-
Notifications
You must be signed in to change notification settings - Fork 20
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: trufflehog external tool (#489)
* feat: trufflehog external tool * adding secret_scanner config module
- Loading branch information
Showing
19 changed files
with
381 additions
and
32 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| parameter var collect_secret_scanner { | ||
| default: true | ||
| shortdoc: "Collect secret scanner via trufflehog" | ||
| doc: "Whether secret scanner results should be collected for chalking operations via trufflehog" | ||
| } | ||
|
|
||
| ~run_secret_scanner_tools = collect_secret_scanner |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,173 @@ | ||
| ## | ||
| ## Copyright (c) 2025, Crash Override, Inc. | ||
| ## | ||
| ## This file is part of Chalk | ||
| ## (see https://crashoverride.com/docs/chalk) | ||
| ## | ||
|
|
||
| ## Builtin Secret Scanning tool implementation(s). | ||
|
|
||
| tool trufflehog { | ||
| kind: "secret_scanner" | ||
| get_tool_location: func find_trufflehog(string) -> string | ||
| attempt_install: func install_trufflehog(string) -> bool | ||
| get_command_args: func get_trufflehog_args(string) -> string | ||
| produce_keys: (func load_trufflehog_results(string, int) -> | ||
| dict[string, `x]) | ||
| trufflehog_config: "" | ||
| trufflehog_format_flags: "--json --no-github-actions" | ||
| trufflehog_other_flags: "" | ||
| trufflehog_exe_dir: "/tmp" | ||
| trufflehog_container: "trufflesecurity/trufflehog" | ||
| trufflehog_entrypoint: "trufflehog" | ||
| trufflehog_prefer_docker: false | ||
| trufflehog_installer: "https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh" | ||
| doc: """ | ||
| This runs the trufflehog secret scanner. If it doesn't exist in the | ||
| path, chalk will: | ||
|
|
||
| 1. use docker (if present) to run trufflehog | ||
| 2. otherwise, attempt to install it via trufflehog install script | ||
|
|
||
| You can configure the following fields in the tool.trufflehog object: | ||
|
|
||
| trufflehog_prefer_docker: When true, docker is preferred over system-installed trufflehog. | ||
| Defaults to `false`. | ||
| trufflehog_container: The name of the docker container to use to run trufflehog. | ||
| Defaults to 'trufflesecurity/trufflehog' from Docker Hub. | ||
| trufflehog_entrypoint: The entrypoint to use to run trufflehog. | ||
| Defaults to 'trufflehog'. | ||
| trufflehog_exe_dir: In addition to $PATH, where to search/install trufflehog. | ||
| Defaults to "/tmp". | ||
| trufflehog_config: The trufflehog config to use. | ||
| By default no config is provided. | ||
| trufflehog_format: The output format flag to pass. | ||
| Defaults to 'sarif'. | ||
| """ | ||
| } | ||
|
|
||
| func trufflehog_docker(path) { | ||
| result := "" | ||
| if tool.trufflehog.trufflehog_entrypoint == "" or tool.trufflehog.trufflehog_container == "" { | ||
| trace("find_trufflehog: docker is disabled - both container and entrypoint must be defined") | ||
| return | ||
| } | ||
| docker_path := docker_exe() | ||
| if docker_path == "" { | ||
| trace("find_trufflehog: docker is missing; unable to use docker for trufflehog") | ||
| return | ||
| } | ||
| dir := path | ||
| if not is_dir(path) { | ||
| dir, _ := path_split(path) | ||
| } | ||
| cwd_volume := "" | ||
| if dir != cwd() { | ||
| cwd_volume := "-v " + cwd() + ":" + cwd() + " " | ||
| } | ||
| # Allow using a config from outside of cwd, such as in ~ | ||
| config_volume := "" | ||
| config := resolve_path(tool.trufflehog.trufflehog_config) | ||
| if config != "" and is_file(config) { | ||
| config_volume := "-v " + config + ":" + config + " " | ||
| } | ||
| return ( | ||
| docker_path + " run " + | ||
| "--rm " + | ||
| "--entrypoint=" + tool.trufflehog.trufflehog_entrypoint + " " + | ||
| "-w " + dir + " " + | ||
| "-v " + dir + ":" + dir + " " + | ||
| cwd_volume + | ||
| config_volume + | ||
| tool.trufflehog.trufflehog_container | ||
| ) | ||
| } | ||
|
|
||
| func trufflehog_system() { | ||
| result := find_exe("trufflehog", [tool.trufflehog.trufflehog_exe_dir]) | ||
| if result == "" { | ||
| trace("find_trufflehog: Unable to find trufflehog in $PATH") | ||
| } else { | ||
| trace("find_trufflehog: found trufflehog in $PATH: " + result) | ||
| } | ||
| } | ||
|
|
||
| func find_trufflehog(path) { | ||
| if tool.trufflehog.trufflehog_prefer_docker { | ||
| result := trufflehog_docker(path) | ||
| if result != "" { | ||
| return | ||
| } | ||
| } | ||
| result := trufflehog_system() | ||
| if result != "" { | ||
| return result | ||
| } | ||
| result := trufflehog_docker(path) | ||
| } | ||
|
|
||
| func install_trufflehog(path) { | ||
| info("Attempting to install trufflehog from " + tool.trufflehog.trufflehog_installer) | ||
|
|
||
| contents := url_get(tool.trufflehog.trufflehog_installer) | ||
| if not starts_with(contents, "#!") { | ||
| error("Trufflehog installer is not a valid shell script due to lack of shebang") | ||
| return false | ||
| } | ||
|
|
||
| installer := to_tmp_file(contents, ".sh") | ||
| cmdline := "sh " + installer + " -b " + tool.trufflehog.trufflehog_exe_dir | ||
|
|
||
| trace("Running: " + cmdline) | ||
| sout, code := system(cmdline) | ||
|
|
||
| info(sout) | ||
| if code == 0 { | ||
| trace("Successfully installed trufflehog into: " + tool.trufflehog.trufflehog_exe_dir) | ||
| return true | ||
| } | ||
| else { | ||
| error("Unable to install trufflehog into: " + tool.trufflehog.trufflehog_exe_dir) | ||
| return false | ||
| } | ||
| } | ||
|
|
||
| func get_trufflehog_args(path) { | ||
| mode := "filesystem" | ||
| prefix := "" | ||
| if is_dir(path) and is_dir(join_path(path, ".git")) { | ||
| mode := "git" | ||
| prefix := "file://" | ||
| } | ||
| result := mode + " " | ||
| if tool.trufflehog.trufflehog_config != "" { | ||
| result := result + "--config=" + tool.trufflehog.trufflehog_config | ||
| } | ||
| result := result + tool.trufflehog.trufflehog_format_flags + " " | ||
| result := result + tool.trufflehog.trufflehog_other_flags + " " | ||
| result := result + prefix + path + " 2>/dev/null" | ||
| } | ||
|
|
||
| func load_trufflehog_results(out: string, code) { | ||
| result := {} | ||
|
|
||
| if code != 0 { | ||
| error("trufflehog failed to run properly; ignoring") | ||
| echo(out) | ||
| return {} | ||
| } | ||
|
|
||
| if strip(out) == "" { | ||
| info("trufflehog did not find any findings. ignoring") | ||
| return {} | ||
| } | ||
|
|
||
| if not starts_with(strip(out), "{") { | ||
| error("trufflehog did not run properly - invalid JSON returned; ignoring") | ||
| echo(out) | ||
| return {} | ||
| } | ||
|
|
||
| # trufflehog returns jsonl | ||
| return { "SECRET_SCANNER" : parse_jsonl(out) } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.