Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

plugin users&pws: ported to new base class #1241

Merged
merged 2 commits into from
Dec 5, 2024
Merged

Conversation

jstucke
Copy link
Collaborator

@jstucke jstucke commented Jul 29, 2024

No description provided.

@jstucke jstucke requested a review from maringuu July 29, 2024 15:09
@jstucke jstucke self-assigned this Jul 29, 2024
def generate_unix_entry(entry: bytes) -> dict:
class CredentialResult(pydantic.BaseModel):
username: str = Field(description='The username.')
full_entry: str = Field(description='The full entry in unparsed form.')
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is a "full_entry" supposed to be? I do not understand the description.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"full_entry" is a full, unparsed entry, e.g.

admin:$5$Mqs9JzinZfyjSMNR$M7DWqlMjKmOHwfzXnts89eQImN2QNDATeN/Z/BX0Jb.:12332:0:99999:7:::

or if it doesn't contain a pw hash:

admin:*:12332:0:99999:7:::

This can be interesting if something went wrong (or sees to have gone wrong) during parsing or if the result is empty (because there is no hash)

Comment on lines 77 to 82
for regex_list, entry_gen_function in [
(UNIX_REGEXES, generate_unix_entry),
(HTPASSWD_REGEXES, generate_htpasswd_entry),
(MOSQUITTO_REGEXES, generate_mosquitto_entry),
]:
credentials.extend(find_password_entries(file_contents, regex_list, entry_gen_function))
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I personally find this less readable than not using a for loop. Also not using a for-loop is three lines less.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The find_password_entries was also ugly and kinda useless, since it had only one line. I refactored it in a way that made more sense to me

Comment on lines 57 to 58
class Schema(pydantic.BaseModel):
credentials: List[CredentialResult] = Field(description='The list of found credentials.')
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd propose a different schema:

class Schema(pydantic.BaseMode):
    unix: list[CreadentialResult]
    httpd: list[CredentialResult]
    mosquito: list[CredentialResult]

The class CrednetialResult would not have the type field anymore.

This way we could delete the _group_user_and_pw_results function and the schema would be more expressive imo.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changing the schema in this way also has disadvantages (like making it more complicated to add more password types or making it more complicated to iterate through all found pw entries) but I changed it (minus the typos 😅)

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I kept the type field, though, because without it, summary generation becomes unnecessarily ugly.

@jstucke jstucke force-pushed the users-pw-pluginV1 branch 2 times, most recently from 2685c6b to 4d63d30 Compare August 5, 2024 10:59
@jstucke jstucke requested a review from maringuu August 5, 2024 10:59
@codecov-commenter
Copy link

codecov-commenter commented Nov 26, 2024

Codecov Report

Attention: Patch coverage is 95.71429% with 6 lines in your changes missing coverage. Please review.

Project coverage is 91.84%. Comparing base (42f7320) to head (20b2e15).
Report is 19 commits behind head on master.

Files with missing lines Patch % Lines
...users_and_passwords/internal/credentials_finder.py 94.54% 3 Missing ⚠️
...users_and_passwords/code/password_file_analyzer.py 91.30% 2 Missing ⚠️
...sis/users_and_passwords/internal/crack_password.py 96.29% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #1241      +/-   ##
==========================================
- Coverage   91.96%   91.84%   -0.12%     
==========================================
  Files         377      378       +1     
  Lines       22360    20929    -1431     
==========================================
- Hits        20564    19223    -1341     
+ Misses       1796     1706      -90     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@maringuu maringuu merged commit ad4d6d8 into master Dec 5, 2024
10 checks passed
@maringuu maringuu deleted the users-pw-pluginV1 branch December 5, 2024 13:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants