Skip to content

Commit 8ba5b87

Browse files
schandr78schandr78
committed
Merged PR 684501: Scan environment variables for credentials using the CredScan library(Phase I)
This is Phase I hence only a warning is logged when a credential is detected in an env var. Depending on the results obtained from the logging information the implementation is modified accordingly. Added the CredentialScanner class to handle the functionality related to credscan Created a unit test to test the functionality of the scanner with various test cases Modified the SetEnvironmentVariables method to call the credscan method from CredentialScanner class. Added allowList mechanism and a unit test to test that Related work items: #1975564
1 parent b63c672 commit 8ba5b87

File tree

46 files changed

+665
-75
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+665
-75
lines changed

‎Private/InternalSdk/Microsoft.Automata.SRM/Microsoft.Automata.SRM.dsc

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
// Copyright (c) Microsoft. All rights reserved.
2+
// Licensed under the MIT license. See LICENSE file in the project root for full license information.
3+
4+
import {Transformer} from "Sdk.Transformers";
5+
import * as Managed from "Sdk.Managed";
6+
7+
// This is an empty facade for a Microsoft internal package.
8+
9+
namespace Contents {
10+
export declare const qualifier: {
11+
};
12+
13+
@@public
14+
export const all: StaticDirectory = Transformer.sealPartialDirectory(d`.`, []);
15+
}
16+
17+
@@public
18+
export const pkg: Managed.ManagedNugetPackage =
19+
Managed.Factory.createNugetPackage(
20+
"Microsoft.Automata.SRM",
21+
"0.0.0",
22+
Contents.all,
23+
[],
24+
[],
25+
[]
26+
);

‎Private/InternalSdk/Microsoft.Automata.SRM/module.config.dsc

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
// Copyright (c) Microsoft. All rights reserved.
2+
// Licensed under the MIT license. See LICENSE file in the project root for full license information.
3+
4+
module({
5+
name: "Microsoft.Automata.SRM"
6+
});

‎Private/InternalSdk/Microsoft.Security.CredScan.KnowledgeBase.Client/Microsoft.Security.CredScan.KnowledgeBase.Client.dsc

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
// Copyright (c) Microsoft. All rights reserved.
2+
// Licensed under the MIT license. See LICENSE file in the project root for full license information.
3+
4+
import {Transformer} from "Sdk.Transformers";
5+
import * as Managed from "Sdk.Managed";
6+
7+
// This is an empty facade for a Microsoft internal package.
8+
9+
namespace Contents {
10+
export declare const qualifier: {
11+
};
12+
13+
@@public
14+
export const all: StaticDirectory = Transformer.sealPartialDirectory(d`.`, []);
15+
}
16+
17+
@@public
18+
export const pkg: Managed.ManagedNugetPackage =
19+
Managed.Factory.createNugetPackage(
20+
"Microsoft.Security.CredScan.KnowledgeBase.Client",
21+
"0.0.0",
22+
Contents.all,
23+
[],
24+
[],
25+
[]
26+
);

‎Private/InternalSdk/Microsoft.Security.CredScan.KnowledgeBase.Client/module.config.dsc

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
// Copyright (c) Microsoft. All rights reserved.
2+
// Licensed under the MIT license. See LICENSE file in the project root for full license information.
3+
4+
module({
5+
name: "Microsoft.Security.CredScan.KnowledgeBase.Client"
6+
});

‎Private/InternalSdk/Microsoft.Security.CredScan.KnowledgeBase.Ruleset/Microsoft.Security.CredScan.KnowledgeBase.Ruleset.dsc

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
// Copyright (c) Microsoft. All rights reserved.
2+
// Licensed under the MIT license. See LICENSE file in the project root for full license information.
3+
4+
import {Transformer} from "Sdk.Transformers";
5+
import * as Managed from "Sdk.Managed";
6+
7+
// This is an empty facade for a Microsoft internal package.
8+
9+
namespace Contents {
10+
export declare const qualifier: {
11+
};
12+
13+
@@public
14+
export const all: StaticDirectory = Transformer.sealPartialDirectory(d`.`, []);
15+
}
16+
17+
@@public
18+
export const pkg: Managed.ManagedNugetPackage =
19+
Managed.Factory.createNugetPackage(
20+
"Microsoft.Security.CredScan.KnowledgeBase.Ruleset",
21+
"0.0.0",
22+
Contents.all,
23+
[],
24+
[],
25+
[]
26+
);

‎Private/InternalSdk/Microsoft.Security.CredScan.KnowledgeBase.Ruleset/module.config.dsc

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
// Copyright (c) Microsoft. All rights reserved.
2+
// Licensed under the MIT license. See LICENSE file in the project root for full license information.
3+
4+
module({
5+
name: "Microsoft.Security.CredScan.KnowledgeBase.Ruleset"
6+
});

‎Private/InternalSdk/Microsoft.Security.CredScan.KnowledgeBase/Microsoft.Security.CredScan.KnowledgeBase.dsc

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
// Copyright (c) Microsoft. All rights reserved.
2+
// Licensed under the MIT license. See LICENSE file in the project root for full license information.
3+
4+
import {Transformer} from "Sdk.Transformers";
5+
import * as Managed from "Sdk.Managed";
6+
7+
// This is an empty facade for a Microsoft internal package.
8+
9+
namespace Contents {
10+
export declare const qualifier: {
11+
};
12+
13+
@@public
14+
export const all: StaticDirectory = Transformer.sealPartialDirectory(d`.`, []);
15+
}
16+
17+
@@public
18+
export const pkg: Managed.ManagedNugetPackage =
19+
Managed.Factory.createNugetPackage(
20+
"Microsoft.Security.CredScan.KnowledgeBase",
21+
"0.0.0",
22+
Contents.all,
23+
[],
24+
[],
25+
[]
26+
);

‎Private/InternalSdk/Microsoft.Security.CredScan.KnowledgeBase/module.config.dsc

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
// Copyright (c) Microsoft. All rights reserved.
2+
// Licensed under the MIT license. See LICENSE file in the project root for full license information.
3+
4+
module({
5+
name: "Microsoft.Security.CredScan.KnowledgeBase"
6+
});

‎Private/InternalSdk/Microsoft.Security.RegularExpressions/Microsoft.Security.RegularExpressions.dsc

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
// Copyright (c) Microsoft. All rights reserved.
2+
// Licensed under the MIT license. See LICENSE file in the project root for full license information.
3+
4+
import {Transformer} from "Sdk.Transformers";
5+
import * as Managed from "Sdk.Managed";
6+
7+
// This is an empty facade for a Microsoft internal package.
8+
9+
namespace Contents {
10+
export declare const qualifier: {
11+
};
12+
13+
@@public
14+
export const all: StaticDirectory = Transformer.sealPartialDirectory(d`.`, []);
15+
}
16+
17+
@@public
18+
export const pkg: Managed.ManagedNugetPackage =
19+
Managed.Factory.createNugetPackage(
20+
"Microsoft.Security.RegularExpressions",
21+
"0.0.0",
22+
Contents.all,
23+
[],
24+
[],
25+
[]
26+
);

‎Private/InternalSdk/Microsoft.Security.RegularExpressions/module.config.dsc

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
// Copyright (c) Microsoft. All rights reserved.
2+
// Licensed under the MIT license. See LICENSE file in the project root for full license information.
3+
4+
module({
5+
name: "Microsoft.Security.RegularExpressions"
6+
});

‎Public/Src/App/Bxl/Args.cs

+6
Original file line numberDiff line numberDiff line change
@@ -316,6 +316,9 @@ public bool TryParse(string[] args, PathTable pathTable, out ICommandLineConfigu
316316
OptionHandlerFactory.CreateBoolOption(
317317
"cpuResourceAware",
318318
sign => schedulingConfiguration.CpuResourceAware = sign),
319+
OptionHandlerFactory.CreateOption(
320+
"credScanEnvironmentVariablesAllowList",
321+
opt => sandboxConfiguration.CredScanEnvironmentVariablesAllowList.AddRange(CommandLineUtilities.ParseRepeatingOption(opt, ";", v => v.Trim()))),
319322
OptionHandlerFactory.CreateOption(
320323
"criticalCommitUtilizationPercentage",
321324
opt => schedulingConfiguration.CriticalCommitUtilizationPercentage = CommandLineUtilities.ParseInt32Option(opt, 0, 100)),
@@ -416,6 +419,9 @@ public bool TryParse(string[] args, PathTable pathTable, out ICommandLineConfigu
416419
OptionHandlerFactory.CreateBoolOption(
417420
"enableAsyncLogging",
418421
sign => loggingConfiguration.EnableAsyncLogging = sign),
422+
OptionHandlerFactory.CreateBoolOption(
423+
"enableCredScan",
424+
sign => sandboxConfiguration.EnableCredScan = sign),
419425
OptionHandlerFactory.CreateBoolOption(
420426
"enableEmptyingWorkingSet",
421427
sign => schedulingConfiguration.EnableEmptyingWorkingSet = sign),

‎Public/Src/App/Bxl/BuildXLApp.cs

+2-1
Original file line numberDiff line numberDiff line change
@@ -2229,7 +2229,8 @@ private EngineState RunEngine(
22292229
trackingEventListener,
22302230
rememberAllChangedTrackedInputs: true,
22312231
commitId: s_buildInfo?.IsDeveloperBuild == false ? s_buildInfo.CommitId : null,
2232-
buildVersion: s_buildInfo?.IsDeveloperBuild == false ? s_buildInfo.Build : null);
2232+
buildVersion: s_buildInfo?.IsDeveloperBuild == false ? s_buildInfo.Build : null,
2233+
enableCredScan: configuration.Sandbox.EnableCredScan);
22332234

22342235
if (engine == null)
22352236
{

‎Public/Src/Engine/Dll/Engine.FrontEnd.cs

+1-1
Original file line numberDiff line numberDiff line change
@@ -515,7 +515,7 @@ private GraphReuseResult ReloadPipGraphOnly(
515515
// - to fully initialize the front end, we have to go through all the steps that have already been
516516
// executed on the old controller; those steps are (1) InitializeHost, and (2) ParseConfig
517517
FrontEndController = m_frontEndControllerFactory.Create(Context.PathTable, Context.SymbolTable);
518-
FrontEndController.InitializeHost(Context.ToFrontEndContext(loggingContext), m_initialCommandLineConfiguration);
518+
FrontEndController.InitializeHost(Context.ToFrontEndContext(loggingContext, enableCredScan: m_enableCredScan), m_initialCommandLineConfiguration);
519519

520520
var configurationEngine = new BasicFrontEndEngineAbstraction(Context.PathTable, Context.FileSystem, m_initialCommandLineConfiguration);
521521
if (!configurationEngine.TryPopulateWithDefaultMountsTable(loggingContext, Context, m_initialCommandLineConfiguration, m_initialCommandLineConfiguration.Startup.Properties))

‎Public/Src/Engine/Dll/Engine.cs

+13-10
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,11 @@ public sealed partial class BuildXLEngine
8989
/// </summary>
9090
public EngineContext Context;
9191

92+
///<summary>
93+
/// Enable cred scan
94+
///</summary>
95+
private readonly bool m_enableCredScan;
96+
9297
/// <summary>
9398
/// BuildXLEngine configuration
9499
/// </summary>
@@ -267,7 +272,8 @@ private BuildXLEngine(
267272
TrackingEventListener trackingEventListener,
268273
bool rememberAllChangedTrackedInputs,
269274
[CanBeNull] string commitId,
270-
[CanBeNull] string buildVersion)
275+
[CanBeNull] string buildVersion,
276+
bool enableCredScan)
271277
{
272278
Contract.Requires(context != null);
273279
Contract.Requires(configuration != null);
@@ -345,7 +351,7 @@ private BuildXLEngine(
345351
m_commitId = commitId;
346352
m_buildVersion = buildVersion;
347353
m_buildViewModel = buildViewModel;
348-
354+
m_enableCredScan = enableCredScan;
349355
var loggingConfig = Configuration.Logging;
350356
if (loggingConfig.OptimizeConsoleOutputForAzureDevOps || loggingConfig.OptimizeVsoAnnotationsForAzureDevOps)
351357
{
@@ -368,7 +374,6 @@ private BuildXLEngine(
368374
// Tell the build viewmodel to collect a builder summary which we report to azure devops.
369375
m_buildViewModel.BuildSummary = new BuildSummary(filePath);
370376
}
371-
372377
// Designate a temp directory under ObjectDirectory for FileUtilities to move files to during deletion attempts
373378
m_moveDeleteTempDirectory = Path.Combine(configuration.Layout.ObjectDirectory.ToString(context.PathTable), MoveDeleteTempDirectoryName);
374379
}
@@ -387,7 +392,8 @@ public static BuildXLEngine Create(
387392
TrackingEventListener trackingEventListener = null,
388393
bool rememberAllChangedTrackedInputs = false,
389394
string commitId = null,
390-
string buildVersion = null)
395+
string buildVersion = null,
396+
bool enableCredScan = false)
391397
{
392398
Contract.Requires(context != null);
393399
Contract.Requires(buildViewModel != null);
@@ -403,7 +409,6 @@ public static BuildXLEngine Create(
403409
{
404410
return null;
405411
}
406-
407412
// Use a copy of the provided configuration. The engine mutates the configuration and invalidates old copies
408413
// as a safety mechanism against using out of date references. An external consumer of the engine may want
409414
// to use the same config for multiple engine runs. So make a copy here to avoid invalidating the config
@@ -413,10 +418,8 @@ public static BuildXLEngine Create(
413418
{
414419
return null;
415420
}
416-
417421
initialCommandLineConfiguration = mutableInitialConfig;
418-
419-
var frontEndContext = context.ToFrontEndContext(loggingContext);
422+
var frontEndContext = context.ToFrontEndContext(loggingContext, enableCredScan: enableCredScan);
420423
frontEndController.InitializeHost(frontEndContext, initialCommandLineConfiguration);
421424

422425
ConfigurationImpl configuration;
@@ -463,7 +466,8 @@ public static BuildXLEngine Create(
463466
trackingEventListener,
464467
rememberAllChangedTrackedInputs,
465468
commitId,
466-
buildVersion);
469+
buildVersion,
470+
enableCredScan);
467471
}
468472

469473
/// <summary>
@@ -2927,7 +2931,6 @@ private ConstructScheduleResult ConstructSchedule(
29272931
cacheInitializationTask,
29282932
journalState,
29292933
engineState);
2930-
29312934
if (TestHooks != null)
29322935
{
29332936
TestHooks.GraphReuseResult = reuseResult;

‎Public/Src/Engine/Dll/EngineContext.cs

+2-2
Original file line numberDiff line numberDiff line change
@@ -107,9 +107,9 @@ public static EngineContext CreateNew(CancellationToken cancellationToken, PathT
107107
/// Creates a new <see cref="FrontEndContext"/> and copies <see cref="PathTable"/>,
108108
/// <see cref="SymbolTable"/>, and <see cref="CancellationToken"/> over to it.
109109
/// </summary>
110-
public FrontEndContext ToFrontEndContext(LoggingContext loggingContext)
110+
public FrontEndContext ToFrontEndContext(LoggingContext loggingContext, bool enableCredScan = false)
111111
{
112-
return new FrontEndContext(this, loggingContext, FileSystem);
112+
return new FrontEndContext(this, loggingContext, FileSystem, enableCredScan);
113113
}
114114

115115
/// <inheritdoc/>

‎Public/Src/Engine/UnitTests/Engine/DirectoryScrubberTests.cs

+2-2
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
using Mount=BuildXL.Utilities.Configuration.Mutable.Mount;
2222
using BuildXL.Processes;
2323
using BuildXL.Utilities.Collections;
24+
using BuildXL.FrontEnd.Sdk;
2425

2526
namespace Test.BuildXL.Engine
2627
{
@@ -680,8 +681,7 @@ private static MountPathExpander CreateMountPathExpander(params TestMount[] moun
680681
private static ProcessBuilder CreatePipBuilderWithTag(TestEnv env, string tag = null)
681682
{
682683
var exe = FileArtifact.CreateSourceFile(AbsolutePath.Create(env.Context.PathTable, @"\\dummyPath\DummyFile.exe"));
683-
684-
var processBuilder = ProcessBuilder.Create(env.PathTable, env.PipDataBuilderPool.GetInstance());
684+
var processBuilder = ProcessBuilder.Create(env.PathTable, env.PipDataBuilderPool.GetInstance(), env.FrontEndContext.CredentialScanner, env.FrontEndContext.LoggingContext);
685685
processBuilder.Executable = exe;
686686
processBuilder.AddInputFile(exe);
687687
if (tag != null)

‎Public/Src/Engine/UnitTests/EngineTestUtilities/TestEnv.cs

+4
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
using System.Runtime.CompilerServices;
1111
using System.Threading;
1212
using BuildXL.Engine;
13+
using BuildXL.FrontEnd.Sdk;
1314
using BuildXL.FrontEnd.Sdk.FileSystem;
1415
using BuildXL.Ipc.Common;
1516
using BuildXL.Pips;
@@ -91,6 +92,9 @@ public sealed class TestEnv : IDisposable
9192
/// <nodoc />
9293
public PipTable PipTable { get; private set; }
9394

95+
/// <nodoc />
96+
public FrontEndContext FrontEndContext => FrontEndContext.CreateInstanceForTesting();
97+
9498
/// <summary>
9599
/// Creates a new test environment which schedules pips with full scheduler validation, but which cannot execute pips.
96100
/// </summary>

‎Public/Src/Engine/UnitTests/Processes/Test.BuildXL.Processes.dsc

+7
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,13 @@ namespace Processes {
3737
oldVersion: "0.0.0.0-4.1.4.0",
3838
newVersion: "4.1.4.0", // Corresponds to: { id: "System.Numerics.Vectors", version: "4.5.0" },
3939
},
40+
{
41+
name: "System.Text.Json",
42+
publicKeyToken: "cc7b13ffcd2ddd51",
43+
culture: "neutral",
44+
oldVersion: "0.0.0.0-6.0.0.0",
45+
newVersion: "6.0.0.0",
46+
},
4047
],
4148
references: [
4249
EngineTestUtilities.dll,

0 commit comments

Comments
 (0)