Fix Trufflehog SARIF Results Bugs#9
Merged
Conversation
Add optionally custom trufflehog config
add optionable flag to TH
remove ScannerType model
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A bug was found when running the trufflehog inside GSAST without parameter
--only-verified. After further investigation, several more bugs were found, namely:Rule ID mapper key mismatch - The
detectors_count_mapperinconvert_trufflehog_to_sarif()was stored usingdetector_nameas key but looked up usingrule_id_hash.hexdigest(). Sincedefaultdict(int)returns0for any unseen key, almost all findings ended up with the same rule ID "trufflehog - git 1", causing different detector types to collide and get mixed together.Duplicate rules created for every finding - A new rule was appended to
driver_rulesfor every single finding, instead of once per unique detector type. With--only-verifiedoff this meant thousands of duplicate rule entries in the SARIF output.Results storage overwrite - In
store_scan_results(), the loop over split SARIF files always used the same keystored_results[scanner_type], so each iteration overwrote the previous one. Only the last split file was kept, the rest were silently lost.Empty line handling in
has_findings_trufflehog()- The function didn't strip empty lines before callingjson.loads(), so a trailing newline in the TruffleHog output caused aJSONDecodeErrorand the function returned False even when findings existed.All these bugs should be handled by the suggested changes. I tested ONLY the json -> SARIF "pipeline" of GSAST, did not try it as a whole.