Gato-X as SAST

[satoridev01]

Hi,

Question, can Gato-X (similar situation for https://github.com/TinderSec/gh-workflow-auditor) be decoupled from the Github API to work as a SAST (like https://github.com/synacktiv/octoscan) ?

Thank you

[AdnaneKhan]

Hi,

It's something on my radar. The main limitation would be that Gato-X would not be able to resolve cross repository actions in this mode. The recent refactoring in the 1.0 release makes this a lot easier to offer as a feature.

In your use case would you be running it on one repository at a time or locally?

[satoridev01]

In my use case I would like to clone a repository on my current working directory and analyze it locally with Gato-X. For example:

git clone https://github.com/AdnaneKhan/Gato-X.git
gato-x e --local ./

[AdnaneKhan]

Okay, so that wouldn't be too tricky to add. I'll look into adding that feature. Do note Gato-X will not analyze any cross repo or cross org workflows/actions in this case.

[satoridev01]

Actually in my use case, my current working directory already has the repo directly accessible. I added a dot at the end of the git clone to use the actual cwd:

git clone https://github.com/AdnaneKhan/Gato-X.git .
gato-x e --local ./

[satoridev01]

I believe that a warning message could be printed at the beginning when using that mode.

Instead of:

[+] The authenticated user is: satoridev01
[!] The token has no scopes!
...

Something like:

[!] When running Gato-X in SAST mode, it will not be able to analyze any cross repo or cross org workflows/actions
...

[satoridev01]

...and I will also be checking before running Gato-X if the repositories go across organizations. I see the multiplication value of the risks identified for those cases:

$ curl -s "https://api.github.com/repos/AdnaneKhan/Gato-X" | jq .forks_count
33

I am also looking to privately share these reports & outputs with you to confirm if there is anything worth reporting.

[satoridev01]

(or fixing)

[satoridev01]

((Cool Defcon talk 👏 ))