Feature(#614): Challenge38 - Git notes challenge

[RemakingEden]

What kind of changes does this PR include?

• Fixes or refactors
• A new challenge
• Additional documentation
• Something else

Description

This is a challenge to teach users about leaking secrets via git notes.

Relations

Closes #614

https://blog.gitguardian.com/leaking-secrets-on-github-what-to-do/

Checklist:

• All the contributions made are solely the work of me and my co-authors
• I tested the changes in this PR (if applicable)
• I added unit tests to ensure my change works (when change in Java or on front-end code)
• The PR passes pre-commit hooks and automated tests

[RemakingEden]

@commjoen Weirdly Trufflehog and git secrets isnt picking the secrets in Git notes up. Do you know if this should be possible? It's hard to figure out definitively:

Ive tried:

• Ensure the secret matched a Trufflehog pattern such as an AWS key
• Created a pattern in Git secrets

It seems they are all looking in the committed files instead of the commits themselves.

[commjoen]

See the comments! Love the setup, but a few things need to change I guess (maybe sync the fork with this one?). I also cannot find teh notes at the commit. did you push all the notes like described in https://stackoverflow.com/questions/18268986/git-how-to-push-messages-added-by-git-notes-to-the-central-git-server ?

[RemakingEden]

@commjoen Okay so git notes have now been pushed. Unfortunately it seems they are very hard to work with. It is not possible to see them in Github and they dont automatically get fetched. You need to use the git fetch origin refs/notes/commits:refs/notes/commits command

[commjoen]

Hi @RemakingEden , thank you for the updates! can you please add the required unit test after applying the suggestions? See https://github.com/OWASP/wrongsecrets/blob/master/CONTRIBUTING.md#step-3-adding-test-file for more details.

[RemakingEden]

This is on hold due to some questions around how heavily Git Notes is used.

[commjoen]

Elligible for hacktoberfest-accepted label if timely finished in october

[commjoen]

Love this! Thank you!