tirith 0.3.0

Terminal security - catches homograph attacks, pipe-to-shell, ANSI injection
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

use std::fs;

pub fn run(json: bool) -> i32 {
    let path = match tirith_core::policy::data_dir() {
        Some(d) => d.join("last_trigger.json"),
        None => {
            eprintln!("tirith: cannot determine data directory");
            return 1;
        }
    };

    if !path.exists() {
        eprintln!("tirith: no recent trigger found");
        return 1;
    }

    let content = match fs::read_to_string(&path) {
        Ok(c) => c,
        Err(e) => {
            eprintln!("tirith: failed to read last trigger: {e}");
            return 1;
        }
    };

    if json {
        println!("{content}");
        return 0;
    }

    let val: serde_json::Value = match serde_json::from_str(&content) {
        Ok(v) => v,
        Err(e) => {
            eprintln!("tirith: failed to parse last trigger: {e}");
            return 1;
        }
    };

    eprintln!("tirith: last trigger");
    if let Some(ts) = val.get("timestamp").and_then(|v| v.as_str()) {
        eprintln!("  when: {ts}");
    }
    if let Some(cmd) = val.get("command_redacted").and_then(|v| v.as_str()) {
        eprintln!("  command: {cmd}");
    }
    if let Some(severity) = val.get("severity").and_then(|v| v.as_str()) {
        eprintln!("  severity: {severity}");
    }
    if let Some(rules) = val.get("rule_ids").and_then(|v| v.as_array()) {
        for rule in rules {
            if let Some(r) = rule.as_str() {
                eprintln!("  rule: {r}");
            }
        }
    }
    if let Some(findings) = val.get("findings").and_then(|v| v.as_array()) {
        for finding in findings {
            if let Some(title) = finding.get("title").and_then(|v| v.as_str()) {
                eprintln!("  - {title}");
            }
            if let Some(desc) = finding.get("description").and_then(|v| v.as_str()) {
                eprintln!("    {desc}");
            }
        }
    }

    0
}