT_RANGE_Y, TILT_RANGE_Y]), + TILT_SPRING, + ); + const lift = useSpring( + useTransform(hover, [0, 1], [0, TILT_LIFT]), + TILT_SPRING, + ); + const glowLeft = useTransform(pointerX, (value) => `${value * 100}%`); + const glowTop = useTransform(pointerY, (value) => `${value * 100}%`); + + const resetMotion = () => { + pointerX.set(TILT_RESTING_POINTER); + pointerY.set(TILT_RESTING_POINTER); + hover.set(0); + }; + + const followPointer = (event: PointerEvent) => { + if (prefersReducedMotion || event.pointerType === "touch") return; + + const bounds = event.currentTarget.getBoundingClientRect(); + if (!bounds.width || !bounds.height) return; + + pointerX.set((event.clientX - bounds.left) / bounds.width); + pointerY.set((event.clientY - bounds.top) / bounds.height); + hover.set(1); + }; + + return ( + + + + + + + ); +}; diff --git a/ui/components/providers/table/column-providers.test.tsx b/ui/components/providers/table/column-providers.test.tsx index 89e7aea791..27e76f3b3b 100644 --- a/ui/components/providers/table/column-providers.test.tsx +++ b/ui/components/providers/table/column-providers.test.tsx @@ -1,6 +1,7 @@ import { render, screen } from "@testing-library/react"; +import userEvent from "@testing-library/user-event"; import type { ReactNode } from "react"; -import { describe, expect, it, vi } from "vitest"; +import { afterEach, describe, expect, it, vi } from "vitest"; import { PROVIDERS_ROW_TYPE, @@ -10,9 +11,18 @@ import { import { getColumnProviders } from "./column-providers"; -vi.mock("@/components/shadcn", () => ({ - Badge: ({ children }: { children: ReactNode }) => {children}, -})); +vi.mock("@/components/shadcn", async () => { + const tooltip = await vi.importActual< + typeof import("@/components/shadcn/tooltip") + >("@/components/shadcn/tooltip"); + + return { + Badge: ({ children, ...props }: { children: ReactNode }) => ( + {children} + ), + ...tooltip, + }; +}); vi.mock("@/components/shadcn/checkbox/checkbox", () => ({ Checkbox: () => null, @@ -64,6 +74,7 @@ const providerRow: ProvidersProviderRow = { attributes: { provider: "aws", is_dynamic: false, + is_imported: false, uid: "123456789012", alias: "Production", status: "completed", @@ -115,6 +126,33 @@ function renderLastScanCell(row: ProvidersTableRow) { render(<>{element as ReactNode}); } +function renderStatusCell(row: ProvidersTableRow) { + const statusColumn = getColumnProviders( + {}, + [], + [], + [], + vi.fn(), + vi.fn(), + vi.fn(), + ).find((column) => column.id === "status"); + + const cell = statusColumn?.cell; + if (typeof cell !== "function") { + throw new Error("Status column cell renderer not found"); + } + + const element = cell({ + row: { original: row }, + } as unknown as Parameters[0]); + + render(<>{element as ReactNode}); +} + +afterEach(() => { + vi.unstubAllEnvs(); +}); + describe("getColumnProviders", () => { it("falls back to connection last_checked_at when lastScanAt is undefined", () => { renderLastScanCell({ ...providerRow, lastScanAt: undefined }); @@ -129,4 +167,133 @@ describe("getColumnProviders", () => { expect(screen.getByText("Never")).toBeVisible(); expect(screen.queryByText("2026-01-01T00:00:00Z")).not.toBeInTheDocument(); }); + + it("shows Not connected with the imported tooltip in Cloud", async () => { + // Given + vi.stubEnv("UI_CLOUD_ENABLED", "true"); + const user = userEvent.setup(); + const importedProvider = { + ...providerRow, + attributes: { + ...providerRow.attributes, + is_imported: true, + connection: { + connected: null, + last_checked_at: null, + }, + }, + relationships: { + ...providerRow.relationships, + secret: { data: null }, + }, + } satisfies ProvidersProviderRow; + + // When + renderStatusCell(importedProvider); + + // Then + expect(screen.getByText("Not connected")).toBeVisible(); + const indicator = screen.getByLabelText("Imported provider"); + expect(indicator).not.toHaveTextContent("Imported"); + expect(indicator).toHaveAttribute("tabindex", "0"); + expect(indicator.querySelector(".lucide-terminal")).toBeInTheDocument(); + expect(indicator.parentElement).toHaveClass("items-stretch"); + expect(screen.queryByRole("tooltip")).not.toBeInTheDocument(); + expect(screen.queryByText("Disconnected")).not.toBeInTheDocument(); + + await user.hover(indicator); + + expect(await screen.findByRole("tooltip")).toHaveTextContent( + /^This provider has findings imported with the Prowler CLI$/, + ); + }); + + it("shows the imported tooltip beside Connected in Cloud", async () => { + // Given + vi.stubEnv("UI_CLOUD_ENABLED", "true"); + const user = userEvent.setup(); + const connectedImportedProvider = { + ...providerRow, + attributes: { + ...providerRow.attributes, + is_imported: true, + connection: { + connected: true, + last_checked_at: "2026-01-01T00:00:00Z", + }, + }, + } satisfies ProvidersProviderRow; + + // When + renderStatusCell(connectedImportedProvider); + + // Then + expect(screen.getByText("Connected")).toBeVisible(); + const indicator = screen.getByLabelText("Imported provider"); + expect(indicator).toBeVisible(); + expect(indicator.querySelector(".lucide-terminal")).toBeInTheDocument(); + expect(indicator.parentElement).toHaveClass("items-stretch"); + expect(indicator).not.toHaveTextContent("Imported"); + expect(screen.queryByRole("tooltip")).not.toBeInTheDocument(); + + await user.hover(indicator); + + expect(await screen.findByRole("tooltip")).toHaveTextContent( + /^This provider has findings imported with the Prowler CLI$/, + ); + }); + + it("keeps Connection failed for imported providers in Cloud", () => { + // Given + vi.stubEnv("UI_CLOUD_ENABLED", "true"); + const importedProviderWithCredentials = { + ...providerRow, + attributes: { + ...providerRow.attributes, + is_imported: true, + connection: { + connected: false, + last_checked_at: null, + }, + }, + } satisfies ProvidersProviderRow; + + // When + renderStatusCell(importedProviderWithCredentials); + + // Then + expect(screen.getByText("Connection failed")).toBeVisible(); + expect(screen.queryByText("Not connected")).not.toBeInTheDocument(); + const indicator = screen.getByLabelText("Imported provider"); + expect(indicator).not.toHaveTextContent("Imported"); + }); + + it("does not expose imported provenance in OSS", () => { + // Given + vi.stubEnv("UI_CLOUD_ENABLED", "false"); + const importedProvider = { + ...providerRow, + attributes: { + ...providerRow.attributes, + is_imported: true, + connection: { + connected: null, + last_checked_at: null, + }, + }, + relationships: { + ...providerRow.relationships, + secret: { data: null }, + }, + } satisfies ProvidersProviderRow; + + // When + renderStatusCell(importedProvider); + + // Then + expect(screen.getByText("Not connected")).toBeVisible(); + expect( + screen.queryByLabelText("Imported provider"), + ).not.toBeInTheDocument(); + }); }); diff --git a/ui/components/providers/table/column-providers.tsx b/ui/components/providers/table/column-providers.tsx index c8ee2407e4..78c59ac764 100644 --- a/ui/components/providers/table/column-providers.tsx +++ b/ui/components/providers/table/column-providers.tsx @@ -1,13 +1,18 @@ "use client"; import { ColumnDef, Row, RowSelectionState } from "@tanstack/react-table"; -import { Building2, FolderTree } from "lucide-react"; +import { Building2, FolderTree, Terminal } from "lucide-react"; import type { OrgWizardInitialData, ProviderWizardInitialData, } from "@/components/providers/wizard/types"; -import { Badge } from "@/components/shadcn"; +import { + Badge, + Tooltip, + TooltipContent, + TooltipTrigger, +} from "@/components/shadcn"; import { Checkbox } from "@/components/shadcn/checkbox/checkbox"; import { CodeSnippet } from "@/components/shadcn/code-snippet/code-snippet"; import { DateWithTime, EntityInfo } from "@/components/shadcn/entities"; @@ -15,6 +20,7 @@ import { DataTableColumnHeader } from "@/components/shadcn/table"; import { DataTableExpandAllToggle } from "@/components/shadcn/table/data-table-expand-all-toggle"; import { DataTableExpandableCell } from "@/components/shadcn/table/data-table-expandable-cell"; import { getNodeLabel } from "@/lib/organizations"; +import { isCloud } from "@/lib/shared/env"; import { isProvidersOrganizationRow, PROVIDERS_GROUP_KIND, @@ -51,28 +57,70 @@ const OrganizationIcon = ({ groupKind }: { groupKind: ProvidersGroupKind }) => { ); }; -const ProviderStatusCell = ({ connected }: { connected: boolean | null }) => { +interface ProviderStatusCellProps { + connected: boolean | null; + isImported: boolean; +} + +const IMPORTED_PROVIDER_TOOLTIP = + "This provider has findings imported with the Prowler CLI"; + +const ImportedIndicator = () => { + const indicator = ( + + + + ); + + return ( + + {indicator} + {IMPORTED_PROVIDER_TOOLTIP} + + ); +}; + +const ProviderStatusCell = ({ + connected, + isImported, +}: ProviderStatusCellProps) => { + let statusBadge; + if (connected === true) { - return ( + statusBadge = ( Connected ); - } - - if (connected === false) { - return ( + } else if (connected === false) { + statusBadge = ( Connection failed ); + } else { + statusBadge = ( + + Not connected + + ); } - return ( - - Not connected - - ); + if (isImported) { + return ( +
    + {statusBadge} + +
    + ); + } + + return statusBadge; }; function getSelectionLabel(row: Row): string | undefined { @@ -299,6 +347,9 @@ export function getColumnProviders( return ( ); }, diff --git a/ui/components/roles/workflow/forms/add-role-form.test.tsx b/ui/components/roles/workflow/forms/add-role-form.test.tsx index e39683e7dc..5f285c0c35 100644 --- a/ui/components/roles/workflow/forms/add-role-form.test.tsx +++ b/ui/components/roles/workflow/forms/add-role-form.test.tsx @@ -2,6 +2,8 @@ import { render, screen } from "@testing-library/react"; import userEvent from "@testing-library/user-event"; import { afterEach, beforeAll, describe, expect, it, vi } from "vitest"; +import { addRole } from "@/actions/roles/roles"; + import { AddRoleForm } from "./add-role-form"; const routerMocks = vi.hoisted(() => ({ @@ -60,6 +62,12 @@ vi.mock("@/lib", () => ({ label: "Manage Alerts", description: "Allows creating and managing custom alerts", }, + { + field: "manage_lighthouse_ai_configuration", + label: "Manage Lighthouse AI", + description: + "Allows configuring Lighthouse AI, including its provider credentials, default model and business context", + }, { field: "manage_billing", label: "Manage Billing", @@ -88,9 +96,31 @@ beforeAll(() => { window.ResizeObserver = ResizeObserverMock; }); +const submitRoleForm = async ( + user: ReturnType, + { grantLighthouseAi }: { grantLighthouseAi: boolean }, +) => { + await user.type(screen.getByPlaceholderText("Enter role name"), "New role"); + + if (grantLighthouseAi) { + await user.click( + screen.getByRole("checkbox", { name: "Manage Lighthouse AI" }), + ); + } + + await user.click(screen.getByRole("button", { name: "Add Role" })); +}; + +const submittedFormData = () => { + const formData = vi.mocked(addRole).mock.calls.at(-1)?.[0]; + if (!formData) throw new Error("addRole was not called"); + return formData; +}; + describe("AddRoleForm", () => { afterEach(() => { routerMocks.push.mockClear(); + vi.mocked(addRole).mockClear(); vi.unstubAllEnvs(); }); @@ -103,6 +133,7 @@ describe("AddRoleForm", () => { // Then expect(screen.getByText("Manage Alerts")).toBeInTheDocument(); + expect(screen.getByText("Manage Lighthouse AI")).toBeInTheDocument(); expect(screen.getByText("Manage Billing")).toBeInTheDocument(); }); @@ -115,9 +146,55 @@ describe("AddRoleForm", () => { // Then expect(screen.queryByText("Manage Alerts")).not.toBeInTheDocument(); + expect(screen.queryByText("Manage Lighthouse AI")).not.toBeInTheDocument(); expect(screen.queryByText("Manage Billing")).not.toBeInTheDocument(); }); + it("submits manage_lighthouse_ai_configuration when granted in Prowler Cloud", async () => { + // Given + vi.stubEnv("UI_CLOUD_ENABLED", "true"); + const user = userEvent.setup(); + render(); + + // When + await submitRoleForm(user, { grantLighthouseAi: true }); + + // Then + expect(submittedFormData().get("manage_lighthouse_ai_configuration")).toBe( + "true", + ); + }); + + it("submits manage_lighthouse_ai_configuration as false when not granted in Prowler Cloud", async () => { + // Given + vi.stubEnv("UI_CLOUD_ENABLED", "true"); + const user = userEvent.setup(); + render(); + + // When + await submitRoleForm(user, { grantLighthouseAi: false }); + + // Then + expect(submittedFormData().get("manage_lighthouse_ai_configuration")).toBe( + "false", + ); + }); + + it("omits manage_lighthouse_ai_configuration from the submission outside Prowler Cloud", async () => { + // Given + vi.stubEnv("UI_CLOUD_ENABLED", "false"); + const user = userEvent.setup(); + render(); + + // When + await submitRoleForm(user, { grantLighthouseAi: false }); + + // Then + expect(submittedFormData().has("manage_lighthouse_ai_configuration")).toBe( + false, + ); + }); + it("navigates back to roles when cancel is clicked", async () => { // Given const user = userEvent.setup(); diff --git a/ui/components/roles/workflow/forms/add-role-form.tsx b/ui/components/roles/workflow/forms/add-role-form.tsx index eb16ea4ebe..19c19e2d48 100644 --- a/ui/components/roles/workflow/forms/add-role-form.tsx +++ b/ui/components/roles/workflow/forms/add-role-form.tsx @@ -27,6 +27,7 @@ export const AddRoleForm = ({ groups }: { groups: RoleGroupOption[] }) => { ...(isCloudEnvironment && { manage_billing: false, manage_alerts: false, + manage_lighthouse_ai_configuration: false, }), }; @@ -51,6 +52,10 @@ export const AddRoleForm = ({ groups }: { groups: RoleGroupOption[] }) => { if (isCloudEnvironment) { formData.append("manage_billing", String(values.manage_billing)); formData.append("manage_alerts", String(values.manage_alerts)); + formData.append( + "manage_lighthouse_ai_configuration", + String(values.manage_lighthouse_ai_configuration), + ); } if (values.groups && values.groups.length > 0) { diff --git a/ui/components/roles/workflow/forms/edit-role-form.test.tsx b/ui/components/roles/workflow/forms/edit-role-form.test.tsx index 0bc69c8ffd..f5ed520ee0 100644 --- a/ui/components/roles/workflow/forms/edit-role-form.test.tsx +++ b/ui/components/roles/workflow/forms/edit-role-form.test.tsx @@ -2,6 +2,8 @@ import { render, screen } from "@testing-library/react"; import userEvent from "@testing-library/user-event"; import { afterEach, beforeAll, describe, expect, it, vi } from "vitest"; +import { updateRole } from "@/actions/roles/roles"; + import { EditRoleForm } from "./edit-role-form"; const routerMocks = vi.hoisted(() => ({ @@ -60,6 +62,12 @@ vi.mock("@/lib", () => ({ label: "Manage Alerts", description: "Allows creating and managing custom alerts", }, + { + field: "manage_lighthouse_ai_configuration", + label: "Manage Lighthouse AI", + description: + "Allows configuring Lighthouse AI, including its provider credentials, default model and business context", + }, { field: "manage_billing", label: "Manage Billing", @@ -118,12 +126,68 @@ const renderEditRoleForm = (options?: Parameters[0]) => , ); +const submittedFormData = () => { + const formData = vi.mocked(updateRole).mock.calls.at(-1)?.[0]; + if (!formData) throw new Error("updateRole was not called"); + return formData; +}; + describe("EditRoleForm", () => { afterEach(() => { routerMocks.push.mockClear(); + vi.mocked(updateRole).mockClear(); vi.unstubAllEnvs(); }); + it("submits manage_lighthouse_ai_configuration when granted in Prowler Cloud", async () => { + // Given + vi.stubEnv("UI_CLOUD_ENABLED", "true"); + const user = userEvent.setup(); + renderEditRoleForm(); + + // When + await user.click( + screen.getByRole("checkbox", { name: "Manage Lighthouse AI" }), + ); + await user.click(screen.getByRole("button", { name: "Update Role" })); + + // Then + expect(submittedFormData().get("manage_lighthouse_ai_configuration")).toBe( + "true", + ); + expect(vi.mocked(updateRole).mock.calls.at(-1)?.[1]).toBe("role-1"); + }); + + it("submits manage_lighthouse_ai_configuration as false when not granted in Prowler Cloud", async () => { + // Given + vi.stubEnv("UI_CLOUD_ENABLED", "true"); + const user = userEvent.setup(); + renderEditRoleForm(); + + // When + await user.click(screen.getByRole("button", { name: "Update Role" })); + + // Then + expect(submittedFormData().get("manage_lighthouse_ai_configuration")).toBe( + "false", + ); + }); + + it("omits manage_lighthouse_ai_configuration from the submission outside Prowler Cloud", async () => { + // Given + vi.stubEnv("UI_CLOUD_ENABLED", "false"); + const user = userEvent.setup(); + renderEditRoleForm(); + + // When + await user.click(screen.getByRole("button", { name: "Update Role" })); + + // Then + expect(submittedFormData().has("manage_lighthouse_ai_configuration")).toBe( + false, + ); + }); + it("shows the subtle Unlimited Visibility description inside Visibility", () => { // Given / When renderEditRoleForm(); diff --git a/ui/components/roles/workflow/forms/edit-role-form.tsx b/ui/components/roles/workflow/forms/edit-role-form.tsx index f64c7aee3c..2621b3c150 100644 --- a/ui/components/roles/workflow/forms/edit-role-form.tsx +++ b/ui/components/roles/workflow/forms/edit-role-form.tsx @@ -60,6 +60,8 @@ export const EditRoleForm = ({ if (isCloudEnvironment) { updatedFields.manage_billing = values.manage_billing; updatedFields.manage_alerts = values.manage_alerts; + updatedFields.manage_lighthouse_ai_configuration = + values.manage_lighthouse_ai_configuration; } if ( diff --git a/ui/components/scans/auto-refresh.test.tsx b/ui/components/scans/auto-refresh.test.tsx new file mode 100644 index 0000000000..bef5f0b87e --- /dev/null +++ b/ui/components/scans/auto-refresh.test.tsx @@ -0,0 +1,203 @@ +import { render } from "@testing-library/react"; +import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"; + +const { navigationState, routerRefreshMock } = vi.hoisted(() => ({ + navigationState: { searchParams: new URLSearchParams() }, + routerRefreshMock: vi.fn(), +})); + +vi.mock("next/navigation", () => ({ + useRouter: () => ({ refresh: routerRefreshMock }), + useSearchParams: () => navigationState.searchParams, +})); + +import { + AutoRefresh, + SCAN_EXECUTION_SETTLED_EVENT, + SCAN_POLL_TICK_EVENT, +} from "./auto-refresh"; + +describe("AutoRefresh", () => { + beforeEach(() => { + vi.useFakeTimers(); + vi.clearAllMocks(); + navigationState.searchParams = new URLSearchParams(); + }); + + afterEach(() => { + vi.useRealTimers(); + }); + + it("dispatches a poll tick after a successful callback refresh", async () => { + // Given + let resolveRefresh!: () => void; + const refreshPromise = new Promise((resolve) => { + resolveRefresh = resolve; + }); + const onRefresh = vi.fn().mockReturnValue(refreshPromise); + const eventListener = vi.fn(); + window.addEventListener(SCAN_POLL_TICK_EVENT, eventListener); + render(); + + // When + await vi.advanceTimersByTimeAsync(5_000); + + // Then + expect(onRefresh).toHaveBeenCalledOnce(); + expect(eventListener).not.toHaveBeenCalled(); + + // When + resolveRefresh(); + await refreshPromise; + await Promise.resolve(); + + // Then + expect(eventListener).toHaveBeenCalledOnce(); + window.removeEventListener(SCAN_POLL_TICK_EVENT, eventListener); + }); + + it("dispatches a poll tick after the default router refresh", async () => { + // Given + const eventListener = vi.fn(); + window.addEventListener(SCAN_POLL_TICK_EVENT, eventListener); + render(); + + // When + await vi.advanceTimersByTimeAsync(5_000); + + // Then + expect(routerRefreshMock).toHaveBeenCalledOnce(); + expect(eventListener).toHaveBeenCalledOnce(); + window.removeEventListener(SCAN_POLL_TICK_EVENT, eventListener); + }); + + it("does not dispatch a poll tick when an async callback rejects", async () => { + // Given + const onRefresh = vi.fn().mockRejectedValue(new Error("refresh failed")); + const eventListener = vi.fn(); + window.addEventListener(SCAN_POLL_TICK_EVENT, eventListener); + render(); + + // When + await vi.advanceTimersByTimeAsync(5_000); + + // Then + expect(onRefresh).toHaveBeenCalledOnce(); + expect(eventListener).not.toHaveBeenCalled(); + window.removeEventListener(SCAN_POLL_TICK_EVENT, eventListener); + }); + + it("does not start another refresh while the previous one is pending", async () => { + // Given + let resolveRefresh!: () => void; + const refreshPromise = new Promise((resolve) => { + resolveRefresh = resolve; + }); + const onRefresh = vi.fn().mockReturnValue(refreshPromise); + render(); + + // When + await vi.advanceTimersByTimeAsync(10_000); + + // Then + expect(onRefresh).toHaveBeenCalledOnce(); + + // When + resolveRefresh(); + await refreshPromise; + await vi.advanceTimersByTimeAsync(5_000); + + // Then + expect(onRefresh).toHaveBeenCalledTimes(2); + }); + + it("does not dispatch a poll tick after unmounting a pending refresh", async () => { + // Given + let resolveRefresh!: () => void; + const refreshPromise = new Promise((resolve) => { + resolveRefresh = resolve; + }); + const onRefresh = vi.fn().mockReturnValue(refreshPromise); + const eventListener = vi.fn(); + window.addEventListener(SCAN_POLL_TICK_EVENT, eventListener); + const { unmount } = render( + , + ); + await vi.advanceTimersByTimeAsync(5_000); + + // When + unmount(); + resolveRefresh(); + await refreshPromise; + await Promise.resolve(); + + // Then + expect(onRefresh).toHaveBeenCalledOnce(); + expect(eventListener).not.toHaveBeenCalled(); + window.removeEventListener(SCAN_POLL_TICK_EVENT, eventListener); + }); + + it("signals when scan execution settles", () => { + // Given + const eventListener = vi.fn(); + window.addEventListener(SCAN_EXECUTION_SETTLED_EVENT, eventListener); + const { rerender } = render(); + + // When + rerender(); + rerender(); + + // Then + expect(eventListener).toHaveBeenCalledOnce(); + window.removeEventListener(SCAN_EXECUTION_SETTLED_EVENT, eventListener); + }); + + it("does not signal settled execution on an idle initial render", () => { + // Given + const eventListener = vi.fn(); + window.addEventListener(SCAN_EXECUTION_SETTLED_EVENT, eventListener); + + // When + render(); + + // Then + expect(eventListener).not.toHaveBeenCalled(); + window.removeEventListener(SCAN_EXECUTION_SETTLED_EVENT, eventListener); + }); + + it.each([ + { + hasExecutingScan: false, + searchParams: "", + condition: "no scan executes", + }, + { + hasExecutingScan: true, + searchParams: "scanId=scan-executing", + condition: "the scan drawer is open", + }, + ])( + "does not poll when $condition", + async ({ hasExecutingScan, searchParams }) => { + // Given + const onRefresh = vi.fn(); + const eventListener = vi.fn(); + navigationState.searchParams = new URLSearchParams(searchParams); + window.addEventListener(SCAN_POLL_TICK_EVENT, eventListener); + render( + , + ); + + // When + await vi.advanceTimersByTimeAsync(5_000); + + // Then + expect(onRefresh).not.toHaveBeenCalled(); + expect(eventListener).not.toHaveBeenCalled(); + window.removeEventListener(SCAN_POLL_TICK_EVENT, eventListener); + }, + ); +}); diff --git a/ui/components/scans/auto-refresh.tsx b/ui/components/scans/auto-refresh.tsx index 3a61bbba8e..d961e7b952 100644 --- a/ui/components/scans/auto-refresh.tsx +++ b/ui/components/scans/auto-refresh.tsx @@ -1,7 +1,17 @@ "use client"; import { useRouter, useSearchParams } from "next/navigation"; -import { useEffect } from "react"; +import { useEffect, useRef } from "react"; + +/** + * Signals that a poll cycle ran, not that fresh data landed: the default branch + * calls the fire-and-forget `router.refresh()`, which reports neither. + * Listeners must read authoritative state themselves. + */ +export const SCAN_POLL_TICK_EVENT = "prowler:scan-poll-tick"; + +/** Signals the transition from an executing scan to no executing scan. */ +export const SCAN_EXECUTION_SETTLED_EVENT = "prowler:scan-execution-settled"; interface AutoRefreshProps { hasExecutingScan: boolean; @@ -9,9 +19,19 @@ interface AutoRefreshProps { onRefresh?: () => void | Promise; } -export function AutoRefresh({ hasExecutingScan, onRefresh }: AutoRefreshProps) { +const useAutoRefresh = ({ hasExecutingScan, onRefresh }: AutoRefreshProps) => { const router = useRouter(); const searchParams = useSearchParams(); + const refreshInProgress = useRef(false); + const previouslyExecuting = useRef(hasExecutingScan); + + useEffect(() => { + if (previouslyExecuting.current && !hasExecutingScan) { + window.dispatchEvent(new Event(SCAN_EXECUTION_SETTLED_EVENT)); + } + + previouslyExecuting.current = hasExecutingScan; + }, [hasExecutingScan]); useEffect(() => { if (!hasExecutingScan) return; @@ -20,18 +40,45 @@ export function AutoRefresh({ hasExecutingScan, onRefresh }: AutoRefreshProps) { const scanId = searchParams.get("scanId"); if (scanId) return; + let active = true; const interval = setInterval(() => { - if (onRefresh) { - // Use custom refresh callback for client-side state management - onRefresh(); - } else { - // Default: trigger server-side refresh - router.refresh(); - } + if (refreshInProgress.current) return; + + const refresh = async () => { + refreshInProgress.current = true; + + try { + if (onRefresh) { + // Use custom refresh callback for client-side state management + await onRefresh(); + } else { + // Default: trigger server-side refresh + router.refresh(); + } + } catch (error) { + console.error("Scan auto-refresh failed:", error); + return; + } finally { + refreshInProgress.current = false; + } + + if (active) { + window.dispatchEvent(new Event(SCAN_POLL_TICK_EVENT)); + } + }; + + void refresh(); }, 5000); - return () => clearInterval(interval); + return () => { + active = false; + clearInterval(interval); + }; }, [hasExecutingScan, router, searchParams, onRefresh]); +}; + +export function AutoRefresh(props: AutoRefreshProps) { + useAutoRefresh(props); return null; } diff --git a/ui/components/users/profile/role-item.test.tsx b/ui/components/users/profile/role-item.test.tsx index 2df8d92ae4..6a4d781d51 100644 --- a/ui/components/users/profile/role-item.test.tsx +++ b/ui/components/users/profile/role-item.test.tsx @@ -23,6 +23,7 @@ const roleDetail = { manage_integrations: false, manage_billing: false, manage_alerts: true, + manage_lighthouse_ai_configuration: true, unlimited_visibility: false, }, } satisfies RoleDetail; @@ -54,6 +55,28 @@ describe("RoleItem", () => { expect(screen.queryByText("Manage Alerts")).not.toBeInTheDocument(); }); + it("shows Manage Lighthouse AI in Prowler Cloud role details", () => { + // Given + vi.stubEnv("UI_CLOUD_ENABLED", "true"); + + // When + render(); + + // Then + expect(screen.getByText("Manage Lighthouse AI")).toBeInTheDocument(); + }); + + it("hides Manage Lighthouse AI outside Prowler Cloud role details", () => { + // Given + vi.stubEnv("UI_CLOUD_ENABLED", "false"); + + // When + render(); + + // Then + expect(screen.queryByText("Manage Lighthouse AI")).not.toBeInTheDocument(); + }); + it("displays the permission state as a badge", () => { // Given vi.stubEnv("UI_CLOUD_ENABLED", "true"); diff --git a/ui/hooks/use-auth.ts b/ui/hooks/use-auth.ts index ce0debb2b2..0946fc7677 100644 --- a/ui/hooks/use-auth.ts +++ b/ui/hooks/use-auth.ts @@ -14,6 +14,7 @@ export function useAuth() { manage_integrations: false, manage_billing: false, manage_alerts: false, + manage_lighthouse_ai_configuration: false, unlimited_visibility: false, }; diff --git a/ui/lib/compliance/cmmc.test.ts b/ui/lib/compliance/cmmc.test.ts new file mode 100644 index 0000000000..237e7e8cb3 --- /dev/null +++ b/ui/lib/compliance/cmmc.test.ts @@ -0,0 +1,240 @@ +import { isValidElement } from "react"; +import { describe, expect, it, vi } from "vitest"; + +// `cmmc.tsx` re-exports `toAccordionItems` which builds JSX referencing +// client-side accordion components. Those components transitively import +// server-only code (next-auth β†’ next/server) and would crash vitest at load +// time. Mocking the JSX deps lets us load the module and exercise the real +// `mapComplianceData` and `toAccordionItems` functions. +vi.mock( + "@/components/compliance/compliance-accordion/client-accordion-content", + () => ({ + ClientAccordionContent: () => null, + }), +); +vi.mock( + "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title", + () => ({ + ComplianceAccordionRequirementTitle: () => null, + }), +); +vi.mock( + "@/components/compliance/compliance-accordion/compliance-accordion-title", + () => ({ + ComplianceAccordionTitle: () => null, + }), +); + +import { + AttributesData, + AttributesItemData, + CMMCAttributesMetadata, + CMMCLevel, + REQUIREMENT_STATUS, + RequirementItemData, + RequirementsData, + RequirementStatus, +} from "@/types/compliance"; + +import { mapComplianceData, toAccordionItems } from "./cmmc"; + +const FRAMEWORK = "CMMC"; + +const baseMetadata = ( + overrides: Partial = {}, +): CMMCAttributesMetadata => ({ + Domain: "Access Control", + Level: "Level 1" as CMMCLevel, + SourceRequirement: "48 CFR 52.204-21(b)(1)(i)", + ...overrides, +}); + +const buildAttribute = ( + id: string, + metadata: CMMCAttributesMetadata, + { name = "" }: { name?: string } = {}, +): AttributesItemData => ({ + type: "compliance-requirements-attributes", + id, + attributes: { + framework_description: "CMMC 2.0", + name, + framework: FRAMEWORK, + version: "2.0", + description: "Requirement clause text.", + attributes: { + metadata: [metadata], + check_ids: ["check_one"], + }, + }, +}); + +const buildRequirement = ( + id: string, + status: RequirementStatus = REQUIREMENT_STATUS.PASS, +): RequirementItemData => ({ + type: "compliance-requirements-details", + id, + attributes: { + framework: FRAMEWORK, + version: "2.0", + description: "Canonical CMMC requirement text.", + status, + }, +}); + +const buildInputs = ( + pairs: Array<{ + attribute: AttributesItemData; + requirement: RequirementItemData; + }>, +): { attributesData: AttributesData; requirementsData: RequirementsData } => ({ + attributesData: { data: pairs.map((p) => p.attribute) }, + requirementsData: { data: pairs.map((p) => p.requirement) }, +}); + +describe("mapComplianceData (CMMC 2.0)", () => { + it("returns an empty list when there are no attributes", () => { + const { attributesData, requirementsData } = buildInputs([]); + expect(mapComplianceData(attributesData, requirementsData)).toEqual([]); + }); + + it("groups requirements by Domain", () => { + const attrA = buildAttribute( + "AC.L1-b.1.i", + baseMetadata({ Domain: "Access Control" }), + ); + const attrB = buildAttribute( + "AC.L2-3.1.3", + baseMetadata({ Domain: "Access Control" }), + ); + + const { attributesData, requirementsData } = buildInputs([ + { attribute: attrA, requirement: buildRequirement("AC.L1-b.1.i") }, + { attribute: attrB, requirement: buildRequirement("AC.L2-3.1.3") }, + ]); + + const [framework] = mapComplianceData(attributesData, requirementsData); + + expect(framework.name).toBe(FRAMEWORK); + expect(framework.categories).toHaveLength(1); + expect(framework.categories[0].name).toBe("Access Control"); + expect(framework.categories[0].controls[0].requirements).toHaveLength(2); + }); + + it("orders domains by the canonical NIST 800-171 family order", () => { + const attrSI = buildAttribute( + "SI.L1-b.1.xiv", + baseMetadata({ Domain: "System and Information Integrity" }), + ); + const attrAC = buildAttribute( + "AC.L1-b.1.i", + baseMetadata({ Domain: "Access Control" }), + ); + + const { attributesData, requirementsData } = buildInputs([ + { attribute: attrSI, requirement: buildRequirement("SI.L1-b.1.xiv") }, + { attribute: attrAC, requirement: buildRequirement("AC.L1-b.1.i") }, + ]); + + const [framework] = mapComplianceData(attributesData, requirementsData); + + expect(framework.categories.map((c) => c.name)).toEqual([ + "Access Control", + "System and Information Integrity", + ]); + }); + + it("propagates Domain, Level and SourceRequirement onto the requirement", () => { + const attribute = buildAttribute( + "AC.L1-b.1.i", + baseMetadata({ + Domain: "Access Control", + Level: "Level 1" as CMMCLevel, + SourceRequirement: "48 CFR 52.204-21(b)(1)(i)", + }), + { name: "Limit information system access" }, + ); + + const { attributesData, requirementsData } = buildInputs([ + { attribute, requirement: buildRequirement("AC.L1-b.1.i") }, + ]); + + const [framework] = mapComplianceData(attributesData, requirementsData); + const requirementOut = framework.categories[0].controls[0].requirements[0]; + + expect(requirementOut.name).toBe( + "AC.L1-b.1.i - Limit information system access", + ); + expect(requirementOut.domain).toBe("Access Control"); + expect(requirementOut.level).toBe("Level 1"); + expect(requirementOut.source_requirement).toBe("48 CFR 52.204-21(b)(1)(i)"); + }); + + it("derives counters from RequirementStatus", () => { + const STATUS_COUNTER = { + PASS: "pass", + FAIL: "fail", + MANUAL: "manual", + } as const; + type StatusCounter = (typeof STATUS_COUNTER)[keyof typeof STATUS_COUNTER]; + + const cases: Array<{ + status: RequirementStatus; + expected: StatusCounter; + }> = [ + { status: REQUIREMENT_STATUS.PASS, expected: STATUS_COUNTER.PASS }, + { status: REQUIREMENT_STATUS.FAIL, expected: STATUS_COUNTER.FAIL }, + { status: REQUIREMENT_STATUS.MANUAL, expected: STATUS_COUNTER.MANUAL }, + ]; + + for (const { status, expected } of cases) { + const attribute = buildAttribute(`AC-${status}`, baseMetadata()); + const { attributesData, requirementsData } = buildInputs([ + { attribute, requirement: buildRequirement(`AC-${status}`, status) }, + ]); + + const [framework] = mapComplianceData(attributesData, requirementsData); + expect(framework[expected]).toBe(1); + } + }); +}); + +describe("toAccordionItems (CMMC 2.0)", () => { + it("produces one accordion item per domain with its requirement leaves", () => { + const attrAC = buildAttribute( + "AC.L1-b.1.i", + baseMetadata({ Domain: "Access Control" }), + ); + const attrIA = buildAttribute( + "IA.L1-b.1.v", + baseMetadata({ Domain: "Identification and Authentication" }), + ); + + const frameworks = mapComplianceData( + { data: [attrAC, attrIA] }, + { + data: [ + buildRequirement("AC.L1-b.1.i"), + buildRequirement("IA.L1-b.1.v"), + ], + }, + ); + + const items = toAccordionItems(frameworks, "scan-1"); + + expect(items).toHaveLength(2); + expect(items[0].key).toBe(`${FRAMEWORK}-Access Control`); + expect(isValidElement(items[0].title)).toBe(true); + expect(items[0].items).toHaveLength(1); + // Requirement keys are stable (derived from the requirement id), not + // positional indexes β€” reordering must not remap expanded state. + expect(items[0].items?.[0]?.key).toBe( + `${FRAMEWORK}-Access Control-AC.L1-b.1.i`, + ); + }); + + it("returns an empty list when given no frameworks", () => { + expect(toAccordionItems([], "scan-1")).toEqual([]); + }); +}); diff --git a/ui/lib/compliance/cmmc.tsx b/ui/lib/compliance/cmmc.tsx new file mode 100644 index 0000000000..557c28b95c --- /dev/null +++ b/ui/lib/compliance/cmmc.tsx @@ -0,0 +1,164 @@ +import { ClientAccordionContent } from "@/components/compliance/compliance-accordion/client-accordion-content"; +import { ComplianceAccordionRequirementTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title"; +import { ComplianceAccordionTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-title"; +import { AccordionItemProps } from "@/components/shadcn/accordion/Accordion"; +import { FindingStatus } from "@/components/shadcn/table/status-finding-badge"; +import { + AttributesData, + CMMCAttributesMetadata, + Framework, + Requirement, + REQUIREMENT_STATUS, + RequirementsData, + RequirementStatus, +} from "@/types/compliance"; + +import { + calculateFrameworkCounters, + createRequirementsMap, + findOrCreateCategory, + findOrCreateControl, + findOrCreateFramework, +} from "./commons"; + +// Canonical NIST SP 800-171 family order for the 14 CMMC domains, so the +// accordion always reads in the same order regardless of the API response. +export const CMMC_DOMAIN_ORDER: readonly string[] = [ + "Access Control", + "Awareness and Training", + "Audit and Accountability", + "Configuration Management", + "Identification and Authentication", + "Incident Response", + "Maintenance", + "Media Protection", + "Personnel Security", + "Physical Protection", + "Risk Assessment", + "Security Assessment", + "System and Communications Protection", + "System and Information Integrity", +]; + +const getStatusCounters = (status: RequirementStatus) => ({ + pass: status === REQUIREMENT_STATUS.PASS ? 1 : 0, + fail: status === REQUIREMENT_STATUS.FAIL ? 1 : 0, + manual: status === REQUIREMENT_STATUS.MANUAL ? 1 : 0, +}); + +export const mapComplianceData = ( + attributesData: AttributesData, + requirementsData: RequirementsData, +): Framework[] => { + const attributes = attributesData?.data || []; + const requirementsMap = createRequirementsMap(requirementsData); + const frameworks: Framework[] = []; + + for (const attributeItem of attributes) { + const id = attributeItem.id; + const metadataArray = attributeItem.attributes?.attributes + ?.metadata as unknown as CMMCAttributesMetadata[]; + const attrs = metadataArray?.[0]; + if (!attrs) continue; + + const requirementData = requirementsMap.get(id); + if (!requirementData) continue; + + const frameworkName = attributeItem.attributes.framework; + // Group by Domain. Level and SourceRequirement live inside the requirement + // so they show up on the detail drawer. + const categoryName = attrs.Domain; + const requirementName = attributeItem.attributes.name || ""; + const description = attributeItem.attributes.description; + const status = requirementData.attributes.status || ""; + const checks = attributeItem.attributes.attributes.check_ids || []; + + const framework = findOrCreateFramework(frameworks, frameworkName); + const category = findOrCreateCategory(framework.categories, categoryName); + // Flat 2-level structure: domain β†’ requirements (no intermediate control). + const control = findOrCreateControl(category.controls, categoryName); + + const finalStatus: RequirementStatus = status as RequirementStatus; + const requirement: Requirement = { + name: requirementName ? `${id} - ${requirementName}` : id, + description, + status: finalStatus, + check_ids: checks, + invalid_config: requirementData.attributes.invalid_config || false, + ...getStatusCounters(finalStatus), + domain: attrs.Domain, + level: attrs.Level, + source_requirement: attrs.SourceRequirement, + }; + + control.requirements.push(requirement); + } + + // Sort domains by the canonical NIST 800-171 family order. + for (const framework of frameworks) { + framework.categories.sort((a, b) => { + const ia = CMMC_DOMAIN_ORDER.indexOf(a.name); + const ib = CMMC_DOMAIN_ORDER.indexOf(b.name); + const orderA = ia === -1 ? CMMC_DOMAIN_ORDER.length : ia; + const orderB = ib === -1 ? CMMC_DOMAIN_ORDER.length : ib; + return orderA - orderB; + }); + } + + calculateFrameworkCounters(frameworks); + + return frameworks; +}; + +export const toAccordionItems = ( + data: Framework[], + scanId: string | undefined, +): AccordionItemProps[] => { + const safeId = scanId || ""; + + return data.flatMap((framework) => + framework.categories.map((category) => ({ + key: `${framework.name}-${category.name}`, + title: ( + + ), + content: "", + // Domain β†’ requirements (flat, no intermediate "control" level). + // Keys are derived from the requirement name (which starts with the + // unique CMMC id, e.g. "AC.L1-b.1.i") instead of the array index, so + // expanded state stays attached to the right requirement even if the + // list is reordered or filtered. + items: category.controls.flatMap((control) => + control.requirements.map((requirement) => ({ + key: `${framework.name}-${category.name}-${requirement.name}`, + title: ( + + ), + content: ( + + ), + items: [], + })), + ), + })), + ); +}; diff --git a/ui/lib/compliance/compliance-mapper.test.ts b/ui/lib/compliance/compliance-mapper.test.ts index 25933b8dff..5f77363725 100644 --- a/ui/lib/compliance/compliance-mapper.test.ts +++ b/ui/lib/compliance/compliance-mapper.test.ts @@ -38,6 +38,10 @@ vi.mock( "@/components/compliance/compliance-custom-details/cis-details", () => ({ CISCustomDetails: stubFactory("CISStub") }), ); +vi.mock( + "@/components/compliance/compliance-custom-details/cmmc-details", + () => ({ CMMCCustomDetails: stubFactory("CMMCStub") }), +); vi.mock( "@/components/compliance/compliance-custom-details/csa-details", () => ({ CSACustomDetails: stubFactory("CSAStub") }), @@ -148,6 +152,7 @@ describe("getComplianceMapper", () => { { framework: "ProwlerThreatScore", expected: "ThreatStub" }, { framework: "CCC", expected: "CCCStub" }, { framework: "CSA-CCM", expected: "CSAStub" }, + { framework: "CMMC", expected: "CMMCStub" }, { framework: "Okta-IDaaS-STIG", expected: "OktaIDaaSStigStub" }, ]; @@ -193,6 +198,7 @@ describe("getComplianceMapper", () => { "ProwlerThreatScore", "CCC", "CSA-CCM", + "CMMC", "Okta-IDaaS-STIG", ]) { const mapper = getComplianceMapper(framework); diff --git a/ui/lib/compliance/compliance-mapper.ts b/ui/lib/compliance/compliance-mapper.ts index 289e16bc47..229a3405ee 100644 --- a/ui/lib/compliance/compliance-mapper.ts +++ b/ui/lib/compliance/compliance-mapper.ts @@ -6,6 +6,7 @@ import { C5CustomDetails } from "@/components/compliance/compliance-custom-detai import { CCCCustomDetails } from "@/components/compliance/compliance-custom-details/ccc-details"; import { CISControlsCustomDetails } from "@/components/compliance/compliance-custom-details/cis-controls-details"; import { CISCustomDetails } from "@/components/compliance/compliance-custom-details/cis-details"; +import { CMMCCustomDetails } from "@/components/compliance/compliance-custom-details/cmmc-details"; import { CSACustomDetails } from "@/components/compliance/compliance-custom-details/csa-details"; import { DORACustomDetails } from "@/components/compliance/compliance-custom-details/dora-details"; import { ENSCustomDetails } from "@/components/compliance/compliance-custom-details/ens-details"; @@ -49,6 +50,10 @@ import { mapComplianceData as mapCISControlsComplianceData, toAccordionItems as toCISControlsAccordionItems, } from "./cis-controls"; +import { + mapComplianceData as mapCMMCComplianceData, + toAccordionItems as toCMMCAccordionItems, +} from "./cmmc"; import { calculateCategoryHeatmapData, getTopFailedSections } from "./commons"; import { mapComplianceData as mapCSAComplianceData, @@ -259,6 +264,19 @@ const getComplianceMappers = (): Record => ({ getDetailsComponent: (requirement: Requirement) => createElement(DORACustomDetails, { requirement }), }, + // CMMC 2.0 β€” universal framework keyed by the `framework` field of + // `prowler/compliance/cmmc_2.0.json` ("CMMC"). Groups by Domain (14 NIST + // 800-171 families) and surfaces Domain / Level / Source Requirement in the + // requirement detail drawer. + CMMC: { + mapComplianceData: mapCMMCComplianceData, + toAccordionItems: toCMMCAccordionItems, + getTopFailedSections, + calculateCategoryHeatmapData: (data: Framework[]) => + calculateCategoryHeatmapData(data), + getDetailsComponent: (requirement: Requirement) => + createElement(CMMCCustomDetails, { requirement }), + }, }); /** diff --git a/ui/lib/compliance/compliance-report-types.test.ts b/ui/lib/compliance/compliance-report-types.test.ts index 0697a7fcce..8a431d9748 100644 --- a/ui/lib/compliance/compliance-report-types.test.ts +++ b/ui/lib/compliance/compliance-report-types.test.ts @@ -40,6 +40,7 @@ describe("isOcsfSupported", () => { expect(isOcsfSupported("dora_2022_2554")).toBe(true); expect(isOcsfSupported("csa_ccm_4.0")).toBe(true); expect(isOcsfSupported("cis_controls_8.1")).toBe(true); + expect(isOcsfSupported("cmmc_2.0")).toBe(true); }); it("returns false for legacy/per-provider frameworks without OCSF output", () => { diff --git a/ui/lib/compliance/compliance-report-types.ts b/ui/lib/compliance/compliance-report-types.ts index 39ae576e28..68ef3072de 100644 --- a/ui/lib/compliance/compliance-report-types.ts +++ b/ui/lib/compliance/compliance-report-types.ts @@ -166,9 +166,9 @@ export const pickLatestCisPerProvider = ( * * Only universal compliance frameworks that declare an ``outputs`` block in * their schema (see ``prowler/compliance/.json``) produce a dedicated - * OCSF artifact during scan output generation. Today that is DORA and - * CSA CCM 4.0. Any other framework only offers CSV (and, for the curated - * list above, PDF). + * OCSF artifact during scan output generation. Today that is DORA, + * CSA CCM 4.0, CIS Controls 8.1 and CMMC 2.0. Any other framework only + * offers CSV (and, for the curated list above, PDF). * * Keep this Set in lock-step with the backend: ``get_prowler_provider_compliance`` * + ``ComplianceFramework.outputs`` is the source of truth. The API will @@ -181,6 +181,7 @@ const OCSF_SUPPORTED_COMPLIANCE_IDS: ReadonlySet = new Set([ "dora_2022_2554", "csa_ccm_4.0", "cis_controls_8.1", + "cmmc_2.0", ]); export const isOcsfSupported = (complianceId: string | undefined): boolean => diff --git a/ui/lib/helper.ts b/ui/lib/helper.ts index 7a70ce4906..35087a00d9 100644 --- a/ui/lib/helper.ts +++ b/ui/lib/helper.ts @@ -469,6 +469,12 @@ export const permissionFormFields: PermissionInfo[] = [ label: "Manage Alerts", description: "Allows creating and managing custom alerts", }, + { + field: "manage_lighthouse_ai_configuration", + label: "Manage Lighthouse AI", + description: + "Allows configuring Lighthouse AI, including its provider credentials, default model and business context", + }, { field: "manage_billing", diff --git a/ui/lib/permissions.test.ts b/ui/lib/permissions.test.ts index 00e409097d..e9fb55a236 100644 --- a/ui/lib/permissions.test.ts +++ b/ui/lib/permissions.test.ts @@ -12,6 +12,7 @@ const attributes = { manage_integrations: false, manage_billing: false, manage_alerts: true, + manage_lighthouse_ai_configuration: true, unlimited_visibility: false, } satisfies RolePermissionAttributes; @@ -47,4 +48,34 @@ describe("getRolePermissions", () => { permissions.some((permission) => permission.key === "manage_alerts"), ).toBe(false); }); + + it("includes Manage Lighthouse AI in Prowler Cloud when role attributes provide it", () => { + // Given + vi.stubEnv("UI_CLOUD_ENABLED", "true"); + + // When + const permissions = getRolePermissions(attributes); + + // Then + expect(permissions).toContainEqual({ + key: "manage_lighthouse_ai_configuration", + label: "Manage Lighthouse AI", + enabled: true, + }); + }); + + it("hides Manage Lighthouse AI outside Prowler Cloud", () => { + // Given + vi.stubEnv("UI_CLOUD_ENABLED", "false"); + + // When + const permissions = getRolePermissions(attributes); + + // Then + expect( + permissions.some( + (permission) => permission.key === "manage_lighthouse_ai_configuration", + ), + ).toBe(false); + }); }); diff --git a/ui/lib/permissions.ts b/ui/lib/permissions.ts index f34f6d6c0e..8f641814c1 100644 --- a/ui/lib/permissions.ts +++ b/ui/lib/permissions.ts @@ -67,6 +67,11 @@ export const getRolePermissions = (attributes: RolePermissionAttributes) => { label: "Manage Alerts", enabled: attributes.manage_alerts ?? false, }, + { + key: "manage_lighthouse_ai_configuration", + label: "Manage Lighthouse AI", + enabled: attributes.manage_lighthouse_ai_configuration ?? false, + }, ] : []), { diff --git a/ui/lib/role-permissions.ts b/ui/lib/role-permissions.ts index 87b024ebee..0ffba41963 100644 --- a/ui/lib/role-permissions.ts +++ b/ui/lib/role-permissions.ts @@ -1,6 +1,10 @@ import { permissionFormFields } from "@/lib"; -const hiddenOutsideCloudFields = ["manage_billing", "manage_alerts"]; +const hiddenOutsideCloudFields = [ + "manage_billing", + "manage_alerts", + "manage_lighthouse_ai_configuration", +]; export const getVisiblePermissionFormFields = (isCloudEnvironment: boolean) => permissionFormFields.filter( diff --git a/ui/types/compliance.ts b/ui/types/compliance.ts index 2f0b4bb0d2..3290b67b0d 100644 --- a/ui/types/compliance.ts +++ b/ui/types/compliance.ts @@ -427,6 +427,23 @@ export interface CISControlsRequirement extends Requirement { implementation_groups?: string[]; } +// CMMC 2.0 (Cybersecurity Maturity Model Certification, 32 CFR Part 170). +// Universal framework β€” flat attributes dict with Domain/Level/SourceRequirement. +// `Domain` is the grouping key; `Level` (1/2/3) and `SourceRequirement` are +// surfaced in the requirement detail drawer. +export const CMMC_LEVEL = { + LEVEL_1: "Level 1", + LEVEL_2: "Level 2", + LEVEL_3: "Level 3", +} as const; +export type CMMCLevel = (typeof CMMC_LEVEL)[keyof typeof CMMC_LEVEL]; + +export interface CMMCAttributesMetadata { + Domain: string; + Level: CMMCLevel; + SourceRequirement: string; +} + export interface AttributesItemData { type: "compliance-requirements-attributes"; id: string; @@ -452,6 +469,7 @@ export interface AttributesItemData { | OktaIDaaSStigAttributesMetadata[] | DORAAttributesMetadata[] | CISControlsAttributesMetadata[] + | CMMCAttributesMetadata[] | GenericAttributesMetadata[]; check_ids: string[]; // MITRE structure diff --git a/ui/types/providers.ts b/ui/types/providers.ts index def1f9f004..f6f898ce48 100644 --- a/ui/types/providers.ts +++ b/ui/types/providers.ts @@ -80,13 +80,15 @@ export interface ProviderProps { attributes: { provider: ProviderType; is_dynamic: boolean; + /** Import Findings provenance returned only by the Prowler Cloud API. */ + is_imported?: boolean; uid: string; alias: string; status: "completed" | "pending" | "cancelled"; resources: number; connection: { - connected: boolean; - last_checked_at: string; + connected: boolean | null; + last_checked_at: string | null; }; scanner_args: { only_logs: boolean; diff --git a/ui/types/users.ts b/ui/types/users.ts index 324bbda319..c9b43494b3 100644 --- a/ui/types/users.ts +++ b/ui/types/users.ts @@ -82,15 +82,20 @@ export interface RoleData { id: string; } +export const PERMISSION_KEY = { + MANAGE_USERS: "manage_users", + MANAGE_ACCOUNT: "manage_account", + MANAGE_PROVIDERS: "manage_providers", + MANAGE_SCANS: "manage_scans", + MANAGE_INTEGRATIONS: "manage_integrations", + MANAGE_BILLING: "manage_billing", + MANAGE_ALERTS: "manage_alerts", + MANAGE_LIGHTHOUSE_AI_CONFIGURATION: "manage_lighthouse_ai_configuration", + UNLIMITED_VISIBILITY: "unlimited_visibility", +} as const; + export type PermissionKey = - | "manage_users" - | "manage_account" - | "manage_providers" - | "manage_scans" - | "manage_integrations" - | "manage_billing" - | "manage_alerts" - | "unlimited_visibility"; + (typeof PERMISSION_KEY)[keyof typeof PERMISSION_KEY]; export type RolePermissionAttributes = Pick< RoleDetail["attributes"], @@ -117,6 +122,7 @@ export interface RoleDetail { manage_integrations: boolean; manage_billing?: boolean; manage_alerts?: boolean; + manage_lighthouse_ai_configuration?: boolean; unlimited_visibility: boolean; permission_state?: string; inserted_at?: string; diff --git a/util/check_yanked_pins.py b/util/check_yanked_pins.py new file mode 100644 index 0000000000..bd2708b28a --- /dev/null +++ b/util/check_yanked_pins.py @@ -0,0 +1,238 @@ +"""Fail when a pinned or locked package version has been yanked from PyPI. + +Exact pins (`==`) still install a yanked release: pip and uv both accept a yanked +version when it is the only candidate an exact specifier allows, printing at most a +warning. That is how zstd 1.5.7.3 (yanked as "buggy - not thread safe") stayed in +uv.lock for months. Yanks happen on PyPI's side after the pin lands, so this check +must run on a schedule, not only on pull requests. + +For each project directory given (default: current directory) the script collects: + +- exact `==` pins from pyproject.toml: [project] dependencies and optional + dependencies, [dependency-groups], and [tool.uv] constraint-dependencies and + override-dependencies +- every registry-sourced package in uv.lock + +and asks the PyPI JSON API whether each (name, version) is yanked or gone. + +Usage: + python util/check_yanked_pins.py # checks ./pyproject.toml and ./uv.lock + python util/check_yanked_pins.py . api mcp_server + +Exit status is 1 when any pin is yanked or no longer exists on PyPI, 0 otherwise. +Network errors are retried; a persistent error also exits 1, because "unknown" +must not read as "clean". +""" + +from __future__ import annotations + +import argparse +import json +import re +import sys +import urllib.error +import urllib.request +from concurrent.futures import ThreadPoolExecutor +from dataclasses import dataclass +from pathlib import Path +from time import sleep +from typing import Callable, Iterable + +try: + import tomllib +except ModuleNotFoundError: # Python 3.10: tomllib arrived in 3.11 + import tomli as tomllib + +PYPI_JSON = "https://pypi.org/pypi/{name}/{version}/json" +USER_AGENT = "prowler-check-yanked-pins (+https://github.com/prowler-cloud/prowler)" + +# PEP 508 requirement with an exact pin: "name[extras]==version ; markers" +_EXACT_PIN = re.compile( + r"^\s*(?P[A-Za-z0-9][A-Za-z0-9._-]*)\s*(\[[^\]]*\])?\s*==\s*(?P[^\s;,]+)" +) + + +def normalize(name: str) -> str: + """PEP 503 name normalization: alibabacloud_tea_openapi == alibabacloud-tea-openapi.""" + return re.sub(r"[-_.]+", "-", name).lower() + + +@dataclass(frozen=True, order=True) +class Pin: + """One exact version requirement and the file/table it was read from.""" + + name: str + version: str + source: str + + +@dataclass(frozen=True) +class Verdict: + """PyPI's answer for one pin: ok, yanked, missing (404) or error (unreachable).""" + + pin: Pin + status: str # "ok" | "yanked" | "missing" | "error" + detail: str = "" + + +def pins_from_pyproject(text: str, source_prefix: str) -> set[Pin]: + """Collect exact == pins from every dependency-bearing table in a pyproject.toml.""" + data = tomllib.loads(text) + tables: list[tuple[str, Iterable[str]]] = [] + + project = data.get("project", {}) + tables.append(("project.dependencies", project.get("dependencies", []))) + for extra, reqs in project.get("optional-dependencies", {}).items(): + tables.append((f"project.optional-dependencies.{extra}", reqs)) + for group, reqs in data.get("dependency-groups", {}).items(): + # dependency-groups entries may be tables ({include-group = ...}); keep strings only + tables.append( + (f"dependency-groups.{group}", [r for r in reqs if isinstance(r, str)]) + ) + uv = data.get("tool", {}).get("uv", {}) + tables.append( + ("tool.uv.constraint-dependencies", uv.get("constraint-dependencies", [])) + ) + tables.append( + ("tool.uv.override-dependencies", uv.get("override-dependencies", [])) + ) + + pins: set[Pin] = set() + for table, requirements in tables: + for requirement in requirements: + match = _EXACT_PIN.match(requirement) + if match: + pins.add( + Pin( + normalize(match.group("name")), + match.group("version"), + f"{source_prefix}pyproject.toml [{table}]", + ) + ) + return pins + + +def pins_from_uv_lock(text: str, source_prefix: str) -> set[Pin]: + """Collect every registry-sourced (name, version) from a uv.lock.""" + data = tomllib.loads(text) + pins: set[Pin] = set() + for package in data.get("package", []): + source = package.get("source", {}) + # git, path, editable and virtual sources are not on PyPI; skip them + if "registry" not in source: + continue + pins.add( + Pin( + normalize(package["name"]), + package["version"], + f"{source_prefix}uv.lock", + ) + ) + return pins + + +def collect_pins(project_dir: Path) -> set[Pin]: + """Gather pins from a project's pyproject.toml and uv.lock, whichever exist.""" + prefix = "" if project_dir == Path(".") else f"{project_dir.as_posix()}/" + pins: set[Pin] = set() + pyproject = project_dir / "pyproject.toml" + lock = project_dir / "uv.lock" + if not pyproject.is_file() and not lock.is_file(): + raise FileNotFoundError( + f"{project_dir}: neither pyproject.toml nor uv.lock found" + ) + if pyproject.is_file(): + pins |= pins_from_pyproject(pyproject.read_text(encoding="utf-8"), prefix) + if lock.is_file(): + pins |= pins_from_uv_lock(lock.read_text(encoding="utf-8"), prefix) + return pins + + +def fetch_release(name: str, version: str, retries: int = 3) -> tuple[str, str]: + """Return (status, detail) for one release, where status is ok|yanked|missing|error.""" + request = urllib.request.Request( + PYPI_JSON.format(name=name, version=version), headers={"User-Agent": USER_AGENT} + ) + last_error = "" + for attempt in range(retries): + try: + with urllib.request.urlopen(request, timeout=20) as response: + info = json.load(response)["info"] + except urllib.error.HTTPError as exc: + if exc.code == 404: + return "missing", "not found on PyPI" + last_error = f"HTTP {exc.code}" + except ( + urllib.error.URLError, + TimeoutError, + OSError, + ValueError, + KeyError, + ) as exc: + last_error = repr(exc) + else: + if info.get("yanked"): + return "yanked", info.get("yanked_reason") or "no reason given" + return "ok", "" + sleep(2**attempt) + return "error", last_error + + +def evaluate( + pins: Iterable[Pin], + fetch: Callable[[str, str], tuple[str, str]] | None = None, + workers: int = 16, +) -> list[Verdict]: + """Query each distinct (name, version) once and fan the answer out to every source.""" + if fetch is None: + fetch = fetch_release + pins = sorted(set(pins)) + releases = sorted({(pin.name, pin.version) for pin in pins}) + with ThreadPoolExecutor(max_workers=workers) as pool: + results = dict( + zip( + releases, + pool.map(lambda release: fetch(*release), releases), + strict=True, + ) + ) + return [Verdict(pin, *results[(pin.name, pin.version)]) for pin in pins] + + +def main(argv: list[str] | None = None) -> int: + """Check every project on the command line; return 1 if any pin is not ok.""" + parser = argparse.ArgumentParser(description=__doc__.split("\n\n")[0]) + parser.add_argument( + "projects", + nargs="*", + default=["."], + help="project directories containing pyproject.toml and/or uv.lock (default: .)", + ) + parser.add_argument( + "--workers", type=int, default=16, help="concurrent PyPI requests" + ) + args = parser.parse_args(argv) + + pins: set[Pin] = set() + for project in args.projects: + pins |= collect_pins(Path(project)) + print( + f"Checking {len({(p.name, p.version) for p in pins})} pinned releases from {len(pins)} pins" + ) + + verdicts = evaluate(pins, workers=args.workers) + problems = [v for v in verdicts if v.status != "ok"] + for verdict in problems: + pin = verdict.pin + print( + f"::error::{pin.name}=={pin.version} is {verdict.status} ({verdict.detail}) in {pin.source}" + ) + if problems: + print(f"{len(problems)} problem(s) found") + return 1 + print("No yanked or missing releases") + return 0 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/uv.lock b/uv.lock index 94018c21a9..f9e261b8cd 100644 --- a/uv.lock +++ b/uv.lock @@ -39,7 +39,7 @@ constraints = [ { name = "alibabacloud-sas20181203", specifier = "==6.1.0" }, { name = "alibabacloud-sts20150401", specifier = "==1.1.6" }, { name = "alibabacloud-tea", specifier = "==0.4.3" }, - { name = "alibabacloud-tea-openapi", specifier = "==0.4.5" }, + { name = "alibabacloud-tea-openapi", specifier = "==0.4.6" }, { name = "alibabacloud-tea-util", specifier = "==0.3.14" }, { name = "alibabacloud-tea-xml", specifier = "==0.0.3" }, { name = "alibabacloud-vpc20160428", specifier = "==6.13.0" }, @@ -140,7 +140,7 @@ constraints = [ { name = "mock", specifier = "==5.2.0" }, { name = "moto", specifier = "==5.1.11" }, { name = "mpmath", specifier = "==1.3.0" }, - { name = "msal", specifier = "==1.36.0" }, + { name = "msal", specifier = "==1.37.0" }, { name = "msal-extensions", specifier = "==1.3.1" }, { name = "msgraph-core", specifier = "==1.3.8" }, { name = "msrest", specifier = "==0.7.1" }, @@ -183,7 +183,7 @@ constraints = [ { name = "pyjwt", specifier = "==2.13.0" }, { name = "pylint", specifier = "==3.3.4" }, { name = "pynacl", specifier = "==1.6.2" }, - { name = "pyopenssl", specifier = "==26.2.0" }, + { name = "pyopenssl", specifier = "==26.4.0" }, { name = "pyparsing", specifier = "==3.3.2" }, { name = "pytest", specifier = "==9.0.3" }, { name = "pytest-cov", specifier = "==6.0.0" }, @@ -227,12 +227,9 @@ constraints = [ { name = "xmltodict", specifier = "==1.0.4" }, { name = "yarl", specifier = "==1.23.0" }, { name = "zipp", specifier = "==3.23.1" }, - { name = "zstd", specifier = "==1.5.7.3" }, -] -overrides = [ - { name = "cryptography", specifier = "==50.0.0" }, - { name = "okta", specifier = "==3.4.2" }, + { name = "zstd", specifier = "==1.5.7.2" }, ] +overrides = [{ name = "okta", specifier = "==3.4.2" }] [[package]] name = "about-time" @@ -686,7 +683,7 @@ sdist = { url = "https://files.pythonhosted.org/packages/9a/7d/b22cb9a0d4f396ee0 [[package]] name = "alibabacloud-tea-openapi" -version = "0.4.5" +version = "0.4.6" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "alibabacloud-credentials" }, @@ -695,9 +692,9 @@ dependencies = [ { name = "cryptography" }, { name = "darabonba-core" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/3b/73/fb0c4d44759791ecdf269fc715c1e810fa1aba3981bfaaf8a01f61899296/alibabacloud_tea_openapi-0.4.5.tar.gz", hash = "sha256:75fa1f4360a46e41f5bf5f8d4917e52efb6f64885839bc1328c35590670c97b9", size = 26616, upload-time = "2026-07-14T13:15:39.364Z" } +sdist = { url = "https://files.pythonhosted.org/packages/ab/34/1918a2d780676494365c7f945bfab397ecddb988054d78025bd26f438977/alibabacloud_tea_openapi-0.4.6.tar.gz", hash = "sha256:dafc32401712f5b21c12dc3d05ba887a91ad156d9b49a7662279f9fd90526fb2", size = 26742, upload-time = "2026-08-17T08:34:11.55Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/8d/ec/6b368a10e9c2e8b1b394c69b96ac213ae66e8c4895e0baa1ffaf7178fd32/alibabacloud_tea_openapi-0.4.5-py3-none-any.whl", hash = "sha256:338979095c7beda80a5b413c31262892cafdc12069dde4ce4fc2e4f7ce0fc609", size = 33333, upload-time = "2026-07-14T13:15:38.365Z" }, + { url = "https://files.pythonhosted.org/packages/35/00/2f534f5884e5f299d9cb3a1e8be2def8071bc6a6e2a192ba4ff2a8cd5e02/alibabacloud_tea_openapi-0.4.6-py3-none-any.whl", hash = "sha256:c9e1727b9fb2936f487d050fc3590c99f9f2065256dc3a927e5b61f414674ed6", size = 33448, upload-time = "2026-08-17T08:34:10.472Z" }, ] [[package]] @@ -3045,16 +3042,16 @@ wheels = [ [[package]] name = "msal" -version = "1.36.0" +version = "1.37.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "cryptography" }, { name = "pyjwt", extra = ["crypto"] }, { name = "requests" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/de/cb/b02b0f748ac668922364ccb3c3bff5b71628a05f5adfec2ba2a5c3031483/msal-1.36.0.tar.gz", hash = "sha256:3f6a4af2b036b476a4215111c4297b4e6e236ed186cd804faefba23e4990978b", size = 174217, upload-time = "2026-04-09T10:20:33.525Z" } +sdist = { url = "https://files.pythonhosted.org/packages/9a/99/d840198ecf6e8057bbc937f129ae940404485d736cda73253bbff9537f01/msal-1.37.0.tar.gz", hash = "sha256:1b1672a33ee467c1d70b341bb16cafd51bb3c817147a95b93263794b03971bec", size = 182444, upload-time = "2026-05-29T19:49:05.561Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/2a/d3/414d1f0a5f6f4fe5313c2b002c54e78a3332970feb3f5fed14237aa17064/msal-1.36.0-py3-none-any.whl", hash = "sha256:36ecac30e2ff4322d956029aabce3c82301c29f0acb1ad89b94edcabb0e58ec4", size = 121547, upload-time = "2026-04-09T10:20:32.336Z" }, + { url = "https://files.pythonhosted.org/packages/94/b0/d807279f4b55d16d1f120d5ac4344c6e39b56732e2a224d40bded7fd67ad/msal-1.37.0-py3-none-any.whl", hash = "sha256:dd17e95a7c71bce75e8108113438ba7c4a086b3bcad4f57a8c09b7af3d753c2d", size = 123725, upload-time = "2026-05-29T19:49:04.335Z" }, ] [[package]] @@ -3337,7 +3334,7 @@ wheels = [ [[package]] name = "oci" -version = "2.183.0" +version = "2.184.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "certifi" }, @@ -3350,9 +3347,9 @@ dependencies = [ { name = "pytz" }, { name = "urllib3" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/1e/2a/77bd6cbf1c69b2f368fe3d6462d84369b0cba15e37ce713cdc08d459b95a/oci-2.183.0.tar.gz", hash = "sha256:ff572ef5f2030a788796bb509d257e6a41c6510ef9b4b6a75a079efd06e533ce", size = 17759723, upload-time = "2026-07-28T06:02:29.76Z" } +sdist = { url = "https://files.pythonhosted.org/packages/74/2d/fa5368cfabb868f4111c6978e8b5f66aa3a55076c40c1a59ac3081b0227b/oci-2.184.1.tar.gz", hash = "sha256:617dad69caf8dd6e521d224dbc3e8a8bc289906943a0214fd2c3419094e26435", size = 17990631, upload-time = "2026-08-11T11:01:26.194Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/a9/de/8574b3e527996a099d196e87794a4652d91a0c3185fcc7fdbb5649b75a8a/oci-2.183.0-py3-none-any.whl", hash = "sha256:bd789c98a94d7c5ea08c20d11dcf68c9cd1ad479b134727d80a930b84387070b", size = 36133501, upload-time = "2026-07-28T06:02:18.239Z" }, + { url = "https://files.pythonhosted.org/packages/5f/63/5ae22e42aaf96a5da74dc2b9de449c78b4d7418cce621d5da723b3e49f32/oci-2.184.1-py3-none-any.whl", hash = "sha256:bd814e38a70da2190e721937455a08689ab13c0750bd2ef8dd0c98b2dc5a38ea", size = 36628063, upload-time = "2026-08-11T11:01:18.178Z" }, ] [[package]] @@ -3755,7 +3752,7 @@ wheels = [ [[package]] name = "prowler" -version = "5.39.0" +version = "5.40.0" source = { editable = "." } dependencies = [ { name = "alibabacloud-actiontrail20200706" }, @@ -3851,6 +3848,7 @@ dependencies = [ { name = "tabulate" }, { name = "tzlocal" }, { name = "uuid6" }, + { name = "zstandard" }, ] [package.dev-dependencies] @@ -3889,7 +3887,7 @@ requires-dist = [ { name = "alibabacloud-sas20181203", specifier = "==6.1.0" }, { name = "alibabacloud-sls20201230", specifier = "==5.9.0" }, { name = "alibabacloud-sts20150401", specifier = "==1.1.6" }, - { name = "alibabacloud-tea-openapi", specifier = "==0.4.5" }, + { name = "alibabacloud-tea-openapi", specifier = "==0.4.6" }, { name = "alibabacloud-vpc20160428", specifier = "==6.13.0" }, { name = "alive-progress", specifier = "==3.3.0" }, { name = "azure-identity", specifier = "==1.21.0" }, @@ -3950,7 +3948,7 @@ requires-dist = [ { name = "microsoft-kiota-abstractions", specifier = "==1.9.10" }, { name = "msgraph-sdk", specifier = "==1.55.0" }, { name = "numpy", specifier = "==2.2.6" }, - { name = "oci", specifier = "==2.183.0" }, + { name = "oci", specifier = "==2.184.1" }, { name = "okta", specifier = "==3.4.2" }, { name = "openstacksdk", specifier = "==4.2.0" }, { name = "pandas", specifier = "==2.2.3" }, @@ -3971,6 +3969,7 @@ requires-dist = [ { name = "tabulate", specifier = "==0.9.0" }, { name = "tzlocal", specifier = "==5.3.1" }, { name = "uuid6", specifier = "==2024.7.10" }, + { name = "zstandard", specifier = "==0.25.0" }, ] [package.metadata.requires-dev] @@ -4399,15 +4398,15 @@ wheels = [ [[package]] name = "pyopenssl" -version = "26.2.0" +version = "26.4.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "cryptography" }, { name = "typing-extensions", marker = "python_full_version < '3.13'" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/1a/51/27a5ad5f939d08f690a326ef9582cda7140555180db71695f6fb747d6a36/pyopenssl-26.2.0.tar.gz", hash = "sha256:8c6fcecd1183a7fc897548dfe388b0cdb7f37e018200d8409cf33959dbe35387", size = 182195, upload-time = "2026-05-04T23:06:09.72Z" } +sdist = { url = "https://files.pythonhosted.org/packages/3f/e8/7325d258199b159eb2c03fe32107533e2832e70e63f4fb88a6aa00023201/pyopenssl-26.4.0.tar.gz", hash = "sha256:28dfcce0162b9211413e26dfbfdf1d24317fbeba18fc93c12400a1856b2a0bc7", size = 182046, upload-time = "2026-08-01T19:50:50.512Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/73/b8/a0e2790ae249d6f38c9f66de7a211621a7ab2650217bcd04e1262f578a56/pyopenssl-26.2.0-py3-none-any.whl", hash = "sha256:4f9d971bc5298b8bc1fab282803da04bf000c755d4ad9d99b52de2569ca19a70", size = 55823, upload-time = "2026-05-04T23:06:08.395Z" }, + { url = "https://files.pythonhosted.org/packages/51/ad/2cf6d3fa2fae5c79e1ed9960c0d42badd0f94d81dd12b50604cdc839e648/pyopenssl-26.4.0-py3-none-any.whl", hash = "sha256:f0eb0cb2d581d3ad2b9c489468485e7f2ab6727d08401bcf9d824c3caddf3c1c", size = 56026, upload-time = "2026-08-01T19:50:48.94Z" }, ] [[package]] @@ -5519,72 +5518,125 @@ wheels = [ ] [[package]] -name = "zstd" -version = "1.5.7.3" +name = "zstandard" +version = "0.25.0" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/49/62/b9c075ad664e7c4cbb3d8d2be7c246506abe1bc7f778eb58d260ef9538c8/zstd-1.5.7.3.tar.gz", hash = "sha256:403e5205f4ac04b92e6b0cda654be2f51de268228a0db0067bc087faacf2f495", size = 672559, upload-time = "2026-01-08T16:24:43.361Z" } +sdist = { url = "https://files.pythonhosted.org/packages/fd/aa/3e0508d5a5dd96529cdc5a97011299056e14c6505b678fd58938792794b1/zstandard-0.25.0.tar.gz", hash = "sha256:7713e1179d162cf5c7906da876ec2ccb9c3a9dcbdffef0cc7f70c3667a205f0b", size = 711513, upload-time = "2025-09-14T22:15:54.002Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/8b/54/95fe3f714a4a0c2befc1f5734deb2706c635481feff4e5497ace0f307fef/zstd-1.5.7.3-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:76f3535616887a1a38e8c6d0de693a23c5bb1f190651eb20d96bfc8e4ab706a0", size = 267642, upload-time = "2026-01-08T16:46:57.829Z" }, - { url = "https://files.pythonhosted.org/packages/0f/af/e88d733bf7dac8bcb0f90e90f9ea2163909e873e37aaf90617e7e5ed34d8/zstd-1.5.7.3-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:67507937e8e4c2a8dfed8e7fa77f4043ec9e6e831a5faebf0f99138b1a25ccbd", size = 230964, upload-time = "2026-01-08T16:46:59.277Z" }, - { url = "https://files.pythonhosted.org/packages/ac/7a/9e8b541b5799bb699e70d6f0c4fa5a0607c9229634209e9662f4a6a8a6ce/zstd-1.5.7.3-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:bd0a2309c524608ce7b940abcc9f8eb5447c6ea2c834a630e0081211ab9d40ec", size = 1540287, upload-time = "2026-01-08T17:39:27.789Z" }, - { url = "https://files.pythonhosted.org/packages/4b/1e/d0fe5f8e860c39f50831889c499fbf91a5bfdb8adcd148d35f1f7a3e7ea7/zstd-1.5.7.3-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:2b497306580d544406b5414c8485c4037a9283ad2ca6ae4ccdf3732c9563141d", size = 1619041, upload-time = "2026-01-08T17:39:23.305Z" }, - { url = "https://files.pythonhosted.org/packages/10/bd/b9b381edad8cfdca944cd15025932c6b0edacc5164ed67b603b4d8a38f84/zstd-1.5.7.3-cp310-cp310-manylinux_2_4_i686.whl", hash = "sha256:e9939a98ea946d1f9e8f9fecc940ae939b8e9e5ef9d71b104f7843567d764f30", size = 300166, upload-time = "2026-01-10T11:12:23.088Z" }, - { url = "https://files.pythonhosted.org/packages/a7/a8/9b6f65a3bd7fb54148bceadf9a5a9a869b64454c9e15b6f1362160594785/zstd-1.5.7.3-cp310-cp310-manylinux_2_4_x86_64.whl", hash = "sha256:d32c0fe8f6b805b7cbeaade462b094a843e84d893d8c6f66ab705e8777cc1850", size = 304165, upload-time = "2026-01-10T11:22:59.825Z" }, - { url = "https://files.pythonhosted.org/packages/f9/22/2fb52f1d288bb5e8176108a4bdbc25484fc05cc902cdf5c99cf604aba979/zstd-1.5.7.3-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_24_i686.whl", hash = "sha256:8aa33b1ef24602b2ef1e8aa67ea3c8f821854a4dbf70c3c8c46b96b54b6ceb5d", size = 1525903, upload-time = "2026-01-08T17:39:26.4Z" }, - { url = "https://files.pythonhosted.org/packages/b4/be/26451e696c2cc5f604eb872408a4e0ddc64478e45928897c755b2ab0330c/zstd-1.5.7.3-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:1bd69fa9c4c97fd04206c919dedbf9f75f544ebb77880db51a13c1e3802cd655", size = 2095723, upload-time = "2026-01-08T17:39:30.473Z" }, - { url = "https://files.pythonhosted.org/packages/01/1a/43ee13d01e367eb5bb2dead554e2fb3931e4f2d4a45a7642601e44b138b1/zstd-1.5.7.3-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:aee96742a64ede2e35dc0316ef0cd1e50089e889ce77e82ca8edf40174a1439c", size = 2132397, upload-time = "2026-01-08T17:39:24.739Z" }, - { url = "https://files.pythonhosted.org/packages/00/d7/5497d54dadb172ee148820aff1551cb189344522c207bc83f073f8a85a59/zstd-1.5.7.3-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:5ac207573d2815a51f4f4fd4e255408396491729a01f690b9f5fb672d39e5610", size = 2124660, upload-time = "2026-01-08T17:39:29.146Z" }, - { url = "https://files.pythonhosted.org/packages/98/89/665c5fac2da24c129ef403f65c2d8e9b08142b97b02ab7daa3a44cddeca7/zstd-1.5.7.3-cp310-cp310-win32.whl", hash = "sha256:04e62e4f9eba79699d072d3c96731ed4aff99f1d334eb967489b091186a6078f", size = 150362, upload-time = "2026-01-08T17:09:29.33Z" }, - { url = "https://files.pythonhosted.org/packages/53/2e/cae4878efd693ddfb712577eee4ac37dd4c0fe757054c4ee3479530b416f/zstd-1.5.7.3-cp310-cp310-win_amd64.whl", hash = "sha256:0794b23b9950af240888087d2bd5943aa4be67273ba32cdafabdc5704778b90e", size = 167580, upload-time = "2026-01-08T17:09:30.639Z" }, - { url = "https://files.pythonhosted.org/packages/93/f9/9908234f86aafb48edd5fe630b41488c3acd8a4edbfbc921a7a6db1ab8b4/zstd-1.5.7.3-cp310-cp310-win_arm64.whl", hash = "sha256:7827fd4901f3e71a7a755d26719549658f08e04fdf0870a952ed08e71b484435", size = 157239, upload-time = "2026-01-08T16:43:01.449Z" }, - { url = "https://files.pythonhosted.org/packages/75/0d/8c89c0d010b58c21a7865a239790bb1c6822029c053b1ded858d6b573e3a/zstd-1.5.7.3-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:1a3c1781a24e2ced2c0ddee11d45b1f04018b03615eeb622a62eca4d56d3358a", size = 267641, upload-time = "2026-01-08T16:30:50.812Z" }, - { url = "https://files.pythonhosted.org/packages/a3/6d/155d8c344d96eca2a5a003a5ddd63373a5f13591fd5cf2b9490250d6805a/zstd-1.5.7.3-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:a6c7c81056362b60a04baa34632e713d596662a860ec34efd8e9b109c10e6ec7", size = 230962, upload-time = "2026-01-08T16:30:49.155Z" }, - { url = "https://files.pythonhosted.org/packages/c8/c7/ab93916a26eb58cd501ad701974c31b4bc67a7f6abd6c24bef8fe4d7649b/zstd-1.5.7.3-cp311-cp311-manylinux_2_14_x86_64.whl", hash = "sha256:e564f34a55effc7d654eb293468edc80b64d476b0f899f82760ecd8323223ff5", size = 304166, upload-time = "2026-01-10T11:17:45.697Z" }, - { url = "https://files.pythonhosted.org/packages/c2/54/27a7040a360019a4602343e3c98c0c0a140f382186002c01e1992fd21837/zstd-1.5.7.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:fbc49a57188184931d5e3c9f1133cad7eea5a370a9e9418fb8122d58c14340a5", size = 1540288, upload-time = "2026-01-08T17:50:26.913Z" }, - { url = "https://files.pythonhosted.org/packages/96/93/4a4d4edd1b2e809e0ebbb16000404bdcc9a09743c04ee1661442c9581b75/zstd-1.5.7.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:d121d3e63722819e1fe5effbcd9628d8a7cfea0cddabcc5bb37ea861a6a83424", size = 1619134, upload-time = "2026-01-08T17:50:32.324Z" }, - { url = "https://files.pythonhosted.org/packages/31/6b/cd6f0a7f4f0d98e4110aa77763cf3e85f594d983ea9ca3d64cc0cee10684/zstd-1.5.7.3-cp311-cp311-manylinux_2_4_i686.whl", hash = "sha256:621f2e7ca8e9eb52a83eb9c91ec3cd283d87591bf75cc658de486b65f44742c7", size = 300166, upload-time = "2026-01-10T11:12:27.938Z" }, - { url = "https://files.pythonhosted.org/packages/05/3f/c717e0d15127d04b7fa58ba9b4c56e8b88b803048b9766cd9d158dbb22ea/zstd-1.5.7.3-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_24_i686.whl", hash = "sha256:c1950fcae690ba32d0f31702b335c548fb42547821565925e48576afdad774a5", size = 1525776, upload-time = "2026-01-08T17:50:35.518Z" }, - { url = "https://files.pythonhosted.org/packages/3e/a2/1813cd787d1a2f9ab8e8a90d28dcbc8e8098997dd04de38897ea8e75dd08/zstd-1.5.7.3-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:bac4f0d03da69115878bedbfa03c4a3f64364e8396b432028c4ce0f05141a0fb", size = 2096057, upload-time = "2026-01-08T17:50:33.984Z" }, - { url = "https://files.pythonhosted.org/packages/36/ce/f5a3c7c12de458dd9ce15c484d627fe5412b60c155da23dacb5fcf08d9d5/zstd-1.5.7.3-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:da0ab134b7fd28023dedf013751ca850de300a090eb11f689d2a1c178c87d9dc", size = 2132659, upload-time = "2026-01-08T17:50:29.534Z" }, - { url = "https://files.pythonhosted.org/packages/f1/66/151f9546498bfd8971a0b6ad67d87c26d7a0df17d57f724da674f3778666/zstd-1.5.7.3-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:b9923175842ee8f7602ec9cc578f5fc396896f0e8460d3ac9a5adc3cea77244e", size = 2124811, upload-time = "2026-01-08T17:50:37.612Z" }, - { url = "https://files.pythonhosted.org/packages/6a/34/4d2dbb36cb2373d3f115c047cb901b64f89de0703d10779da39de9453812/zstd-1.5.7.3-cp311-cp311-win32.whl", hash = "sha256:0612b604948d7b58aecc6788c7ceb53c5f21d94a155bb6ea9bd0f54ffa43725d", size = 150363, upload-time = "2026-01-08T17:11:02.392Z" }, - { url = "https://files.pythonhosted.org/packages/d9/de/f53687e0dd8c0d0ebfaed9ae88f6a96a1a0388ae7424b469e74bb17ac57d/zstd-1.5.7.3-cp311-cp311-win_amd64.whl", hash = "sha256:5b7f8c81b2bd3b62c0345242247d484cafa4b518d59d18619813d9225af5c5c3", size = 167577, upload-time = "2026-01-08T17:11:03.356Z" }, - { url = "https://files.pythonhosted.org/packages/f2/58/d4a6a902e229e953ed273fe9b78587ed31f57567aa68d3e34af6056e42af/zstd-1.5.7.3-cp311-cp311-win_arm64.whl", hash = "sha256:ea112e3acd9e1765adca35df7b54ac75b36194290f64ea03a3a59664209c8527", size = 157238, upload-time = "2026-01-08T16:36:06.25Z" }, - { url = "https://files.pythonhosted.org/packages/aa/ed/5a3bf2e29dc56d4cc7619929bb51f0c758de6d02967cc73c5d8755a862c0/zstd-1.5.7.3-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:01a39efb0eeab7cc45cb308618233b624b0840d5e16dcf85456b6cca0592f203", size = 268124, upload-time = "2026-01-08T16:29:57.091Z" }, - { url = "https://files.pythonhosted.org/packages/e2/1d/efc2074ac90af938e78f2ed4004639fe24f294d9086c5280f8d9a02b9897/zstd-1.5.7.3-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:7a8e8838cf35fa3987bfe1958584cc22e1797efce8e155a63544b4144fc671f8", size = 230988, upload-time = "2026-01-08T16:29:55.604Z" }, - { url = "https://files.pythonhosted.org/packages/2a/52/178393b8d70e23fba67f42dfce4663e4e8a30867110168beb490a36d4639/zstd-1.5.7.3-cp312-cp312-manylinux_2_14_i686.whl", hash = "sha256:f3920ac1d1cc7e9f252f3e29f217fe3cd36f2191bb3dbcae826c29e189b7ad54", size = 300207, upload-time = "2026-01-10T11:26:58.351Z" }, - { url = "https://files.pythonhosted.org/packages/6a/7a/8dcd86a2efb2ed3f9dae39545a05d3c7ed26c7678330786ce4a44cd8b099/zstd-1.5.7.3-cp312-cp312-manylinux_2_14_x86_64.whl", hash = "sha256:143f9062953fb5590cbd47c1040d357336742c79696bf90b6d5b835279a68304", size = 304154, upload-time = "2026-01-10T11:17:40.91Z" }, - { url = "https://files.pythonhosted.org/packages/6f/ce/0c96905ab01ffe0e53a3cec8132123b82db26bd583a71608029bcc789ebc/zstd-1.5.7.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:36d1fd8647e47e1f21b345e192f1a279e925678c23dad8236b547d04456cd699", size = 2162222, upload-time = "2026-01-08T18:02:22.762Z" }, - { url = "https://files.pythonhosted.org/packages/11/c4/db4807d6a68b4628c74fd379de7e3c67ec34f19a2a80ac246b3837cde6cb/zstd-1.5.7.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f1538db419afa62773cf534fc7f3009ff59ecf55ecee4e889587ac2ef0010ed8", size = 2201732, upload-time = "2026-01-08T18:02:20.835Z" }, - { url = "https://files.pythonhosted.org/packages/c5/99/c19a3c0f5580ff9c33a74f06d98d6060ed1fa6bd09b55aed9be852ec191f/zstd-1.5.7.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:c5efd16adb092e2a547a7d51cfdaf6fd5680528227684c5bafc7669ab4a55f41", size = 2096459, upload-time = "2026-01-08T18:02:25.336Z" }, - { url = "https://files.pythonhosted.org/packages/23/fd/02eac30419475dbe50212c119043a2d0698a0cbc756da85fd3fd9abddf42/zstd-1.5.7.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:39b3438e64637d80a5b1860526903b92020acb9bae9ceb5adffd9838c1441328", size = 2125442, upload-time = "2026-01-08T18:02:17.715Z" }, - { url = "https://files.pythonhosted.org/packages/bb/43/3a16ff0a8c913bb9825379db1bd533c75c57c2d2f31dd9111aa9b53711f4/zstd-1.5.7.3-cp312-cp312-win32.whl", hash = "sha256:cbf48c53461e224ffc2490cfe5120a1ff40d14c84d2b512c6d6d99fc91685cf3", size = 150367, upload-time = "2026-01-08T17:03:40.178Z" }, - { url = "https://files.pythonhosted.org/packages/46/83/b85875d7428e63dfa9247e41d17fac611443c774f7892f8643bd4164a6b2/zstd-1.5.7.3-cp312-cp312-win_amd64.whl", hash = "sha256:943a189910f2fea997462e3e4d7fbf727a06d231ef801ebee557b1c87568981c", size = 167604, upload-time = "2026-01-08T17:03:41.355Z" }, - { url = "https://files.pythonhosted.org/packages/37/42/cf291e26804de2f55500cdac93f5e9fa6267cf315def8aa402529bae3a87/zstd-1.5.7.3-cp312-cp312-win_arm64.whl", hash = "sha256:85c4d508f8109afa7c51c4960626c3325af2cf1e442c6c36ebfea15d04757e3f", size = 157241, upload-time = "2026-01-08T16:47:34.615Z" }, - { url = "https://files.pythonhosted.org/packages/21/7c/f2fe6e09b9d064873ebd384f2692b9fcad3d8e9412298dfb09a935aec77d/zstd-1.5.7.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:b2455e56f1d265dacbd450510b8c2f632a5d8d92c23282e7723fb04af37001a2", size = 268133, upload-time = "2026-01-08T17:31:54.616Z" }, - { url = "https://files.pythonhosted.org/packages/14/8d/0a1e49844ed82c7ab0f66dce5e0dd822742fc7e9d04f147032db33740840/zstd-1.5.7.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:3486dc4f1b4e52bb059f8eec1f31daa3e540062c0f522f221782cf132a8bc9a8", size = 231005, upload-time = "2026-01-08T17:31:55.885Z" }, - { url = "https://files.pythonhosted.org/packages/3b/24/0ab682096da2411f83236a10c89423f26859a65431660e460e2d637b5628/zstd-1.5.7.3-cp313-cp313-manylinux_2_14_i686.whl", hash = "sha256:1cb47bf10ffcb6a782edacfe758da2c94879f7e89c6628feb3f1254daf8cc596", size = 300230, upload-time = "2026-01-08T16:30:52.654Z" }, - { url = "https://files.pythonhosted.org/packages/36/2e/3ff0d28ea8d6b9bd931af7477fad082b99633cb7901cdd657dcb7ecfee11/zstd-1.5.7.3-cp313-cp313-manylinux_2_14_x86_64.whl", hash = "sha256:07b1378d1230ddeea8773f99d7518a3060e6468c76edd502057cb795fe278d7e", size = 297097, upload-time = "2026-01-08T16:49:41.211Z" }, - { url = "https://files.pythonhosted.org/packages/3e/ef/25c15570fb6b06a4a03bd054afa2d084df687ac10e336b703139acc77182/zstd-1.5.7.3-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1ee34317f013e3405108f5baea53502159809cfc4510598d614257525500c70d", size = 2162274, upload-time = "2026-01-08T17:35:24.464Z" }, - { url = "https://files.pythonhosted.org/packages/f1/24/fd16ba9e9be877a2194f05462ae77dcb62c8f90c4ecc186d9ee71e9bdc9f/zstd-1.5.7.3-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c19127ca2c79855376a34a2d7a6969408094b25c1f44485b0373eba4be851b98", size = 2201877, upload-time = "2026-01-08T17:35:28.596Z" }, - { url = "https://files.pythonhosted.org/packages/85/ef/73c37a81ac36429bb1bbb69c8ac43f3a154cfab739dce6424d28f95301c3/zstd-1.5.7.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:2e79cae70dd08cb247391312463085c624c0302e8c860d13f87f4c76502d8202", size = 2096535, upload-time = "2026-01-08T17:35:30.001Z" }, - { url = "https://files.pythonhosted.org/packages/d3/1f/859a8049634e444feb6855347d5e558c1280d87b0bc6385f13cd3d95dbe6/zstd-1.5.7.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:0e83e91e5daf89037c737f5529da0f80da80a78a6ad0b1d70a09860eb267dea4", size = 2125473, upload-time = "2026-01-08T17:35:26.596Z" }, - { url = "https://files.pythonhosted.org/packages/b1/5c/e7b8aa8eea46f032891ecef187f1d469e20f9ddf0d10607e9523b3d306a1/zstd-1.5.7.3-cp313-cp313-win32.whl", hash = "sha256:2283f3bb910c028e1b9fe76b834016012ab021025a0ea197e27a1333f85e3031", size = 150370, upload-time = "2026-01-08T17:18:12.899Z" }, - { url = "https://files.pythonhosted.org/packages/50/2b/ba558ff87ba7f6c29e3a9b1c3b3e95338146aee7250b10807229d412a9c4/zstd-1.5.7.3-cp313-cp313-win_amd64.whl", hash = "sha256:3ad5fe4c36bab5dfa5a4b8d050bd07c50c1e69f94d381bc65337ab14cd69e5b1", size = 167602, upload-time = "2026-01-08T17:18:13.858Z" }, - { url = "https://files.pythonhosted.org/packages/f7/7d/4a5c9813fafad2949d42deee3857d7ecc8caf369bbf82a88b60519200083/zstd-1.5.7.3-cp313-cp313-win_arm64.whl", hash = "sha256:7e878172b0eb69ac2edc6576eb862e00747c7c25e638fb354630a1ea7cfddf49", size = 157239, upload-time = "2026-01-08T16:42:28.885Z" }, - { url = "https://files.pythonhosted.org/packages/0c/67/5fcec6bbf8aab4aeb26e3cbe8cc9fa2f323dd143d066e313b134b8c28dc8/zstd-1.5.7.3-cp313-cp313t-manylinux_2_14_x86_64.whl", hash = "sha256:7e0a7e94d5b63b4cacf2396079ca9584d11f49f87cb4e5aa21f126a8f6b83446", size = 297302, upload-time = "2026-01-08T16:36:49.027Z" }, - { url = "https://files.pythonhosted.org/packages/64/ad/f6588943c9fde34a28f1b0448a8ac824b2ebe341f7af56ff035d0489338d/zstd-1.5.7.3-pp310-pypy310_pp73-macosx_10_15_x86_64.whl", hash = "sha256:2b9ec4d5ba8c170d3fdf21ae5da3c15eaea2beef9c419a5f3274a6f9e03c412a", size = 260091, upload-time = "2026-01-08T17:14:18.143Z" }, - { url = "https://files.pythonhosted.org/packages/7a/6a/6d2d3b9b7bad0124c684b7b77621ee6bdc3fc220a580f002014cf0a8f558/zstd-1.5.7.3-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:a7ab69fc4d90eeb64b98a567751f8e48373f4bcf301597fca344b8e8342e1d5e", size = 221149, upload-time = "2026-01-08T17:14:17.168Z" }, - { url = "https://files.pythonhosted.org/packages/90/8d/ad4d3c24293c70d8ae9c80e06b2da2922048933f9a00f35d18df5166346a/zstd-1.5.7.3-pp310-pypy310_pp73-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:da70f0918bf739bc75d7770410c9b94ea0dcb6f02d7ef70598b464bd5fcb193a", size = 326792, upload-time = "2026-01-08T17:12:35.38Z" }, - { url = "https://files.pythonhosted.org/packages/ed/37/98c3dd075935b5a7a1806837db343c1a37e6726c53db93c27aa4d7e5e86c/zstd-1.5.7.3-pp310-pypy310_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:3dd5c069d0409284f1963b0b6b119f21b1da9e22a503e88933eb0696249d87d3", size = 322283, upload-time = "2026-01-08T17:12:32.042Z" }, - { url = "https://files.pythonhosted.org/packages/97/96/20fd30bd330529b4ad8420f4ba9030b80b971499be75d37c39306cdeb038/zstd-1.5.7.3-pp310-pypy310_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:46ca4a075f36f118e2ce07ba07d9ece7aeda193cea6f50b82aaee635df7b5fc2", size = 311551, upload-time = "2026-01-08T17:12:33.683Z" }, - { url = "https://files.pythonhosted.org/packages/51/b5/001cc10b6a221e4e5fb4ec19ff49d6dcc028f97a5ce53a8ef5cee67ac409/zstd-1.5.7.3-pp310-pypy310_pp73-manylinux_2_14_x86_64.whl", hash = "sha256:4a521cb7615fc61bfe9514bea182e224894b5987fc7843b6d6da20a61206ef24", size = 317071, upload-time = "2026-01-08T16:30:35.427Z" }, - { url = "https://files.pythonhosted.org/packages/41/81/75bdf0e4515c74094adff7e5119f4d50bc9af20359b78c04f8f6cac3f59c/zstd-1.5.7.3-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:71ea22c953a164f34eb4b8c2c3b97eaa22da6a75296ea80b3ba4473187f15046", size = 167655, upload-time = "2026-01-08T16:55:06.572Z" }, - { url = "https://files.pythonhosted.org/packages/04/b8/d13d584867d5eb1bc607877a870858e02a256d4706a4274e475413a000aa/zstd-1.5.7.3-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:76c49ea969bc08389ea59155cea7c5dea224522ffc62f443f3c0a915f5fd184d", size = 260025, upload-time = "2026-01-08T16:57:45.739Z" }, - { url = "https://files.pythonhosted.org/packages/16/a1/1e5faf75bedfd2bfccfb83e18736b115bed6e348504bd21800cd8f30dcea/zstd-1.5.7.3-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:6b1a638ff3dfce8f4cb1203c662fb5606dd99b4a62c5ddc4c406d2d1326bcfdd", size = 221038, upload-time = "2026-01-08T17:16:32.005Z" }, - { url = "https://files.pythonhosted.org/packages/b7/2c/0fe74d8b2029eef8000bc71aac5b3e5b55d00581238711cf627814183ea3/zstd-1.5.7.3-pp311-pypy311_pp73-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:5e96a5cb100a0edc162935227f2d9784b1031ce4a8a83e96e66eae2673c10143", size = 326792, upload-time = "2026-01-08T16:57:35.631Z" }, - { url = "https://files.pythonhosted.org/packages/96/e0/2c7f081f3524f872128ff31bea2acb6b21cb1dacccef920eb6a1a77a87c6/zstd-1.5.7.3-pp311-pypy311_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1bda0bbf3a9553720cd33f1f85940a259656c7ffba4be717ff82b7f062052188", size = 322283, upload-time = "2026-01-08T16:57:36.759Z" }, - { url = "https://files.pythonhosted.org/packages/c9/a7/3bebfcc18d66b90bc7b506a61b2ff4af5ee1b0b16e784ea644afa06241c5/zstd-1.5.7.3-pp311-pypy311_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ac36e4022422f6e49b3f07bdbb8a964fd348223d3dc9c82ad5398a4f0432a719", size = 311553, upload-time = "2026-01-08T16:57:38.465Z" }, - { url = "https://files.pythonhosted.org/packages/41/75/8a791cae2c98e5e44a158e15db50d21b7ec0b37aeaffa68d151bc8ffb6d6/zstd-1.5.7.3-pp311-pypy311_pp73-manylinux_2_14_x86_64.whl", hash = "sha256:fa4d760a220541b18ce732a3a2cf7547ea05afc76d05b3b39edebfeb721f6079", size = 317071, upload-time = "2026-01-08T16:36:07.47Z" }, - { url = "https://files.pythonhosted.org/packages/2f/25/b6624e6b08d515242154436c9d06fb20b790d300ac82e84f3c4c133e25e1/zstd-1.5.7.3-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:a69e60146bf8aaa6a0e6c9a94a7c5f3133d68091e2e5c5a3c5ababf71fd5ec7a", size = 167654, upload-time = "2026-01-08T17:00:56.667Z" }, + { url = "https://files.pythonhosted.org/packages/56/7a/28efd1d371f1acd037ac64ed1c5e2b41514a6cc937dd6ab6a13ab9f0702f/zstandard-0.25.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:e59fdc271772f6686e01e1b3b74537259800f57e24280be3f29c8a0deb1904dd", size = 795256, upload-time = "2025-09-14T22:15:56.415Z" }, + { url = "https://files.pythonhosted.org/packages/96/34/ef34ef77f1ee38fc8e4f9775217a613b452916e633c4f1d98f31db52c4a5/zstandard-0.25.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:4d441506e9b372386a5271c64125f72d5df6d2a8e8a2a45a0ae09b03cb781ef7", size = 640565, upload-time = "2025-09-14T22:15:58.177Z" }, + { url = "https://files.pythonhosted.org/packages/9d/1b/4fdb2c12eb58f31f28c4d28e8dc36611dd7205df8452e63f52fb6261d13e/zstandard-0.25.0-cp310-cp310-manylinux2010_i686.manylinux2014_i686.manylinux_2_12_i686.manylinux_2_17_i686.whl", hash = "sha256:ab85470ab54c2cb96e176f40342d9ed41e58ca5733be6a893b730e7af9c40550", size = 5345306, upload-time = "2025-09-14T22:16:00.165Z" }, + { url = "https://files.pythonhosted.org/packages/73/28/a44bdece01bca027b079f0e00be3b6bd89a4df180071da59a3dd7381665b/zstandard-0.25.0-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:e05ab82ea7753354bb054b92e2f288afb750e6b439ff6ca78af52939ebbc476d", size = 5055561, upload-time = "2025-09-14T22:16:02.22Z" }, + { url = "https://files.pythonhosted.org/packages/e9/74/68341185a4f32b274e0fc3410d5ad0750497e1acc20bd0f5b5f64ce17785/zstandard-0.25.0-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:78228d8a6a1c177a96b94f7e2e8d012c55f9c760761980da16ae7546a15a8e9b", size = 5402214, upload-time = "2025-09-14T22:16:04.109Z" }, + { url = "https://files.pythonhosted.org/packages/8b/67/f92e64e748fd6aaffe01e2b75a083c0c4fd27abe1c8747fee4555fcee7dd/zstandard-0.25.0-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:2b6bd67528ee8b5c5f10255735abc21aa106931f0dbaf297c7be0c886353c3d0", size = 5449703, upload-time = "2025-09-14T22:16:06.312Z" }, + { url = "https://files.pythonhosted.org/packages/fd/e5/6d36f92a197c3c17729a2125e29c169f460538a7d939a27eaaa6dcfcba8e/zstandard-0.25.0-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:4b6d83057e713ff235a12e73916b6d356e3084fd3d14ced499d84240f3eecee0", size = 5556583, upload-time = "2025-09-14T22:16:08.457Z" }, + { url = "https://files.pythonhosted.org/packages/d7/83/41939e60d8d7ebfe2b747be022d0806953799140a702b90ffe214d557638/zstandard-0.25.0-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:9174f4ed06f790a6869b41cba05b43eeb9a35f8993c4422ab853b705e8112bbd", size = 5045332, upload-time = "2025-09-14T22:16:10.444Z" }, + { url = "https://files.pythonhosted.org/packages/b3/87/d3ee185e3d1aa0133399893697ae91f221fda79deb61adbe998a7235c43f/zstandard-0.25.0-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:25f8f3cd45087d089aef5ba3848cd9efe3ad41163d3400862fb42f81a3a46701", size = 5572283, upload-time = "2025-09-14T22:16:12.128Z" }, + { url = "https://files.pythonhosted.org/packages/0a/1d/58635ae6104df96671076ac7d4ae7816838ce7debd94aecf83e30b7121b0/zstandard-0.25.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:3756b3e9da9b83da1796f8809dd57cb024f838b9eeafde28f3cb472012797ac1", size = 4959754, upload-time = "2025-09-14T22:16:14.225Z" }, + { url = "https://files.pythonhosted.org/packages/75/d6/57e9cb0a9983e9a229dd8fd2e6e96593ef2aa82a3907188436f22b111ccd/zstandard-0.25.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:81dad8d145d8fd981b2962b686b2241d3a1ea07733e76a2f15435dfb7fb60150", size = 5266477, upload-time = "2025-09-14T22:16:16.343Z" }, + { url = "https://files.pythonhosted.org/packages/d1/a9/ee891e5edf33a6ebce0a028726f0bbd8567effe20fe3d5808c42323e8542/zstandard-0.25.0-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:a5a419712cf88862a45a23def0ae063686db3d324cec7edbe40509d1a79a0aab", size = 5440914, upload-time = "2025-09-14T22:16:18.453Z" }, + { url = "https://files.pythonhosted.org/packages/58/08/a8522c28c08031a9521f27abc6f78dbdee7312a7463dd2cfc658b813323b/zstandard-0.25.0-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:e7360eae90809efd19b886e59a09dad07da4ca9ba096752e61a2e03c8aca188e", size = 5819847, upload-time = "2025-09-14T22:16:20.559Z" }, + { url = "https://files.pythonhosted.org/packages/6f/11/4c91411805c3f7b6f31c60e78ce347ca48f6f16d552fc659af6ec3b73202/zstandard-0.25.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:75ffc32a569fb049499e63ce68c743155477610532da1eb38e7f24bf7cd29e74", size = 5363131, upload-time = "2025-09-14T22:16:22.206Z" }, + { url = "https://files.pythonhosted.org/packages/ef/d6/8c4bd38a3b24c4c7676a7a3d8de85d6ee7a983602a734b9f9cdefb04a5d6/zstandard-0.25.0-cp310-cp310-win32.whl", hash = "sha256:106281ae350e494f4ac8a80470e66d1fe27e497052c8d9c3b95dc4cf1ade81aa", size = 436469, upload-time = "2025-09-14T22:16:25.002Z" }, + { url = "https://files.pythonhosted.org/packages/93/90/96d50ad417a8ace5f841b3228e93d1bb13e6ad356737f42e2dde30d8bd68/zstandard-0.25.0-cp310-cp310-win_amd64.whl", hash = "sha256:ea9d54cc3d8064260114a0bbf3479fc4a98b21dffc89b3459edd506b69262f6e", size = 506100, upload-time = "2025-09-14T22:16:23.569Z" }, + { url = "https://files.pythonhosted.org/packages/2a/83/c3ca27c363d104980f1c9cee1101cc8ba724ac8c28a033ede6aab89585b1/zstandard-0.25.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:933b65d7680ea337180733cf9e87293cc5500cc0eb3fc8769f4d3c88d724ec5c", size = 795254, upload-time = "2025-09-14T22:16:26.137Z" }, + { url = "https://files.pythonhosted.org/packages/ac/4d/e66465c5411a7cf4866aeadc7d108081d8ceba9bc7abe6b14aa21c671ec3/zstandard-0.25.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:a3f79487c687b1fc69f19e487cd949bf3aae653d181dfb5fde3bf6d18894706f", size = 640559, upload-time = "2025-09-14T22:16:27.973Z" }, + { url = "https://files.pythonhosted.org/packages/12/56/354fe655905f290d3b147b33fe946b0f27e791e4b50a5f004c802cb3eb7b/zstandard-0.25.0-cp311-cp311-manylinux2010_i686.manylinux2014_i686.manylinux_2_12_i686.manylinux_2_17_i686.whl", hash = "sha256:0bbc9a0c65ce0eea3c34a691e3c4b6889f5f3909ba4822ab385fab9057099431", size = 5348020, upload-time = "2025-09-14T22:16:29.523Z" }, + { url = "https://files.pythonhosted.org/packages/3b/13/2b7ed68bd85e69a2069bcc72141d378f22cae5a0f3b353a2c8f50ef30c1b/zstandard-0.25.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:01582723b3ccd6939ab7b3a78622c573799d5d8737b534b86d0e06ac18dbde4a", size = 5058126, upload-time = "2025-09-14T22:16:31.811Z" }, + { url = "https://files.pythonhosted.org/packages/c9/dd/fdaf0674f4b10d92cb120ccff58bbb6626bf8368f00ebfd2a41ba4a0dc99/zstandard-0.25.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:5f1ad7bf88535edcf30038f6919abe087f606f62c00a87d7e33e7fc57cb69fcc", size = 5405390, upload-time = "2025-09-14T22:16:33.486Z" }, + { url = "https://files.pythonhosted.org/packages/0f/67/354d1555575bc2490435f90d67ca4dd65238ff2f119f30f72d5cde09c2ad/zstandard-0.25.0-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:06acb75eebeedb77b69048031282737717a63e71e4ae3f77cc0c3b9508320df6", size = 5452914, upload-time = "2025-09-14T22:16:35.277Z" }, + { url = "https://files.pythonhosted.org/packages/bb/1f/e9cfd801a3f9190bf3e759c422bbfd2247db9d7f3d54a56ecde70137791a/zstandard-0.25.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:9300d02ea7c6506f00e627e287e0492a5eb0371ec1670ae852fefffa6164b072", size = 5559635, upload-time = "2025-09-14T22:16:37.141Z" }, + { url = "https://files.pythonhosted.org/packages/21/88/5ba550f797ca953a52d708c8e4f380959e7e3280af029e38fbf47b55916e/zstandard-0.25.0-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:bfd06b1c5584b657a2892a6014c2f4c20e0db0208c159148fa78c65f7e0b0277", size = 5048277, upload-time = "2025-09-14T22:16:38.807Z" }, + { url = "https://files.pythonhosted.org/packages/46/c0/ca3e533b4fa03112facbe7fbe7779cb1ebec215688e5df576fe5429172e0/zstandard-0.25.0-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:f373da2c1757bb7f1acaf09369cdc1d51d84131e50d5fa9863982fd626466313", size = 5574377, upload-time = "2025-09-14T22:16:40.523Z" }, + { url = "https://files.pythonhosted.org/packages/12/9b/3fb626390113f272abd0799fd677ea33d5fc3ec185e62e6be534493c4b60/zstandard-0.25.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:6c0e5a65158a7946e7a7affa6418878ef97ab66636f13353b8502d7ea03c8097", size = 4961493, upload-time = "2025-09-14T22:16:43.3Z" }, + { url = "https://files.pythonhosted.org/packages/cb/d3/23094a6b6a4b1343b27ae68249daa17ae0651fcfec9ed4de09d14b940285/zstandard-0.25.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:c8e167d5adf59476fa3e37bee730890e389410c354771a62e3c076c86f9f7778", size = 5269018, upload-time = "2025-09-14T22:16:45.292Z" }, + { url = "https://files.pythonhosted.org/packages/8c/a7/bb5a0c1c0f3f4b5e9d5b55198e39de91e04ba7c205cc46fcb0f95f0383c1/zstandard-0.25.0-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:98750a309eb2f020da61e727de7d7ba3c57c97cf6213f6f6277bb7fb42a8e065", size = 5443672, upload-time = "2025-09-14T22:16:47.076Z" }, + { url = "https://files.pythonhosted.org/packages/27/22/503347aa08d073993f25109c36c8d9f029c7d5949198050962cb568dfa5e/zstandard-0.25.0-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:22a086cff1b6ceca18a8dd6096ec631e430e93a8e70a9ca5efa7561a00f826fa", size = 5822753, upload-time = "2025-09-14T22:16:49.316Z" }, + { url = "https://files.pythonhosted.org/packages/e2/be/94267dc6ee64f0f8ba2b2ae7c7a2df934a816baaa7291db9e1aa77394c3c/zstandard-0.25.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:72d35d7aa0bba323965da807a462b0966c91608ef3a48ba761678cb20ce5d8b7", size = 5366047, upload-time = "2025-09-14T22:16:51.328Z" }, + { url = "https://files.pythonhosted.org/packages/7b/a3/732893eab0a3a7aecff8b99052fecf9f605cf0fb5fb6d0290e36beee47a4/zstandard-0.25.0-cp311-cp311-win32.whl", hash = "sha256:f5aeea11ded7320a84dcdd62a3d95b5186834224a9e55b92ccae35d21a8b63d4", size = 436484, upload-time = "2025-09-14T22:16:55.005Z" }, + { url = "https://files.pythonhosted.org/packages/43/a3/c6155f5c1cce691cb80dfd38627046e50af3ee9ddc5d0b45b9b063bfb8c9/zstandard-0.25.0-cp311-cp311-win_amd64.whl", hash = "sha256:daab68faadb847063d0c56f361a289c4f268706b598afbf9ad113cbe5c38b6b2", size = 506183, upload-time = "2025-09-14T22:16:52.753Z" }, + { url = "https://files.pythonhosted.org/packages/8c/3e/8945ab86a0820cc0e0cdbf38086a92868a9172020fdab8a03ac19662b0e5/zstandard-0.25.0-cp311-cp311-win_arm64.whl", hash = "sha256:22a06c5df3751bb7dc67406f5374734ccee8ed37fc5981bf1ad7041831fa1137", size = 462533, upload-time = "2025-09-14T22:16:53.878Z" }, + { url = "https://files.pythonhosted.org/packages/82/fc/f26eb6ef91ae723a03e16eddb198abcfce2bc5a42e224d44cc8b6765e57e/zstandard-0.25.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:7b3c3a3ab9daa3eed242d6ecceead93aebbb8f5f84318d82cee643e019c4b73b", size = 795738, upload-time = "2025-09-14T22:16:56.237Z" }, + { url = "https://files.pythonhosted.org/packages/aa/1c/d920d64b22f8dd028a8b90e2d756e431a5d86194caa78e3819c7bf53b4b3/zstandard-0.25.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:913cbd31a400febff93b564a23e17c3ed2d56c064006f54efec210d586171c00", size = 640436, upload-time = "2025-09-14T22:16:57.774Z" }, + { url = "https://files.pythonhosted.org/packages/53/6c/288c3f0bd9fcfe9ca41e2c2fbfd17b2097f6af57b62a81161941f09afa76/zstandard-0.25.0-cp312-cp312-manylinux2010_i686.manylinux2014_i686.manylinux_2_12_i686.manylinux_2_17_i686.whl", hash = "sha256:011d388c76b11a0c165374ce660ce2c8efa8e5d87f34996aa80f9c0816698b64", size = 5343019, upload-time = "2025-09-14T22:16:59.302Z" }, + { url = "https://files.pythonhosted.org/packages/1e/15/efef5a2f204a64bdb5571e6161d49f7ef0fffdbca953a615efbec045f60f/zstandard-0.25.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:6dffecc361d079bb48d7caef5d673c88c8988d3d33fb74ab95b7ee6da42652ea", size = 5063012, upload-time = "2025-09-14T22:17:01.156Z" }, + { url = "https://files.pythonhosted.org/packages/b7/37/a6ce629ffdb43959e92e87ebdaeebb5ac81c944b6a75c9c47e300f85abdf/zstandard-0.25.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:7149623bba7fdf7e7f24312953bcf73cae103db8cae49f8154dd1eadc8a29ecb", size = 5394148, upload-time = "2025-09-14T22:17:03.091Z" }, + { url = "https://files.pythonhosted.org/packages/e3/79/2bf870b3abeb5c070fe2d670a5a8d1057a8270f125ef7676d29ea900f496/zstandard-0.25.0-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:6a573a35693e03cf1d67799fd01b50ff578515a8aeadd4595d2a7fa9f3ec002a", size = 5451652, upload-time = "2025-09-14T22:17:04.979Z" }, + { url = "https://files.pythonhosted.org/packages/53/60/7be26e610767316c028a2cbedb9a3beabdbe33e2182c373f71a1c0b88f36/zstandard-0.25.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:5a56ba0db2d244117ed744dfa8f6f5b366e14148e00de44723413b2f3938a902", size = 5546993, upload-time = "2025-09-14T22:17:06.781Z" }, + { url = "https://files.pythonhosted.org/packages/85/c7/3483ad9ff0662623f3648479b0380d2de5510abf00990468c286c6b04017/zstandard-0.25.0-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:10ef2a79ab8e2974e2075fb984e5b9806c64134810fac21576f0668e7ea19f8f", size = 5046806, upload-time = "2025-09-14T22:17:08.415Z" }, + { url = "https://files.pythonhosted.org/packages/08/b3/206883dd25b8d1591a1caa44b54c2aad84badccf2f1de9e2d60a446f9a25/zstandard-0.25.0-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:aaf21ba8fb76d102b696781bddaa0954b782536446083ae3fdaa6f16b25a1c4b", size = 5576659, upload-time = "2025-09-14T22:17:10.164Z" }, + { url = "https://files.pythonhosted.org/packages/9d/31/76c0779101453e6c117b0ff22565865c54f48f8bd807df2b00c2c404b8e0/zstandard-0.25.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:1869da9571d5e94a85a5e8d57e4e8807b175c9e4a6294e3b66fa4efb074d90f6", size = 4953933, upload-time = "2025-09-14T22:17:11.857Z" }, + { url = "https://files.pythonhosted.org/packages/18/e1/97680c664a1bf9a247a280a053d98e251424af51f1b196c6d52f117c9720/zstandard-0.25.0-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:809c5bcb2c67cd0ed81e9229d227d4ca28f82d0f778fc5fea624a9def3963f91", size = 5268008, upload-time = "2025-09-14T22:17:13.627Z" }, + { url = "https://files.pythonhosted.org/packages/1e/73/316e4010de585ac798e154e88fd81bb16afc5c5cb1a72eeb16dd37e8024a/zstandard-0.25.0-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:f27662e4f7dbf9f9c12391cb37b4c4c3cb90ffbd3b1fb9284dadbbb8935fa708", size = 5433517, upload-time = "2025-09-14T22:17:16.103Z" }, + { url = "https://files.pythonhosted.org/packages/5b/60/dd0f8cfa8129c5a0ce3ea6b7f70be5b33d2618013a161e1ff26c2b39787c/zstandard-0.25.0-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:99c0c846e6e61718715a3c9437ccc625de26593fea60189567f0118dc9db7512", size = 5814292, upload-time = "2025-09-14T22:17:17.827Z" }, + { url = "https://files.pythonhosted.org/packages/fc/5f/75aafd4b9d11b5407b641b8e41a57864097663699f23e9ad4dbb91dc6bfe/zstandard-0.25.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:474d2596a2dbc241a556e965fb76002c1ce655445e4e3bf38e5477d413165ffa", size = 5360237, upload-time = "2025-09-14T22:17:19.954Z" }, + { url = "https://files.pythonhosted.org/packages/ff/8d/0309daffea4fcac7981021dbf21cdb2e3427a9e76bafbcdbdf5392ff99a4/zstandard-0.25.0-cp312-cp312-win32.whl", hash = "sha256:23ebc8f17a03133b4426bcc04aabd68f8236eb78c3760f12783385171b0fd8bd", size = 436922, upload-time = "2025-09-14T22:17:24.398Z" }, + { url = "https://files.pythonhosted.org/packages/79/3b/fa54d9015f945330510cb5d0b0501e8253c127cca7ebe8ba46a965df18c5/zstandard-0.25.0-cp312-cp312-win_amd64.whl", hash = "sha256:ffef5a74088f1e09947aecf91011136665152e0b4b359c42be3373897fb39b01", size = 506276, upload-time = "2025-09-14T22:17:21.429Z" }, + { url = "https://files.pythonhosted.org/packages/ea/6b/8b51697e5319b1f9ac71087b0af9a40d8a6288ff8025c36486e0c12abcc4/zstandard-0.25.0-cp312-cp312-win_arm64.whl", hash = "sha256:181eb40e0b6a29b3cd2849f825e0fa34397f649170673d385f3598ae17cca2e9", size = 462679, upload-time = "2025-09-14T22:17:23.147Z" }, + { url = "https://files.pythonhosted.org/packages/35/0b/8df9c4ad06af91d39e94fa96cc010a24ac4ef1378d3efab9223cc8593d40/zstandard-0.25.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:ec996f12524f88e151c339688c3897194821d7f03081ab35d31d1e12ec975e94", size = 795735, upload-time = "2025-09-14T22:17:26.042Z" }, + { url = "https://files.pythonhosted.org/packages/3f/06/9ae96a3e5dcfd119377ba33d4c42a7d89da1efabd5cb3e366b156c45ff4d/zstandard-0.25.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:a1a4ae2dec3993a32247995bdfe367fc3266da832d82f8438c8570f989753de1", size = 640440, upload-time = "2025-09-14T22:17:27.366Z" }, + { url = "https://files.pythonhosted.org/packages/d9/14/933d27204c2bd404229c69f445862454dcc101cd69ef8c6068f15aaec12c/zstandard-0.25.0-cp313-cp313-manylinux2010_i686.manylinux2014_i686.manylinux_2_12_i686.manylinux_2_17_i686.whl", hash = "sha256:e96594a5537722fdfb79951672a2a63aec5ebfb823e7560586f7484819f2a08f", size = 5343070, upload-time = "2025-09-14T22:17:28.896Z" }, + { url = "https://files.pythonhosted.org/packages/6d/db/ddb11011826ed7db9d0e485d13df79b58586bfdec56e5c84a928a9a78c1c/zstandard-0.25.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:bfc4e20784722098822e3eee42b8e576b379ed72cca4a7cb856ae733e62192ea", size = 5063001, upload-time = "2025-09-14T22:17:31.044Z" }, + { url = "https://files.pythonhosted.org/packages/db/00/87466ea3f99599d02a5238498b87bf84a6348290c19571051839ca943777/zstandard-0.25.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:457ed498fc58cdc12fc48f7950e02740d4f7ae9493dd4ab2168a47c93c31298e", size = 5394120, upload-time = "2025-09-14T22:17:32.711Z" }, + { url = "https://files.pythonhosted.org/packages/2b/95/fc5531d9c618a679a20ff6c29e2b3ef1d1f4ad66c5e161ae6ff847d102a9/zstandard-0.25.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:fd7a5004eb1980d3cefe26b2685bcb0b17989901a70a1040d1ac86f1d898c551", size = 5451230, upload-time = "2025-09-14T22:17:34.41Z" }, + { url = "https://files.pythonhosted.org/packages/63/4b/e3678b4e776db00f9f7b2fe58e547e8928ef32727d7a1ff01dea010f3f13/zstandard-0.25.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:8e735494da3db08694d26480f1493ad2cf86e99bdd53e8e9771b2752a5c0246a", size = 5547173, upload-time = "2025-09-14T22:17:36.084Z" }, + { url = "https://files.pythonhosted.org/packages/4e/d5/ba05ed95c6b8ec30bd468dfeab20589f2cf709b5c940483e31d991f2ca58/zstandard-0.25.0-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:3a39c94ad7866160a4a46d772e43311a743c316942037671beb264e395bdd611", size = 5046736, upload-time = "2025-09-14T22:17:37.891Z" }, + { url = "https://files.pythonhosted.org/packages/50/d5/870aa06b3a76c73eced65c044b92286a3c4e00554005ff51962deef28e28/zstandard-0.25.0-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:172de1f06947577d3a3005416977cce6168f2261284c02080e7ad0185faeced3", size = 5576368, upload-time = "2025-09-14T22:17:40.206Z" }, + { url = "https://files.pythonhosted.org/packages/5d/35/398dc2ffc89d304d59bc12f0fdd931b4ce455bddf7038a0a67733a25f550/zstandard-0.25.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:3c83b0188c852a47cd13ef3bf9209fb0a77fa5374958b8c53aaa699398c6bd7b", size = 4954022, upload-time = "2025-09-14T22:17:41.879Z" }, + { url = "https://files.pythonhosted.org/packages/9a/5c/36ba1e5507d56d2213202ec2b05e8541734af5f2ce378c5d1ceaf4d88dc4/zstandard-0.25.0-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:1673b7199bbe763365b81a4f3252b8e80f44c9e323fc42940dc8843bfeaf9851", size = 5267889, upload-time = "2025-09-14T22:17:43.577Z" }, + { url = "https://files.pythonhosted.org/packages/70/e8/2ec6b6fb7358b2ec0113ae202647ca7c0e9d15b61c005ae5225ad0995df5/zstandard-0.25.0-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:0be7622c37c183406f3dbf0cba104118eb16a4ea7359eeb5752f0794882fc250", size = 5433952, upload-time = "2025-09-14T22:17:45.271Z" }, + { url = "https://files.pythonhosted.org/packages/7b/01/b5f4d4dbc59ef193e870495c6f1275f5b2928e01ff5a81fecb22a06e22fb/zstandard-0.25.0-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:5f5e4c2a23ca271c218ac025bd7d635597048b366d6f31f420aaeb715239fc98", size = 5814054, upload-time = "2025-09-14T22:17:47.08Z" }, + { url = "https://files.pythonhosted.org/packages/b2/e5/fbd822d5c6f427cf158316d012c5a12f233473c2f9c5fe5ab1ae5d21f3d8/zstandard-0.25.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:4f187a0bb61b35119d1926aee039524d1f93aaf38a9916b8c4b78ac8514a0aaf", size = 5360113, upload-time = "2025-09-14T22:17:48.893Z" }, + { url = "https://files.pythonhosted.org/packages/8e/e0/69a553d2047f9a2c7347caa225bb3a63b6d7704ad74610cb7823baa08ed7/zstandard-0.25.0-cp313-cp313-win32.whl", hash = "sha256:7030defa83eef3e51ff26f0b7bfb229f0204b66fe18e04359ce3474ac33cbc09", size = 436936, upload-time = "2025-09-14T22:17:52.658Z" }, + { url = "https://files.pythonhosted.org/packages/d9/82/b9c06c870f3bd8767c201f1edbdf9e8dc34be5b0fbc5682c4f80fe948475/zstandard-0.25.0-cp313-cp313-win_amd64.whl", hash = "sha256:1f830a0dac88719af0ae43b8b2d6aef487d437036468ef3c2ea59c51f9d55fd5", size = 506232, upload-time = "2025-09-14T22:17:50.402Z" }, + { url = "https://files.pythonhosted.org/packages/d4/57/60c3c01243bb81d381c9916e2a6d9e149ab8627c0c7d7abb2d73384b3c0c/zstandard-0.25.0-cp313-cp313-win_arm64.whl", hash = "sha256:85304a43f4d513f5464ceb938aa02c1e78c2943b29f44a750b48b25ac999a049", size = 462671, upload-time = "2025-09-14T22:17:51.533Z" }, +] + +[[package]] +name = "zstd" +version = "1.5.7.2" +source = { registry = "https://pypi.org/simple" } +sdist = { url = "https://files.pythonhosted.org/packages/0f/78/9a476e09c825304df47b98be80d1ffe223733b03550af71325415028f615/zstd-1.5.7.2.tar.gz", hash = "sha256:6d8684c69009be49e1b18ec251a5eb0d7e24f93624990a8a124a1da66a92fc8a", size = 670481, upload-time = "2025-06-23T12:36:08.131Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/18/76/825a002361bcfb4444d8ff0bd5c75d60e449158c5a9cd3b884971b3ecd1e/zstd-1.5.7.2-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:d3f14c5c405ea353b68fe105236780494eb67c756ecd346fd295498f5eab6d24", size = 269695, upload-time = "2025-06-23T12:54:29.916Z" }, + { url = "https://files.pythonhosted.org/packages/b9/0a/a8c936edc431217186085276a37eba8e52c9bd4cd3025b38403baa2466a4/zstd-1.5.7.2-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:07d2061df22a3efc06453089e6e8b96e58f5bb7a0c4074dcfd0b0ce243ddde72", size = 228243, upload-time = "2025-06-23T12:54:30.942Z" }, + { url = "https://files.pythonhosted.org/packages/ae/24/e81d1561ab3e32be2370de82e13d3c50b68a9fed6977b4d7d596d3ddd1b9/zstd-1.5.7.2-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:27e55aa2043ba7d8a08aba0978c652d4d5857338a8188aa84522569f3586c7bb", size = 1536535, upload-time = "2025-06-23T13:53:22.123Z" }, + { url = "https://files.pythonhosted.org/packages/8b/9d/60d956dc3f457620997906bc4c220fad12b2ad1a3a5e2224d3b5dbf0a28e/zstd-1.5.7.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:8e97933addfd71ea9608306f18dc18e7d2a5e64212ba2bb9a4ccb6d714f9f280", size = 1616160, upload-time = "2025-06-23T13:53:16.221Z" }, + { url = "https://files.pythonhosted.org/packages/71/6a/49fc94a39f44994c5db20259d44a849e558af5232072580a7614cdb2058d/zstd-1.5.7.2-cp310-cp310-manylinux_2_4_i686.whl", hash = "sha256:27e2ed58b64001c9ef0a8e028625477f1a6ed4ca949412ff6548544945cc59c2", size = 322186, upload-time = "2025-06-23T12:41:36.574Z" }, + { url = "https://files.pythonhosted.org/packages/17/20/e1e06a7f39c7eb27a1fe1c0281970c840fcde539a2f8ad99bb3155dbf3ad/zstd-1.5.7.2-cp310-cp310-manylinux_2_4_x86_64.whl", hash = "sha256:92f072819fc0c7e8445f51a232c9ad76642027c069d2f36470cdb5e663839cdb", size = 302736, upload-time = "2025-06-23T13:05:04.168Z" }, + { url = "https://files.pythonhosted.org/packages/a6/c0/86bb2d8e556062edf663f8d08c315418fefb80cae7c786cf39957e10455f/zstd-1.5.7.2-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_24_i686.whl", hash = "sha256:2a653cdd2c52d60c28e519d44bde8d759f2c1837f0ff8e8e1b0045ca62fcf70e", size = 1522689, upload-time = "2025-06-23T13:53:17.761Z" }, + { url = "https://files.pythonhosted.org/packages/80/24/60a125d82d64b4d2a823f490904d8b5861117771237e34bb02e2cc311572/zstd-1.5.7.2-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:047803d87d910f4905f48d99aeff1e0539ec2e4f4bf17d077701b5d0b2392a95", size = 2098532, upload-time = "2025-06-23T13:53:11.938Z" }, + { url = "https://files.pythonhosted.org/packages/09/eb/3274ea05a788bbdb90e3de90bfa27dc9113ee0114011d28bfad6d9fd34d7/zstd-1.5.7.2-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:0d8c1dc947e5ccea3bd81043080213685faf1d43886c27c51851fabf325f05c0", size = 2112079, upload-time = "2025-06-23T13:53:19.833Z" }, + { url = "https://files.pythonhosted.org/packages/93/c6/fa6898d55f8313e9649e2853ea3fede8b7301a5a1c40d8aa920252c31a52/zstd-1.5.7.2-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:8291d393321fac30604c6bbf40067103fee315aa476647a5eaecf877ee53496f", size = 2109450, upload-time = "2025-06-23T13:53:13.806Z" }, + { url = "https://files.pythonhosted.org/packages/ad/56/4180cd24fdc468f4f0beae3d4f5e8690a16995a561b1926dfdde223ecc3d/zstd-1.5.7.2-cp310-cp310-win32.whl", hash = "sha256:6922ceac5f2d60bb57a7875168c8aa442477b83e8951f2206cf1e9be788b0a6e", size = 149448, upload-time = "2025-06-23T13:09:43.678Z" }, + { url = "https://files.pythonhosted.org/packages/d5/55/3b315dc894b9726c16e5d58f48a618e6e2670e93c0eacc03fd30330444ee/zstd-1.5.7.2-cp310-cp310-win_amd64.whl", hash = "sha256:346d1e4774d89a77d67fc70d53964bfca57c0abecfd885a4e00f87fd7c71e074", size = 166591, upload-time = "2025-06-23T13:09:44.85Z" }, + { url = "https://files.pythonhosted.org/packages/43/2a/0885f6f1921ec1ef4a8f8ab29ab0a335cc867abe4c7aaa4e5031435a32a5/zstd-1.5.7.2-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:f799c1e9900ad77e7a3d994b9b5146d7cfd1cbd1b61c3db53a697bf21ffcc57b", size = 269702, upload-time = "2025-06-23T12:50:11.695Z" }, + { url = "https://files.pythonhosted.org/packages/05/e6/629cf6b77e47fc7149f5724fb4853c48edcdeb10d8c64e391d7026cb10e1/zstd-1.5.7.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:1ff4c667f29101566a7b71f06bbd677a63192818396003354131f586383db042", size = 228145, upload-time = "2025-06-23T12:50:10.411Z" }, + { url = "https://files.pythonhosted.org/packages/c4/b8/9ddefd4670bfe9328ca6657ad335eb8d9c657466247e234a579818b6b0b9/zstd-1.5.7.2-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:8526a32fa9f67b07fd09e62474e345f8ca1daf3e37a41137643d45bd1bc90773", size = 1536530, upload-time = "2025-06-23T13:51:38.853Z" }, + { url = "https://files.pythonhosted.org/packages/d1/6a/1bb836c18760dc1e28ca7a9706016e482ebdea633b980d8505dbb65e18f8/zstd-1.5.7.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:2cec2472760d48a7a3445beaba509d3f7850e200fed65db15a1a66e315baec6a", size = 1616141, upload-time = "2025-06-23T13:51:34.152Z" }, + { url = "https://files.pythonhosted.org/packages/b5/7a/bb6c6e2cb2a066e347dc27d45d5205058b69d6c8b8d4ae2ee7d6b91c64a5/zstd-1.5.7.2-cp311-cp311-manylinux_2_4_i686.whl", hash = "sha256:a200c479ee1bb661bc45518e016a1fdc215a1d8f7e4bf6c7de0af254976cfdf6", size = 322188, upload-time = "2025-06-23T13:01:48.704Z" }, + { url = "https://files.pythonhosted.org/packages/5a/4f/cf0669c8a89fdcc91814bf92bd05cc363d5d12a79b656418c0add6f2d266/zstd-1.5.7.2-cp311-cp311-manylinux_2_4_x86_64.whl", hash = "sha256:f5d159e57a13147aa8293c0f14803a75e9039fd8afdf6cf1c8c2289fb4d2333a", size = 302736, upload-time = "2025-06-23T13:05:33.649Z" }, + { url = "https://files.pythonhosted.org/packages/be/bc/e5f8b7f61826323e39e099db1eb5c0e09b18315df1b1ff778f7ae9aadcac/zstd-1.5.7.2-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_24_i686.whl", hash = "sha256:7206934a2bd390080e972a1fed5a897e184dfd71dbb54e978dc11c6b295e1806", size = 1522687, upload-time = "2025-06-23T13:51:35.494Z" }, + { url = "https://files.pythonhosted.org/packages/d5/8c/7660a949a020ac9d02b3166a25dd1c12144572d77b11ae92a31d341016da/zstd-1.5.7.2-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:7e0027b20f296d1c9a8e85b8436834cf46560240a29d623aa8eaa8911832eb58", size = 2098794, upload-time = "2025-06-23T13:51:37.219Z" }, + { url = "https://files.pythonhosted.org/packages/bc/b2/730c811a78d670104d40c7f08cc8092577cdff870cba42b3158f20fceb57/zstd-1.5.7.2-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:d6b17e5581dd1a13437079bd62838d2635db8eb8aca9c0e9251faa5d4d40a6d7", size = 2112266, upload-time = "2025-06-23T13:51:31.258Z" }, + { url = "https://files.pythonhosted.org/packages/44/74/2c16e1632094db36c8920d4c13b8e2e843024d548ae26888c2d22af6a676/zstd-1.5.7.2-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:b13285c99cc710f60dd270785ec75233018870a1831f5655d862745470a0ca29", size = 2109465, upload-time = "2025-06-23T13:51:32.884Z" }, + { url = "https://files.pythonhosted.org/packages/58/6e/b9c9a834769d96cab2122da1be8c8c700d3f76be796d2b7516e85d2eca0e/zstd-1.5.7.2-cp311-cp311-win32.whl", hash = "sha256:cdb5ec80da299f63f8aeccec0bff3247e96252d4c8442876363ff1b438d8049b", size = 149448, upload-time = "2025-06-23T13:06:21.144Z" }, + { url = "https://files.pythonhosted.org/packages/47/b7/fc22ad6292a32d7676ab815de3a23573beac3679e8abd9914288d1496ceb/zstd-1.5.7.2-cp311-cp311-win_amd64.whl", hash = "sha256:4f6861c8edceb25fda37cdaf422fc5f15dcc88ced37c6a5b3c9011eda51aa218", size = 166592, upload-time = "2025-06-23T13:06:22.126Z" }, + { url = "https://files.pythonhosted.org/packages/45/14/096bb77f3e5ef525b452cd6294da33de7f8a8c9647ba78293378fbb0a7ce/zstd-1.5.7.2-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:d2ebe3e60dbace52525fa7aa604479e231dc3e4fcc76d0b4c54d8abce5e58734", size = 269408, upload-time = "2025-06-23T13:11:46.492Z" }, + { url = "https://files.pythonhosted.org/packages/08/b8/2bc2590a34c733ea0570f366e6ad7d889d05c7825bd3ccab01f36ece71c6/zstd-1.5.7.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ef201b6f7d3a6751d85cc52f9e6198d4d870e83d490172016b64a6dd654a9583", size = 228188, upload-time = "2025-06-23T13:11:47.539Z" }, + { url = "https://files.pythonhosted.org/packages/b7/80/6252de3a70cfd7767718ad476893f1c7dc129f942cc7ed0322e3137c03d9/zstd-1.5.7.2-cp312-cp312-manylinux_2_14_x86_64.whl", hash = "sha256:ac7bdfedda51b1fcdcf0ab69267d01256fc97ddf666ce894fde0fae9f3630eac", size = 302720, upload-time = "2025-06-23T12:40:11.522Z" }, + { url = "https://files.pythonhosted.org/packages/af/b6/af908387814b99172d3aea6aeb24b19583aadfa45f6021e5e2a0d6d8e99a/zstd-1.5.7.2-cp312-cp312-manylinux_2_4_i686.whl", hash = "sha256:b835405cc4080b378e45029f2fe500e408d1eaedfba7dd7402aba27af16955f9", size = 322237, upload-time = "2025-06-23T13:17:35.482Z" }, + { url = "https://files.pythonhosted.org/packages/ed/d7/ab9142e002a7eaa451cb4bb37a74c390c489ba8ae75ade543840496eda04/zstd-1.5.7.2-cp312-cp312-win32.whl", hash = "sha256:e4cf97bb97ed6dbb62d139d68fd42fa1af51fd26fd178c501f7b62040e897c50", size = 149453, upload-time = "2025-06-23T13:13:02.786Z" }, + { url = "https://files.pythonhosted.org/packages/3e/c7/c182ea7bc283f591e3f3c5f0f239e7a92c9bc1f626642ae2c4dfbe51d6f2/zstd-1.5.7.2-cp312-cp312-win_amd64.whl", hash = "sha256:55e2edc4560a5cf8ee9908595e90a15b1f47536ea9aad4b2889f0e6165890a38", size = 166628, upload-time = "2025-06-23T13:13:03.745Z" }, + { url = "https://files.pythonhosted.org/packages/a1/63/0d392a8ec2231dee9fc2290faea7a6642584686720d6b77899ad8b12e35a/zstd-1.5.7.2-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:6e684e27064b6550aa2e7dc85d171ea1b62cb5930a2c99b3df9b30bf620b5c06", size = 269438, upload-time = "2025-06-23T12:57:52.507Z" }, + { url = "https://files.pythonhosted.org/packages/be/1f/85aae095f92811bed3d2944bbed971fe07ec1dd2d82c9eb1395d69d2123c/zstd-1.5.7.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:fd6262788a98807d6b2befd065d127db177c1cd76bb8e536e0dded419eb7c7fb", size = 228179, upload-time = "2025-06-23T12:57:51.031Z" }, + { url = "https://files.pythonhosted.org/packages/31/4e/547949993ea347ac44f5908262ebe6e85edfa7b11a5df136319789be731d/zstd-1.5.7.2-cp313-cp313-manylinux_2_14_x86_64.whl", hash = "sha256:53948be45f286a1b25c07a6aa2aca5c902208eb3df9fe36cf891efa0394c8b71", size = 302763, upload-time = "2025-06-23T12:51:51.615Z" }, + { url = "https://files.pythonhosted.org/packages/25/ca/4a6882846e3049be249031f825251a9229ecad471e18e7fd27974540549c/zstd-1.5.7.2-cp313-cp313-win32.whl", hash = "sha256:edf816c218e5978033b7bb47dcb453dfb71038cb8a9bf4877f3f823e74d58174", size = 149452, upload-time = "2025-06-23T12:57:32.116Z" }, + { url = "https://files.pythonhosted.org/packages/e7/aa/89339605864c9803e4738f176932a6c9f1ad99d03c03ef2cb0634ddca680/zstd-1.5.7.2-cp313-cp313-win_amd64.whl", hash = "sha256:eea9bddf06f3f5e1e450fd647665c86df048a45e8b956d53522387c1dff41b7a", size = 166625, upload-time = "2025-06-23T12:57:33.334Z" }, + { url = "https://files.pythonhosted.org/packages/07/e9/501291a2f9b300b2c73dcc6d086df778e895e71573df9575def54d9dbab2/zstd-1.5.7.2-cp313-cp313t-manylinux_2_14_x86_64.whl", hash = "sha256:1d71f9f92b3abe18b06b5f0aefa5b9c42112beef3bff27e36028d147cb4426a6", size = 302906, upload-time = "2025-06-23T13:21:13.331Z" }, + { url = "https://files.pythonhosted.org/packages/56/b9/179ad7330e6ea33ce655b671ee6f961fbbf4714996aa7c5180ef08d1616a/zstd-1.5.7.2-pp310-pypy310_pp73-macosx_10_15_x86_64.whl", hash = "sha256:426e5c6b7b3e2401b734bfd08050b071e17c15df5e3b31e63651d1fd9ba4c751", size = 262933, upload-time = "2025-06-23T13:03:44.34Z" }, + { url = "https://files.pythonhosted.org/packages/56/d9/f9b73abd3ccce44468ccbdc1ad48b8adb6eaffeacc556472a6e42331b2c3/zstd-1.5.7.2-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:53375b23f2f39359ade944169bbd88f8895eed91290ee608ccbc28810ac360ba", size = 218516, upload-time = "2025-06-23T13:19:05.55Z" }, + { url = "https://files.pythonhosted.org/packages/ca/3b/f6f6c4d009b5945bbe043e576a61a8adc71eba5e9adc7b1872c080508b26/zstd-1.5.7.2-pp310-pypy310_pp73-manylinux_2_14_x86_64.whl", hash = "sha256:1b301b2f9dbb0e848093127fb10cbe6334a697dc3aea6740f0bb726450ee9a34", size = 315543, upload-time = "2025-06-23T13:20:47.275Z" }, + { url = "https://files.pythonhosted.org/packages/7d/39/7edf76a442621d76dc18ee82dcce82f8a0df2fbc7b962ade42a833e30a32/zstd-1.5.7.2-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:5414c9ae27069ab3ec8420fe8d005cb1b227806cbc874a7b4c73a96b4697a633", size = 166648, upload-time = "2025-06-23T13:11:55.47Z" }, + { url = "https://files.pythonhosted.org/packages/cd/c9/a6495a7bf168a78f0a0c01d61d830ebfb401315a64fd1ae8d725c458114c/zstd-1.5.7.2-pp311-pypy311_pp73-manylinux_2_14_x86_64.whl", hash = "sha256:5fb2ff5718fe89181223c23ce7308bd0b4a427239379e2566294da805d8df68a", size = 315542, upload-time = "2025-06-23T12:39:27.598Z" }, ]