Week_6 : Coding period - Progress Report

GSoC Projects Plugin Ecosystem Security
1

PROGRESS :

HALFWAY THROUGH THERE!

This week I focused on reifing the CodeQl custom ruleset for scanning, worked on the scanning workflow to make it reviewer friendly and finalized the code of the scan plugin YAML file - that will be responsible for running the scan on github when issue is opened.

I have created the PLAN.md in the root of the repository and added a section mentioning detailed shedule for the upcoming week :

I have finalized the current rules and tested them locally on the top 20 plugins. All of them passed with no findings. (This indicated 0 false positive on top 20 plugins for now)

Then I also ran the updated rules on one of the test plugin I made weeks ago : [Plugin Submission] joplin-plugin-test v1.0.0 · Issue #30 · akshajrawat/plugins-test · GitHub , the workflow was working fine. This week I'll just go through it once more to finalize the code.

I will now start making few test plugins that can be used to verify if the rules are doing what they are supposed to do, using the test mock code in the plugins-test repository, so we can also confirm that the test code are also checking their respective rules.

The update registry workflow, that will work to update the registry and github release will depend on the code we have to get merged on `plugin-repo-cli.

So the plan for the next 2 week is to test the scanner with custom malicious code and in parallel work on getting the plugin-repo-cli get merged.

PR left :

  • 1 generator-joplin pr left to merge
  • 1 plugin-cli pr left to merge

Pr merged :

2

Hi, regarding PLAN.md, here's my feedback:

  • Run the scanner against the Top 20 Joplin plugins. Adjust rules to ensure close to zero false positives.

It should not be "close to zero", it should be zero, that's a hard requirement. If the scanner is failing on known safe plugins it is not working as it should. So please update this part.

Milestone 2: SAST Scanning using CodeQl and Repository update (UPDATE WORKFLOW LEFT)

Under this milestone, please add the following:

  • Create an action that fetches all the top 20 plugins and run the rules against them. There should be no error or warning
  • Setup the GitHub Actions so that the workflow runs every time a rule is changed or added.

Milestone 4: Validation & Tuning (Top 20 + Threats)

As a deliverable, please provide a video showing the complete workflow:

  • A developer runs npm run publish on a fresh plugin
  • The issue is created on the repository
  • The workflows run and check the plugin
  • A report is generated for reviewers
  • The reviewer approve the plugin with a "status: approved" label (for example)
  • The .jpl artifact appears on the test registry's "plugins" folder
  • The manifests.json file is updated with the new plugin entry

Deliverable date

Please add the planned date for each deliverable.