Skip to content
This repository was archived by the owner on Jun 23, 2023. It is now read-only.

Commit 6d3f0ce

Browse files
author
radekk
authored
New release with AWS Lambda support, v3.0.0 (#40)
* Update tooling to use Node.js v10 * Use package-lock instead of shrinkwrap and remove webtask * Delete config.json * Add .editorconfig file * Add a rule to eslint to enforce max line length * Adjust Babel settings * Bump up packages and update config * New webpack config * Move responses and messages to a config file * Run scan on reopened PR * Refactor code to work with AWS Lambda handler - Add AWS Lambda handler - Implement consistent module for HTTP responses - Get Slack URL from ENV variable - Use async/await statements instead of callbacks - Remove ES6 module import statements (it was causing issue for a webpack) - Remove deprecated calls to "new Buffer" * Add changes to HTML report view - Only one button to report an issue with a false positive - Updated messages - Refreshed view * Update old tests - Rename bugs to issues - Update CLI test * Add JWT fixtures for tests * Ignore some of eslint rules for a test file * Return error with a function * Regenerate package-lock.json file * CircleCI - trigger a build before running tests * Update a readme file to match the v3 release changes * Resize and compress image in docs * Adjust tables in a readme file and add TOC * Ignore .DS_Store files * Feat: multiple file extensions for a single file type * docs: docker image support * docs: AWS Lambda support * docs: How to support a new file type * docs: Link to a new documentation from the main readme file * fix: do not use es6 module syntax yet * feat: support configuration for obfuscation module
1 parent aef6646 commit 6d3f0ce

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

57 files changed

+3257
-5487
lines changed

.babelrc

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,23 @@
11
{
2-
"presets": ["es2015"]
2+
"presets": [
3+
["@babel/preset-env",
4+
{
5+
"targets": {
6+
"node": "current"
7+
}
8+
}
9+
]
10+
],
11+
"plugins": ["@babel/plugin-transform-runtime"],
12+
"sourceType": "unambiguous",
13+
"env": {
14+
"development" : {
15+
"compact": false
16+
}
17+
},
18+
"ignore": [
19+
"./test/**",
20+
"./dist/**",
21+
"./node_modules/**"
22+
]
323
}

.circleci/config.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,5 +26,5 @@ jobs:
2626
key: v1-dependencies-{{ checksum "package.json" }}
2727
- run:
2828
name: Run Tests
29-
command: npm test
29+
command: npm run build && npm run test
3030
when: always

.config.json

Lines changed: 0 additions & 3 deletions
This file was deleted.

.editorconfig

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
[*]
2+
indent_style = space
3+
4+
[*.{js,json}]
5+
indent_size = 2

.eslintignore

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
dist/*
1+
./dist/*

.eslintrc

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,13 @@
2323
"no-console": "off",
2424
"no-param-reassign": "off",
2525
"no-plusplus": "off",
26-
"strict": "off"
26+
"strict": "off",
27+
"max-len": ["error", 120, 2, {
28+
"ignoreUrls": true,
29+
"ignoreComments": false,
30+
"ignoreRegExpLiterals": true,
31+
"ignoreStrings": false,
32+
"ignoreTemplateLiterals": false
33+
}]
2734
}
2835
}

.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,4 @@ TODO
1111
.vscode
1212
.config.json
1313
dist/
14+
.DS_Store

.nvmrc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
8
1+
10

Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ ADD ./ /opt/repo-supervisor
2020

2121
# Install node version manager
2222
RUN curl -o- https://raw.githubusercontent.com/creationix/nvm/v0.33.2/install.sh | bash
23-
RUN /bin/bash -c "source ~/.bashrc && nvm install 7"
23+
RUN /bin/bash -c "source ~/.bashrc && nvm install 10"
2424

2525
# Build scripts
2626
RUN /bin/bash -c "source ~/.bashrc && cd /opt/repo-supervisor && npm install --no-optional && npm run build"

README.md

Lines changed: 91 additions & 128 deletions
Original file line numberDiff line numberDiff line change
@@ -1,189 +1,152 @@
11
# Repo-supervisor
22

3-
Serverless tool that detects secrets and passwords in your pull requests - one file at a time.
4-
53
[![Join the chat at https://gitter.im/repo-supervisor/Lobby](https://badges.gitter.im/repo-supervisor/Lobby.svg)](https://gitter.im/repo-supervisor/Lobby)
64
[![Build Status](https://travis-ci.org/auth0/repo-supervisor.svg?branch=master)](https://travis-ci.org/auth0/repo-supervisor)
75

86

9-
<div style="text-align:center"><img src="docs/report.preview.png"/></div>
7+
The Repo-supervisor is a tool that helps you to detect secrets and passwords in your code. It's as easy to install as adding a new webhook to your Github repository.
108

11-
## Help
9+
It works in two separate modes. The first one allows us to scan Github pull requests, and the second one works from the command line where it scans local directories.
1210

13-
If you need help please visit [Wiki](https://github.com/auth0/repo-supervisor/wiki/) or [Gitter chat](https://gitter.im/repo-supervisor/Lobby).
11+
- [Repo-supervisor](#repo-supervisor)
12+
- [Usage](#usage)
13+
- [Pre-requisites](#pre-requisites)
14+
- [Command line mode](#command-line-mode)
15+
- [Github Pull Request mode](#github-pull-request-mode)
16+
- [Supported files](#supported-files)
17+
- [Security checks](#security-checks)
18+
- [Frequently asked questions](#frequently-asked-questions)
19+
- [How does it work?](#how-does-it-work)
20+
- [Why doesn't it find any secrets?](#why-doesnt-it-find-any-secrets)
21+
- [How to add support for new file types?](#how-to-add-support-for-new-file-types)
22+
- [What is Auth0?](#what-is-auth0)
23+
- [Create a free account in Auth0](#create-a-free-account-in-auth0)
24+
- [Issue Reporting](#issue-reporting)
25+
- [Author](#author)
26+
- [License](#license)
1427

15-
## Command line mode
28+
## Usage
1629

17-
To start using tool without setting up webhooks etc. you can start scanning local directories right after downloading the source code:
30+
### Pre-requisites
1831

19-
```bash
20-
npm install --no-optional
21-
npm run build
22-
npm run cli ./src/
23-
```
32+
To start using a tool, download the latest release from the Github releases page. There are two bundles available for both AWS Lambda deployment as well as for the CLI mode. Using CLI mode doesn't require any additional configuration, whereas to use the PR mode, it's necessary to deploy the bundle to AWS Lambda first.
2433

25-
**JSON output**
34+
- [AWS Lambda deployment](docs/aws.lambda.deployment.md)
35+
- [Using a docker image](docs/docker.image.md)
2636

27-
To trigger JSON format for the output report you need to set `JSON_OUTPUT=1` environment variable.
37+
### Command line mode
2838

29-
```bash
30-
→ JSON_OUTPUT=1 node ./dist/cli.js ./test/fixtures/integration/dir.with.secrets/foo/ | jq
31-
{
32-
"result": [
33-
{
34-
"filepath": "./test/fixtures/integration/dir.with.secrets/foo/bar.js",
35-
"secrets": [
36-
"zJd-55qmsY6LD53CRTqnCr_g-",
37-
"gm5yb-hJWRoS7ZJTi_YUj_tbU",
38-
"GxC56B6x67anequGYNPsW_-TL",
39-
"MLTk-BuGS8s6Tx9iK5zaL8a_W",
40-
"2g877BA_TsE-WoPoWrjHah9ta"
41-
]
42-
},
43-
{
44-
"filepath": "./test/fixtures/integration/dir.with.secrets/foo/foo.json",
45-
"secrets": [
46-
"d7kyociU24P9hJ_sYVkqzo-kE",
47-
"q28Wt3nAmLt_3NGpqi2qz-jQ7"
48-
]
49-
}
50-
]
51-
}
52-
```
39+
The CLI mode allows scanning local directories with source code to detect secrets and passwords in files. That is the simplest deployment option, and it could become a part of the CI pipeline.
5340

54-
## Docker
55-
56-
It's possible to run Repo Supervisor inside the Docker container. It gives you more flexibility and you don't need to configure your local environment with Node.JS and npm. At first you need to build up the Docker image:
41+
Findings might be either returned in the plaintext or JSON format:
5742

5843
```bash
59-
docker build -t repo-supervisor .
60-
```
44+
$ npm ci && npm run build
45+
$ node ./dist/cli.js ./test/fixtures/integration/dir.with.secrets
6146

62-
To run the tool inside Docker container you need to trigger a specific command:
47+
[./test/fixtures/integration/dir.with.secrets/foo/bar.js]
48+
>> zJd-55qmsY6LD53CRTqnCr_g-
49+
>> gm5yb-hJWRoS7ZJTi_YUj_tbU
50+
>> GxC56B6x67anequGYNPsW_-TL
51+
>> MLTk-BuGS8s6Tx9iK5zaL8a_W
52+
>> 2g877BA_TsE-WoPoWrjHah9ta
6353

64-
```bash
65-
docker run -it --rm -v /local/path/on/your/host:/opt/scan_me repo-supervisor /bin/bash -c "source ~/.bashrc && JSON_OUTPUT=1 node /opt/repo-supervisor/dist/cli.js /opt/scan_me"
66-
```
54+
[./test/fixtures/integration/dir.with.secrets/foo/foo.json]
55+
>> d7kyociU24P9hJ_sYVkqzo-kE
56+
>> q28Wt3nAmLt_3NGpqi2qz-jQ7
6757

68-
As a result it should return detected secrets in JSON format:
58+
$ JSON_OUTPUT=1 node ./dist/cli.js ./test/fixtures/integration/dir.with.secrets
6959

70-
```
71-
→ docker run -it --rm -v /local/path/on/your/host:/opt/scan_me repo-supervisor /bin/bash -c "source ~/.bashrc && JSON_OUTPUT=1 node /opt/repo-supervisor/dist/cli.js /opt/scan_me"
7260
{"result":[{"filepath":"./test/fixtures/integration/dir.with.secrets/foo/bar.js","secrets":["zJd-55qmsY6LD53CRTqnCr_g-","gm5yb-hJWRoS7ZJTi_YUj_tbU","GxC56B6x67anequGYNPsW_-TL","MLTk-BuGS8s6Tx9iK5zaL8a_W","2g877BA_TsE-WoPoWrjHah9ta"]},{"filepath":"./test/fixtures/integration/dir.with.secrets/foo/foo.json","secrets":["d7kyociU24P9hJ_sYVkqzo-kE","q28Wt3nAmLt_3NGpqi2qz-jQ7"]}]}
7361
```
7462

75-
## Setup
76-
77-
The recommended way is to clone this repository, install required dependencies and run script to deploy a script on the webtask.io platform.
7863

79-
```bash
80-
git clone git@github.com:auth0/repo-supervisor.git
81-
cd repo-supervisor
82-
83-
npm install --no-optional
84-
GITHUB_TOKEN=<token> JWT_SECRET=<secret> npm run deploy
85-
```
64+
### Github Pull Request mode
8665

87-
After script was deployed it will return a URL address to your webtask which then you can use to setup a webhook.
66+
Running a tool in the pull request mode requires to add a new webhook to the Github repository. Webhook should be triggered on a pull request events whenever someone opens, updates, or closes a PR. Therefore, when a scan is triggered, it will update the PR status to either success or failure, depending on findings.
8867

89-
_If you want to deploy webtask with profile different than a standard one you should set env. variable called `WT_PROFILE=myprofile` just before or right after `GITHUB_TOKEN` variable._
68+
Webhook configuration details:
9069

91-
## Webhook
70+
| Setting | Value |
71+
| ------------ | ------------------ |
72+
| Payload URL | AWS Lambda URL |
73+
| Content type | `application/json` |
74+
| Events type | `Pull requests` |
9275

93-
Installing webhook is easy and there is no difference to other webhooks provided by i.e. Zapier or IFTTT.
76+
Whenever a tool finds security issues, it sets the PR status to error, and it adds a link to view the report. Link to the report is a URL to AWS Lambda deployment with an additional query parameter `?id=<jwt>` that allows to generate the HTML report.
9477

95-
Before installing a webhook you need to build and install this tool. As a result `npm run deploy` should return the URL address to your deployed webtask. Point your **Payload URL** to webtask url and you're ready to go.
78+
Check out a sample report:
9679

97-
:exclamation: Please ensure that the Content type for a webhook is set to `application/json`. :exclamation:
80+
<div style="text-align:center"><img src="docs/images/pr.report.review.png"/></div>
9881

99-
<div style="text-align:center"><img src="docs/webhook.setup.png"/></div>
82+
Depending on the success or failure of the scan, it will set a proper PR status.
10083

101-
> Which events would you like to trigger this webhook?
84+
**Error - issues detected**
10285

103-
- [x] Let me select individual events.
104-
- [x] Pull request
86+
<img src="docs/images/pr.ci.status.error.png"/>
10587

106-
## Requirements
88+
**Success - no issues were found**
10789

108-
After installing all required packages with `npm` the one additional tool is `wt-cli` to communicate with [webtask.io](https://webtask.io).
90+
<img src="docs/images/pr.ci.status.success.png"/>
10991

110-
If you don't have an account then create a new one, **it's free**. All details related to `wt-cli` are available in the [documentation](https://webtask.io/docs/wt-cli).
111-
112-
Installation process:
113-
114-
```bash
115-
npm install -g wt-cli
116-
```
92+
**A false positive was reported**
11793

118-
## Introduction
94+
<img src="docs/images/pr.ci.status.false.positive.png"/>
11995

120-
It happens sometimes that you can commit secrets or passwords to your repository by accident. The recommended best practice is not commit the secrets, that's obvious. But not always that obvious when you have a big merge waiting to be reviewed.
96+
## Supported files
12197

122-
This tool allows you to setup a `webhook` that waits for the Pull Requests and scans all interesting files to check for leaked secrets. Every time PR is updated it rescans latest changes and generates a report.
98+
Repo-supervisor aims to decrease the number of false positives as much as possible. It means that it doesn't scan all file types and extensions. Each file is parsed according to its format to extract strings, and this is a context-aware process that requires to use a language tokenizer. The currently supported file types are:
12399

124-
Both acknowledge and rejection actions are triggering Slack notification which allows to whether improve or fix secrets detection rules.
125-
126-
**Acknowledge** report (YES): Approve that report as valid, detected strings are actual secrets.
127-
128-
**Reject** report (NO): Reject report, detected secrets are not credentials but only object identifiers, messages or other not related strings. It will help to improve the false-positives ratio.
100+
- JSON (.json)
101+
- JavaScript (.js)
129102

103+
We plan to add new file types in the future. Read a documentation on [how to add a new file type](docs/add.new.file.type.md) to learn more.
130104

131105
## Security checks
132106

133-
Tool is easily extendable by adding new filter and parsers for a specific format, for now we support `json` and `js` parsing.
107+
This is the list of currently implemented checks in a tool:
134108

135-
- **Entropy Meter** - measures the level of entropy for extracted strings. The higher the entropy the higher probability of detecting a secret/password.
109+
| Module | Details |
110+
| ----------------- | ------------------------------------------------------------------------------------------ |
111+
| **Entropy Meter** | Finds strings with a high entropy to detect secrets and passwords in supported file types. |
136112

137-
## Testing
113+
## Frequently asked questions
138114

139-
Testing this tool is super easy without a need to install the actual source code on the webtask platform.
115+
### How does it work?
140116

141-
1\. Start local wt-cli server
117+
**CLI mode:**
142118

143-
```bash
144-
cd repo-supervisor
145-
GITHUB_TOKEN=<github_token> JWT_SECRET=<random_secret> npm start
146-
```
119+
- Scan a directory provided as argument
120+
- Get a list of all files and return only those matching [supported extensions](#supported-files) like `*.json` or `*.js`
121+
- Process every supported file with a tokenizer (different one for each file type)
122+
- Iterate over all extracted strings and run security checks on them
123+
- Entropy Meter - calculate the entropy value to see if it goes above defined threshold ([maxAllowedEntropy](config/filters/entropy.meter.json))
124+
- Print out detected issues either in a plain-text or JSON format
147125

148-
It will trigger the built-in server and listen by default at `localhost` on port `7070` if not changed (env: `PORT`, `HOST`).
126+
**Pull Request mode:**
149127

150-
2\. Run local `ngrok` tunnel
128+
- Receive a webhook payload
129+
- Process payload and extract all modified files
130+
- Iterate over each file:
131+
- Use the appropriate tokenizer based on file type
132+
- Extract strings from a file
133+
- Run security checks on those strings
134+
- If tool detects issues then it sets CI status to error with a link to the report
135+
- If no issues were found then it sets CI status to success
151136

152-
```bash
153-
ngrok http 7070
154-
```
155-
156-
Output:
137+
Read more on the [CI status](https://developer.github.com/v3/repos/statuses/) definition.
157138

158-
```bash
159-
Session Status online
160-
Region United States (us)
161-
Web Interface http://127.0.0.1:4040
162-
Forwarding http://b1942011.ngrok.io -> localhost:7070
163-
Forwarding https://b1942011.ngrok.io -> localhost:7070
164-
```
139+
### Why doesn't it find any secrets?
165140

166-
3\. Setup webhook URL so it points to `ngrok` URL.
141+
Verify that the secrets you want to find are inside supported file types. Read more in the [Supported files](#supported-files) section.
167142

168-
[Ngrok](https://ngrok.com/) is a really useful tool, it allows you to inspect **every** request send to your ngrok's endpoint so you can verify data in/out.
143+
### How to add support for new file types?
169144

145+
To support a new file type, you need to create a new parser. Some of the file types might require to use external tokenizers because of the complex structure like [JavaScript](src/parser/tokenizer/js/index.js) files. On the other hand, for simple file types, it's pretty straightforward as it was with [JSON](src/parser/tokenizer/json/index.js) files.
170146

171-
## Dependencies
172-
173-
All required dependencies are enforced in specific versions on the webtask.io platform by using metadata setting.
174-
175-
```bash
176-
--meta wt-node-dependencies=$(./bin/get.wt.deps.sh)
177-
```
178-
179-
_get.wt.deps.sh_ script returns a list of dependencies extracted from `package.json` file.
180-
181-
```bash
182-
→ ./bin/get.wt.deps.sh
183-
{"acorn":"4.0.11","bluebird":"3.4.7","github":"8.2.1","handlebars":"4.0.6","handlebars-loader":"1.4.0","jsonwebtoken":"7.3.0","lodash":"4.17.4"}
184-
```
147+
Read more on how to add a [new file type](docs/add.new.file.type.md).
185148

186-
Without the enforcement policy it would break the installation since older version of libraries are not compatible with current code.
149+
---
187150

188151
## What is Auth0?
189152

@@ -203,7 +166,7 @@ the same user.
203166
* Pull data from other sources and add it to the user profile, through
204167
[JavaScript rules](https://docs.auth0.com/rules).
205168

206-
## Create a free account in Auth0
169+
### Create a free account in Auth0
207170

208171
1. Go to [Auth0](https://auth0.com) and click Sign Up.
209172
2. Use Google, GitHub or Microsoft Account to login.

config/filters.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[
22
{
3-
"ext": ".js",
3+
"ext": [".js"],
44
"filters": ["entropy.meter/index.js"],
55
"parser": {
66
"module": "tokenizer/js/index.js",
@@ -12,7 +12,7 @@
1212
}
1313
},
1414
{
15-
"ext": ".json",
15+
"ext": [".json"],
1616
"filters": ["entropy.meter/index.js"],
1717
"parser": {
1818
"module": "tokenizer/json/index.js",

0 commit comments

Comments
 (0)