Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: add typosquatting analyzer for go modules #481

Merged
merged 7 commits into from
Nov 13, 2024
Merged

feat: add typosquatting analyzer for go modules #481

merged 7 commits into from
Nov 13, 2024

Conversation

bthuilot
Copy link
Contributor

@bthuilot bthuilot commented Oct 30, 2024 •
edited
Loading

Changes

  • Adds typosquatting analyzer for go modules
  • Adds top_go_packages.json which contains top ~3000 go modules
    • List was gathered by searching for go.mod files on GitHub with more than 50 stars
    • Parsed the go.mod files and counted the amount of each pacakge used, then took all packages used in more than 10 repos

@bthuilot
feat: add typosquatting detector for go modules
7de87f4 
Signed-off-by: Bryce Thuilot <bryce.thuilot@datadoghq.com>
@bthuilot bthuilot requested a review from juliendoutre October 30, 2024 13:53
@bthuilot bthuilot self-assigned this Oct 30, 2024
@sobregosodd
Copy link
Contributor

sobregosodd commented Oct 30, 2024 •
edited
Loading

which contains top 500 go modules

@bthuilot mind that we are using about 8k packages in other ecosystems for this detection

@bthuilot
fix: linting
ca9c9fa 
Signed-off-by: Bryce Thuilot <bryce.thuilot@datadoghq.com>
@bthuilot
chore: update top go packages
657d4ad 
Signed-off-by: Bryce Thuilot <bryce.thuilot@datadoghq.com>
juliendoutre
juliendoutre reviewed Nov 4, 2024
View reviewed changes
Copy link
Contributor

@juliendoutre juliendoutre left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me but noticed a few commented code sections which may not be intentional?

guarddog/analyzer/metadata/go/typosquatting.py Outdated Show resolved Hide resolved
guarddog/analyzer/metadata/go/typosquatting.py Outdated Show resolved Hide resolved
guarddog/analyzer/metadata/go/typosquatting.py Outdated Show resolved Hide resolved
@bthuilot
refactor: remove dead code
9f7af5b 
Signed-off-by: Bryce Thuilot <bryce.thuilot@datadoghq.com>
@bthuilot
refactor: move _get_confused_forms to abstract method
65b4db9 
Signed-off-by: Bryce Thuilot <bryce.thuilot@datadoghq.com>
@bthuilot
docs: update go typosquat function comments
8fdce60 
Signed-off-by: Bryce Thuilot <bryce.thuilot@datadoghq.com>
@bthuilot
fix: implement abstract method for NPM typosquat
3453290 
Signed-off-by: Bryce Thuilot <bryce.thuilot@datadoghq.com>
@bthuilot bthuilot requested a review from sobregosodd November 12, 2024 17:53
@bthuilot bthuilot merged commit dd87387 into main Nov 13, 2024
10 checks passed
@bthuilot bthuilot deleted the bryce.thuilot/sint-2270 branch November 13, 2024 19:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@datadog-datadog-prod-us1 datadog-datadog-prod-us1[bot] datadog-datadog-prod-us1[bot] left review comments

@juliendoutre juliendoutre juliendoutre left review comments

@sobregosodd sobregosodd sobregosodd approved these changes

Assignees

@bthuilot bthuilot

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@bthuilot @sobregosodd @juliendoutre