def test_print_stats_only_audited_real(
self,
capsys,
live_secrets_fixture,
unaudited_secrets_fixture,
audited_real_secrets_fixture,
):
unaudited_secrets_fixture = live_secrets_fixture = []
with self.mock_env():
print_stats(
live_secrets_fixture,
unaudited_secrets_fixture,
audited_real_secrets_fixture,
baseline_filename,
False,
False,
True,
)
secrets = audit.get_secrets_list_from_file(baseline_filename)
captured = capsys.readouterr()
assert captured.out == '\n{} potential secrets in {} were reviewed.'.format(
colorize(len(secrets), AnsiColor.BOLD),
colorize(baseline_filename, AnsiColor.BOLD),
) + ' Found {} secret that was audited as real.\n\n'.format(
colorize(len(audited_real_secrets_fixture), AnsiColor.BOLD), )
def test_print_stats_failed_conditions_zero_and_multiple_secrets_per_condition(
self,
capsys,
live_secrets_fixture,
unaudited_secrets_fixture,
audited_real_secrets_fixture,
):
unaudited_secrets_fixture = audited_real_secrets_fixture = []
with self.mock_env():
print_stats(
live_secrets_fixture,
unaudited_secrets_fixture,
audited_real_secrets_fixture,
baseline_filename,
True,
True,
True,
)
secrets = audit.get_secrets_list_from_file(baseline_filename)
captured = capsys.readouterr()
assert captured.out == '\n{} potential secrets in {} were reviewed.'.format(
colorize(len(secrets), AnsiColor.BOLD),
colorize(baseline_filename, AnsiColor.BOLD),
) + ' Found {} live secret, {} unaudited secrets'.format(
colorize(len(live_secrets_fixture), AnsiColor.BOLD),
colorize(len(unaudited_secrets_fixture), AnsiColor.BOLD),
) + ' and {} secrets that were audited as real.\n\n'.format(
colorize(len(audited_real_secrets_fixture), AnsiColor.BOLD), )
def test_print_stats_no_failed_conditions(
self,
capsys,
live_secrets_fixture,
unaudited_secrets_fixture,
audited_real_secrets_fixture,
):
live_secrets_fixture = unaudited_secrets_fixture = audited_real_secrets_fixture = []
with self.mock_env():
print_stats(
live_secrets_fixture,
unaudited_secrets_fixture,
audited_real_secrets_fixture,
baseline_filename,
True,
True,
True,
)
secrets = audit.get_secrets_list_from_file(baseline_filename)
captured = capsys.readouterr()
assert captured.out == ('\n{} potential secrets in {} were reviewed.'
' All checks have passed.\n\n'.format(
colorize(len(secrets), AnsiColor.BOLD),
colorize(baseline_filename,
AnsiColor.BOLD),
))
def execute(args) -> None:
"""
Executes a report based off the given arguments.
This feature extends the audit subcommand; it is recommended to be run as a
CI / CD build stage for users who would like to have a Detect Secrets report
in their pipeline.
It will cause Detect Secrets to exit with an error code if secrets
within a baseline fail a user-provided set of conditions:
1. if they are active (--fail-on-live)
2. if have not been audited (--fail-on-unaudited)
3. if they have been marked as real secrets when audited (--fail-on-audited-real)
A detailed report will be output that lists information about the secrets which failed
said conditions, including line number, filename, condition failed.There will be no
raw secret values in this output
Alternatively, assuming all conditions pass, Detect secrets will complete with zero exit status,
outputting a short summary stating that the checks passed, allowing the CI / CD build to
continue onto the next stage.
If no fail-on options are provided, all of the conditions will be
checked by default, but the report will always exit with zero.
"""
unaudited_secrets = live_secrets = audited_real_secrets = []
unaudited_return_code = live_return_code = audited_real_return_code = ReportExitCode.PASS.value
default_conditions = False
# If no fail conditions provided, run report using all fail conditions, but exit with 0
if (
args.report
and not args.fail_on_unaudited
and not args.fail_on_audited_real
and not args.fail_on_live
):
default_conditions = True
if args.fail_on_unaudited or default_conditions:
(unaudited_return_code, unaudited_secrets) = fail_on_unaudited(
args.filename[0],
)
if args.fail_on_live or default_conditions:
(live_return_code, live_secrets) = fail_on_live(args.filename[0])
if args.fail_on_audited_real or default_conditions:
(audited_real_return_code, audited_real_secrets) = fail_on_audited_real(
args.filename[0],
)
if args.json:
print_json_report(
live_secrets,
unaudited_secrets,
audited_real_secrets,
args.filename[0],
True if default_conditions else args.fail_on_live,
True if default_conditions else args.fail_on_unaudited,
True if default_conditions else args.fail_on_audited_real,
),
else:
print_stats(
live_secrets,
unaudited_secrets,
audited_real_secrets,
args.filename[0],
True if default_conditions else args.fail_on_live,
True if default_conditions else args.fail_on_unaudited,
True if default_conditions else args.fail_on_audited_real,
)
print_table_report(
live_secrets,
unaudited_secrets,
audited_real_secrets,
)
print_summary(
unaudited_return_code,
live_return_code,
audited_real_return_code,
args.filename[0],
True if default_conditions else args.fail_on_live,
True if default_conditions else args.fail_on_unaudited,
True if default_conditions else args.fail_on_audited_real,
True if args.omit_instructions else False,
)
if (
unaudited_return_code
== live_return_code
== audited_real_return_code
== ReportExitCode.PASS.value
):
sys.exit(ReportExitCode.PASS.value)
elif default_conditions:
sys.exit(ReportExitCode.PASS.value)
else:
sys.exit(ReportExitCode.FAIL.value)
def test_print_stats_failed_conditions_multiple_secrets_per_condition(
self,
capsys,
live_secrets_fixture,
unaudited_secrets_fixture,
audited_real_secrets_fixture,
):
modified_baseline = deepcopy(self.baseline)
modified_baseline['results']['filenameA'][0]['is_secret'] = True
modified_baseline['results']['filenameA'][1]['is_secret'] = None
modified_baseline['results']['filenameA'].append(
{
'hashed_secret': 'd',
'line_number': 150,
'type': 'Private key',
'is_secret': None,
}, )
modified_baseline['results']['filenameB'][0]['is_verified'] = True
modified_baseline['results']['filenameB'].append(
{
'hashed_secret': 'e',
'line_number': 185,
'type': 'Hex High Entropy String',
'is_verified': True,
}, )
modified_baseline['results']['filenameB'].append(
{
'hashed_secret': 'f',
'line_number': 200,
'type': 'Hex High Entropy String',
'is_secret': True,
}, )
live_secrets_fixture.append(
{
'failed_condition': ReportSecretType.LIVE.value,
'filename': baseline_filename,
'line': 180,
'type': 'Private key',
}, )
unaudited_secrets_fixture.append(
{
'failed_condition': ReportSecretType.UNAUDITED.value,
'filename': baseline_filename,
'line': 150,
'type': 'Hex High Entropy String',
}, )
audited_real_secrets_fixture.append(
{
'failed_condition': ReportSecretType.AUDITED_REAL.value,
'filename': baseline_filename,
'line': 200,
'type': 'Hex High Entropy String',
}, )
with self.mock_env(baseline=modified_baseline):
print_stats(
live_secrets_fixture,
unaudited_secrets_fixture,
audited_real_secrets_fixture,
baseline_filename,
True,
True,
True,
)
secrets = audit.get_secrets_list_from_file(baseline_filename)
captured = capsys.readouterr()
assert captured.out == '\n{} potential secrets in {} were reviewed.'.format(
colorize(len(secrets), AnsiColor.BOLD),
colorize(baseline_filename, AnsiColor.BOLD),
) + ' Found {} live secrets, {} unaudited secrets'.format(
colorize(len(live_secrets_fixture), AnsiColor.BOLD),
colorize(len(unaudited_secrets_fixture), AnsiColor.BOLD),
) + ' and {} secrets that were audited as real.\n\n'.format(
colorize(len(audited_real_secrets_fixture), AnsiColor.BOLD), )