Skip to content
This repository has been archived by the owner on Jul 19, 2023. It is now read-only.

Commit

Permalink
feat: Add more scanners as regex for sca and iac rules
Browse files Browse the repository at this point in the history
* add support to jfrog prevent password rule

* add more tools to iac & sca rules

* CR fixes
  • Loading branch information
OriYosef authored Sep 29, 2022
1 parent 1763c8a commit 378dc88
Show file tree
Hide file tree
Showing 2 changed files with 30 additions and 2 deletions.
26 changes: 24 additions & 2 deletions pkg/rulesConfig/defaultRules/10-ensure-sca-scanner.go
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ package defaultRules

import (
"encoding/json"
"fmt"

githubConnector "github.com/allero-io/allero/pkg/connectors/github"
gitlabConnector "github.com/allero-io/allero/pkg/connectors/gitlab"
Expand Down Expand Up @@ -35,11 +36,16 @@ func githubErrorsRule10(githubData map[string]*githubConnector.GithubOwner) ([]*
".*anchore/scan-action@.*",
".*synopsys-sig/detect-action@.*",
".*aquasecurity/trivy-action@.*",
".*checkmarx-ts/checkmarx-cxflow-github-action@.*",
".*snyk/actions/maven@.*",
}

runRegexExpressions := []string{
".*^[\\S]*trivy.*|.*docker .* run .*(aquasec/)?trivy.*",
"^[\\S]*grype|docker .* run .*(anchore/)?grype.*",
"(jfrog|jf) (s|scan).*",
"ws scan.*",
"snyk (code | )test.*",
}

for _, owner := range githubData {
Expand Down Expand Up @@ -131,15 +137,31 @@ func gitlabErrorsRule10(gitlabData map[string]*gitlabConnector.GitlabGroup) ([]*
}

func findScaScannerRule10(project *gitlabConnector.GitlabProject) (bool, error) {

imageRegexExpressions := []string{
"registry.gitlab.com/secure.*",
}

scriptRegexExpressions := []string{
".*^[\\S]*trivy.*|.*docker .* run .*(aquasec/)?trivy.*",
"^[\\S]*grype|docker .* run .*(anchore/)?grype.*",
"(jfrog|jf) (s|scan).*",
"ws scan.*",
"snyk ?(code | )test.*",
}

for _, pipeline := range project.GitlabCi {

for _, stage := range pipeline.Content {
stageBytes, err := json.Marshal(stage)
for key, value := range pipeline.Content {
if key == "image" {
imageValue := fmt.Sprintf("%v", value)
for _, imageRegexExpression := range imageRegexExpressions {
if matchRegex(imageRegexExpression, imageValue) {
return true, nil
}
}
}
stageBytes, err := json.Marshal(value)
if err != nil {
return false, err
}
Expand Down
6 changes: 6 additions & 0 deletions pkg/rulesConfig/defaultRules/11-ensure-terraform-scanner.go
Original file line number Diff line number Diff line change
Expand Up @@ -36,10 +36,14 @@ func githubErrorsRule11(githubData map[string]*githubConnector.GithubOwner) ([]*
".*tenable/terrascan-action@.*",
".*snyk/actions/iac@.*",
".*aquasecurity/trivy-action@.*",
".*checkmarx/kics-github-action@.*",
".*kubescape/github-action@.*",
}

runRegexExpressions := []string{
".*^[\\S]*trivy.*|.*docker .* run .*(aquasec/)?trivy.*",
".*docker .* run .*checkmarx/kics scan.*",
".*kubescape scan.*",
}

for _, owner := range githubData {
Expand Down Expand Up @@ -133,6 +137,8 @@ func gitlabErrorsRule11(gitlabData map[string]*gitlabConnector.GitlabGroup) ([]*
func findScaScannerRule11(project *gitlabConnector.GitlabProject) (bool, error) {
scriptRegexExpressions := []string{
".*^[\\S]*trivy.*|.*docker .* run .*(aquasec/)?trivy.*",
".*docker .* run .*checkmarx/kics scan.*",
".*kubescape scan.*",
}

for _, pipeline := range project.GitlabCi {
Expand Down

0 comments on commit 378dc88

Please sign in to comment.