…-fix

create environment for patch on DW script injections

Signed-off-by: Diogo Teles Sant'Anna <[email protected]>
Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

…-with-remediation-output

Include the generated patch in the output

Signed-off-by: Joyce Brum <[email protected]>
Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

…erate-patch

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

Git diff created using hexops/gotextdiff, WHICH IS ARCHIVED.
It is unfortunately the only package I found which could do it.
To be discussed with Scorecard maintainers whether it's worth it.

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

- Test patchWorkflow instead of GeneratePatch. This avoids the
  complication of comparing diff files; we can instead simply
  compare the output workflow to an expected "fixed" workflow.
- Examples with multiple findings must have separate "fixed"
  workflows for each finding, not a single file which covers
  all findings
- Instead of hard-coding the finding details (snippet, line
  position), run raw.DangerousWorkflow() to get that data
  automatically. This does make these tests a bit more
  "integration-test-like", but makes them substantially easier
  to maintain.

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

- misc refactors
- use go-git to generate diff
- Most functions now return errors instead of bools. This can be
  later used for simpler logging
- Existing environment variables are now detected by parsing the
  files as GH workflows. This is WIP to handle existing envvars
  in our patches.
- Remove instances of C-style for-loops, unnecessarily dangerous!
- Fixed proper detection of existing env, handling blank lines
  and comments.

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

- Fix inconsistencies between original and "fixed" versions
- Store multiple "fixed" workflows for tests with multiple
  findings. Each "fixed" workflow fixes a single finding. The
  files are numbered according to the order in which the
  findings are found by moving down the file.
- allKindsOfUserInput removed. Would require too many "fixed"
  workflows to test. The behavior can be tested more directly.

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

- If an envvar with our name and value already existed but simply
  wasn't used, the patch no longer duplicates it.
- After the patched workflow is created, we validate that it is
  valid. Or, at least did not introduce any syntax errors that
  were not present in the original workflow.

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

- Create helper function `readWorkflow`
- Improved error handling in case of failed workflow validation
- Allow the declaration of duplicate findings (cases where 2+ findings have the same patch)

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

- Simplify use of unsafePatterns
- Replaced boolean returns with errors, for easier log/debugging
- Improved documentation
- Changes to satisfy linter, adoption of 120-char line limit

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>

Signed-off-by: Pedro Kaj Kjellerup Nacht <[email protected]>