Skip to content

Commit c62cd20

Browse files
pedrobpereirapedrobpereira
authored
fix: not recommended patterns are now included in semgrep config CF-1809 (#175)
* fix: not recommended patterns are now included in semgrep config CF-1809 * fix: semgrep rules updated CF-1809
1 parent ee1b0e6 commit c62cd20

File tree

16 files changed

+466
-79
lines changed

16 files changed

+466
-79
lines changed

‎.codacy/codacy.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,4 +13,4 @@ tools:
1313
- [email protected]
1414
- [email protected]
1515
- [email protected]
16-
- trivy@0.65.0
16+
- trivy@0.66.0

‎cmd/init_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ func TestConfigFileTemplate(t *testing.T) {
2525
"[email protected]",
2626
"[email protected]",
2727
"[email protected]",
28-
"trivy@0.65.0",
28+
"trivy@0.66.0",
2929
"[email protected]",
3030
"[email protected]",
3131
},

‎codacy-client/client.go‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -172,12 +172,29 @@ func parsePatternConfigurations(response []byte) ([]domain.PatternConfiguration,
172172

173173
// GetDefaultToolPatternsConfig fetches the default patterns for a tool
174174
func GetDefaultToolPatternsConfig(initFlags domain.InitFlags, toolUUID string, onlyEnabledPatterns bool) ([]domain.PatternConfiguration, error) {
175-
baseURL := fmt.Sprintf("%s/api/v3/tools/%s/patterns", CodacyApiBase, toolUUID)
175+
return GetDefaultToolPatternsConfigWithCodacyAPIBase(CodacyApiBase, initFlags, toolUUID, onlyEnabledPatterns)
176+
}
177+
178+
// GetDefaultToolPatternsConfigWithCodacyAPIBase fetches the default patterns for a tool, and a base api url
179+
func GetDefaultToolPatternsConfigWithCodacyAPIBase(codacyAPIBaseURL string, initFlags domain.InitFlags, toolUUID string, onlyEnabledPatterns bool) ([]domain.PatternConfiguration, error) {
180+
baseURL := fmt.Sprintf("%s/api/v3/tools/%s/patterns", codacyAPIBaseURL, toolUUID)
176181
if onlyEnabledPatterns {
177182
baseURL += "?enabled=true"
178183
}
179184

180-
return getAllPages(baseURL, initFlags, parseDefaultPatternConfigurations)
185+
allPaterns, err := getAllPages(baseURL, initFlags, parseDefaultPatternConfigurations)
186+
if err != nil {
187+
return nil, err
188+
}
189+
190+
onlyRecommendedPatterns := make([]domain.PatternConfiguration, 0)
191+
for _, pattern := range allPaterns {
192+
if pattern.PatternDefinition.Enabled {
193+
onlyRecommendedPatterns = append(onlyRecommendedPatterns, pattern)
194+
}
195+
}
196+
197+
return onlyRecommendedPatterns, nil
181198
}
182199

183200
// GetRepositoryToolPatterns fetches the patterns for a tool in a repository

‎codacy-client/client_test.go‎

Lines changed: 52 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package codacyclient
22

33
import (
44
"encoding/json"
5+
"fmt"
56
"net/http"
67
"net/http/httptest"
78
"testing"
@@ -100,15 +101,55 @@ func TestGetDefaultToolPatternsConfig_Empty(t *testing.T) {
100101
}))
101102
defer ts.Close()
102103

103-
// TODO: Refactor GetDefaultToolPatternsConfig to accept a baseURL for easier testing
104-
// oldBase := CodacyApiBase
105-
// CodacyApiBase = ts.URL
106-
// defer func() { CodacyApiBase = oldBase }()
107-
108-
// Placeholder: test cannot be run until function is refactored for testability
109-
_ = ts // avoid unused warning
110-
// initFlags := domain.InitFlags{ApiToken: "dummy"}
111-
// patterns, err := GetDefaultToolPatternsConfig(initFlags, "tool-uuid")
112-
// assert.NoError(t, err)
113-
// assert.Empty(t, patterns)
104+
CodacyApiBase = ts.URL
105+
106+
initFlags := domain.InitFlags{ApiToken: "dummy"}
107+
patterns, err := GetDefaultToolPatternsConfigWithCodacyAPIBase(CodacyApiBase, initFlags, "tool-uuid", true)
108+
assert.NoError(t, err)
109+
assert.Empty(t, patterns)
110+
}
111+
112+
func TestGetDefaultToolPatternsConfig_WithNonRecommended(t *testing.T) {
113+
114+
config := []domain.PatternDefinition{
115+
{
116+
Id: "internal_id_1",
117+
Enabled: true,
118+
},
119+
{
120+
Id: "internal_id_2",
121+
Enabled: false,
122+
},
123+
}
124+
125+
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
126+
127+
resp := map[string]interface{}{
128+
"data": config,
129+
"pagination": map[string]interface{}{"cursor": ""},
130+
}
131+
w.Header().Set("Content-Type", "application/json")
132+
json.NewEncoder(w).Encode(resp)
133+
}))
134+
defer ts.Close()
135+
136+
expected := []domain.PatternConfiguration{
137+
{
138+
Enabled: true,
139+
PatternDefinition: domain.PatternDefinition{
140+
Id: "internal_id_1",
141+
Enabled: true,
142+
},
143+
},
144+
}
145+
146+
CodacyApiBase = ts.URL
147+
148+
initFlags := domain.InitFlags{ApiToken: "dummy"}
149+
patterns, err := GetDefaultToolPatternsConfigWithCodacyAPIBase(CodacyApiBase, initFlags, "tool-uuid", true)
150+
151+
fmt.Println(len(patterns))
152+
153+
assert.NoError(t, err)
154+
assert.Equal(t, expected, patterns)
114155
}

‎integration-tests/config-discover/expected/codacy.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,4 @@ tools:
1010
- [email protected]
1111
- [email protected]
1212
- [email protected]
13-
- trivy@0.65.0
13+
- trivy@0.66.0

‎integration-tests/config-discover/expected/tools-configs/semgrep.yaml‎

Lines changed: 43 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29501,6 +29501,43 @@ rules:
2950129501
}
2950229502
- focus-metavariable: $SECRET
2950329503
severity: WARNING
29504+
- id: terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec
29505+
languages:
29506+
- terraform
29507+
message: Provisioners are a tool of last resort and should be avoided where possible. Provisioner behavior cannot be mapped by Terraform as part of a plan, and execute arbitrary shell commands by design.
29508+
metadata:
29509+
category: security
29510+
confidence: HIGH
29511+
cwe:
29512+
- 'CWE-77: Improper Neutralization of Special Elements used in a Command (''Command Injection'')'
29513+
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
29514+
impact: MEDIUM
29515+
likelihood: HIGH
29516+
owasp:
29517+
- A03:2021 - Injection
29518+
- A01:2017 - Injection
29519+
references:
29520+
- https://developer.hashicorp.com/terraform/language/resources/provisioners/remote-exec
29521+
- https://developer.hashicorp.com/terraform/language/resources/provisioners/local-exec
29522+
subcategory:
29523+
- guardrail
29524+
technology:
29525+
- terraform
29526+
patterns:
29527+
- pattern-either:
29528+
- pattern: |
29529+
provisioner "remote-exec" {
29530+
...
29531+
}
29532+
- pattern: |
29533+
provisioner "local-exec" {
29534+
...
29535+
}
29536+
- pattern-inside: |
29537+
resource "aws_instance" "..." {
29538+
...
29539+
}
29540+
severity: WARNING
2950429541
- id: terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention
2950529542
languages:
2950629543
- hcl
@@ -34374,8 +34411,12 @@ rules:
3437434411
- A3:2017 Sensitive Data Exposure
3437534412
options:
3437634413
generic_ellipsis_max_span: 0
34377-
pattern: |
34378-
$PASSWORD VARCHAR2($LENGTH) := $...VALUE;
34414+
patterns:
34415+
- pattern: |
34416+
$PASSWORD VARCHAR2($LENGTH) := $...VALUE;
34417+
- metavariable-regex:
34418+
metavariable: $PASSWORD
34419+
regex: (?i).*(password|motdepasse|heslo|adgangskode|wachtwoord|salasana|passwort|passord|senha|geslo|clave|losenord|clave|parola|secret|pwd).*
3437934420
severity: ERROR
3438034421
- id: codacy.generic.plsql.resource-injection
3438134422
languages:

‎integration-tests/init-with-token/expected/codacy.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,4 @@ tools:
88
- [email protected]
99
- [email protected]
1010
- [email protected]
11-
- trivy@0.65.0
11+
- trivy@0.66.0

‎integration-tests/init-with-token/expected/tools-configs/semgrep.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,22 @@
11
rules:
2+
- id: bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command
3+
languages:
4+
- bash
5+
message: Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper bash array.
6+
metadata:
7+
category: correctness
8+
technology:
9+
- bash
10+
patterns:
11+
- pattern-either:
12+
- pattern: |
13+
... ${$VAR} ...
14+
- pattern: |
15+
... ...${$VAR}... ...
16+
- metavariable-regex:
17+
metavariable: $VAR
18+
regex: '[*@0-9]|[A-Za-z].*'
19+
severity: INFO
220
- id: clojure.lang.security.use-of-md5.use-of-md5
321
languages:
422
- clojure
@@ -30,6 +48,19 @@ rules:
3048
- pattern: (java.security.MessageDigest/getInstance MessageDigestAlgorithms/MD5)
3149
- pattern: (java.security.MessageDigest/getInstance org.apache.commons.codec.digest.MessageDigestAlgorithms/MD5)
3250
severity: WARNING
51+
- fix: Bitwise.bnot($VAL)
52+
id: elixir.lang.best-practice.deprecated-bnot-operator.deprecated_bnot_operator
53+
languages:
54+
- elixir
55+
message: The bitwise operator (`^^^`) is already deprecated. Please use `Bitwise.bnot($VAL)` instead.
56+
metadata:
57+
category: best-practice
58+
references:
59+
- https://github.com/elixir-lang/elixir/commit/f1b9d3e818e5bebd44540f87be85979f24b9abfc
60+
technology:
61+
- elixir
62+
pattern: ~~~$VAL
63+
severity: WARNING
3364
- id: codacy.generic.plsql.empty-strings
3465
languages:
3566
- generic

‎integration-tests/init-without-token/expected/codacy.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,4 +12,4 @@ tools:
1212
- [email protected]
1313
- [email protected]
1414
- [email protected]
15-
- trivy@0.65.0
15+
- trivy@0.66.0

‎integration-tests/init-without-token/expected/tools-configs/semgrep.yaml‎

Lines changed: 43 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29501,6 +29501,43 @@ rules:
2950129501
}
2950229502
- focus-metavariable: $SECRET
2950329503
severity: WARNING
29504+
- id: terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec
29505+
languages:
29506+
- terraform
29507+
message: Provisioners are a tool of last resort and should be avoided where possible. Provisioner behavior cannot be mapped by Terraform as part of a plan, and execute arbitrary shell commands by design.
29508+
metadata:
29509+
category: security
29510+
confidence: HIGH
29511+
cwe:
29512+
- 'CWE-77: Improper Neutralization of Special Elements used in a Command (''Command Injection'')'
29513+
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
29514+
impact: MEDIUM
29515+
likelihood: HIGH
29516+
owasp:
29517+
- A03:2021 - Injection
29518+
- A01:2017 - Injection
29519+
references:
29520+
- https://developer.hashicorp.com/terraform/language/resources/provisioners/remote-exec
29521+
- https://developer.hashicorp.com/terraform/language/resources/provisioners/local-exec
29522+
subcategory:
29523+
- guardrail
29524+
technology:
29525+
- terraform
29526+
patterns:
29527+
- pattern-either:
29528+
- pattern: |
29529+
provisioner "remote-exec" {
29530+
...
29531+
}
29532+
- pattern: |
29533+
provisioner "local-exec" {
29534+
...
29535+
}
29536+
- pattern-inside: |
29537+
resource "aws_instance" "..." {
29538+
...
29539+
}
29540+
severity: WARNING
2950429541
- id: terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention
2950529542
languages:
2950629543
- hcl
@@ -34374,8 +34411,12 @@ rules:
3437434411
- A3:2017 Sensitive Data Exposure
3437534412
options:
3437634413
generic_ellipsis_max_span: 0
34377-
pattern: |
34378-
$PASSWORD VARCHAR2($LENGTH) := $...VALUE;
34414+
patterns:
34415+
- pattern: |
34416+
$PASSWORD VARCHAR2($LENGTH) := $...VALUE;
34417+
- metavariable-regex:
34418+
metavariable: $PASSWORD
34419+
regex: (?i).*(password|motdepasse|heslo|adgangskode|wachtwoord|salasana|passwort|passord|senha|geslo|clave|losenord|clave|parola|secret|pwd).*
3437934420
severity: ERROR
3438034421
- id: codacy.generic.plsql.resource-injection
3438134422
languages:

0 commit comments

Comments
 (0)