Adding slack workflow#585
Conversation
| }, | ||
| { | ||
| "Id": "SEC101/048", | ||
| "Name": "DoNotExposePlaintextSecrets/SlackWorkflow", |
There was a problem hiding this comment.
Credentials = id + password, for example.
Token/ApiKey = you use that to authenticate.
For others, such as workflows/webhooks, we don't have a specific pattern.
Now, should we change all to 'Token', when we discussed about this, we were relying on the term used by the secret.
For example, we found a Nuget api key and not a nuget token.
There was a problem hiding this comment.
I think we actually converged on 'Key' elsewhere unless there was a better term.
In any case, what name do we want here? SlackWorkflowKey?
|
|
||
| case HttpStatusCode.NotFound: | ||
| { | ||
| message = "The specified Slack webhook could not be found."; |
There was a problem hiding this comment.
yeah, forgot to update.
will do once u finish this review!
thanks!
| namespace Microsoft.CodeAnalysis.Sarif.PatternMatcher.Plugins.Security.Validators | ||
| { | ||
| /// <summary> | ||
| /// Testing SEC101/005.SlackTokenValidator |
There was a problem hiding this comment.
Oops, I think SlackApiKey is actually the right rule name.
|
|
||
| namespace Microsoft.CodeAnalysis.Sarif.PatternMatcher.Plugins.Security | ||
| { | ||
| public class SlackWorkflowValidator : DynamicValidatorBase |
There was a problem hiding this comment.
Actually, SlackWorkflowKey looks right.
| namespace Microsoft.CodeAnalysis.Sarif.PatternMatcher.Plugins.Security.Validators | ||
| { | ||
| /// <summary> | ||
| /// Testing SEC101/020.DropboxAccessTokenValidator |
| { | ||
| /// <summary> | ||
| /// Testing SEC101/026.AkamaiCredentialsValidatorTests | ||
| /// Testing SEC101/015.AkamaiCredentialsValidator |
There was a problem hiding this comment.
thanks!
i'm following ur guidance to make everything in the same format, it will facilitate in the future :)
Changes
For significant contributions please make sure you have completed the following items:
ReleaseHistory.mdupdated for non-trivial changes