zendesk_apps_support 4.15.1 → 4.16.0
Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
|
-
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
2
|
+
SHA256:
|
|
3
|
+
metadata.gz: 7629b25072aa14d2fc633c4061efe052835f0893e221c131881124ecf1bb9989
|
|
4
|
+
data.tar.gz: 31827636b35c8b029e80e96cf7511b17f25b64319ba26725bc57fee0c38abda8
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: c84e515174af4129cd536c670279113588893de7f684523edd35521dac6fa0f1d1c33e1b7648239e56e88ef697899f11bb87c64f250c960a1dd4296709e35752
|
|
7
|
+
data.tar.gz: 1279372798bf6ba5a1672408046d308ae7feaf00d99cfdddb96122ce1ad4be3780e2c49223be5311146426ed4e5549c1647c8503401659b001f648a3946a8196
|
data/config/locales/en.yml
CHANGED
|
@@ -6,6 +6,7 @@ en:
|
|
|
6
6
|
admin:
|
|
7
7
|
error:
|
|
8
8
|
app_build:
|
|
9
|
+
listing_comma: ", "
|
|
9
10
|
jshint:
|
|
10
11
|
one: 'JSHint error in %{file}: %{errors}'
|
|
11
12
|
other: 'JSHint errors in %{file}: %{errors}'
|
|
@@ -52,6 +53,9 @@ en:
|
|
|
52
53
|
invalid_requirements_types:
|
|
53
54
|
one: 'requirements.json contains an invalid type: %{invalid_types}'
|
|
54
55
|
other: 'requirements.json contains invalid types: %{invalid_types}'
|
|
56
|
+
unsupported_mime_type_detected:
|
|
57
|
+
one: 'Unsupported MIME type detected in %{file_names}'
|
|
58
|
+
other: 'Unsupported MIME types detected in %{file_names}'
|
|
55
59
|
multiple_channel_integrations: Specifying multiple channel integrations
|
|
56
60
|
in requirements.json is not supported.
|
|
57
61
|
invalid_cr_schema_keys:
|
|
@@ -80,10 +84,16 @@ en:
|
|
|
80
84
|
blank_location_uri: "%{location} location does not specify a URI."
|
|
81
85
|
invalid_location_uri: "%{uri} is either an invalid location URI, refers
|
|
82
86
|
to a missing asset, or does not use HTTPS."
|
|
87
|
+
signed_setting_uri: The url (%{uri}) cannot use a setting because it is
|
|
88
|
+
a signed url.
|
|
83
89
|
name_as_parameter_name: Can't call a parameter 'name'
|
|
84
90
|
invalid_hidden_parameter:
|
|
85
91
|
one: "%{invalid_params} is set to hidden and cannot be required."
|
|
86
92
|
other: "%{invalid_params} are set to hidden and cannot be required."
|
|
93
|
+
blocked_request: Possible request to a %{type} ip %{uri} in %{file}.
|
|
94
|
+
blocked_request_private: private
|
|
95
|
+
blocked_request_loopback: loopback
|
|
96
|
+
blocked_request_link_local: link-local
|
|
87
97
|
invalid_version: "%{target_version} is not a valid framework version.
|
|
88
98
|
Available versions are: %{available_versions}."
|
|
89
99
|
old_version: Iframe Only apps must target framework versions 2.0 or greater.
|
|
@@ -128,3 +138,12 @@ en:
|
|
|
128
138
|
and may not display as intended.
|
|
129
139
|
bitmap_in_svg: "%{svg} contains an embedded bitmap and cannot be used
|
|
130
140
|
as an app icon. It has been replaced with a default placeholder icon."
|
|
141
|
+
generic_secrets:
|
|
142
|
+
one: Possible secrets found in %{files}. Consider reviewing the contents
|
|
143
|
+
of this file before submitting your app.
|
|
144
|
+
other: Possible secrets found in %{files}. Consider reviewing the contents
|
|
145
|
+
of these files before submitting your app.
|
|
146
|
+
insecure_http_request: Possible insecure HTTP request to %{uri} in %{file}.
|
|
147
|
+
Consider instead using the HTTPS protocol.
|
|
148
|
+
application_secret: Possible %{secret_type} found in %{file}. Consider
|
|
149
|
+
reviewing the contents of this file before submitting your app.
|
|
@@ -7,6 +7,10 @@ packages:
|
|
|
7
7
|
- apps_support
|
|
8
8
|
|
|
9
9
|
parts:
|
|
10
|
+
- translation:
|
|
11
|
+
key: "txt.apps.admin.error.app_build.listing_comma"
|
|
12
|
+
title: "Punctuation for separating lists of items in a sentence"
|
|
13
|
+
value: ", "
|
|
10
14
|
- translation:
|
|
11
15
|
key: "txt.apps.admin.error.app_build.jshint.one"
|
|
12
16
|
title: "App builder job: JSHint error message"
|
|
@@ -115,6 +119,16 @@ parts:
|
|
|
115
119
|
key: "txt.apps.admin.error.app_build.invalid_requirements_types.other"
|
|
116
120
|
title: "App builder job: requirements file contains invalid types error"
|
|
117
121
|
value: "requirements.json contains invalid types: %{invalid_types}"
|
|
122
|
+
- translation:
|
|
123
|
+
key: "txt.apps.admin.error.app_build.unsupported_mime_type_detected.one"
|
|
124
|
+
title: "App builder job: directory contains unsupported mime type. MIME is an abbreviation for Multipurpose Internet Mail Extensions. https://en.wikipedia.org/wiki/MIME"
|
|
125
|
+
value: "Unsupported MIME type detected in %{file_names}."
|
|
126
|
+
screenshot: "https://drive.google.com/open?id=13sG5kRWrcVPZiFzDLYo-WavY4WbsHdvX"
|
|
127
|
+
- translation:
|
|
128
|
+
key: "txt.apps.admin.error.app_build.unsupported_mime_type_detected.other"
|
|
129
|
+
title: "App builder job: directory contains unsupported mime type. MIME is an abbreviation for Multipurpose Internet Mail Extensions. https://en.wikipedia.org/wiki/MIME"
|
|
130
|
+
value: "Unsupported MIME types detected in %{file_names}."
|
|
131
|
+
screenshot: "https://drive.google.com/open?id=1Ht4Nq4ZcQ0DMfcm6JphF66QI3e1FT8Wn"
|
|
118
132
|
- translation:
|
|
119
133
|
key: "txt.apps.admin.error.app_build.multiple_channel_integrations"
|
|
120
134
|
title: "App builder job: requirements file contains multiple channel integrations, leave requirements.json as is (file name)"
|
|
@@ -219,6 +233,43 @@ parts:
|
|
|
219
233
|
key: "txt.apps.admin.warning.app_build.bitmap_in_svg"
|
|
220
234
|
title: "App builder job: warning that svg contains an embedded bitmap image and cannot be used"
|
|
221
235
|
value: "%{svg} contains an embedded bitmap and cannot be used as an app icon. It has been replaced with a default placeholder icon."
|
|
236
|
+
- translation:
|
|
237
|
+
key: "txt.apps.admin.warning.app_build.generic_secrets.one"
|
|
238
|
+
title: "App builder job: warning for generic secrets found in app text files. %{files} will be replaced with one file name"
|
|
239
|
+
value: "Possible secrets found in %{files}. Consider reviewing the contents of this file before submitting your app."
|
|
240
|
+
screenshot: "https://drive.google.com/file/d/179IMwzJvXD1m5u-0K499Ul3-qRBXAxnT"
|
|
241
|
+
- translation:
|
|
242
|
+
key: "txt.apps.admin.warning.app_build.generic_secrets.other"
|
|
243
|
+
title: "App builder job: warning for generic secrets found in app text files. %{files} will be replaced with multiple file names"
|
|
244
|
+
value: "Possible secrets found in %{files}. Consider reviewing the contents of these files before submitting your app."
|
|
245
|
+
screenshot: "https://drive.google.com/file/d/179IMwzJvXD1m5u-0K499Ul3-qRBXAxnT"
|
|
246
|
+
- translation:
|
|
247
|
+
key: "txt.apps.admin.warning.app_build.insecure_http_request"
|
|
248
|
+
title: "App builder job: warning on detecting an insecure http request call in app source files"
|
|
249
|
+
value: "Possible insecure HTTP request to %{uri} in %{file}. Consider instead using the HTTPS protocol."
|
|
250
|
+
screenshot: "https://drive.google.com/file/d/1V-lXrVoAXAZEtBoekq7XLyetomUZRqY-"
|
|
251
|
+
- translation:
|
|
252
|
+
key: "txt.apps.admin.error.app_build.blocked_request"
|
|
253
|
+
title: "App builder job: error on detecting a forbidden http request call in app source files"
|
|
254
|
+
value: "Possible request to a %{type} ip %{uri} in %{file}."
|
|
255
|
+
screenshot: "https://drive.google.com/file/d/1hiTwbQi5aj6PnEtfuA7QTALs6AryDmj_"
|
|
256
|
+
- translation:
|
|
257
|
+
key: "txt.apps.admin.error.app_build.blocked_request_private"
|
|
258
|
+
title: "App builder job: forbidden http request call ip type: private. See https://en.wikipedia.org/wiki/Private_network"
|
|
259
|
+
value: "private"
|
|
260
|
+
- translation:
|
|
261
|
+
key: "txt.apps.admin.error.app_build.blocked_request_loopback"
|
|
262
|
+
title: "App builder job: forbidden http request call ip type: loopback. See https://en.wikipedia.org/wiki/Loopback"
|
|
263
|
+
value: "loopback"
|
|
264
|
+
- translation:
|
|
265
|
+
key: "txt.apps.admin.error.app_build.blocked_request_link_local"
|
|
266
|
+
title: "App builder job: forbidden http request call ip type: link-local. See https://en.wikipedia.org/wiki/Link-local_address"
|
|
267
|
+
value: "link-local"
|
|
268
|
+
- translation:
|
|
269
|
+
key: "txt.apps.admin.warning.app_build.application_secret"
|
|
270
|
+
title: "App builder job: warning for secrets found in app text files"
|
|
271
|
+
value: "Possible %{secret_type} found in %{file}. Consider reviewing the contents of this file before submitting your app."
|
|
272
|
+
screenshot: "https://drive.google.com/file/d/1LoN9-IlRbiz6uv1-CQ933mh-WY8XY5o2"
|
|
222
273
|
- translation:
|
|
223
274
|
key: "txt.apps.admin.error.app_build.invalid_version"
|
|
224
275
|
title: "App builder job: invalid framework version"
|
data/lib/zendesk_apps_support.rb
CHANGED
|
@@ -21,6 +21,7 @@ module ZendeskAppsSupport
|
|
|
21
21
|
autoload :ValidationError, 'zendesk_apps_support/validations/validation_error'
|
|
22
22
|
autoload :Manifest, 'zendesk_apps_support/validations/manifest'
|
|
23
23
|
autoload :Marketplace, 'zendesk_apps_support/validations/marketplace'
|
|
24
|
+
autoload :Secrets, 'zendesk_apps_support/validations/secrets'
|
|
24
25
|
autoload :Source, 'zendesk_apps_support/validations/source'
|
|
25
26
|
autoload :Templates, 'zendesk_apps_support/validations/templates'
|
|
26
27
|
autoload :Translations, 'zendesk_apps_support/validations/translations'
|
|
@@ -31,6 +31,7 @@ module ZendeskAppsSupport
|
|
|
31
31
|
def validate(marketplace: true, skip_marketplace_translations: false)
|
|
32
32
|
errors = []
|
|
33
33
|
errors << Validations::Manifest.call(self)
|
|
34
|
+
|
|
34
35
|
if has_valid_manifest?(errors)
|
|
35
36
|
errors << Validations::Marketplace.call(self) if marketplace
|
|
36
37
|
errors << Validations::Source.call(self)
|
|
@@ -46,6 +47,9 @@ module ZendeskAppsSupport
|
|
|
46
47
|
errors << Validations::Banner.call(self) if has_banner?
|
|
47
48
|
errors << Validations::Svg.call(self) if has_svgs?
|
|
48
49
|
|
|
50
|
+
# warning only validators
|
|
51
|
+
Validations::Secrets.call(self)
|
|
52
|
+
|
|
49
53
|
errors.flatten.compact
|
|
50
54
|
end
|
|
51
55
|
|
|
@@ -84,8 +88,12 @@ module ZendeskAppsSupport
|
|
|
84
88
|
files
|
|
85
89
|
end
|
|
86
90
|
|
|
91
|
+
def text_files
|
|
92
|
+
@text_files ||= files.select { |f| f =~ %r{.*(html?|xml|js|json?)$} }
|
|
93
|
+
end
|
|
94
|
+
|
|
87
95
|
def js_files
|
|
88
|
-
@js_files ||= files.select { |f| f
|
|
96
|
+
@js_files ||= files.select { |f| f =~ %r{^(app|lib\/.*)\.js$} }
|
|
89
97
|
end
|
|
90
98
|
|
|
91
99
|
def lib_files
|
|
@@ -0,0 +1,76 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
2
|
+
|
|
3
|
+
module ZendeskAppsSupport
|
|
4
|
+
module Validations
|
|
5
|
+
module Secrets
|
|
6
|
+
SECRET_KEYWORDS = %w[
|
|
7
|
+
pass password secret secretToken secret_token auth_key
|
|
8
|
+
authKey auth_pass authPass auth_user AuthUser username api_key
|
|
9
|
+
].freeze
|
|
10
|
+
|
|
11
|
+
APPLICATION_SECRETS = {
|
|
12
|
+
# rubocop:disable Metrics/LineLength
|
|
13
|
+
'Slack Token' => /(xox[p|b|o|a]-*.[a-z0-9])/,
|
|
14
|
+
'RSA Private Key' => /-----BEGIN RSA PRIVATE KEY-----/,
|
|
15
|
+
'SSH Private Key (OpenSSH)' => /-----BEGIN OPENSSH PRIVATE KEY-----/,
|
|
16
|
+
'SSH Private Key (DSA)' => /-----BEGIN DSA PRIVATE KEY-----/,
|
|
17
|
+
'SSH Private Key (EC)' => /-----BEGIN EC PRIVATE KEY-----/,
|
|
18
|
+
'PGP Private Key Block' => /-----BEGIN PGP PRIVATE KEY BLOCK-----/,
|
|
19
|
+
'Facebook OAuth Token' => /([f|F][a|A][c|C][e|E][b|B][o|O][o|O][k|K]( [|:\"=-]|[:\"=-|]).*.[0-9a-f]{24,36})/,
|
|
20
|
+
'Twitter OAuth Token' => /([t|T][w|W][i|I][t|T][t|T][e|E][r|R]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z]{30,45})/,
|
|
21
|
+
'Github Token' => /([g|G][i|I][t|T][h|H][u|U][b|B]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z]{30,45})/,
|
|
22
|
+
'Google OAuth Token' => /([c|C][l|L][i|I][e|E][n|N][t|T][\-_][s|S][e|E][c|C][r|R][e|E][t|T]( [:\"=-]|[:\"=-]).*[a-zA-Z0-9\-_]{16,32})/,
|
|
23
|
+
'AWS Access Key ID' => /(AKIA[0-9A-Z]{8,24})/,
|
|
24
|
+
'AWS Secret Access Key' => /([a|A][w|W][s|S][_-][s|S][e|E][c|C][r|R][e|E][t|T][_-][a|A][c|C][c|C][e|E][s|S][s|S][_-][k|K][e|E][y|Y].*.[0-9a-zA-Z]{24,48})/,
|
|
25
|
+
'Heroku API Key' => /([h|H][e|E][r|R][o|O][k|K][u|U].*[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{6,18})/,
|
|
26
|
+
'Quickpay Secret' => /(quickpay_secret:.*.[0-9a-zA-Z]{24,72})/,
|
|
27
|
+
'Doorman Secret' => /([d|D][o|O][o|O][r|R][m|M][a|A][n|N][-_][s|S][e|E][c|C][r|R][e|E][t|T].*.[0-9a-f]{16,132})/,
|
|
28
|
+
'Shared Session Secret' => /(shared_session_secret.*.[0-9a-f]{4,132})/,
|
|
29
|
+
'Permanent Cookie Secret' => /(permanent_cookie_secret.*.[0-9a-f]{120,156})/,
|
|
30
|
+
'Scarlett AWS Secret Key' => /([sS][cC][aA][rR][lL][eE][tT][tT][_-][aA][wW][sS][_-][sS][eE][cC][rR][eE][tT][_-][kK][eE][yY].*.[0-9a-zA-Z+.]{35,45})/,
|
|
31
|
+
'Braintree Key' => /(braintree_key.*.[0-9a-zA-Z]{16,36})/,
|
|
32
|
+
'Ticket Validation Key' => /(ticket_validation_key.*.[0-9a-zA-Z]{15,25})/,
|
|
33
|
+
'App Key' => /([aA][pP][pP][-_][kK][eE][yY]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
|
|
34
|
+
'App Secret' => /([aA][pP][pP][-_][sS][eE][cC][rR][eE][tT]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
|
|
35
|
+
'Consumer Key' => /([cC][oO][nN][sS][uU][mM][eE][rR][-_][kK][eE][yY]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
|
|
36
|
+
'Consumer Secret' => /([cC][oO][nN][sS][uU][mM][eE][rR][-_][sS][eE][cC][rR][eE][tT]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
|
|
37
|
+
'Generic Secret' => /(?m)^([sS][eE][cC][rR][eE][tT]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
|
|
38
|
+
'Master Key' => /([mM][aA][sS][tT][eE][rR][-_][kK][eE][yY]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
|
|
39
|
+
'Master Secret' => /([mM][aA][sS][tT][eE][rR][-_][sS][eE][cC][rR][eE][tT]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
|
|
40
|
+
'Token Key' => /([tT][oO][kK][eE][nN][-_][kK][eE][yY]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
|
|
41
|
+
'Token Secret' => /([tT][oO][kK][eE][nN][-_][sS][eE][cC][rR][eE][tT]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
|
|
42
|
+
'Zendesk Zopim Mobile SSO Key' => /(zendesk_zopim_mobile_sso_key.*.[0-9a-f]{58,68})/,
|
|
43
|
+
'Help Center Private Key' => /([pP][rR][iI][vV][aA][tT][eE][-_][kK][eE][yY]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/,
|
|
44
|
+
'X-Outbound-Key' => /([xX][-][oO][uU][tT][bB][oO][uU][nN][dD][-][kK][eE][yY][:\" \t=-].*.[0-9a-z-]{32,36})/,
|
|
45
|
+
'Attachment Token Key' => /(attachment_token_key.*.[0-9a-f]{24,72})/,
|
|
46
|
+
'Password' => /([pP][aA][sS][sS][wW][oO][rR][dD].*.[0-9a-zA-Z+_.-]{4,156})/,
|
|
47
|
+
'Token' => /([tT][oO][kK][eE][nN]( [:\"=-]|[:\"=-]).*.[0-9a-zA-Z+_.-]{4,156})/
|
|
48
|
+
# rubocop:enable Metrics/LineLength
|
|
49
|
+
}.freeze
|
|
50
|
+
|
|
51
|
+
class << self
|
|
52
|
+
def call(package)
|
|
53
|
+
compromised_files = package.text_files.map do |file|
|
|
54
|
+
contents = file.read
|
|
55
|
+
|
|
56
|
+
APPLICATION_SECRETS.each do |secret_type, regex_str|
|
|
57
|
+
next unless contents =~ Regexp.new(regex_str)
|
|
58
|
+
package.warnings << I18n.t('txt.apps.admin.warning.app_build.application_secret',
|
|
59
|
+
file: file.relative_path,
|
|
60
|
+
secret_type: secret_type)
|
|
61
|
+
end
|
|
62
|
+
|
|
63
|
+
file.relative_path if contents =~ Regexp.union(SECRET_KEYWORDS)
|
|
64
|
+
end.compact
|
|
65
|
+
|
|
66
|
+
return unless compromised_files.any?
|
|
67
|
+
package.warnings << I18n.t('txt.apps.admin.warning.app_build.generic_secrets',
|
|
68
|
+
files: compromised_files.join(
|
|
69
|
+
I18n.t('txt.apps.admin.error.app_build.listing_comma')
|
|
70
|
+
),
|
|
71
|
+
count: compromised_files.count)
|
|
72
|
+
end
|
|
73
|
+
end
|
|
74
|
+
end
|
|
75
|
+
end
|
|
76
|
+
end
|
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: zendesk_apps_support
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 4.
|
|
4
|
+
version: 4.16.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- James A. Rosen
|
|
@@ -11,7 +11,7 @@ authors:
|
|
|
11
11
|
autorequire:
|
|
12
12
|
bindir: bin
|
|
13
13
|
cert_chain: []
|
|
14
|
-
date: 2019-
|
|
14
|
+
date: 2019-06-26 00:00:00.000000000 Z
|
|
15
15
|
dependencies:
|
|
16
16
|
- !ruby/object:Gem::Dependency
|
|
17
17
|
name: i18n
|
|
@@ -262,6 +262,7 @@ files:
|
|
|
262
262
|
- lib/zendesk_apps_support/validations/manifest.rb
|
|
263
263
|
- lib/zendesk_apps_support/validations/marketplace.rb
|
|
264
264
|
- lib/zendesk_apps_support/validations/requirements.rb
|
|
265
|
+
- lib/zendesk_apps_support/validations/secrets.rb
|
|
265
266
|
- lib/zendesk_apps_support/validations/source.rb
|
|
266
267
|
- lib/zendesk_apps_support/validations/stylesheets.rb
|
|
267
268
|
- lib/zendesk_apps_support/validations/svg.rb
|
|
@@ -288,7 +289,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
|
288
289
|
version: 1.3.6
|
|
289
290
|
requirements: []
|
|
290
291
|
rubyforge_project:
|
|
291
|
-
rubygems_version: 2.6
|
|
292
|
+
rubygems_version: 2.7.6
|
|
292
293
|
signing_key:
|
|
293
294
|
specification_version: 4
|
|
294
295
|
summary: Support to help you develop Zendesk Apps.
|