From b703357027bda5221d7e9a93e542bf856b3a04cc Mon Sep 17 00:00:00 2001 From: Sergio Garcia <38561120+sergargar@users.noreply.github.com> Date: Tue, 8 Oct 2024 09:55:46 -0400 Subject: [PATCH] chore(secrets): use `master` branch of Yelp/detect-secrets (#5298) Co-authored-by: Pepe Fagoaga --- poetry.lock | 16 ++++--- prowler/config/config.yaml | 4 +- pyproject.toml | 2 +- tests/config/fixtures/config.yaml | 4 +- ...lambda_function_no_secrets_in_code_test.py | 45 +++++++++++++++++++ 5 files changed, 60 insertions(+), 11 deletions(-) diff --git a/poetry.lock b/poetry.lock index b6f64932be..db5f0c48d8 100644 --- a/poetry.lock +++ b/poetry.lock @@ -1302,15 +1302,13 @@ wrapt = ">=1.10,<2" dev = ["PyTest", "PyTest-Cov", "bump2version (<1)", "sphinx (<2)", "tox"] [[package]] -name = "detect-secrets" +name = "detect_secrets" version = "1.5.0" description = "Tool for detecting secrets in the codebase" optional = false python-versions = "*" -files = [ - {file = "detect_secrets-1.5.0-py3-none-any.whl", hash = "sha256:e24e7b9b5a35048c313e983f76c4bd09dad89f045ff059e354f9943bf45aa060"}, - {file = "detect_secrets-1.5.0.tar.gz", hash = "sha256:6bb46dcc553c10df51475641bb30fd69d25645cc12339e46c824c1e0c388898a"}, -] +files = [] +develop = false [package.dependencies] pyyaml = "*" @@ -1320,6 +1318,12 @@ requests = "*" gibberish = ["gibberish-detector"] word-list = ["pyahocorasick"] +[package.source] +type = "git" +url = "https://github.com/Yelp/detect-secrets.git" +reference = "master" +resolved_reference = "462720710ec337300fab2b4f2290949c7ee141eb" + [[package]] name = "dill" version = "0.3.9" @@ -5068,4 +5072,4 @@ type = ["pytest-mypy"] [metadata] lock-version = "2.0" python-versions = ">=3.9,<3.13" -content-hash = "f99a8859e7618ddc32babfd9b742ee8f8cc4520c274e245b358a0df252d56ee6" +content-hash = "0b367fa80501022efe43dc1beaa7f3da278fb64ffaddece72a0e88b09a0e53a2" diff --git a/prowler/config/config.yaml b/prowler/config/config.yaml index 5572a958c8..1e93bb87fb 100644 --- a/prowler/config/config.yaml +++ b/prowler/config/config.yaml @@ -335,8 +335,8 @@ aws: elbv2_min_azs: 2 - # Known secrets to ignore on detection - # this will include a list of regex patterns to ignore on detection + # AWS Secrets Configuration + # Patterns to ignore in the secrets checks secrets_ignore_patterns: [] # Azure Configuration diff --git a/pyproject.toml b/pyproject.toml index 7327862a0b..22c0ba71bf 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -53,7 +53,7 @@ colorama = "0.4.6" cryptography = "43.0.1" dash = "2.18.1" dash-bootstrap-components = "1.6.0" -detect-secrets = "1.5.0" +detect-secrets = {git = "https://github.com/Yelp/detect-secrets.git", rev = "master"} google-api-python-client = "2.147.0" google-auth-httplib2 = ">=0.1,<0.3" jsonschema = "4.23.0" diff --git a/tests/config/fixtures/config.yaml b/tests/config/fixtures/config.yaml index d2abd5a01e..0d0cca204d 100644 --- a/tests/config/fixtures/config.yaml +++ b/tests/config/fixtures/config.yaml @@ -333,8 +333,8 @@ aws: # Minimum number of Availability Zones that an ELBv2 must be in elbv2_min_azs: 2 - # Known secrets to ignore on detection - # this will include a list of regex patterns to ignore on detection + # AWS Secrets Configuration + # Patterns to ignore in the secrets checks secrets_ignore_patterns: [] # Azure Configuration diff --git a/tests/providers/aws/services/awslambda/awslambda_function_no_secrets_in_code/awslambda_function_no_secrets_in_code_test.py b/tests/providers/aws/services/awslambda/awslambda_function_no_secrets_in_code/awslambda_function_no_secrets_in_code_test.py index 4fb6da3977..8256f13ad3 100644 --- a/tests/providers/aws/services/awslambda/awslambda_function_no_secrets_in_code/awslambda_function_no_secrets_in_code_test.py +++ b/tests/providers/aws/services/awslambda/awslambda_function_no_secrets_in_code/awslambda_function_no_secrets_in_code_test.py @@ -28,6 +28,12 @@ def lambda_handler(event, context): print("custom log event") return event """ +LAMBDA_FUNCTION_CODE_WITH_METADATA_API = """ +def lambda_handler(event, context): + metadata_api = "169.254.169.254" + print("custom log event") + return event +""" def create_lambda_function() -> Function: @@ -59,6 +65,12 @@ def mock_get_function_codewithout_secrets(): ) +def mock_get_function_codewith_metadata_api(): + yield create_lambda_function(), get_lambda_code_with_secrets( + LAMBDA_FUNCTION_CODE_WITH_METADATA_API + ) + + class Test_awslambda_function_no_secrets_in_code: def test_no_functions(self): lambda_client = mock.MagicMock @@ -144,3 +156,36 @@ class Test_awslambda_function_no_secrets_in_code: == f"No secrets found in Lambda function {LAMBDA_FUNCTION_NAME} code." ) assert result[0].resource_tags == [] + + def test_function_code_with_metadata_api(self): + lambda_client = mock.MagicMock + lambda_client.functions = {LAMBDA_FUNCTION_ARN: create_lambda_function()} + + lambda_client._get_function_code = mock_get_function_codewith_metadata_api + lambda_client.audit_config = {"secrets_ignore_patterns": []} + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_aws_provider(), + ), mock.patch( + "prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_code.awslambda_function_no_secrets_in_code.awslambda_client", + new=lambda_client, + ): + # Test Check + from prowler.providers.aws.services.awslambda.awslambda_function_no_secrets_in_code.awslambda_function_no_secrets_in_code import ( + awslambda_function_no_secrets_in_code, + ) + + check = awslambda_function_no_secrets_in_code() + result = check.execute() + + assert len(result) == 1 + assert result[0].region == AWS_REGION_US_EAST_1 + assert result[0].resource_id == LAMBDA_FUNCTION_NAME + assert result[0].resource_arn == LAMBDA_FUNCTION_ARN + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"No secrets found in Lambda function {LAMBDA_FUNCTION_NAME} code." + ) + assert result[0].resource_tags == []