Skip to content

Commit 934d844

Browse files
cx-miguel-neivacx-miguel-neiva
authored
Merge branch 'master' into fix/correct-regex-anchor
2 parents 064271a + 77505bb commit 934d844

55 files changed

Lines changed: 1668 additions & 564 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.2ms.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,3 +111,32 @@ ignore-result:
111111
- 754506f714ffc10628e6fe6dd05affa486d78234 # value used for testing
112112
- eebd28cd68ee73b9a1f68b85453575498c12c5b8 # value used for testing
113113
- 14f5cf9d2716f2cec7daf95ab86e1a4feaf7ba41 # value used for testing
114+
- d8901c5a580965cd0c1ad89aec17e94a9286ee01 # value used for testing
115+
- cf3ce6be9ae0c492bafeeac34978dcda9a5fb7b9 # value used for testing
116+
- df951402e6372dd78d4ed845e3b89ff6ac8b98ef # value used for testing
117+
- 62cf656ad2a1f6e82f31df38ced303c9e860428f # value used for testing
118+
- cfb862dc1f06113443c9c0b908f6322f139754f6 # value used for testing
119+
- feb671ccd2fb03b181aa8bb64455441cea4070e0 # value used for testing
120+
- d1a56c3e06ef27d9dbd0bcb6c38416935ee7aed1 # value used for testing
121+
- 7054f43a4dcd4954c3353800167e41a927934620 # value used for testing
122+
- 9d94eb297ac8cb2613d3091e1ee4d085bc3ce218 # value used for testing
123+
- 2d06c941743a66ec44d96c5db4b3b1e6e07a1eee # value used for testing
124+
- 9343373de08c9a35cb8f2d7695b02b5141de29d8 # value used for testing
125+
- 071b6cb8c1affc7e1c49137ead1b875cc5d08876 # value used for testing
126+
- f0dbf084d67ad8d1a132b1b77f3186df939ccb6f # value used for testing
127+
- 36421c2650a6f6ed3ed52ac013c8e73fc47a95da # value used for testing
128+
- e7feb20ae9d14a4cdfce9d4a5451313ffc92253b # value used for testing
129+
- 7c0c039771d4cc8eb455d3bbdccf8131fdd6e45e # value used for testing
130+
- 9a8177d80f9aa9a32759ba7710725b8a1fd3343a # value used for testing
131+
- 82ff8052d87e4cedb3dee7db569fcb181e6caf88 # value used for testing
132+
- 44eca14299c23849c83a7a84fdaa35b8a6a0de34 # value used for testing
133+
- 374eb22f69352d768e8096f9d55299c4dfd8888c # value used for testing
134+
- bd69025b337716ee008f80192523d3cb1c11ed09 # value used for testing
135+
- abee8cb648ac1d20c88db6ec5a4ae079c7d29ea8 # value used for testing
136+
- b8e323e82ffb1a6cd55f6f21c05ac963c2586c8f # value used for testing
137+
- 53fea9d5c1718a37457bc484d5a0c8336ef7ab75 # value used for testing
138+
- 4666bc0670fcfa15e706f53abdc59eff2674854f # value used for testing
139+
- f701cd699fcb706453af869581c74a7133a5a317 # value used for testing
140+
- b3f999807edd036ffd73f14a2ca43c543bcf366d # value used for testing
141+
- 7585409b82ac064a256b70d9e526a011ebfb0411 # value used for testing
142+
- f4d8d834faf54a9551b2a1d937a436bea498506e # value used for testing

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,3 +19,5 @@ vendor/
1919

2020
dist
2121
2ms
22+
23+
cover.out.tmp

‎.golangci.yml‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
version: "2"
2+
run:
3+
tests: false
4+
linters:
5+
default: none
6+
enable:
7+
- bodyclose
8+
- dogsled
9+
- dupl
10+
- errcheck
11+
- funlen
12+
- gochecknoinits
13+
- goconst
14+
- gocritic
15+
- gocyclo
16+
- goprintffuncname
17+
- gosec
18+
- govet
19+
- ineffassign
20+
- lll
21+
- misspell
22+
- nakedret
23+
- noctx
24+
- nolintlint
25+
- rowserrcheck
26+
- staticcheck
27+
- unconvert
28+
- unparam
29+
- unused
30+
- whitespace
31+
settings:
32+
dupl:
33+
threshold: 100
34+
funlen:
35+
lines: 100
36+
statements: 50
37+
goconst:
38+
min-len: 2
39+
min-occurrences: 3
40+
gocritic:
41+
disabled-checks:
42+
- dupImport
43+
- ifElseChain
44+
- octalLiteral
45+
- whyNoLint
46+
- wrapperFunc
47+
- importShadow
48+
- unnamedResult
49+
enabled-tags:
50+
- diagnostic
51+
- experimental
52+
- opinionated
53+
- performance
54+
- style
55+
gocyclo:
56+
min-complexity: 15
57+
govet:
58+
settings:
59+
printf:
60+
funcs:
61+
- (github.com/golangci/golangci-lint/pkg/logutils.Log).Infof
62+
- (github.com/golangci/golangci-lint/pkg/logutils.Log).Warnf
63+
- (github.com/golangci/golangci-lint/pkg/logutils.Log).Errorf
64+
- (github.com/golangci/golangci-lint/pkg/logutils.Log).Fatalf
65+
lll:
66+
line-length: 140
67+
misspell:
68+
locale: US
69+
nolintlint:
70+
require-explanation: false
71+
require-specific: false
72+
allow-unused: false
73+
exclusions:
74+
generated: lax
75+
presets:
76+
- comments
77+
- common-false-positives
78+
- legacy
79+
- std-error-handling
80+
rules:
81+
- path: _test\.go
82+
linters: [ '*' ]
83+
paths:
84+
- third_party$
85+
- builtin$
86+
- examples$
87+
formatters:
88+
enable:
89+
- gofmt
90+
- goimports
91+
settings:
92+
goimports:
93+
local-prefixes:
94+
- github.com/golangci/golangci-lint
95+
exclusions:
96+
generated: lax
97+
paths:
98+
- third_party$
99+
- builtin$
100+
- examples$

‎.pre-commit-config.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
repos:
2+
- repo: local
3+
hooks:
4+
- id: make-check
5+
name: make check
6+
description: Run project checks, gofmt, golangci-lint, tests and coverage
7+
entry: make check
8+
language: system
9+
pass_filenames: false
10+
types: [ go ] # Only run when Go files change
11+
stages: [ pre-push ] # Explicitly run at push time

‎Makefile‎

Lines changed: 93 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,102 @@
1+
SHELL=/bin/bash
2+
13
image_label ?= latest
24
image_name ?= checkmarx/2ms:$(image_label)
35
image_file_name ?= checkmarx-2ms-$(image_label).tar
46

5-
build:
6-
docker build -t $(image_name) .
7+
GREEN := $(shell printf "\033[32m")
8+
RED := $(shell printf "\033[31m")
9+
RESET := $(shell printf "\033[0m")
10+
11+
COVERAGE_REQUIRED := 55
12+
MOCKGEN_VERSION := 0.5.2
13+
LINTER_VERSION := 2.1.6
14+
15+
.PHONY: lint
16+
lint: check-linter-version
17+
go fmt ./...
18+
golangci-lint run -c ./.golangci.yml
19+
20+
get-linter:
21+
command -v golangci-lint ||curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(shell go env GOPATH)/bin v$(LINTER_VERSION)
22+
23+
modtidy:
24+
go mod tidy
25+
go mod vendor
26+
27+
.PHONY: test
28+
test:
29+
## We have several race condition warnings (as expected), but those will be fixed on the next PRs
30+
## GO_ENABLED=1 go test -race -count=1 -vet all -coverprofile=cover.out.tmp ./...
31+
go test -count=1 -vet all -coverprofile=cover.out.tmp ./...
32+
grep -v -e "_mock\.go:" -e "/mocks/" -e "/docs/" cover.out.tmp > cover.out
33+
go tool cover -func=cover.out
34+
rm cover.out.tmp
735

836
save: build
937
docker save $(image_name) > $(image_file_name)
1038

11-
run:
12-
docker run -it $(image_name) $(ARGS)
39+
build:
40+
docker build -t $(image_name) .
41+
42+
generate: check-mockgen-version
43+
go generate ./...
44+
45+
check: lint test coverage-check
46+
47+
.PHONY: coverage-check
48+
coverage-check: test
49+
@coverage=$$(go tool cover -func=cover.out | grep '^total:' | awk '{print $$3}' | sed 's/%//g'); \
50+
if awk "BEGIN {exit !($$coverage < $(COVERAGE_REQUIRED))}"; then \
51+
echo "error: coverage ($$coverage%) must be at least $(COVERAGE_REQUIRED)%"; \
52+
exit 1; \
53+
else \
54+
echo "test coverage: $$coverage% (threshold: $(COVERAGE_REQUIRED)%)"; \
55+
fi
56+
57+
.PHONY: test-coverage
58+
test-coverage: test coverage-check
59+
60+
## cover-report: show html report
61+
## If you don't have the cover.out file yet, just run the tests with make test
62+
cover-report:
63+
go tool cover -html=cover.out
64+
.PHONY: coverage-check
65+
66+
check-mockgen-version:
67+
@echo "Checking mockgen version..."
68+
@if command -v mockgen >/dev/null 2>&1; then \
69+
INSTALLED_VERSION=$$(mockgen -version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+'); \
70+
if [ "$$INSTALLED_VERSION" = "$(MOCKGEN_VERSION)" ]; then \
71+
echo "$(GREEN)[OK]$(RESET) mockgen version $(MOCKGEN_VERSION) is installed"; \
72+
else \
73+
echo "$(RED)[ERROR]$(RESET) Wrong mockgen version: $$INSTALLED_VERSION (required: $(MOCKGEN_VERSION))"; \
74+
echo "Please install the correct version using:"; \
75+
echo " go install go.uber.org/mock/mockgen@v$(MOCKGEN_VERSION)"; \
76+
exit 1; \
77+
fi; \
78+
else \
79+
echo "$(RED)[ERROR]$(RESET) mockgen is not installed"; \
80+
echo "Please install it using:"; \
81+
echo " go install go.uber.org/mock/mockgen@v$(MOCKGEN_VERSION)"; \
82+
exit 1; \
83+
fi
1384

14-
# To run golangci-lint, you need to install it first: https://golangci-lint.run/usage/install/#local-installation
15-
lint:
16-
golangci-lint run -v -E gofmt --timeout=5m
17-
lint-fix:
18-
golangci-lint run -v -E gofmt --fix --timeout=5m
85+
check-linter-version:
86+
@echo "Checking golangci-lint version..."
87+
@if command -v golangci-lint >/dev/null 2>&1; then \
88+
INSTALLED_VERSION=$$(golangci-lint --version | grep -oE 'version [0-9]+\.[0-9]+\.[0-9]+' | cut -d' ' -f2); \
89+
if [ "$$INSTALLED_VERSION" = "$(LINTER_VERSION)" ]; then \
90+
echo "$(GREEN)[OK]$(RESET) golangci-lint version $(LINTER_VERSION) is installed"; \
91+
else \
92+
echo "$(RED)[ERROR]$(RESET) Wrong golangci-lint version: $$INSTALLED_VERSION (required: $(LINTER_VERSION))"; \
93+
echo "Please install the correct version using:"; \
94+
echo " make get-linter"; \
95+
exit 1; \
96+
fi; \
97+
else \
98+
echo "$(RED)[ERROR]$(RESET) golangci-lint is not installed"; \
99+
echo "Please install it using:"; \
100+
echo " make get-linter"; \
101+
exit 1; \
102+
fi

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -336,6 +336,7 @@ Scans a local git repository
336336
| ---------------- | ----- | -------------------------------------- | -------------------------------------------------------- |
337337
| `--all-branches` | - | false - only current checked in branch | scan all branches |
338338
| `--depth` | int | no limit | limit the number of historical commits to scan from HEAD |
339+
| `--base-commit` | string| - | base commit to scan commits between base and HEAD |
339340

340341
For example
341342

‎cmd/config.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ import (
1313
)
1414

1515
func initialize() {
16-
1716
configFilePath, err := rootCmd.Flags().GetString(configFileFlag)
1817
if err != nil {
1918
cobra.CheckErr(err)

‎cmd/exit_handler.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
package cmd
22

33
import (
4-
"github.com/rs/zerolog/log"
54
"os"
5+
6+
"github.com/rs/zerolog/log"
67
)
78

89
const (
@@ -19,7 +20,7 @@ func isNeedReturnErrorCodeFor(kind ignoreOnExit) bool {
1920
return false
2021
}
2122

22-
if ignoreOnExitVar != ignoreOnExit(kind) {
23+
if ignoreOnExitVar != kind {
2324
return true
2425
}
2526

‎cmd/main.go‎

Lines changed: 24 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -87,17 +87,31 @@ func Execute() (int, error) {
8787
rootCmd.PersistentFlags().StringVar(&configFilePath, configFileFlag, "", "config file path")
8888
cobra.CheckErr(rootCmd.MarkPersistentFlagFilename(configFileFlag, "yaml", "yml", "json"))
8989
rootCmd.PersistentFlags().StringVar(&logLevelVar, logLevelFlagName, "info", "log level (trace, debug, info, warn, error, fatal, none)")
90-
rootCmd.PersistentFlags().StringSliceVar(&reportPathVar, reportPathFlagName, []string{}, "path to generate report files. The output format will be determined by the file extension (.json, .yaml, .sarif)")
91-
rootCmd.PersistentFlags().StringVar(&stdoutFormatVar, stdoutFormatFlagName, "yaml", "stdout output format, available formats are: json, yaml, sarif")
92-
rootCmd.PersistentFlags().StringArrayVar(&customRegexRuleVar, customRegexRuleFlagName, []string{}, "custom regexes to apply to the scan, must be valid Go regex")
93-
rootCmd.PersistentFlags().StringSliceVar(&engineConfigVar.SelectedList, ruleFlagName, []string{}, "select rules by name or tag to apply to this scan")
90+
rootCmd.PersistentFlags().
91+
StringSliceVar(&reportPathVar, reportPathFlagName, []string{},
92+
"path to generate report files. The output format will be determined by the file extension (.json, .yaml, .sarif)")
93+
rootCmd.PersistentFlags().
94+
StringVar(&stdoutFormatVar, stdoutFormatFlagName, "yaml", "stdout output format, available formats are: json, yaml, sarif")
95+
rootCmd.PersistentFlags().
96+
StringArrayVar(&customRegexRuleVar, customRegexRuleFlagName, []string{}, "custom regexes to apply to the scan, must be valid Go regex")
97+
rootCmd.PersistentFlags().
98+
StringSliceVar(&engineConfigVar.SelectedList, ruleFlagName, []string{}, "select rules by name or tag to apply to this scan")
9499
rootCmd.PersistentFlags().StringSliceVar(&engineConfigVar.IgnoreList, ignoreRuleFlagName, []string{}, "ignore rules by name or tag")
95100
rootCmd.PersistentFlags().StringSliceVar(&engineConfigVar.IgnoredIds, ignoreFlagName, []string{}, "ignore specific result by id")
96-
rootCmd.PersistentFlags().StringSliceVar(&engineConfigVar.AllowedValues, allowedValuesFlagName, []string{}, "allowed secrets values to ignore")
97-
rootCmd.PersistentFlags().StringSliceVar(&engineConfigVar.SpecialList, specialRulesFlagName, []string{}, "special (non-default) rules to apply.\nThis list is not affected by the --rule and --ignore-rule flags.")
98-
rootCmd.PersistentFlags().Var(&ignoreOnExitVar, ignoreOnExitFlagName, "defines which kind of non-zero exits code should be ignored\naccepts: all, results, errors, none\nexample: if 'results' is set, only engine errors will make 2ms exit code different from 0")
99-
rootCmd.PersistentFlags().IntVar(&engineConfigVar.MaxTargetMegabytes, maxTargetMegabytesFlagName, 0, "files larger than this will be skipped.\nOmit or set to 0 to disable this check.")
100-
rootCmd.PersistentFlags().BoolVar(&validateVar, validate, false, "trigger additional validation to check if discovered secrets are valid or invalid")
101+
rootCmd.PersistentFlags().
102+
StringSliceVar(&engineConfigVar.AllowedValues, allowedValuesFlagName, []string{}, "allowed secrets values to ignore")
103+
rootCmd.PersistentFlags().
104+
StringSliceVar(&engineConfigVar.SpecialList, specialRulesFlagName, []string{},
105+
"special (non-default) rules to apply.\nThis list is not affected by the --rule and --ignore-rule flags.")
106+
rootCmd.PersistentFlags().
107+
Var(&ignoreOnExitVar, ignoreOnExitFlagName,
108+
"defines which kind of non-zero exits code should be ignored\naccepts: all, results, errors, none\n"+
109+
"example: if 'results' is set, only engine errors will make 2ms exit code different from 0")
110+
rootCmd.PersistentFlags().
111+
IntVar(&engineConfigVar.MaxTargetMegabytes, maxTargetMegabytesFlagName, 0,
112+
"files larger than this will be skipped.\nOmit or set to 0 to disable this check.")
113+
rootCmd.PersistentFlags().
114+
BoolVar(&validateVar, validate, false, "trigger additional validation to check if discovered secrets are valid or invalid")
101115

102116
rootCmd.AddCommand(engine.GetRulesCommand(&engineConfigVar))
103117

@@ -126,7 +140,7 @@ func Execute() (int, error) {
126140
return Report.TotalSecretsFound, nil
127141
}
128142

129-
func preRun(pluginName string, cmd *cobra.Command, args []string) error {
143+
func preRun(pluginName string, _ *cobra.Command, _ []string) error {
130144
if err := validateFormat(stdoutFormatVar, reportPathVar); err != nil {
131145
return err
132146
}
@@ -166,7 +180,6 @@ func postRun(cmd *cobra.Command, args []string) error {
166180
cfg := config.LoadConfig("2ms", Version)
167181

168182
if Report.TotalItemsScanned > 0 {
169-
170183
if zerolog.GlobalLevel() != zerolog.Disabled {
171184
if err := Report.ShowReport(stdoutFormatVar, cfg); err != nil {
172185
return err

‎engine/config.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,8 @@ import (
66
"github.com/zricethezav/gitleaks/v8/config"
77
)
88

9-
// Taken from gitleaks config https://github.com/gitleaks/gitleaks/blob/6c52f878cc48a513849900a9aa6f9d68e1c2dbdd/config/gitleaks.toml#L15-L26
9+
// Taken from gitleaks config
10+
// https://github.com/gitleaks/gitleaks/blob/6c52f878cc48a513849900a9aa6f9d68e1c2dbdd/config/gitleaks.toml#L15-L26
1011
var cfg = config.Config{
1112
Allowlist: config.Allowlist{
1213
Paths: []*regexp.Regexp{

0 commit comments

Comments
 (0)