Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Handle binary values in YAML files #223

Merged
merged 4 commits into from
Sep 4, 2019
Merged

Commits on Aug 21, 2019

  1. Handle binary values specially in yaml file parser

    This is step (1) in supporting binary in both YAML and non-
    YAML files.
    
    This makes it so that instead of immediately converting the
    base64-encoded binary into a binary value in python, we just
    interpret the binary as a normal string, but annotate it as
    such with the `is_binary` flag.
    
    This is needed so that plugins can scan a different value
    from the value hashed into baselines.
    Victor Zhou committed Aug 21, 2019
    Configuration menu
    Copy the full SHA
    0af82f6 View commit details
    Browse the repository at this point in the history

Commits on Aug 29, 2019

  1. Detect YAML binary secrets

    This implements support for high-entropy secrets in binary
    values in yaml files.
    
    We encode the binary value into a hex- or base64-encoded
    string (based on the plugin), and run the normal entropy
    check. If the string is deemed to be high-entropy, we re
    encode the string into a yaml binary (using `yaml.dump`)
    and strip the `!!binary`. This yaml binary is considered
    the secret, and is put into the baseline as normal.
    
    I had to update a test function so that it uses a custom
    hex high-entropy detector, since `HighEntropyStringsPlugin`
    is now an abstract class.
    Victor Zhou committed Aug 29, 2019
    1 Configuration menu
    Copy the full SHA
    e5e0b3c View commit details
    Browse the repository at this point in the history
  2. Don't enforce coverage for untestable line

    To test this you would need to import an unused class
    into the module so that it's in `globals()`, and have
    the test know what class that is. Seems messy to me,
    and not worth what it would be testing.
    Victor Zhou committed Aug 29, 2019
    1 Configuration menu
    Copy the full SHA
    869033d View commit details
    Browse the repository at this point in the history

Commits on Sep 4, 2019

  1. Change one variable name

    Victor Zhou committed Sep 4, 2019
    Configuration menu
    Copy the full SHA
    34a730d View commit details
    Browse the repository at this point in the history