Legit-Labs/legitify

Remediation Steps in Output are Formatted as Double Numbered List

Closed this issue · 5 comments

ajh- commented

TL;DR

After running a scan, the remediation steps for a particular finding are double numbered. For example:

Remediation Steps:

  1. Note: The remediation steps apply to legacy branch protections, rules set-based protection should be updated from the rules set page
    1. Make sure you have admin permissions
    1. Go to the repo's settings page
    1. Enter 'Branches' tab
    1. Under 'Branch protection rules'
    1. Click 'Edit' on the default branch rule
    1. Check 'Require a pull request before merging'
    1. Check 'Require approvals'
    1. Set 'Required number of approvals before merging' to 1 or more
    1. Click 'Save changes'

Expected behavior

Only a single numbered list (like in v1.0.7)

Observed behavior

Remediation steps are double numbered

Version

1.0.8

On which operating system are you using legitify?

Linux

Relevant log output

No response

Additional information

Did not experience this in v1.0.7

royb-legit commented

Thanks @ajh-

  1. Did this happen for only one policy?
  2. Can you paste a few lines above the remediation steps (starting from the policy title)
  3. Can you attach logs?
royb-legit commented

@ajh- thanks to @sagic-orca your bug was fixed in version 1.0.9.

ajh- commented

@royb-legit @sagic-orca thanks for taking this on. I should've been more specific upfront. This happens for all policies when outputted as markdown. Unfortunately, just tested v1.0.9 and still have the same issue.

I'm assuming applying @sagic-orca's fix to formatter_markdown.go should also remediate my current issue?

royb-legit commented

@ajh- thanks for resurfacing this.
Version 1.0.10 should fix it, could you please check it?

ajh- commented

@royb-legit Perfect, just tested it and it looks like it is fixed. Thanks!

I will add, with this formatting update, the blockquote section is now displayed as multiple sections instead of being one contiguous section. Not the end of the world, but just wanted to let you know.

For example:

Default Branch Should Require Code Review ⛔

In order to comply with separation of duties principle and enforce secure code practices, a code review should be mandatory using the source-code-management system's built-in enforcement. This option is found in the branch protection setting of the repository.

Policy Name: code_review_not_required
Namespace: repository
Severity: HIGH ⛔

Threat:

  • Users can merge code without being reviewed, which can lead to insecure code reaching the main branch and production.

Remediation Steps:

Note: The remediation steps apply to legacy branch protections, rules set-based protection should be updated from the rules set page

  1. Make sure you have admin permissions
  2. Go to the repo's settings page
  3. Enter 'Branches' tab
  4. Under 'Branch protection rules'
  5. Click 'Edit' on the default branch rule
  6. Check 'Require a pull request before merging'
  7. Check 'Require approvals'
  8. Set 'Required number of approvals before merging' to 1 or more
  9. Click 'Save changes'

Violations:

Link to repository: https://test.com/test
Auxiliary Info:

  • Entity Id: 77
  • Entity Name: test