forked from mirrors/kingfisher
93 lines
2.8 KiB
Rust
93 lines
2.8 KiB
Rust
use std::{fs::File, io::Write, path::Path, process::Command};
|
|
|
|
use assert_cmd::prelude::*;
|
|
use flate2::{Compression, write::GzEncoder};
|
|
use predicates::prelude::*;
|
|
|
|
fn append_bytes(tar: &mut tar::Builder<impl Write>, path: &str, data: &[u8]) -> anyhow::Result<()> {
|
|
let mut header = tar::Header::new_gnu();
|
|
header.set_size(data.len() as u64);
|
|
header.set_mode(0o644);
|
|
header.set_cksum();
|
|
tar.append_data(&mut header, path, data)?;
|
|
Ok(())
|
|
}
|
|
|
|
fn build_docker_archive(path: &Path, github_pat: &str) -> anyhow::Result<()> {
|
|
let mut layer = GzEncoder::new(Vec::new(), Compression::default());
|
|
{
|
|
let mut tar = tar::Builder::new(&mut layer);
|
|
append_bytes(&mut tar, "app/secret.txt", format!("token={github_pat}\n").as_bytes())?;
|
|
tar.finish()?;
|
|
}
|
|
let layer = layer.finish()?;
|
|
|
|
let mut tar = tar::Builder::new(File::create(path)?);
|
|
append_bytes(&mut tar, "oci-layout", br#"{"imageLayoutVersion":"1.0.0"}"#)?;
|
|
append_bytes(
|
|
&mut tar,
|
|
"manifest.json",
|
|
br#"[{"Config":"blobs/sha256/config","Layers":["blobs/sha256/layer"]}]"#,
|
|
)?;
|
|
append_bytes(&mut tar, "blobs/sha256/config", br#"{}"#)?;
|
|
append_bytes(&mut tar, "blobs/sha256/layer", &layer)?;
|
|
tar.finish()?;
|
|
Ok(())
|
|
}
|
|
|
|
#[test]
|
|
fn smoke_scan_docker_image() -> anyhow::Result<()> {
|
|
let mut cmd = Command::new(assert_cmd::cargo::cargo_bin!("kingfisher"));
|
|
let output = cmd
|
|
.args([
|
|
"scan",
|
|
"--docker-image",
|
|
"ghcr.io/owasp/wrongsecrets/wrongsecrets-master:latest-master",
|
|
"--format",
|
|
"json",
|
|
"--no-update-check",
|
|
])
|
|
.output()?;
|
|
|
|
if !output.status.success() {
|
|
eprintln!("Skipping test: {}", String::from_utf8_lossy(&output.stderr));
|
|
return Ok(());
|
|
}
|
|
|
|
let stdout = String::from_utf8_lossy(&output.stdout);
|
|
assert!(stdout.contains("Not Attempted"));
|
|
Ok(())
|
|
}
|
|
|
|
#[test]
|
|
fn smoke_scan_docker_archive() -> anyhow::Result<()> {
|
|
let dir = tempfile::tempdir()?;
|
|
let archive = dir.path().join("image.tar");
|
|
let github_pat = "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";
|
|
build_docker_archive(&archive, github_pat)?;
|
|
|
|
Command::new(assert_cmd::cargo::cargo_bin!("kingfisher"))
|
|
.args([
|
|
"scan",
|
|
"docker",
|
|
"--archive",
|
|
archive.to_str().unwrap(),
|
|
"--confidence=low",
|
|
"--format",
|
|
"json",
|
|
"--rule",
|
|
"kingfisher.github.2",
|
|
"--no-validate",
|
|
"--no-update-check",
|
|
])
|
|
.assert()
|
|
.code(200)
|
|
.stdout(
|
|
predicate::str::contains(github_pat).and(
|
|
predicate::str::contains("app/secret.txt")
|
|
.or(predicate::str::contains("app\\\\secret.txt")),
|
|
),
|
|
);
|
|
|
|
Ok(())
|
|
}
|