Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add option to allow Emojis in log output #1032

Merged
merged 4 commits into from
Oct 23, 2024
Merged

Conversation

attiasas
Copy link
Contributor

@attiasas attiasas commented Oct 23, 2024

  • All tests passed. If this feature is not already covered by the tests, I added new tests.
  • All static analysis checks passed.
  • This pull request is on the dev branch.
  • I used gofmt for formatting the code before submitting the pull request.

Add option for the logger not to remove Emojis.

@attiasas attiasas added safe to test Approve running integration tests on a pull request improvement Automatically generated release notes labels Oct 23, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Oct 23, 2024
@attiasas attiasas added the safe to test Approve running integration tests on a pull request label Oct 23, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Oct 23, 2024
@eyalbe4 eyalbe4 added the safe to test Approve running integration tests on a pull request label Oct 23, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Oct 23, 2024
Copy link
Contributor

@eyalbe4 eyalbe4 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's add a unit test for the new functionality.

@attiasas attiasas added the safe to test Approve running integration tests on a pull request label Oct 23, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Oct 23, 2024
@attiasas attiasas requested a review from eyalbe4 October 23, 2024 11:43
Copy link
Contributor

🚨 Frogbot scanned this pull request and found the below:


Copy link
Contributor

{
		User: "admin",
		Auth: []ssh.AuthMethod{
			sshAuth,
		},
		//#nosec G106 -- Used to get ssh headers only.
		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
	}

at auth/sshlogin.go (line 67)

🎯 Static Application Security Testing (SAST) Vulnerability

Severity Finding

Low
SSH key not verified properly, expired certificates may be accepted
Full description

Overview

SSH Keys Past Expiration is a vulnerability that occurs when SSH keys
used for authentication have expired. Expired keys can lead to
unauthorized access to systems and sensitive data, posing a security
risk to the organization.

Vulnerable example

package main

import (
    "golang.org/x/crypto/ssh"
    "net"
)

func main() {}

func insecureIgnoreHostKey() {
    _ = &ssh.ClientConfig{
        User:            "username",
        Auth:            []ssh.AuthMethod{nil},
        HostKeyCallback: ssh.InsecureIgnoreHostKey(),
    }
}

In this example, the InsecureIgnoreHostKey function is used to ignore
host key verification, which can lead to accepting expired or invalid
keys.

Remediation

package main

import (
    "golang.org/x/crypto/ssh"
    "net"
)

func main() {}

func secureHostKeyCallback() {
    publicKeyBytes, _ := ioutil.ReadFile("allowed_hostkey.pub")
    publicKey, _ := ssh.ParsePublicKey(publicKeyBytes)

    _ = &ssh.ClientConfig{
        User:            "username",
        Auth:            []ssh.AuthMethod{nil},
        HostKeyCallback: ssh.FixedHostKey(publicKey),
    }
}

By using allowed host keys and proper host key verification, we can
mitigate the risk of accepting expired or invalid SSH keys.


@eyalbe4 eyalbe4 merged commit 6613bb5 into jfrog:dev Oct 23, 2024
15 of 24 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
improvement Automatically generated release notes
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants