Add audit result view #205

OiCMudkips · 2019-07-02T23:00:44Z

Implements #191

As of writing this only shows hashed secrets. I'll update this once I get plaintext secrets and git repo info shown in the results.

OiCMudkips · 2019-07-02T23:52:24Z

I ran this branch against the detect-secrets repo and got these results: https://i.fluffy.cc/pWlPvpGl4Hz0jl4PGkcxrV3GMcB64CTv.html

If you look at baseline.txt you'll notice 2 audited secrets (i.e. have a is_secret attribute) and then in display-results output.txt the 2 secrets are marked as positive/negative and the rest are unknown.

help_text.txt is the help text of audit with the new option.

KevinHock · 2019-07-02T23:56:48Z

detect_secrets/plugins/common/initialize.py

@@ -16,6 +11,7 @@
 from ..stripe import StripeDetector                         # noqa: F401
 from detect_secrets.core.log import log
 from detect_secrets.core.usage import PluginOptions
+from detect_secrets.plugins.common.util import get_mapping_from_secret_type_to_class_name


Nit: Since we use relative imports above, for within the plugins folder, so I think we can do from .util in this case

Changed as suggested

OiCMudkips · 2019-07-03T00:30:23Z

baseline.txt
display-results output.txt
help_text.txt

…uture use

OiCMudkips · 2019-07-03T22:49:38Z

Updated baseline (well this should be the same as before) and output:

display-results.txt
baseline.txt

OiCMudkips · 2019-07-05T21:55:12Z

New output:
display-results.txt

Note it has the SHA of the last commit of this PR!

KevinHock

lgtm

left some feedback/suggested changes but nothing major

KevinHock · 2019-07-05T22:01:46Z

detect_secrets/core/audit.py

+    Attempts to read a given line from the input file.
+    """
+    try:
+        with codecs.open(filename, encoding='utf-8') as file:


Super nit: We normally use f for file, as the latter is a keyword in python (weird highlighting on GitHub)

Good point, fixed

KevinHock · 2019-07-08T21:37:56Z

detect_secrets/core/audit.py

+    all_secrets = _secret_generator(baseline)
+
+    audit_results = {
+        'results': defaultdict(lambda: deepcopy(EMPTY_PLUGIN_AUDIT_RESULT)),


results feels a little redundant, e.g.

... }, "results": { "Base64HighEntropyString": { "config": { "base64_limit": 4.5, "name": "Base64HighEntropyString" }, "results": { "positive": [], ...

vs.

... }, "Base64HighEntropyString": { "config": { "base64_limit": 4.5, "name": "Base64HighEntropyString" }, "results": { "positive": [], ...

We could rename the key to plugins, but removing it as in the latter snippet seems okay to me since we will mostly use this for plugin development.

Great use of lambda btw 🐑

I'm OK with renaming it to plugins, but I think there needs to be a key. If we can get git config info we dump it into a key called repo_info on the top level. If the plugins were also at the top-level then it would be really annoying for clients to have to filter out the plugin results in iteration (assuming the client is a machine or jq).

KevinHock · 2019-07-08T21:54:01Z

detect_secrets/core/audit.py

+        'results': defaultdict(lambda: deepcopy(EMPTY_PLUGIN_AUDIT_RESULT)),
+    }
+
+    secret_type_mapping = get_mapping_from_secret_type_to_class_name()


This is more of a super nit, but maybe indicate what secret type is mapping to? similar to how the func is named e.g. secret_type_to_plugin_class

Sounds good, done.

KevinHock · 2019-07-08T22:06:49Z

tests/core/audit_test.py

+        ) as _mock:
+            yield _mock
+
+    def get_audited_baseline(self, plugin_config={}, is_secret=None):


Since plugin_config is always passed, afaict, I don't think you need the default value. (There's also the python gotcha w/ dict's as a default arg.)

Also you can do e.g. get_audited_baseline(plugin_config=foo, is_secret=True) rather than get_audited_baseline(foo,True) as it's a little more readable what the args are from seeing the call.

Makes sense, fixed

KevinHock · 2019-07-08T22:09:10Z

tests/core/audit_test.py

+        results = audit.determine_audit_results(baseline, '.secrets.baseline')
+
+        if plugin_config:
+            assert results['results']['HexHighEntropyString']['config'].items() \


Not sure if I follow, what does this comparison do?

This checks that the config in the test baseline is actually returned from determine_audit_results.

Also, I noticed the if plugin_config check doesn't really do anything useful, so I took it out.

* Rename a variable to be clearer per review comment * Change test fixure signature * Remove unneeded `if` from test

) Related to git-defenders/detect-secrets-stream#222 Supports git-defenders/detect-secrets-discuss#203

Supports git-defenders/detect-secrets-discuss#203 IBM Cloud IAM Api Key Validation (Yelp#201) Supports git-defenders/detect-secrets-discuss#203 Refactor IBM Cloud IAM verification for owner resolution reuse (Yelp#205) Related to git-defenders/detect-secrets-stream#222 Supports git-defenders/detect-secrets-discuss#203

OiCMudkips force-pushed the add_audit_result_view branch from 6c518be to ea965f8 Compare July 2, 2019 23:14

KevinHock reviewed Jul 2, 2019

View reviewed changes

Victor Zhou added 3 commits July 3, 2019 10:44

Move get_mapping_from_secret_type_to_class_name to its own file for f…

f6f994c

…uture use

Add skeleton for audit results view

d6ebaa5

Hook up audit display-results command in args parser

7ea0a22

OiCMudkips force-pushed the add_audit_result_view branch from 2ec25e4 to 7ea0a22 Compare July 3, 2019 17:47

OiCMudkips changed the title ~~WIP: Add audit result view~~ \Add audit result view Jul 5, 2019

OiCMudkips changed the title ~~\Add audit result view~~ Add audit result view Jul 5, 2019

OiCMudkips marked this pull request as ready for review July 5, 2019 21:55

KevinHock approved these changes Jul 8, 2019

View reviewed changes

Victor Zhou added 4 commits July 8, 2019 15:47

Show the plaintext in the audit results view

3266d71

Add helpers to get git repo SHA and remotes

1a24e2a

Add git repo info to audit results

733a600

Cleanup audit --display-results code and tests

69a109e

* Rename a variable to be clearer per review comment * Change test fixure signature * Remove unneeded `if` from test

OiCMudkips force-pushed the add_audit_result_view branch from 8856d3a to 69a109e Compare July 8, 2019 23:08

KevinHock approved these changes Jul 8, 2019

View reviewed changes

OiCMudkips merged commit d16ec18 into Yelp:master Jul 9, 2019

OiCMudkips mentioned this pull request Jul 9, 2019

Add an audit --display option #191

Closed

OiCMudkips deleted the add_audit_result_view branch July 9, 2019 22:52

killuazhu pushed a commit to killuazhu/detect-secrets that referenced this pull request Oct 28, 2019

Refactor IBM Cloud IAM verification for owner resolution reuse (Yelp#205

7258002

) Related to git-defenders/detect-secrets-stream#222 Supports git-defenders/detect-secrets-discuss#203

killuazhu pushed a commit to IBM/detect-secrets that referenced this pull request May 28, 2020

Refactor IBM Cloud IAM verification for owner resolution reuse (Yelp#205

04e5ab4

) Related to git-defenders/detect-secrets-stream#222 Supports git-defenders/detect-secrets-discuss#203

killuazhu pushed a commit to IBM/detect-secrets that referenced this pull request Jul 9, 2020

Refactor IBM Cloud IAM verification for owner resolution reuse (Yelp#205

013f609

) Related to git-defenders/detect-secrets-stream#222 Supports git-defenders/detect-secrets-discuss#203

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add audit result view #205

Add audit result view #205

OiCMudkips commented Jul 2, 2019

OiCMudkips commented Jul 2, 2019

KevinHock Jul 2, 2019

OiCMudkips Jul 3, 2019

OiCMudkips commented Jul 3, 2019

OiCMudkips commented Jul 3, 2019

OiCMudkips commented Jul 5, 2019

KevinHock left a comment

KevinHock Jul 5, 2019

OiCMudkips Jul 8, 2019

KevinHock Jul 8, 2019

KevinHock Jul 8, 2019

OiCMudkips Jul 8, 2019

KevinHock Jul 8, 2019

KevinHock Jul 8, 2019

OiCMudkips Jul 8, 2019

KevinHock Jul 8, 2019

OiCMudkips Jul 8, 2019

KevinHock Jul 8, 2019

OiCMudkips Jul 8, 2019

Add audit result view #205

Add audit result view #205

Conversation

OiCMudkips commented Jul 2, 2019

OiCMudkips commented Jul 2, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

OiCMudkips commented Jul 3, 2019

OiCMudkips commented Jul 3, 2019

OiCMudkips commented Jul 5, 2019

KevinHock left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment