Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Homoglyphs detection in Minder #2312

Merged
merged 9 commits into from
Feb 11, 2024
Merged

Conversation

teodor-yanev
Copy link
Contributor

@teodor-yanev teodor-yanev commented Feb 8, 2024

Closes: #2121

Please refer to #2121 for a full description of the work covered in this PR. There will be a second short one for adding the rule types and a profile.

Reference to the PR and repo used for testing the feature: teodor-yanev/a-testrepo#1

A couple of notes here regarding the implementation:

  1. Considering the ongoing work (Create single status comment and correctly dismiss reviews #2171) and the tightly coupled (to the "vulncheck" dependency checks for ecosystems functionality) way of "review" related calls and string constants, I decided to opt-in for an "extract and refactor" approach which can be seen in "reviewer.go" and the related functions and files. After we reach a consensus on generalising these calls, we can come back to this work and address the necessary changes.

  2. Two rule types instead of one with parameters: an entirely subjective decision, this approach gives more flexibility when we want to customise each rule further.

  3. Two evaluators behind one "main" 'Homoglyphs' evaluator: The Homoglyphs evaluator presents a type field which gives us a direction on which functionality we need, that's it. There are two for now but there might be more in the future. While they are still classified under the same type of "Evaluator", they are still two separate logical entities, providing a different set of results, and making decisions based on different parameters.

Please note that the PR size isn't as scary as it looks: the scripts.txt file is ~3k lines alone and we also have proto generations.

@teodor-yanev teodor-yanev requested a review from a team as a code owner February 8, 2024 21:12
@teodor-yanev teodor-yanev self-assigned this Feb 8, 2024
@JAORMX
Copy link
Contributor

JAORMX commented Feb 8, 2024

6k PR daaaaaaaaaaamn

@teodor-yanev teodor-yanev mentioned this pull request Feb 9, 2024
}

// Eval evaluates the mixed scripts rule type
func (mse *MixedScriptsEvaluator) Eval(ctx context.Context, _ map[string]any, res *engif.Result) error {
Copy link
Contributor

@dmjb dmjb Feb 9, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Eval method of the these two evaluation strategies seem to share mostly identical code. I suspect it's possible to refactor them to share a common function. From what I can see, the only things which seem to change between the two Eval methods is:

  1. The type of processor and the method of the processor which carries out the evaluation.
  2. The message written in the PR comment
  3. The status/message in the PR review

One solution for this would be to add a common interface for MixedScriptsEvaluator and InvisibleCharactersEvaluator which looks something like this:

type HomoglyphEvaluator interface {
  FindViolations(codeLine string) InfoType
  GetLineCommentText() string
  GetFailedReviewText() string
  GetPassedReviewText() string
}

(I am not 100% sure of the types involved here, and there may be better names than the ones in my example)

At which point you could write a common function with a signature such as:

func checkForHomoglyphViolation(ctx context.Context, evaluator HomoglyphEvaluator, res *engif.Result) errror

Which will mostly look like the current code, except that it delegates the methods of the HomoglyphEvaluator struct instead of having hard-coded evaluator-specific references. The Eval methods of both structs simply calls into the common function with the appropriate arguments.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the descriptive suggestion and the discussion that followed in Slack!
I've addressed your comments.

@teodor-yanev teodor-yanev requested a review from dmjb February 9, 2024 19:14
@teodor-yanev teodor-yanev merged commit 067a3b7 into main Feb 11, 2024
19 checks passed
@teodor-yanev teodor-yanev deleted the add-minder-homoglyphs-detection branch February 11, 2024 19:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Implementing PR Diff Checks for Invisible Characters and Homoglyph Security Threats
3 participants