gitrob 0.0.5 → 0.0.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 90f04895ed250caafe2dd882ad64aa517647d92b
-  data.tar.gz: d47a5bf63fde5b24bb0735f6ba4b3d473bd3604c
+  metadata.gz: 233269393064c9df0a4e4cf715f89b61da4cfaf1
+  data.tar.gz: 67367c7bb7b8e9e879b69d11e8d3afc00d4c2c01
 SHA512:
-  metadata.gz: c6d01493289fedd10935a1d1fc86b4ff34e4d8277049738a3f3a722a91946de3a6c5ab67d60039b04967a8eb38fe273490a6b35c47ce4907489c7e068f8bed5c
-  data.tar.gz: b411388a1d96baad65f1531c09bf2736946745e4cbffadac2c3b510b4f8d0a291cf6cfc49558f8f6a81db0691f19b7a30d06419d70e66a3486ee5d6353d8c341
+  metadata.gz: 9a073a5a96890fb8fdc37c839c2debd118f7951ea53736ce60e29dd8924e52af65d2937e8742a9041518922dfd393e212aabc5794cb751c577ae2c20b70d5afd
+  data.tar.gz: 94184271f33c605d018556bb9b0a3d61d2a8d28b767d084286011aabe2af3cc9502d7d6ae28ade7cacc13c89319b8898031bfd08cdd3577034b2e7ccd68b5fbd

data/CONTRIBUTING.md

@@ -0,0 +1,14 @@
+# Contributing
+
+Gitrob should be considered Beta and there is probably a good amount of bugs. Bug reports and suggestions for improvements are welcome!
+
+Another way to help out is to contribute new patterns for sensitive files. If you know of any sensitive files that are not already identified, please submit them in a pull request. I am especially interested in sensitive web framework files and configuration files. Have a look at the [patterns.json](https://github.com/michenriksen/gitrob/blob/master/patterns.json) file to see what is already looked for.
+
+## How to make a pull request:
+
+1. Fork it ( https://github.com/michenriksen/gitrob/fork )
+2. Create your feature branch (`git checkout -b my-new-feature`)
+3. Commit your changes (`git commit -am 'Add some feature'`)
+4. Push to the branch (`git push origin my-new-feature`)
+5. Create a new Pull Request
+

data/README.md

@@ -20,12 +20,18 @@ All of the members, repositories and files will be saved to a PostgreSQL databas
 
 ## Installation
 
-Gitrob is written in Ruby and requires at least version 1.9.3 or above, except for version 2.2.0 which is currently not compatible. If you are on an older version, it is very easy to install newer versions with [RVM](http://rvm.io/). If you are installing Gitrob on [Kali](http://www.kali.org/), you are almost good to go, you just need to update Bundler with `gem install bundler`. It might also be necessary to install a PostgreSQL dependency with `apt-get install postgresql-server-dev-9.1` in a terminal.
+Gitrob is written in Ruby and requires at least version 1.9.3 or above, except for version 2.2.0 which is currently not compatible. If you are on an older version, it is very easy to install newer versions with [RVM](http://rvm.io/). If you are installing Gitrob on [Kali](http://www.kali.org/), you are almost good to go, you just need to update Bundler with `gem install bundler`. It might also be necessary to install a PostgreSQL dependency with `apt-get install postgresql-server-dev-9.1` and a Ruby dependency with `apt-get install ruby1.9.1-dev` in a terminal.
 
 Gitrob is a Ruby gem, so installation is a simple `gem install gitrob` in a terminal. This will automatically install all the code dependencies as well.
 
 A [PostgreSQL](http://www.postgresql.org/) database is also needed for Gitrob to store its data. Installing PostgreSQL is pretty straight forward; here is an installation guide for [Mac OS X](http://www.gotealeaf.com/blog/how-to-install-postgresql-on-a-mac) and one for [Ubuntu/Debian](https://www.digitalocean.com/community/tutorials/how-to-install-and-use-postgresql-on-ubuntu-14-04) based Linux. If you're installing Gitrob on Kali, you already have PostgreSQL installed, however you need to start the server with `service postgresql start` in a terminal.
 
+When PostgreSQL is installed, it's time to create a user and a database for Gitrob. To do so, type the following commands in a terminal:
+
+    sudo su postgres # Not necessary on Mac OS X
+    createuser -s gitrob --pwprompt
+    createdb -O gitrob gitrob
+
 The last thing we need is a GitHub access token in order to be able to talk to their API. The easiest way is to create a [personal access token](https://github.com/settings/applications). If you plan on using Gitrob extensively or on a very big organization, it might be necessary to have multiple access tokens to prevent running into rate limiting, but they need to be from different user accounts.
 
 When everything is ready, simply run `gitrob --configure` and you will be presented with a configuration wizard that asks you for database connection details and GitHub access tokens. All of this configuration can be changed by running the same command again. The configuration will be saved in `~/.gitrobrc` - and yes, Gitrob is looking for this file too so watch out.

data/bin/gitrob

@@ -95,8 +95,6 @@ class App
     begin
       org = Gitrob::Github::Organization.new(org_name, http_client)
 
-      Gitrob::delete_organization(org.login)
-
       Gitrob::task("Collecting organization repositories...") do
         repo_count = org.repositories.count
       end

data/lib/gitrob/observers/sensitive_files.rb

@@ -10,6 +10,7 @@ module Gitrob
       VALID_TYPES = %w(match regex)
 
       def self.observe(blob)
+        return if !blob.size || blob.size.zero?
         patterns.each do |pattern|
           check_blob(blob, pattern)
         end

data/lib/gitrob/version.rb

@@ -1,3 +1,3 @@
 module Gitrob
-  VERSION = "0.0.5"
+  VERSION = "0.0.6"
 end

data/patterns.json

@@ -36,8 +36,8 @@
     },
     {
         "part": "extension",
-        "type": "match",
-        "pattern": "key",
+        "type": "regex",
+        "pattern": "\\Akey(pair)?\\z",
         "caption": "Potential cryptographic private key",
         "description": null
     },
@@ -341,5 +341,54 @@
         "pattern": "credentials.xml",
         "caption": "Potential Jenkins credentials file",
         "description": null
+    },
+    {
+        "part": "filename",
+        "type": "regex",
+        "pattern": "\\A\\.?htpasswd\\z",
+        "caption": "Apache htpasswd file",
+        "description": null
+    },
+    {
+        "part": "filename",
+        "type": "regex",
+        "pattern": "\\A\\.?netrc\\z",
+        "caption": "Configuration file for auto-login process",
+        "description": "Might contain username and password."
+    },
+    {
+        "part": "extension",
+        "type": "match",
+        "pattern": "kwallet",
+        "caption": "KDE Wallet Manager database file",
+        "description": null
+    },
+    {
+        "part": "filename",
+        "type": "match",
+        "pattern": "LocalSettings.php",
+        "caption": "Potential MediaWiki configuration file",
+        "description": null
+    },
+    {
+        "part": "extension",
+        "type": "match",
+        "pattern": "tblk",
+        "caption": "Tunnelblick VPN configuration file",
+        "description": null
+    },
+    {
+        "part": "path",
+        "type": "regex",
+        "pattern": "\\A\\.?gem/credentials\\z",
+        "caption": "Rubygems credentials file",
+        "description": "Might contain API key for a rubygems.org account."
+    },
+    {
+        "part": "filename",
+        "type": "regex",
+        "pattern": "\\A*\\.pubxml(\\.user)?\\z",
+        "caption": "Potential MSBuild publish profile",
+        "description": null
     }
 ]

data/spec/lib/gitrob/observers/sensitive_files_spec.rb

@@ -93,10 +93,12 @@ RSpec.describe Gitrob::Observers::SensitiveFiles do
       end
     end
 
-    it 'detects files with .key extension' do
+    it 'detects files with .key(pair) extension' do
       ['privatekey.key',
        'keys/privatekey.key',
        '.secret.key',
+       'production.keypair',
+       'keys/privatekey.keypair'
       ].each do |path|
         blob = Gitrob::Github::Blob.new(path, 1, repo).to_model(org, repo.to_model(org))
         described_class.observe(blob)
@@ -615,5 +617,75 @@ RSpec.describe Gitrob::Observers::SensitiveFiles do
         expect(blob.findings.first.caption).to eq("Potential Jenkins credentials file")
       end
     end
+
+    it 'detects Apache htpasswd files' do
+      ['.htpasswd',
+       'htpasswd',
+       'public/htpasswd',
+       'admin/.htpasswd'
+      ].each do |path|
+        blob = Gitrob::Github::Blob.new(path, 1, repo).to_model(org, repo.to_model(org))
+        described_class.observe(blob)
+        expect(blob.findings.first.caption).to eq("Apache htpasswd file")
+      end
+    end
+
+    it 'detects netrc files' do
+      ['.netrc',
+       'netrc',
+       'dotfiles/.netrc',
+       'homefolder/netrc'
+      ].each do |path|
+        blob = Gitrob::Github::Blob.new(path, 1, repo).to_model(org, repo.to_model(org))
+        described_class.observe(blob)
+        expect(blob.findings.first.caption).to eq("Configuration file for auto-login process")
+        expect(blob.findings.first.description).to eq("Might contain username and password.")
+      end
+    end
+
+    it 'detects KDE Wallet Manager files' do
+      ['wallet.kwallet',
+       '.wallet.kwallet',
+       'dotfiles/secret.kwallet',
+       'homefolder/creds.kwallet'
+      ].each do |path|
+        blob = Gitrob::Github::Blob.new(path, 1, repo).to_model(org, repo.to_model(org))
+        described_class.observe(blob)
+        expect(blob.findings.first.caption).to eq("KDE Wallet Manager database file")
+      end
+    end
+
+    it 'detects MediaWiki configuration files' do
+      ['LocalSettings.php',
+       'mediawiki/LocalSettings.php',
+       'configs/LocalSettings.php'
+      ].each do |path|
+        blob = Gitrob::Github::Blob.new(path, 1, repo).to_model(org, repo.to_model(org))
+        described_class.observe(blob)
+        expect(blob.findings.first.caption).to eq("Potential MediaWiki configuration file")
+      end
+    end
+
+    it 'detects Tunnelblick VPN configuration files' do
+      ['vpn.tblk',
+       'secret/tunnel.tblk',
+       'configs/.tunnelblick.tblk'
+      ].each do |path|
+        blob = Gitrob::Github::Blob.new(path, 1, repo).to_model(org, repo.to_model(org))
+        described_class.observe(blob)
+        expect(blob.findings.first.caption).to eq("Tunnelblick VPN configuration file")
+      end
+    end
+
+    it 'detects Rubygems credentials files' do
+      ['.gem/credentials',
+       'gem/credentials',
+      ].each do |path|
+        blob = Gitrob::Github::Blob.new(path, 1, repo).to_model(org, repo.to_model(org))
+        described_class.observe(blob)
+        expect(blob.findings.first.caption).to eq("Rubygems credentials file")
+        expect(blob.findings.first.description).to eq("Might contain API key for a rubygems.org account.")
+      end
+    end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gitrob
 version: !ruby/object:Gem::Version
-  version: 0.0.5
+  version: 0.0.6
 platform: ruby
 authors:
 - Michael Henriksen
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-01-20 00:00:00.000000000 Z
+date: 2015-02-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: httparty
@@ -216,6 +216,7 @@ extra_rdoc_files: []
 files:
 - ".gitignore"
 - ".rspec"
+- CONTRIBUTING.md
 - Gemfile
 - LICENSE.txt
 - README.md