Skip to content

Commit ab424da

Browse files
committed
use Defang secret-detector to identify potential secret leaks before publishing OCI artifacts
Signed-off-by: Guillaume Lours <[email protected]>
1 parent 8615e9a commit ab424da

File tree

7 files changed

+176
-12
lines changed

7 files changed

+176
-12
lines changed

go.mod

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ go 1.23.6
44

55
require (
66
github.com/AlecAivazis/survey/v2 v2.3.7
7+
github.com/DefangLabs/secret-detector v0.0.0-20250108223530-c2b44d4c1f8f
78
github.com/Microsoft/go-winio v0.6.2
89
github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
910
github.com/buger/goterm v1.0.4
@@ -116,6 +117,7 @@ require (
116117
github.com/goccy/go-yaml v1.13.3 // indirect
117118
github.com/gofrs/flock v0.12.1 // indirect
118119
github.com/gogo/protobuf v1.3.2 // indirect
120+
github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
119121
github.com/golang/protobuf v1.5.4 // indirect
120122
github.com/google/gnostic-models v0.6.8 // indirect
121123
github.com/google/gofuzz v1.2.0 // indirect
@@ -129,6 +131,7 @@ require (
129131
github.com/imdario/mergo v0.3.16 // indirect
130132
github.com/in-toto/in-toto-golang v0.5.0 // indirect
131133
github.com/inconshreveable/mousetrap v1.1.0 // indirect
134+
github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf // indirect
132135
github.com/jinzhu/copier v0.4.0 // indirect
133136
github.com/josharian/intern v1.0.0 // indirect
134137
github.com/json-iterator/go v1.1.12 // indirect
@@ -202,6 +205,7 @@ require (
202205
google.golang.org/protobuf v1.36.4 // indirect
203206
gopkg.in/cenkalti/backoff.v1 v1.1.0 // indirect
204207
gopkg.in/inf.v0 v0.9.1 // indirect
208+
gopkg.in/ini.v1 v1.66.2 // indirect
205209
gopkg.in/yaml.v2 v2.4.0 // indirect
206210
k8s.io/api v0.31.2 // indirect
207211
k8s.io/apimachinery v0.31.2 // indirect

go.sum

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEK
1010
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
1111
github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ=
1212
github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
13+
github.com/DefangLabs/secret-detector v0.0.0-20250108223530-c2b44d4c1f8f h1:RTbUqLhPxejgK92ifVdMTIW9H23QLlscy8QXPDTfaL4=
14+
github.com/DefangLabs/secret-detector v0.0.0-20250108223530-c2b44d4c1f8f/go.mod h1:2UjtD/G/Sy2FxoHpxKnzHTXMpRURecwYal8HgbxcvkY=
1315
github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
1416
github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
1517
github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
@@ -221,6 +223,8 @@ github.com/gogo/protobuf v1.0.0/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7a
221223
github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
222224
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
223225
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
226+
github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY=
227+
github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
224228
github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
225229
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
226230
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -277,6 +281,8 @@ github.com/in-toto/in-toto-golang v0.5.0/go.mod h1:/Rq0IZHLV7Ku5gielPT4wPHJfH1Gd
277281
github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
278282
github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
279283
github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
284+
github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf h1:FtEj8sfIcaaBfAKrE1Cwb61YDtYq9JxChK1c7AKce7s=
285+
github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf/go.mod h1:yrqSXGoD/4EKfF26AOGzscPOgTTJcyAwM2rpixWT+t4=
280286
github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8=
281287
github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
282288
github.com/jinzhu/gorm v0.0.0-20170222002820-5409931a1bb8 h1:CZkYfurY6KGhVtlalI4QwQ6T0Cu6iuY3e0x5RLu96WE=
@@ -682,6 +688,8 @@ gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMy
682688
gopkg.in/gemnasium/logrus-airbrake-hook.v2 v2.1.2/go.mod h1:Xk6kEKp8OKb+X14hQBKWaSkCsqBpgog8nAV2xsGOxlo=
683689
gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
684690
gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
691+
gopkg.in/ini.v1 v1.66.2 h1:XfR1dOYubytKy4Shzc2LHrrGhU0lDCfDGG1yLPmpgsI=
692+
gopkg.in/ini.v1 v1.66.2/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
685693
gopkg.in/op/go-logging.v1 v1.0.0-20160211212156-b2cb9fa56473 h1:6D+BvnJ/j6e222UW8s2qTSe3wGBtvo0MbVQG/c5k8RE=
686694
gopkg.in/op/go-logging.v1 v1.0.0-20160211212156-b2cb9fa56473/go.mod h1:N1eN2tsCx0Ydtgjl4cqmbRCsY4/+z4cYDeqwZTk6zog=
687695
gopkg.in/rethinkdb/rethinkdb-go.v6 v6.2.1 h1:d4KQkxAaAiRY2h5Zqis161Pv91A37uZyJOx73duwUwM=

pkg/compose/publish.go

Lines changed: 137 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,17 @@
1717
package compose
1818

1919
import (
20+
"bytes"
2021
"context"
2122
"crypto/sha256"
2223
"errors"
2324
"fmt"
25+
"io"
2426
"os"
2527

28+
"github.com/DefangLabs/secret-detector/pkg/scanner"
29+
"github.com/DefangLabs/secret-detector/pkg/secrets"
30+
2631
"github.com/compose-spec/compose-go/v2/loader"
2732
"github.com/compose-spec/compose-go/v2/types"
2833
"github.com/distribution/reference"
@@ -259,15 +264,37 @@ func (s *composeService) generateImageDigestsOverride(ctx context.Context, proje
259264
return override.MarshalYAML()
260265
}
261266

267+
//nolint:gocyclo
262268
func (s *composeService) preChecks(project *types.Project, options api.PublishOptions) (bool, error) {
263-
if ok, err := s.checkOnlyBuildSection(project); !ok {
269+
if ok, err := s.checkOnlyBuildSection(project); !ok || err != nil {
270+
return false, err
271+
}
272+
if ok, err := s.checkForBindMount(project); !ok || err != nil {
264273
return false, err
265274
}
275+
if options.AssumeYes {
276+
return true, nil
277+
}
278+
detectedSecrets, err := s.checkForSensitiveData(project)
279+
if err != nil {
280+
return false, err
281+
}
282+
if len(detectedSecrets) > 0 {
283+
fmt.Println("you are about to publish sensitive data within your OCI artifact.\n" +
284+
"please double check that you are not leaking sensitive data")
285+
for _, val := range detectedSecrets {
286+
_, _ = fmt.Fprintln(s.dockerCli.Out(), val.Type)
287+
_, _ = fmt.Fprintf(s.dockerCli.Out(), "%q: %s\n", val.Key, val.Value)
288+
}
289+
if ok, err := acceptPublishSensitiveData(s.dockerCli); err != nil || !ok {
290+
return false, err
291+
}
292+
}
266293
envVariables, err := s.checkEnvironmentVariables(project, options)
267294
if err != nil {
268295
return false, err
269296
}
270-
if !options.AssumeYes && len(envVariables) > 0 {
297+
if len(envVariables) > 0 {
271298
fmt.Println("you are about to publish environment variables within your OCI artifact.\n" +
272299
"please double check that you are not leaking sensitive data")
273300
for key, val := range envVariables {
@@ -276,17 +303,10 @@ func (s *composeService) preChecks(project *types.Project, options api.PublishOp
276303
_, _ = fmt.Fprintf(s.dockerCli.Out(), "%s=%v\n", k, *v)
277304
}
278305
}
279-
return acceptPublishEnvVariables(s.dockerCli)
280-
}
281-
282-
for name, config := range project.Services {
283-
for _, volume := range config.Volumes {
284-
if volume.Type == types.VolumeTypeBind {
285-
return false, fmt.Errorf("cannot publish compose file: service %q relies on bind-mount. You should use volumes", name)
286-
}
306+
if ok, err := acceptPublishEnvVariables(s.dockerCli); err != nil || !ok {
307+
return false, err
287308
}
288309
}
289-
290310
return true, nil
291311
}
292312

@@ -332,6 +352,12 @@ func acceptPublishEnvVariables(cli command.Cli) (bool, error) {
332352
return confirm, err
333353
}
334354

355+
func acceptPublishSensitiveData(cli command.Cli) (bool, error) {
356+
msg := "Are you ok to publish these sensitive data? [y/N]: "
357+
confirm, err := prompt.NewPrompt(cli.In(), cli.Out()).Confirm(msg, false)
358+
return confirm, err
359+
}
360+
335361
func envFileLayers(project *types.Project) []ocipush.Pushable {
336362
var layers []ocipush.Pushable
337363
for _, service := range project.Services {
@@ -367,3 +393,103 @@ func (s *composeService) checkOnlyBuildSection(project *types.Project) (bool, er
367393
}
368394
return true, nil
369395
}
396+
397+
func (s *composeService) checkForBindMount(project *types.Project) (bool, error) {
398+
for name, config := range project.Services {
399+
for _, volume := range config.Volumes {
400+
if volume.Type == types.VolumeTypeBind {
401+
return false, fmt.Errorf("cannot publish compose file: service %q relies on bind-mount. You should use volumes", name)
402+
}
403+
}
404+
}
405+
return true, nil
406+
}
407+
408+
func (s *composeService) checkForSensitiveData(project *types.Project) ([]secrets.DetectedSecret, error) {
409+
var allFindings []secrets.DetectedSecret
410+
scan := scanner.NewDefaultScanner()
411+
412+
projecYaml, _ := project.MarshalYAML()
413+
_, _ = scan.ScanReader(bytes.NewReader(projecYaml))
414+
415+
// Check all compose files
416+
for _, file := range project.ComposeFiles {
417+
in, err := composeFileAsByteReader(file, project)
418+
if err != nil {
419+
return nil, err
420+
}
421+
422+
findings, err := scan.ScanReader(in)
423+
if err != nil {
424+
return nil, fmt.Errorf("failed to scan compose file %s: %w", file, err)
425+
}
426+
allFindings = append(allFindings, findings...)
427+
}
428+
for _, service := range project.Services {
429+
// Check env files
430+
for _, envFile := range service.EnvFiles {
431+
findings, err := scan.ScanFile(envFile.Path)
432+
if err != nil {
433+
return nil, fmt.Errorf("failed to scan env file %s: %w", envFile.Path, err)
434+
}
435+
allFindings = append(allFindings, findings...)
436+
}
437+
}
438+
439+
// Check configs defined by files
440+
for _, config := range project.Configs {
441+
if config.File != "" {
442+
findings, err := scan.ScanFile(config.File)
443+
if err != nil {
444+
return nil, fmt.Errorf("failed to scan config file %s: %w", config.File, err)
445+
}
446+
allFindings = append(allFindings, findings...)
447+
}
448+
}
449+
450+
// Check secrets defined by files
451+
for _, secret := range project.Secrets {
452+
if secret.File != "" {
453+
findings, err := scan.ScanFile(secret.File)
454+
if err != nil {
455+
return nil, fmt.Errorf("failed to scan secret file %s: %w", secret.File, err)
456+
}
457+
allFindings = append(allFindings, findings...)
458+
}
459+
}
460+
461+
return allFindings, nil
462+
}
463+
464+
func composeFileAsByteReader(filePath string, project *types.Project) (io.Reader, error) {
465+
composeFile, err := os.ReadFile(filePath)
466+
if err != nil {
467+
return nil, fmt.Errorf("failed to open compose file %s: %w", filePath, err)
468+
}
469+
base, err := loader.LoadWithContext(context.TODO(), types.ConfigDetails{
470+
WorkingDir: project.WorkingDir,
471+
Environment: project.Environment,
472+
ConfigFiles: []types.ConfigFile{
473+
{
474+
Filename: filePath,
475+
Content: composeFile,
476+
},
477+
},
478+
}, func(options *loader.Options) {
479+
options.SkipValidation = true
480+
options.SkipExtends = true
481+
options.SkipConsistencyCheck = true
482+
options.ResolvePaths = true
483+
options.SkipInterpolation = true
484+
options.SkipResolveEnvironment = true
485+
})
486+
if err != nil {
487+
return nil, err
488+
}
489+
490+
in, err := base.MarshalYAML()
491+
if err != nil {
492+
return nil, err
493+
}
494+
return bytes.NewBuffer(in), nil
495+
}
Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
services:
2+
serviceA:
3+
image: "alpine:3.12"
4+
environment:
5+
- AWS_ACCESS_KEY_ID=A3TX1234567890ABCDEF
6+
- AWS_SECRET_ACCESS_KEY=aws"12345+67890/abcdefghijklm+NOPQRSTUVWXYZ+"
7+
serviceB:
8+
image: "alpine:3.12"
9+
env_file:
10+
- publish-sensitive.env
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
GITHUB_TOKEN=ghp_1234567890abcdefghijklmnopqrstuvwxyz
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
FOO=bar
2-
QUIX=
2+
QUIX=

pkg/e2e/publish_test.go

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,4 +134,19 @@ FOO=bar`), res.Combined())
134134
"-p", projectName, "alpha", "publish", "test/test", "--dry-run")
135135
res.Assert(t, icmd.Expected{ExitCode: 1, Err: "cannot publish compose file with local includes"})
136136
})
137+
138+
t.Run("detect sensitive data", func(t *testing.T) {
139+
cmd := c.NewDockerComposeCmd(t, "-f", "./fixtures/publish/compose-sensitive.yml",
140+
"-p", projectName, "alpha", "publish", "test/test", "--with-env", "--dry-run")
141+
cmd.Stdin = strings.NewReader("n\n")
142+
res := icmd.RunCmd(cmd)
143+
res.Assert(t, icmd.Expected{ExitCode: 0})
144+
145+
output := res.Combined()
146+
assert.Assert(t, strings.Contains(output, "you are about to publish sensitive data within your OCI artifact.\n"), output)
147+
assert.Assert(t, strings.Contains(output, "please double check that you are not leaking sensitive data"), output)
148+
assert.Assert(t, strings.Contains(output, "AWS Client ID\n\"services.serviceA.environment.AWS_ACCESS_KEY_ID\": A3TX1234567890ABCDEF"), output)
149+
assert.Assert(t, strings.Contains(output, "AWS Secret Key\n\"services.serviceA.environment.AWS_SECRET_ACCESS_KEY\": aws\"12345+67890/abcdefghijklm+NOPQRSTUVWXYZ+\""), output)
150+
assert.Assert(t, strings.Contains(output, "Github authentication\n\"GITHUB_TOKEN\": ghp_1234567890abcdefghijklmnopqrstuvwxyz"), output)
151+
})
137152
}

0 commit comments

Comments
 (0)