Add genai command for interacting with LLMs for generating IaC files

[santoshkal]

Adds Genai command to interact with LLM Backends and generate IaC files

[dryrunsecurity]

DryRun Security Summary

The pull request covers a wide range of functionality related to a command-line application called "GenAI" that interacts with Large Language Models (LLMs) to generate secure infrastructure-as-code (IaC) configurations, with a focus on user input handling, configuration management, file integrity validation, dependency management, and secure coding practices.

Expand for full summary

Summary:

The code changes in this pull request cover a wide range of functionality related to a command-line application called "GenAI" that interacts with Large Language Models (LLMs) to generate secure infrastructure-as-code (IaC) configurations. The changes include the addition of new commands, the management of LLM resources, the handling of user input and configuration, and the implementation of file integrity validation mechanisms.

From an application security perspective, the key areas that require careful review and consideration are:

1. User Input Handling: Ensure that all user-provided inputs, such as model, endpoint, prompt, and system prompt, are properly sanitized and validated to prevent potential injection attacks.
2. Configuration Management: Verify that sensitive information, like API keys and endpoints, are stored and managed securely, and that the configuration loading process is robust and secure.
3. File Integrity Validation: Review the implementation of the file integrity validation mechanisms to ensure that the remote file URLs are trusted and that the downloaded files are properly verified for authenticity and integrity.
4. Dependency Management: Closely monitor the dependencies used in the application, especially the third-party libraries, to ensure that they are up-to-date and do not introduce any known vulnerabilities.
5. Secure Coding Practices: Ensure that the application follows secure coding practices throughout, such as proper error handling, secure file I/O operations, and the secure integration with external services.

Files Changed:

• cmd/genai.go: This file handles user input and configuration for the "genai" command-line application. Ensure that all user-provided inputs are properly sanitized and validated.
• .gitignore: The changes to the .gitignore file should be reviewed to ensure that no important or sensitive files are being ignored unintentionally.
• cmd/genai_gendoc.go: This file introduces a new "gendoc" command that generates code explanation documents. Review the input validation and file handling mechanisms to prevent potential security vulnerabilities.
• cmd/genai_init.go: This file adds a new "genaiInitCmd" command to initialize the GenAI configurations. Ensure that the DownloadLLMResources() function is implemented securely.
• go.mod: The changes to the project dependencies should be reviewed to ensure that the new dependencies are from trusted sources and do not introduce any known vulnerabilities.
• demos/notes.md: The hardcoded secrets and the generation of sensitive content should be carefully reviewed and addressed to ensure the overall security of the system.
• deploy.json: The Kubernetes Deployment configuration should be reviewed to ensure that appropriate security measures, such as resource limits and network policies, are in place.
• cmd/regx.go: The implementation of the regex-based scanning utility should be reviewed to ensure that the regex patterns are not vulnerable to ReDoS attacks and that the output handling is secure.
• llm/common.go: The use of hardcoded paths and URLs should be reviewed and, if possible, replaced with more flexible and secure alternatives.
• llm/README.md: The configuration options for the LLM should be carefully reviewed to ensure that they are properly secured and validated.
• llm/assistant.go: The file path handling and input validation mechanisms should be reviewed to prevent potential file path traversal vulnerabilities.
• llm/llm-utils.go: The GitHub API usage and the file I/O operations should be reviewed to ensure that they are implemented securely.
• llm/types.go: The handling of sensitive information, such as API keys, should be reviewed to ensure that they are properly secured and managed.
• pkg/regx/regx.go: The regex-based scanning utility should be reviewed to ensure that the regex patterns are not vulnerable to ReDoS attacks and that the error handling is robust.
• templates/defaultpolicies/genai/charan-config.yaml: The hardcoded API keys and the overall configuration should be reviewed to ensure that sensitive information is properly secured.
• templates/defaultpolicies/genai/config.yaml: The API key exposure and the input validation mechanisms should be reviewed to address potential security concerns.
• templates/defaultpolicies/genai/new-config.yaml: The hardcoded API key and the configuration parameters should be reviewed to ensure that they are properly secured and validated.
• templates/defaultpolicies/genai/updated-config.yaml: The API key exposure and the prompt file security should be addressed to mitigate potential security risks.
• `templates/

Code Analysis

We ran 9 analyzers against 22 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	2 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.