Improve handling of Gist URLs #2653
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
rgmz
force-pushed
the
fix/github-enterprise-gist
branch
3 times, most recently
from
730ec6d
to
75a23ef
Compare
mcastorina
reviewed
Apr 11, 2024
pkg/sources/github/github.go
Outdated
| case 3: | ||
| // Do nothing | ||
| case 4: | ||
| if !(!strings.EqualFold(urlParts[0], "github.com") && strings.EqualFold(urlParts[1], "gist")) { |
There was a problem hiding this comment.
I think there's an extra ! in there and it should be:
!(strings.EqualFold(urlParts[0], "github.com") && strings.EqualFold(urlParts[1], "gist"))
// ^^ removed this oneA gist segment is only expected for the github.com host, right?
There was a problem hiding this comment.
This is difficult to grok in its current state, I'll need to change it — or at least add a comment. 😵
I think there's an extra
!in there and it should be:!(strings.EqualFold(urlParts[0], "github.com") && strings.EqualFold(urlParts[1], "gist")) // ^^ removed this oneA
gistsegment is only expected for thegithub.comhost, right?
It's actually the opposite. GitHub uses the subdomain gist.github.com for gists, and although github.com/gist redirects -> gist.github.com, it isn't a valid gist URL (e.g., https://github.com/gist/280192b0523099d0614a95f579d99aa9 and https://github.com/gist/rgmz/280192b0523099d0614a95f579d99aa9). However, /gist/<id> can be valid for instances of GitHub Enterprise Server (e.g., https://github.company.org/gist/nat/5fdbb7f945d121f197fb074578e53948.git).
The logic is meant to accept a gist segment for any domain except github.com.
There was a problem hiding this comment.
I'm not sure if @joeleonjr has anything to add about Gist URLs.
There was a problem hiding this comment.
This is difficult to grok in its current state, I'll need to change it — or at least add a comment. 😵
I did both. Let me know if that looks better.
rgmz
force-pushed
the
fix/github-enterprise-gist
branch
2 times, most recently
from
1c3ddff
to
cbe808f
Compare
rgmz
force-pushed
the
fix/github-enterprise-gist
branch
2 times, most recently
from
5ff26ff
to
a4dca22
Compare
rgmz
force-pushed
the
fix/github-enterprise-gist
branch
from
a4dca22
to
d009666
Compare
ahrav
approved these changes
May 24, 2024
rgmz
force-pushed
the
fix/github-enterprise-gist
branch
from
d009666
to
7ef3f2e
Compare
itsacoyote
pushed a commit
to matter-labs/docs-nuxt-template
that referenced
this pull request
May 29, 2024
[](https://renovatebot.com) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [trufflesecurity/trufflehog](https://togithub.com/trufflesecurity/trufflehog) | action | minor | `v3.76.3` -> `v3.77.0` | --- ### Release Notes <details> <summary>trufflesecurity/trufflehog (trufflesecurity/trufflehog)</summary> ### [`v3.77.0`](https://togithub.com/trufflesecurity/trufflehog/releases/tag/v3.77.0) [Compare Source](https://togithub.com/trufflesecurity/trufflehog/compare/v3.76.3...v3.77.0) #### What's Changed - Remove "finished verificationOverlap chunks" log line by [@​rgmz](https://togithub.com/rgmz) in [trufflesecurity/trufflehog#2860 - fix(deps): update module github.com/wasilibs/go-re2 to v1.5.3 by [@​renovate](https://togithub.com/renovate) in [trufflesecurity/trufflehog#2861 - fix(deps): update module google.golang.org/api to v0.181.0 by [@​renovate](https://togithub.com/renovate) in [trufflesecurity/trufflehog#2857 - fix(deps): update module github.com/aws/aws-sdk-go to v1.53.5 by [@​renovate](https://togithub.com/renovate) in [trufflesecurity/trufflehog#2859 - Update azure storage extra data by [@​abmussani](https://togithub.com/abmussani) in [trufflesecurity/trufflehog#2808 - Update regex for Organization in Azure Devops detector by [@​abmussani](https://togithub.com/abmussani) in [trufflesecurity/trufflehog#2866 - fix(deps): update module github.com/aws/aws-sdk-go to v1.53.6 by [@​renovate](https://togithub.com/renovate) in [trufflesecurity/trufflehog#2867 - \[chore] - Use http.NewRequestWithContext by [@​ahrav](https://togithub.com/ahrav) in [trufflesecurity/trufflehog#2870 - adding Groq detector by [@​0x1](https://togithub.com/0x1) in [trufflesecurity/trufflehog#2873 - Log reasons for GitLab repo exclusion by [@​rosecodym](https://togithub.com/rosecodym) in [trufflesecurity/trufflehog#2875 - \[github] Scan user repositories by [@​rgmz](https://togithub.com/rgmz) in [trufflesecurity/trufflehog#2814 - Elastic adapter by [@​camgunz](https://togithub.com/camgunz) in [trufflesecurity/trufflehog#2727 - Improve handling of Gist URLs by [@​rgmz](https://togithub.com/rgmz) in [trufflesecurity/trufflehog#2653 - Fix some GitHub source test issues by [@​rgmz](https://togithub.com/rgmz) in [trufflesecurity/trufflehog#2774 - fix(deps): update module github.com/aws/aws-sdk-go to v1.53.10 by [@​renovate](https://togithub.com/renovate) in [trufflesecurity/trufflehog#2871 - fix(deps): update module github.com/go-logr/logr to v1.4.2 by [@​renovate](https://togithub.com/renovate) in [trufflesecurity/trufflehog#2869 - fix(deps): update module cloud.google.com/go/secretmanager to v1.13.1 by [@​renovate](https://togithub.com/renovate) in [trufflesecurity/trufflehog#2884 - fix(deps): update golang.org/x/exp digest to [`4c93da0`](https://togithub.com/trufflesecurity/trufflehog/commit/4c93da0) by [@​renovate](https://togithub.com/renovate) in [trufflesecurity/trufflehog#2883 - fix(deps): update module github.com/elastic/go-elasticsearch/v8 to v8.13.1 by [@​renovate](https://togithub.com/renovate) in [trufflesecurity/trufflehog#2886 - fix(deps): update module github.com/gabriel-vasile/mimetype to v1.4.4 by [@​renovate](https://togithub.com/renovate) in [trufflesecurity/trufflehog#2890 - Added extra data for LaunchDarkly by [@​abmussani](https://togithub.com/abmussani) in [trufflesecurity/trufflehog#2836 - feat: support docker image history scanning by [@​jamestelfer](https://togithub.com/jamestelfer) in [trufflesecurity/trufflehog#2882 #### New Contributors - [@​camgunz](https://togithub.com/camgunz) made their first contribution in [trufflesecurity/trufflehog#2727 - [@​jamestelfer](https://togithub.com/jamestelfer) made their first contribution in [trufflesecurity/trufflehog#2882 **Full Changelog**: trufflesecurity/trufflehog@v3.76.3...v3.77.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/matter-labs/docs-nuxt-template). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4zNzcuOCIsInVwZGF0ZWRJblZlciI6IjM3LjM3Ny44IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
](https://renovatebot.com){kind=link}
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description:
This is a follow-up to #2625. It fixes #2640 (at least based on my testing) and should allow scanning of gists with GHES, which was highlighted in #2640 (comment).
Checklist:
make test-community)?make lintthis requires golangci-lint)?