gitrob 0.0.3 → 0.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 67ff947e44f57832ac04e0cc36bad170b6168b32
-  data.tar.gz: 541eff757e7caa083bd25da0265b1823f7335b81
+  metadata.gz: 81f068944463add65ad8508310610cba768c41bd
+  data.tar.gz: c5f00cff14c11e36f8a2335e471b897a8317a08e
 SHA512:
-  metadata.gz: 17c6f678592140b9d9fc9e44bf00224baf4736cf90447408686fb428fd6690acfa5813f3017ef5758394f7b2201faeb8776c721af879ef14298ea605888edfe1
-  data.tar.gz: af13933e20cbaa53cf3f32d800e83402320470bfea427603cf9b94ea166b6184927b8db00b48f393553a2828028768cb106f273560648ec260ec59ec725efc21
+  metadata.gz: 7e2397c9c5d6a4ae6aa1f5f87ebb145202eb8549f3182baa8f3b3b1a4bc81d587d2d590b2b2d990cfd63d20dbee0d0291d979c52f06e0dbbade31b88696ff14d
+  data.tar.gz: c171532f79547e5a9822123f96973a21b35c4e332ccbfcdbbe7041778853cbfbbe8540954f0048b1937dfb1a123f78362af4ba603f90fa2349f72f4db64cdae1

data/README.md

@@ -20,7 +20,7 @@ All of the members, repositories and files will be saved to a PostgreSQL databas
 
 ## Installation
 
-Gitrob is written in Ruby and requires at least version 1.9.3 or above. If you are on an older version, it is very easy to install newer versions with [RVM](http://rvm.io/). If you are installing Gitrob on [Kali](http://www.kali.org/), you are almost good to go, you just need to update Bundler with `gem install bundler` and install a PostgreSQL dependency with `apt-get install libpq-dev` in a terminal.
+Gitrob is written in Ruby and requires at least version 1.9.3 or above, except for version 2.2.0 which is currently not compatible. If you are on an older version, it is very easy to install newer versions with [RVM](http://rvm.io/). If you are installing Gitrob on [Kali](http://www.kali.org/), you are almost good to go, you just need to update Bundler with `gem install bundler`. It might also be necessary to install a PostgreSQL dependency with `apt-get install postgresql-server-dev-9.1` in a terminal.
 
 Gitrob is a Ruby gem, so installation is a simple `gem install gitrob` in a terminal. This will automatically install all the code dependencies as well.
 

data/bin/gitrob

@@ -242,6 +242,10 @@ class App
   on('--no-banner', "Don't print Gitrob banner")
 
   begin
+    if ARGV.empty?
+      Gitrob::fatal("No options given; see gitrob --help for options.")
+    end
+
     go!
   rescue Gitrob::Github::HttpClient::MissingAccessTokensError
     Gitrob::fatal("Configuration file does not contain any GitHub access tokens. Run Gitrob with --configure flag to set it up.")

data/lib/gitrob/version.rb

@@ -1,3 +1,3 @@
 module Gitrob
-  VERSION = "0.0.3"
+  VERSION = "0.0.4"
 end

data/patterns.json

@@ -1,22 +1,29 @@
 [
     {
         "part": "filename",
-        "type": "match",
-        "pattern": "id_rsa",
+        "type": "regex",
+        "pattern": "\\A.*_rsa\\z",
         "caption": "Private SSH key",
         "description": null
     },
     {
         "part": "filename",
-        "type": "match",
-        "pattern": "id_ed25519",
+        "type": "regex",
+        "pattern": "\\A.*_dsa\\z",
         "caption": "Private SSH key",
         "description": null
     },
     {
         "part": "filename",
-        "type": "match",
-        "pattern": "id_ecdsa",
+        "type": "regex",
+        "pattern": "\\A.*_ed25519\\z",
+        "caption": "Private SSH key",
+        "description": null
+    },
+    {
+        "part": "filename",
+        "type": "regex",
+        "pattern": "\\A.*_ecdsa\\z",
         "caption": "Private SSH key",
         "description": null
     },
@@ -223,6 +230,20 @@
         "caption": "Potential Ruby On Rails database configuration file",
         "description": "Might contain database credentials."
     },
+    {
+        "part": "filename",
+        "type": "match",
+        "pattern": "settings.py",
+        "caption": "Django configuration file",
+        "description": "Might contain database credentials, online storage system credentials, secret keys, etc."
+    },
+    {
+        "part": "filename",
+        "type": "regex",
+        "pattern": "\\A(.*)?config(\\.inc)?\\.php\\z",
+        "caption": "PHP configuration file",
+        "description": "Might contain credentials and keys."
+    },
     {
         "part": "extension",
         "type": "match",
@@ -299,5 +320,26 @@
         "pattern": "password",
         "caption": "Contains word: password",
         "description": null
+    },
+    {
+        "part": "filename",
+        "type": "regex",
+        "pattern": "private.*key",
+        "caption": "Contains words: private, key",
+        "description": null
+    },
+    {
+        "part": "filename",
+        "type": "match",
+        "pattern": "jenkins.plugins.publish_over_ssh.BapSshPublisherPlugin.xml",
+        "caption": "Jenkins publish over SSH plugin file",
+        "description": null
+    },
+    {
+        "part": "filename",
+        "type": "match",
+        "pattern": "credentials.xml",
+        "caption": "Potential Jenkins credentials file",
+        "description": null
     }
 ]

data/spec/lib/gitrob/observers/sensitive_files_spec.rb

@@ -58,14 +58,21 @@ RSpec.describe Gitrob::Observers::SensitiveFiles do
 
     it 'detects private keys' do
       ['id_rsa',
+       'production_rsa',
        '.ssh/id_rsa',
        'ssh/id_rsa',
        'privatekeys/id_rsa',
+       'id_dsa',
+       'key_dsa',
+       '.ssh/id_dsa',
+       'privatekeys/id_dsa',
        'id_ed25519',
+       'user_ed25519',
        '.ssh/id_ed25519',
        'privatekeys/id_ed25519',
        '.ssh/id_ecdsa',
        'id_ecdsa',
+       'jenkins_ecdsa',
        'ssh/id_ecdsa',
        'privatekeys/id_ecdsa'
       ].each do |path|
@@ -438,6 +445,29 @@ RSpec.describe Gitrob::Observers::SensitiveFiles do
       end
     end
 
+    it 'detects Django settings files' do
+      ['settings.py',
+      ].each do |path|
+        blob = Gitrob::Github::Blob.new(path, 1, repo).to_model(org, repo.to_model(org))
+        described_class.observe(blob)
+        expect(blob.findings.first.caption).to eq("Django configuration file")
+        expect(blob.findings.first.description).to eq("Might contain database credentials, online storage system credentials, secret keys, etc.")
+      end
+    end
+
+    it 'detects PHP configuration files' do
+      ['config.php',
+       'config/config.inc.php',
+       'db_config.php',
+       'secret_config.inc.php'
+      ].each do |path|
+        blob = Gitrob::Github::Blob.new(path, 1, repo).to_model(org, repo.to_model(org))
+        described_class.observe(blob)
+        expect(blob.findings.first.caption).to eq("PHP configuration file")
+        expect(blob.findings.first.description).to eq("Might contain credentials and keys.")
+      end
+    end
+
     it 'detects KeePass database files' do
       ['keepass.kdb',
        'secret/pwd.kdb'
@@ -554,5 +584,36 @@ RSpec.describe Gitrob::Observers::SensitiveFiles do
         expect(blob.findings.first.caption).to eq("Contains word: password")
       end
     end
+
+    it 'detects files containing wordis: private, key' do
+      ['privatekey.asc',
+       'super_private_key.asc',
+       'private/private_keys.tar.gz'
+      ].each do |path|
+        blob = Gitrob::Github::Blob.new(path, 1, repo).to_model(org, repo.to_model(org))
+        described_class.observe(blob)
+        expect(blob.findings.last.caption).to eq("Contains words: private, key")
+      end
+    end
+
+    it 'detects Jenkins publish over ssh plugin configuration files' do
+      ['jenkins.plugins.publish_over_ssh.BapSshPublisherPlugin.xml',
+       'jenkins/jenkins.plugins.publish_over_ssh.BapSshPublisherPlugin.xml'
+      ].each do |path|
+        blob = Gitrob::Github::Blob.new(path, 1, repo).to_model(org, repo.to_model(org))
+        described_class.observe(blob)
+        expect(blob.findings.first.caption).to eq("Jenkins publish over SSH plugin file")
+      end
+    end
+
+    it 'detects Jenkins credentials files' do
+      ['credentials.xml',
+       'jenkins/credentials.xml'
+      ].each do |path|
+        blob = Gitrob::Github::Blob.new(path, 1, repo).to_model(org, repo.to_model(org))
+        described_class.observe(blob)
+        expect(blob.findings.first.caption).to eq("Potential Jenkins credentials file")
+      end
+    end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gitrob
 version: !ruby/object:Gem::Version
-  version: 0.0.3
+  version: 0.0.4
 platform: ruby
 authors:
 - Michael Henriksen
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-01-14 00:00:00.000000000 Z
+date: 2015-01-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: httparty