Skip to content

Commit

Permalink
Introduce interface for utility and ChecksumCalculator
Browse files Browse the repository at this point in the history
  • Loading branch information
dineshba committed Jun 8, 2020
1 parent 64df451 commit 2caae94
Show file tree
Hide file tree
Showing 16 changed files with 235 additions and 79 deletions.
18 changes: 12 additions & 6 deletions checksumcalculator/checksumcalculator.go
Expand Up @@ -9,18 +9,24 @@ import (
yaml "gopkg.in/yaml.v2"
)

type ChecksumCalculator struct {
type ChecksumCalculator interface {
SuggestTalismanRC(fileNamePatterns []string) string
CalculateCollectiveChecksumForPattern(fileNamePattern string) string
}

type DefaultChecksumCalculator struct {
gitAdditions []gitrepo.Addition
hasher utility.SHA256Hasher
}

//NewChecksumCalculator returns new instance of the CheckSumDetector
func NewChecksumCalculator(gitAdditions []gitrepo.Addition) *ChecksumCalculator {
cc := ChecksumCalculator{gitAdditions: gitAdditions}
func NewChecksumCalculator(hasher utility.SHA256Hasher, gitAdditions []gitrepo.Addition) ChecksumCalculator {
cc := DefaultChecksumCalculator{hasher: hasher, gitAdditions: gitAdditions}
return &cc
}

//SuggestTalismanRC returns the suggestion for .talismanrc format
func (cc *ChecksumCalculator) SuggestTalismanRC(fileNamePatterns []string) string {
func (cc *DefaultChecksumCalculator) SuggestTalismanRC(fileNamePatterns []string) string {
var fileIgnoreConfigs []talismanrc.FileIgnoreConfig
result := ""
for _, pattern := range fileNamePatterns {
Expand All @@ -39,7 +45,7 @@ func (cc *ChecksumCalculator) SuggestTalismanRC(fileNamePatterns []string) strin
return result
}

func (cc *ChecksumCalculator) CalculateCollectiveChecksumForPattern(fileNamePattern string) string {
func (cc *DefaultChecksumCalculator) CalculateCollectiveChecksumForPattern(fileNamePattern string) string {
var patternPaths []string
currentCollectiveChecksum := ""
for _, addition := range cc.gitAdditions {
Expand All @@ -50,7 +56,7 @@ func (cc *ChecksumCalculator) CalculateCollectiveChecksumForPattern(fileNamePatt
// Calculate current collective checksum
patternPaths = utility.UniqueItems(patternPaths)
if len(patternPaths) != 0 {
currentCollectiveChecksum = utility.CollectiveSHA256Hash(patternPaths)
currentCollectiveChecksum = cc.hasher.CollectiveSHA256Hash(patternPaths)
}
return currentCollectiveChecksum
}
7 changes: 4 additions & 3 deletions detector/base64_aggressive_detector_test.go
@@ -1,6 +1,7 @@
package detector

import (
"talisman/utility"
"testing"

"talisman/gitrepo"
Expand All @@ -18,7 +19,7 @@ func TestShouldFlagPotentialAWSAccessKeysInAggressiveMode(t *testing.T) {
filename := "filename"
additions := []gitrepo.Addition{gitrepo.NewAddition(filename, content)}

NewFileContentDetector().AggressiveMode().Test(ChecksumCompare{calculator: nil, talismanRC: talismanrc.NewTalismanRC(nil)}, additions, talismanRC, results)
NewFileContentDetector().AggressiveMode().Test(NewChecksumCompare(nil, utility.DefaultSHA256Hasher{}, talismanrc.NewTalismanRC(nil)), additions, talismanRC, results)
assert.True(t, results.HasFailures(), "Expected file to not to contain base64 encoded texts")
}

Expand All @@ -29,7 +30,7 @@ func TestShouldFlagPotentialAWSAccessKeysAtPropertyDefinitionInAggressiveMode(t
filename := "filename"
additions := []gitrepo.Addition{gitrepo.NewAddition(filename, content)}

NewFileContentDetector().AggressiveMode().Test(ChecksumCompare{calculator: nil, talismanRC: talismanrc.NewTalismanRC(nil)}, additions, talismanRC, results)
NewFileContentDetector().AggressiveMode().Test(NewChecksumCompare(nil, utility.DefaultSHA256Hasher{}, talismanrc.NewTalismanRC(nil)), additions, talismanRC, results)
assert.True(t, results.HasFailures(), "Expected file to not to contain base64 encoded texts")
}

Expand All @@ -40,7 +41,7 @@ func TestShouldNotFlagPotentialSecretsWithinSafeJavaCodeEvenInAggressiveMode(t *
filename := "filename"
additions := []gitrepo.Addition{gitrepo.NewAddition(filename, content)}

NewFileContentDetector().AggressiveMode().Test(ChecksumCompare{calculator: nil, talismanRC: talismanrc.NewTalismanRC(nil)}, additions, talismanRC, results)
NewFileContentDetector().AggressiveMode().Test(NewChecksumCompare(nil, utility.DefaultSHA256Hasher{}, talismanrc.NewTalismanRC(nil)), additions, talismanRC, results)
if results == nil {
additions = nil
}
Expand Down
10 changes: 5 additions & 5 deletions detector/checksum_compare.go
Expand Up @@ -8,18 +8,18 @@ import (
)

type ChecksumCompare struct {
calculator *checksumcalculator.ChecksumCalculator
calculator checksumcalculator.ChecksumCalculator
hasher utility.SHA256Hasher
talismanRC *talismanrc.TalismanRC
}

//NewChecksumCompare returns new instance of the ChecksumCompare
func NewChecksumCompare(calculator *checksumcalculator.ChecksumCalculator, talismanRCConfig *talismanrc.TalismanRC) *ChecksumCompare {
cc := ChecksumCompare{calculator: calculator, talismanRC: talismanRCConfig}
return &cc
func NewChecksumCompare(calculator checksumcalculator.ChecksumCalculator, hasher utility.SHA256Hasher, talismanRCConfig *talismanrc.TalismanRC) ChecksumCompare {
return ChecksumCompare{calculator: calculator, hasher: hasher, talismanRC: talismanRCConfig}
}

func (cc *ChecksumCompare) IsScanNotRequired(addition gitrepo.Addition) bool {
currentCollectiveChecksum := utility.CollectiveSHA256Hash([]string{string(addition.Path)})
currentCollectiveChecksum := cc.hasher.CollectiveSHA256Hash([]string{string(addition.Path)})
declaredCheckSum := ""
for _, ignore := range cc.talismanRC.FileIgnoreConfig {
if addition.Matches(ignore.FileName) {
Expand Down
40 changes: 31 additions & 9 deletions detector/checksum_compare_test.go
@@ -1,30 +1,52 @@
package detector

import (
"github.com/golang/mock/gomock"
"github.com/stretchr/testify/assert"
"talisman/gitrepo"
mockchecksumcalculator "talisman/internal/mock/checksumcalculator"
mockutility "talisman/internal/mock/utility"
"talisman/talismanrc"
"testing"
)

func TestChecksumCompare_IsScanNotRequired(t *testing.T) {

t.Run("should return false if talismanrc is empty", func(t *testing.T) {
ctrl := gomock.NewController(t)
defer ctrl.Finish()
mockSHA256Hasher := mockutility.NewMockSHA256Hasher(ctrl)
ignoreConfig := talismanrc.NewTalismanRC(nil)
cc := NewChecksumCompare(nil, ignoreConfig)
cc := NewChecksumCompare(nil, mockSHA256Hasher, ignoreConfig)
addition := gitrepo.Addition{Path: "some.txt"}
mockSHA256Hasher.EXPECT().CollectiveSHA256Hash([]string{string(addition.Path)}).Return("somesha")

required := cc.IsScanNotRequired(gitrepo.Addition{})
required := cc.IsScanNotRequired(addition)

assert.False(t, required)
})

t.Run("should return false if talismanrc is empty", func(t *testing.T) {
ignoreConfig := talismanrc.NewTalismanRC(nil)
cc := NewChecksumCompare(nil, ignoreConfig)

required := cc.IsScanNotRequired(gitrepo.Addition{})

assert.False(t, required)
t.Run("should loop through talismanrc configs", func(t *testing.T) {
ctrl := gomock.NewController(t)
defer ctrl.Finish()
mockSHA256Hasher := mockutility.NewMockSHA256Hasher(ctrl)
checksumCalculator := mockchecksumcalculator.NewMockChecksumCalculator(ctrl)
ignoreConfig := talismanrc.TalismanRC{
FileIgnoreConfig: []talismanrc.FileIgnoreConfig{
{
FileName: "some.txt",
Checksum: "sha1",
},
},
}
cc := NewChecksumCompare(checksumCalculator, mockSHA256Hasher, &ignoreConfig)
addition := gitrepo.Addition{Name: "some.txt",}
mockSHA256Hasher.EXPECT().CollectiveSHA256Hash([]string{string(addition.Path)}).Return("somesha")
checksumCalculator.EXPECT().CalculateCollectiveChecksumForPattern("some.txt").Return("sha1")

required := cc.IsScanNotRequired(addition)

assert.True(t, required)
})

}
2 changes: 1 addition & 1 deletion detector/detection_results.go
Expand Up @@ -307,7 +307,7 @@ func (r *DetectionResults) suggestTalismanRC(fs afero.Fs, ignoreFile string, fil
var entriesToAdd []talismanrc.FileIgnoreConfig

for _, filePath := range filePaths {
currentChecksum := utility.CollectiveSHA256Hash([]string{filePath})
currentChecksum := utility.DefaultSHA256Hasher{}.CollectiveSHA256Hash([]string{filePath})
fileIgnoreConfig := talismanrc.FileIgnoreConfig{filePath, currentChecksum, []string{}}
entriesToAdd = append(entriesToAdd, fileIgnoreConfig)
}
Expand Down
8 changes: 5 additions & 3 deletions detector/detector.go
Expand Up @@ -5,6 +5,7 @@ import (
"talisman/checksumcalculator"
"talisman/gitrepo"
"talisman/talismanrc"
"talisman/utility"
)

//Detector represents a single kind of test to be performed against a set of Additions
Expand Down Expand Up @@ -48,9 +49,10 @@ func (dc *Chain) Test(currentAdditions []gitrepo.Addition, talismanRC *talismanr
wd, _ := os.Getwd()
repo := gitrepo.RepoLocatedAt(wd)
allAdditions := repo.TrackedFilesAsAdditions()
calculator := checksumcalculator.NewChecksumCalculator(append(allAdditions, currentAdditions...))
cc := NewChecksumCompare(calculator, talismanRC)
hasher := utility.DefaultSHA256Hasher{}
calculator := checksumcalculator.NewChecksumCalculator(hasher, append(allAdditions, currentAdditions...))
cc := NewChecksumCompare(calculator, hasher, talismanRC)
for _, v := range dc.detectors {
v.Test(*cc, currentAdditions, talismanRC, result)
v.Test(cc, currentAdditions, talismanRC, result)
}
}
29 changes: 15 additions & 14 deletions detector/filecontent_detector_test.go
Expand Up @@ -5,6 +5,7 @@ import (
"strings"
"talisman/gitrepo"
"talisman/talismanrc"
"talisman/utility"
"testing"

"github.com/stretchr/testify/assert"
Expand All @@ -21,7 +22,7 @@ func TestShouldNotFlagSafeText(t *testing.T) {
filename := "filename"
additions := []gitrepo.Addition{gitrepo.NewAddition(filename, content)}

NewFileContentDetector().Test(ChecksumCompare{calculator: nil, talismanRC: talismanrc.NewTalismanRC(nil)}, additions, &talismanrc.TalismanRC{}, results)
NewFileContentDetector().Test(NewChecksumCompare(nil, utility.DefaultSHA256Hasher{}, talismanrc.NewTalismanRC(nil)), additions, &talismanrc.TalismanRC{}, results)
assert.False(t, results.HasFailures(), "Expected file to not to contain base64 encoded texts")
}

Expand All @@ -31,7 +32,7 @@ func TestShouldIgnoreFileIfNeeded(t *testing.T) {
filename := "filename"
additions := []gitrepo.Addition{gitrepo.NewAddition(filename, content)}

NewFileContentDetector().Test(ChecksumCompare{calculator: nil, talismanRC: talismanrc.NewTalismanRC(nil)}, additions, talismanrc.NewTalismanRC([]byte(talismanRCContents)), results)
NewFileContentDetector().Test(NewChecksumCompare(nil, utility.DefaultSHA256Hasher{}, talismanrc.NewTalismanRC(nil)), additions, talismanrc.NewTalismanRC([]byte(talismanRCContents)), results)
assert.True(t, results.Successful(), "Expected file %s to be ignored by pattern", filename)
}

Expand All @@ -45,7 +46,7 @@ func TestShouldNotFlag4CharSafeText(t *testing.T) {
filename := "filename"
additions := []gitrepo.Addition{gitrepo.NewAddition(filename, content)}

NewFileContentDetector().Test(ChecksumCompare{calculator: nil, talismanRC: talismanrc.NewTalismanRC(nil)}, additions, talismanRC, results)
NewFileContentDetector().Test(NewChecksumCompare(nil, utility.DefaultSHA256Hasher{}, talismanrc.NewTalismanRC(nil)), additions, talismanRC, results)
assert.False(t, results.HasFailures(), "Expected file to not to contain base64 encoded texts")
}

Expand All @@ -56,7 +57,7 @@ func TestShouldNotFlagLowEntropyBase64Text(t *testing.T) {
filename := "filename"
additions := []gitrepo.Addition{gitrepo.NewAddition(filename, content)}

NewFileContentDetector().Test(ChecksumCompare{calculator: nil, talismanRC: talismanrc.NewTalismanRC(nil)}, additions, talismanRC, results)
NewFileContentDetector().Test(NewChecksumCompare(nil, utility.DefaultSHA256Hasher{}, talismanrc.NewTalismanRC(nil)), additions, talismanRC, results)
assert.False(t, results.HasFailures(), "Expected file to not to contain base64 encoded texts")
}

Expand All @@ -68,7 +69,7 @@ func TestShouldFlagPotentialAWSSecretKeys(t *testing.T) {
additions := []gitrepo.Addition{gitrepo.NewAddition(filename, content)}
filePath := additions[0].Path

NewFileContentDetector().Test(ChecksumCompare{calculator: nil, talismanRC: talismanrc.NewTalismanRC(nil)}, additions, talismanRC, results)
NewFileContentDetector().Test(NewChecksumCompare(nil, utility.DefaultSHA256Hasher{}, talismanrc.NewTalismanRC(nil)), additions, talismanRC, results)
expectedMessage := fmt.Sprintf("Expected file to not to contain base64 encoded texts such as: %s", awsSecretAccessKey)
assert.True(t, results.HasFailures(), "Expected file to not to contain base64 encoded texts")
assert.Equal(t, expectedMessage, getFailureMessages(results, filePath)[0])
Expand All @@ -83,7 +84,7 @@ func TestShouldFlagPotentialSecretWithoutTrimmingWhenLengthLessThan50Characters(
additions := []gitrepo.Addition{gitrepo.NewAddition(filename, content)}
filePath := additions[0].Path

NewFileContentDetector().Test(ChecksumCompare{calculator: nil, talismanRC: talismanrc.NewTalismanRC(nil)}, additions, talismanRC, results)
NewFileContentDetector().Test(NewChecksumCompare(nil, utility.DefaultSHA256Hasher{}, talismanrc.NewTalismanRC(nil)), additions, talismanRC, results)
expectedMessage := fmt.Sprintf("Expected file to not to contain base64 encoded texts such as: %s", secret)
assert.True(t, results.HasFailures(), "Expected file to not to contain base64 encoded texts")
assert.Equal(t, expectedMessage, getFailureMessages(results, filePath)[0])
Expand All @@ -98,7 +99,7 @@ func TestShouldFlagPotentialJWT(t *testing.T) {
additions := []gitrepo.Addition{gitrepo.NewAddition(filename, content)}
filePath := additions[0].Path

NewFileContentDetector().Test(ChecksumCompare{calculator: nil, talismanRC: talismanrc.NewTalismanRC(nil)}, additions, talismanRC, results)
NewFileContentDetector().Test(NewChecksumCompare(nil, utility.DefaultSHA256Hasher{}, talismanrc.NewTalismanRC(nil)), additions, talismanRC, results)
expectedMessage := fmt.Sprintf("Expected file to not to contain base64 encoded texts such as: %s", jwt[:47]+"...")
assert.True(t, results.HasFailures(), "Expected file to not to contain base64 encoded texts")
assert.Equal(t, expectedMessage, getFailureMessages(results, filePath)[0])
Expand All @@ -113,7 +114,7 @@ func TestShouldFlagPotentialSecretsWithinJavaCode(t *testing.T) {
additions := []gitrepo.Addition{gitrepo.NewAddition(filename, content)}
filePath := additions[0].Path

NewFileContentDetector().Test(ChecksumCompare{calculator: nil, talismanRC: talismanrc.NewTalismanRC(nil)}, additions, talismanRC, results)
NewFileContentDetector().Test(NewChecksumCompare(nil, utility.DefaultSHA256Hasher{}, talismanrc.NewTalismanRC(nil)), additions, talismanRC, results)
expectedMessage := "Expected file to not to contain base64 encoded texts such as: accessKey=\"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPL..."
assert.True(t, results.HasFailures(), "Expected file to not to contain base64 encoded texts")
assert.Equal(t, expectedMessage, getFailureMessages(results, filePath)[0])
Expand All @@ -127,7 +128,7 @@ func TestShouldNotFlagPotentialSecretsWithinSafeJavaCode(t *testing.T) {
filename := "filename"
additions := []gitrepo.Addition{gitrepo.NewAddition(filename, content)}

NewFileContentDetector().Test(ChecksumCompare{calculator: nil, talismanRC: talismanrc.NewTalismanRC(nil)}, additions, talismanRC, results)
NewFileContentDetector().Test(NewChecksumCompare(nil, utility.DefaultSHA256Hasher{}, talismanrc.NewTalismanRC(nil)), additions, talismanRC, results)
assert.False(t, results.HasFailures(), "Expected file to not to contain base64 encoded texts")
}

Expand All @@ -138,7 +139,7 @@ func TestShouldNotFlagPotentialSecretsWithinSafeLongMethodName(t *testing.T) {
filename := "filename"
additions := []gitrepo.Addition{gitrepo.NewAddition(filename, content)}

NewFileContentDetector().Test(ChecksumCompare{calculator: nil, talismanRC: talismanrc.NewTalismanRC(nil)}, additions, talismanRC, results)
NewFileContentDetector().Test(NewChecksumCompare(nil, utility.DefaultSHA256Hasher{}, talismanrc.NewTalismanRC(nil)), additions, talismanRC, results)
assert.False(t, results.HasFailures(), "Expected file to not to contain base64 encoded texts")
}

Expand All @@ -150,7 +151,7 @@ func TestShouldFlagPotentialSecretsEncodedInHex(t *testing.T) {
additions := []gitrepo.Addition{gitrepo.NewAddition(filename, content)}
filePath := additions[0].Path

NewFileContentDetector().Test(ChecksumCompare{calculator: nil, talismanRC: talismanrc.NewTalismanRC(nil)}, additions, talismanRC, results)
NewFileContentDetector().Test(NewChecksumCompare(nil, utility.DefaultSHA256Hasher{}, talismanrc.NewTalismanRC(nil)), additions, talismanRC, results)
expectedMessage := "Expected file to not to contain hex encoded texts such as: " + hex
assert.Equal(t, expectedMessage, getFailureMessages(results, filePath)[0])
assert.Len(t, results.Results, 1)
Expand All @@ -166,7 +167,7 @@ func TestResultsShouldContainHexTextsIfHexAndBase64ExistInFile(t *testing.T) {
additions := []gitrepo.Addition{gitrepo.NewAddition(filename, content)}
filePath := additions[0].Path

NewFileContentDetector().Test(ChecksumCompare{calculator: nil, talismanRC: talismanrc.NewTalismanRC(nil)}, additions, talismanRC, results)
NewFileContentDetector().Test(NewChecksumCompare(nil, utility.DefaultSHA256Hasher{}, talismanrc.NewTalismanRC(nil)), additions, talismanRC, results)
expectedMessage := "Expected file to not to contain hex encoded texts such as: " + hex
messageReceived := strings.Join(getFailureMessages(results, filePath), " ")
assert.Regexp(t, expectedMessage, messageReceived, "Should contain hex detection message")
Expand All @@ -183,7 +184,7 @@ func TestResultsShouldContainBase64TextsIfHexAndBase64ExistInFile(t *testing.T)
additions := []gitrepo.Addition{gitrepo.NewAddition(filename, content)}
filePath := additions[0].Path

NewFileContentDetector().Test(ChecksumCompare{calculator: nil, talismanRC: talismanrc.NewTalismanRC(nil)}, additions, talismanRC, results)
NewFileContentDetector().Test(NewChecksumCompare(nil, utility.DefaultSHA256Hasher{}, talismanrc.NewTalismanRC(nil)), additions, talismanRC, results)
expectedMessage := "Expected file to not to contain base64 encoded texts such as: " + base64
messageReceived := strings.Join(getFailureMessages(results, filePath), " ")
assert.Regexp(t, expectedMessage, messageReceived, "Should contain base64 detection message")
Expand All @@ -198,7 +199,7 @@ func TestResultsShouldContainCreditCardNumberIfCreditCardNumberExistInFile(t *te
additions := []gitrepo.Addition{gitrepo.NewAddition(filename, content)}
filePath := additions[0].Path

NewFileContentDetector().Test(ChecksumCompare{calculator: nil, talismanRC: talismanrc.NewTalismanRC(nil)}, additions, talismanRC, results)
NewFileContentDetector().Test(NewChecksumCompare(nil, utility.DefaultSHA256Hasher{}, talismanrc.NewTalismanRC(nil)), additions, talismanRC, results)
expectedMessage := "Expected file to not to contain credit card numbers such as: " + creditCardNumber
assert.Equal(t, expectedMessage, getFailureMessages(results, filePath)[0])
assert.Len(t, results.Results, 1)
Expand Down
7 changes: 4 additions & 3 deletions detector/filename_detector_test.go
Expand Up @@ -5,6 +5,7 @@ package detector

import (
"regexp"
"talisman/utility"
"testing"

"talisman/gitrepo"
Expand Down Expand Up @@ -152,20 +153,20 @@ func shouldNotFailWithDefaultDetectorAndIgnores(fileName, ignore string, t *test
talismanRC.FileIgnoreConfig = make([]talismanrc.FileIgnoreConfig, 1)
talismanRC.FileIgnoreConfig[0] = fileIgnoreConfig

DefaultFileNameDetector().Test(ChecksumCompare{calculator: nil, talismanRC: talismanrc.NewTalismanRC(nil)}, additionsNamed(fileName), talismanRC, results)
DefaultFileNameDetector().Test(NewChecksumCompare(nil, utility.DefaultSHA256Hasher{}, talismanrc.NewTalismanRC(nil)), additionsNamed(fileName), talismanRC, results)
assert.True(t, results.Successful(), "Expected file %s to be ignored by pattern", fileName, ignore)
}

func shouldFailWithSpecificPattern(fileName, pattern string, t *testing.T) {
results := NewDetectionResults()
pt := regexp.MustCompile(pattern)
NewFileNameDetector([]*regexp.Regexp{pt}).Test(ChecksumCompare{calculator: nil, talismanRC: talismanrc.NewTalismanRC(nil)}, additionsNamed(fileName), talismanRC, results)
NewFileNameDetector([]*regexp.Regexp{pt}).Test(NewChecksumCompare(nil, utility.DefaultSHA256Hasher{}, talismanrc.NewTalismanRC(nil)), additionsNamed(fileName), talismanRC, results)
assert.True(t, results.HasFailures(), "Expected file %s to fail the check against the %s pattern", fileName, pattern)
}

func shouldFailWithDefaultDetector(fileName, pattern string, t *testing.T) {
results := NewDetectionResults()
DefaultFileNameDetector().Test(ChecksumCompare{calculator: nil, talismanRC: talismanrc.NewTalismanRC(nil)}, additionsNamed(fileName), talismanRC, results)
DefaultFileNameDetector().Test(NewChecksumCompare(nil, utility.DefaultSHA256Hasher{}, talismanrc.NewTalismanRC(nil)), additionsNamed(fileName), talismanRC, results)
assert.True(t, results.HasFailures(), "Expected file %s to fail the check against default detector. Missing pattern %s?", fileName, pattern)
}

Expand Down

0 comments on commit 2caae94

Please sign in to comment.