Skip to content

Commit

Permalink
use six for config parser, add to reqs
Browse files Browse the repository at this point in the history
ditch checkign access_key (don't consider these a secret)
don't check line by line, check the whole file in bulk instead
  • Loading branch information
arahayrabedian committed Jun 12, 2015
1 parent 95bf20d commit 3078aec
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 20 deletions.
31 changes: 11 additions & 20 deletions pre_commit_hooks/detect_aws_credentials.py
Original file line number Diff line number Diff line change
Expand Up @@ -2,36 +2,35 @@
from __future__ import unicode_literals

import argparse
import ConfigParser
import os
from six.moves import configparser


def get_your_keys(credentials_file, ignore_access_key=False):
""" reads the keys in your credentials file in order to be able to look
def get_your_keys(credentials_file):
""" reads the secret keys in your credentials file in order to be able to look
for them in the submitted code.
"""
aws_credentials_file_path = os.path.expanduser(credentials_file)
if not os.path.exists(aws_credentials_file_path):
exit(2)

parser = ConfigParser.ConfigParser()
parser = configparser.ConfigParser()
parser.read(aws_credentials_file_path)

keys = set()
for section in parser.sections():
if not ignore_access_key:
keys.add(parser.get(section, 'aws_access_key_id'))
keys.add(parser.get(section, 'aws_secret_access_key'))
print(str(keys))
return keys


def check_file_for_aws_keys(filename, keys):
with open(filename, 'r') as content:
# naively match the entire file, chances be so slim
# of random characters matching your flipping key.
for line in content:
if any(key in line for key in keys):
return 1
text_body = content.read()
if any(key in text_body for key in keys):
return 1
return 0


Expand All @@ -41,19 +40,11 @@ def main(argv=None):
parser.add_argument(
"--credentials-file",
default='~/.aws/credentials',
help="location of aws credentials file from which to get the keys "
"we're looking for",
)
parser.add_argument(
"--ignore-access-key",
action='store_true',
help="if you would like to ignore access keys, as there is "
"occasionally legitimate use for these.",
help="location of aws credentials file from which to get the secret "
"keys we're looking for",
)
args = parser.parse_args(argv)
ignore_access_key = args.ignore_access_key
keys = get_your_keys(args.credentials_file,
ignore_access_key=ignore_access_key)
keys = get_your_keys(args.credentials_file)

retv = 0
for filename in args.filenames:
Expand Down
1 change: 1 addition & 0 deletions requirements-dev.txt
Original file line number Diff line number Diff line change
Expand Up @@ -7,3 +7,4 @@ mock
pre-commit
pylint<1.4
pytest
six==1.9.0

0 comments on commit 3078aec

Please sign in to comment.