detect-secrets 0.0.0-development

package/package.json

@@ -0,0 +1,196 @@
+{
+  "name": "detect-secrets",
+  "version": "0.0.0-development",
+  "description": "A developer-friendly secrets detection tool for CI and pre-commit hooks based on Yelp's detect-secrets",
+  "bin": {
+    "detect-secrets-launcher": "./bin/detect-secrets-launcher.js"
+  },
+  "engines": {
+    "npm": ">=11.10.0",
+    "node": ">=24.0.0"
+  },
+  "scripts": {
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "format": "prettier-standard '**/*.js'",
+    "test": "jest",
+    "test:watch": "jest --watch",
+    "coverage:view": "open-cli coverage/lcov-report/index.html",
+    "commit": "git-cz",
+    "docs": "npm run docs:code && npm run docs:api",
+    "docs:api": "doxdox *.js --layout bootstrap --output docs/index.html",
+    "docs:code": "docco *.js --output docs/code",
+    "build": "echo \"No build step configured\"",
+    "lint:markdown": "markdownlint -c .github/.markdownlint.yml '**/**.md'",
+    "version": "changeset version",
+    "release": "changeset publish"
+  },
+  "author": {
+    "name": "Liran Tal",
+    "email": "liran.tal@gmail.com",
+    "url": "https://github.com/lirantal"
+  },
+  "license": "Apache-2.0",
+  "keywords": [
+    "secrets",
+    "precommit",
+    "leak",
+    "git",
+    "credentials",
+    "yelp",
+    "detect-secrets"
+  ],
+  "homepage": "https://github.com/lirantal/detect-secrets",
+  "bugs": {
+    "url": "https://github.com/lirantal/detect-secrets/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/lirantal/detect-secrets.git"
+  },
+  "dependencies": {
+    "debug": "^4.3.3",
+    "which": "^2.0.2"
+  },
+  "devDependencies": {
+    "@commitlint/cli": "^7.2.1",
+    "@commitlint/config-conventional": "^7.1.2",
+    "babel-eslint": "^10.0.1",
+    "babel-plugin-syntax-async-functions": "^6.13.0",
+    "babel-plugin-transform-regenerator": "^6.26.0",
+    "babel-preset-env": "^1.6.1",
+    "babel-preset-es2015": "^6.24.1",
+    "commitizen": "^2.9.5",
+    "cz-conventional-changelog": "^1.2.0",
+    "docco": "^0.9.2",
+    "doxdox": "^2.0.1",
+    "eslint": "^5.10.0",
+    "eslint-config-standard": "^12.0.0",
+    "eslint-plugin-import": "^2.14.0",
+    "eslint-plugin-jest": "^22.1.2",
+    "eslint-plugin-node": "^8.0.0",
+    "eslint-plugin-promise": "^4.0.1",
+    "eslint-plugin-security": "^1.4.0",
+    "eslint-plugin-standard": "^4.0.0",
+    "husky": "^1.2.1",
+    "jest": "23.6",
+    "lint-staged": "^8.1.0",
+    "opn-cli": "^3.1.0",
+    "prettier-standard": "^8.0.1",
+    "@changesets/changelog-github": "^0.6.0",
+    "@changesets/cli": "^2.31.0",
+    "markdownlint-cli": "0.49.1",
+    "semantic-release": "25.0.9"
+  },
+  "jest": {
+    "testEnvironment": "node",
+    "verbose": true,
+    "notify": true,
+    "collectCoverage": true,
+    "coverageThreshold": {
+      "global": {
+        "branches": 80,
+        "functions": 80,
+        "lines": 80,
+        "statements": 80
+      }
+    },
+    "testPathIgnorePatterns": [
+      "/__tests__/.*/__fixtures__/.*"
+    ],
+    "collectCoverageFrom": [
+      "index.js",
+      "src/**/*.{js,ts}"
+    ],
+    "testMatch": [
+      "**/*.test.js"
+    ]
+  },
+  "husky": {
+    "hooks": {
+      "commit-msg": "commitlint --env HUSKY_GIT_PARAMS",
+      "pre-commit": "lint-staged",
+      "post-merge": "npm install",
+      "pre-push": "npm run lint && npm run test"
+    }
+  },
+  "lint-staged": {
+    "linters": {
+      "**/*.js": [
+        "prettier-standard",
+        "git add"
+      ]
+    }
+  },
+  "commitlint": {
+    "extends": [
+      "@commitlint/config-conventional"
+    ]
+  },
+  "config": {
+    "commitizen": {
+      "path": "./node_modules/cz-conventional-changelog"
+    }
+  },
+  "standard": {
+    "env": [
+      "jest"
+    ],
+    "parser": "babel-eslint",
+    "ignore": [
+      "**/out/"
+    ]
+  },
+  "eslintIgnore": [
+    "coverage/**"
+  ],
+  "eslintConfig": {
+    "env": {
+      "node": true,
+      "es6": true,
+      "jest": true
+    },
+    "plugins": [
+      "import",
+      "standard",
+      "node",
+      "security",
+      "jest"
+    ],
+    "extends": [
+      "standard",
+      "plugin:node/recommended"
+    ],
+    "rules": {
+      "no-process-exit": "warn",
+      "jest/no-disabled-tests": "error",
+      "jest/no-focused-tests": "error",
+      "jest/no-identical-title": "error",
+      "node/no-unsupported-features": "off",
+      "node/no-unpublished-require": "off",
+      "security/detect-non-literal-fs-filename": "error",
+      "security/detect-unsafe-regex": "error",
+      "security/detect-buffer-noassert": "error",
+      "security/detect-child-process": "error",
+      "security/detect-disable-mustache-escape": "error",
+      "security/detect-eval-with-expression": "error",
+      "security/detect-no-csrf-before-method-override": "error",
+      "security/detect-non-literal-regexp": "error",
+      "security/detect-object-injection": "warn",
+      "security/detect-possible-timing-attacks": "error",
+      "security/detect-pseudoRandomBytes": "error",
+      "space-before-function-paren": "off",
+      "object-curly-spacing": "off"
+    },
+    "parserOptions": {
+      "ecmaVersion": 8,
+      "ecmaFeatures": {
+        "impliedStrict": true
+      }
+    }
+  },
+  "publishConfig": {
+    "provenance": true,
+    "access": "public"
+  }
+}

package/src/cli.js

@@ -0,0 +1,26 @@
+/* eslint-disable security/detect-child-process */
+/* eslint-disable no-process-exit */
+'use strict'
+
+const {isExecutableAvailableInPath, executeStrategy} = require('../src/strategies')
+
+function start(executableStrategies) {
+  let strategyExitCode = 0
+  let strategiesInvoked = false
+  executableStrategies.forEach(strategy => {
+    const strategyExists = isExecutableAvailableInPath(strategy.filePath)
+    if (strategyExists && !strategiesInvoked) {
+      strategiesInvoked = true
+      strategyExitCode = executeStrategy(strategy)
+    }
+  })
+
+  return {
+    strategyExitCode,
+    strategiesInvoked
+  }
+}
+
+module.exports = {
+  start
+}

package/src/strategies.js

@@ -0,0 +1,63 @@
+/* eslint-disable security/detect-child-process */
+/* eslint-disable no-process-exit */
+'use strict'
+
+const ChildProcess = require('child_process')
+const debug = require('debug')('detect-secrets')
+const which = require('which')
+
+function isExecutableAvailableInPath(executable) {
+  debug(`checking if the executable ${executable} exists`)
+  let resolved
+  try {
+    resolved = which.sync(executable)
+    debug(`found executable ${executable} at: ${resolved}`)
+  } catch (error) {
+    debug(error)
+  }
+
+  if (!resolved) {
+    return false
+  }
+
+  return true
+}
+
+function executeStrategy(strategy) {
+  let hookCommandArguments = process.argv.slice(2)
+  debug(
+    `received ${hookCommandArguments.length} command arguments: ${JSON.stringify(
+      hookCommandArguments
+    )}`
+  )
+
+  if (strategy.prefixCommandArguments && strategy.prefixCommandArguments.length > 0) {
+    hookCommandArguments = strategy.prefixCommandArguments.concat(hookCommandArguments)
+  }
+
+  debug(`executing [${strategy.filePath}] with command arguments:`)
+  debug(hookCommandArguments)
+
+  const spawnResult = ChildProcess.spawnSync(strategy.filePath, hookCommandArguments, {
+    shell: true
+  })
+
+  debug(`exited with code: ${spawnResult.status}`)
+  console.log(spawnResult.stdout.toString('utf-8'))
+  console.error(spawnResult.stderr.toString('utf-8'))
+
+  const stderr = spawnResult.stderr.toString('utf-8')
+  const stringFound = stderr.match(/The baseline file was updated/g)
+  if (stringFound) {
+    // force a 0 status code as this isn't an actual error
+    // ref: https://github.com/Yelp/detect-secrets/issues/212
+    return 0
+  }
+
+  return spawnResult.status
+}
+
+module.exports = {
+  isExecutableAvailableInPath,
+  executeStrategy
+}