ossf/scorecard
1
1
Fork 0
mirror of https://github.com/ossf/scorecard.git synced 2024-09-11 00:45:36 +03:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

✨ Cleanup code for github tokens #534 (#539)

Browse Source 
* missed comments

* comments
This commit is contained in:
laurentsimon 2021-06-03 17:12:56 -07:00 committed by GitHub
parent 37d979f79b
commit d528b6e626
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 20 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
checks/permissions.go
View File

@ -17,6 +17,7 @@ package checks
import (
"errors"
"fmt"
"strings"
"gopkg.in/yaml.v2"
@ -39,15 +40,16 @@ func leastPrivilegedTokens(c *checker.CheckRequest) checker.CheckResult {
func validatePermission(key string, value interface{}, path string,
logf func(s string, f ...interface{})) (bool, error) {
switch val := value.(type) {
case string:
if val == "write" {
logf("!! token-permissions/github-token - %v permission set to '%v' in %v", key, val, path)
return false, nil
}
default:
val, ok := value.(string)
if !ok {
return false, ErrInvalidGitHubWorkflowFile
}
if strings.EqualFold(val, "write") {
logf("!! token-permissions/github-token - %v permission set to '%v' in %v", key, val, path)
return false, nil
}
return true, nil
}
@ -59,20 +61,18 @@ func validateMapPermissions(values map[interface{}]interface{}, path string,
// Iterate over the permission, verify keys and values are strings.
for k, v := range values {
switch key := k.(type) {
// String type.
case string:
if r, err = validatePermission(key, v, path, logf); err != nil {
return false, err
}
if !r {
permissionRead = false
}
// Invalid type.
default:
key, ok := k.(string)
if !ok {
return false, ErrInvalidGitHubWorkflowFile
}
if r, err = validatePermission(key, v, path, logf); err != nil {
return false, err
}
if !r {
permissionRead = false
}
}
return permissionRead, nil
}
@ -100,7 +100,7 @@ func validateReadPermissions(config map[interface{}]interface{}, path string,
// String type.
case string:
if val != "read-all" && val != "" {
if !strings.EqualFold(val, "read-all") && val != "" {
logf("!! token-permissions/github-token - permission set to '%v' in %v", val, path)
return false, nil
}