Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add implementations for new API: config profile with repository context #1054

Open
wants to merge 17 commits into
base: dev
Choose a base branch
from

Conversation

eranturgeman
Copy link
Contributor

  • All tests passed. If this feature is not already covered by the tests, I added new tests.
  • All static analysis checks passed.
  • This pull request is on the dev branch.
  • I used gofmt for formatting the code before submitting the pull request.

@eranturgeman eranturgeman added safe to test Approve running integration tests on a pull request ignore for release Automatically generated release notes labels Dec 10, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Dec 10, 2024
@eranturgeman eranturgeman added the safe to test Approve running integration tests on a pull request label Dec 10, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Dec 10, 2024
@eranturgeman eranturgeman added the safe to test Approve running integration tests on a pull request label Dec 11, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Dec 11, 2024
@eranturgeman eranturgeman added the safe to test Approve running integration tests on a pull request label Dec 11, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Dec 11, 2024
@eranturgeman eranturgeman added the safe to test Approve running integration tests on a pull request label Dec 11, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Dec 11, 2024
@eranturgeman eranturgeman added the safe to test Approve running integration tests on a pull request label Dec 11, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Dec 11, 2024
@eranturgeman eranturgeman added the safe to test Approve running integration tests on a pull request label Dec 15, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Dec 15, 2024
@eranturgeman eranturgeman added the safe to test Approve running integration tests on a pull request label Dec 15, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Dec 15, 2024
@eranturgeman eranturgeman requested review from attiasas, eyalbe4 and orz25 and removed request for eyalbe4 and attiasas December 15, 2024 11:59
if err != nil {
t.Skip(err)
}
err = clientUtils.ValidateMinimumVersion(clientUtils.Xsc, currentXrayVersion, minXscVersion)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the last variable here should be minXrayVersion?

@eranturgeman eranturgeman added the safe to test Approve running integration tests on a pull request label Dec 15, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Dec 15, 2024
@eyalbe4 eyalbe4 added the safe to test Approve running integration tests on a pull request label Dec 15, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Dec 15, 2024
Copy link
Contributor

🚨 Frogbot scanned this pull request and found the below:


Copy link
Contributor

{
		User: "admin",
		Auth: []ssh.AuthMethod{
			sshAuth,
		},
		//#nosec G106 -- Used to get ssh headers only.
		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
	}

at auth/sshlogin.go (line 67)

🎯 Static Application Security Testing (SAST) Vulnerability

Severity Finding

Low
SSH key not verified properly, expired certificates may be accepted
Full description

Overview

SSH Keys Past Expiration is a vulnerability that occurs when SSH keys
used for authentication have expired. Expired keys can lead to
unauthorized access to systems and sensitive data, posing a security
risk to the organization.

Vulnerable example

package main

import (
    "golang.org/x/crypto/ssh"
    "net"
)

func main() {}

func insecureIgnoreHostKey() {
    _ = &ssh.ClientConfig{
        User:            "username",
        Auth:            []ssh.AuthMethod{nil},
        HostKeyCallback: ssh.InsecureIgnoreHostKey(),
    }
}

In this example, the InsecureIgnoreHostKey function is used to ignore
host key verification, which can lead to accepting expired or invalid
keys.

Remediation

package main

import (
    "golang.org/x/crypto/ssh"
    "net"
)

func main() {}

func secureHostKeyCallback() {
    publicKeyBytes, _ := ioutil.ReadFile("allowed_hostkey.pub")
    publicKey, _ := ssh.ParsePublicKey(publicKeyBytes)

    _ = &ssh.ClientConfig{
        User:            "username",
        Auth:            []ssh.AuthMethod{nil},
        HostKeyCallback: ssh.FixedHostKey(publicKey),
    }
}

By using allowed host keys and proper host key verification, we can
mitigate the risk of accepting expired or invalid SSH keys.


Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
ignore for release Automatically generated release notes
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants