feat(cedarling): initial implementation for cedarling #8691

sokorototo · 2024-06-10T16:04:15Z

Prepare

Read PR guidelines
Read license information

Description

Target issue

It doesn't close any issue, as this is new territory.

Implementation Details

Initial implementation for cedarling

Test and Document the changes

Static code analysis has been run locally and issues have been fixed
Relevant unit and integration tests have been added/updated
Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

dryrunsecurity · 2024-06-10T16:04:48Z

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security	Status	Findings
Configured Codepaths Analyzer	✅	0 findings
Secrets Analyzer	✅	0 findings
IDOR Analyzer	✅	0 findings
Sensitive Files Analyzer	✅	0 findings
Authn/Authz Analyzer	✅	0 findings
SQL Injection Analyzer	✅	0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖. Note that this summary is auto-generated and not meant to be a definitive list of security issues but rather a helpful summary from a security perspective.

Summary:

The changes in this GitHub pull request cover a wide range of files and functionality within the "jans-lock/cedarling" project. The key changes include:

Updates to the .gitignore file to exclude build artifacts, metadata, and IDE-specific files.
Addition of a new Rust crate called "cedarling" that is designed to work with WebAssembly (WASM) and various web-related APIs.
Modifications to the project's configuration file to specify the URL for fetching a policy schema file and configure the policy store.
Updates to the project's dependencies, including the addition of the "cedar-policy" crate and various other Rust libraries.
Changes to the project's code, including the implementation of utility functions for fetching the policy schema, making HTTP requests, and handling authorization decisions using the Cedar Policy framework.
Addition of new test cases, including one that fetches data from an external URL.

From an application security perspective, the key areas to focus on are:

Ensuring the security of external dependencies and libraries used in the project.
Properly validating and sanitizing user input, especially when making HTTP requests or handling authorization decisions.
Securing the communication and storage of sensitive data, such as the policy schema and authorization-related information.
Implementing robust error handling and logging mechanisms to detect and respond to potential security issues.

Overall, the changes appear to be focused on enhancing the functionality and reliability of the "cedarling" project, but it's important to carefully review the implementation and security implications of these changes to maintain the overall security posture of the application.

Files Changed:

jans-lock/cedarling/.gitignore: Updates to the .gitignore file to exclude build artifacts, metadata, and IDE-specific files.
jans-lock/cedarling/Cargo.toml: Addition of a new Rust crate called "cedarling" and updates to the project's dependencies.
jans-lock/cedarling/config.toml: Modifications to the project's configuration file to specify the URL for fetching a policy schema file and configure the policy store.
jans-lock/cedarling/Cargo.lock: Updates to the project's dependency versions and the addition of new dependencies.
jans-lock/cedarling/rustfmt.toml: Changes to the Rust code formatting configuration, including increasing the maximum line width.
jans-lock/cedarling/src/cedar.rs: Implementation of utility functions for managing the lifecycle of entities, policies, and the authorizer used in the Cedar policy engine.
jans-lock/cedarling/src/types.rs: Addition of new data structures, including "Tokens" and "Request", used in the project.
jans-lock/cedarling/src/lib.rs: Changes related to the initialization of the Cedar Policy framework, event source setup, and authorization logic.
jans-lock/cedarling/tests/fetch-schema.rs: Addition of a new test case for the utils::fetch_schema() function.
jans-lock/cedarling/src/utils.rs: Implementation of utility functions for making HTTP requests and fetching the policy schema.
jans-lock/cedarling/tests/get-str.rs: Addition of a new test case for the utils::get() function.

Powered by DryRun Security

nynymike

In the future we want smaller PR's.

sokorototo · 2024-06-10T18:39:46Z

In the future we want smaller PR's.

Yeah, will do

kdhttps

@sokorototo thanks for a initial code. It's looking good. It will good to add some test cases and README.md with setup, run test cases, and usage of library instructions.

kdhttps · 2024-06-11T08:46:44Z

jans-lock/cedarling/src/utils.rs

+	fn fetch_with_request_and_init(input: &Request, init: &RequestInit) -> js_sys::Promise;
+}
+
+pub async fn get_str(url: &str, _: &Tokens) -> Option<String> {


can we add unit test for get_str func?

kdhttps · 2024-06-11T08:47:32Z

jans-lock/cedarling/src/utils.rs

+	text.as_string()
+}
+
+pub async fn fetch_schema() -> cedar_policy::Schema {


it will be good to add a unit test for fetch_schema.

kdhttps · 2024-06-11T08:50:14Z

jans-lock/cedarling/tests/fetch-schema.rs

+#[wasm_bindgen_test]
+async fn test() {
+	let schema = utils::fetch_schema().await;
+	console_log!("Fetched Schema: {:?}", &schema)


Can we check the let schema with some values? Adding some assert() statements here will be good.

Oh it was a temporary test, just to make sure utils::fetch_schema was working. I will validate the data next!

kdhttps · 2024-06-11T08:51:29Z

jans-lock/cedarling/src/lib.rs

+}
+
+#[wasm_bindgen]
+pub async fn init(auth: JsValue, entities: Option<String>, policies: Option<String>) {


is it possible to add an integration test for lib.rs functions?

Yes, I can setup some unit tests for these.

sokorototo · 2024-06-11T12:45:21Z

@kdhttps do you mind merging this currently, and then creating a new issue for the unit tests? Otherwise the commit might get larger

…tatic data Signed-off-by: sokorototo <nyachiengatoto@gmail.com>

kdhttps · 2024-06-12T02:03:30Z

@kdhttps do you mind merging this currently, and then creating a new issue for the unit tests? Otherwise the commit might get larger

agreed

SafinWasi

Looks good to me. Once we have a basic POC, can you add a README on how to compile and run this locally?

sokorototo · 2024-06-12T16:28:01Z

agreed

You can create a new issue, I am sure to follow up!

feat(cedarling): initial implementation for cedarling

2069c7f

sokorototo requested a review from yurem as a code owner June 10, 2024 16:04

nynymike assigned nynymike and unassigned nynymike Jun 10, 2024

nynymike self-requested a review June 10, 2024 16:21

nynymike previously approved these changes Jun 10, 2024

View reviewed changes

nynymike requested review from SafinWasi and kdhttps June 10, 2024 19:44

kdhttps requested changes Jun 11, 2024

View reviewed changes

feat(jans-lock): implemented configurable policy-store loading from s…

109b82c

…tatic data Signed-off-by: sokorototo <nyachiengatoto@gmail.com>

sokorototo dismissed nynymike’s stale review via 109b82c June 11, 2024 20:01

kdhttps approved these changes Jun 12, 2024

View reviewed changes

Merge branch 'main' into main

221a5a1

SafinWasi approved these changes Jun 12, 2024

View reviewed changes

yurem approved these changes Jun 14, 2024

View reviewed changes

yurem merged commit 0a3c03d into JanssenProject:main Jun 14, 2024
8 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(cedarling): initial implementation for cedarling #8691

feat(cedarling): initial implementation for cedarling #8691

sokorototo commented Jun 10, 2024

dryrunsecurity bot commented Jun 10, 2024 •

edited

Loading

nynymike left a comment

sokorototo commented Jun 10, 2024

kdhttps left a comment

kdhttps Jun 11, 2024

sokorototo Jun 11, 2024

kdhttps Jun 11, 2024

kdhttps Jun 11, 2024

sokorototo Jun 11, 2024

kdhttps Jun 11, 2024

sokorototo Jun 11, 2024

sokorototo commented Jun 11, 2024

kdhttps commented Jun 12, 2024 •

edited

Loading

SafinWasi left a comment

sokorototo commented Jun 12, 2024

feat(cedarling): initial implementation for cedarling #8691

feat(cedarling): initial implementation for cedarling #8691

Conversation

sokorototo commented Jun 10, 2024

Prepare

Description

Target issue

Implementation Details

Test and Document the changes

dryrunsecurity bot commented Jun 10, 2024 • edited Loading

nynymike left a comment

Choose a reason for hiding this comment

sokorototo commented Jun 10, 2024

kdhttps left a comment

Choose a reason for hiding this comment

kdhttps Jun 11, 2024

Choose a reason for hiding this comment

sokorototo Jun 11, 2024

Choose a reason for hiding this comment

kdhttps Jun 11, 2024

Choose a reason for hiding this comment

kdhttps Jun 11, 2024

Choose a reason for hiding this comment

sokorototo Jun 11, 2024

Choose a reason for hiding this comment

kdhttps Jun 11, 2024

Choose a reason for hiding this comment

sokorototo Jun 11, 2024

Choose a reason for hiding this comment

sokorototo commented Jun 11, 2024

kdhttps commented Jun 12, 2024 • edited Loading

SafinWasi left a comment

Choose a reason for hiding this comment

sokorototo commented Jun 12, 2024

dryrunsecurity bot commented Jun 10, 2024 •

edited

Loading

kdhttps commented Jun 12, 2024 •

edited

Loading