SEDATED

The SEDATED® Project (Sensitive Enterprise Data Analyzer To Eliminate Disclosure) focuses on preventing sensitive data such as user credentials and tokens from being pushed to Git.

Table of Contents

• Purpose
• Setup
  • Clone down SEDATED®
  • Update .example files
  • Customize /config/custom_configs.sh variables and functions (as desired)
  • Push SEDATED® with Organization Specific Implementation
  • Point pre-receive hook to SEDATED®'s pre-receive.sh file
• Local Testing
• File Descriptions
  • pre-receive.sh
  • /config/custom_configs.sh
  • /config/enforced_repos_list.txt
  • /config/regexes.json
  • /config/whitelists/commit_whitelist.txt
  • /config/whitelists/repo_whitelist.txt
  • /testing/regex_testing/regex_test_script.sh
  • /testing/regex_testing/test_cases.txt
• Customization
  • Custom Variables
  • Custom Functions
• Compatibility
  • GitHub
  • GitLab
  • Git
  • Any Other Git SCM Tool
• Contribute
• Authors
• License

Purpose

With the myriad of code changes required in today's CICD environment developers are constantly pushing code that could unintentionally contain sensitive information. This potential sensitive data exposure represents a huge risk to organizations (2017 OWASP Top Ten #3 - Sensitive Data Exposure). SEDATED® addresses this issue by automatically reviewing all incoming code changes and providing instant feedback to the developer. If it identifies sensitive data it will prevent the commit(s) from being pushed to the Git server.

**NOTE: ONLY lines being added or modified (beginning with + in the patch file) in commit pushes are scanned by SEDATED®. Lines that are being removed (beginning with - in the patch file) in commit pushes are NOT scanned by SEDATED®.

Setup

1. Clone down SEDATED®

git clone https://github.com/OWASP/SEDATED.git

cd SEDATED/

2. Update .example files

cp /config/whitelists/commit_whitelist.txt.example /config/whitelists/commit_whitelist.txt

cp /config/whitelists/repo_whitelist.txt.example /config/whitelists/repo_whitelist.txt

cp /config/enforced_repos_list.txt.example /config/enforced_repos_list.txt

3. Customize /config/custom_configs.sh Variables and Functions (as desired)

4. Push SEDATED® with Organization Specific Implementation

Push organization specific implementation of SEDATED® to organization's desired Git repository (GitHub, GitLab, Git, etc...).

5. Point pre-receive hook to SEDATED®'s pre-receive.sh file

Instructions for accomplishing this on a GitHub Enterprise instance can be found in GitHub_Enterprise_Setup.md.

Local Testing

• GitHub Docker Setup - General instructions for setting up a GitHub docker container to act as a Git server with a pre-receive hook enabled for local testing.
  • Some modifications will need to be made to allow SEDATED® to function as designed.
    • always_reject.sh will need to be replaced with the SEDATED® pre-receive.sh script.
    • SEDATED®'s accompanying files/folder structure will need to be included in the same directory/accessible by the pre-receive.sh script.
    • Some additional tweaks may be required as well, but the instructions linked above are a good starting point for local testing.