From 195f086afce5ba946bcb7d111391dafe20a17fcd Mon Sep 17 00:00:00 2001 From: Mick Grove Date: Fri, 12 Dec 2025 17:21:17 -0800 Subject: [PATCH] added dark mode for finding + access map viewer --- .pre-commit-hooks.yaml | 4 +- CHANGELOG.md | 1 + README.md | 7 +- data/rules/aws.yml | 6 +- docs/access-map-viewer/index.html | 103 ++++++++++--- scripts/install-kingfisher-pre-commit.ps1 | 179 ++++++++++++---------- scripts/install-kingfisher-pre-commit.sh | 13 +- src/cli/commands/output.rs | 4 +- src/cli/commands/scan.rs | 54 +++---- src/main.rs | 7 +- src/matcher.rs | 5 +- src/reporter.rs | 1 - src/reporter/json_format.rs | 1 - src/scanner/runner.rs | 24 +-- tests/cli_subcommands.rs | 21 +++ tests/int_allowlist.rs | 1 - tests/int_bitbucket.rs | 4 +- tests/int_dedup.rs | 1 - tests/int_github.rs | 4 +- tests/int_gitlab.rs | 8 +- tests/int_redact.rs | 1 - tests/int_slack.rs | 2 - tests/int_validation_cache.rs | 1 - tests/int_vulnerable_files.rs | 2 - tests/pre_commit_installer.rs | 27 ++-- 25 files changed, 286 insertions(+), 195 deletions(-) mode change 100644 => 100755 scripts/install-kingfisher-pre-commit.sh diff --git a/.pre-commit-hooks.yaml b/.pre-commit-hooks.yaml index 302f859..ae2d00c 100644 --- a/.pre-commit-hooks.yaml +++ b/.pre-commit-hooks.yaml @@ -3,7 +3,7 @@ description: Run Kingfisher in Docker against staged changes at the repository root. No local install required. entry: ghcr.io/kingfisher-sec/kingfisher:latest language: docker - args: ["scan", ".", "--staged", "--quiet", "--redact", "--only-valid", "--no-update-check"] + args: ["scan", ".", "--staged", "--quiet", "--no-update-check"] pass_filenames: false stages: [commit] @@ -12,7 +12,7 @@ description: Scan staged changes with the locally installed Kingfisher binary. entry: kingfisher language: system - args: ["scan", ".", "--staged", "--quiet", "--redact", "--only-valid", "--no-update-check"] + args: ["scan", ".", "--staged", "--quiet", "--no-update-check"] pass_filenames: false types: [file] stages: [commit] \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md index 62f4399..24e1e4a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,7 @@ All notable changes to this project will be documented in this file. - Added `--staged` argument to support new `pre-commit` behavior and added integration coverage to ensure validated secrets block commits when used as pre-commit hook - Added new rules for AWS Bedrock, Voyage.ai, Posthog, Atlassian - Added an embedded web-based report and access-map viewer via `kingfisher view` subcommand that can load JSON or JSONL reports passed on the CLI (or upload them in the browser) +- Added a check for network connectivity via `online` crate before attempting validation. ## [v1.69.0] - Reduced per-match memory usage by compacting stored source locations and interning repeated capture names. diff --git a/README.md b/README.md index 97ac307..1c5fe87 100644 --- a/README.md +++ b/README.md @@ -276,7 +276,7 @@ Install a **per-repository** hook from the root of the target repo: ```powershell Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force -Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/mongodb/kingfisher/main/scripts/install-kingfisher-pre-commit.ps1' -OutFile install-kingfisher-pre-commit.ps1 +Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/mongodb/kingfisher/development/scripts/install-kingfisher-pre-commit.ps1' -OutFile install-kingfisher-pre-commit.ps1 ./install-kingfisher-pre-commit.ps1 ``` @@ -298,7 +298,7 @@ Uninstall the **global** hook: ``` > The installer automatically runs any existing `pre-commit` hook first, then -> executes `kingfisher scan . --staged --quiet --redact --only-valid --no-update-check` +> executes `kingfisher scan . --staged --quiet --no-update-check` > against the staged diff (anchored to `HEAD` when no commits exist yet). @@ -325,7 +325,7 @@ Then install the hook via `pre-commit install`. Every hook now drives Kingfisher directly with the built-in `--staged` flag: ```bash -kingfisher scan . --staged --quiet --redact --only-valid --no-update-check +kingfisher scan . --staged --quiet --no-update-check ``` When `--staged` is set, Kingfisher snapshots the staged index into a temporary @@ -551,6 +551,7 @@ kingfisher scan /path/to/repo --format sarif --output findings.sarif - Add `--access-map` to enrich JSON, JSONL, BSON, pretty, and SARIF reports with an `access_map` array containing providers, accounts/projects, resources, and the permissions available for each resource (grouped when identical). - If you validated cloud credentials without `--access-map`, Kingfisher will remind you on stderr to rerun with the flag so the access map appears in the output. +- Use the access map functionality only when you are authorized to inspect the target account, as Kingfisher will issue additional network requests to determine what access the secret grants. - Run `kingfisher view ./kingfisher.json` to explore a report locally in a local web UI ### View access-map reports locally diff --git a/data/rules/aws.yml b/data/rules/aws.yml index 30dd091..6015285 100644 --- a/data/rules/aws.yml +++ b/data/rules/aws.yml @@ -28,9 +28,9 @@ rules: \b (?:AWS|AMAZON|AMZN|A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA) (?:.|[\n\r]){0,64}? - \b + [^A-Za-z0-9_+!@\#$%^&*()\]./] ([A-Za-z0-9/+]{40}) - \b + [^A-Za-z0-9_+!@\#$%^&*()\]./] | \b(?:AWS|AMAZON|AMZN|A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA) (?:.|[\n\r]){0,96}? @@ -43,7 +43,7 @@ rules: \b ) pattern_requirements: - min_digits: 2 + min_digits: 3 ignore_if_contains: - "EXAMPLE" - "TEST" diff --git a/docs/access-map-viewer/index.html b/docs/access-map-viewer/index.html index 1dfa1f6..fef75f6 100644 --- a/docs/access-map-viewer/index.html +++ b/docs/access-map-viewer/index.html @@ -1,16 +1,40 @@ - + Kingfisher Access Map Viewer