From 077cdeabaff1e8c8b19f422300b14da7a53bb725 Mon Sep 17 00:00:00 2001 From: HugoPBrito Date: Fri, 13 Dec 2024 21:37:38 +0000 Subject: [PATCH] feat: added check logic and metadata --- .../repository_denies_force_push/__init__.py | 0 ...repository_denies_force_push.metadata.json | 30 ++++++++++++++ .../repository_denies_force_push.py | 40 +++++++++++++++++++ .../services/repository/repository_service.py | 3 ++ 4 files changed, 73 insertions(+) create mode 100644 prowler/providers/github/services/repository/repository_denies_force_push/__init__.py create mode 100644 prowler/providers/github/services/repository/repository_denies_force_push/repository_denies_force_push.metadata.json create mode 100644 prowler/providers/github/services/repository/repository_denies_force_push/repository_denies_force_push.py diff --git a/prowler/providers/github/services/repository/repository_denies_force_push/__init__.py b/prowler/providers/github/services/repository/repository_denies_force_push/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/github/services/repository/repository_denies_force_push/repository_denies_force_push.metadata.json b/prowler/providers/github/services/repository/repository_denies_force_push/repository_denies_force_push.metadata.json new file mode 100644 index 0000000000..9021971111 --- /dev/null +++ b/prowler/providers/github/services/repository/repository_denies_force_push/repository_denies_force_push.metadata.json @@ -0,0 +1,30 @@ +{ + "Provider": "github", + "CheckID": "repository_denies_force_push", + "CheckTitle": "Check if repository denies force push", + "CheckType": [], + "ServiceName": "repository", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", + "ResourceType": "Other", + "Description": "Ensure that the repository denies force push to protected branches.", + "Risk": "Permitting force pushes to branches can lead to accidental or intentional overwrites of the commit history, resulting in potential data loss, code inconsistencies, or the introduction of malicious changes. This compromises the stability and security of the repository.", + "RelatedUrl": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#allow-force-pushes", + "Remediation": { + "Code": { + "CLI": "", + "NativeIaC": "", + "Other": "", + "Terraform": "" + }, + "Recommendation": { + "Text": "Disable force pushes on protected branches to preserve the commit history and ensure the integrity of the repository. This measure helps prevent unintentional data loss and protects the repository from malicious changes.", + "Url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule" + } + }, + "Categories": [], + "DependsOn": [], + "RelatedTo": [], + "Notes": "" +} diff --git a/prowler/providers/github/services/repository/repository_denies_force_push/repository_denies_force_push.py b/prowler/providers/github/services/repository/repository_denies_force_push/repository_denies_force_push.py new file mode 100644 index 0000000000..bf1c0f3675 --- /dev/null +++ b/prowler/providers/github/services/repository/repository_denies_force_push/repository_denies_force_push.py @@ -0,0 +1,40 @@ +from typing import List + +from prowler.lib.check.models import Check, Check_Report_Github +from prowler.providers.github.services.repository.repository_client import ( + repository_client, +) + + +class repository_denies_force_push(Check): + """Check if a repository denies force push + + This class verifies whether each repository denies force push. + """ + + def execute(self) -> List[Check_Report_Github]: + """Execute the Github Repository Denies Force Push check + + Iterates over all repositories and checks if they deny force push. + + Returns: + List[Check_Report_Github]: A list of reports for each repository + """ + findings = [] + for repo in repository_client.repositories.values(): + report = Check_Report_Github(self.metadata()) + report.resource_id = repo.id + report.resource_name = repo.name + report.status = "FAIL" + report.status_extended = f"Repository {repo.name} does allow force push." + + if ( + repo.default_branch_protection + and not repo.default_branch_protection.allow_force_push + ): + report.status = "PASS" + report.status_extended = f"Repository {repo.name} does deny force push." + + findings.append(report) + + return findings diff --git a/prowler/providers/github/services/repository/repository_service.py b/prowler/providers/github/services/repository/repository_service.py index d20d92aa57..2426b7f456 100644 --- a/prowler/providers/github/services/repository/repository_service.py +++ b/prowler/providers/github/services/repository/repository_service.py @@ -47,10 +47,12 @@ class Repository(GithubService): required_linear_history = ( protection.required_linear_history ) + allow_force_pushes = protection.allow_force_pushes branch_protection = Protection( require_pull_request=require_pr, approval_count=approval_cnt, linear_history=required_linear_history, + allow_force_push=allow_force_pushes, ) except Exception as e: logger.warning( @@ -80,6 +82,7 @@ class Protection(BaseModel): require_pull_request: bool = False approval_count: int = 0 linear_history: bool = False + allow_force_push: bool = False class Repo(BaseModel):