adding kics remediate command

adding kics remediate command

Author: tiagobcx

package.json

@@ -13,7 +13,7 @@
   },
   "scripts": {
     "build": "tsc",
-    "postbuild": "copyfiles -u 1 src/main/wrapper/resources/cx* dist/",
+    "postbuild": "copyfiles -u 1 src/main/wrapper/resources/cx* dist/;copyfiles -u 1 src/tests/data/* dist/;",
     "lint": "eslint . --ext .ts",
     "lint-and-fix": "eslint . --ext .ts --fix",
     "test": "copyfiles -u 1 src/tests/data/* dist/; tsc && jest --runInBand --coverage"

src/main/remediation/CxKicsRemediation.ts

@@ -0,0 +1,14 @@
+export default class CxKicsRemediation {
+    availableRemediation: string;
+    appliedRemediation: string;
+
+    constructor(availableRemediation: string,appliedRemediation: string) {
+        this.availableRemediation = availableRemediation;
+        this.appliedRemediation = appliedRemediation;
+    }
+
+    static parseKicsRemediation(resultObject: any): CxKicsRemediation {
+        const output: CxKicsRemediation = new CxKicsRemediation(resultObject.available_remediation_count,resultObject.applied_remediation_count);
+        return output;
+    }
+}

src/main/wrapper/CxConstants.ts

@@ -15,6 +15,12 @@ export enum CxConstants {
     TENANT = "--tenant",
     BASE_URI = "--base-uri",
     BASE_AUTH_URI = "--base-auth-uri",
+    CMD_UTILS = "utils",
+    CMD_REMEDIATION = "remediation",
+    SUB_CMD_REMEDIATION_KICS = "kics",
+    KICS_REMEDIATION_RESULTS_FILE = "--results-file",
+    KICS_REMEDIATION_KICS_FILE = "--kics-files",
+    KICS_REMEDIATION_SIMILARITY_IDS = "--similarity-ids",
     CMD_AUTH = "auth",
     SUB_CMD_VALIDATE = "validate",
     CMD_PROJECT = "project",
@@ -56,6 +62,7 @@ export enum CxConstants {
     PREDICATE_TYPE = "CxPredicate",
     CODE_BASHING_TYPE = "CxCodeBashing",
     KICS_REALTIME_TYPE = "CxKicsRealTime",
+    KICS_REMEDIATION_TYPE = "CxKicsRemediation",
     BFL_TYPE = "CxBFL",
     SAST = "sast",
     LANGUAGE = "--language",

src/main/wrapper/CxWrapper.ts

@@ -247,6 +247,19 @@ export class CxWrapper {
         return exec.executeKicsCommands(this.config.pathToExecutable, commands, CxConstants.KICS_REALTIME_TYPE);
     }
 
+    async kicsRemediation(resultsFile: string, kicsFile:string, engine:string,similarityIds?: string):Promise<[Promise<CxCommandOutput>,any]>  {
+        const commands: string[] = [CxConstants.CMD_UTILS, CxConstants.CMD_REMEDIATION,CxConstants.SUB_CMD_REMEDIATION_KICS,CxConstants.KICS_REMEDIATION_RESULTS_FILE, resultsFile, CxConstants.KICS_REMEDIATION_KICS_FILE, kicsFile];
+        if(engine.length>0){
+            commands.push(CxConstants.ENGINE,engine)
+        }
+        if(similarityIds){
+            commands.push(CxConstants.KICS_REMEDIATION_SIMILARITY_IDS,similarityIds)
+        }
+        commands.push(...this.initializeCommands(false));
+        const exec = new ExecutionService();
+        return exec.executeKicsCommands(this.config.pathToExecutable, commands, CxConstants.KICS_REMEDIATION_TYPE);
+    }
+
     getIndexOfBflNode(bflNodes: CxBFL[], resultNodes: any[]): number {
 
         const bflNodeNotFound = -1;

src/main/wrapper/ExecutionService.ts

@@ -10,6 +10,7 @@ import CxCodeBashing from "../codebashing/CxCodeBashing";
 import CxBFL from "../bfl/CxBFL";
 import spawner = require('child_process');
 import CxKicsRealTime from "../kicsRealtime/CxKicsRealTime";
+import CxKicsRemediation from "../remediation/CxKicsRemediation";
 
 
 
@@ -140,6 +141,10 @@ export class ExecutionService {
                     const kicsResults = CxKicsRealTime.parseKicsRealTimeResponse(resultObject);
                     cxCommandOutput.payload = [kicsResults];
                     break;
+                  case "CxKicsRemediation":
+                    const kicsRemediationOutput = CxKicsRemediation.parseKicsRemediation(resultObject)
+                    cxCommandOutput.payload = [kicsRemediationOutput]
+                    break;
                 default:
                   cxCommandOutput.payload = resultObject;
               }

src/tests/RemediationTest.test.ts

@@ -0,0 +1,25 @@
+import {CxWrapper} from '../main/wrapper/CxWrapper';
+import {BaseTest} from "./BaseTest";
+import {CxCommandOutput} from "../main/wrapper/CxCommandOutput";
+import CxKicsRemediation from "../main/remediation/CxKicsRemediation";
+
+describe("Kics Remediation cases",() => {
+    const cxScanConfig = new BaseTest();
+    it('Kics Remediation Successful case', async () => {
+        const auth = new CxWrapper(cxScanConfig);
+        const e:[Promise<CxCommandOutput>,any] = await auth.kicsRemediation("dist/tests/data/results.json",__dirname+"/data","docker")
+        const output = await e[0];
+        const remediation: CxKicsRemediation = output.payload[0];
+        expect(remediation.availableRemediation).toBeDefined();
+        expect(remediation.appliedRemediation).toBeDefined();
+    });
+
+    it('Kics Remediation Successful case with filter', async () => {
+        const auth = new CxWrapper(cxScanConfig);
+        const e:[Promise<CxCommandOutput>,any] = await auth.kicsRemediation("dist/tests/data/results.json",__dirname+"/data/","","9574288c118e8c87eea31b6f0b011295a39ec5e70d83fb70e839b8db4a99eba8")
+        const output = await e[0];
+        const remediation: CxKicsRemediation = output.payload[0];
+        expect(remediation.availableRemediation).toBeDefined();
+        expect(remediation.appliedRemediation).toBeDefined();
+    });
+});

src/tests/data/positive1.tf

@@ -0,0 +1,22 @@
+resource "aws_lb_listener" "listener5" {
+  load_balancer_arn = aws_lb.test3.arn
+  port = 80
+  default_action {
+    type = "redirect"
+
+    redirect {
+      port        = "80"
+      protocol    = "HTTPSSSSSSSSSSSSSSSSSSSSSSSSS"
+      status_code = "HTTP_301"
+    }
+  }
+}
+
+resource "aws_lb" "test3" {
+  enable_deletion_protection = true
+  drop_invalid_header_fields = true
+  name = "test123"
+  load_balancer_type = "application"
+  subnets = [aws_subnet.subnet1.id, aws_subnet.subnet2.id]
+  internal = true
+}

src/tests/data/results.json

@@ -0,0 +1 @@
+{"kics_version":"v1.5.12","total_counter":6,"queries":[{"query_name":"ALB Listening on HTTP","query_id":"de7f5e83-da88-4046-871f-ea18504b1d43","severity":"HIGH","platform":"Terraform","category":"Networking and Firewall","description":"AWS Application Load Balancer (alb) should not listen on HTTP","query_url":"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_listener","files":[{"file_name":"../../path/positive1.tf","similarity_id":"b42a19486a8e18324a9b2c06147b1c49feb3ba39a0e4aeafec5665e60f98d047","line":9,"issue_type":"IncorrectValue","search_key":"aws_lb_listener[listener5].default_action.redirect.protocol","search_line":0,"search_value":"","expected_value":"'default_action.redirect.protocol' is equal to 'HTTPS'","actual_value":"'default_action.redirect.protocol' is equal 'HTTP'","remediation":"{\"after\":\"HTTPS\",\"before\":\"HTTP\"}","remediation_type":"replacement"}]},{"query_name":"ALB Not Dropping Invalid Headers","query_id":"6e3fd2ed-5c83-4c68-9679-7700d224d379","severity":"MEDIUM","platform":"Terraform","category":"Best Practices","description":"It's considered a best practice when using Application Load Balancers to drop invalid header fields","query_url":"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb#drop_invalid_header_fields","files":[{"file_name":"../../path/positive1.tf","similarity_id":"9574288c118e8c87eea31b6f0b011295a39ec5e70d83fb70e839b8db4a99eba8","line":15,"issue_type":"MissingAttribute","search_key":"aws_lb[{{test3}}]","search_line":0,"search_value":"","expected_value":"aws_lb[{{test3}}].drop_invalid_header_fields is set to true","actual_value":"aws_lb[{{test3}}].drop_invalid_header_fields is missing","remediation":"drop_invalid_header_fields = true","remediation_type":"addition"}]},{"query_name":"ALB Deletion Protection Disabled","query_id":"afecd1f1-6378-4f7e-bb3b-60c35801fdd4","severity":"LOW","platform":"Terraform","category":"Insecure Configurations","description":"Application Load Balancer should have deletion protection enabled","query_url":"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb#enable_deletion_protection","files":[{"file_name":"../../path/positive1.tf","similarity_id":"cc22618d82eee56de73a07a558bf689f2efe1ddc42393323d14f77b0c37c29a8","line":15,"issue_type":"MissingAttribute","search_key":"aws_lb[test3]","search_line":0,"search_value":"","expected_value":"'enable_deletion_protection' is defined and set to true","actual_value":"'enable_deletion_protection' is undefined or null","remediation":"enable_deletion_protection = true","remediation_type":"addition"}]},{"query_name":"IAM Access Analyzer Not Enabled","query_id":"e592a0c5-5bdb-414c-9066-5dba7cdea370","severity":"LOW","platform":"Terraform","category":"Best Practices","description":"IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions","query_url":"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/accessanalyzer_analyzer","files":[{"file_name":"../../path/positive1.tf","similarity_id":"23486f3c10caaa350ec4e2a26d49de0969a585e7df6ec7814fe44466c8e1ff9e","line":1,"issue_type":"MissingAttribute","search_key":"resource","search_line":0,"search_value":"","expected_value":"'aws_accessanalyzer_analyzer' is set","actual_value":"'aws_accessanalyzer_analyzer' is undefined","remediation":"","remediation_type":""}]},{"query_name":"Shield Advanced Not In Use","query_id":"084c6686-2a70-4710-91b1-000393e54c12","severity":"LOW","platform":"Terraform","category":"Networking and Firewall","description":"AWS Shield Advanced should be used for Amazon Route 53 hosted zone, AWS Global Accelerator accelerator, Elastic IP Address, Elastic Load Balancing, and Amazon CloudFront Distribution to protect these resources against robust DDoS attacks","query_url":"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/shield_protection#resource_arn","files":[{"file_name":"../../path/positive1.tf","similarity_id":"069aa314d2934c4c50746ec0045e0802e3c6f8f803ea5528c60d92917cc4d318","line":15,"issue_type":"MissingAttribute","search_key":"aws_lb[test3]","search_line":0,"search_value":"","expected_value":"aws_lb has shield advanced associated","actual_value":"aws_lb does not have shield advanced associated","remediation":"","remediation_type":""}]},{"query_name":"Resource Not Using Tags","query_id":"e38a8e0a-b88b-4902-b3fe-b0fcb17d5c10","severity":"INFO","platform":"Terraform","category":"Best Practices","description":"AWS services resource tags are an essential part of managing components. As a best practice, the field 'tags' should have additional tags defined other than 'Name'","query_url":"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/guides/resource-tagging","files":[{"file_name":"../../path/positive1.tf","similarity_id":"e9119956188af27eb6b095cf0fadbf0d784270d9238e4650390e3b3d9a9756f5","line":15,"issue_type":"MissingAttribute","search_key":"aws_lb[{{test3}}]","search_line":0,"search_value":"","expected_value":"aws_lb[{{test3}}].tags is defined and not null","actual_value":"aws_lb[{{test3}}].tags is undefined or null","remediation":"","remediation_type":""}]}],"severity_counters":{"HIGH":1,"INFO":1,"LOW":3,"MEDIUM":1}}