FilesExpand file tree

v4.39.1

/

artifact-scanner.test.ts

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

183 lines (164 loc) · 5.1 KB

v4.39.1

/

artifact-scanner.test.ts

Copy path

Top

File metadata and controls

• Code
• Blame

183 lines (164 loc) · 5.1 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

import * as fs from "fs";

import * as os from "os";

import * as path from "path";

import test from "ava";

import {

GITHUB_PAT_CLASSIC_PATTERN,

isAuthToken,

scanArtifactsForTokens,

TokenType,

} from "./artifact-scanner";

import { getRunnerLogger } from "./logging";

import {

checkExpectedLogMessages,

getRecordingLogger,

LoggedMessage,

makeTestToken,

} from "./testing-utils";

test("makeTestToken", (t) => {

t.is(makeTestToken().length, 36);

t.is(makeTestToken(255).length, 255);

});

test("isAuthToken", (t) => {

// Undefined for strings that aren't tokens

t.is(isAuthToken("some string"), undefined);

t.is(isAuthToken("ghp_"), undefined);

t.is(isAuthToken("ghp_123"), undefined);

// Token types for strings that are tokens.

t.is(isAuthToken(`ghp_${makeTestToken()}`), TokenType.PersonalAccessClassic);

t.is(isAuthToken(`ghp_${makeTestToken()}`), TokenType.PersonalAccessClassic);

t.is(

isAuthToken(`ghs_${makeTestToken(255)}`),

TokenType.AppInstallationAccess,

);

t.is(

isAuthToken(`github_pat_${makeTestToken(22)}_${makeTestToken(59)}`),

TokenType.PersonalAccessFineGrained,

);

// With a custom pattern set

t.is(

isAuthToken(`ghp_${makeTestToken()}`, [GITHUB_PAT_CLASSIC_PATTERN]),

TokenType.PersonalAccessClassic,

);

t.is(

isAuthToken(`github_pat_${makeTestToken(22)}_${makeTestToken(59)}`, [

GITHUB_PAT_CLASSIC_PATTERN,

]),

undefined,

);

});

const testTokens = [

{

type: TokenType.PersonalAccessClassic,

value: `ghp_${makeTestToken()}`,

checkPattern: "Personal Access Token",

},

{

type: TokenType.PersonalAccessFineGrained,

value:

"github_pat_1234567890ABCDEFGHIJKL_MNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890ABCDEFGHI",

checkPattern: "Personal Access Token",

},

{

type: TokenType.OAuth,

value: `gho_${makeTestToken()}`,

},

{

type: TokenType.UserToServer,

value: `ghu_${makeTestToken()}`,

},

{

type: TokenType.ServerToServer,

value: `ghs_${makeTestToken()}`,

},

{

type: TokenType.Refresh,

value: `ghr_${makeTestToken()}`,

},

{

type: TokenType.AppInstallationAccess,

value: `ghs_${makeTestToken(255)}`,

},

];

for (const { type, value, checkPattern } of testTokens) {

test(`scanArtifactsForTokens detects GitHub ${type} tokens in files`, async (t) => {

const logMessages = [];

const logger = getRecordingLogger(logMessages, { logToConsole: false });

const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "scanner-test-"));

try {

// Create a test file with a fake GitHub token

const testFile = path.join(tempDir, "test.txt");

fs.writeFileSync(testFile, `This is a test file with token ${value}`);

const error = await t.throwsAsync(

async () => await scanArtifactsForTokens([testFile], logger),

);

t.regex(

error?.message || "",

new RegExp(`Found 1 potential GitHub token.*${checkPattern || type}`),

);

t.regex(error?.message || "", /test\.txt/);

checkExpectedLogMessages(t, logMessages, [

"Starting best-effort check",

`Found 1 ${type}`,

]);

} finally {

// Clean up

fs.rmSync(tempDir, { recursive: true, force: true });

}

});

}

test("scanArtifactsForTokens handles files without tokens", async (t) => {

const logger = getRunnerLogger(true);

const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "scanner-test-"));

try {

// Create a test file without tokens

const testFile = path.join(tempDir, "test.txt");

fs.writeFileSync(

testFile,

"This is a test file without any sensitive data",

);

await t.notThrowsAsync(

async () => await scanArtifactsForTokens([testFile], logger),

);

} finally {

// Clean up

fs.rmSync(tempDir, { recursive: true, force: true });

}

});

// `scanArchiveFile` does not support Windows, so we skip this test there.

if (os.platform() !== "win32") {

test("scanArtifactsForTokens finds token in debug artifacts", async (t) => {

const messages: LoggedMessage[] = [];

const logger = getRecordingLogger(messages, { logToConsole: false });

// The zip here is a regression test based on

// https://github.com/github/codeql-action/security/advisories/GHSA-vqf5-2xx6-9wfm

const testZip = path.join(

__dirname,

"..",

"src",

"testdata",

"debug-artifacts-with-fake-token.zip",

);

// This zip file contains a nested structure with a fake token in:

// my-db-java-partial.zip/trap/java/invocations/kotlin.9017231652989744319.trap

const error = await t.throwsAsync(

async () => await scanArtifactsForTokens([testZip], logger),

);

t.regex(

error?.message || "",

/Found.*potential GitHub token/,

"Should detect token in nested zip",

);

t.regex(

error?.message || "",

/kotlin\.9017231652989744319\.trap/,

"Should report the .trap file containing the token",

);

const logOutput = messages.map((msg) => msg.message).join("\n");

t.regex(

logOutput,

/^Extracting gz file: .*\.gz$/m,

"Logs should show that .gz files were extracted",

);

});

}