Skip to content

Commit

Permalink
Merge pull request #4490 from GSA-TTS/main
Browse files Browse the repository at this point in the history
  • Loading branch information
jadudm authored Nov 27, 2024
2 parents d25e4a8 + 4c35b8e commit b525919
Show file tree
Hide file tree
Showing 21 changed files with 811 additions and 726 deletions.
2 changes: 1 addition & 1 deletion .github/workflows/pull-containers-and-push-to-ghcr.yml
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ jobs:
run: docker pull ${{ matrix.image.name }}

- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@0.28.0
uses: aquasecurity/trivy-action@0.29.0
env:
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db,ghcr.io/aquasecurity/trivy-db
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db,ghcr.io/aquasecurity/trivy-java-db
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/trivy.yml
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ jobs:
run: docker build -t ${{ env.DOCKER_NAME }}:${{ steps.date.outputs.date }} .

- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@0.28.0
uses: aquasecurity/trivy-action@0.29.0
env:
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db,ghcr.io/aquasecurity/trivy-db
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db,ghcr.io/aquasecurity/trivy-java-db
Expand Down Expand Up @@ -82,7 +82,7 @@ jobs:
run: docker pull ${{ matrix.image.name }}

- name: Run Trivy vulnerability scanner on Third Party Images
uses: aquasecurity/trivy-action@0.28.0
uses: aquasecurity/trivy-action@0.29.0
env:
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db,ghcr.io/aquasecurity/trivy-db
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db,ghcr.io/aquasecurity/trivy-java-db
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/zap-scan.yml
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ jobs:
uses: actions/checkout@v4

- name: ZAP Scan of ${{ env.url }}
uses: zaproxy/action-baseline@v0.13.0
uses: zaproxy/action-baseline@v0.14.0
with:
token: ${{ secrets.GITHUB_TOKEN }}
docker_name: 'ghcr.io/zaproxy/zaproxy:stable'
Expand Down
2 changes: 1 addition & 1 deletion CONTRIBUTING.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ We want to ensure a welcoming environment for all of our projects. Our staff fol

We adhere to the [18F Open Source Policy](https://github.com/18f/open-source-policy). If you have any questions, just [send us an email](mailto:[email protected]).

As part of a U.S. government agency, the General Services Administration (GSA)’s Technology Transformation Services (TTS) takes seriously our responsibility to protect the public’s information, including financial and personal information, from unwarranted disclosure. For more information about security and vulnerability disclosure for our projects, please read our [18F Vulnerability Disclosure Policy](https://18f.gsa.gov/vulnerability-disclosure-policy/).
As part of a U.S. government agency, the General Services Administration (GSA)’s Technology Transformation Services (TTS) takes seriously our responsibility to protect the public’s information, including financial and personal information, from unwarranted disclosure. For more information about security and vulnerability disclosure for our projects, please read the [GSA Vulnerability Disclosure Policy](https://www.gsa.gov/vulnerability-disclosure-policy/).

## Public domain

Expand Down
11 changes: 11 additions & 0 deletions backend/audit/admin.py
Original file line number Diff line number Diff line change
Expand Up @@ -180,6 +180,17 @@ def save_model(self, request, obj, form, change):
logger.info(
f"Duplicate finding reference number waiver applied to SAC {sac.report_id} by user: {request.user.email}."
)
elif (
STATUS.IN_PROGRESS
and SacValidationWaiver.TYPES.PRIOR_REFERENCES in obj.waiver_types
):
logger.info(
f"User {request.user.email} is applying waiver for SAC with status: {sac.submission_status}"
)
super().save_model(request, obj, form, change)
logger.info(
f"Invalid prior reference waiver applied to SAC {sac.report_id} by user: {request.user.email}."
)
else:
messages.set_level(request, messages.WARNING)
messages.warning(
Expand Down
2 changes: 2 additions & 0 deletions backend/audit/cross_validation/__init__.py
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,7 @@
from .check_award_ref_declaration import check_award_ref_declaration
from .check_award_ref_existence import check_award_ref_existence
from .check_award_reference_uniqueness import check_award_reference_uniqueness
from .check_finding_prior_references import check_finding_prior_references
from .check_biennial_low_risk import check_biennial_low_risk
from .check_certifying_contacts import check_certifying_contacts
from .check_finding_reference_uniqueness import check_finding_reference_uniqueness
Expand All @@ -82,6 +83,7 @@
check_biennial_low_risk,
check_certifying_contacts,
check_finding_reference_uniqueness,
check_finding_prior_references,
check_findings_count_consistency,
check_has_federal_awards,
check_ref_number_in_cap,
Expand Down
129 changes: 129 additions & 0 deletions backend/audit/cross_validation/check_finding_prior_references.py
Original file line number Diff line number Diff line change
@@ -0,0 +1,129 @@
from audit.fixtures.excel import (
FINDINGS_UNIFORM_TEMPLATE_DEFINITION,
)
from .errors import err_prior_ref_not_found
from dissemination.models import (
Finding,
General,
)

from django.conf import settings

from datetime import date
import json


def check_finding_prior_references(sac_dict, *_args, **_kwargs):
"""
Check that prior references numbers point to findings that actually exist
in a previously submitted report
"""
# Importing here to avoid circular import
from audit.models import SacValidationWaiver

if SacValidationWaiver.TYPES.PRIOR_REFERENCES in sac_dict.get("waiver_types", []):
return []

all_sections = sac_dict.get("sf_sac_sections")
findings_uniform_guidance_section = (
all_sections.get("findings_uniform_guidance") or {}
)
findings_uniform_guidance = findings_uniform_guidance_section.get(
"findings_uniform_guidance_entries", []
)
all_prior_refs = _get_prior_refs(findings_uniform_guidance)

# No prior reference numbers to validate
if not all_prior_refs:
return []

general_information = all_sections.get("general_information")
auditee_uei = general_information["auditee_uei"]
audit_year = date.fromisoformat(
general_information["auditee_fiscal_period_start"]
).year

# UEIs only become reliable as of 2022, so don't bother invalidating
# prior references before that
if audit_year < 2023:
return []

# Get the report_ids for previous reports
previous_report_ids = General.objects.filter(auditee_uei=auditee_uei).values_list(
"report_id", flat=True
)
errors = []

# Validate all prior reference numbers for each award
for award_ref, prior_refs_strings in all_prior_refs.items():
prior_refs = prior_refs_strings.split(",")
_validate_prior_refs(
prior_refs,
award_ref,
auditee_uei,
previous_report_ids,
errors,
)

return errors


def _get_prior_refs(findings_uniform_guidance):
"""
Returns a dict that maps award references to a list of prior references
strings
"""
all_prior_refs = {}

for finding in findings_uniform_guidance:
if finding["findings"]["repeat_prior_reference"] == "Y":
award_ref = finding["program"]["award_reference"]
cur_prior_refs = finding["findings"]["prior_references"]
all_prior_refs[award_ref] = cur_prior_refs

return all_prior_refs


TEMPLATE_DEFINITION_PATH = (
settings.XLSX_TEMPLATE_JSON_DIR / FINDINGS_UNIFORM_TEMPLATE_DEFINITION
)
FINDINGS_TEMPLATE = json.loads(TEMPLATE_DEFINITION_PATH.read_text(encoding="utf-8"))


def _validate_prior_refs(
prior_refs, award_ref, auditee_uei, previous_report_ids, errors
):
"""
Performs validation on the given list of prior reference numbers
"""
first_row = FINDINGS_TEMPLATE["title_row"]

for index, prior_ref in enumerate(prior_refs):
current_row = first_row + index + 1
prior_ref_year = prior_ref[:4]

if prior_ref_year.isnumeric() and int(prior_ref_year) < 2022:
# Skip validation for pre-UEI prior references
continue
elif not previous_report_ids:
errors.append(
{
"error": err_prior_ref_not_found(
auditee_uei, prior_ref, award_ref, current_row
),
}
)

continue
elif not Finding.objects.filter(
report_id__in=previous_report_ids,
reference_number=prior_ref,
).exists():
# Error if we can't find the prior finding in previous reports
errors.append(
{
"error": err_prior_ref_not_found(
auditee_uei, prior_ref, award_ref, current_row
),
}
)
7 changes: 7 additions & 0 deletions backend/audit/cross_validation/errors.py
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,13 @@ def err_duplicate_finding_reference(award_ref, ref_number):
return f"Award {award_ref} repeats reference {ref_number}. The reference {ref_number} should only appear once for award {award_ref}."


def err_prior_ref_not_found(auditee_uei, prior_ref, award_ref, row):
return (
f"The {SECTION_NAMES.FEDERAL_AWARDS_AUDIT_FINDINGS} workbook contains prior reference {prior_ref} (award {award_ref}, row {row}). "
f"However, that reference was not found in any previous reports for UEI {auditee_uei}."
)


def err_findings_count_inconsistent(total_expected, total_counted, award_ref):
return (
f"You reported {total_expected} findings for award {award_ref} in the {SECTION_NAMES.FEDERAL_AWARDS} workbook, "
Expand Down
Loading

0 comments on commit b525919

Please sign in to comment.