puppet-sec-lint 0.5.17 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6bfe95cea2d99930169041dca391fc75092615989bf760110c9e30aa129e4cfa
-  data.tar.gz: 74eebb1a8c0173313962c2f89a59f051228b32148deca9abebfad22345dc4728
+  metadata.gz: 0ed39e8fd69a0dd1d3091aaee274f88cc192e973ef2b2cd21076a86aa21f6712
+  data.tar.gz: 9483297393e0eaebe4551b037d87260552c0e26b2b76d77dd9db14485c0a197c
 SHA512:
-  metadata.gz: 61ef7a949e6eb553397d1e3497daee79e7d53d5bc87b4d11c6dcb825652ccd31bd395a38956a503bd4f2a157e7a35c19b81a3c67a5794381022253b424417e34
-  data.tar.gz: 5a630410caafefd0c5536fde1503591f0e9f8ebc82718b020b3b8a81f583a7746e69ff2cbba4e8c05971cf68ab22bbf4617467f2bcb4a44762ed40e7cf2bc5d3
+  metadata.gz: c759dca11c5156be203bafff3ccb26dfcc02a10936a5157b061dabdb42de8689ddc69e79865a999e792c704712cbd95757f383ee1afac33e75b326ad1dbeb9dd
+  data.tar.gz: 49d80107d0ab6d01c73fa24b6482cd7a483f7bf0ec049e860b12b67a27aa69293df98b00bf24cd36def138d3bce3884c4d2b87421b2162f7bec90251d957bf11

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    puppet-sec-lint (0.5.17)
+    puppet-sec-lint (1.0.0)
       inifile (~> 3.0.0)
       launchy (~> 2.5.0)
       logger (~> 1.4.3)

data/README.md

@@ -50,20 +50,52 @@ puppet-sec-lint -c
 
 ## Development
 
-### Development of new rules
-
 The linter was built on top of a modular architecture, which means that new customizable rules can be added fairly easy facing the discovery of new scenarios and vulnerabilities.
 
-<!--
-(add instructions on how to clone, build and run tool)
+### Cloning and running 
+
+To add new functionality to the tool, start by cloning the repository into a folder.
+To run the software locally, run the executable **exe/puppet-sec-lint** from a command line.
+
+### Adding new rules
+
+To add a new rule, the easiest way is to duplicate the file of an existing rule inside the **lib/rules** folder. Taking the *Admin By Default* rule as an example, here is everything that can be changed and customized.
+
+![puppet-sec-lint rule](docs/images/puppet-sec-lint_rule.png)
+
+#### Naming
+
+The class should have an unique and meaningful name, both at the class name itself and the property @Name (that's what's displayed in the Configurations page). It should also be derived from the **Rule** class.
+
+#### Token analysis
+
+Each rule works by running the **AnalyzeTokens** method, receiving a list of tokens (that represent the entire code of the file being analyzed) and after analyzing everything, it should return a list of results (each result is a vulnerability found represented by the **Sin** class). Adding new types of vulnerabilities can be done by adding new elements to the **SinType** class.
+
+#### Configurations
+
+To add configurable elements to the class, simply create new instances of the child classes of the **Configuration** class, as exemplified in the above rule. The constructor takes as arguments the title and description (to be shown in the configurations page) and the initial default value (before the user modifies the application settings).
+
+All configurations should then be added to the @configurations array.
+
+The current types of configurations available (children of the **Configuration** class) are:
+
+* Boolean
+  
+  ![puppet-sec-lint configuration_bool](docs/images/puppet-sec-lint_configuration_bool.png)
+* List of elements
+  
+  ![puppet-sec-lint configuration_list](docs/images/puppet-sec-lint_configuration_list.png)
+* Regular Expression
+  
+  ![puppet-sec-lint configuration_regex](docs/images/puppet-sec-lint_configuration_regex.png)
 
-(add instructions on where and how to add new rule and configurations)
--->
+#### Add rule to rule engine
 
-<!--After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+The final step is to ensure that the Rule Engine can detect and run the rule everytime an analysis is performed. As such, in the **lib/rule_engine.rb** file, import the newly created rule and add it to the @rules array.
 
-To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and the created tag, and push the `.gem` file to [rubygems.org](https://rubygems.org).-->
+---
 
+After following these steps, the rule should then be automatically run everytime an analysis is performed. Also, the configurations now show up automatically in the configurations page, giving the user the possibility to customize its values. 
 
 ## Contributing
 

data/lib/puppet-sec-lint/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module PuppetSecLint
-  VERSION = "0.5.17"
+  VERSION = "1.0.0"
   YEAR = "2021"
   AUTHOR = "TQRG"
 end

data/puppet-sec-lint.gemspec

@@ -12,7 +12,7 @@ Gem::Specification.new do |spec|
   spec.description   = "Linter built to detect potential security vulnerabilities in Puppet manifests code. It also offers integration with Visual Studio Code https://marketplace.visualstudio.com/items?itemName=tiago1998.puppet-sec-lint-vscode"
   spec.homepage      = "https://github.com/TiagoR98/puppet-sec-lint"
   spec.license       = "MIT"
-  spec.required_ruby_version = Gem::Requirement.new(">= 2.3.0")
+  spec.required_ruby_version = Gem::Requirement.new(">= 2.7.0")
 
   spec.metadata["allowed_push_host"] = "https://rubygems.org"
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: puppet-sec-lint
 version: !ruby/object:Gem::Version
-  version: 0.5.17
+  version: 1.0.0
 platform: ruby
 authors:
 - Tiago Ribeiro
@@ -173,8 +173,12 @@ files:
 - docs/empty-password.md
 - docs/hard-coded-credentials.md
 - docs/http-without-tls.md
+- docs/images/puppet-sec-lint_configuration_bool.png
+- docs/images/puppet-sec-lint_configuration_list.png
+- docs/images/puppet-sec-lint_configuration_regex.png
 - docs/images/puppet-sec-lint_configurations.png
 - docs/images/puppet-sec-lint_console.png
+- docs/images/puppet-sec-lint_rule.png
 - docs/images/puppet-sec-lint_vscode.png
 - docs/index.md
 - docs/invalid-ip-addr-binding.md
@@ -224,7 +228,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.3.0
+      version: 2.7.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="