Skip to content

Commit ba9fe40

Browse files
Dustin RogersDustin Rogers
Dustin Rogers
authored and
Dustin Rogers
committed
wiping commit history
0 parents  commit ba9fe40

12 files changed

+452
-0
lines changed

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
trufflehog_report.json
2+
somefilewithpasswords.txt
3+
__pycache__

‎CONTRIBUTING‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Contributions are welcome!

‎Dockerfile‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
2+
FROM ubuntu:18.04
3+
4+
RUN apt-get update && \
5+
apt-get install -y python3 python3-pip && \
6+
apt-get clean
7+
8+
COPY requirements.txt requirements.txt
9+
RUN pip3 install -r requirements.txt
10+
11+
COPY trufflehog_python.py /trufflehog_python.py
12+
13+
COPY entrypoint.sh /entrypoint.sh
14+
RUN chmod +x /entrypoint.sh
15+
ENTRYPOINT ["/entrypoint.sh"]
16+
17+
#ENTRYPOINT ["sh", "-c", "python3 /trufflehog_python.py --github=false --slack=false"]
18+

‎LICENSE‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
Copyright (c) 2021 Netlify.
2+
3+
Permission is hereby granted, free of charge, to any person obtaining
4+
a copy of this software and associated documentation files (the
5+
"Software"), to deal in the Software without restriction, including
6+
without limitation the rights to use, copy, modify, merge, publish,
7+
distribute, sublicense, and/or sell copies of the Software, and to
8+
permit persons to whom the Software is furnished to do so, subject to
9+
the following conditions:
10+
11+
The above copyright notice and this permission notice shall be
12+
included in all copies or substantial portions of the Software.
13+
14+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
15+
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
16+
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
17+
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
18+
CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
19+
TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
20+
SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

‎README.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
```
2+
_,-""""-..__
3+
|`,-'_. ` ` `` `--'""".
4+
; ,' | `` ` ` ` ``` `.
5+
,-' ..-' ` ` `` ` `` ` ` |==.
6+
,' ^ ` ` `` ` ` `. ; \
7+
`}_,-^- _ . ` \ ` ` __ ` ; #
8+
`"---"' `-`. ` \---""`.`. `;
9+
\\` ; ; `. `,
10+
||`; / / | |
11+
jrei //_;` ,_;' ,_;"
12+
```
13+
# security-netlify-trufflehog-scanner
14+
This repository is meant to hold trufflehog secret-scanning utility
15+
16+
## Secret Scanning Automation
17+
Trufflehog (using `trufflehog3`) scans the Netlify code repos in github everyday by executing the script `trufflehog_python.py` as a github action. It will report any new findings to slack channel `#security-operations-alerts`.
18+
19+
trufflehog_arachni.py accepts to arguments
20+
--org , -o , the org to report on
21+
22+
### Suppressing Alerts
23+
To suppress alerts, add the `Commit Hash` or `SHA256` to the `suppressions` file, line-by-line, with an appropriate comment. PR and merge.
24+
25+
### Testing Locally
26+
- You will need to install `trufflehog3` using `pip`, and have it available in '/usr/local/bin/trufflehog3`
27+
- You will need to set the TRUFFLEHOG_SLACK_WEBHOOK env var.
28+
- You will need to set the TRUFFLEHOG_GH_ACCESS_TOKEN env var.
29+
30+
### TODO
31+
- Post daily HTML report as static Netlify site.
32+
- each string can be suppressed, currently the entire commit must be suppressed.
33+
- figure out `git LFS` problem on some of the repos
34+
35+
## Using `trufflehog-python.py` to Perform a Secret Scan
36+
Prerequisites - `trufflehog3` must be installed and available on your system.
37+
38+
### Running the scan
39+
Now we can run a scan. If you wish to see which parameters are being executed with `trufflehog3`, explore the script.
40+
41+
`python trufflehog-python.py --org netlify > /tmp/netlify_secrets.trufflelog`
42+
43+
### Create HTML report
44+
TBD

‎action.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: 'security-netlify-trufflehog-parse'
2+
description: 'python wrapped trufflehog scanner and report parser adding features like suppression handling'
3+
inputs:
4+
trufflehog_report_file_path:
5+
description: 'location of trufflehog report that will be parsed'
6+
required: true
7+
default: 'trufflehog_report.json'
8+
suppression_file_path: # id of input
9+
description: 'path/name of suppression list file'
10+
required: false
11+
default: 'suppressions-trufflehog'
12+
ignore_paths_file_path: # id of input
13+
description: 'path/name of paths-to-ignore list file'
14+
required: false
15+
default: 'ignore-paths-trufflehog'
16+
create_github_issue:
17+
description: 'boolean if user wishes to create github issues'
18+
required: false
19+
default: 'false'
20+
create_slack_notification:
21+
description: 'boolean if user wishes to create slack alert'
22+
required: false
23+
default: false
24+
secret_scan_slack_webhook:
25+
description: 'slack webhook, if desired'
26+
required: false
27+
default: ''
28+
secret_scan_gh_access_token:
29+
description: 'GH access token used to create issues'
30+
required: false
31+
default: ''
32+
github_repo_name:
33+
description: 'github repo name'
34+
required: false
35+
default: ''
36+
runs:
37+
using: 'docker'
38+
image: 'Dockerfile'
39+
args:
40+
- ${{ inputs.trufflehog_report_file_path }}
41+
- ${{ inputs.suppression_file_path }}
42+
- ${{ inputs.ignore_paths_file_path }}
43+
- ${{ inputs.create_github_issue }}
44+
- ${{ inputs.create_slack_notification }}
45+
env:
46+
SECRET_SCAN_SLACK_WEBHOOK: ${{ inputs.secret_scan_slack_webhook }}
47+
SECRET_SCAN_GH_ACCESS_TOKEN: ${{ inputs.secret_scan_gh_access_token }}
48+
GITHUB_REPO: ${{ inputs.github_repo_name }}
49+
branding:
50+
icon: 'life-buoy'
51+
color: 'white'

‎entrypoint.sh‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
#!/bin/bash
2+
3+
PARAMS_STRING=""
4+
5+
# ARG- Must Supply Trufflehog3 Report Path
6+
if [ ! -z "$1" ]
7+
then
8+
PARAMS_STRING+="--report-path=$1"
9+
fi
10+
11+
# ARG - Suppressions List File Path
12+
if [ ! -z "$2" ]
13+
then
14+
PARAMS_STRING+=" --suppressions-path=$2"
15+
fi
16+
17+
# ARG - Paths-to-Ingore List File Path
18+
if [ ! -z "$2" ]
19+
then
20+
PARAMS_STRING+=" --ignore-paths=$3"
21+
fi
22+
23+
# ARG - Create Github Issues Bool
24+
if [ ! -z "$3" ]
25+
then
26+
PARAMS_STRING+=" --github=$4"
27+
fi
28+
29+
# ARG - Create Slack Notifications Bool
30+
if [ ! -z "$5" ]
31+
then
32+
PARAMS_STRING+=" --slack=$5"
33+
fi
34+
35+
echo "$PARAMS_STRING"
36+
37+
#python3 trufflehog_python.py --report-path="trufflehog_report.json"
38+
python3 /trufflehog_python.py $PARAMS_STRING

‎ignore-paths-trufflehog-example‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
somefilewithotherpasswords.txt

‎requirements.txt‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
requests==2.22.0
2+
requests-unixsocket==0.2.0
3+
slackclient==2.8.1
4+
simplejson==3.16.0
5+
truffleHog3
6+
truffleHogRegexes
7+
PyGithub==1.53
8+
GitPython

‎suppressions-trufflehog-example‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
343a2bf8c900e0e20959ef6a11378ee15f80c91d #example_org/example - removing key in commit
2+
kka1742068f7e436743d3e7ce0d1a54323f9c1e48c2dd582a5447d10425b8c53a2 - #netlify/trufflehog - testing

0 commit comments

Comments
 (0)