Andoni A.
876702fd22
feat(image): add --registry-list flag for image discovery
...
Add --registry-list flag that enumerates registry repositories and tags,
then prints a structured listing and exits without scanning. This helps
users discover available images before building --image-filter or
--tag-filter regexes.
2026-02-17 07:44:41 +01:00
Andoni A.
326def4a17
fix(image): handle Basic auth challenge and pre-encoded ECR credentials
...
- Detect Basic auth challenges (non-Bearer) in _ensure_auth()
- Decode base64-wrapped credentials from aws ecr get-authorization-token
- Add unit tests for credential resolution and Basic auth flow
2026-02-16 17:50:05 +01:00
Andoni A.
aa284b8b24
test(image): add comprehensive registry scan mode unit tests
...
69 tests covering:
- Factory auto-detection (OCI, Docker Hub, ECR URL patterns)
- OCI adapter (auth flows, pagination, retry, error handling)
- Docker Hub adapter (namespace extraction, Hub API, token exchange)
- Argument validation (registry flags, Docker Hub namespace)
- Provider integration (enumeration, filtering, max-images, dedup)
2026-02-16 15:42:02 +01:00
Andoni A.
ace36fe76e
feat(image): add registry scan mode with OCI, Docker Hub, and ECR support
...
Add pluggable registry adapter pattern for enumerating and scanning all
container images in a private registry. Supports:
- Generic OCI registries (Harbor, GitLab, JFrog) via /v2/_catalog
- Docker Hub via Hub REST API with namespace-based enumeration
- AWS ECR via standard OCI endpoints with ECR auth token
New CLI flags: --registry, --image-filter, --tag-filter, --max-images,
--registry-insecure
2026-02-16 15:35:55 +01:00
Andoni A.
6b0a139361
Merge remote-tracking branch 'origin/master' into feat/PROWLER-939-stage-2-registry-auth
...
# Conflicts:
# prowler/CHANGELOG.md
# prowler/lib/check/models.py
# prowler/providers/common/provider.py
# prowler/providers/image/exceptions/exceptions.py
# prowler/providers/image/image_provider.py
# tests/providers/image/image_provider_test.py
2026-02-13 13:09:51 +01:00
Andoni A.
0589721505
fix(image): include missing merge changes from stage-1 and docs branches
...
The pre-commit hook stash/restore cycle during the first merge caused
some auto-merged changes to be excluded from the merge commits. This
commit includes the remaining changes: error code renumbering (9000→11000
range), input validation, image config scanners, and docs branch updates.
2026-02-12 22:38:11 +01:00
Andoni Alonso
aa7490aab4
feat(image): add container image provider for CLI scanning ( #9984 )
2026-02-12 16:36:48 +01:00
Andoni A.
f93cbbdb38
Merge remote-tracking branch 'origin/feat/PROWLER-941-stage-2-b-image-provider-cli-docs' into feat/PROWLER-939-stage-2-registry-auth
...
# Conflicts:
# prowler/CHANGELOG.md
# skills/prowler-attack-paths-query/SKILL.md
# ui/CHANGELOG.md
# ui/components/scans/table/scans/scans-table-with-polling.tsx
2026-02-12 16:34:29 +01:00
Andoni A.
51c5fda202
Merge remote-tracking branch 'origin/master' into feat/PROWLER-941-stage-2-b-image-provider-cli-docs
2026-02-12 12:04:02 +01:00
Andoni Alonso and HugoPBrito
fce1e4f3d2
feat(m365): add defender_safe_attachments_policy_enabled security check ( #9833 )
...
Co-authored-by: HugoPBrito <hugopbrit@gmail.com >
2026-02-11 15:42:11 +01:00
Andoni Alonso and HugoPBrito
5d490fa185
feat(m365): add defender_atp_safe_attachments_and_docs_configured security check ( #9837 )
...
Co-authored-by: HugoPBrito <hugopbrit@gmail.com >
2026-02-11 15:21:06 +01:00
Andoni Alonso and HugoPBrito
c5f7e80b20
feat(m365): add defender_safelinks_policy_enabled security check ( #9832 )
...
Co-authored-by: HugoPBrito <hugopbrit@gmail.com >
2026-02-11 13:03:32 +01:00
Andoni Alonso
dde42b6a84
fix(github): combine --repository and --organization flags for scan scoping ( #10001 )
2026-02-10 14:34:59 +01:00
Andoni A.
43ad2f705c
feat(image): add --image-config-scanners support for Trivy
...
- Add CLI argument for image config scanners (misconfig, secret)
- Add validation and ImageInvalidConfigScannerError exception
- Append --image-config-scanners to Trivy command when set
- Add tests for defaults, validation, and command construction
2026-02-09 15:55:15 +01:00
Andoni A.
132be2c728
fix(image): add input validation and file size limits
...
- Add IMAGE to Provider enum for runtime routing
- Validate image names against shell metacharacters and OCI format
- Enforce max line count and name length on image list files
- Add tests for name validation and file size limits
2026-02-09 14:43:11 +01:00
Andoni A.
74ad1186cf
fix(image): harden input validation and fix traceback edge case
...
- Add timeout, scanner, and severity input validation with custom exceptions
- Fix potential None dereference on error.__traceback__
- Modernize typing imports (List → list)
- Remove PoC label from CLI help text
- Update CHANGELOG entry with PR reference
2026-02-09 14:00:42 +01:00
Andoni A.
cc1197d632
fix(image): add image provider to parser test usage string and mock
...
The hardcoded usage string and mock_get_available_providers in
parser_test.py did not include the image provider, causing 7 test
failures in CI.
2026-02-09 10:07:46 +01:00
Andoni A.
f7adbc2dcf
feat(image): add docker login and pull for private registry authentication
...
Trivy's remote source cannot authenticate against Docker Hub (and some
other registries) even after docker login. This adds a docker login +
docker pull flow before scanning so Trivy can access private images
from the local Docker daemon.
- Add _docker_login, _docker_pull, _docker_logout, cleanup methods
- Add _extract_registry to determine registry from image reference
- Wrap run() in try/finally to ensure cleanup on success or error
- Wire registry credentials from CLI args to ImageProvider
- Add ImageDockerLoginError and ImageDockerNotFoundError exceptions
2026-02-06 15:08:42 +01:00
Andoni A.
31d9a23225
feat(image): add container image provider for CLI scanning
...
Add a new Image provider that uses Trivy for container image vulnerability
and secret scanning, integrated into the Prowler CLI.
- ImageProvider class with Trivy integration for vuln/secret/misconfig scanning
- CLI support via `prowler image -I <image>` with severity filters, timeout,
ignore-unfixed, and image-list-file options
- CheckReportImage model for image-specific findings
- Custom exceptions (9000-9005) with clear remediation messages
- Error handling for Trivy failures (non-zero exit, binary not found)
- Batch processing of findings with progress bar
- test_connection() for registry accessibility checks
- Comprehensive test coverage
2026-02-06 13:59:48 +01:00
Hugo Pereira Brito and Josema Camacho
cb9ab03778
feat(aws): revert Adding check that AWS Auto Scaling group has deletion protection ( #9956 )
...
Co-authored-by: Josema Camacho <hello@josema.xyz >
2026-02-04 16:53:08 +01:00
69818abdd0
feat(aws): Adding check that AWS Auto Scaling group has deletion protection ( #9928 )
...
Co-authored-by: Serhii Sokolov <serhii.sokolov@automat-it.com >
Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com >
Co-authored-by: HugoPBrito <hugopbrit@gmail.com >
2026-02-04 13:17:13 +01:00
Hugo Pereira Brito
547c53e07c
ci: add duplicate test name checker across providers ( #9949 )
2026-02-03 12:00:41 +01:00
Daniel Barranquero
e66c9864f5
fix: modify tests files name ( #9942 )
2026-02-03 08:05:27 +01:00
Daniel Barranquero
08730b4eb5
feat(openstack): add Openstack provider ( #9811 )
2026-01-29 12:54:18 +01:00
mohd4adil and Daniel Barranquero
e97e31c7ca
chore(aws): add support for trusted aws accounts in cross account checks for s3, eventbridge bus, eventbridge schema and dynamodb ( #9692 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-01-29 09:13:34 +01:00
Kay Agahd and Daniel Barranquero
04e2d15dd2
feat(aws): add check rds_instance_extended_support ( #9865 )
...
Co-authored-by: Daniel Barranquero <74871504+danibarranqueroo@users.noreply.github.com >
2026-01-28 16:49:35 +01:00
Hugo Pereira Brito and Andoni Alonso
80c94faff9
feat(cloudflare): --account-id filter support ( #9894 )
...
Co-authored-by: Andoni Alonso <14891798+andoniaf@users.noreply.github.com >
2026-01-27 14:18:55 +01:00
Hugo Pereira Brito and Andoni Alonso
6bb8dc6168
feat(cloudflare): extend dns and zone services check coverage ( #9426 )
...
Co-authored-by: Andoni Alonso <14891798+andoniaf@users.noreply.github.com >
2026-01-27 13:48:26 +01:00
9e7ecb39fa
feat(aws): CloudTrail timeline for findings ( #9101 )
...
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Pepe Fagoaga <pepe@prowler.com >
2026-01-27 13:00:46 +01:00
3d6aa6c650
feat(m365): add defender_zap_for_teams_enabled security check ( #9838 )
...
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com >
Co-authored-by: HugoPBrito <hugopbrit@gmail.com >
2026-01-26 17:34:10 +01:00
Andoni Alonso
7f4c02c738
feat(m365): add exchange_shared_mailbox_sign_in_disabled check ( #9828 )
2026-01-26 16:00:28 +01:00
Hugo Pereira Brito
5784592437
chore(azure): add vault parallelization in keyvault service ( #9876 )
2026-01-26 13:39:54 +01:00
Andoni Alonso and HugoPBrito
6cb0edf3e1
feat(aws/codebuild): add check for CodeBreach webhook filter vulnerability ( #9840 )
...
Co-authored-by: HugoPBrito <hugopbrit@gmail.com >
2026-01-22 15:12:24 +01:00
lydiavilchez and Daniel Barranquero
963ece9a0b
feat(gcp): add check to detect persistent disks on suspended VM instances ( #9747 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-01-22 13:38:30 +01:00
lydiavilchez
e76ecfdd4d
feat(gcp): add check for OS Login 2FA enabled at project level ( #9839 )
2026-01-21 15:12:01 +01:00
lydiavilchez
7b839d9f9e
feat(gcp): add check to enforce On Host Maintenance set to MIGRATE ( #9834 )
2026-01-21 09:37:21 +01:00
Hugo Pereira Brito and Andoni Alonso
aa24034ca7
feat(cloudflare): Add bot protection and configuration checks for zones ( #9425 )
...
Co-authored-by: Andoni Alonso <14891798+andoniaf@users.noreply.github.com >
2026-01-16 12:06:52 +01:00
Josema Camacho and Andoni A.
847645543a
feat(attack-paths): update boto dependencies for catrography compatibility ( #9798 )
...
Co-authored-by: Andoni A. <14891798+andoniaf@users.noreply.github.com >
2026-01-15 13:00:54 +01:00
Hugo Pereira Brito and Andoni Alonso
d4bc6d7531
feat(cloudflare): Add TLS/SSL, records and email security checks for zones ( #9424 )
...
Co-authored-by: Andoni Alonso <14891798+andoniaf@users.noreply.github.com >
2026-01-15 09:31:27 +01:00
Hugo Pereira Brito
1bf49747ad
chore(entra): enhance performance for user_registration_details and user mfa evaluation ( #9236 )
2026-01-14 14:01:51 +01:00
lydiavilchez
2cde4c939d
feat(gcp): add compute_snapshot_not_outdated check ( #9774 )
2026-01-14 12:35:29 +01:00
Hugo Pereira Brito
9844379d30
chore(cloudflare): rename zones service to zone ( #9792 )
2026-01-14 11:00:51 +01:00
Hugo Pereira Brito
b0eea61468
feat(cloudflare): Add Cloudflare provider with zones service and critical security checks ( #9423 )
2026-01-13 11:09:54 +01:00
429c591819
chore(aws): fixup AWS EC2 SG lib ( #9216 )
...
Co-authored-by: MrCloudSec <hello@mistercloudsec.com >
Co-authored-by: Sergio Garcia <sergargar1@gmail.com >
Co-authored-by: HugoPBrito <hugopbrit@gmail.com >
2026-01-12 13:47:37 +01:00
62a8540169
feat(gcp): add check to detect Compute Engine configuration changes ( #9698 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com >
2026-01-12 12:22:15 +01:00
mchennai and Pepe Fagoaga
05466cff22
test: Add edge case test for s3_bucket_server_access_logging_enabled ( #9725 )
...
Co-authored-by: Pepe Fagoaga <pepe@prowler.com >
2026-01-12 10:06:34 +01:00
Andoni Alonso
27492cbd42
fix(oci): validate credentials before scanning ( #9738 )
2026-01-08 15:47:26 +01:00
lydiavilchez
3e4458c8f3
feat(gcp): add check to detect VMs with multiple network interfaces ( #9702 )
2026-01-07 17:04:53 +01:00
lydiavilchez
e12e0dc1aa
feat(gcp): add check to ensure Compute Engine disk images are not publicly shared ( #9718 )
2026-01-07 15:05:36 +01:00
mchennai and pedrooot
4169611a6a
test(s3_bucket_server_access_logging_enabled): Add multi-bucket test ( #9716 )
...
Co-authored-by: pedrooot <pedromarting3@gmail.com >
2026-01-05 11:34:57 +01:00
Andoni A.