GitLab Secure Stage, 30 Mar 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Post-processing leaked credentials on all branches (demo) – GitLab 15.11

Description

Issue: https://gitlab.com/gitlab-org/gitlab/-/issues/299212
Documentation: https://docs.gitlab.com/ee/user/application_security/secret_detection/post_processing.html

A

Hi everyone,: this is ahmed., I'm a senior backend engineer in the static analysis, team,.

A

And today we will be walking over this issue, and doing a demo of it.

A

The issue basically allows post-processing of leaked credentials on all branches,, not just the default branch.

A

Which means that,, if you were to have a leaked token in your code,, this token will be revoked on all branches,, not just when your merge request is merged to the default branch.

A

We will start by looking at this project here,, which has secret detection enabled,, as you can see,. We include this secret detection yaml file in our .gitlab-ci.yml file.

A

And here you see that I increased the log level so that we can see the logs verbosely and do not have to wonder what's going on with the secret detection job.

A

If you were to look at the secret detection job, you will see that the analyzer or gitleaks did not find any leaks for the time being.

A

If we go back over here,, this is because we don't have anything in the code yet,. So there's no tokens leaked.

A

But let's imagine that we created an access token for this project, and we will call it 'demo'.

A

This access token will have some of the scopes we have here,, maybe 'write_repository` as well.

A

And then we will just create the project- access token., let's copy this and have it committed to a new branch.

A

Now, as soon as we have the pipeline running,, including this secret detection, job, umm,, this new project access token, should be revoked already.

A

If we refresh this page,, we will see that it's no longer active,, but let's just walk over to the secret detection job, over here, again.

A

And as you can see,, when the analyzer, or when gitleaks, did walk through the code,, the new code, we have,, it did find one leak,, which is the new project access. We have just added.

A

Now,, if we go back to the project access tokens, and we refresh the page,, we will see that the project token has been revoked. Already.

A

So, this ensures that,, even if you mistakenly have committed something, to like a branch, and pushed to a repository,, it will be revoked immediately as soon as the secret detection, job runs.

A

And,, that's it!.