slalombuild / secureli

seCureLI is a tool that enables you to experience the delight of building products by helping you get ideas from your head into working software as frictionlessly as possible, in a reliable, secure, scalable, and observable way.
Apache License 2.0
28 stars 3 forks source link

Create command for users to submit custom regex pattern for security scan #460

Closed JordoHeffernan closed 3 months ago

JordoHeffernan commented 7 months ago

As a user, I want to be able to have SeCureLi scan for custom patterns specific for my security concerns

AC

  1. Add a new item to .secureli.yaml called custom_scan_patterns that is an empty list
  2. Create a new command called add_custom_scan_pattern (name suggestions?) Expand Update command to include pattern additions
  3. Command accepts a flag --new_pattern which can be added multiple times, each flag accepts a string
  4. User input is checked and must be a regex pattern. if it pass the check, it is saved in config as an item in custom_scan_patterns a. If it fails, present error message to user
  5. When the pre-commit scan runs, in addition to default security checks, and the items check by work completed in #435 also check for all patterns in custom_scan_patterns
  6. Add documentation - Readme

Notes

rt-slalom commented 4 months ago

Completed development and unit tests for steps 1-4, work in linked branch feature/secureli-460-custom-regex. Steps 5-6 must still be completed.

Use secureli update --new-pattern --help to view current tool tip. Option is functional, so use secureli update --new-pattern test_pattern to see how it works.

The new patterns are written to scan_patterns -> custom_scan_patterns in the .secureli.yaml file. This may be reducible to a top level list by playing with the CustomScanSettings class or the SecureliFile.scan patterns member in repository.py. If the yaml does not have the section, it will be created.

Error handling: When a user submits an invalid or previously saved regex pattern, there is a warning message output, but no error. This allows for partial successes.

When any number of patterns is successfully added, the total list of custom scan patterns is printed out, for clarity.