Manage _UNSECURED_ENV_VARIABLES for linters

Fixes #2699
oxsecurity · May 30, 2023 · ca2343f · ca2343f
1 parent 429032d
commit ca2343f
Show file tree

Hide file tree

Showing 6 changed files with 31 additions and 12 deletions.
diff --git a/megalinter/Linter.py b/megalinter/Linter.py
@@ -87,6 +87,7 @@ def __init__(self, params=None, linter_config=None):
         self.is_plugin = False
         self.pre_commands = None
         self.post_commands = None
+        self.unsecured_env_variables = []
         self.ignore_for_flavor_suggestions = False
 
         self.cli_lint_mode = "file"
@@ -665,6 +666,12 @@ def load_config_vars(self, params):
                 self.request_id, self.name + "_POST_COMMANDS"
             )
 
+        # Get secured variables allow list
+        if config.exists(self.request_id, self.name + "_UNSECURED_ENV_VARIABLES"):
+            self.unsecured_env_variables = config.get_list(
+                self.name + "_UNSECURED_ENV_VARIABLES"
+            )
+
         # Disable errors for this linter NAME + _DISABLE_ERRORS, then LANGUAGE + _DISABLE_ERRORS
         if config.get(self.request_id, self.name + "_DISABLE_ERRORS_IF_LESS_THAN"):
             self.disable_errors_if_less_than = int(
@@ -895,7 +902,7 @@ def execute_lint_command(self, command):
         cwd = os.path.abspath(self.workspace)
         logging.debug(f"[{self.linter_name}] CWD: {cwd}")
         subprocess_env = {
-            **config.build_env(self.request_id),
+            **config.build_env(self.request_id, True, self.unsecured_env_variables),
             "FORCE_COLOR": "0",
         }
         if type(command) == str:
@@ -1025,7 +1032,7 @@ def get_linter_version_output(self):
         logging.debug("Linter version command: " + str(command))
         cwd = os.getcwd() if command[0] != "npm" else "~/"
         subprocess_env = {
-            **config.build_env(self.request_id),
+            **config.build_env(self.request_id, True, self.unsecured_env_variables),
             "FORCE_COLOR": "0",
         }
         try:
@@ -1073,7 +1080,9 @@ def get_linter_help(self):
                         command[0] = cli_absolute
                 logging.debug("Linter help command: " + str(command))
                 subprocess_env = {
-                    **config.build_env(self.request_id),
+                    **config.build_env(
+                        self.request_id, True, self.unsecured_env_variables
+                    ),
                     "FORCE_COLOR": "0",
                 }
                 process = subprocess.run(

diff --git a/megalinter/config.py b/megalinter/config.py
@@ -236,7 +236,7 @@ def delete(request_id=None, key=None):
     set_config(request_id, config)
 
 
-def build_env(request_id, secured=True):
+def build_env(request_id, secured=True, allow_list=[]):
     secured_env_variables = []
     secured_env_variables_regex = []
     if secured is True:
@@ -246,9 +246,10 @@ def build_env(request_id, secured=True):
         )
     env_dict = {}
     for key, value in get_config(request_id).items():
-        if key in secured_env_variables or match_variable_regexes(
-            key, secured_env_variables_regex
-        ):
+        if (
+            key in secured_env_variables
+            or match_variable_regexes(key, secured_env_variables_regex)
+        ) and key not in allow_list:
             env_dict[key] = "HIDDEN_BY_MEGALINTER"
         elif not isinstance(value, str):
             env_dict[key] = str(value)

diff --git a/megalinter/linters/RakuLinter.py b/megalinter/linters/RakuLinter.py
@@ -24,7 +24,9 @@ def before_lint_files(self):
                 stdout=subprocess.PIPE,
                 stderr=subprocess.STDOUT,
                 shell=True,
-                env=config.build_env(self.request_id),
+                env=config.build_env(
+                    self.request_id, True, self.unsecured_env_variables
+                ),
             )
             return_code = process.returncode
             return_stdout = megalinter.utils.decode_utf8(process.stdout)

diff --git a/megalinter/linters/TfLintLinter.py b/megalinter/linters/TfLintLinter.py
@@ -34,4 +34,4 @@ def before_lint_files(self):
         self.pre_commands.append(tflint_pre_command)
 
     def pre_test(self):
-        config.set_value(self.request_id, "TERRAFORM_TFLINT_SECURED_ENV", "false")
+        config.set_value(self.request_id, "TERRAFORM_TFLINT_UNSECURED_ENV_VARIABLES", "GITHUB_TOKEN")
diff --git a/megalinter/pre_post_factory.py b/megalinter/pre_post_factory.py
@@ -63,8 +63,11 @@ def run_command(command_info, log_key, mega_linter, linter=None):
     if "secured_env" not in command_info:
         command_info["secured_env"] = True
     command_info = complete_command(command_info)
+    unsecured_env_variables = []
+    if linter is not None:
+        unsecured_env_variables = linter.unsecured_env_variables
     subprocess_env = {
-        **config.build_env(mega_linter.request_id, command_info["secured_env"])
+        **config.build_env(mega_linter.request_id, command_info["secured_env"], unsecured_env_variables)
     }
     add_in_logs(
         linter,

diff --git a/megalinter/tests/test_megalinter/config_test.py b/megalinter/tests/test_megalinter/config_test.py
@@ -269,13 +269,14 @@ def test_config_secure_env_vars_custom(self):
                 "GITLAB_ACCESS_TOKEN_MEGALINTER": "GITLAB_ACCESS_TOKEN_MEGALINTER_VALUE",
                 "SECRET_VAR": "SECRET_VALUE",
                 "OX_API_KEY": "1234",
-                "SECURED_ENV_VARIABLES": "SECRET_VAR,OX_API_KEY,(VAR_.*_REGEX)",
+                "SECURED_ENV_VARIABLES": "SECRET_VAR,OX_API_KEY,(VAR_.*_REGEX),UNSECURED_VAR",
                 "workspace": ".",
                 "LOG_LEVEL": "DEBUG",
                 "VAR_WITH_REGEX": "aXw32",
+                'UNSECURED_VAR': 'visible'
             },
         )
-        cli_env = config.build_env(request_id)
+        cli_env = config.build_env(request_id,True,['UNSECURED_VAR'])
         self.assertTrue(cli_env["VISIBLE_VAR"] == "VALUE", "VISIBLE_VAR is visible")
         self.assertTrue(
             cli_env["GITHUB_TOKEN"] == "HIDDEN_BY_MEGALINTER",
@@ -295,6 +296,9 @@ def test_config_secure_env_vars_custom(self):
             cli_env["GITLAB_ACCESS_TOKEN_MEGALINTER"] == "HIDDEN_BY_MEGALINTER",
             "GITLAB_ACCESS_TOKEN_MEGALINTER is not visible",
         )
+        self.assertTrue(
+            cli_env["UNSECURED_VAR"] == "visible", "UNSECURED_VAR is visible"
+        )
         usage_stdout = io.StringIO()
         with contextlib.redirect_stdout(usage_stdout):
             Megalinter(