prowler-cloud / prowler

Prowler is an Open Source Security tool for AWS, Azure, GCP and Kubernetes to do security assessments, audits, incident response, compliance, continuous monitoring, hardening and forensics readiness. Includes CIS, NIST 800, NIST CSF, CISA, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, Well-Architected Security, ENS and more
https://prowler.com
Apache License 2.0
10.76k stars 1.53k forks source link

feat(CodeBuild): Ensure source repository URLs do not contain sensitive credentials #4731

Closed MarioRgzLpz closed 2 months ago

MarioRgzLpz commented 2 months ago

Context

To improve security and adhere to best practices for code repository management, we are adding a new check within the CodeBuild framework. This check ensures that source repository URLs (right now only Bitbucket) do not contain sensitive credentials like authentication tokens or username and password.

Description

I added codebuild_bitbucket_urls_no_sensitive_credentialscheck with respective unit tests. In order to that I modified codebuild_service.py to add two new attributes source secondary_sources to the Project model, a new model Source and added respective test to codebuild_service_test.py.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

codecov[bot] commented 2 months ago

Codecov Report

Attention: Patch coverage is 89.36170% with 5 lines in your changes missing coverage. Please review.

Project coverage is 89.05%. Comparing base (e11bb47) to head (d366bc1). Report is 2 commits behind head on master.

Files Patch % Lines
...roject_source_repo_url_no_sensitive_credentials.py 84.37% 5 Missing :warning:
Additional details and impacted files ```diff @@ Coverage Diff @@ ## master #4731 +/- ## ======================================= Coverage 89.04% 89.05% ======================================= Files 923 924 +1 Lines 28280 28324 +44 ======================================= + Hits 25182 25223 +41 - Misses 3098 3101 +3 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

sergargar commented 2 months ago

Please name the check codebuild_project_source_repo_url_no_sensitive_credentials and create a BaseModel called Source to fill it with the information needed.

MarioRgzLpz commented 2 months ago

@sergargar All the changes requested done in commit 64bade9.