Skip to content

Commit 345a431

Browse files
J12934J12934
committed
Merge branch 'main' into v3
2 parents 47d0120 + 625547e commit 345a431

15 files changed

Lines changed: 222 additions & 1672 deletions

File tree

.eslintrc.license renamed to .eslintrc.json.license

File renamed without changes.

‎.github/workflows/helm-docs.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ jobs:
2323
passphrase: ${{ secrets.GPG_COMMITS_PASSPHRASE }}
2424
git-user-signingkey: true
2525
git-commit-gpgsign: true
26+
commit_options: '--signoff'
2627

2728
- name: Download Helm Docs
2829
run: |

‎.reuse/dep5‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
22
Upstream-Name: secureCodeBox
33
Upstream-Contact: Robert Seedorff <robert.seedorff@iteratec.com>
4-
Source: www.securecodebox.io
4+
Source: https://github.com/secureCodeBox/secureCodeBox

‎CONTRIBUTING.md‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ SPDX-License-Identifier: Apache-2.0
1414
- [Working with Issues - How to Contribute in Issues](#working-with-issues---how-to-contribute-in-issues)
1515
- [How to Write Commit Messages](#how-to-write-commit-messages)
1616
- [Code of Conduct](#code-of-conduct)
17+
- [Developer Certificate of Origin and Licensing](#developer-certificate-of-origin-and-licensing)
1718

1819
## GitHub Flow
1920

@@ -79,7 +80,7 @@ For bugfixes and security fixes of the current release please follow the followi
7980
- For the main branch:
8081
- Create a bugfix branch from `main` branch
8182
- Cherry-Pick Bugfix and commit to bugfix branch
82-
- Create PR to `main` branch
83+
- Create PR to `main` branch
8384

8485
## Working with Issues - How to Contribute in Issues
8586

@@ -88,7 +89,7 @@ Before you open an issue please verify there is no existing one covering your is
8889

8990
## How to Write Commit Messages
9091

91-
For more information see [here](https://chris.beams.io/posts/git-commit/).
92+
For more information see [Chris Beams article](https://chris.beams.io/posts/git-commit/).
9293

9394
TL;DR
9495

@@ -100,8 +101,21 @@ TL;DR
100101
6. Wrap the body at 72 characters
101102
7. Use the body to explain what and why vs. how
102103

103-
NOTE: Make sure you don't include `@mentions` or `fixes` keywords in your git commit messages. These should be included in the PR body instead.
104+
**NOTE**: Make sure you don't include `@mentions` or `fixes` keywords in your git commit messages. These should be included in the PR body instead.
105+
106+
**NOTE**: Make sure to add your signed-off-by tag as described in our [contributors file][contributors-file].
104107

105108
## Code of Conduct
106109

107110
Please have a look at our [Code of Conduct](./CODE_OF_CONDUCT.md) before you write an Issue or make a PR.
111+
112+
## Developer Certificate of Origin and Licensing
113+
114+
We decided to use [DCO](https://en.wikipedia.org/wiki/Developer_Certificate_of_Origin) instead of [CLA](https://en.wikipedia.org/wiki/Contributor_License_Agreement) as described in [CLAs and using DCO clearly](https://medium.com/@flamefew/clas-and-using-dco-clearly-e46b09a4c048). The reason for that: We need to be sure that one submitting a contribution to this repository is allowed to do this and does not violates copyrights of someone else. For that purpose you have to do some steps to to fullfil our DCO requirements:
115+
116+
1. Read carefully our [contributors file][contributors-file].
117+
2. Open a pull request which adds you to the [contributors file][contributors-file] to agree the DCO.
118+
3. Always add a signed-of tag to all your commits as described in the [contributors file][contributors-file].
119+
4. Add a SPDX license header to all files your contribution will create. You can use the [reuse tool](https://reuse.software) with our [helper script](./bin/add-license-header.sh).
120+
121+
[contributors-file]: ./CONTRIBUTORS.md

‎CONTRIBUTORS.md‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
<!--
2+
SPDX-FileCopyrightText: 2021 iteratec GmbH
3+
4+
SPDX-License-Identifier: Apache-2.0
5+
-->
6+
17
# Contributors
28

39
If you would like to make contributions to this repository, please certify to the following Developer's Certificate of Origin (DCO) in [this repository](DCO). Please confirm your certification to the DCO by adding a sign-of tag to all your commit messages and adding your author name (e.g. `gordon shumway <alf@melmak.com>`) to the following list of contributors and open a pull request.
@@ -20,4 +26,5 @@ Committing with `git commit -s` will add the sign-off at the end of the commit m
2026
- Sven Strittmatter <sven.strittmatter@iteratec.com>
2127
- Tim Walter <tim.walter@iteratec.com>
2228
- Yannik Fuhrmeister <yannik.fuhrmeister@iteratec.com>
23-
29+
- Jannik Hollenbach <jannik.hollenbach@iteratec.com>
30+
- Johannes Zahn <johannes.zahn@iteratec.com>

‎bin/add-license-header.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@
1414
# add-license-header.sh file1 file2 file3
1515
# cat file_list.txt | add-license-header.sh
1616
#
17+
# To generate the file list use `reuse lint`. This produces a Markdown report:
18+
# reuse lint > spdx-report.md
19+
#
1720
# See also:
1821
# - https://spdx.org
1922
# - https://reuse.software

‎hooks/notification/README.md‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ notificationChannels:
3434
- name: slack
3535
type: slack
3636
template: slack-messageCard
37+
skipNotificationOnZeroFinding: true
3738
rules:
3839
- matches:
3940
anyOf:
@@ -54,14 +55,19 @@ The `name` is used to for debugging failing notifications.
5455
it can be a _string_ of you choice.
5556
5657
The `type` specifies the type of the notification (in this example slack).
57-
Currently `slack` is the only available type, but we are working on others (e.g. MS Teams or email) as well.
58+
See [Available Notifier](#available-notifier).
5859
5960
The `template` field defines the name of a Nunjucks template to send to your notification channel.
6061
These templates are usually tied to their notification channel (slack templates will not work for teams).
6162
The template `slack-messageCard` is provided by default.
6263
Notice that for the name of the template we chose to omit the file type.
6364
The template `slack-messageCard` will point to `slack-messageCard.njk` in the filesystem of the hook.
6465
66+
The `skipNotificationOnZeroFindings` if set to true will cause the notifier when there were no findings.
67+
This can happen when the scan did not identify any or if all findings were filtered out using [rules](#rule-configuration).
68+
Defaults to `false` if not set.
69+
You can use `skipNotificationOnZeroFindings` to only send out notification for non duplicate findings, e.g. by combining the DefectDojo hook with this one and filtering out the `duplicate` attribute in the rules.
70+
6571
The `endPoint` specifies where the notification has to go to.
6672
To protect the actual endPoint (e.g. a webhook url) this should point to an env name defined under `env`
6773
For slack this would be your webhook URL to slack.
@@ -177,10 +183,15 @@ The identifier for this config has to be `SMTP_CONFIG`.
177183
A basic configuration could look like this:
178184
179185
```
180-
...
186+
notificationChannels:
187+
- name: email
188+
type: email
189+
template: email
190+
rules: []
191+
endPoint: "someone@somewhere.xyz"
181192
env:
182193
- name: SMTP_CONFIG
183-
value: "smtp://user@domain.tld:pass@smtp.domain.tld/"
194+
value: "smtp://user:pass@smtp.domain.tld/"
184195
```
185196
186197
To provide a custom `from` field for your email you can specify `EMAIL_FROM` under env.
@@ -189,7 +200,7 @@ For example:
189200
```
190201
env:
191202
- name: SMTP_CONFIG
192-
value: "smtp://user@domain.tld:pass@smtp.domain.tld/"
203+
value: "smtp://user:pass@smtp.domain.tld/"
193204
- name: EMAIL_FROM
194205
value: secureCodeBox
195206
```

‎hooks/notification/README.md.gotmpl‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ notificationChannels:
3939
- name: slack
4040
type: slack
4141
template: slack-messageCard
42+
skipNotificationOnZeroFinding: true
4243
rules:
4344
- matches:
4445
anyOf:
@@ -59,14 +60,19 @@ The `name` is used to for debugging failing notifications.
5960
it can be a _string_ of you choice.
6061

6162
The `type` specifies the type of the notification (in this example slack).
62-
Currently `slack` is the only available type, but we are working on others (e.g. MS Teams or email) as well.
63+
See [Available Notifier](#available-notifier).
6364

6465
The `template` field defines the name of a Nunjucks template to send to your notification channel.
6566
These templates are usually tied to their notification channel (slack templates will not work for teams).
6667
The template `slack-messageCard` is provided by default.
6768
Notice that for the name of the template we chose to omit the file type.
6869
The template `slack-messageCard` will point to `slack-messageCard.njk` in the filesystem of the hook.
6970

71+
The `skipNotificationOnZeroFindings` if set to true will cause the notifier when there were no findings.
72+
This can happen when the scan did not identify any or if all findings were filtered out using [rules](#rule-configuration).
73+
Defaults to `false` if not set.
74+
You can use `skipNotificationOnZeroFindings` to only send out notification for non duplicate findings, e.g. by combining the DefectDojo hook with this one and filtering out the `duplicate` attribute in the rules.
75+
7076
The `endPoint` specifies where the notification has to go to.
7177
To protect the actual endPoint (e.g. a webhook url) this should point to an env name defined under `env`
7278
For slack this would be your webhook URL to slack.
@@ -182,10 +188,15 @@ The identifier for this config has to be `SMTP_CONFIG`.
182188
A basic configuration could look like this:
183189

184190
```
185-
...
191+
notificationChannels:
192+
- name: email
193+
type: email
194+
template: email
195+
rules: []
196+
endPoint: "someone@somewhere.xyz"
186197
env:
187198
- name: SMTP_CONFIG
188-
value: "smtp://user@domain.tld:pass@smtp.domain.tld/"
199+
value: "smtp://user:pass@smtp.domain.tld/"
189200
```
190201

191202
To provide a custom `from` field for your email you can specify `EMAIL_FROM` under env.
@@ -194,7 +205,7 @@ For example:
194205
```
195206
env:
196207
- name: SMTP_CONFIG
197-
value: "smtp://user@domain.tld:pass@smtp.domain.tld/"
208+
value: "smtp://user:pass@smtp.domain.tld/"
198209
- name: EMAIL_FROM
199210
value: secureCodeBox
200211
```

‎hooks/notification/hook.test.ts‎

Lines changed: 1 addition & 152 deletions
Original file line numberDiff line numberDiff line change
@@ -3,162 +3,11 @@
33
// SPDX-License-Identifier: Apache-2.0
44

55
import * as path from "path";
6-
import { handle, matches, getNotificationChannels, mapToEndPoint } from "./hook";
6+
import { matches, getNotificationChannels, mapToEndPoint } from "./hook";
77
import { Finding } from "./model/Finding";
88
import { NotificationChannel } from "./model/NotificationChannel";
99
import { NotifierType } from "./NotifierType";
1010

11-
const scan = {
12-
metadata: {
13-
uid: "09988cdf-1fc7-4f85-95ee-1b1d65dbc7cc",
14-
name: "demo-scan-1601086432",
15-
namespace: "my-scans",
16-
creationTimestamp: "2021-01-01T14:29:25Z",
17-
labels: {
18-
company: "iteratec",
19-
"attack-surface": "external",
20-
},
21-
},
22-
spec: {
23-
scanType: "Nmap",
24-
parameters: ["-Pn", "localhost"],
25-
},
26-
status: {
27-
findingDownloadLink:
28-
"https://my-secureCodeBox-instance.com/scan-b9as-sdweref--sadf-asdfsdf-dasdgf-asdffdsfa7/findings.json",
29-
findings: {
30-
categories: {
31-
"A Client Error response code was returned by the server": 1,
32-
"Information Disclosure - Sensitive Information in URL": 1,
33-
"Strict-Transport-Security Header Not Set": 1,
34-
},
35-
count: 3,
36-
severities: {
37-
high: 10,
38-
medium: 5,
39-
low: 2,
40-
informational: 1,
41-
},
42-
},
43-
finishedAt: "2020-05-25T02:38:13Z",
44-
rawResultDownloadLink:
45-
"https://my-secureCodeBox-instance.com/scan-blkfsdg-sdgfsfgd-sfg-sdfg-dfsg-gfs98-e8af2172caa7/zap-results.json?Expires=1601691232",
46-
rawResultFile: "zap-results.json",
47-
rawResultType: "zap-json",
48-
state: "Done",
49-
},
50-
};
51-
52-
const findings = [
53-
{
54-
name: "SSH Service",
55-
description: "SSH Service Information",
56-
category: "SSH Service",
57-
osi_layer: "APPLICATION",
58-
severity: "INFORMATIONAL",
59-
reference: {},
60-
hint: "",
61-
location: "dummy-ssh.demo-apps.svc",
62-
attributes: {
63-
hostname: "dummy-ssh.demo-apps.svc",
64-
ip_address: "10.102.131.102",
65-
server_banner: "SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.8",
66-
ssh_version: 2,
67-
os_cpe: "o:canonical:ubuntu:16.04",
68-
ssh_lib_cpe: "a:openssh:openssh:7.2p2",
69-
compliance_policy: "Mozilla Modern",
70-
compliant: false,
71-
grade: "D",
72-
references: ["https://wiki.mozilla.org/Security/Guidelines/OpenSSH"],
73-
auth_methods: ["publickey", "password"],
74-
key_algorithms: [
75-
"curve25519-sha256@libssh.org",
76-
"ecdh-sha2-nistp256",
77-
"ecdh-sha2-nistp384",
78-
"ecdh-sha2-nistp521",
79-
"diffie-hellman-group-exchange-sha256",
80-
"diffie-hellman-group14-sha1",
81-
],
82-
encryption_algorithms: [
83-
"chacha20-poly1305@openssh.com",
84-
"aes128-ctr",
85-
"aes192-ctr",
86-
"aes256-ctr",
87-
"aes128-gcm@openssh.com",
88-
"aes256-gcm@openssh.com",
89-
],
90-
mac_algorithms: [
91-
"umac-64-etm@openssh.com",
92-
"umac-128-etm@openssh.com",
93-
"hmac-sha2-256-etm@openssh.com",
94-
"hmac-sha2-512-etm@openssh.com",
95-
"hmac-sha1-etm@openssh.com",
96-
"umac-64@openssh.com",
97-
"umac-128@openssh.com",
98-
"hmac-sha2-256",
99-
"hmac-sha2-512",
100-
"hmac-sha1",
101-
],
102-
compression_algorithms: ["none", "zlib@openssh.com"],
103-
},
104-
id: "17ac9886-d083-4c58-8518-557aa3b38d2d",
105-
},
106-
{
107-
name: "Insecure SSH Key Algorithms",
108-
description: "Deprecated / discouraged SSH key algorithms are used",
109-
category: "SSH Policy Violation",
110-
osi_layer: "NETWORK",
111-
severity: "MEDIUM",
112-
reference: {},
113-
hint: "Remove these key exchange algorithms: diffie-hellman-group14-sha1",
114-
location: "dummy-ssh.demo-apps.svc",
115-
attributes: {
116-
hostname: "dummy-ssh.demo-apps.svc",
117-
ip_address: "10.102.131.102",
118-
payload: ["diffie-hellman-group14-sha1"],
119-
},
120-
id: "650c5ed1-00fb-44e3-933c-515dca4a1eda",
121-
},
122-
{
123-
name: "Insecure SSH MAC Algorithms",
124-
description: "Deprecated / discouraged SSH MAC algorithms are used",
125-
category: "SSH Policy Violation",
126-
osi_layer: "NETWORK",
127-
severity: "MEDIUM",
128-
reference: {},
129-
hint:
130-
"Remove these MAC algorithms: umac-64-etm@openssh.com, hmac-sha1-etm@openssh.com, umac-64@openssh.com, hmac-sha1",
131-
location: "dummy-ssh.demo-apps.svc",
132-
attributes: {
133-
hostname: "dummy-ssh.demo-apps.svc",
134-
ip_address: "10.102.131.102",
135-
payload: [
136-
"umac-64-etm@openssh.com",
137-
"hmac-sha1-etm@openssh.com",
138-
"umac-64@openssh.com",
139-
"hmac-sha1",
140-
],
141-
},
142-
id: "5b681ed0-b509-400b-bb1e-ae839bb1b766",
143-
},
144-
{
145-
name: "Discouraged SSH authentication methods",
146-
description: "Discouraged SSH authentication methods are used",
147-
category: "SSH Policy Violation",
148-
osi_layer: "NETWORK",
149-
severity: "MEDIUM",
150-
reference: {},
151-
hint: "Remove these authentication methods: password",
152-
location: "dummy-ssh.demo-apps.svc",
153-
attributes: {
154-
hostname: "dummy-ssh.demo-apps.svc",
155-
ip_address: "10.102.131.102",
156-
payload: ["password"],
157-
},
158-
id: "4485916d-3747-4c16-a730-a9b1146dd9a2",
159-
},
160-
];
161-
16211
test("Should Match for High Severity Findings", async () => {
16312
const finding: Finding = {
16413
name: "test finding",

‎hooks/notification/hook.ts‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,11 @@ export async function handle({ getFindings, scan }) {
1919
for (const channel of notificationChannels) {
2020
channel.endPoint = mapToEndPoint(channel.endPoint);
2121
const findingsToNotify = findings.filter(finding => matches(finding, channel.rules));
22+
23+
if (channel.skipNotificationOnZeroFindings === true && findings.length === 0) {
24+
continue;
25+
}
26+
2227
const notifier: Notifier = NotifierFactory.create(channel, scan, findingsToNotify, args);
2328
await notifier.sendMessage();
2429
}

0 commit comments

Comments
 (0)