test(prohibited-file-names): verify push rule regular expressions

briefcase Feature Request

1. User story

As a security engineer and citizen,
I must prevent people from push secrets to public repositories
In order to protect confidential information.

2. Acceptance criteria

We'll be done when:

  • 1. The regular expressions and string matches in signatures.json prevent engineers for pushing confidential information to GitLab source code repositories.
  • 2. Each regular expression can be set to block, warn, or ignore matches.

3. Functional test plan

Problem: How can we automatically assess every single signature?

  1. Install the data-loss-signatures and gl-got module.

    npm i data-loss-signatures gl-got
  2. Create a personal access token with api access.

  3. Create a Jest spec to test each signature.

  4. Convert signatures.json into an array of Signature.prototypes:

    const dls = require('data-loss-signatures')
    const glGot = require('gl-got')
    const signaturesJson = require('data-loss-signatures/signatures.json')
    
    describe('GitLab Push Rules Prohibited File Names', () => {
      describe('are regular expressions and strings that each', () => {
        it('matches a data-leakage pattern', () => {
          const signatures = dls.signature.toArray(signaturesJson)
          signatures.forEach((signature) => {
            // Remove all prohibited file names and POST each one
            // Try to push this repo to your branch.
            // Output each result.
          })
        })
      })
    })
Edited by gregswindle