New pre commit hook by rajk1000 · Pull Request #3 · rajk1000/tfsec-testing

rajk1000 · 2022-09-08T11:22:05Z

No description provided.

pspandler

Just cosmetic stuff and standardisation needed for now - fixing this and adding comments will help.

pspandler · 2022-09-08T12:10:46Z

.githooks/pre-commit

+#!/bin/bash
+#set -x
+PREFIX="pre-commit:"
+RESULTS_FILE=tfsec-scan-output.txt


Quote your variables please.

Also, it would help if there were some useful comments - reading comments aids understanding.

pspandler · 2022-09-08T12:11:31Z

.githooks/pre-commit

+initialise() {
+    mkdir -p $TFSEC_WORKING_DIR
+    mkdir -p $TFSEC_RESULTS_DIR
+    rm  $TFSEC_WORKING_DIR/* 2> /dev/null


Remove stray space.

Why are you redirecting STDERR to /dev/null?

ok. Redirecting as it gives an error if this is run for the first time

Righto, maybe you could:

see if the directory exists

if yes, delete it & recreate it

if no, create it

pspandler · 2022-09-08T12:11:57Z

.githooks/pre-commit

+#set -x
+PREFIX="pre-commit:"
+RESULTS_FILE=tfsec-scan-output.txt
+TFSEC_RESULTS_DIR=/tmp/tfsec-results


pspandler · 2022-09-08T12:12:05Z

.githooks/pre-commit

+PREFIX="pre-commit:"
+RESULTS_FILE=tfsec-scan-output.txt
+TFSEC_RESULTS_DIR=/tmp/tfsec-results
+TFSEC_WORKING_DIR=/tmp/tfsec-files


pspandler · 2022-09-08T12:12:14Z

.githooks/pre-commit

+    mkdir -p $TFSEC_WORKING_DIR
+    mkdir -p $TFSEC_RESULTS_DIR
+    rm  $TFSEC_WORKING_DIR/* 2> /dev/null
+    rm  $TFSEC_RESULTS_DIR/* 2> /dev/null


pspandler · 2022-09-08T12:21:44Z

.githooks/pre-commit

+initialise;
+populateGlobalVars;
+
+if [ "$TERRAFORM_FILES_STAGED" = "yes" ]; then


Are you using [ ] or [[ ]]..?

I think [[ ]] is safer, but I can't remember why.

pspandler · 2022-09-08T12:22:00Z

.githooks/pre-commit

+    copyTerraformFilesToBeScanned;
+
+    #Do the latest tfsec scan on the files that have been staged    
+    if ! tfsec $TFSEC_WORKING_DIR --no-colour --out $TFSEC_RESULTS_DIR/$RESULTS_FILE; then


Quoting and cuddling, blah, blah.

pspandler · 2022-09-08T12:22:22Z

.githooks/pre-commit

+        if [ "$ALLOW_TFSEC_ISSUES" = "yes" ]
+	    then
+            #Check that the file added is exactly the same as the latest tfsec issues. They must be identical in order for the commit to be allowed through
+            diffResult=$(diff $TFSEC_RESULTS_DIR/$RESULTS_FILE $TFSEC_WORKING_DIR/$RESULTS_FILE)


pspandler · 2022-09-08T12:22:58Z

.githooks/pre-commit

+            diffResult=$(diff $TFSEC_RESULTS_DIR/$RESULTS_FILE $TFSEC_WORKING_DIR/$RESULTS_FILE)
+            if [ $? -eq 0 ]
+            then
+                informUserThatWeAllowCommitThroughDespiteTfsecIssues;


Not a fan of Camel case function names.

Also, could they be shorter?

pspandler · 2022-09-08T12:23:16Z

.githooks/pre-commit

+                exit 1
+            fi
+	    else
+            informUserThatWeDenyCommitBecauseOutstandingTfSecIssues;


Indentation

rajk1000 added 4 commits September 8, 2022 12:05

Adding correct tfsec-scan-output.txt file to check the diff working ok

54c8a4b

Adding correct tfsec-scan-output.txt file to check the diff working ok

f04be76

Adding the pre-commit hook and instructions on how to set it up

b2d4132

comment out the set -x in the pre-commit script

ed5efd3

pspandler suggested changes Sep 8, 2022

View reviewed changes

rajk1000 added 25 commits September 8, 2022 15:46

removing scan out file to o do more testing

17f7397

Adding correct tfsec-scan-output.txt file to check the diff working ok

304b34e

removing scan out file to o do more testing

50088b0

Adding correct tfsec-scan-output.txt file to check the diff working ok

8ad9d5e

removing scan out file to o do more testing

9598897

Adding correct tfsec-scan-output.txt file to check the diff working ok

e254add

removing scan out file to o do more testing

b09a056

Adding correct tfsec-scan-output.txt file to check the diff working ok

0d34c4b

modifying pre-commit hook after review

dc86fcb

modifying bit more indent fixes pre-commit hook after review

f6f77fc

removing scan out file to o do more testing

a75009e

Adding correct tfsec-scan-output.txt file to check the diff working ok

8834a8b

adding more comments to pre-commit hook after review

0b9ea55

removing scan out file to o do more testing

7e4b03b

Adding correct tfsec-scan-output.txt file to check the diff working ok

5606ca2

adding some variable cuddling to pre-commit hook after review

71e40bd

removing scan out file to o do more testing

62405ab

Adding correct tfsec-scan-output.txt file to check the diff working ok

b05dc3d

adding some tweaks to pre-commit hook after review

9c16a79

Adding tfsec-scan-output.txt file to check the diff working ok

59927b2

removing scan out file to o do more testing

181033f

adding in main to do more testing

a010147

adding in mod file

6207827

Adding correct tfsec-scan-output.txt file to check the diff working ok

c5b0f7a

removing in mod file

a94c175

rajk1000 added 14 commits September 9, 2022 14:17

removing scan out file to o do more testing

eb5f427

adding in a comment only

3cb661a

Adding in insecure code

90d746c

removing scan out file to o do more testing

fb615a1

Adding correct tfsec-scan-output.txt file to check the diff working ok

26190c3

Adding correct tfsec-scan-output.txt file to check the diff working ok

eb3a548

removing scan out file to o do more testing

daae91c

changed name of bucket

4ff1f44

Added in ability to pass in TFSEC_PRECOMMIT_ARGS to tfsec

04f160b

stuff dding in pre-commit hook that runs tfsec on new terraform files

1a09a2e

removing scan out file to o do more testing

681ce63

comment to trigger tfsec

d00efff

removing scan out file to o do more testing

1fba480

Adding correct tfsec-scan-output.txt file to check the diff working ok

ca27cd6

Conversation

rajk1000 commented Sep 8, 2022

Uh oh!

pspandler left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants