Added ADO CredScan support. (#2371)

* Added .tsv file for ADO Cred Scan task to use. * Changed credScanTargetFolders to .tsv extension * Removed build agent env variables from tsv * Changed paths in .tsv to try and match the build agent structure * Adjusted path to not be relative * Altered tsv paths again * Added CredScan suppressions. * Fixed suppressions * Adjusted CredScan folders. * Altered tsv paths * Trying another path format * Trying another path format * Removed quotes from path * Added all the desired paths * Changed delimiter from tab to newline * Added missing newline * Fixed tests.
2022-03-10 13:17:46 -08:00 · 2022-03-10 13:17:46 -08:00 · 56e05ed3d9
--- a/credScanSuppressions.json
+++ b/credScanSuppressions.json
@ -0,0 +1,17 @@
+{
+  "tool": "Credential Scanner",
+  "suppressions": [
+    {
+      "placeholder": "MOCK_TEST_SECRET",
+      "_justification": "This is a secret place holder used by my team in tests."
+    },
+    {
+      "placeholder": "MOCK_TEST_SECRET_1",
+      "_justification": "This is a secret place holder used by my team in tests."
+    },
+    {
+      "placeholder": "lgCbJPXnfOlatjbBDKMbh0ie6bc8PD/cjqA/2tPgMS0=",
+      "_justification": "This is a secret place holder used by my team in the botHelpers.spec.ts test file."
+    }
+  ]
+}
--- a/credScanTargetFolders.tsv
+++ b/credScanTargetFolders.tsv
@ -0,0 +1,9 @@
+/home/vsts/work/1/s/packages/app/client/src/
+/home/vsts/work/1/s/packages/app/main/src/
+/home/vsts/work/1/s/packages/app/shared/src/
+/home/vsts/work/1/s/packages/extensions/json/src/
+/home/vsts/work/1/s/packages/extensions/luis/client/src/
+/home/vsts/work/1/s/packages/extensions/qnamaker/client/src/
+/home/vsts/work/1/s/packages/sdk/client/src/
+/home/vsts/work/1/s/packages/sdk/shared/src/
+/home/vsts/work/1/s/packages/sdk/ui-react/src/
--- a/packages/app/client/src/state/sagas/endpointSagas.spec.ts
+++ b/packages/app/client/src/state/sagas/endpointSagas.spec.ts
@ -66,7 +66,7 @@ const mockBot = JSON.parse(`{
  "services": [{
      "type": "endpoint",
      "appId": "51fc2648-1190-44aa-9559-87b11b1d0014",
-      "appPassword": "vcxzvcxzvvxczvcxzv",
+      "appPassword": "MOCK_TEST_SECRET",
      "endpoint": "https://testbot.botframework.com/api/messagesv3",
      "id": "https://testbot.botframework.com/api/messagesv3",
      "name": "https://testbot.botframework.com/api/messagesv3"
@ -116,7 +116,7 @@ let mockRemoteCommandsCalled = [];
 const endpointService: IEndpointService = {
  appId: 'appId',
  name: 'service',
-  appPassword: 'password123',
+  appPassword: 'MOCK_TEST_SECRET',
  endpoint: 'http://localendpoint',
  channelService: 'channel service',
 };
--- a/packages/app/client/src/ui/dialogs/botCreationDialog/botCreationDialog.spec.tsx
+++ b/packages/app/client/src/ui/dialogs/botCreationDialog/botCreationDialog.spec.tsx
@ -149,7 +149,7 @@ describe('BotCreationDialog tests', () => {

  // it('should generate a new bot secret when reset is clicked', () => {
  //   const testWrapper = shallow(<BotCreationDialog/>);
-  //   const initialSecret = 'secret1';
+  //   const initialSecret = 'MOCK_TEST_SECRET';
  //   testWrapper.instance().setState({ secret: initialSecret, encryptKey: true });
  //   (testWrapper.instance() as any).onResetClick();
  //   const state = testWrapper.state() as Partial<BotCreationDialogState>;
@ -186,7 +186,7 @@ describe('BotCreationDialog tests', () => {
    (testWrapper.instance() as any).onInputChange(mockEvent as any);

    mockEvent.target.dataset.prop = 'appPassword';
-    mockEvent.target.value = 'somePw';
+    mockEvent.target.value = 'MOCK_TEST_SECRET';
    (testWrapper.instance() as any).onInputChange(mockEvent as any);

    mockEvent.target.dataset.prop = 'name';
@ -196,7 +196,7 @@ describe('BotCreationDialog tests', () => {
    const state = testWrapper.state() as Partial<BotCreationDialogState>;
    expect(state.endpoint.endpoint).toBe('someEndpoint');
    expect(state.endpoint.appId).toBe('someId');
-    expect(state.endpoint.appPassword).toBe('somePw');
+    expect(state.endpoint.appPassword).toBe('MOCK_TEST_SECRET');
    expect(state.bot.name).toBe('someName');
  });

--- a/packages/app/client/src/ui/dialogs/botSettingsEditor/botSettingsEditor.spec.tsx
+++ b/packages/app/client/src/ui/dialogs/botSettingsEditor/botSettingsEditor.spec.tsx
@ -207,7 +207,7 @@ describe('The BotSettingsEditor dialog should', () => {
      const instance = node.instance();
      instance.setState({
        path: SharedConstants.TEMP_BOT_IN_MEMORY_PATH,
-        secret: 'MsKgJGZJw7Vqw51YwpZhw7LCk2MzwpZZwoLDkMKPIWfCq8K7wobDp8OvwqvCmsO+EAY=',
+        secret: 'MOCK_TEST_SECRET',
      });
      await instance.onSaveClick();
      expect(mockRemoteCommandsCalled.length).toBe(7);
@ -239,7 +239,7 @@ describe('The BotSettingsEditor dialog should', () => {
            {
              displayName: '',
              path: '/test/path',
-              secret: 'MsKgJGZJw7Vqw51YwpZhw7LCk2MzwpZZwoLDkMKPIWfCq8K7wobDp8OvwqvCmsO+EAY=',
+              secret: 'MOCK_TEST_SECRET',
            },
          ],
          commandName: 'bot:list:patch',
@ -287,7 +287,7 @@ describe('The BotSettingsEditor dialog should', () => {
      const instance = node.instance();
      instance.setState({
        path: 'a/test/path',
-        secret: 'MsKgJGZJw7Vqw51YwpZhw7LCk2MzwpZZwoLDkMKPIWfCq8K7wobDp8OvwqvCmsO+EAY=',
+        secret: 'MOCK_TEST_SECRET',
      });
      await instance.onSaveClick();
      expect(mockRemoteCommandsCalled.length).toBe(3);
@ -297,7 +297,7 @@ describe('The BotSettingsEditor dialog should', () => {
          args: [
            'a/test/path',
            {
-              secret: 'MsKgJGZJw7Vqw51YwpZhw7LCk2MzwpZZwoLDkMKPIWfCq8K7wobDp8OvwqvCmsO+EAY=',
+              secret: 'MOCK_TEST_SECRET',
            },
          ],
        },
--- a/packages/app/client/src/ui/dialogs/resourcesSettings/resourcesSettings.spec.tsx
+++ b/packages/app/client/src/ui/dialogs/resourcesSettings/resourcesSettings.spec.tsx
@ -100,7 +100,7 @@ describe('The ResourcesSettings component should', () => {
            "name": "https://testbot.botframework.com/api/messagesv3",
            "id": "https://testbot.botframework.com/api/messagesv3",
            "appId": "51fc2648-1190-44fa-9559-87b11b1d0014",
-            "appPassword": "ter65rtgfgfdsgfsg",
+            "appPassword": "MOCK_TEST_SECRET",
            "endpoint": "https://testbot.botframework.com/api/messagesv3"
        }]
      }`);
--- a/packages/app/client/src/ui/shell/explorer/endpointExplorer/endpointEditor/endpointEditor.spec.tsx
+++ b/packages/app/client/src/ui/shell/explorer/endpointExplorer/endpointEditor/endpointEditor.spec.tsx
@ -58,7 +58,7 @@ const mockBot = {
    {
      type: 'endpoint',
      appId: '51fc2648-1190-44aa-9559-87b11b1d0014',
-      appPassword: 'vcxzvcxzvvxczvcxzv',
+      appPassword: 'MOCK_TEST_SECRET',
      endpoint: 'https://testbot.botframework.com/api/messagesv3',
      id: 'https://testbot.botframework.com/api/messagesv3',
      name: 'https://testbot.botframework.com/api/messagesv3',
@ -209,7 +209,7 @@ describe('The EndpointExplorer component should', () => {
    expect(hideDialogSpy).toHaveBeenCalledWith([
      {
        appId: '51fc2648-1190-44aa-9559-87b11b1d0014',
-        appPassword: 'vcxzvcxzvvxczvcxzv',
+        appPassword: 'MOCK_TEST_SECRET',
        endpoint: 'https://testbot.botframework.com/api/messagesv3',
        id: 'https://testbot.botframework.com/api/messagesv3',
        name: 'https://testbot.botframework.com/api/messagesv3',
--- a/packages/app/client/src/ui/shell/explorer/endpointExplorer/endpointExplorer.spec.tsx
+++ b/packages/app/client/src/ui/shell/explorer/endpointExplorer/endpointExplorer.spec.tsx
@ -72,7 +72,7 @@ const mockBot = {
    {
      type: 'endpoint',
      appId: '51fc2648-1190-44aa-9559-87b11b1d0014',
-      appPassword: 'vcxzvcxzvvxczvcxzv',
+      appPassword: 'MOCK_TEST_SECRET',
      endpoint: 'https://testbot.botframework.com/api/messagesv3',
      id: 'https://testbot.botframework.com/api/messagesv3',
      name: 'https://testbot.botframework.com/api/messagesv3',
--- a/packages/app/client/src/ui/shell/explorer/resourcesBar/resourcesBar.spec.tsx
+++ b/packages/app/client/src/ui/shell/explorer/resourcesBar/resourcesBar.spec.tsx
@ -71,7 +71,7 @@ describe('The ServicesExplorer component should', () => {
            "name": "https://testbot.botframework.com/api/messagesv3",
            "id": "https://testbot.botframework.com/api/messagesv3",
            "appId": "51fc2648-1190-44fa-9559-87b11b1d0014",
-            "appPassword": "jxZjGcOpyfM4q75vp2paNQd",
+            "appPassword": "MOCK_TEST_SECRET",
            "endpoint": "https://testbot.botframework.com/api/messagesv3"
        }]
      }`);
--- a/packages/app/client/src/ui/shell/explorer/servicesExplorer/connectedServicePicker/connectedServicePicker.spec.tsx
+++ b/packages/app/client/src/ui/shell/explorer/servicesExplorer/connectedServicePicker/connectedServicePicker.spec.tsx
@ -78,7 +78,7 @@ describe('The ConnectedServicePicker component', () => {
            "name": "https://testbot.botframework.com/api/messagesv3",
            "id": "https://testbot.botframework.com/api/messagesv3",
            "appId": "51fc2648-1190-44fa-9559-87b11b1d0014",
-            "appPassword": "jxZjGcOpyfM4q75vp2paNQd",
+            "appPassword": "MOCK_TEST_SECRET",
            "endpoint": "https://testbot.botframework.com/api/messagesv3"
        }]
      }`);
--- a/packages/app/client/src/ui/shell/explorer/servicesExplorer/servicesExplorer.spec.tsx
+++ b/packages/app/client/src/ui/shell/explorer/servicesExplorer/servicesExplorer.spec.tsx
@ -123,7 +123,7 @@ describe('The ServicesExplorer component', () => {
            "name": "https://testbot.botframework.com/api/messagesv3",
            "id": "https://testbot.botframework.com/api/messagesv3",
            "appId": "51fc2648-1190-44fa-9559-87b11b1d0014",
-            "appPassword": "jxZjGcOpyfM4q75vp2paNQd",
+            "appPassword": "MOCK_TEST_SECRET",
            "endpoint": "https://testbot.botframework.com/api/messagesv3"
        }]
      }`);
--- a/packages/app/main/src/botHelpers.spec.ts
+++ b/packages/app/main/src/botHelpers.spec.ts
@ -89,7 +89,7 @@ jest.mock('./state/store', () => ({
          { path: 'path1', displayName: 'name1', secret: '' },
          { path: 'path2', displayName: 'name2', secret: '' },
          { path: 'path3', displayName: 'name3', secret: '' },
-          { path: 'path4', displayName: 'name4', secret: 'ffsafsdfdsa' },
+          { path: 'path4', displayName: 'name4', secret: 'MOCK_TEST_SECRET' },
        ],
      },
    }),
@ -189,7 +189,7 @@ describe('The botHelpers', () => {
    commandService.remoteCall = jest
      .fn()
      .mockImplementationOnce(() => Promise.resolve(null))
-      .mockImplementation(() => Promise.resolve('secret'));
+      .mockImplementation(() => Promise.resolve('MOCK_TEST_SECRET'));

    // if prompt for secret is dismissed, this should return null
    expect(await BotHelpers.promptForSecretAndRetry('somePath')).toBe(null);
@ -210,11 +210,11 @@ describe('The botHelpers', () => {
      jest
        .spyOn(BotHelpers, 'toSavableBot')
        .mockReturnValueOnce({ save: mockSave, validateSecret: mockValidateSecret });
-      const result = await BotHelpers.saveBot({ path: 'path' } as any, 'secret');
+      const result = await BotHelpers.saveBot({ path: 'path' } as any, 'MOCK_TEST_SECRET');

      expect(result).toBe(true);
-      expect(mockValidateSecret).toHaveBeenCalledWith('secret');
-      expect(mockSave).toHaveBeenCalledWith('secret');
+      expect(mockValidateSecret).toHaveBeenCalledWith('MOCK_TEST_SECRET');
+      expect(mockSave).toHaveBeenCalledWith('MOCK_TEST_SECRET');
    });

    it('should save a bot using the secret from the store', async () => {
@ -223,12 +223,12 @@ describe('The botHelpers', () => {
      jest
        .spyOn(BotHelpers, 'toSavableBot')
        .mockReturnValueOnce({ save: mockSave, validateSecret: mockValidateSecret });
-      jest.spyOn(CredentialManager, 'getPassword').mockResolvedValueOnce('secret');
+      jest.spyOn(CredentialManager, 'getPassword').mockResolvedValueOnce('MOCK_TEST_SECRET');
      const result = await BotHelpers.saveBot({ path: 'path' } as any, undefined);

      expect(result).toBe(true);
-      expect(mockValidateSecret).toHaveBeenCalledWith('secret');
-      expect(mockSave).toHaveBeenCalledWith('secret');
+      expect(mockValidateSecret).toHaveBeenCalledWith('MOCK_TEST_SECRET');
+      expect(mockSave).toHaveBeenCalledWith('MOCK_TEST_SECRET');
    });
  });

@ -237,13 +237,13 @@ describe('The botHelpers', () => {
      const botConfigLoadSpy = jest
        .spyOn(BotConfiguration, 'load')
        .mockResolvedValueOnce({ path: 'path', name: 'boticus' });
-      const getPasswordSpy = jest.spyOn(CredentialManager, 'getPassword').mockResolvedValueOnce('secret');
+      const getPasswordSpy = jest.spyOn(CredentialManager, 'getPassword').mockResolvedValueOnce('MOCK_TEST_SECRET');
      const setPasswordSpy = jest.spyOn(CredentialManager, 'setPassword');
      jest.spyOn(BotHelpers, 'pathExistsInRecentBots').mockReturnValueOnce(false);
      const patchBotsSpy = jest.spyOn(BotHelpers, 'patchBotsJson').mockResolvedValueOnce(true);
-      const result = await BotHelpers.loadBotWithRetry('path', 'secret');
+      const result = await BotHelpers.loadBotWithRetry('path', 'MOCK_TEST_SECRET');

-      expect(botConfigLoadSpy).toHaveBeenCalledWith('path', 'secret');
+      expect(botConfigLoadSpy).toHaveBeenCalledWith('path', 'MOCK_TEST_SECRET');
      expect(patchBotsSpy).toHaveBeenCalledWith('path', { path: 'path', displayName: 'boticus' });
      expect(getPasswordSpy).toHaveBeenCalledWith('path');
      expect(setPasswordSpy).not.toHaveBeenCalled();
@ -264,9 +264,9 @@ describe('The botHelpers', () => {
      const setPasswordSpy = jest.spyOn(CredentialManager, 'setPassword');
      jest.spyOn(BotHelpers, 'pathExistsInRecentBots').mockReturnValueOnce(false);
      jest.spyOn(BotHelpers, 'patchBotsJson').mockResolvedValueOnce(true);
-      const result = await BotHelpers.loadBotWithRetry('path', 'secret');
+      const result = await BotHelpers.loadBotWithRetry('path', 'MOCK_TEST_SECRET');

-      expect(setPasswordSpy).toHaveBeenCalledWith('path', 'secret');
+      expect(setPasswordSpy).toHaveBeenCalledWith('path', 'MOCK_TEST_SECRET');
      expect(result).toEqual({
        description: '',
        name: 'boticus',
@ -280,13 +280,13 @@ describe('The botHelpers', () => {

    it('should update the secret in the store if it does not match the supplied secret', async () => {
      jest.spyOn(BotConfiguration, 'load').mockResolvedValueOnce({ path: 'path', name: 'boticus' });
-      jest.spyOn(CredentialManager, 'getPassword').mockResolvedValueOnce('otherSecret');
+      jest.spyOn(CredentialManager, 'getPassword').mockResolvedValueOnce('MOCK_TEST_SECRET_1');
      const setPasswordSpy = jest.spyOn(CredentialManager, 'setPassword');
      jest.spyOn(BotHelpers, 'pathExistsInRecentBots').mockReturnValueOnce(false);
      jest.spyOn(BotHelpers, 'patchBotsJson').mockResolvedValueOnce(true);
-      const result = await BotHelpers.loadBotWithRetry('path', 'secret');
+      const result = await BotHelpers.loadBotWithRetry('path', 'MOCK_TEST_SECRET');

-      expect(setPasswordSpy).toHaveBeenCalledWith('path', 'secret');
+      expect(setPasswordSpy).toHaveBeenCalledWith('path', 'MOCK_TEST_SECRET');
      expect(result).toEqual({
        description: '',
        name: 'boticus',
@ -307,8 +307,8 @@ describe('The botHelpers', () => {
        .mockResolvedValueOnce({ path: 'path' });
      const loadBotWithRetrySpy = jest.spyOn(BotHelpers, 'loadBotWithRetry');
      jest.spyOn(BotHelpers, 'pathExistsInRecentBots').mockReturnValue(true);
-      jest.spyOn(CredentialManager, 'getPassword').mockResolvedValue('secret');
-      const result = await BotHelpers.loadBotWithRetry('path', 'secret');
+      jest.spyOn(CredentialManager, 'getPassword').mockResolvedValue('MOCK_TEST_SECRET');
+      const result = await BotHelpers.loadBotWithRetry('path', 'MOCK_TEST_SECRET');

      expect(result).toEqual({
        description: '',
--- a/packages/app/main/src/server/state/botEndpoint.spec.ts
+++ b/packages/app/main/src/server/state/botEndpoint.spec.ts
@ -51,14 +51,14 @@ describe('BotEndpoint', () => {
  it('should return the speech token if it already exists', async () => {
    const endpoint = new BotEndpoint('', '', '', 'msaAppId', 'msaAppPw');
    endpoint.speechAuthenticationToken = {
-      accessToken: 'someToken',
+      accessToken: 'MOCK_TEST_SECRET',
      region: 'westus2',
      expireAt: Date.now() + 10 * 1000 * 60, // expires in 10 minutes
      tokenLife: 10 * 1000 * 60, // token life of 10 minutes
    };
    const refresh = false;
    const token = await endpoint.getSpeechToken(refresh);
-    expect(token).toBe('someToken');
+    expect(token).toBe('MOCK_TEST_SECRET');
  });

  it('should return a new speech token if the current token is expired', async () => {
@ -106,7 +106,7 @@ describe('BotEndpoint', () => {
    jest.spyOn(endpoint as any, 'fetchWithAuth').mockResolvedValueOnce({
      json: () =>
        Promise.resolve({
-          access_Token: 'someSpeechToken',
+          access_Token: 'MOCK_TEST_SECRET',
          region: 'westus2',
          expireAt: 1234,
          tokenLife: 9999,
@ -115,7 +115,7 @@ describe('BotEndpoint', () => {
    });
    const token = await (endpoint as any).fetchSpeechToken();

-    expect(token).toBe('someSpeechToken');
+    expect(token).toBe('MOCK_TEST_SECRET');
  });

  it('should throw when failing to read the token response', async () => {
@ -245,9 +245,8 @@ describe('BotEndpoint', () => {
  it('should return the access token if it already exists and has not expired yet', async () => {
    const endpoint = new BotEndpoint();
    const msaAppId = 'someAppId';
-    const msaPw = 'someAppPw';
    endpoint.msaAppId = msaAppId;
-    endpoint.msaPassword = msaPw;
+    endpoint.msaPassword = 'MOCK_TEST_SECRET';
    endpoint.use10Tokens = false;
    endpoint.channelService = undefined;
    // ensure that the token won't be expired
@ -270,7 +269,7 @@ describe('BotEndpoint', () => {
      body: new URLSearchParams({
        grant_type: 'client_credentials',
        client_id: msaAppId,
-        client_secret: msaPw,
+        client_secret: 'MOCK_TEST_SECRET',
        scope: `${msaAppId}/.default`,
      } as { [key: string]: string }).toString(),
      headers: {
@ -292,7 +291,7 @@ describe('BotEndpoint', () => {
      body: new URLSearchParams({
        grant_type: 'client_credentials',
        client_id: msaAppId,
-        client_secret: msaPw,
+        client_secret: 'MOCK_TEST_SECRET',
        scope: `${msaAppId}/.default`,
        atver: '1',
      } as { [key: string]: string }).toString(),
@ -305,7 +304,7 @@ describe('BotEndpoint', () => {
  it('should throw when requesting an access returns a bad response', async () => {
    const endpoint = new BotEndpoint();
    const msaAppId = 'someAppId';
-    const msaPw = 'someAppPw';
+    const msaPw = 'MOCK_TEST_SECRET';
    endpoint.msaAppId = msaAppId;
    endpoint.msaPassword = msaPw;
    endpoint.use10Tokens = false;
--- a/packages/app/main/src/server/state/endpointSet.spec.ts
+++ b/packages/app/main/src/server/state/endpointSet.spec.ts
@ -56,7 +56,7 @@ describe('Endpoints', () => {
      botId: 'someBotId',
      botUrl: 'someBotUrl',
      msaAppId: 'someMsaAppId',
-      msaPassword: 'someMsaPassword',
+      msaPassword: 'MOCK_TEST_SECRET',
      use10Tokens: false,
      channelService: undefined,
    };
@ -169,21 +169,21 @@ describe('Endpoints', () => {
      botId: 'botId1',
      botUrl: 'botUrl1',
      msaAppId: 'msaAppId1',
-      msaPassword: 'msaPassword1',
+      msaPassword: 'MOCK_TEST_SECRET',
      use10Tokens: 'use10Tokens1',
    };
    const endpoint2 = {
      botId: 'botId2',
      botUrl: 'botUrl2',
      msaAppId: 'msaAppId2',
-      msaPassword: 'msaPassword2',
+      msaPassword: 'MOCK_TEST_SECRET',
      use10Tokens: 'use10Tokens2',
    };
    const endpoint3 = {
      botId: 'botId3',
      botUrl: 'botUrl3',
      msaAppId: 'msaAppId3',
-      msaPassword: 'msaPassword3',
+      msaPassword: 'MOCK_TEST_SECRET',
      use10Tokens: 'use10Tokens3',
    };
    (endpoints as any)._endpoints['id1'] = endpoint1;
--- a/packages/sdk/shared/src/utils/bot.spec.ts
+++ b/packages/sdk/shared/src/utils/bot.spec.ts
@ -110,7 +110,7 @@ describe('Bot utility function tests', () => {
      id: 'http://www.endpoint1.com/api/messages',
      endpoint: 'http://www.endpoint1.com/api/messages',
      appId: 'someAppId1',
-      appPassword: 'someAppPw1',
+      appPassword: 'MOCK_TEST_SECRET',
    };

    const endpoint2: Partial<IEndpointService> = {