Skip to content

Commit

Permalink
general update
Browse files Browse the repository at this point in the history
  • Loading branch information
@htrgouvea
htrgouvea committed Aug 23, 2024
1 parent 05dad0f commit c936433
Show file tree
Hide file tree
Showing 3 changed files with 121 additions and 110 deletions.
4 changes: 3 additions & 1 deletion .github/workflows/security-gate.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -39,4 +39,6 @@ jobs:
-h "$MAX_HIGH" \
-m "$MAX_MEDIUM" \
-l "$MAX_LOW" \
--dependency-alerts
--dependency-alerts
--secrets-alerts
--code-alerts
114 changes: 60 additions & 54 deletions lib/SecurityGate/Engine/Code.pm
View file
Original file line number Diff line number Diff line change
@@ -1,69 +1,75 @@
package SecurityGate::Engine::Code;
package SecurityGate::Engine::Code {
use strict;
use warnings;
use Mojo::UserAgent;
use Mojo::JSON;

use strict;
use warnings;
use Mojo::UserAgent;
use Mojo::JSON;
sub new {
my ($class, $token, $repository, $severity_limits) = @_;

sub new {
my ($class, $token, $repository, $severity_limits) = @_;
my $alerts_endpoint = "https://api.github.com/repos/$repository/code-scanning/alerts";
my $analyses_endpoint = "https://api.github.com/repos/$repository/code-scanning/analyses";

my $userAgent = Mojo::UserAgent -> new();
my $alerts_request = $userAgent -> get($alerts_endpoint, {Authorization => "Bearer $token"}) -> result();

my $alerts_endpoint = "https://api.github.com/repos/$repository/code-scanning/alerts";
my $analyses_endpoint = "https://api.github.com/repos/$repository/code-scanning/analyses";

my $userAgent = Mojo::UserAgent -> new();
if ($alerts_request -> code() == 200) {
my $alerts_data = $alerts_request -> json();
my $open_alerts = 0;
my %severity_counts = map {$_ => 0} keys %$severity_limits;

my $alerts_request = $userAgent -> get($alerts_endpoint, {Authorization => "Bearer $token"}) -> result();
foreach my $alert (@$alerts_data) {
if ($alert -> {state} eq "open") {
$open_alerts++;

my $severity = $alert -> {rule} -> {severity};
$severity_counts{$severity}++ if exists $severity_counts{$severity};
}
}

if ($alerts_request -> code() == 200) {
my $alerts_data = $alerts_request -> json();
my $open_alerts = 0;
my %severity_counts = map {$_ => 0} keys %$severity_limits;
print "[!] Total of open code scanning alerts: $open_alerts\n";

foreach my $severity (keys %severity_counts) {
print "[-] $severity: $severity_counts{$severity}\n";
}

foreach my $alert (@$alerts_data) {
if ($alert -> {state} eq "open") {
$open_alerts++;
my $severity = $alert -> {rule} -> {severity};
$severity_counts{$severity}++ if exists $severity_counts{$severity};
}
}

print "[!] Total of open code scanning alerts: $open_alerts\n";
foreach my $severity (keys %severity_counts) {
print "[-] $severity: $severity_counts{$severity}\n";
}
my $threshold_exceeded = 0;

foreach my $severity (keys %severity_counts) {
if ($severity_counts{$severity} > $severity_limits -> {$severity}) {
print "[+] More than $severity_limits -> {$severity} $severity code scanning alerts found.\n";

$threshold_exceeded = 1;
}
}

my $threshold_exceeded = 0;
foreach my $severity (keys %severity_counts) {
if ($severity_counts{$severity} > $severity_limits -> {$severity}) {
print "[+] More than $severity_limits -> {$severity} $severity code scanning alerts found.\n";
$threshold_exceeded = 1;
if ($threshold_exceeded) {
return 1;
}
}
}

if ($threshold_exceeded) {
return 1;
}
}

else {
print "Error: Unable to fetch code scanning alerts. HTTP status code: " . $alerts_request -> code() . "\n";
return 1;
}
else {
print "Error: Unable to fetch code scanning alerts. HTTP status code: " . $alerts_request -> code() . "\n";

return 1;
}

my $analyses_request = $userAgent -> get($analyses_endpoint, {Authorization => "Bearer $token"}) -> result();
my $analyses_request = $userAgent -> get($analyses_endpoint, {Authorization => "Bearer $token"}) -> result();

if ($analyses_request -> code() == 200) {
my $analyses_data = $analyses_request -> json();
print "[!] Total of code scanning analyses found: " . scalar(@$analyses_data) . "\n";
}
if ($analyses_request -> code() == 200) {
my $analyses_data = $analyses_request -> json();

print "[!] Total of code scanning analyses found: " . scalar(@$analyses_data) . "\n";
}

else {
print "Error: Unable to fetch code scanning analyses. HTTP status code: " . $analyses_request -> code() . "\n";
return 1;
}
else {
print "Error: Unable to fetch code scanning analyses. HTTP status code: " . $analyses_request -> code() . "\n";

return 1;
}

return 0;
return 0;
}
}

1;
1;
113 changes: 58 additions & 55 deletions lib/SecurityGate/Engine/Secrets.pm
View file
Original file line number Diff line number Diff line change
@@ -1,62 +1,65 @@
package SecurityGate::Engine::Secrets;

use strict;
use warnings;
use Mojo::UserAgent;
use Mojo::JSON;

sub new {
my ($class, $token, $repository) = @_;

my $endpoint = "https://api.github.com/repos/$repository/secret-scanning/alerts";
my $userAgent = Mojo::UserAgent -> new();
my $request = $userAgent -> get($endpoint, {Authorization => "Bearer $token"}) -> result();

if ($request -> code() == 200) {
my $data = $request -> json();
my $open_alerts = 0;
my @alert_details;

foreach my $alert (@$data) {
if ($alert -> {state} eq "open") {
$open_alerts++;

my $locations_endpoint = "https://api.github.com/repos/$repository/secret-scanning/alerts/$alert -> {number}/locations";
my $locations_request = $userAgent -> get($locations_endpoint, {Authorization => "Bearer $token"}) -> result();

if ($locations_request -> code() == 200) {
my $locations = $locations_request -> json();
push @alert_details, {
alert_number => $alert -> {number},
locations => $locations,
};
}
}
}

if ($open_alerts > 0) {
print "[!] Total of open secret scanning alerts: $open_alerts\n";
foreach my $detail (@alert_details) {
print "[-] Alert $detail -> {alert_number} found in the following locations:\n";
foreach my $location (@{$detail -> {locations}}) {
print " File: $location -> {path}, Start line: $location -> {start_line}\n";
package SecurityGate::Engine::Secrets {
use strict;
use warnings;
use Mojo::UserAgent;
use Mojo::JSON;

sub new {
my ($class, $token, $repository) = @_;

my $endpoint = "https://api.github.com/repos/$repository/secret-scanning/alerts";
my $userAgent = Mojo::UserAgent -> new();
my $request = $userAgent -> get($endpoint, {Authorization => "Bearer $token"}) -> result();

if ($request -> code() == 200) {
my $data = $request -> json();
my $open_alerts = 0;
my @alert_details;

foreach my $alert (@$data) {
if ($alert -> {state} eq "open") {
$open_alerts++;

my $locations_endpoint = "https://api.github.com/repos/$repository/secret-scanning/alerts/$alert -> {number}/locations";
my $locations_request = $userAgent -> get($locations_endpoint, {Authorization => "Bearer $token"}) -> result();

if ($locations_request -> code() == 200) {
my $locations = $locations_request -> json();

push @alert_details, {
alert_number => $alert -> {number},
locations => $locations,
};
}
}
}
}

print "[+] Secret scanning alert(s) found. Blocking pipeline.\n";
return 1;
}
if ($open_alerts > 0) {
print "[!] Total of open secret scanning alerts: $open_alerts\n";

foreach my $detail (@alert_details) {
print "[-] Alert $detail -> {alert_number} found in the following locations:\n";

foreach my $location (@{$detail -> {locations}}) {
print " File: $location -> {path}, Start line: $location -> {start_line}\n";
}
}

else {
print "[+] No secret scanning alerts found.\n";
return 0;
}
}
print "[+] Secret scanning alert(s) found. Blocking pipeline.\n";
return 1;
}

else {
print "Error: Unable to fetch secret scanning alerts. HTTP status code: " . $request -> code() . "\n";
return 1;
else {
print "[-] No secret scanning alerts found.\n";
return 0;
}
}

else {
print "Error: Unable to fetch secret scanning alerts. HTTP status code: " . $request -> code() . "\n";
return 1;
}
}
}

1;
1;

0 comments on commit c936433

Please sign in to comment.