-
Notifications
You must be signed in to change notification settings - Fork 485
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
✨ Add machine-readable patch to fix script injections in workflows #4218
base: main
Are you sure you want to change the base?
Commits on Aug 29, 2024
-
Merge pull request #1 from joycebrum/feature/setup-environment-for-dw…
…-fix create environment for patch on DW script injections Signed-off-by: Diogo Teles Sant'Anna <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for cb7f2a7 - Browse repository at this point
Copy the full SHA cb7f2a7View commit details -
Merge pull request ossf#3 from joycebrum/feat/connect-patch-generator…
…-with-remediation-output Include the generated patch in the output Signed-off-by: Joyce Brum <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for c2e7b0a - Browse repository at this point
Copy the full SHA c2e7b0aView commit details -
Merge pull request ossf#2 from joycebrum/test/initial-tests-for-dw-fix
Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for 949411a - Browse repository at this point
Copy the full SHA 949411aView commit details -
Merge pull request ossf#4 from joycebrum/feat/get-input-needed-to-gen…
…erate-patch Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for 8b45ada - Browse repository at this point
Copy the full SHA 8b45adaView commit details -
impl.go: slight refactor to loop
Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for ae4d700 - Browse repository at this point
Copy the full SHA ae4d700View commit details -
Add envvars to existing or new env, still not replaced in
run
Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for 40734bd - Browse repository at this point
Copy the full SHA 40734bdView commit details -
Replace unsafe variables in run commands, generate git diff
Git diff created using hexops/gotextdiff, WHICH IS ARCHIVED. It is unfortunately the only package I found which could do it. To be discussed with Scorecard maintainers whether it's worth it. Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for d6c6a3d - Browse repository at this point
Copy the full SHA d6c6a3dView commit details -
- Test patchWorkflow instead of GeneratePatch. This avoids the complication of comparing diff files; we can instead simply compare the output workflow to an expected "fixed" workflow. - Examples with multiple findings must have separate "fixed" workflows for each finding, not a single file which covers all findings - Instead of hard-coding the finding details (snippet, line position), run raw.DangerousWorkflow() to get that data automatically. This does make these tests a bit more "integration-test-like", but makes them substantially easier to maintain. Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for ed6b47f - Browse repository at this point
Copy the full SHA ed6b47fView commit details -
- misc refactors - use go-git to generate diff - Most functions now return errors instead of bools. This can be later used for simpler logging - Existing environment variables are now detected by parsing the files as GH workflows. This is WIP to handle existing envvars in our patches. - Remove instances of C-style for-loops, unnecessarily dangerous! - Fixed proper detection of existing env, handling blank lines and comments. Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for c0fe682 - Browse repository at this point
Copy the full SHA c0fe682View commit details -
- Fix inconsistencies between original and "fixed" versions - Store multiple "fixed" workflows for tests with multiple findings. Each "fixed" workflow fixes a single finding. The files are numbered according to the order in which the findings are found by moving down the file. - allKindsOfUserInput removed. Would require too many "fixed" workflows to test. The behavior can be tested more directly. Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for 809bcdd - Browse repository at this point
Copy the full SHA 809bcddView commit details -
Use existing envvars, validate patched workflow
- If an envvar with our name and value already existed but simply wasn't used, the patch no longer duplicates it. - After the patched workflow is created, we validate that it is valid. Or, at least did not introduce any syntax errors that were not present in the original workflow. Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for 07c5133 - Browse repository at this point
Copy the full SHA 07c5133View commit details -
Test for same injection in same step, leading to duplicate findings
Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for 51bf21d - Browse repository at this point
Copy the full SHA 51bf21dView commit details -
Use existing envvars with different name but same meaning
Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for fc34c62 - Browse repository at this point
Copy the full SHA fc34c62View commit details -
Avoid conflicts with irrelevant but existing envvars
Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for a9de65a - Browse repository at this point
Copy the full SHA a9de65aView commit details -
Use first job's indent to define envvar indent
Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for 46c4fbd - Browse repository at this point
Copy the full SHA 46c4fbdView commit details -
- Create helper function `readWorkflow` - Improved error handling in case of failed workflow validation - Allow the declaration of duplicate findings (cases where 2+ findings have the same patch) Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for 313b537 - Browse repository at this point
Copy the full SHA 313b537View commit details -
patch/impl: Simplify unsafePatterns, use errors, docs, lint
- Simplify use of unsafePatterns - Replaced boolean returns with errors, for easier log/debugging - Improved documentation - Changes to satisfy linter, adoption of 120-char line limit Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for b753de1 - Browse repository at this point
Copy the full SHA b753de1View commit details -
Fix panic in hasScriptInjection test due to missing file
Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for 23b58ee - Browse repository at this point
Copy the full SHA 23b58eeView commit details -
Avoid duplicate envvars dealing with array variables
Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for ed5fd7d - Browse repository at this point
Copy the full SHA ed5fd7dView commit details -
Adopt existing inter-block spacing for new env
Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for ad84cc1 - Browse repository at this point
Copy the full SHA ad84cc1View commit details -
chore: Tidy up function order, remove unused files
Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for 62062e0 - Browse repository at this point
Copy the full SHA 62062e0View commit details -
Define localPath in runScorecard
Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for 062ca77 - Browse repository at this point
Copy the full SHA 062ca77View commit details -
Assert valid offset, use TrimSpace, drop unused struct member
Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for aecc126 - Browse repository at this point
Copy the full SHA aecc126View commit details -
Just use []bytes instead of string
Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for eeaa677 - Browse repository at this point
Copy the full SHA eeaa677View commit details -
Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for 961a45b - Browse repository at this point
Copy the full SHA 961a45bView commit details -
Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for a72951d - Browse repository at this point
Copy the full SHA a72951dView commit details
Commits on Sep 4, 2024
-
Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for 686baec - Browse repository at this point
Copy the full SHA 686baecView commit details -
Move /patch to /internal/patch
Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for 39766fb - Browse repository at this point
Copy the full SHA 39766fbView commit details -
Document patch behavior and add patch to remediation in def.yml
Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>
Configuration menu - View commit details
-
Copy full SHA for 950f649 - Browse repository at this point
Copy the full SHA 950f649View commit details