Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

the block confidential script is not blocking the kubeconfig file #244

Open
vivuu1989 opened this issue May 31, 2019 · 5 comments
Open

the block confidential script is not blocking the kubeconfig file #244

vivuu1989 opened this issue May 31, 2019 · 5 comments

Comments

@vivuu1989
Copy link

Hello experts,

We are using the platform samples the block confidential pre-receive script in our environment. It was working as expected.
but when we scanned the GitHub data , we could identify that the kubeconfig files are not getting blocked.

Could you please suggest us to add the best regex to find the kubeconfig file and block it through pre-receive script..
@stoe
Copy link
Member

stoe commented May 31, 2019

To block a certain file by extension, you may want to look at the https://github.com/github/platform-samples/blob/master/pre-receive-hooks/block_file_extensions.sh example, @vivuu1989.

@vivuu1989
Copy link
Author

@stoe thanks , but we were looking for the possibility to block it through the same pre-receive hook which we are using for the block confidential. Because the user may store the file in different format and it may not identify..
Hence we are looking for some regex same like which we used for finding RSA token or etc..

@stoe
Copy link
Member

stoe commented May 31, 2019

@vivuu1989, you can add the required regex to the list in

platform-samples/pre-receive-hooks/block_confidentials.sh

Lines 20 to 29 in e9c2177

regex_list=(
# block any private key file
'(\-){5}BEGIN\s?(RSA|OPENSSH|DSA|EC|PGP)?\s?PRIVATE KEY\s?(BLOCK)?(\-){5}.*'
# block AWS API Keys
'AKIA[0-9A-Z]{16}'
# block AWS Secret Access Key (TODO: adjust to not find validd Git SHA1s; false positives)
# '([^A-Za-z0-9/+=])?([A-Za-z0-9/+=]{40})([^A-Za-z0-9/+=])?'
# block confidential content
'CONFIDENTIAL'
)

@vivuu1989
Copy link
Author

@stoe yes , thats correct. But we are confused about the regex value which can be added to the script to block the kubeconfig file.

@stoe
Copy link
Member

stoe commented Jun 6, 2019

@vivuu1989, maybe try https://regexr.com to get to the regex you need?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@stoe @vivuu1989