PRP: JDBC secret veles and validator

[grandsilva]

#1008

I tried to add parsers for all examples of JDBC URLs I could find for MySQL, PostgreSQL, and MSSQL.
Currently, I parsed the JDBC URLS and only extracted hosts in the detector because we only need to determine if the hosts are local or not.
Inside the validate function, the database name and user/pass are extracted.

[alessandro-Doyensec]

Since we can validate only PublicDBs I would rename IsLocalDB to IsPublicDB (and modify the logic accordingly) or something similar.

[alessandro-Doyensec]

Hello @grandsilva

Any update on this?

[grandsilva]

I think I explained it here: #1774 (comment)
Local databases are still important, according to this @erikvarga's comment: #1008 (comment)

[alessandro-Doyensec]

Hello @grandsilva

Thanks for the contribution!

1. Please checkout the comments I left for you to address

2. Remember to add the plugin to the docs/supported_inventory_types.md file.

3. Regarding:

   Currently, I parsed the JDBC URLS and only extracted hosts in the detector because we only need to determine if the hosts are local or not.

   I think it might also make sense to extract credentials in the detection step to be sure they're not empty. This may be redundant with the regex extraction though, so we can discuss it.

[grandsilva]

@alessandro-Doyensec Hi
I think the purpose of running scalibr is checking for local file systems, whether the extracted URLs are local or public, we should notify the users in both cases.

I think it might also make sense to extract credentials in the detection step to be sure they're not empty. This may be redundant with the regex extraction though, so we can discuss it.

Extracting secrets here means the URLs, not the credentials of the URLs.
Exposed JDBC URLs can be dangerous, since they can be used to quickly identify the IP and open ports on the system instead of scanning the whole ip ranges.
The reason that we are extracting the Host, port, and credentials is that we can connect to these JDBC URLs in the Validator; Otherwise, I wouldn't parse these kinds of URLs from the beginning.
JDBC URLs are different than ordinary HTTP URLs, so I think the URL itself can be a secret.

[alessandro-Doyensec]

Hello @grandsilva

Looking at 285b9f9 I think some changes have not been included: for example I don't see the IsLocalHost function or the IsLocalDB field being renamed.

[alessandro-Doyensec]

Note: I suspect that the changes to the docs/supported_inventory_types.md file will cause a lot of merge conflicts, could you please modify only the relevant section?

[alessandro-Doyensec]

Hello @grandsilva

Thanks for the changes. I left a few comments for you to address.

[alessandro-Doyensec]

Hello @grandsilva

Thanks for the changes, the PR looks good to me