-
Notifications
You must be signed in to change notification settings - Fork 11
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* implement git-diff scan This tool is meant for pull requests. It compares the current branch to a given target branch. The resulting file list will than be scaned via vaas. * adds a push of the git-scan image when releasing go this image will be the base for implementing the github action and the gitlab template
- Loading branch information
1 parent
49d94b7
commit ec89136
Showing
5 changed files
with
147 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,111 @@ | ||
| package main | ||
|
|
||
| import ( | ||
| "context" | ||
| "log" | ||
| "os" | ||
| "os/exec" | ||
| "path/filepath" | ||
| "strings" | ||
|
|
||
| "github.com/GDATASoftwareAG/vaas/golang/vaas/pkg/authenticator" | ||
| "github.com/GDATASoftwareAG/vaas/golang/vaas/pkg/messages" | ||
| "github.com/GDATASoftwareAG/vaas/golang/vaas/pkg/options" | ||
| "github.com/GDATASoftwareAG/vaas/golang/vaas/pkg/vaas" | ||
| ) | ||
|
|
||
| func main() { | ||
| if len(os.Args) < 3 { | ||
| log.Fatal("need 2 parameter: path, targetBranch") | ||
| } | ||
| path := os.Args[1] | ||
| if path == "" { | ||
| log.Fatal("no path set") | ||
| } | ||
|
|
||
| targetBranch := os.Args[2] | ||
| if targetBranch == "" { | ||
| log.Fatal("no targetBranch set") | ||
| } | ||
| remote := "" | ||
| if len(os.Args) > 3 { | ||
| remote = os.Args[3] | ||
| } | ||
| if remote == "" { | ||
| remote = "origin" | ||
| } | ||
|
|
||
| err := os.Chdir(path) | ||
| if err != nil { | ||
| log.Fatal(err) | ||
| } | ||
|
|
||
| clientID, exists := os.LookupEnv("CLIENT_ID") | ||
| if !exists { | ||
| log.Fatal("no Client ID set") | ||
| } | ||
| clientSecret, exists := os.LookupEnv("CLIENT_SECRET") | ||
| if !exists { | ||
| log.Fatal("no Client Secret set") | ||
| } | ||
| vaasUrl, exists := os.LookupEnv("VAAS_URL") | ||
| if !exists { | ||
| vaasUrl = "wss://gateway.production.vaas.gdatasecurity.de/" | ||
| } | ||
| tokenUrl, exists := os.LookupEnv("TOKEN_URL") | ||
| if !exists { | ||
| tokenUrl = "https://account.gdata.de/realms/vaas-production/protocol/openid-connect/token" | ||
| } | ||
|
|
||
| gitRevParseCommand := exec.Command("git", "rev-parse", "--show-toplevel") | ||
| rootDirectoryBytes, err := gitRevParseCommand.Output() | ||
| if err != nil { | ||
| log.Fatal("git rev-parse", err) | ||
| } | ||
| rootDirectory := strings.Split(strings.ReplaceAll(string(rootDirectoryBytes), "\r\n", "\n"), "\n")[0] | ||
|
|
||
| exec.Command("git", "fetch", remote, targetBranch) | ||
| gitDiffCommand := exec.Command("git", "diff", "--name-only", targetBranch) | ||
| diffBytes, err := gitDiffCommand.Output() | ||
| if err != nil { | ||
| log.Fatal("git diff", err) | ||
| } | ||
| files := strings.Split(strings.ReplaceAll(string(diffBytes), "\r\n", "\n"), "\n") | ||
| if len(files) < 1 { | ||
| log.Println("no changed files found in diff") | ||
| os.Exit(0) | ||
| } | ||
|
|
||
| authenticator := authenticator.New(clientID, clientSecret, tokenUrl) | ||
|
|
||
| vaas := vaas.New(options.DefaultOptions(), vaasUrl) | ||
| ctx, webSocketCancel := context.WithCancel(context.Background()) | ||
| termChan, err := vaas.Connect(ctx, authenticator) | ||
| if err != nil { | ||
| log.Fatal("vaas connect error", err) | ||
| } | ||
| if termChan == nil { | ||
| log.Fatal("vaas connect error") | ||
| } | ||
| var maliciousFileFound bool | ||
| for _, file := range files { | ||
| if file != "" { | ||
| pathToFile := filepath.Join(rootDirectory, file) | ||
| verdict, err := vaas.ForFile(context.Background(), pathToFile) | ||
| if err != nil { | ||
| log.Fatalln(err) | ||
| } | ||
| log.Println(pathToFile + ": " + string(verdict.Verdict)) | ||
| if verdict.Verdict == messages.Malicious { | ||
| maliciousFileFound = true | ||
| } | ||
| } | ||
| } | ||
| webSocketCancel() | ||
| if err = <-termChan; err != nil { | ||
| log.Printf("Websocket shutdown with an error - %v", err) | ||
| } | ||
| if maliciousFileFound { | ||
| os.Exit(1) | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| FROM ubuntu:22.04 as runner | ||
|
|
||
| RUN apt update && apt install -y git | ||
| WORKDIR /app | ||
|
|
||
| FROM golang:1.22 as builder | ||
|
|
||
| COPY . . | ||
| RUN go build -o /build/git-scan cmd/git-scan/main.go | ||
|
|
||
| FROM runner | ||
| COPY --from=builder /build/git-scan /app/git-scan | ||
| ENTRYPOINT ["/app/git-scan"] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters