remediate files & packages

Author: Devils-Knight

main.go

@@ -11,6 +11,11 @@ import (
 	"github.com/aws/aws-lambda-go/lambda"
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/dynamodb"
+	"github.com/step-security/secure-workflows/remediation/dependabot"
+	"github.com/step-security/secure-workflows/remediation/docker"
+	"github.com/step-security/secure-workflows/remediation/secrets"
+	"github.com/step-security/secure-workflows/remediation/workflow"
+	"github.com/step-security/secure-workflows/remediation/workflow/permissions"
 )
 
 type Handler struct {
@@ -42,7 +47,7 @@ func (h Handler) Invoke(ctx context.Context, req []byte) ([]byte, error) {
 		if strings.Contains(httpRequest.RawPath, "/secrets") {
 			if httpRequest.RequestContext.HTTP.Method == "GET" {
 				authHeader := httpRequest.Headers["authorization"]
-				githubWorkflowSecrets, err := GetSecrets(httpRequest.QueryStringParameters, authHeader, dynamoDbSvc)
+				githubWorkflowSecrets, err := secrets.GetSecrets(httpRequest.QueryStringParameters, authHeader, dynamoDbSvc)
 				if err != nil {
 					response = events.APIGatewayProxyResponse{
 						StatusCode: http.StatusInternalServerError,
@@ -58,7 +63,7 @@ func (h Handler) Invoke(ctx context.Context, req []byte) ([]byte, error) {
 
 			} else if httpRequest.RequestContext.HTTP.Method == "PUT" {
 				authHeader := httpRequest.Headers["authorization"]
-				githubWorkflowSecrets, err := InitSecrets(httpRequest.Body, authHeader, dynamoDbSvc)
+				githubWorkflowSecrets, err := secrets.InitSecrets(httpRequest.Body, authHeader, dynamoDbSvc)
 				if err != nil {
 					response = events.APIGatewayProxyResponse{
 						StatusCode: http.StatusInternalServerError,
@@ -73,7 +78,7 @@ func (h Handler) Invoke(ctx context.Context, req []byte) ([]byte, error) {
 				}
 
 			} else if httpRequest.RequestContext.HTTP.Method == "POST" {
-				err := SetSecrets(httpRequest.Body, dynamoDbSvc)
+				err := secrets.SetSecrets(httpRequest.Body, dynamoDbSvc)
 				if err != nil {
 					response = events.APIGatewayProxyResponse{
 						StatusCode: http.StatusInternalServerError,
@@ -86,7 +91,7 @@ func (h Handler) Invoke(ctx context.Context, req []byte) ([]byte, error) {
 				}
 			} else if httpRequest.RequestContext.HTTP.Method == "DELETE" {
 				authHeader := httpRequest.Headers["authorization"]
-				err := DeleteSecrets(authHeader, dynamoDbSvc)
+				err := secrets.DeleteSecrets(authHeader, dynamoDbSvc)
 				if err != nil {
 					response = events.APIGatewayProxyResponse{
 						StatusCode: http.StatusInternalServerError,
@@ -107,9 +112,9 @@ func (h Handler) Invoke(ctx context.Context, req []byte) ([]byte, error) {
 			// if owner is set, assuming that repo, path are also set
 			// get the workflow using API
 			if _, ok := queryStringParams["owner"]; ok {
-				inputYaml, err = GetGitHubWorkflowContents(httpRequest.QueryStringParameters)
+				inputYaml, err = workflow.GetGitHubWorkflowContents(httpRequest.QueryStringParameters)
 				if err != nil {
-					fixResponse := &SecureWorkflowReponse{WorkflowFetchError: true, HasErrors: true}
+					fixResponse := &permissions.SecureWorkflowReponse{WorkflowFetchError: true, HasErrors: true}
 					output, _ := json.Marshal(fixResponse)
 					response = events.APIGatewayProxyResponse{
 						StatusCode: http.StatusOK,
@@ -123,7 +128,7 @@ func (h Handler) Invoke(ctx context.Context, req []byte) ([]byte, error) {
 				inputYaml = httpRequest.Body
 			}
 
-			fixResponse, err := SecureWorkflow(httpRequest.QueryStringParameters, inputYaml, dynamoDbSvc)
+			fixResponse, err := workflow.SecureWorkflow(httpRequest.QueryStringParameters, inputYaml, dynamoDbSvc)
 
 			if err != nil {
 				response = events.APIGatewayProxyResponse{
@@ -148,9 +153,9 @@ func (h Handler) Invoke(ctx context.Context, req []byte) ([]byte, error) {
 			// if owner is set, assuming that repo, path are also set
 			// get the dockerfile using API
 			if _, ok := queryStringParams["owner"]; ok {
-				dockerFile, err = GetGitHubWorkflowContents(httpRequest.QueryStringParameters)
+				dockerFile, err = workflow.GetGitHubWorkflowContents(httpRequest.QueryStringParameters)
 				if err != nil {
-					fixResponse := &SecureDockerfileResponse{DockerfileFetchError: true}
+					fixResponse := &docker.SecureDockerfileResponse{DockerfileFetchError: true}
 					output, _ := json.Marshal(fixResponse)
 					response = events.APIGatewayProxyResponse{
 						StatusCode: http.StatusOK,
@@ -164,7 +169,7 @@ func (h Handler) Invoke(ctx context.Context, req []byte) ([]byte, error) {
 				dockerFile = httpRequest.Body
 			}
 
-			fixResponse, err := SecureDockerFile(dockerFile)
+			fixResponse, err := docker.SecureDockerFile(dockerFile)
 			if err != nil {
 				response = events.APIGatewayProxyResponse{
 					StatusCode: http.StatusInternalServerError,
@@ -186,7 +191,7 @@ func (h Handler) Invoke(ctx context.Context, req []byte) ([]byte, error) {
 			updateDependabotConfigRequest := ""
 			updateDependabotConfigRequest = httpRequest.Body
 
-			fixResponse, err := UpdateDependabotConfig(updateDependabotConfigRequest)
+			fixResponse, err := dependabot.UpdateDependabotConfig(updateDependabotConfigRequest)
 			if err != nil {
 				response = events.APIGatewayProxyResponse{
 					StatusCode: http.StatusInternalServerError,

dependabotconfig.go renamed to remediation/dependabot/dependabotconfig.go

@@ -1,4 +1,4 @@
-package main
+package dependabot
 
 import (
 	"bufio"

dependabotconfig_test.go renamed to remediation/dependabot/dependabotconfig_test.go

@@ -1,4 +1,4 @@
-package main
+package dependabot
 
 import (
 	"encoding/json"
@@ -10,8 +10,8 @@ import (
 
 func TestConfigDependabotFile(t *testing.T) {
 
-	const inputDirectory = "./testfiles/dependabotfiles/input"
-	const outputDirectory = "./testfiles/dependabotfiles/output"
+	const inputDirectory = "../../testfiles/dependabotfiles/input"
+	const outputDirectory = "../../testfiles/dependabotfiles/output"
 
 	tests := []struct {
 		fileName   string

securedockerfile.go renamed to remediation/docker/securedockerfile.go

@@ -1,7 +1,8 @@
-package main
+package docker
 
 import (
 	"fmt"
+	"net/http"
 	"strings"
 
 	"github.com/asottile/dockerfile"
@@ -10,6 +11,8 @@ import (
 	"github.com/google/go-containerregistry/pkg/v1/remote"
 )
 
+var Tr http.RoundTripper = remote.DefaultTransport
+
 type SecureDockerfileResponse struct {
 	OriginalInput        string
 	FinalOutput          string

securedockerfile_test.go renamed to remediation/docker/securedockerfile_test.go

@@ -1,4 +1,4 @@
-package main
+package docker
 
 import (
 	"io/ioutil"
@@ -9,12 +9,12 @@ import (
 	"github.com/jarcoal/httpmock"
 )
 
-var resp = httpmock.File("./testfiles/dockerfiles/response.json").String()
+var resp = httpmock.File("../../testfiles/dockerfiles/response.json").String()
 
 func TestSecureDockerFile(t *testing.T) {
 
-	const inputDirectory = "./testfiles/dockerfiles/input"
-	const outputDirectory = "./testfiles/dockerfiles/output"
+	const inputDirectory = "../../testfiles/dockerfiles/input"
+	const outputDirectory = "../../testfiles/dockerfiles/output"
 	// NOTE: http mocking is not working,
 	// need to investigate this issue
 	httpmock.Activate()

secrets.go renamed to remediation/secrets/secrets.go

@@ -1,4 +1,4 @@
-package main
+package secrets
 
 import (
 	"context"

secrets_test.go renamed to remediation/secrets/secrets_test.go

@@ -1,4 +1,4 @@
-package main
+package secrets
 
 import (
 	"reflect"

addaction.go renamed to remediation/workflow/hardenrunner/addaction.go

@@ -1,14 +1,21 @@
-package main
+package hardenrunner
 
 import (
 	"fmt"
 	"strings"
 
+	metadata "github.com/step-security/secure-workflows/remediation/workflow/metadata"
+	"github.com/step-security/secure-workflows/remediation/workflow/permissions"
 	"gopkg.in/yaml.v3"
 )
 
+const (
+	HardenRunnerActionPath = "step-security/harden-runner"
+	HardenRunnerActionName = "Harden Runner"
+)
+
 func AddAction(inputYaml, action string) (string, bool, error) {
-	workflow := Workflow{}
+	workflow := metadata.Workflow{}
 	updated := false
 	err := yaml.Unmarshal([]byte(inputYaml), &workflow)
 	if err != nil {
@@ -18,7 +25,7 @@ func AddAction(inputYaml, action string) (string, bool, error) {
 
 	for jobName, job := range workflow.Jobs {
 		// Skip adding action for reusable jobs
-		if IsCallingReusableWorkflow(job) {
+		if metadata.IsCallingReusableWorkflow(job) {
 			continue
 		}
 		alreadyPresent := false
@@ -49,9 +56,9 @@ func addAction(inputYaml, jobName, action string) (string, error) {
 		return "", fmt.Errorf("unable to parse yaml %v", err)
 	}
 
-	jobNode := iterateNode(&t, jobName, "!!map", 0)
+	jobNode := permissions.IterateNode(&t, jobName, "!!map", 0)
 
-	jobNode = iterateNode(&t, "steps", "!!seq", jobNode.Line)
+	jobNode = permissions.IterateNode(&t, "steps", "!!seq", jobNode.Line)
 
 	if jobNode == nil {
 		return "", fmt.Errorf("jobName %s not found in the input yaml", jobName)

addaction_test.go renamed to remediation/workflow/hardenrunner/addaction_test.go

@@ -1,4 +1,4 @@
-package main
+package hardenrunner
 
 import (
 	"io/ioutil"
@@ -11,8 +11,8 @@ func TestAddAction(t *testing.T) {
 		inputYaml string
 		action    string
 	}
-	const inputDirectory = "./testfiles/addaction/input"
-	const outputDirectory = "./testfiles/addaction/output"
+	const inputDirectory = "../../../testfiles/addaction/input"
+	const outputDirectory = "../../../testfiles/addaction/output"
 	tests := []struct {
 		name        string
 		args        args

issue.go renamed to remediation/workflow/issue.go

@@ -1,4 +1,4 @@
-package main
+package workflow
 
 import (
 	"context"
@@ -7,6 +7,7 @@ import (
 	"strings"
 
 	"github.com/google/go-github/v40/github"
+	metadata "github.com/step-security/secure-workflows/remediation/workflow/metadata"
 	"golang.org/x/oauth2"
 )
 
@@ -22,7 +23,7 @@ func CreateIssue(Action string) (int, error) {
 	// is action
 	if len(Action) > 0 {
 		// is kb not found
-		_, err := GetActionKnowledgeBase(Action)
+		_, err := metadata.GetActionKnowledgeBase(Action)
 
 		if err != nil {
 			// does issue already exist?