Cody Rose
a136e31d83
This PR implements global log redaction for the credentials of most other source types. It doesn't redact for sources that don't load their credentials with Init as a way to keep the PR simple - we can do those separately.
45 lines
1.4 KiB
Go
45 lines
1.4 KiB
Go
package github
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
gogit "github.com/go-git/go-git/v5"
|
|
"github.com/google/go-github/v66/github"
|
|
"github.com/trufflesecurity/trufflehog/v3/pkg/log"
|
|
|
|
"github.com/trufflesecurity/trufflehog/v3/pkg/context"
|
|
"github.com/trufflesecurity/trufflehog/v3/pkg/pb/sourcespb"
|
|
)
|
|
|
|
const cloudEndpoint = "https://api.github.com"
|
|
|
|
type connector interface {
|
|
// APIClient returns a configured GitHub client that can be used for GitHub API operations.
|
|
APIClient() *github.Client
|
|
// Clone clones a repository using the configured authentication information.
|
|
Clone(ctx context.Context, repoURL string) (string, *gogit.Repository, error)
|
|
}
|
|
|
|
func newConnector(source *Source) (connector, error) {
|
|
apiEndpoint := source.conn.Endpoint
|
|
if apiEndpoint == "" || endsWithGithub.MatchString(apiEndpoint) {
|
|
apiEndpoint = cloudEndpoint
|
|
}
|
|
|
|
switch cred := source.conn.GetCredential().(type) {
|
|
case *sourcespb.GitHub_GithubApp:
|
|
log.RedactGlobally(cred.GithubApp.GetPrivateKey())
|
|
return newAppConnector(apiEndpoint, cred.GithubApp)
|
|
case *sourcespb.GitHub_BasicAuth:
|
|
log.RedactGlobally(cred.BasicAuth.GetPassword())
|
|
return newBasicAuthConnector(apiEndpoint, cred.BasicAuth)
|
|
case *sourcespb.GitHub_Token:
|
|
log.RedactGlobally(cred.Token)
|
|
return newTokenConnector(apiEndpoint, cred.Token, source.handleRateLimit)
|
|
case *sourcespb.GitHub_Unauthenticated:
|
|
return newUnauthenticatedConnector(apiEndpoint)
|
|
default:
|
|
return nil, fmt.Errorf("unknown connection type")
|
|
}
|
|
}
|