| 1 | //! The security service: what g1t finds wrong in a repository, and the |
| 2 | //! upkeep that fixes it without a person. |
| 3 | //! |
| 4 | //! - Secrets. The repos service refuses pushes that add one |
| 5 | //! (`push_blocked` says which were allowed and records the rest), and |
| 6 | //! each repository's history is scanned once, in the background. |
| 7 | //! A push too large to scan first is let through, and its new commits |
| 8 | //! are scanned after they land (`history::advance_push_scan`). |
| 9 | //! - Alerts are open, dismissed (with a reason, a comment and who) or |
| 10 | //! fixed, and each keeps an activity log. Likely test values are listed |
| 11 | //! apart and never block a push or count as critical. |
| 12 | //! - Dependencies. On every push to a default branch, and daily, the |
| 13 | //! lockfiles are read and every package checked against OSV. Each |
| 14 | //! vulnerable package with a fix gets a security update: g1t itself |
| 15 | //! (`User::system`) opens a pull request raising its version, made in a |
| 16 | //! sandbox (the runner's `bump`), which lands through the branch's |
| 17 | //! required checks. When code has to change, the alert says why and |
| 18 | //! the update is tried again later. |
| 19 | //! |
| 20 | //! - The security suite (`g1t_contracts::security_suite`): custom secret |
| 21 | //! patterns (`patterns`), push protection bypasses, their review and |
| 22 | //! validity checks (`secret_alerts`), code scanning from SARIF uploads |
| 23 | //! and its pull request check (`code_scanning`), the dependency graph, |
| 24 | //! its SBOM and dependency review (`supply_chain`), and settings with |
| 25 | //! the workspace's overview (`overview`). |
| 26 | //! On private repositories its paid parts need the workspace's Security |
| 27 | //! and quality activation (`suite`); it tells people through events. |
| 28 | //! |
| 29 | //! Other services reach it over `POST /rpc/<method>`; see |
| 30 | //! `g1t_contracts::security`. |
| 31 | |
| 32 | mod advisories; |
| 33 | mod code_scanning; |
| 34 | mod config; |
| 35 | mod deps; |
| 36 | mod history; |
| 37 | mod manifests; |
| 38 | mod overview; |
| 39 | mod patterns; |
| 40 | mod planning; |
| 41 | mod pull_text; |
| 42 | mod resolved; |
| 43 | mod ranges; |
| 44 | mod registries; |
| 45 | mod schedule; |
| 46 | mod secret_alerts; |
| 47 | mod security_updates; |
| 48 | mod store; |
| 49 | mod suite; |
| 50 | mod suite_store; |
| 51 | mod summaries; |
| 52 | mod supply_chain; |
| 53 | mod timezones; |
| 54 | mod update_store; |
| 55 | mod updates; |
| 56 | mod version_updates; |
| 57 | mod yaml; |
| 58 | |
| 59 | use g1t_contracts::access::{self, Capability}; |
| 60 | use g1t_contracts::events::{Event, WorkspaceRenamed}; |
| 61 | use g1t_contracts::security::UPDATE_BRANCH_PREFIX; |
| 62 | use g1t_contracts::repos::{GetArgs, PathByIdArgs, Repo, RepoPath, RepoStatus, StatusByIdArgs}; |
| 63 | use g1t_contracts::security::*; |
| 64 | use g1t_contracts::time::rfc3339; |
| 65 | use g1t_contracts::{FailureCode, Outcome, User}; |
| 66 | use g1t_kit::{args, now_ms, reply, rpc_method}; |
| 67 | use serde::Deserialize; |
| 68 | use worker::{Context, Env, Fetcher, MessageBatch, Request, Response, Result, ScheduleContext, ScheduledEvent, event}; |
| 69 | |
| 70 | use store::{Activity, RepoRow, Store}; |
| 71 | |
| 72 | /// Repositories whose history is continued per sweep, and pages each. |
| 73 | const HISTORIES_PER_SWEEP: u32 = 5; |
| 74 | const PAGES_PER_SWEEP: u32 = 4; |
| 75 | /// Repositories whose dependencies are read again per sweep. |
| 76 | const DEPENDENCIES_PER_SWEEP: u32 = 10; |
| 77 | const DAY_MS: u64 = 24 * 60 * 60 * 1000; |
| 78 | const MAX_REASON_CHARS: usize = 500; |
| 79 | /// What seeing and dismissing a repository's findings takes: the Write |
| 80 | /// role, as on GitHub, or a security manager of its workspace. Changing its |
| 81 | /// security settings takes Admin (`ManageSecurity`). |
| 82 | const SEE_FINDINGS: Capability = Capability::SecurityAlerts; |
| 83 | |
| 84 | pub struct Security { |
| 85 | store: Store, |
| 86 | identity: Fetcher, |
| 87 | repos: Fetcher, |
| 88 | work: Fetcher, |
| 89 | runner: Fetcher, |
| 90 | billing: Fetcher, |
| 91 | actions: Fetcher, |
| 92 | /// The events service: security events for webhooks and the inbox, |
| 93 | /// and audit entries. Optional so a deployment without the binding |
| 94 | /// still scans. |
| 95 | events: Option<Fetcher>, |
| 96 | } |
| 97 | |
| 98 | fn fail<T>(code: FailureCode, message: impl Into<String>) -> Outcome<T> { |
| 99 | Outcome::fail(code, message) |
| 100 | } |
| 101 | |
| 102 | /// `git.push`, as far as this service reads it. |
| 103 | #[derive(Deserialize)] |
| 104 | #[serde(rename_all = "camelCase")] |
| 105 | struct Pushed { |
| 106 | repo_id: String, |
| 107 | #[serde(default)] |
| 108 | default_branch: bool, |
| 109 | #[serde(default, rename = "ref")] |
| 110 | git_ref: String, |
| 111 | #[serde(default)] |
| 112 | before: Option<String>, |
| 113 | #[serde(default)] |
| 114 | after: String, |
| 115 | /// Too large to scan before it was stored. |
| 116 | #[serde(default)] |
| 117 | unscanned: bool, |
| 118 | } |
| 119 | |
| 120 | /// `pull.merged` and `pull.closed`, as far as this service reads them. |
| 121 | #[derive(Deserialize)] |
| 122 | #[serde(rename_all = "camelCase")] |
| 123 | struct PullHappened { |
| 124 | repo_id: String, |
| 125 | number: u32, |
| 126 | } |
| 127 | |
| 128 | /// The longest comment a dismissal keeps. |
| 129 | const MAX_COMMENT_CHARS: usize = MAX_REASON_CHARS; |
| 130 | /// Activity rows the Security page reads, newest first. |
| 131 | const ACTIVITY_SHOWN: u32 = 500; |
| 132 | |
| 133 | #[derive(Deserialize)] |
| 134 | #[serde(rename_all = "camelCase")] |
| 135 | struct Created { |
| 136 | repo_id: String, |
| 137 | /// Absent from events older than the field. |
| 138 | #[serde(default)] |
| 139 | is_private: Option<bool>, |
| 140 | } |
| 141 | |
| 142 | impl Security { |
| 143 | fn new(env: &Env) -> Result<Self> { |
| 144 | Ok(Security { |
| 145 | store: Store { db: env.d1("DB")? }, |
| 146 | identity: env.service("IDENTITY")?, |
| 147 | repos: env.service("REPOS")?, |
| 148 | work: env.service("WORK")?, |
| 149 | runner: env.service("RUNNER")?, |
| 150 | billing: env.service("BILLING")?, |
| 151 | actions: env.service("ACTIONS")?, |
| 152 | events: env.service("EVENTS").ok(), |
| 153 | }) |
| 154 | } |
| 155 | |
| 156 | /// The repository at `path`, recorded here, if `viewer` may see its |
| 157 | /// findings (the Write role) and do `capability`. Findings are for those |
| 158 | /// who can change the code: to anyone else the page does not exist, |
| 159 | /// public repository or not. |
| 160 | async fn member_repo( |
| 161 | &self, |
| 162 | path: &RepoPath, |
| 163 | viewer: &Option<User>, |
| 164 | capability: Capability, |
| 165 | ) -> Result<Outcome<RepoRow>> { |
| 166 | let hidden = || fail(FailureCode::NotFound, "Repository not found."); |
| 167 | if viewer.is_none() { |
| 168 | return Ok(hidden()); |
| 169 | } |
| 170 | let repo: Outcome<Repo> = |
| 171 | g1t_kit::call(&self.repos, "get", &GetArgs { path: path.clone(), viewer: viewer.clone() }).await?; |
| 172 | let repo = match repo { |
| 173 | Outcome::Ok(repo) if repo.fork_of.is_none() => repo, |
| 174 | _ => return Ok(hidden()), |
| 175 | }; |
| 176 | if !access::can(viewer.as_ref(), &repo, SEE_FINDINGS) { |
| 177 | return Ok(hidden()); |
| 178 | } |
| 179 | if !access::can(viewer.as_ref(), &repo, capability) { |
| 180 | return Ok(fail( |
| 181 | FailureCode::Forbidden, |
| 182 | access::needs(capability, &format!("{}/{}", repo.namespace, repo.name)), |
| 183 | )); |
| 184 | } |
| 185 | let row = self.store.register(&repo.id, &repo.namespace, &repo.name).await?; |
| 186 | self.store.set_private(&repo.id, repo.is_private).await?; |
| 187 | Ok(Outcome::Ok(row)) |
| 188 | } |
| 189 | |
| 190 | /// Where the repository stands: archived, deleted, a mirror. When repos |
| 191 | /// cannot say, it is taken as an ordinary active repository. |
| 192 | async fn status(&self, repo_id: &str) -> Result<RepoStatus> { |
| 193 | let status: Result<RepoStatus> = |
| 194 | g1t_kit::call(&self.repos, "status_by_id", &StatusByIdArgs { id: repo_id.to_owned() }).await; |
| 195 | Ok(match status { |
| 196 | Ok(status) => status, |
| 197 | Err(error) => { |
| 198 | worker::console_error!("security: status_by_id {repo_id}: {error}"); |
| 199 | RepoStatus::default() |
| 200 | } |
| 201 | }) |
| 202 | } |
| 203 | |
| 204 | /// Whether the repository is neither archived nor deleted. Scanning |
| 205 | /// goes on in a mirror: it reads. |
| 206 | async fn active(&self, repo_id: &str) -> Result<bool> { |
| 207 | Ok(self.status(repo_id).await?.active()) |
| 208 | } |
| 209 | |
| 210 | /// Whether g1t may open branches and pull requests here on its own |
| 211 | /// (security and dependency updates): active, and not a mirror short |
| 212 | /// of a takeover (`g1t_contracts::mirrors`). `Err` says why not. |
| 213 | async fn takes_updates(&self, repo: &RepoRow) -> Result<std::result::Result<(), String>> { |
| 214 | let status = self.status(&repo.repo_id).await?; |
| 215 | if status.takes_updates() { |
| 216 | return Ok(Ok(())); |
| 217 | } |
| 218 | Ok(Err(match &status.mirror { |
| 219 | Some(mirror) if status.active() => g1t_contracts::mirrors::updates_wait_message(&repo.namespace, &repo.name, mirror), |
| 220 | _ => "Updates wait while the repository is archived or deleted.".to_owned(), |
| 221 | })) |
| 222 | } |
| 223 | |
| 224 | /// Records a repository named in an event, by id. Forks are not |
| 225 | /// recorded: a pull request's findings belong to its repository. |
| 226 | async fn register_by_id(&self, repo_id: &str) -> Result<Option<RepoRow>> { |
| 227 | if let Some(row) = self.store.repo(repo_id).await? { |
| 228 | return Ok(Some(row)); |
| 229 | } |
| 230 | let path: Option<RepoPath> = g1t_kit::call(&self.repos, "path_by_id", &PathByIdArgs { id: repo_id.to_owned() }).await?; |
| 231 | match path { |
| 232 | Some(path) => Ok(Some(self.store.register(repo_id, &path.namespace, &path.name).await?)), |
| 233 | None => Ok(None), |
| 234 | } |
| 235 | } |
| 236 | |
| 237 | async fn overview(&self, a: OverviewArgs) -> Result<Outcome<SecurityOverview>> { |
| 238 | let mut repo = match self.member_repo(&a.repo, &a.viewer, SEE_FINDINGS).await? { |
| 239 | Outcome::Ok(repo) => repo, |
| 240 | Outcome::Fail(failure) => return Ok(Outcome::Fail(failure)), |
| 241 | }; |
| 242 | // The first look at a repository reads its dependencies at once; |
| 243 | // its history is scanned in the background. |
| 244 | if repo.deps_scanned_at.is_none() { |
| 245 | self.scan_dependencies(&repo).await?; |
| 246 | repo = self.store.repo(&repo.repo_id).await?.unwrap_or(repo); |
| 247 | } |
| 248 | let (counts, _, _) = self.store.counts(&repo.repo_id).await?; |
| 249 | Ok(Outcome::Ok(SecurityOverview { |
| 250 | repo_id: repo.repo_id.clone(), |
| 251 | counts, |
| 252 | secret_counts: self.store.secret_counts(&repo.repo_id).await?, |
| 253 | secrets: self.store.secrets(&repo.repo_id).await?, |
| 254 | vulnerabilities: self.store.vulnerabilities(&repo.repo_id).await?, |
| 255 | activity: self.store.activity(&repo.repo_id, ACTIVITY_SHOWN).await?, |
| 256 | scan: repo.scan_state(), |
| 257 | upkeep: repo.upkeep != 0, |
| 258 | version_updates: self.version_updates_view(&repo).await?, |
| 259 | })) |
| 260 | } |
| 261 | |
| 262 | /// What dismissing or reopening alert `id` takes: Write, for a secret |
| 263 | /// as for a vulnerable dependency, as on GitHub; a security manager may |
| 264 | /// too. |
| 265 | fn capability_for(_id: &str) -> Capability { |
| 266 | SEE_FINDINGS |
| 267 | } |
| 268 | |
| 269 | async fn dismiss(&self, a: DismissArgs) -> Result<Outcome<AlertChange>> { |
| 270 | let repo = match self.member_repo(&a.repo, &Some(a.actor.clone()), Self::capability_for(&a.id)).await? { |
| 271 | Outcome::Ok(repo) => repo, |
| 272 | Outcome::Fail(failure) => return Ok(Outcome::Fail(failure)), |
| 273 | }; |
| 274 | if !a.actor.verified { |
| 275 | return Ok(fail(FailureCode::Forbidden, "Confirm your email address first.")); |
| 276 | } |
| 277 | let comment: String = a.comment.trim().chars().take(MAX_COMMENT_CHARS).collect(); |
| 278 | let comment = (!comment.is_empty()).then_some(comment); |
| 279 | if let Some(finding) = self.store.secret(&repo.repo_id, &a.id).await? { |
| 280 | if !a.reason.for_secrets() { |
| 281 | return Ok(fail( |
| 282 | FailureCode::Invalid, |
| 283 | "A secret is dismissed as false_positive, used_in_tests, revoked or wont_fix.", |
| 284 | )); |
| 285 | } |
| 286 | if finding.state != AlertState::Open { |
| 287 | return Ok(fail(FailureCode::Conflict, "This alert is not open. Reopen it first to dismiss it again.")); |
| 288 | } |
| 289 | self.store |
| 290 | .dismiss_secret(&repo.repo_id, &a.id, a.reason, &a.actor.username, comment.as_deref()) |
| 291 | .await?; |
| 292 | self.store |
| 293 | .record(&repo.repo_id, &[Activity { |
| 294 | alert_id: &a.id, |
| 295 | action: "dismissed", |
| 296 | actor: Some(&a.actor.username), |
| 297 | reason: Some(a.reason), |
| 298 | comment: comment.as_deref(), |
| 299 | number: None, |
| 300 | }]) |
| 301 | .await?; |
| 302 | let secret = self.store.secret(&repo.repo_id, &a.id).await?; |
| 303 | if let Some(secret) = &secret { |
| 304 | // Revoked is fixed; any other reason, dismissed. |
| 305 | let action = if a.reason == DismissReason::Revoked { "fixed" } else { "dismissed" }; |
| 306 | let event = g1t_contracts::security_suite::SecurityEvent { |
| 307 | reason: Some(a.reason.as_str().to_owned()), |
| 308 | ..secret_alerts::secret_event(&repo, secret) |
| 309 | }; |
| 310 | self.alert_event(g1t_contracts::security_suite::AlertType::SecretScanning, action, &repo, event, Some(a.actor.id.clone())) |
| 311 | .await; |
| 312 | let changed = summaries::Changed { |
| 313 | scan: "change", |
| 314 | fixed: if action == "fixed" { vec![a.id.clone()] } else { Vec::new() }, |
| 315 | dismissed: u32::from(action == "dismissed"), |
| 316 | ..summaries::Changed::default() |
| 317 | }; |
| 318 | self.summarize(&repo, g1t_contracts::security_suite::AlertType::SecretScanning, changed, Some(a.actor.id.clone())).await?; |
| 319 | } |
| 320 | return Ok(Outcome::Ok(AlertChange { secret, vulnerability: None })); |
| 321 | } |
| 322 | let Some(vuln) = self.store.vulnerability(&repo.repo_id, &a.id).await? else { |
| 323 | return Ok(fail(FailureCode::NotFound, "No such alert.")); |
| 324 | }; |
| 325 | if a.reason.for_secrets() { |
| 326 | return Ok(fail( |
| 327 | FailureCode::Invalid, |
| 328 | "A dependency is dismissed as fix_started, no_bandwidth, tolerable_risk, inaccurate or not_used.", |
| 329 | )); |
| 330 | } |
| 331 | if vuln.state != AlertState::Open { |
| 332 | return Ok(fail(FailureCode::Conflict, "This alert is not open. Reopen it first to dismiss it again.")); |
| 333 | } |
| 334 | self.store |
| 335 | .dismiss_vulnerability(&repo.repo_id, &a.id, a.reason, &a.actor.username, comment.as_deref()) |
| 336 | .await?; |
| 337 | self.store |
| 338 | .record(&repo.repo_id, &[Activity { |
| 339 | alert_id: &a.id, |
| 340 | action: "dismissed", |
| 341 | actor: Some(&a.actor.username), |
| 342 | reason: Some(a.reason), |
| 343 | comment: comment.as_deref(), |
| 344 | number: None, |
| 345 | }]) |
| 346 | .await?; |
| 347 | let vulnerability = self.store.vulnerability(&repo.repo_id, &a.id).await?; |
| 348 | if let Some(vuln) = &vulnerability { |
| 349 | let event = g1t_contracts::security_suite::SecurityEvent { reason: Some(a.reason.as_str().to_owned()), ..deps::vulnerability_event(&repo, vuln) }; |
| 350 | self.alert_event(g1t_contracts::security_suite::AlertType::Vulnerability, "dismissed", &repo, event, Some(a.actor.id.clone())).await; |
| 351 | let changed = summaries::Changed { scan: "change", dismissed: 1, ..summaries::Changed::default() }; |
| 352 | self.summarize(&repo, g1t_contracts::security_suite::AlertType::Vulnerability, changed, Some(a.actor.id.clone())).await?; |
| 353 | } |
| 354 | // A security update whose alerts are now all fixed or dismissed closes. |
| 355 | if let Err(error) = self.resolve_updates(&repo, None).await { |
| 356 | worker::console_error!("security: updates of {} not resolved after a dismissal: {error}", repo.repo_id); |
| 357 | } |
| 358 | Ok(Outcome::Ok(AlertChange { secret: None, vulnerability })) |
| 359 | } |
| 360 | |
| 361 | async fn reopen(&self, a: ReopenArgs) -> Result<Outcome<AlertChange>> { |
| 362 | let repo = match self.member_repo(&a.repo, &Some(a.actor.clone()), Self::capability_for(&a.id)).await? { |
| 363 | Outcome::Ok(repo) => repo, |
| 364 | Outcome::Fail(failure) => return Ok(Outcome::Fail(failure)), |
| 365 | }; |
| 366 | if !a.actor.verified { |
| 367 | return Ok(fail(FailureCode::Forbidden, "Confirm your email address first.")); |
| 368 | } |
| 369 | let reopened = Activity { alert_id: &a.id, action: "reopened", actor: Some(&a.actor.username), reason: None, comment: None, number: None }; |
| 370 | if let Some(finding) = self.store.secret(&repo.repo_id, &a.id).await? { |
| 371 | if finding.state == AlertState::Open { |
| 372 | return Ok(fail(FailureCode::Conflict, "This alert is already open.")); |
| 373 | } |
| 374 | // A secret that never landed has nothing to reopen to but blocked. |
| 375 | let status = if finding.source == "push" && finding.test_value.is_none() { SecretStatus::Blocked } else { SecretStatus::Open }; |
| 376 | self.store.reopen_secret(&repo.repo_id, &a.id, status).await?; |
| 377 | self.store.record(&repo.repo_id, &[reopened]).await?; |
| 378 | let secret = self.store.secret(&repo.repo_id, &a.id).await?; |
| 379 | if let Some(secret) = &secret { |
| 380 | self.alert_event( |
| 381 | g1t_contracts::security_suite::AlertType::SecretScanning, |
| 382 | "reopened", |
| 383 | &repo, |
| 384 | secret_alerts::secret_event(&repo, secret), |
| 385 | Some(a.actor.id.clone()), |
| 386 | ) |
| 387 | .await; |
| 388 | // The thread's counts move; nobody is told anew of what they reopened. |
| 389 | let changed = summaries::Changed { scan: "change", ..summaries::Changed::default() }; |
| 390 | self.summarize(&repo, g1t_contracts::security_suite::AlertType::SecretScanning, changed, Some(a.actor.id.clone())).await?; |
| 391 | } |
| 392 | return Ok(Outcome::Ok(AlertChange { secret, vulnerability: None })); |
| 393 | } |
| 394 | let Some(vuln) = self.store.vulnerability(&repo.repo_id, &a.id).await? else { |
| 395 | return Ok(fail(FailureCode::NotFound, "No such alert.")); |
| 396 | }; |
| 397 | if vuln.state != AlertState::Dismissed { |
| 398 | return Ok(fail(FailureCode::Conflict, "Only a dismissed alert can be reopened; a fixed one reopens when it is found again.")); |
| 399 | } |
| 400 | self.store.reopen_vulnerability(&repo.repo_id, &a.id).await?; |
| 401 | self.store.record(&repo.repo_id, &[reopened]).await?; |
| 402 | let vulnerability = self.store.vulnerability(&repo.repo_id, &a.id).await?; |
| 403 | if let Some(vuln) = &vulnerability { |
| 404 | self.alert_event( |
| 405 | g1t_contracts::security_suite::AlertType::Vulnerability, |
| 406 | "reopened", |
| 407 | &repo, |
| 408 | deps::vulnerability_event(&repo, vuln), |
| 409 | Some(a.actor.id.clone()), |
| 410 | ) |
| 411 | .await; |
| 412 | let changed = summaries::Changed { scan: "change", ..summaries::Changed::default() }; |
| 413 | self.summarize(&repo, g1t_contracts::security_suite::AlertType::Vulnerability, changed, Some(a.actor.id.clone())).await?; |
| 414 | } |
| 415 | Ok(Outcome::Ok(AlertChange { secret: None, vulnerability })) |
| 416 | } |
| 417 | |
| 418 | async fn rescan(&self, a: RescanArgs) -> Result<Outcome<ScanState>> { |
| 419 | let repo = match self.member_repo(&a.repo, &Some(a.actor.clone()), SEE_FINDINGS).await? { |
| 420 | Outcome::Ok(repo) => repo, |
| 421 | Outcome::Fail(failure) => return Ok(Outcome::Fail(failure)), |
| 422 | }; |
| 423 | self.store.restart_history(&repo.repo_id).await?; |
| 424 | self.scan_dependencies(&repo).await?; |
| 425 | if let Some(fresh) = self.store.repo(&repo.repo_id).await? { |
| 426 | self.advance_history(&fresh, 1).await?; |
| 427 | } |
| 428 | let state = self.store.repo(&repo.repo_id).await?.map(|row| row.scan_state()).unwrap_or_default(); |
| 429 | Ok(Outcome::Ok(state)) |
| 430 | } |
| 431 | |
| 432 | async fn set_upkeep(&self, a: SetUpkeepArgs) -> Result<Outcome<bool>> { |
| 433 | // Whether agents keep its dependencies up to date is one of its |
| 434 | // settings. |
| 435 | let repo = match self.member_repo(&a.repo, &Some(a.actor.clone()), Capability::ManageSettings).await? { |
| 436 | Outcome::Ok(repo) => repo, |
| 437 | Outcome::Fail(failure) => return Ok(Outcome::Fail(failure)), |
| 438 | }; |
| 439 | if !a.actor.verified { |
| 440 | return Ok(fail(FailureCode::Forbidden, "Confirm your email address first.")); |
| 441 | } |
| 442 | self.store.set_upkeep(&repo.repo_id, a.enabled, &a.actor.username).await?; |
| 443 | Ok(Outcome::Ok(a.enabled)) |
| 444 | } |
| 445 | |
| 446 | async fn workspace(&self, a: WorkspaceArgs) -> Result<Outcome<Vec<RepoSecurity>>> { |
| 447 | let workspace = a.workspace.to_lowercase(); |
| 448 | if !a.viewer.as_ref().is_some_and(|user| user.is_member(&workspace)) { |
| 449 | return Ok(fail(FailureCode::NotFound, "Workspace not found.")); |
| 450 | } |
| 451 | // Only the repositories whose findings the viewer may see. The |
| 452 | // Write role is never had through being public, so treating each |
| 453 | // as private changes nothing. |
| 454 | let repos: Vec<RepoRow> = self |
| 455 | .store |
| 456 | .in_namespace(&workspace) |
| 457 | .await? |
| 458 | .into_iter() |
| 459 | .filter(|repo| { |
| 460 | let target = access::RepoRef { id: &repo.repo_id, namespace: &workspace, private: true }; |
| 461 | access::can(a.viewer.as_ref(), target, SEE_FINDINGS) |
| 462 | }) |
| 463 | .collect(); |
| 464 | // Every repository's counts at once, not one after another. |
| 465 | let counts = futures_util::future::try_join_all(repos.iter().map(|repo| self.store.counts(&repo.repo_id))).await?; |
| 466 | let list = repos |
| 467 | .into_iter() |
| 468 | .zip(counts) |
| 469 | .map(|(repo, (counts, secrets, vulnerabilities))| RepoSecurity { |
| 470 | repo_id: repo.repo_id, |
| 471 | name: repo.name, |
| 472 | counts, |
| 473 | secrets, |
| 474 | vulnerabilities, |
| 475 | upkeep: repo.upkeep != 0, |
| 476 | dependencies_scanned_at: repo.deps_scanned_at, |
| 477 | }) |
| 478 | .collect(); |
| 479 | Ok(Outcome::Ok(list)) |
| 480 | } |
| 481 | |
| 482 | /// Push protection's question: which of these secrets were allowed? |
| 483 | /// The others are recorded as blocked, so someone can allow them. |
| 484 | async fn push_blocked(&self, a: PushBlockedArgs) -> Result<PushVerdict> { |
| 485 | let repo = self.store.register(&a.repo_id, &a.path.namespace, &a.path.name).await?; |
| 486 | if let Some(private) = a.private { |
| 487 | self.store.set_private(&a.repo_id, private).await?; |
| 488 | } |
| 489 | let fingerprints: Vec<String> = a.secrets.iter().map(|secret| secret.fingerprint.clone()).collect(); |
| 490 | let known = self.store.known(&a.repo_id, &fingerprints).await?; |
| 491 | let mut allowed = let_through(&known, &a.secrets); |
| 492 | // Bypassed with a reason: let through, whatever the alert says now. |
| 493 | allowed.extend(self.store.bypassed(&a.repo_id, &fingerprints).await?); |
| 494 | allowed.sort(); |
| 495 | allowed.dedup(); |
| 496 | let all = a.secrets.clone(); |
| 497 | let fresh: Vec<NewSecret> = a |
| 498 | .secrets |
| 499 | .into_iter() |
| 500 | .filter(|secret| !known.iter().any(|(fingerprint, _, _)| *fingerprint == secret.fingerprint)) |
| 501 | .collect(); |
| 502 | // A likely test value goes through, so it lands: open, not blocked. |
| 503 | let (tests, real): (Vec<NewSecret>, Vec<NewSecret>) = fresh.into_iter().partition(|secret| secret.test_value.is_some()); |
| 504 | self.store |
| 505 | .add_secrets(&a.repo_id, &real, SecretStatus::Blocked, "push", a.pusher.as_deref()) |
| 506 | .await?; |
| 507 | self.store |
| 508 | .add_secrets(&a.repo_id, &tests, SecretStatus::Open, "push", a.pusher.as_deref()) |
| 509 | .await?; |
| 510 | let fresh: Vec<String> = real.iter().map(|secret| secret.fingerprint.clone()).collect(); |
| 511 | self.secrets_found(&repo, &all, "push", &fresh, a.pusher.as_deref()).await?; |
| 512 | let ids = self |
| 513 | .store |
| 514 | .known(&a.repo_id, &fingerprints) |
| 515 | .await? |
| 516 | .into_iter() |
| 517 | .filter(|(fingerprint, _, _)| !allowed.contains(fingerprint)) |
| 518 | .map(|(fingerprint, id, _)| (fingerprint, id)) |
| 519 | .collect(); |
| 520 | Ok(PushVerdict { allowed, ids }) |
| 521 | } |
| 522 | |
| 523 | /// What happens on the bus that concerns this service. |
| 524 | async fn on_event(&self, event: &Event) -> Result<()> { |
| 525 | match event.kind.as_str() { |
| 526 | "git.push" => { |
| 527 | let Ok(pushed) = serde_json::from_value::<Pushed>(event.data.clone()) else { |
| 528 | return Ok(()); |
| 529 | }; |
| 530 | // Too large to scan before it was stored: its new commits |
| 531 | // are scanned now, on whichever branch. |
| 532 | if pushed.unscanned |
| 533 | && !pushed.after.is_empty() |
| 534 | && let Some(repo) = self.register_by_id(&pushed.repo_id).await? |
| 535 | { |
| 536 | let id = self |
| 537 | .store |
| 538 | .add_push_scan(&repo.repo_id, &pushed.git_ref, &pushed.after, pushed.before.as_deref(), event.actor.as_deref()) |
| 539 | .await?; |
| 540 | self.advance_push_scan(&id, history::PUSH_PAGES_AT_ONCE).await?; |
| 541 | } |
| 542 | // A version update's branch, or a grouped security update's, |
| 543 | // pushed by its sandbox: time for its pull request. |
| 544 | if !pushed.default_branch |
| 545 | && let Some(branch) = pushed.git_ref.strip_prefix("refs/heads/") |
| 546 | && self.update_pull_pushed(&pushed.repo_id, branch, &pushed.after).await? |
| 547 | { |
| 548 | return Ok(()); |
| 549 | } |
| 550 | // A security update's branch, pushed by its sandbox: time for |
| 551 | // its pull request. |
| 552 | if let Some(branch) = pushed.git_ref.strip_prefix("refs/heads/") |
| 553 | && branch.starts_with(UPDATE_BRANCH_PREFIX) |
| 554 | { |
| 555 | self.update_pushed(&pushed.repo_id, branch, &pushed.after).await?; |
| 556 | return Ok(()); |
| 557 | } |
| 558 | if !pushed.default_branch { |
| 559 | return Ok(()); |
| 560 | } |
| 561 | if let Some(repo) = self.register_by_id(&pushed.repo_id).await? { |
| 562 | self.scan_dependencies(&repo).await?; |
| 563 | if repo.history != "done" { |
| 564 | self.advance_history(&repo, 1).await?; |
| 565 | } |
| 566 | } |
| 567 | } |
| 568 | "pull.merged" | "pull.closed" => { |
| 569 | if let Ok(happened) = serde_json::from_value::<PullHappened>(event.data.clone()) { |
| 570 | if !self.update_pull_closed(&event.kind, &happened.repo_id, happened.number).await? { |
| 571 | self.update_pull_event(&event.kind, &happened.repo_id, happened.number, event.actor.as_deref()).await?; |
| 572 | } |
| 573 | // One of g1t's update pull requests closed or merged, by |
| 574 | // g1t or by a person: its branch goes. |
| 575 | self.pull_finished(&happened.repo_id, happened.number).await?; |
| 576 | } |
| 577 | } |
| 578 | "comment.created" => self.update_comment(event).await?, |
| 579 | // A pull request opened or its head moved: a dependency update |
| 580 | // file it changes is checked (not on `pull.ready`, which moves |
| 581 | // nothing), and dependency review runs. |
| 582 | "pull.opened" | "pull.updated" | "pull.ready" => { |
| 583 | if event.kind != "pull.ready" { |
| 584 | self.check_dependabot_file(event).await?; |
| 585 | } |
| 586 | if let Ok(happened) = serde_json::from_value::<PullHappened>(event.data.clone()) { |
| 587 | self.review_pull(&happened.repo_id, happened.number).await?; |
| 588 | } |
| 589 | } |
| 590 | "repo.created" => { |
| 591 | if let Ok(created) = serde_json::from_value::<Created>(event.data.clone()) { |
| 592 | // Recorded with its visibility, so the overview never takes a |
| 593 | // public repository for a private one. |
| 594 | if self.register_by_id(&created.repo_id).await?.is_some() |
| 595 | && let Some(private) = created.is_private |
| 596 | { |
| 597 | self.store.set_private(&created.repo_id, private).await?; |
| 598 | } |
| 599 | } |
| 600 | } |
| 601 | "repo.visibility_changed" => { |
| 602 | if let Ok(changed) = serde_json::from_value::<g1t_contracts::events::RepoVisibilityChanged>(event.data.clone()) |
| 603 | && self.store.repo(&changed.repo_id).await?.is_some() |
| 604 | { |
| 605 | self.store.set_private(&changed.repo_id, changed.is_private).await?; |
| 606 | } |
| 607 | } |
| 608 | // A repository transferred or renamed: it is recorded under its new path. |
| 609 | "repo.transferred" | "repo.renamed" => { |
| 610 | if let Some(moved) = g1t_kit::transfer::read(event) { |
| 611 | // Where it is now, so moves heard out of order end in |
| 612 | // the same place. |
| 613 | let now: Option<g1t_contracts::repos::RepoPath> = g1t_kit::call( |
| 614 | &self.repos, |
| 615 | "path_by_id", |
| 616 | &g1t_contracts::repos::PathByIdArgs { id: moved.repo_id.clone() }, |
| 617 | ) |
| 618 | .await?; |
| 619 | let current = now.map_or_else( |
| 620 | || moved.destination().to_owned(), |
| 621 | |path| format!("{}/{}", path.namespace, path.name), |
| 622 | ); |
| 623 | if let Some((namespace, name)) = current.split_once('/') { |
| 624 | self.store.moved(&moved.repo_id, namespace, name).await?; |
| 625 | } |
| 626 | } |
| 627 | } |
| 628 | // A repository purged: everything found in it goes. |
| 629 | "repo.purged" => { |
| 630 | if let Some(g1t_kit::lifecycle::Lifecycle::Purged(purged)) = g1t_kit::lifecycle::read(event) { |
| 631 | self.store.purge_advisories(&purged.repo_id).await?; |
| 632 | self.store.purge_suite(&purged.repo_id).await?; |
| 633 | self.store.purge(&purged.repo_id).await?; |
| 634 | } |
| 635 | } |
| 636 | "workspace.renamed" => { |
| 637 | if let Ok(renamed) = serde_json::from_value::<WorkspaceRenamed>(event.data.clone()) { |
| 638 | self.store.rename_namespace(&renamed.stale_slugs(&renamed.to), &renamed.to).await?; |
| 639 | } |
| 640 | } |
| 641 | _ => {} |
| 642 | } |
| 643 | Ok(()) |
| 644 | } |
| 645 | |
| 646 | /// The sweep: continues history scans and scans of pushes that landed |
| 647 | /// unscanned, catches security updates whose sandbox never pushed, and |
| 648 | /// reads dependencies that have not been read for a day. |
| 649 | async fn sweep(&self) -> Result<()> { |
| 650 | for scan in self.store.pending_push_scans(HISTORIES_PER_SWEEP).await? { |
| 651 | if let Err(error) = self.advance_push_scan(&scan.id, PAGES_PER_SWEEP).await { |
| 652 | worker::console_error!("security: push scan {} not continued: {error}", scan.id); |
| 653 | } |
| 654 | } |
| 655 | if let Err(error) = self.stalled_updates().await { |
| 656 | worker::console_error!("security: stalled security updates not handled: {error}"); |
| 657 | } |
| 658 | if let Err(error) = self.sweep_suite().await { |
| 659 | worker::console_error!("security: daily snapshots and validity checks: {error}"); |
| 660 | } |
| 661 | // Archived and deleted repositories wait; a few more are looked at |
| 662 | // so that they do not hold up the rest. |
| 663 | let mut histories = 0; |
| 664 | for repo in self.store.unfinished_histories(HISTORIES_PER_SWEEP * 4).await? { |
| 665 | if histories == HISTORIES_PER_SWEEP { |
| 666 | break; |
| 667 | } |
| 668 | if !self.active(&repo.repo_id).await? { |
| 669 | continue; |
| 670 | } |
| 671 | histories += 1; |
| 672 | if let Err(error) = self.advance_history(&repo, PAGES_PER_SWEEP).await { |
| 673 | worker::console_error!("security: history of {} not scanned: {error}", repo.repo_id); |
| 674 | } |
| 675 | } |
| 676 | let day_ago = rfc3339(now_ms().saturating_sub(DAY_MS)); |
| 677 | for repo in self.store.stale_dependencies(&day_ago, DEPENDENCIES_PER_SWEEP).await? { |
| 678 | if !self.active(&repo.repo_id).await? { |
| 679 | self.store |
| 680 | .skip_dependencies(&repo.repo_id, "Dependencies are not checked while the repository is archived or deleted.") |
| 681 | .await?; |
| 682 | continue; |
| 683 | } |
| 684 | if let Err(error) = self.scan_dependencies(&repo).await { |
| 685 | worker::console_error!("security: dependencies of {} not read: {error}", repo.repo_id); |
| 686 | } |
| 687 | } |
| 688 | Ok(()) |
| 689 | } |
| 690 | } |
| 691 | |
| 692 | /// The fingerprints a push may carry: those someone dismissed (allowed), |
| 693 | /// and likely test values, which are recorded but never stop a push. |
| 694 | /// `known` is (fingerprint, id, status) of findings already recorded. |
| 695 | fn let_through(known: &[(String, String, String)], secrets: &[NewSecret]) -> Vec<String> { |
| 696 | let mut allowed: Vec<String> = known |
| 697 | .iter() |
| 698 | .filter(|(_, _, status)| status == "allowed") |
| 699 | .map(|(fingerprint, _, _)| fingerprint.clone()) |
| 700 | .chain(secrets.iter().filter(|secret| secret.test_value.is_some()).map(|secret| secret.fingerprint.clone())) |
| 701 | .collect(); |
| 702 | allowed.sort(); |
| 703 | allowed.dedup(); |
| 704 | allowed |
| 705 | } |
| 706 | |
| 707 | #[event(fetch)] |
| 708 | async fn fetch(mut request: Request, env: Env, _ctx: Context) -> Result<Response> { |
| 709 | let Some(method) = rpc_method(&request) else { |
| 710 | return Response::error("Not found", 404); |
| 711 | }; |
| 712 | let security = Security::new(&env)?; |
| 713 | let body: serde_json::Value = request.json().await?; |
| 714 | match method.as_str() { |
| 715 | "overview" => reply(&security.overview(args(body)?).await?), |
| 716 | "dismiss" => reply(&security.dismiss(args(body)?).await?), |
| 717 | "reopen" => reply(&security.reopen(args(body)?).await?), |
| 718 | "rescan" => reply(&security.rescan(args(body)?).await?), |
| 719 | "set_upkeep" => reply(&security.set_upkeep(args(body)?).await?), |
| 720 | "workspace" => reply(&security.workspace(args(body)?).await?), |
| 721 | "push_blocked" => reply(&security.push_blocked(args(body)?).await?), |
| 722 | "check_updates" => reply(&security.check_updates(args(body)?).await?), |
| 723 | // The security suite. |
| 724 | "patterns_for" => reply(&security.patterns_for(args(body)?).await?), |
| 725 | "custom_patterns" => reply(&security.custom_patterns(args(body)?).await?), |
| 726 | "save_custom_pattern" => reply(&security.save_custom_pattern(args(body)?).await?), |
| 727 | "delete_custom_pattern" => reply(&security.delete_custom_pattern(args(body)?).await?), |
| 728 | "dry_run_pattern" => reply(&security.dry_run_pattern(args(body)?).await?), |
| 729 | "secret_alert" => reply(&security.secret_alert(args(body)?).await?), |
| 730 | "bypass" => reply(&security.bypass(args(body)?).await?), |
| 731 | "bypass_requests" => reply(&security.bypass_requests(args(body)?).await?), |
| 732 | "review_bypass" => reply(&security.review_bypass(args(body)?).await?), |
| 733 | "check_validity" => reply(&security.check_validity(args(body)?).await?), |
| 734 | "upload_sarif" => reply(&security.upload_sarif(args(body)?).await?), |
| 735 | "sarif_status" => reply(&security.sarif_status(args(body)?).await?), |
| 736 | "code_scanning" => reply(&security.code_scanning(args(body)?).await?), |
| 737 | "code_alert" => reply(&security.code_alert(args(body)?).await?), |
| 738 | "set_code_alert_state" => reply(&security.set_code_alert_state(args(body)?).await?), |
| 739 | "pull_code_scanning" => reply(&security.pull_code_scanning(args(body)?).await?), |
| 740 | "dependency_graph" => reply(&security.dependency_graph(args(body)?).await?), |
| 741 | "sbom" => reply(&security.sbom(args(body)?).await?), |
| 742 | "dependency_review" => reply(&security.dependency_review(args(body)?).await?), |
| 743 | "security_settings" => reply(&security.security_settings(args(body)?).await?), |
| 744 | "set_security_settings" => reply(&security.set_security_settings(args(body)?).await?), |
| 745 | "workspace_security_settings" => reply(&security.workspace_security_settings(args(body)?).await?), |
| 746 | "set_workspace_security_settings" => reply(&security.set_workspace_security_settings(args(body)?).await?), |
| 747 | "security_overview" => reply(&security.security_overview(args(body)?).await?), |
| 748 | "workspace_alerts" => reply(&security.workspace_alerts(args(body)?).await?), |
| 749 | // Reporting: advisories and private vulnerability reports (advisories.rs). |
| 750 | "list_advisories" => reply(&security.list_advisories(args(body)?).await?), |
| 751 | "get_advisory" => reply(&security.get_advisory(args(body)?).await?), |
| 752 | "create_advisory" => reply(&security.create_advisory(args(body)?).await?), |
| 753 | "update_advisory" => reply(&security.update_advisory(args(body)?).await?), |
| 754 | "set_advisory_state" => reply(&security.set_advisory_state(args(body)?).await?), |
| 755 | "report_vulnerability" => reply(&security.report_vulnerability(args(body)?).await?), |
| 756 | "report_settings" => reply(&security.report_settings(args(body)?).await?), |
| 757 | "list_vulnerability_reports" => reply(&security.list_vulnerability_reports(args(body)?).await?), |
| 758 | "review_vulnerability_report" => reply(&security.review_vulnerability_report(args(body)?).await?), |
| 759 | _ => Response::error("Unknown method", 404), |
| 760 | } |
| 761 | } |
| 762 | |
| 763 | #[event(queue)] |
| 764 | async fn queue(batch: MessageBatch<Event>, env: Env, _ctx: Context) -> Result<()> { |
| 765 | let security = Security::new(&env)?; |
| 766 | for message in batch.messages()? { |
| 767 | let event = message.body(); |
| 768 | if let Err(error) = security.on_event(event).await { |
| 769 | // Scans are idempotent and the sweep catches up, so one failed |
| 770 | // event is logged rather than retried. |
| 771 | worker::console_error!("security: {} {} failed: {error}", event.kind, event.id); |
| 772 | } |
| 773 | } |
| 774 | Ok(()) |
| 775 | } |
| 776 | |
| 777 | /// The cron (wrangler.jsonc) that runs version updates that are due. |
| 778 | const VERSION_UPDATES_CRON: &str = "*/5 * * * *"; |
| 779 | |
| 780 | #[event(scheduled)] |
| 781 | async fn scheduled(event: ScheduledEvent, env: Env, _ctx: ScheduleContext) { |
| 782 | match Security::new(&env) { |
| 783 | // Version updates run every few minutes, so a schedule's time is kept. |
| 784 | Ok(security) if event.cron() == VERSION_UPDATES_CRON => { |
| 785 | if let Err(error) = security.version_update_sweep().await { |
| 786 | worker::console_error!("security: the version update sweep failed: {error}"); |
| 787 | } |
| 788 | } |
| 789 | Ok(security) => { |
| 790 | if let Err(error) = security.sweep().await { |
| 791 | worker::console_error!("security: the sweep failed: {error}"); |
| 792 | } |
| 793 | } |
| 794 | Err(error) => worker::console_error!("security: could not start: {error}"), |
| 795 | } |
| 796 | } |
| 797 | |
| 798 | #[cfg(test)] |
| 799 | mod tests { |
| 800 | use super::*; |
| 801 | |
| 802 | fn secret(fingerprint: &str, test_value: Option<&str>) -> NewSecret { |
| 803 | NewSecret { |
| 804 | fingerprint: fingerprint.into(), |
| 805 | kind: "aws_access_key".into(), |
| 806 | path: "a.env".into(), |
| 807 | line: 1, |
| 808 | commit: "c".into(), |
| 809 | preview: "AKIA…".into(), |
| 810 | test_value: test_value.map(str::to_owned), |
| 811 | pattern_id: None, |
| 812 | pattern_name: None, |
| 813 | } |
| 814 | } |
| 815 | |
| 816 | #[test] |
| 817 | fn dismissed_secrets_and_test_values_go_through() { |
| 818 | let known = vec![ |
| 819 | ("allowed".to_owned(), "sec_1".to_owned(), "allowed".to_owned()), |
| 820 | ("resolved".to_owned(), "sec_2".to_owned(), "resolved".to_owned()), |
| 821 | ("blocked".to_owned(), "sec_3".to_owned(), "blocked".to_owned()), |
| 822 | ]; |
| 823 | let secrets = [secret("allowed", None), secret("resolved", None), secret("example", Some("it says it is an example")), secret("real", None)]; |
| 824 | assert_eq!(let_through(&known, &secrets), ["allowed", "example"]); |
| 825 | } |
| 826 | |
| 827 | #[test] |
| 828 | fn a_push_says_when_it_landed_unscanned() { |
| 829 | let pushed: Pushed = serde_json::from_value(serde_json::json!({ |
| 830 | "repoId": "rep_1", "ref": "refs/heads/import", "after": "abc", "defaultBranch": false, "unscanned": true |
| 831 | })) |
| 832 | .unwrap(); |
| 833 | assert!(pushed.unscanned && pushed.before.is_none() && pushed.git_ref == "refs/heads/import"); |
| 834 | let ordinary: Pushed = serde_json::from_value(serde_json::json!({ "repoId": "rep_1", "ref": "refs/heads/main", "after": "abc", "defaultBranch": true })).unwrap(); |
| 835 | assert!(!ordinary.unscanned); |
| 836 | } |
| 837 | |
| 838 | #[test] |
| 839 | fn owners_are_told_what_landed_and_what_to_do() { |
| 840 | let one = history::landed_secrets_intro("acme", "rocket", "import", 1); |
| 841 | assert!(one.contains("A push to import in acme/rocket") && one.contains("a secret that looks real") && one.contains("Rotate")); |
| 842 | assert!(history::landed_secrets_intro("acme", "rocket", "main", 3).contains("3 secrets that look real")); |
| 843 | } |
| 844 | |
| 845 | #[test] |
| 846 | fn dismissing_a_secret_takes_admin_and_a_dependency_write() { |
| 847 | assert_eq!(Security::capability_for("sec_1"), Capability::SecurityAlerts); |
| 848 | assert_eq!(Security::capability_for("vul_1"), Capability::SecurityAlerts); |
| 849 | } |
| 850 | } |