zendesk_apps_support 4.15.1 → 4.16.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
|
-
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
2
|
+
SHA256:
|
|
3
|
+
metadata.gz: 7629b25072aa14d2fc633c4061efe052835f0893e221c131881124ecf1bb9989
|
|
4
|
+
data.tar.gz: 31827636b35c8b029e80e96cf7511b17f25b64319ba26725bc57fee0c38abda8
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: c84e515174af4129cd536c670279113588893de7f684523edd35521dac6fa0f1d1c33e1b7648239e56e88ef697899f11bb87c64f250c960a1dd4296709e35752
|
|
7
|
+
data.tar.gz: 1279372798bf6ba5a1672408046d308ae7feaf00d99cfdddb96122ce1ad4be3780e2c49223be5311146426ed4e5549c1647c8503401659b001f648a3946a8196
|
data/config/locales/en.yml
CHANGED
|
@@ -6,6 +6,7 @@ en:
|
|
|
6
6
|
admin:
|
|
7
7
|
error:
|
|
8
8
|
app_build:
|
|
9
|
+
listing_comma: ", "
|
|
9
10
|
jshint:
|
|
10
11
|
one: 'JSHint error in %{file}: %{errors}'
|
|
11
12
|
other: 'JSHint errors in %{file}: %{errors}'
|
|
@@ -52,6 +53,9 @@ en:
|
|
|
52
53
|
invalid_requirements_types:
|
|
53
54
|
one: 'requirements.json contains an invalid type: %{invalid_types}'
|
|
54
55
|
other: 'requirements.json contains invalid types: %{invalid_types}'
|
|
56
|
+
unsupported_mime_type_detected:
|
|
57
|
+
one: 'Unsupported MIME type detected in %{file_names}'
|
|
58
|
+
other: 'Unsupported MIME types detected in %{file_names}'
|
|
55
59
|
multiple_channel_integrations: Specifying multiple channel integrations
|
|
56
60
|
in requirements.json is not supported.
|
|
57
61
|
invalid_cr_schema_keys:
|
|
@@ -80,10 +84,16 @@ en:
|
|
|
80
84
|
blank_location_uri: "%{location} location does not specify a URI."
|
|
81
85
|
invalid_location_uri: "%{uri} is either an invalid location URI, refers
|
|
82
86
|
to a missing asset, or does not use HTTPS."
|
|
87
|
+
signed_setting_uri: The url (%{uri}) cannot use a setting because it is
|
|
88
|
+
a signed url.
|
|
83
89
|
name_as_parameter_name: Can't call a parameter 'name'
|
|
84
90
|
invalid_hidden_parameter:
|
|
85
91
|
one: "%{invalid_params} is set to hidden and cannot be required."
|
|
86
92
|
other: "%{invalid_params} are set to hidden and cannot be required."
|
|
93
|
+
blocked_request: Possible request to a %{type} ip %{uri} in %{file}.
|
|
94
|
+
blocked_request_private: private
|
|
95
|
+
blocked_request_loopback: loopback
|
|
96
|
+
blocked_request_link_local: link-local
|
|
87
97
|
invalid_version: "%{target_version} is not a valid framework version.
|
|
88
98
|
Available versions are: %{available_versions}."
|
|
89
99
|
old_version: Iframe Only apps must target framework versions 2.0 or greater.
|
|
@@ -128,3 +138,12 @@ en:
|
|
|
128
138
|
and may not display as intended.
|
|
129
139
|
bitmap_in_svg: "%{svg} contains an embedded bitmap and cannot be used
|
|
130
140
|
as an app icon. It has been replaced with a default placeholder icon."
|
|
141
|
+
generic_secrets:
|
|
142
|
+
one: Possible secrets found in %{files}. Consider reviewing the contents
|
|
143
|
+
of this file before submitting your app.
|
|
144
|
+
other: Possible secrets found in %{files}. Consider reviewing the contents
|
|
145
|
+
of these files before submitting your app.
|
|
146
|
+
insecure_http_request: Possible insecure HTTP request to %{uri} in %{file}.
|
|
147
|
+
Consider instead using the HTTPS protocol.
|
|
148
|
+
application_secret: Possible %{secret_type} found in %{file}. Consider
|
|
149
|
+
reviewing the contents of this file before submitting your app.
|
|
@@ -7,6 +7,10 @@ packages:
|
|
|
7
7
|
- apps_support
|
|
8
8
|
|
|
9
9
|
parts:
|
|
10
|
+
- translation:
|
|
11
|
+
key: "txt.apps.admin.error.app_build.listing_comma"
|
|
12
|
+
title: "Punctuation for separating lists of items in a sentence"
|
|
13
|
+
value: ", "
|
|
10
14
|
- translation:
|
|
11
15
|
key: "txt.apps.admin.error.app_build.jshint.one"
|
|
12
16
|
title: "App builder job: JSHint error message"
|
|
@@ -115,6 +119,16 @@ parts:
|
|
|
115
119
|
key: "txt.apps.admin.error.app_build.invalid_requirements_types.other"
|
|
116
120
|
title: "App builder job: requirements file contains invalid types error"
|
|
117
121
|
value: "requirements.json contains invalid types: %{invalid_types}"
|
|
122
|
+
- translation:
|
|
123
|
+
key: "txt.apps.admin.error.app_build.unsupported_mime_type_detected.one"
|
|
124
|
+
title: "App builder job: directory contains unsupported mime type. MIME is an abbreviation for Multipurpose Internet Mail Extensions. https://en.wikipedia.org/wiki/MIME"
|
|
125
|
+
value: "Unsupported MIME type detected in %{file_names}."
|
|
126
|
+
screenshot: "https://drive.google.com/open?id=13sG5kRWrcVPZiFzDLYo-WavY4WbsHdvX"
|
|
127
|
+
- translation:
|
|
128
|
+
key: "txt.apps.admin.error.app_build.unsupported_mime_type_detected.other"
|
|
129
|
+
title: "App builder job: directory contains unsupported mime type. MIME is an abbreviation for Multipurpose Internet Mail Extensions. https://en.wikipedia.org/wiki/MIME"
|
|
130
|
+
value: "Unsupported MIME types detected in %{file_names}."
|
|
131
|
+
screenshot: "https://drive.google.com/open?id=1Ht4Nq4ZcQ0DMfcm6JphF66QI3e1FT8Wn"
|
|
118
132
|
- translation:
|
|
119
133
|
key: "txt.apps.admin.error.app_build.multiple_channel_integrations"
|
|
120
134
|
title: "App builder job: requirements file contains multiple channel integrations, leave requirements.json as is (file name)"
|
|
@@ -219,6 +233,43 @@ parts:
|
|
|
219
233
|
key: "txt.apps.admin.warning.app_build.bitmap_in_svg"
|
|
220
234
|
title: "App builder job: warning that svg contains an embedded bitmap image and cannot be used"
|
|
221
235
|
value: "%{svg} contains an embedded bitmap and cannot be used as an app icon. It has been replaced with a default placeholder icon."
|
|
236
|
+
- translation:
|
|
237
|
+
key: "txt.apps.admin.warning.app_build.generic_secrets.one"
|
|
238
|
+
title: "App builder job: warning for generic secrets found in app text files. %{files} will be replaced with one file name"
|
|
239
|
+
value: "Possible secrets found in %{files}. Consider reviewing the contents of this file before submitting your app."
|
|
240
|
+
screenshot: "https://drive.google.com/file/d/179IMwzJvXD1m5u-0K499Ul3-qRBXAxnT"
|
|
241
|
+
- translation:
|
|
242
|
+
key: "txt.apps.admin.warning.app_build.generic_secrets.other"
|
|
243
|
+
title: "App builder job: warning for generic secrets found in app text files. %{files} will be replaced with multiple file names"
|
|
244
|
+
value: "Possible secrets found in %{files}. Consider reviewing the contents of these files before submitting your app."
|
|
245
|
+
screenshot: "https://drive.google.com/file/d/179IMwzJvXD1m5u-0K499Ul3-qRBXAxnT"
|
|
246
|
+
- translation:
|
|
247
|
+
key: "txt.apps.admin.warning.app_build.insecure_http_request"
|
|
248
|
+
title: "App builder job: warning on detecting an insecure http request call in app source files"
|
|
249
|
+
value: "Possible insecure HTTP request to %{uri} in %{file}. Consider instead using the HTTPS protocol."
|
|
250
|
+
screenshot: "https://drive.google.com/file/d/1V-lXrVoAXAZEtBoekq7XLyetomUZRqY-"
|
|
251
|
+
- translation:
|
|
252
|
+
key: "txt.apps.admin.error.app_build.blocked_request"
|
|
253
|
+
title: "App builder job: error on detecting a forbidden http request call in app source files"
|
|
254
|
+
value: "Possible request to a %{type} ip %{uri} in %{file}."
|
|
255
|
+
screenshot: "https://drive.google.com/file/d/1hiTwbQi5aj6PnEtfuA7QTALs6AryDmj_"
|
|
256
|
+
- translation:
|
|
257
|
+
key: "txt.apps.admin.error.app_build.blocked_request_private"
|
|
258
|
+
title: "App builder job: forbidden http request call ip type: private. See https://en.wikipedia.org/wiki/Private_network"
|
|
259
|
+
value: "private"
|
|
260
|
+
- translation:
|
|
261
|
+
key: "txt.apps.admin.error.app_build.blocked_request_loopback"
|
|
262
|
+
title: "App builder job: forbidden http request call ip type: loopback. See https://en.wikipedia.org/wiki/Loopback"
|
|
263
|
+
value: "loopback"
|
|
264
|
+
- translation:
|
|
265
|
+
key: "txt.apps.admin.error.app_build.blocked_request_link_local"
|
|
266
|
+
title: "App builder job: forbidden http request call ip type: link-local. See https://en.wikipedia.org/wiki/Link-local_address"
|
|
267
|
+
value: "link-local"
|
|
268
|
+
- translation:
|
|
269
|
+
key: "txt.apps.admin.warning.app_build.application_secret"
|
|
270
|
+
title: "App builder job: warning for secrets found in app text files"
|
|
271
|
+
value: "Possible %{secret_type} found in %{file}. Consider reviewing the contents of this file before submitting your app."
|
|
272
|
+
screenshot: "https://drive.google.com/file/d/1LoN9-IlRbiz6uv1-CQ933mh-WY8XY5o2"
|
|
222
273
|
- translation:
|
|
223
274
|
key: "txt.apps.admin.error.app_build.invalid_version"
|
|
224
275
|
title: "App builder job: invalid framework version"
|
data/lib/zendesk_apps_support.rb
CHANGED
|
@@ -21,6 +21,7 @@ module ZendeskAppsSupport
|
|
|
21
21
|
autoload :ValidationError, 'zendesk_apps_support/validations/validation_error'
|
|
22
22
|
autoload :Manifest, 'zendesk_apps_support/validations/manifest'
|
|
23
23
|
autoload :Marketplace, 'zendesk_apps_support/validations/marketplace'
|
|
24
|
+
autoload :Secrets, 'zendesk_apps_support/validations/secrets'
|
|
24
25
|
autoload :Source, 'zendesk_apps_support/validations/source'
|
|
25
26
|
autoload :Templates, 'zendesk_apps_support/validations/templates'
|
|
26
27
|
autoload :Translations, 'zendesk_apps_support/validations/translations'
|
|
@@ -31,6 +31,7 @@ module ZendeskAppsSupport
|
|
|
31
31
|
def validate(marketplace: true, skip_marketplace_translations: false)
|
|
32
32
|
errors = []
|
|
33
33
|
errors << Validations::Manifest.call(self)
|
|
34
|
+
|
|
34
35
|
if has_valid_manifest?(errors)
|
|
35
36
|
errors << Validations::Marketplace.call(self) if marketplace
|
|
36
37
|
errors << Validations::Source.call(self)
|
|
@@ -46,6 +47,9 @@ module ZendeskAppsSupport
|
|
|
46
47
|
errors << Validations::Banner.call(self) if has_banner?
|
|
47
48
|
errors << Validations::Svg.call(self) if has_svgs?
|
|
48
49
|
|
|
50
|
+
# warning only validators
|
|
51
|
+
Validations::Secrets.call(self)
|
|
52
|
+
|
|
49
53
|
errors.flatten.compact
|
|
50
54
|
end
|
|
51
55
|
|
|
@@ -84,8 +88,12 @@ module ZendeskAppsSupport
|
|
|
84
88
|
files
|
|
85
89
|
end
|
|
86
90
|
|
|
91
|
+
def text_files
|
|
92
|
+
@text_files ||= files.select { |f| f =~ %r{.*(html?|xml|js|json?)$} }
|
|
93
|
+
end
|
|
94
|
+
|
|
87
95
|
def js_files
|
|
88
|
-
@js_files ||= files.select { |f| f
|
|
96
|
+
@js_files ||= files.select { |f| f =~ %r{^(app|lib\/.*)\.js$} }
|
|
89
97
|
end
|
|
90
98
|
|
|
91
99
|
def lib_files
|
|
@@ -0,0 +1,76 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
2
|
+
|
|
3
|
+
module ZendeskAppsSupport
|
|
4
|
+
module Validations
|
|
5
|
+
module Secrets
|
|
6
|
+
SECRET_KEYWORDS = %w[
|
|
7
|
+
pass password secret secretToken secret_token auth_key
|
|
8
|
+
authKey auth_pass authPass auth_user AuthUser username api_key
|
|
9
|
+
].freeze
|
|
10
|
+
|
|
11
|
+
APPLICATION_SECRETS = {
|
|
12
|
+
# rubocop:disable Metrics/LineLength
|
|
13
|
+
'Slack Token' => /(xox[p|b|o|a]-*.[a-z0-9])/,
|
|
14
|
+
'RSA Private Key' => /-----BEGIN RSA PRIVATE KEY-----/,
|
|
15
|
+
'SSH Private Key (OpenSSH)' => /-----BEGIN OPENSSH PRIVATE KEY-----/,
|
|
16
|
+
'SSH Private Key (DSA)' => /-----BEGIN DSA PRIVATE KEY-----/,
|
|
17
|
+
'SSH Private Key (EC)' => /-----BEGIN EC PRIVATE KEY-----/,
|
|
18
|
+
'PGP Private Key Block' => /-----BEGIN PGP PRIVATE KEY BLOCK-----/,
|
|
19
|
+
'Facebook OAuth Token' => /([f|F][a|A][c|C][e|E][b|B][o|O][o|O][k|K]( [|:\"=-]|[:\"=-|]).*.[0-9a-f]{24,36})/,
|
|
20
|
+
'Twitter OAuth Token' => /([t|T][w|W][i|I][t|T][t|T][e|E][r|R]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z]{30,45})/,
|
|
21
|
+
'Github Token' => /([g|G][i|I][t|T][h|H][u|U][b|B]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z]{30,45})/,
|
|
22
|
+
'Google OAuth Token' => /([c|C][l|L][i|I][e|E][n|N][t|T][\-_][s|S][e|E][c|C][r|R][e|E][t|T]( [:\"=-]|[:\"=-]).*[a-zA-Z0-9\-_]{16,32})/,
|
|
23
|
+
'AWS Access Key ID' => /(AKIA[0-9A-Z]{8,24})/,
|
|
24
|
+
'AWS Secret Access Key' => /([a|A][w|W][s|S][_-][s|S][e|E][c|C][r|R][e|E][t|T][_-][a|A][c|C][c|C][e|E][s|S][s|S][_-][k|K][e|E][y|Y].*.[0-9a-zA-Z]{24,48})/,
|
|
25
|
+
'Heroku API Key' => /([h|H][e|E][r|R][o|O][k|K][u|U].*[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{6,18})/,
|
|
26
|
+
'Quickpay Secret' => /(quickpay_secret:.*.[0-9a-zA-Z]{24,72})/,
|
|
27
|
+
'Doorman Secret' => /([d|D][o|O][o|O][r|R][m|M][a|A][n|N][-_][s|S][e|E][c|C][r|R][e|E][t|T].*.[0-9a-f]{16,132})/,
|
|
28
|
+
'Shared Session Secret' => /(shared_session_secret.*.[0-9a-f]{4,132})/,
|
|
29
|
+
'Permanent Cookie Secret' => /(permanent_cookie_secret.*.[0-9a-f]{120,156})/,
|
|
30
|
+
'Scarlett AWS Secret Key' => /([sS][cC][aA][rR][lL][eE][tT][tT][_-][aA][wW][sS][_-][sS][eE][cC][rR][eE][tT][_-][kK][eE][yY].*.[0-9a-zA-Z+.]{35,45})/,
|
|
31
|
+
'Braintree Key' => /(braintree_key.*.[0-9a-zA-Z]{16,36})/,
|
|
32
|
+
'Ticket Validation Key' => /(ticket_validation_key.*.[0-9a-zA-Z]{15,25})/,
|
|
33
|
+
'App Key' => /([aA][pP][pP][-_][kK][eE][yY]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
|
|
34
|
+
'App Secret' => /([aA][pP][pP][-_][sS][eE][cC][rR][eE][tT]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
|
|
35
|
+
'Consumer Key' => /([cC][oO][nN][sS][uU][mM][eE][rR][-_][kK][eE][yY]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
|
|
36
|
+
'Consumer Secret' => /([cC][oO][nN][sS][uU][mM][eE][rR][-_][sS][eE][cC][rR][eE][tT]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
|
|
37
|
+
'Generic Secret' => /(?m)^([sS][eE][cC][rR][eE][tT]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
|
|
38
|
+
'Master Key' => /([mM][aA][sS][tT][eE][rR][-_][kK][eE][yY]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
|
|
39
|
+
'Master Secret' => /([mM][aA][sS][tT][eE][rR][-_][sS][eE][cC][rR][eE][tT]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
|
|
40
|
+
'Token Key' => /([tT][oO][kK][eE][nN][-_][kK][eE][yY]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
|
|
41
|
+
'Token Secret' => /([tT][oO][kK][eE][nN][-_][sS][eE][cC][rR][eE][tT]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
|
|
42
|
+
'Zendesk Zopim Mobile SSO Key' => /(zendesk_zopim_mobile_sso_key.*.[0-9a-f]{58,68})/,
|
|
43
|
+
'Help Center Private Key' => /([pP][rR][iI][vV][aA][tT][eE][-_][kK][eE][yY]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
|
|
44
|
+
'X-Outbound-Key' => /([xX][-][oO][uU][tT][bB][oO][uU][nN][dD][-][kK][eE][yY][:\" \t=-].*.[0-9a-z-]{32,36})/,
|
|
45
|
+
'Attachment Token Key' => /(attachment_token_key.*.[0-9a-f]{24,72})/,
|
|
46
|
+
'Password' => /([pP][aA][sS][sS][wW][oO][rR][dD].*.[0-9a-zA-Z+_.-]{4,156})/,
|
|
47
|
+
'Token' => /([tT][oO][kK][eE][nN]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/
|
|
48
|
+
# rubocop:enable Metrics/LineLength
|
|
49
|
+
}.freeze
|
|
50
|
+
|
|
51
|
+
class << self
|
|
52
|
+
def call(package)
|
|
53
|
+
compromised_files = package.text_files.map do |file|
|
|
54
|
+
contents = file.read
|
|
55
|
+
|
|
56
|
+
APPLICATION_SECRETS.each do |secret_type, regex_str|
|
|
57
|
+
next unless contents =~ Regexp.new(regex_str)
|
|
58
|
+
package.warnings << I18n.t('txt.apps.admin.warning.app_build.application_secret',
|
|
59
|
+
file: file.relative_path,
|
|
60
|
+
secret_type: secret_type)
|
|
61
|
+
end
|
|
62
|
+
|
|
63
|
+
file.relative_path if contents =~ Regexp.union(SECRET_KEYWORDS)
|
|
64
|
+
end.compact
|
|
65
|
+
|
|
66
|
+
return unless compromised_files.any?
|
|
67
|
+
package.warnings << I18n.t('txt.apps.admin.warning.app_build.generic_secrets',
|
|
68
|
+
files: compromised_files.join(
|
|
69
|
+
I18n.t('txt.apps.admin.error.app_build.listing_comma')
|
|
70
|
+
),
|
|
71
|
+
count: compromised_files.count)
|
|
72
|
+
end
|
|
73
|
+
end
|
|
74
|
+
end
|
|
75
|
+
end
|
|
76
|
+
end
|
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: zendesk_apps_support
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 4.
|
|
4
|
+
version: 4.16.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- James A. Rosen
|
|
@@ -11,7 +11,7 @@ authors:
|
|
|
11
11
|
autorequire:
|
|
12
12
|
bindir: bin
|
|
13
13
|
cert_chain: []
|
|
14
|
-
date: 2019-
|
|
14
|
+
date: 2019-06-26 00:00:00.000000000 Z
|
|
15
15
|
dependencies:
|
|
16
16
|
- !ruby/object:Gem::Dependency
|
|
17
17
|
name: i18n
|
|
@@ -262,6 +262,7 @@ files:
|
|
|
262
262
|
- lib/zendesk_apps_support/validations/manifest.rb
|
|
263
263
|
- lib/zendesk_apps_support/validations/marketplace.rb
|
|
264
264
|
- lib/zendesk_apps_support/validations/requirements.rb
|
|
265
|
+
- lib/zendesk_apps_support/validations/secrets.rb
|
|
265
266
|
- lib/zendesk_apps_support/validations/source.rb
|
|
266
267
|
- lib/zendesk_apps_support/validations/stylesheets.rb
|
|
267
268
|
- lib/zendesk_apps_support/validations/svg.rb
|
|
@@ -288,7 +289,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
|
288
289
|
version: 1.3.6
|
|
289
290
|
requirements: []
|
|
290
291
|
rubyforge_project:
|
|
291
|
-
rubygems_version: 2.6
|
|
292
|
+
rubygems_version: 2.7.6
|
|
292
293
|
signing_key:
|
|
293
294
|
specification_version: 4
|
|
294
295
|
summary: Support to help you develop Zendesk Apps.
|