i have created a Bitbucket-Plugin forcing git-crypt encrypted

[mschwehl]

I have created a BB plugin that checks some path if is crypted with git-crypt (Magic Number). Some guys checked some configs in our secret-folder that where not encrypted and git don't forget

Drop me a note if you're interested, maybe i will release it in bb

[mschwehl]

// Credits:
// https://github.com/hmcmanus/yaml-validator-hook/blob/master/src/main/java/com/mcmanus/scm/stash/hook/YamlValidatorPreReceiveRepositoryHook.java

import com.atlassian.bitbucket.scope.Scope;
import com.atlassian.bitbucket.setting.Settings;
import com.atlassian.bitbucket.setting.SettingsValidationErrors;
import com.atlassian.bitbucket.setting.SettingsValidator;
import javax.annotation.Nonnull;

/**
 *
 * @author mschwehl
 */
public class SecretPluginSettingsValidator implements SettingsValidator {

    @Override
    public void validate(@Nonnull Settings settings, @Nonnull SettingsValidationErrors errors, @Nonnull Scope scope) {
        // Check that there is a value in the Regex field
        if (settings.getString("mergeCommitMsgRegex").trim().isEmpty()) {
            errors.addFieldError("mergeCommitMsgRegex", "A Regex is required");
        }

        if (settings.getString("mergeCommitMsgRegex").trim().indexOf("*") > 0) {
            errors.addFieldError("mergeCommitMsgRegex", "A Regex with '*' is required");
        }
                
        // Check that the summary notification is not empty
        if (settings.getString("mergeCommitMsgSummaryText").trim().isEmpty()) {
            errors.addFieldError("mergeCommitMsgSummaryText", "A summary notification message is required");
        }

        // Check that the detailed notification is not empty
        if (settings.getString("mergeCommitMsgDetailedText").trim().isEmpty()) {
            errors.addFieldError("mergeCommitMsgDetailedText", "A detailed notification message is required");
        }
    }
}

----

import com.atlassian.bitbucket.commit.Commit;
import com.atlassian.bitbucket.commit.CommitRequest;
import com.atlassian.bitbucket.commit.CommitService;
import com.atlassian.bitbucket.commit.MinimalCommit;
import com.atlassian.bitbucket.content.Change;
import com.atlassian.bitbucket.content.ChangeType;
import com.atlassian.bitbucket.content.ChangesRequest;
import com.atlassian.bitbucket.content.ContentService;
import com.atlassian.bitbucket.hook.repository.PreRepositoryHook;
import com.atlassian.bitbucket.hook.repository.PreRepositoryHookContext;
import com.atlassian.bitbucket.hook.repository.RepositoryHookRequest;
import com.atlassian.bitbucket.hook.repository.RepositoryHookResult;
import com.atlassian.bitbucket.idx.CommitIndex;
import com.atlassian.bitbucket.io.TypeAwareOutputSupplier;
import com.atlassian.bitbucket.repository.RefChange;
import com.atlassian.bitbucket.repository.Repository;
import com.atlassian.bitbucket.util.MoreSuppliers;
import com.atlassian.bitbucket.util.Page;
import com.atlassian.bitbucket.util.PageRequest;
import com.atlassian.bitbucket.util.PageUtils;
import com.atlassian.plugin.spring.scanner.annotation.export.ExportAsService;
import com.atlassian.plugin.spring.scanner.annotation.imports.ComponentImport;
import com.hrakaroo.glob.GlobPattern;
import com.hrakaroo.glob.MatchingEngine;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;


import javax.annotation.Nonnull;
import javax.inject.Inject;
import javax.inject.Named;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.util.ArrayList;
import java.util.Collection;
import java.util.Collections;
import java.util.Map;
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.ConcurrentMap;

@ExportAsService({SecretValidatorPreReceiveRepositoryHook.class})
@Named("secretValidatorRepositoryHook")
public class SecretValidatorPreReceiveRepositoryHook implements PreRepositoryHook
{
    private static final Logger LOG = LoggerFactory.getLogger(PreRepositoryHook.class);

    private static final String CONFIG_MERGE_COMMIT_REGEX = "mergeCommitMsgRegex";
    private static final String CONFIG_MERGE_COMMIT_SUMMARY = "mergeCommitMsgSummaryText";
    private static final String CONFIG_MERGE_COMMIT_DETAIL = "mergeCommitMsgDetailedText";
    
    
    private static final String SUMMARY = "summary";
    private static final String DETAIL = "detail";

    byte[] GIT_CRYPT_MAGIG_NUMBER = {(byte)0x00, 'G','I','T','C','R', 'Y','P', 'T', (byte)0x00};
        
    @ComponentImport
    private final CommitService commitService;
    @ComponentImport
    private final ContentService contentService;
    @ComponentImport
    private final CommitIndex commitIndex;

    @Inject
    public SecretValidatorPreReceiveRepositoryHook(final CommitService commitService,
                                                 final ContentService contentService,
                                                 final CommitIndex commitIndex 
                                                 ){
        this.commitService = commitService;
        this.contentService = contentService;
        this.commitIndex = commitIndex;
    }

    @Nonnull
    @Override
    public RepositoryHookResult preUpdate(@Nonnull PreRepositoryHookContext preRepositoryHookContext, @Nonnull RepositoryHookRequest repositoryHookRequest) {
        RepositoryHookResult result;
        
        String pathPattern = preRepositoryHookContext.getSettings().getString(CONFIG_MERGE_COMMIT_REGEX);
        String summaryHeader = preRepositoryHookContext.getSettings().getString(CONFIG_MERGE_COMMIT_SUMMARY);
        String detailHeader  = preRepositoryHookContext.getSettings().getString(CONFIG_MERGE_COMMIT_DETAIL);
                
        // Pruefen dass es mindestens einen Stern gibt        
        if (pathPattern == null || !pathPattern.contains("*")) {
           result = RepositoryHookResult.rejected(summaryHeader + " *MISSKONFIGURATION*", detailHeader + " -> Glob-Pattern ohne Stern");
           return result;
        }
        
        Map<String, String> processedResults = onReceive(repositoryHookRequest.getRepository(),
                repositoryHookRequest.getRefChanges(),pathPattern );

        if (processedResults.containsKey(SUMMARY)) {
            result = RepositoryHookResult.rejected(summaryHeader + "->" + processedResults.get(SUMMARY), detailHeader + "->" + processedResults.get(DETAIL));
        } else {
            result = RepositoryHookResult.accepted();
        }
        return result;
    }
    
    
    /**
     * Hook to check git-crypt files before allowing the push to complete.
     *
     * @param repository The repository that the changes are part of
     * @param refChanges A set of changes
     * @param secretPathRegex filepath that should be validated
     * @return Whether to allow the push to continue or not
     */
    public Map<String, String> onReceive(Repository repository, Collection<RefChange> refChanges, String secretPathRegex)
    {
        ConcurrentHashMap<String, String> result = new ConcurrentHashMap<>();
        ConcurrentMap<String, Commit> pathChanges = new ConcurrentHashMap<>();

        for (RefChange refChange : refChanges) {
            LOG.debug("Processing refchange of type: " + refChange.getType());

            Collection<Commit> commitsToCheck = Collections.synchronizedList(new ArrayList<>());

            findCommitsToCheck(refChange.getToHash(), repository, commitsToCheck);

            for (Commit commit : commitsToCheck) {
                addFileChangesOnCommit(pathChanges, repository, commit, secretPathRegex);
            }
        }

        if (!pathChanges.isEmpty()) {
            areFilesValid(pathChanges, repository, result);
        }

        return result;
    }

    /**
     * Recursive method to get the list of commits which are new on the branch
     *
     * @param hash The commit hash
     * @param repository The repository that the commits have been completed on
     * @param commitsToProcess A list of commits which are new
     */
    private void findCommitsToCheck(String hash, Repository repository, Collection<Commit> commitsToProcess) {
        final String zero = "0000000000000000000000000000000000000000";
        if (zero.equals(hash)) {
            // a new hash of 40 `0` means the branch is to be deleted
            // just let it pass through in that case
            LOG.debug("Found deletion commit");
            return;
        }

        if (!commitIndex.isIndexed(hash, repository)) {
            final CommitRequest request = new CommitRequest.Builder(repository, hash).build();
            final Commit commit = commitService.getCommit(request);
            LOG.debug("Found commit to check " + hash);
            commitsToProcess.add(commit);
            if (commit != null) {
                for (MinimalCommit parent : commit.getParents()) {
                    findCommitsToCheck(parent.getId(), repository, commitsToProcess);
                }
            }
        }
    }

    /**
     * This function checks that all the files are valid that are being pushed
     *
     * @param pathChanges Map of the string paths with their associated commits
     * @param repository The repository that the push is for
     * @param result Map holding the response to be sent back to the client
     *
     * @return A boolean denoting if the secret files are valid
     */
    private boolean areFilesValid(ConcurrentMap<String, Commit> pathChanges, Repository repository, ConcurrentMap<String, String> result) {
        LOG.info("Found " + pathChanges.size() + "secret files to validate");
        boolean allFilesAreValid = true;
        try {
            for (String filePath : pathChanges.keySet()){
                ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
                TypeAwareOutputSupplier os = MoreSuppliers.newTypeAwareOutputSupplierOf(outputStream);

                contentService.streamFile(
                        repository,
                        pathChanges.get(filePath).getId(),
                        filePath,
                        os);

                try {
                    if(!checkFile(outputStream.toByteArray(), result, filePath)) {
                        allFilesAreValid = false;
                    }
                } finally {
                    LOG.debug("Attempting to close the output stream");
                    outputStream.close();
                }

                if (!allFilesAreValid) {
                    break;
                }

            }
            LOG.debug("Removing the directory created in order to validate secret file");
        } catch (IOException e) {
            LOG.error("Problem creating the a temp directory to validate secret file" + e.getMessage());
        }

        return allFilesAreValid;
    }
    


    boolean checkFile(byte[] fileBytes, ConcurrentMap<String, String> result, String filePath) {
        boolean validFile = true;
		
        try {
            LOG.info("Attempting to validate secret stream");

            if (fileBytes.length < GIT_CRYPT_MAGIG_NUMBER.length) {
                throw new IllegalStateException("Dateilaenge kleiner als GitCrypt-Header");
            }
            
            for (int i =0 ; i < GIT_CRYPT_MAGIG_NUMBER.length; i++) {
                if (fileBytes[i] != GIT_CRYPT_MAGIG_NUMBER[i]) {
                    throw new IllegalStateException("Unterschied im Git-Crypt-Header: Datei nicht verschluesselt");
                } 
            }
            
        } catch (Exception e) {
            LOG.info("Rejecting push because following secret file is invalid: " + filePath);
            result.putIfAbsent(SUMMARY, "ERROR: Invalid secret file: " + filePath);
            result.putIfAbsent(DETAIL, e.getMessage());
            validFile = false;
        }
        return validFile;
    }

    /**
     * Creates a map of repository references mapped to the commit that it was changed with
     *
     * @param filesWithCommits The map to be added to
     * @param repository The repository is being pushed to
     * @param commit The new commit with file changes
     * @param pathPattern PathPattern
     * 
     */
    public void addFileChangesOnCommit(ConcurrentMap<String, Commit> filesWithCommits, Repository repository, Commit commit, String pathPattern) {
        
        final ChangesRequest changesRequest = new ChangesRequest.Builder(repository, commit.getId()).build();
        final Page<Change> changes = commitService.getChanges(changesRequest, PageUtils.newRequest(0,  PageRequest.MAX_PAGE_LIMIT));

        if (changes != null) {
            
            MatchingEngine m = GlobPattern.compile(pathPattern);
                                
            for (Change change : changes.getValues()) {
                
                LOG.debug("Change type was: " + change.getType().name());
                if (!ChangeType.DELETE.equals(change.getType())) {

                    boolean toProcess = false;
                    if (change.getPath() != null) {
                        
                        String path = change.getPath().toString().toLowerCase();
                        if (m.matches(path)) {
                            LOG.info("Secret-File found against glob-pattern " + pathPattern + " validating -> " + change.getPath().toString());
                            toProcess = true;
                        } else {
                            LOG.info("Regular file against glob-pattern " + pathPattern + " skipping -> " + change.getPath().toString());
                        }
                        
                    }
                    
                    if (toProcess) {
                        
                        if (filesWithCommits.containsKey(change.getPath().toString())) {
                            if (commit.getAuthorTimestamp().after(filesWithCommits.get(change.getPath().toString()).getAuthorTimestamp())) {
                                filesWithCommits.replace(change.getPath().toString(), commit);
                            }
                        } else {
                            filesWithCommits.putIfAbsent(change.getPath().toString(), commit);
                        }
                    }
                }
            }
        }
    }


}