While using atlassian/ms-teams-notify:0.1.0, it is reporting an incorrect security issue for Uncovered a Microsoft Teams Webhook. While the webhook is being read through pipeline environment variable.
Hey @Atish Roy ,
and welcome to the Community!
In order for us to investigate this further, could you kindly share the logs/errors you are receiving when running that pipe? You can either copy/paste the logs here or attach a screenshot.
This will help us to better understand the issue and provide more accurate instructions.
Thank you, @Atish Roy !
Patrik S
Hi @Atish Roy . Thanks for your question.Did you create WEBHOOK_URL Repository variable as a secured variable?Regards, Igor
Yes @Igor Stoyanov
@Atish Roy Please provide your bitbucketpipelines.yml config and result log outputs.Regards, Igor
Hello @Patrik S Snippet of pipeline code and failure report.
Log data:
Unable to find image 'bitbucketpipelines/git-secrets-scan:2.0.2' locally2.0.2: Pulling from bitbucketpipelines/git-secrets-scan4abcf2066143: Pulling fs layerc1963c07a115: Pulling fs layercfbddac15374: Pulling fs layer6a7c18283447: Pulling fs layer53208667e7cd: Pulling fs layer05a64fe2113b: Pulling fs layer75570927627d: Pulling fs layerf220f69d8c97: Pulling fs layer98f78dac6b8a: Pulling fs layerf220f69d8c97: Waiting53208667e7cd: Waiting6a7c18283447: Waiting98f78dac6b8a: Waiting05a64fe2113b: Waiting75570927627d: Waitingcfbddac15374: Verifying Checksumcfbddac15374: Download complete4abcf2066143: Verifying Checksum4abcf2066143: Download completec1963c07a115: Verifying Checksumc1963c07a115: Download complete4abcf2066143: Pull completec1963c07a115: Pull completecfbddac15374: Pull complete6a7c18283447: Verifying Checksum6a7c18283447: Download complete6a7c18283447: Pull complete05a64fe2113b: Verifying Checksum05a64fe2113b: Download completef220f69d8c97: Verifying Checksumf220f69d8c97: Download complete75570927627d: Download complete98f78dac6b8a: Download complete53208667e7cd: Verifying Checksum53208667e7cd: Download complete53208667e7cd: Pull complete05a64fe2113b: Pull complete75570927627d: Pull completef220f69d8c97: Pull complete98f78dac6b8a: Pull completeDigest: sha256:4b3105aca60c83e317663cabe25926acb2da421da72bc445209cc873e2447051Status: Downloaded newer image for bitbucketpipelines/git-secrets-scan:2.0.2[33mWARNING: New version available: atlassian/git-secrets-scan '2.0.2' to '2.0.3' [0m[34mINFO: Extend gitleaks command to create reports... [0m[33mWARNING: Gitleaks detect result status code: 1,○│╲│ ○○ ░░ gitleaks
[90m10:56AM [0m [32mINF [0m 50 commits scanned.[90m10:56AM [0m [32mINF [0m scan completed in 46.8ms[90m10:56AM [0m [31mWRN [0m leaks found: 6[0m[34mINFO: Generating CodeInsights reports... [0m[31m✖ Pipe has finished with a Results Status Code: 1 [0mSearching for files matching artifact pattern .bitbucket/pipelines/generated/pipeline/pipes/**
Searching for test report files in directories named [test-results, failsafe-reports, test-reports, TestResults, surefire-reports] down to a depth of 4Finished scanning for test reports. Found 0 test report files.Merged test suites, total number tests is 0, with 0 failures and 0 errors.
pipeline.yaml
Hi @Atish Roy . You do not have problem with ms-teams-notify pipe.You have generated report from git-secrets-scan pipe, in which you have the information that you exposed your WEBHOOK_URL value in previous commits.You have a fingerprint for commit in annotation so you could check this.Regards, Igor
@Igor Stoyanov shuoldn't it flag the issue based on current commit of the code base. Why is it looking for obsolete code base and flagging issue?
@Atish Roy shuoldn't it flag the issue based on current commit of the code base. -- No.
Why is it looking for obsolete code base and flagging issue? -- Because this secret still could be accessed by the hash commit. If the tool found your secret, then anyone else also could.If you think this is a false positive, you could use gitleaksignore to add the fingerprint there.
Regards, Igor
I tried to add fingerprints to the `.gitleaksignore` file but that does not work
how do I have to get the fingerprints?
I tried to run gitleaks command locally in my repo, but they have a totally different style then the ones of the CodeInsights report in the pipeline
It looks like you're new here. Sign in or register to get started.
