Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ BUG FIX ] The first commit was missed #83

Merged
merged 1 commit into from
Apr 2, 2018

Conversation

kings-way
Copy link

If some code exists in a repo from the first commit and stays unchanged, or there is only one commit in a repo, trufflehog are not going to check the code in the first commit.

Here is a simple solution :)

@codecov-io
Copy link

Codecov Report

Merging #83 into master will increase coverage by 0.14%.
The diff coverage is 4.16%.

Impacted file tree graph

@@           Coverage Diff           @@
##           master   #83      +/-   ##
=======================================
+ Coverage   31.85%   32%   +0.14%     
=======================================
  Files           4     4              
  Lines         248   250       +2     
=======================================
+ Hits           79    80       +1     
- Misses        169   170       +1
Impacted Files Coverage Δ
truffleHog/truffleHog.py 26.99% <4.16%> (+0.2%) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 461953f...e3e2dfa. Read the comment docs.

@dxa4481
Copy link
Collaborator

dxa4481 commented Jan 29, 2018

Hi @kings-way I've merged this into dev. There was a problem I was having, basically when you casted the entire commit tree to a list, it can consume lots of memory if the commit tree is huge. To solve this I've implemented a hacky work around you can see here https://github.com/dxa4481/truffleHog/blob/dev/truffleHog/truffleHog.py#L240

Basically, because we can't diff NULL_TREE against current diff, I flip them around for the first diff. I'm not super happy with this solution, because it pulls the wrong commit message and date for the first commit, and shows the diff in reverse, but it's at least showing results.

Do you have any ideas for how to fix this without casting the entire commit tree to a list?

@kings-way
Copy link
Author

kings-way commented Feb 1, 2018

Hi @dxa4481
Actually, your code at this time does not work as well..... For two scenarios:

  1. There is only one commit, your code works well.
  2. There are more than one commit, but the sensitive string exists from the first commit and never be changed. Which you still miss for now ......

For my own project, I got a very different solution.
There is no need to diff between every two commits. In fact, we could diff every commit with NULL_TREE, and this works actually.

A sample code from my private project:

for remote_branch in repo.remotes.origin.fetch():
    repo.git.checkout(remote_branch.name)
    for commit in repo.iter_commits(max_count=max_depth):
        diff_list = commit.diff(NULL_TREE, create_patch=True, unified=0)
        for item in diff_list:
            diff_text = item.diff.decode('utf-8', errors='replace')
            if diff_text.startswith("Binary files"):
                continue
            # do something
        if str(commit) == since_commit:
            break

@dxa4481 dxa4481 merged commit e3e2dfa into trufflesecurity:master Apr 2, 2018
dustin-decker pushed a commit that referenced this pull request Apr 3, 2022
Bumps [github.com/aws/aws-sdk-go](https://github.com/aws/aws-sdk-go) from 1.43.18 to 1.43.19.
- [Release notes](https://github.com/aws/aws-sdk-go/releases)
- [Changelog](https://github.com/aws/aws-sdk-go/blob/main/CHANGELOG.md)
- [Commits](aws/aws-sdk-go@v1.43.18...v1.43.19)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

3 participants