Support reading .gitleaksignore using git show

cmd/detect.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/zricethezav/gitleaks/v8/config"
 	"github.com/zricethezav/gitleaks/v8/detect"
+	"github.com/zricethezav/gitleaks/v8/detect/git"
 	"github.com/zricethezav/gitleaks/v8/report"
 )
 
@@ -21,6 +22,7 @@ func init() {
 	detectCmd.Flags().Bool("pipe", false, "scan input from stdin, ex: `cat some_file | gitleaks detect --pipe`")
 	detectCmd.Flags().Bool("follow-symlinks", false, "scan files that are symlinks to other files")
 	detectCmd.Flags().StringP("gitleaks-ignore-path", "i", ".", "path to .gitleaksignore file or folder containing one")
+	detectCmd.Flags().String("gitleaks-ignore-rev", "HEAD", "git revision where .gitleaksignore can be found (useful in bare repositories without working tree)")
 }
 
 var detectCmd = &cobra.Command{
@@ -85,23 +87,39 @@ func runDetect(cmd *cobra.Command, args []string) {
 	if err != nil {
 		log.Fatal().Err(err).Msg("could not get .gitleaksignore path")
 	}
+	gitleaksIgnoreRev, err := cmd.Flags().GetString("gitleaks-ignore-rev")
+	if err != nil {
+		log.Fatal().Err(err).Msg("could not get revision")
+	}
 
 	if fileExists(gitleaksIgnorePath) {
 		if err = detector.AddGitleaksIgnore(gitleaksIgnorePath); err != nil {
 			log.Fatal().Err(err).Msg("could not call AddGitleaksIgnore")
 		}
+	} else if gitPath := gitleaksIgnoreRev + ":" + gitleaksIgnorePath; fileExistsInGit(gitPath) {
+		if err = detector.AddGitleaksIgnoreFromGit(gitPath); err != nil {
+			log.Fatal().Err(err).Msg("could not call AddGitleaksIgnoreFromGit")
+		}
 	}
 
-	if fileExists(filepath.Join(gitleaksIgnorePath, ".gitleaksignore")) {
-		if err = detector.AddGitleaksIgnore(filepath.Join(gitleaksIgnorePath, ".gitleaksignore")); err != nil {
+	if path := filepath.Join(gitleaksIgnorePath, ".gitleaksignore"); fileExists(path) {
+		if err = detector.AddGitleaksIgnore(path); err != nil {
 			log.Fatal().Err(err).Msg("could not call AddGitleaksIgnore")
 		}
+	} else if gitPath := gitleaksIgnoreRev + ":" + path; fileExistsInGit(gitPath) {
+		if err = detector.AddGitleaksIgnoreFromGit(gitPath); err != nil {
+			log.Fatal().Err(err).Msg("could not call AddGitleaksIgnoreFromGit")
+		}
 	}
 
-	if fileExists(filepath.Join(source, ".gitleaksignore")) {
-		if err = detector.AddGitleaksIgnore(filepath.Join(source, ".gitleaksignore")); err != nil {
+	if path := filepath.Join(source, ".gitleaksignore"); fileExists(path) {
+		if err = detector.AddGitleaksIgnore(path); err != nil {
 			log.Fatal().Err(err).Msg("could not call AddGitleaksIgnore")
 		}
+	} else if gitPath := gitleaksIgnoreRev + ":" + path; fileExistsInGit(gitPath) {
+		if err = detector.AddGitleaksIgnoreFromGit(gitPath); err != nil {
+			log.Fatal().Err(err).Msg("could not call AddGitleaksIgnoreFromGit")
+		}
 	}
 
 	// ignore findings from the baseline (an existing report in json format generated earlier)
@@ -213,6 +231,15 @@ func fileExists(fileName string) bool {
 	return false
 }
 
+func fileExistsInGit(filename string) bool {
+	exists, err := git.FileExists(filename)
+	if err != nil {
+		return false
+	}
+
+	return exists
+}
+
 func FormatDuration(d time.Duration) string {
 	scale := 100 * time.Second
 	// look for the max scale that is smaller than d

detect/detect.go

@@ -148,23 +148,39 @@ func NewDetectorDefaultConfig() (*Detector, error) {
 
 func (d *Detector) AddGitleaksIgnore(gitleaksIgnorePath string) error {
 	log.Debug().Msgf("found .gitleaksignore file: %s", gitleaksIgnorePath)
-	file, err := os.Open(gitleaksIgnorePath)
 
+	file, err := os.Open(gitleaksIgnorePath)
 	if err != nil {
 		return err
 	}
-
 	// https://github.com/securego/gosec/issues/512
 	defer func() {
 		if err := file.Close(); err != nil {
 			log.Warn().Msgf("Error closing .gitleaksignore file: %s\n", err)
 		}
 	}()
+
 	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
+		d.gitleaksIgnore[scanner.Text()] = true
+	}
 
+	return nil
+}
+
+func (d *Detector) AddGitleaksIgnoreFromGit(gitPath string) error {
+	log.Debug().Msgf("found .gitleaksignore file in the git tree: %s", gitPath)
+
+	file, err := git.ShowFile(gitPath)
+	if err != nil {
+		return err
+	}
+
+	scanner := bufio.NewScanner(file)
 	for scanner.Scan() {
 		d.gitleaksIgnore[scanner.Text()] = true
 	}
+
 	return nil
 }
 

detect/detect_test.go

@@ -9,6 +9,7 @@ import (
 	"github.com/rs/zerolog/log"
 	"github.com/spf13/viper"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/zricethezav/gitleaks/v8/config"
 	"github.com/zricethezav/gitleaks/v8/report"
@@ -502,6 +503,142 @@ func TestFromGit(t *testing.T) {
 		assert.ElementsMatch(t, tt.expectedFindings, findings)
 	}
 }
+
+// TestFromGitBare tests the FromGit function with bare repository
+func TestFromGitBare(t *testing.T) {
+	tests := []struct {
+		cfgName          string
+		source           string
+		logOpts          string
+		revision         string
+		expectedFindings []report.Finding
+	}{
+		{
+			source:   filepath.Join(repoBasePath, "small.git"),
+			cfgName:  "simple",
+			revision: "HEAD",
+			expectedFindings: []report.Finding{
+				{
+					Description: "AWS Access Key",
+					StartLine:   20,
+					EndLine:     20,
+					StartColumn: 19,
+					EndColumn:   38,
+					Line:        "\n    awsToken := \"AKIALALEMEL33243OLIA\"",
+					Secret:      "AKIALALEMEL33243OLIA",
+					Match:       "AKIALALEMEL33243OLIA",
+					File:        "main.go",
+					Date:        "2021-11-02T23:37:53Z",
+					Commit:      "1b6da43b82b22e4eaa10bcf8ee591e91abbfc587",
+					Author:      "Zachary Rice",
+					Email:       "zricer@protonmail.com",
+					Message:     "Accidentally add a secret",
+					RuleID:      "aws-access-key",
+					Tags:        []string{"key", "AWS"},
+					Entropy:     3.0841837,
+					Fingerprint: "1b6da43b82b22e4eaa10bcf8ee591e91abbfc587:main.go:aws-access-key:20",
+				},
+				{
+					Description: "AWS Access Key",
+					StartLine:   9,
+					EndLine:     9,
+					StartColumn: 17,
+					EndColumn:   36,
+					Secret:      "AKIALALEMEL33243OLIA",
+					Match:       "AKIALALEMEL33243OLIA",
+					Line:        "\n\taws_token := \"AKIALALEMEL33243OLIA\"",
+					File:        "foo/foo.go",
+					Date:        "2021-11-02T23:48:06Z",
+					Commit:      "491504d5a31946ce75e22554cc34203d8e5ff3ca",
+					Author:      "Zach Rice",
+					Email:       "zricer@protonmail.com",
+					Message:     "adding foo package with secret",
+					RuleID:      "aws-access-key",
+					Tags:        []string{"key", "AWS"},
+					Entropy:     3.0841837,
+					Fingerprint: "491504d5a31946ce75e22554cc34203d8e5ff3ca:foo/foo.go:aws-access-key:9",
+				},
+			},
+		},
+		{
+			source:   filepath.Join(repoBasePath, "small.git"),
+			logOpts:  "--all foo...",
+			revision: "foo",
+			cfgName:  "simple",
+			expectedFindings: []report.Finding{
+				{
+					Description: "AWS Access Key",
+					StartLine:   9,
+					EndLine:     9,
+					StartColumn: 17,
+					EndColumn:   36,
+					Secret:      "AKIALALEMEL33243OLIA",
+					Line:        "\n\taws_token := \"AKIALALEMEL33243OLIA\"",
+					Match:       "AKIALALEMEL33243OLIA",
+					Date:        "2021-11-02T23:48:06Z",
+					File:        "foo/foo.go",
+					Commit:      "491504d5a31946ce75e22554cc34203d8e5ff3ca",
+					Author:      "Zach Rice",
+					Email:       "zricer@protonmail.com",
+					Message:     "adding foo package with secret",
+					RuleID:      "aws-access-key",
+					Tags:        []string{"key", "AWS"},
+					Entropy:     3.0841837,
+					Fingerprint: "491504d5a31946ce75e22554cc34203d8e5ff3ca:foo/foo.go:aws-access-key:9",
+				},
+			},
+		},
+	}
+
+	err := moveDotGit("dotGit", ".git")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() {
+		if err := moveDotGit(".git", "dotGit"); err != nil {
+			t.Error(err)
+		}
+	}()
+
+	for _, tt := range tests {
+
+		viper.AddConfigPath(configPath)
+		viper.SetConfigName("simple")
+		viper.SetConfigType("toml")
+		err = viper.ReadInConfig()
+		if err != nil {
+			t.Error(err)
+		}
+
+		var vc config.ViperConfig
+		err = viper.Unmarshal(&vc)
+		if err != nil {
+			t.Error(err)
+		}
+		cfg, err := vc.Translate()
+		if err != nil {
+			t.Error(err)
+		}
+		detector := NewDetector(cfg)
+
+		// git show requires us to set GIT_DIR
+		os.Setenv("GIT_DIR", tt.source)
+		if err = detector.AddGitleaksIgnoreFromGit(tt.revision + ":" + ".gitleaksignore"); err != nil {
+			log.Fatal().Err(err).Msg("could not call AddGitleaksIgnore")
+		}
+		// For some reason git log will not work with GIT_DIR env var
+		os.Unsetenv("GIT_DIR")
+
+		findings, err := detector.DetectGit(tt.source, tt.logOpts, DetectType)
+		require.NoError(t, err)
+
+		for _, f := range findings {
+			f.Match = "" // remove lines cause copying and pasting them has some wack formatting
+		}
+		assert.ElementsMatch(t, tt.expectedFindings, findings)
+	}
+}
+
 func TestFromGitStaged(t *testing.T) {
 	tests := []struct {
 		cfgName          string

detect/git/git.go

@@ -2,6 +2,7 @@ package git
 
 import (
 	"bufio"
+	"bytes"
 	"errors"
 	"io"
 	"os/exec"
@@ -138,6 +139,84 @@ func (c *DiffFilesCmd) Wait() (err error) {
 	return c.cmd.Wait()
 }
 
+// FileExists allows to check if file exists in git tree.
+func FileExists(gitPath string) (bool, error) {
+	parts := strings.Split(gitPath, ":")
+	if len(parts) != 2 {
+		return false, errors.New("invalid git path")
+	}
+	object := parts[0]
+	path := parts[1]
+
+	cmd := exec.Command("git", "ls-tree", "-r", object, "--name-only")
+	log.Debug().Msgf("executing: %s", cmd.String())
+
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return false, err
+	}
+	stderr, err := cmd.StderrPipe()
+	if err != nil {
+		return false, err
+	}
+	if err := cmd.Start(); err != nil {
+		return false, err
+	}
+	defer cmd.Wait()
+
+	errCh := make(chan error)
+	go listenForStdErr(stderr, errCh)
+
+	scanner := bufio.NewScanner(stdout)
+	for scanner.Scan() {
+		if scanner.Text() == path {
+			return true, nil
+		}
+	}
+
+	if err, open := <-errCh; open {
+		return false, err
+	}
+
+	return false, nil
+}
+
+// ShowFile uses git show to show file. Useful to read .gitleaksignore without working tree
+// (e.g. while using gitleaks in git server hooks with bare repositories).
+func ShowFile(gitPath string) (io.Reader, error) {
+	cmd := exec.Command("git", "show", gitPath)
+	log.Debug().Msgf("executing: %s", cmd.String())
+
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return nil, err
+	}
+	stderr, err := cmd.StderrPipe()
+	if err != nil {
+		return nil, err
+	}
+	if err := cmd.Start(); err != nil {
+		return nil, err
+	}
+	defer cmd.Wait()
+
+	errCh := make(chan error)
+	go listenForStdErr(stderr, errCh)
+
+	// Func is designed to read mostly .gitleaksignore file which should not be big.
+	// Using buffer and io.Copy() should be okay.
+	buf := bytes.NewBuffer(nil)
+	if _, err := io.Copy(buf, stdout); err != nil {
+		return nil, err
+	}
+
+	if err, open := <-errCh; open {
+		return nil, err
+	}
+
+	return buf, nil
+}
+
 // listenForStdErr listens for stderr output from git, prints it to stdout,
 // sends to errCh and closes it.
 func listenForStdErr(stderr io.ReadCloser, errCh chan<- error) {
@@ -166,7 +245,10 @@ func listenForStdErr(stderr io.ReadCloser, errCh chan<- error) {
 			strings.Contains(scanner.Text(),
 				"inexact rename detection was skipped") ||
 			strings.Contains(scanner.Text(),
-				"you may want to set your diff.renameLimit") {
+				"you may want to set your diff.renameLimit") ||
+			// if git ls-tree check fails
+			strings.Contains(scanner.Text(),
+				"exists on disk, but not in") {
 			log.Warn().Msg(scanner.Text())
 		} else {
 			log.Error().Msgf("[git] %s", scanner.Text())

testdata/repos/small.git/COMMIT_EDITMSG

@@ -0,0 +1 @@
+feat: add .gitleaksignore

testdata/repos/small.git/FETCH_HEAD

@@ -0,0 +1 @@
+2e1db472eeba53f06c4026ae4566ea022e36598e		branch 'main' of github.com:gitleaks/test

testdata/repos/small.git/HEAD

@@ -0,0 +1 @@
+ref: refs/heads/main

testdata/repos/small.git/ORIG_HEAD

@@ -0,0 +1 @@
+cada78a9bf157ec05573f19e682d211f811c2e2d

testdata/repos/small.git/config

@@ -0,0 +1,13 @@
+[core]
+	repositoryformatversion = 0
+	filemode = true
+	bare = true
+	logallrefupdates = true
+	ignorecase = true
+	precomposeunicode = true
+[remote "origin"]
+	url = git@github.com:gitleaks/test.git
+	fetch = +refs/heads/*:refs/remotes/origin/*
+[branch "main"]
+	remote = origin
+	merge = refs/heads/main

testdata/repos/small.git/description

@@ -0,0 +1 @@
+Unnamed repository; edit this file 'description' to name the repository.