Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding fields to Policy struct to support skip not applicable #1067

Merged
merged 4 commits into from
Jan 6, 2025

Conversation

eranturgeman
Copy link
Contributor

@eranturgeman eranturgeman commented Jan 1, 2025

  • All tests passed. If this feature is not already covered by the tests, I added new tests.
  • All static analysis checks passed.
  • This pull request is on the dev branch.
  • I used gofmt for formatting the code before submitting the pull request.

This PR adds new fields into Policy related structs

@eranturgeman eranturgeman added the safe to test Approve running integration tests on a pull request label Jan 2, 2025
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Jan 2, 2025
@eranturgeman eranturgeman added the ignore for release Automatically generated release notes label Jan 2, 2025
@eranturgeman eranturgeman changed the title Adding fields to Policy struct to support skip not applicable - new Adding fields to Policy struct to support skip not applicable Jan 2, 2025
@eranturgeman eranturgeman added the safe to test Approve running integration tests on a pull request label Jan 5, 2025
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Jan 5, 2025
@eranturgeman eranturgeman requested a review from attiasas January 5, 2025 08:09
Copy link
Contributor

@attiasas attiasas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, I would try to add test case for passing 'True'

@eranturgeman eranturgeman added the safe to test Approve running integration tests on a pull request label Jan 5, 2025
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Jan 5, 2025
Copy link
Contributor

github-actions bot commented Jan 6, 2025

🚨 Frogbot scanned this pull request and found the below:


Copy link
Contributor

github-actions bot commented Jan 6, 2025

{
		User: "admin",
		Auth: []ssh.AuthMethod{
			sshAuth,
		},
		//#nosec G106 -- Used to get ssh headers only.
		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
	}

at auth/sshlogin.go (line 67)

🎯 Static Application Security Testing (SAST) Vulnerability

Severity Finding

Low
SSH key not verified properly, expired certificates may be accepted
Full description

Overview

SSH Keys Past Expiration is a vulnerability that occurs when SSH keys
used for authentication have expired. Expired keys can lead to
unauthorized access to systems and sensitive data, posing a security
risk to the organization.

Vulnerable example

package main

import (
    "golang.org/x/crypto/ssh"
    "net"
)

func main() {}

func insecureIgnoreHostKey() {
    _ = &ssh.ClientConfig{
        User:            "username",
        Auth:            []ssh.AuthMethod{nil},
        HostKeyCallback: ssh.InsecureIgnoreHostKey(),
    }
}

In this example, the InsecureIgnoreHostKey function is used to ignore
host key verification, which can lead to accepting expired or invalid
keys.

Remediation

package main

import (
    "golang.org/x/crypto/ssh"
    "net"
)

func main() {}

func secureHostKeyCallback() {
    publicKeyBytes, _ := ioutil.ReadFile("allowed_hostkey.pub")
    publicKey, _ := ssh.ParsePublicKey(publicKeyBytes)

    _ = &ssh.ClientConfig{
        User:            "username",
        Auth:            []ssh.AuthMethod{nil},
        HostKeyCallback: ssh.FixedHostKey(publicKey),
    }
}

By using allowed host keys and proper host key verification, we can
mitigate the risk of accepting expired or invalid SSH keys.


@EyalDelarea EyalDelarea merged commit de902d8 into jfrog:dev Jan 6, 2025
23 of 24 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
ignore for release Automatically generated release notes
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants