From f6552d16d51448862ab3747d6c9957da5f11d997 Mon Sep 17 00:00:00 2001 From: HugoPBrito Date: Mon, 30 Dec 2024 15:40:26 +0000 Subject: [PATCH] feat: added check logic and metadata --- .../__init__.py | 0 ...ans_packages_vulnerabilities.metadata.json | 30 +++++++++++++++ ...pository_scans_packages_vulnerabilities.py | 37 +++++++++++++++++++ .../services/repository/repository_service.py | 13 +++++++ 4 files changed, 80 insertions(+) create mode 100644 prowler/providers/github/services/repository/repository_scans_packages_vulnerabilities/__init__.py create mode 100644 prowler/providers/github/services/repository/repository_scans_packages_vulnerabilities/repository_scans_packages_vulnerabilities.metadata.json create mode 100644 prowler/providers/github/services/repository/repository_scans_packages_vulnerabilities/repository_scans_packages_vulnerabilities.py diff --git a/prowler/providers/github/services/repository/repository_scans_packages_vulnerabilities/__init__.py b/prowler/providers/github/services/repository/repository_scans_packages_vulnerabilities/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/github/services/repository/repository_scans_packages_vulnerabilities/repository_scans_packages_vulnerabilities.metadata.json b/prowler/providers/github/services/repository/repository_scans_packages_vulnerabilities/repository_scans_packages_vulnerabilities.metadata.json new file mode 100644 index 0000000000..22e3461ff0 --- /dev/null +++ b/prowler/providers/github/services/repository/repository_scans_packages_vulnerabilities/repository_scans_packages_vulnerabilities.metadata.json @@ -0,0 +1,30 @@ +{ + "Provider": "github", + "CheckID": "repository_scans_packages_vulnerabilities", + "CheckTitle": "Check if repositories scan packages for vulnerabilities", + "CheckType": [], + "ServiceName": "repository", + "SubServiceName": "", + "ResourceIdTemplate": "github:user-id:repository/repository-name", + "Severity": "high", + "ResourceType": "Other", + "Description": "Ensure that repositories scan packages for vulnerabilities to detect and remediate open-source vulnerabilities.", + "Risk": "Open-source vulnerabilities may exist in or be discovered for the packages an organization uses. These vulnerabilities can be exploited by attackers, potentially compromising the security of applications. Without proper monitoring, vulnerabilities affecting dependencies may go unnoticed, increasing the risk of breaches or failures in production environments.", + "RelatedUrl": "https://docs.github.com/en/code-security/dependabot/working-with-dependabot", + "Remediation": { + "Code": { + "CLI": "", + "NativeIaC": "", + "Other": "", + "Terraform": "" + }, + "Recommendation": { + "Text": "Implement and enforce tools to detect, monitor, and remediate open-source vulnerabilities. Enable GitHub's Dependabot alerts to track known issues, and consider integrating additional solutions to ensure comprehensive identification of vulnerabilities. This proactive approach mitigates security risks and helps maintain application stability and integrity.", + "Url": "https://docs.github.com/en/code-security/getting-started/dependabot-quickstart-guide" + } + }, + "Categories": [], + "DependsOn": [], + "RelatedTo": [], + "Notes": "" +} diff --git a/prowler/providers/github/services/repository/repository_scans_packages_vulnerabilities/repository_scans_packages_vulnerabilities.py b/prowler/providers/github/services/repository/repository_scans_packages_vulnerabilities/repository_scans_packages_vulnerabilities.py new file mode 100644 index 0000000000..c73ea4b588 --- /dev/null +++ b/prowler/providers/github/services/repository/repository_scans_packages_vulnerabilities/repository_scans_packages_vulnerabilities.py @@ -0,0 +1,37 @@ +from typing import List + +from prowler.lib.check.models import Check, Check_Report_Github +from prowler.providers.github.services.repository.repository_client import ( + repository_client, +) + + +class repository_scans_packages_vulnerabilities(Check): + """Check if a repository scans packages for vulnerabilities + + This class verifies whether each public repository scans packages for vulnerabilities. + """ + + def execute(self) -> List[Check_Report_Github]: + """Execute the Github Repository Scans Packages Vulnerabilities check + + Iterates over all repositories and checks if they scan packages for vulnerabilities. + + Returns: + List[Check_Report_Github]: A list of reports for each repository + """ + findings = [] + for repo in repository_client.repositories.values(): + report = Check_Report_Github(self.metadata()) + report.resource_id = repo.id + report.resource_name = repo.name + report.status = "FAIL" + report.status_extended = f"Repository {repo.name} does not scan vulnerabilities in used packages." + + if repo.dependabot_enabled: + report.status = "PASS" + report.status_extended = f"Repository {repo.name} does scan vulnerabilities in used packages." + + findings.append(report) + + return findings diff --git a/prowler/providers/github/services/repository/repository_service.py b/prowler/providers/github/services/repository/repository_service.py index f77f48b4db..9b75ec469b 100644 --- a/prowler/providers/github/services/repository/repository_service.py +++ b/prowler/providers/github/services/repository/repository_service.py @@ -35,6 +35,17 @@ class Repository(GithubService): else False ) + dependabot_status = False + try: + dependabot_status = ( + repo.security_and_analysis.dependabot_security_updates.status + == "enabled" + ) + except Exception as e: + logger.warning( + f"Could not determine dependabot status for repo {repo.name}: {e}" + ) + branch_protection = None try: branch = repo.get_branch(default_branch) @@ -89,6 +100,7 @@ class Repository(GithubService): securitymd=securitymd_exists, default_branch_protection=branch_protection, delete_branch_on_merge=delete_branch_on_merge, + dependabot_enabled=dependabot_status, ) except Exception as error: @@ -122,3 +134,4 @@ class Repo(BaseModel): default_branch_protection: Optional[Protection] securitymd: bool = False delete_branch_on_merge: bool = False + dependabot_enabled: bool = False