trojan scanner

.do_not_edit-trojansourcedetector.json

@@ -0,0 +1,86 @@
+{
+  "detect_bidi" : true,
+  "detect_unicode" : false,
+  "exclude" : [
+    ".git",
+    ".git/*",
+    ".git/*/*",
+    ".git/*/*/*",
+    ".git/*/*/*/*",
+    ".git/*/*/*/*/*",
+    ".git/*/*/*/*/*/*",
+    ".git/*/*/*/*/*/*/*",
+    ".git/*/*/*/*/*/*/*/*",
+    ".git/*/*/*/*/*/*/*/*/*",
+    ".git/*/*/*/*/*/*/*/*/*/*",
+    ".git/*/*/*/*/*/*/*/*/*/*/*",
+    ".git/*/*/*/*/*/*/*/*/*/*/*/*",
+    ".git/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    ".git/*/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    ".git/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    ".git/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    ".git/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    ".git/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    ".git/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    "bin",
+    "bin/*",
+    "bin/*/*",
+    "bin/*/*/*",
+    "bin/*/*/*/*",
+    "bin/*/*/*/*/*",
+    "bin/*/*/*/*/*/*",
+    "bin/*/*/*/*/*/*/*",
+    "bin/*/*/*/*/*/*/*/*",
+    "bin/*/*/*/*/*/*/*/*/*",
+    "bin/*/*/*/*/*/*/*/*/*/*",
+    "bin/*/*/*/*/*/*/*/*/*/*/*",
+    "bin/*/*/*/*/*/*/*/*/*/*/*/*",
+    "bin/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    "bin/*/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    "bin/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    "bin/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    "bin/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    "bin/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    "bin/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    "target",
+    "target/*",
+    "target/*/*",
+    "target/*/*/*",
+    "target/*/*/*/*",
+    "target/*/*/*/*/*",
+    "target/*/*/*/*/*/*",
+    "target/*/*/*/*/*/*/*",
+    "target/*/*/*/*/*/*/*/*",
+    "target/*/*/*/*/*/*/*/*/*",
+    "target/*/*/*/*/*/*/*/*/*/*",
+    "target/*/*/*/*/*/*/*/*/*/*/*",
+    "target/*/*/*/*/*/*/*/*/*/*/*/*",
+    "target/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    "target/*/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    "target/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    "target/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    "target/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    "target/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    "target/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    "tmp",
+    "tmp/*",
+    "tmp/*/*",
+    "tmp/*/*/*",
+    "tmp/*/*/*/*",
+    "tmp/*/*/*/*/*",
+    "tmp/*/*/*/*/*/*",
+    "tmp/*/*/*/*/*/*/*",
+    "tmp/*/*/*/*/*/*/*/*",
+    "tmp/*/*/*/*/*/*/*/*/*",
+    "tmp/*/*/*/*/*/*/*/*/*/*",
+    "tmp/*/*/*/*/*/*/*/*/*/*/*",
+    "tmp/*/*/*/*/*/*/*/*/*/*/*/*",
+    "tmp/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    "tmp/*/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    "tmp/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    "tmp/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    "tmp/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    "tmp/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*",
+    "tmp/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*"
+  ]
+}

.github/workflows/pr.yml

@@ -64,6 +64,9 @@ jobs:
       - name: Run tests for scripts
         run: ./scripts-test/test_runner.clj
       - run: ./scripts/actions/setup_env.clj
+      # scan ctia's source for trojans. uberjar is scanned in deploy step.
+      - run: ./scripts/actions/install-trojansourcedetector.sh
+      - run: ./scripts/trojan-scan.sh
       - name: Setup test matrix splits
         id: set-matrix
         run: |
@@ -338,6 +341,7 @@ jobs:
           echo "${BIN_PATH}" >> $GITHUB_PATH
       - name: Install babashka
         run: ./scripts/actions/install-bb.sh
+      - run: ./scripts/actions/install-trojansourcedetector.sh
       - run: ./scripts/actions/setup_env.clj
       - name: Maven Cache
         id: maven-cache

.gitignore

@@ -17,4 +17,5 @@ pom.xml
 .lsp/.cache
 .clj-kondo/.cache
 .clj-kondo/cache
-.clj-kondo/rewrite-clj/
+.clj-kondo/rewrite-clj/
+tmp

bb.edn

@@ -1,2 +1,17 @@
 {:paths ["scripts"
-         "scripts-test"]}
+         "scripts-test"]
+ :tasks
+ {:requires ([babashka.fs :as fs]
+             [babashka.process :as p :refer [process]]
+             [babashka.wait :as wait])
+  ;; bb nrepl
+  nrepl (let [port (with-open [sock (java.net.ServerSocket. 0)] (.getLocalPort sock))
+              proc (process (str "bb nrepl-server " port) {:inherit true})
+              paths ["scripts"
+                     "scripts-test"]]
+          (wait/wait-for-port "localhost" port)
+          (doseq [path paths
+                  :let [nrepl-port-path (str path "/.nrepl-port")]]
+            (spit nrepl-port-path port)
+            (fs/delete-on-exit nrepl-port-path))
+          (deref proc))}}

build/deploy-actions.sh

@@ -40,6 +40,8 @@ function build-and-publish-package {
 
   lein uberjar
 
+  ./scripts/uberjar-trojan-scan.clj
+
   BUILD_NAME="${CTIA_MAJOR_VERSION}-${PKG_TYPE}-${CTIA_BUILD_NUMBER}-${CTIA_COMMIT:0:8}"
   echo "$BUILD_NAME"
   echo "Build: $BUILD_NAME"

scripts-test/test_runner.clj

@@ -12,11 +12,12 @@
     "scripts-test/actions/print_matrix_test.clj" actions.print-matrix-test
     "scripts-test/actions/setup_env_test.clj" actions.setup-env-test})
 
-(let [fs (into #{}
-               (keep (fn [^File f]
-                       (when (.isFile f)
-                         (.getPath f))))
-               (file-seq (io/file "scripts-test")))
+(let [fs (-> (into #{}
+                   (keep (fn [^File f]
+                           (when (.isFile f)
+                             (.getPath f))))
+                   (file-seq (io/file "scripts-test")))
+             (disj "scripts-test/.nrepl-port"))
       expected-extra #{"scripts-test/test_runner.clj"
                        "scripts-test/actions/test_helpers.clj"}
       actual-extra (into #{}

scripts/actions/install-trojansourcedetector.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+set -Eeuxo pipefail
+
+if ! command -v trojansourcedetector &> /dev/null 
+then
+  rm -rf tmp/trojansourcedetector
+  mkdir -p tmp/trojansourcedetector
+  cd tmp/trojansourcedetector
+  curl -sLO https://github.com/haveyoudebuggedit/trojansourcedetector/releases/download/v1.0.1/trojansourcedetector_1.0.1_linux_amd64.tar.gz
+  sha256sum trojansourcedetector_1.0.1_linux_amd64.tar.gz | grep 62dfc2afb37c0124b755dbcee52e5af5cea2da372609cc83a8c2cbb62caf7598 
+  tar -xf trojansourcedetector_1.0.1_linux_amd64.tar.gz
+  cp trojansourcedetector "${BIN_PATH}"
+fi

scripts/do_not_edit-uberjar_trojansourcedetector.json

@@ -0,0 +1,33 @@
+{
+  "directory" : "tmp/unzipped-uberjar",
+  "exclude" : [
+    "META-INF/native/linux64/liblmdbjni.so",
+    "com/google/common/base/CharMatcher$Invisible.class",
+    "com/google/protobuf/DescriptorProtos$SourceCodeInfo$Location$Builder.class",
+    "com/ibm/icu/impl/data/icudt65b/brkitr/*.dict",
+    "com/ibm/icu/impl/data/icudt65b/*.res",
+    "com/ibm/icu/impl/data/icudt65b/*/*.res",
+    "com/ibm/icu/impl/data/icudt65b/unames.icu",
+    "externs.zip",
+    "goog/demos/emoji/*.gif",
+    "goog/demos/emoji/*.png",
+    "goog/images/*.gif",
+    "goog/images/*.png",
+    "graphql/parser/antlr/GraphqlLexer.class",
+    "img/*.png",
+    "org/apache/commons/codec/language/bm/gen_rules_arabic.txt",
+    "org/apache/curator/shaded/com/google/common/base/CharMatcher$Invisible.class",
+    "org/bouncycastle/crypto/engines/AESFastEngine.class",
+    "org/xerial/snappy/native/Linux/android-arm/libsnappyjava.so",
+    "org/xerial/snappy/native/Linux/ppc64le/libsnappyjava.so",
+    "org/xerial/snappy/native/Windows/x86/snappyjava.dll",
+    "goog/i18n/datetimepatternsext.js",
+    "goog/i18n/datetimesymbols.js",
+    "goog/i18n/datetimesymbolsext.js",
+    "goog/labs/i18n/listsymbols.js",
+    "goog/labs/i18n/listsymbolsext.js",
+    "goog/i18n/datetimepatterns.js",
+    "goog/format/internationalizedemailaddress.js",
+    "swagger-ui/swagger-ui-bundle.js"
+  ]
+}

scripts/generate-trojan-config.clj

@@ -0,0 +1,77 @@
+#!/usr/bin/env bb
+
+;; Devs: run `bb nrepl` at project root start an nrepl server
+
+;; https://github.com/haveyoudebuggedit/trojansourcedetector#configuration
+
+(require '[cheshire.core :as json])
+
+(defn gen-edn-config [base-config excluded-file-types excluded-directories]
+  (let [explode-extension (fn [extension]
+                            (take 15
+                                  (iterate (fn [p]
+                                             (str "*/" p))
+                                           (str "*." extension))))
+        explode-directory (fn [directory]
+                            (take 20
+                                  (iterate (fn [p]
+                                             (str p "/*"))
+                                           directory)))]
+    (update base-config
+            "exclude" (fn [exclude]
+                        (-> (or exclude [])
+                            (into (mapcat explode-extension) excluded-file-types)
+                            (into (mapcat explode-directory) excluded-directories))))))
+
+(comment
+  (clojure.repl/pst)
+  (gen-edn-config base-config excluded-file-types excluded-directories)
+  (take 10
+        (iterate (fn [p]
+                   (str "*/" p))
+                 "*.png"))
+  )
+
+(defn gen-json-config [base-config excluded-file-types excluded-directories]
+  (str (json/generate-string
+         (gen-edn-config base-config excluded-file-types excluded-directories)
+         {:pretty (json/create-pretty-printer
+                    (assoc json/default-pretty-print-options
+                           :indent-arrays? true))})
+       \newline))
+
+(comment
+  (println (gen-json-config base-config excluded-file-types excluded-directories))
+  )
+
+(defn regen-config [path base-config excluded-file-types excluded-directories]
+  (spit path
+        (gen-json-config base-config excluded-file-types excluded-directories)))
+
+(def config-path ".do_not_edit-trojansourcedetector.json")
+
+(def excluded-file-types
+  (sorted-set
+    ))
+
+(def excluded-directories
+  (sorted-set
+    ".git"
+    "target"
+    "tmp"
+    "bin"))
+
+(def base-config
+  (sorted-map
+    "detect_unicode" false,
+    "detect_bidi" true
+    "exclude" []))
+
+(defn -main [& args]
+  (assert (empty? args) (pr-str args))
+  (regen-config config-path base-config excluded-file-types excluded-directories))
+
+(comment
+  (-main))
+
+(when (= *file* (System/getProperty "babashka.file")) (-main))

scripts/trojan-scan.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+set -Eeuxo pipefail
+
+./scripts/generate-trojan-config.clj
+
+trojansourcedetector -config .do_not_edit-trojansourcedetector.json