Skip to content

Commit 7314304

Browse files
dacoburndacoburn
authored
Fixes for logic issues in entrypoint and in main files. (#7)
1 parent e0d1206 commit 7314304

11 files changed

Lines changed: 92 additions & 79 deletions

File tree

‎Dockerfile‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,9 @@
11
# Use the official Python image as a base
22
FROM python:3.9
3-
COPY src/socket_external_tools_runner.py /app/
4-
COPY src/core /app/
5-
COPY entrypoint.sh /app/
3+
COPY src/socket_external_tools_runner.py /
4+
COPY src/core /core
5+
COPY entrypoint.sh /
66
ENV PATH=$PATH:/usr/local/go/bin
7-
WORKDIR /app
87

98
# Setup Golang
109
RUN curl -sfL https://go.dev/dl/go1.23.2.linux-amd64.tar.gz > go1.23.2.linux-amd64.tar.gz
@@ -18,11 +17,14 @@ RUN curl -sfL https://raw.githubusercontent.com/securego/gosec/master/install.sh
1817
# Install Trivy
1918
RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.18.3
2019

21-
# Install Bandit and Trufflehog using pip
22-
RUN pip install bandit trufflehog
20+
#Install Trufflehog
21+
# Install trufflehog
22+
RUN curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin
23+
24+
# Install Bandit
25+
RUN pip install bandit
2326

2427
# Copy the entrypoint script and make it executable
25-
COPY entrypoint.sh /entrypoint.sh
2628
RUN chmod +x /entrypoint.sh
2729

2830

‎entrypoint.sh‎

Lines changed: 18 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -13,51 +13,58 @@ GOSEC_RULES=${INPUT_GOSEC_RULES:-}
1313
TRIVY_EXCLUDE_DIR=${INPUT_TRIVY_EXCLUDE_DIR:-}
1414
TRIVY_RULES=${INPUT_TRIVY_RULES:-}
1515

16+
echo "Running Bandit"
1617
# Run Bandit with exclusion directories and rules if specified
17-
bandit_cmd="bandit -r . -f json -o /tmp/bandit_output.json"
18+
bandit_cmd="bandit -r $GITHUB_WORKSPACE -f json -o /tmp/bandit_output.json"
1819
if [[ -n "$BANDIT_EXCLUDE_DIR" ]]; then
1920
bandit_cmd+=" --exclude $BANDIT_EXCLUDE_DIR"
2021
fi
2122
if [[ -n "$BANDIT_RULES" ]]; then
2223
bandit_cmd+=" --skip $BANDIT_RULES"
2324
fi
24-
eval $bandit_cmd
25+
eval $bandit_cmd || :
2526

27+
echo "Running gosec"
2628
# Run Gosec with exclusion directories and rules if specified
27-
gosec_cmd="gosec -fmt json -out /tmp/gosec_output.json ./..."
29+
gosec_cmd="gosec -fmt json -out /tmp/gosec_output.json "
2830
if [[ -n "$GOSEC_EXCLUDE_DIR" ]]; then
2931
gosec_cmd+=" -exclude-dir=$GOSEC_EXCLUDE_DIR"
3032
fi
3133
if [[ -n "$GOSEC_RULES" ]]; then
3234
gosec_cmd+=" -severity=$GOSEC_RULES"
3335
fi
34-
go mod tidy
35-
go mod download
36-
eval $gosec_cmd
36+
gosec_cmd+=" $GITHUB_WORKSPACE/..."
37+
eval $gosec_cmd || :
3738

39+
echo "Running Trivy"
3840
# Run Trivy with exclusion directories and rules if specified
39-
trivy_cmd="trivy fs --format json --output /tmp/trivy_output.json ."
41+
trivy_cmd="trivy fs --format json --output /tmp/trivy_output.json"
4042
if [[ -n "$TRIVY_EXCLUDE_DIR" ]]; then
41-
trivy_cmd+=" --ignore $TRIVY_EXCLUDE_DIR"
43+
trivy_cmd+=" --skip-dirs $TRIVY_EXCLUDE_DIR"
4244
fi
4345
if [[ -n "$TRIVY_RULES" ]]; then
4446
trivy_cmd+=" --severity $TRIVY_RULES"
4547
fi
46-
eval $trivy_cmd
48+
trivy_cmd+=" $GITHUB_WORKSPACE"
49+
eval $trivy_cmd || :
4750

51+
echo "Running Trufflehog"
4852
# Run Trufflehog with exclusion directories and rules if specified
49-
trufflehog_cmd="trufflehog filesystem --json . > /tmp/trufflehog_output.json"
53+
trufflehog_cmd="trufflehog filesystem "
5054
TRUFFLEHOG_EXCLUDE_FILE=$(mktemp)
5155
if [[ -n "$TRUFFLEHOG_EXCLUDE_DIR" ]]; then
5256
IFS=',' read -ra EXCLUDE_DIRS <<< "$TRUFFLEHOG_EXCLUDE_DIR"
5357
for dir in "${EXCLUDE_DIRS[@]}"; do
5458
echo "$dir" >> "$TRUFFLEHOG_EXCLUDE_FILE"
5559
done
60+
trufflehog_cmd+=" -x $TRUFFLEHOG_EXCLUDE_FILE"
5661
fi
5762
if [[ -n "$TRUFFLEHOG_RULES" ]]; then
5863
trufflehog_cmd+=" --rules $TRUFFLEHOG_RULES"
5964
fi
60-
eval $trufflehog_cmd
65+
trufflehog_cmd+=" --no-verification -j $GITHUB_WORKSPACE > /tmp/trufflehog_output.json"
66+
eval $trufflehog_cmd || :
6167

6268
# Execute the custom Python script to process findings
69+
mv /tmp/*.json .
6370
python socket_external_tools_runner.py

‎src/core/connectors/bandit/__init__.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
from src.core.connectors.bandit.classes import BanditTestResult
1+
from core.connectors.bandit.classes import BanditTestResult
22
from mdutils import MdUtils
33
from typing import Union
44

@@ -14,7 +14,7 @@ def process_output(data: dict, cwd: str) -> dict:
1414
"output": [],
1515
# "code": []
1616
}
17-
if len(results) > 0:
17+
if results is not None and len(results) > 0:
1818
for test in results:
1919
test_result = BanditTestResult(**test, cwd=cwd)
2020
tests.append(test_result)
@@ -47,7 +47,7 @@ def create_output(data: dict, marker: str, repo: str, commit: str, cwd: str) ->
4747
file = output.url.replace("REPO_REPLACE", repo).replace("COMMIT_REPLACE", commit)
4848
file_name = f"[{output.filename}]({file})"
4949
else:
50-
file_name = output.filename
50+
file_name = f"`{output.filename}`"
5151
md.new_line(f"**{output.issue_text}**")
5252
md.new_line(f"**Severity**: `{output.issue_severity}`")
5353
md.new_line(f"**Filename:** {file_name}")

‎src/core/connectors/bandit/classes.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
import json
2-
from src.core import base_github
2+
from core import base_github
33

44

55
class BanditTestResult:

‎src/core/connectors/gosec/__init__.py‎

Lines changed: 17 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
from src.core.connectors.gosec.classes import GosecTestResult
1+
from core.connectors.gosec.classes import GosecTestResult
22
from mdutils import MdUtils
33
from typing import Union
44

@@ -14,21 +14,22 @@ def process_output(data: dict, cwd: str) -> dict:
1414
"output": [],
1515
# "code": []
1616
}
17-
for test in results:
18-
test_result = GosecTestResult(**test, cwd=cwd)
19-
tests.append(test_result)
20-
test_name = f"{test_result.rule_id}_{test_result.severity}"
21-
if test_result.severity not in metrics["severities"]:
22-
metrics["severities"][test_result.severity] = 1
23-
else:
24-
metrics["severities"][test_result.severity] += 1
17+
if results is not None and len(results) > 0:
18+
for test in results:
19+
test_result = GosecTestResult(**test, cwd=cwd)
20+
tests.append(test_result)
21+
test_name = f"{test_result.rule_id}_{test_result.severity}"
22+
if test_result.severity not in metrics["severities"]:
23+
metrics["severities"][test_result.severity] = 1
24+
else:
25+
metrics["severities"][test_result.severity] += 1
2526

26-
if test_name not in metrics["tests"]:
27-
metrics["tests"][test_name] = 1
28-
else:
29-
metrics["tests"][test_name] += 1
30-
metrics["output"].append(test_result)
31-
# metrics["code"].append(test_result.code)
27+
if test_name not in metrics["tests"]:
28+
metrics["tests"][test_name] = 1
29+
else:
30+
metrics["tests"][test_name] += 1
31+
metrics["output"].append(test_result)
32+
# metrics["code"].append(test_result.code)
3233

3334
return metrics
3435

@@ -47,7 +48,7 @@ def create_output(data: dict, marker: str, repo: str, commit: str, cwd: str) ->
4748
file = output.url.replace("REPO_REPLACE", repo).replace("COMMIT_REPLACE", commit)
4849
file_name = f"[{output.file}]({file})"
4950
else:
50-
file_name = output.file
51+
file_name = f"`{output.file}`"
5152
md.new_line(f"**{output.details}**")
5253
md.new_line(f"**Severity**: `{output.severity}`")
5354
md.new_line(f"**Filename:** {file_name}")

‎src/core/connectors/gosec/classes.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
import json
2-
from src.core import base_github
2+
from core import base_github
33

44

55
class GosecTestResult:

‎src/core/connectors/trufflehog/__init__.py‎

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
from src.core.connectors.trufflehog.classes import TrufflehogTestResult
1+
from core.connectors.trufflehog.classes import TrufflehogTestResult
22
from mdutils import MdUtils
33
from typing import Union
44

@@ -14,24 +14,24 @@ def process_output(data: dict, cwd: str) -> dict:
1414
"output": [],
1515
# "code": []
1616
}
17-
for test in results:
18-
test_result = TrufflehogTestResult(**test, cwd=cwd)
19-
metadata = test_result.SourceMetadata.get('Data')
20-
if metadata is not None:
21-
test_result.file = metadata['Filesystem']['file'].lstrip("./").lstrip("/")
22-
test_result.file.replace(cwd, "")
23-
test_result.line = metadata['Filesystem'].get('line')
24-
if test_result.line is not None:
25-
test_result.url = test_result.set_url()
26-
test_name = f"secret_{test_result.DetectorName}_{test_result.DecoderName}"
27-
if test_name not in metrics["tests"]:
28-
metrics["tests"][test_name] = 1
29-
else:
30-
metrics["tests"][test_name] += 1
31-
tests.append(test_result)
32-
metrics["output"].append(test_result)
33-
# metrics["code"].append(test_result.code)
34-
17+
if results is not None and len(results) > 0:
18+
for test in results:
19+
test_result = TrufflehogTestResult(**test, cwd=cwd)
20+
metadata = test_result.SourceMetadata.get('Data')
21+
if metadata is not None:
22+
test_result.file = metadata['Filesystem']['file'].lstrip("./").lstrip("/")
23+
test_result.file.replace(cwd, "")
24+
test_result.line = metadata['Filesystem'].get('line')
25+
if test_result.line is not None:
26+
test_result.url = test_result.set_url()
27+
test_name = f"secret_{test_result.DetectorName}_{test_result.DecoderName}"
28+
if test_name not in metrics["tests"]:
29+
metrics["tests"][test_name] = 1
30+
else:
31+
metrics["tests"][test_name] += 1
32+
tests.append(test_result)
33+
metrics["output"].append(test_result)
34+
# metrics["code"].append(test_result.code)
3535
return metrics
3636

3737
@staticmethod
@@ -49,11 +49,11 @@ def create_output(data: dict, marker: str, repo: str, commit: str, cwd: str) ->
4949
file = output.url.replace("REPO_REPLACE", repo).replace("COMMIT_REPLACE", commit)
5050
file_name = f"[{output.file}]({file})"
5151
else:
52-
file_name = output.file
52+
file_name = f"`{output.file}`"
5353
md.new_line(f"**Detection:** {output.DetectorName} - {output.DecoderName}")
5454
md.new_line(f"**Source Type**: `{output.SourceName}`")
5555
md.new_line(f"**Filename:** {file_name}")
56-
md.new_line(f"**Detected Secret:** {output.Raw}")
56+
# md.new_line(f"**Detected Secret:** {output.Raw}")
5757
md.new_line("<br>")
5858
md.new_line()
5959
md.create_md_file()

‎src/core/connectors/trufflehog/classes.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
import json
2-
from src.core import base_github
2+
from core import base_github
33

44

55
class TrufflehogTestResult:

‎src/core/scm/__init__.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
from src.core.scm.github import Github
1+
from core.scm.github import Github
22

33

44
class SCM:

‎src/core/scm/github.py‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
import json
22
import os
33
from github import Github, Repository, PullRequest, IssueComment
4-
from src.core import log
4+
from core import log
55

66

77
repo: Repository
@@ -13,7 +13,7 @@
1313
with open(event_path, 'r') as f:
1414
event_data = json.load(f)
1515
# Extract the pull request number from the event data
16-
pr_number = event_data["number"] if "pull_request" in event_data else None
16+
pr_number = event_data["pull_request"]["number"] if "pull_request" in event_data else None
1717
if pr_number is None:
1818
log.warn("Unable to get PR number from event data, assuming not a PR")
1919
exit(0)
@@ -88,4 +88,5 @@ def post_comment(tool_name: str, marker: str, issues: str = None):
8888
else:
8989
pull_request.create_issue_comment(comment_body)
9090
else:
91-
existing_comment.delete()
91+
if existing_comment is not None:
92+
existing_comment.delete()

0 commit comments

Comments
 (0)