Compare commits

..

2 Commits

Author SHA1 Message Date
undergroundwires
cfe5704328 Add more macOS scripts
TODO: https://github.com/usnistgov/macos_security/tree/main/rules
2022-10-12 17:08:53 +02:00
undergroundwires
d16846fa3c Add donation information 2022-03-03 00:27:48 +01:00
18 changed files with 2114 additions and 1814 deletions

View File

@@ -1,8 +0,0 @@
runs:
using: composite
steps:
-
name: Setup node
uses: actions/setup-node@v2
with:
node-version: 16.x

View File

@@ -18,7 +18,9 @@ jobs:
uses: actions/checkout@v2
-
name: Setup node
uses: ./.github/actions/setup-node
uses: actions/setup-node@v1
with:
node-version: 15.x
-
name: Install dependencies
run: npm ci
@@ -40,7 +42,9 @@ jobs:
uses: actions/checkout@v2
-
name: Setup node
uses: ./.github/actions/setup-node
uses: actions/setup-node@v1
with:
node-version: 15.x
-
name: Install dependencies
run: npm ci

View File

@@ -19,7 +19,9 @@ jobs:
- name: Checkout
uses: actions/checkout@v2
- name: Setup node
uses: ./.github/actions/setup-node
uses: actions/setup-node@v1
with:
node-version: 15.x
- name: Install dependencies
run: npm ci
- name: Lint

View File

@@ -16,7 +16,9 @@ jobs:
uses: actions/checkout@v2
-
name: Setup node
uses: ./.github/actions/setup-node
uses: actions/setup-node@v1
with:
node-version: 15.x
-
name: NPM audit
run: exit "$(npm audit)" # Since node 15.x, it does not fail with error if we don't explicitly exit

View File

@@ -20,7 +20,9 @@ jobs:
- name: Checkout to bump commit
run: git checkout "$(git rev-list "${{ github.event.release.tag_name }}"..master | tail -1)"
- name: Setup node
uses: ./.github/actions/setup-node
uses: actions/setup-node@v1
with:
node-version: 15.x
- name: Install dependencies
run: npm ci
- name: Run unit tests
@@ -29,4 +31,4 @@ jobs:
run: npm run electron:build -- -p always # https://nklayman.github.io/vue-cli-plugin-electron-builder/guide/recipes.html#upload-release-to-github
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
EP_GH_IGNORE_TIME: true # Otherwise publishing fails if GitHub release is more than 2 hours old https://github.com/electron-userland/electron-builder/issues/2074
EP_GH_IGNORE_TIME: true # Otherwise publishing fails if GitHub release is more than 2 hours old https://github.com/electron-userland/electron-builder/issues/2074

View File

@@ -1,8 +1,8 @@
name: release-site
on:
release:
types: [created] # will be triggered when a NON-draft release is created and published.
release:
types: [created] # will be triggered when a NON-draft release is created and published.
jobs:
aws-deploy: # see: https://github.com/undergroundwires/aws-static-site-with-cd
@@ -77,28 +77,30 @@ jobs:
name: "App: Checkout"
uses: actions/checkout@v2
with:
path: app
path: site
ref: master # otherwise we don't get version bump commit
-
name: "App: Setup node"
uses: ./app/.github/actions/setup-node
uses: actions/setup-node@v1
with:
node-version: 15.x
-
name: "App: Install dependencies"
run: npm ci
working-directory: app
working-directory: site
-
name: "App: Run unit tests"
run: npm run test:unit
working-directory: app
working-directory: site
-
name: "App: Build"
run: npm run build
working-directory: app
working-directory: site
-
name: "App: Deploy to S3"
run: >-
bash "aws/scripts/deploy/deploy-to-s3.sh" \
--folder app/dist \
--folder site/dist \
--web-stack-name privacysexy-web-stack --web-stack-s3-name-output-name S3BucketName \
--storage-class ONEZONE_IA \
--role-arn ${{secrets.AWS_S3_SITE_DEPLOYMENT_ROLE_ARN}} \

View File

@@ -17,7 +17,9 @@ jobs:
uses: actions/checkout@v2
-
name: Setup node
uses: ./.github/actions/setup-node
uses: actions/setup-node@v1
with:
node-version: 15.x
-
name: Install dependencies
run: npm ci

View File

@@ -19,7 +19,9 @@ jobs:
uses: actions/checkout@v2
-
name: Setup node
uses: ./.github/actions/setup-node
uses: actions/setup-node@v1
with:
node-version: 15.x
-
name: Install dependencies
run: npm ci

View File

@@ -16,8 +16,10 @@ jobs:
name: Checkout
uses: actions/checkout@v2
-
name: Set-up node
uses: ./.github/actions/setup-node
name: Setup node
uses: actions/setup-node@v1
with:
node-version: 15.x
-
name: Install dependencies
run: npm ci

View File

@@ -126,9 +126,9 @@ Online version does not require to run any software on your computer. Offline ve
## Support
**Sponsor 💕**. Consider sponsoring on [GitHub Sponsors](https://github.com/sponsors/undergroundwires), or you can donate using [other ways such as crypto or a coffee](https://undergroundwires.dev/donate).
**Sponsor 💕**. This project is free, and it might not be tempting to donate since you don't have to pay. But your donations will ensure that this project stays alive. A monthly coffee from you would make a difference. Recurring donations allow me to spend more time and resources on this project. Consider sponsoring on [GitHub Sponsors](https://github.com/sponsors/undergroundwires), or you can donate using [other ways such as crypto or a coffee](https://undergroundwires.dev/donate).
**Star 🤩**. Feel free to give it a star ⭐ .
**Star 🤩**. I know that not everyone can afford donating a coffee to show support. In this case, feel free to give it a star ⭐ . It helps me to see that you appreciate the project.
**Contribute 👷**. Contributions of any type are welcome. See [CONTRIBUTING.md](./CONTRIBUTING.md) as the starting point. It includes useful information like [how to add new scripts](./CONTRIBUTING.md#extend-scripts).

View File

@@ -12,9 +12,9 @@ Everything that's merged in the master goes directly to production.
privacy.sexy uses [GitHub actions](https://github.com/features/actions) to define and run pipelines as code.
GitHub workflows i.e. pipelines exist in [`/.github/workflows/`](./../.github/workflows/) folder without any subfolders due to GitHub actions requirements [1] .
GitHub workflows i.e. pipelines exist in [`/.github/.workflows/`](./../.github/workflows/) folder without any subfolders due to GitHub actions requirements [1] .
Local GitHub actions are defined in [`/.github/actions/`](./../.github/actions/) and used to reuse same workflow steps.
[1]: https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#about-yaml-syntax-for-workflows
## Pipeline types

3580
package-lock.json generated

File diff suppressed because it is too large Load Diff

View File

@@ -23,20 +23,20 @@
},
"main": "background.js",
"dependencies": {
"@fortawesome/fontawesome-svg-core": "^1.3.0",
"@fortawesome/free-brands-svg-icons": "^6.0.0",
"@fortawesome/free-regular-svg-icons": "^6.0.0",
"@fortawesome/free-solid-svg-icons": "^6.0.0",
"@fortawesome/fontawesome-svg-core": "^1.2.36",
"@fortawesome/free-brands-svg-icons": "^5.15.4",
"@fortawesome/free-regular-svg-icons": "^5.15.4",
"@fortawesome/free-solid-svg-icons": "^5.15.4",
"@fortawesome/vue-fontawesome": "^2.0.6",
"@juggle/resize-observer": "^3.3.1",
"ace-builds": "^1.4.14",
"core-js": "^3.21.1",
"cross-fetch": "^3.1.5",
"ace-builds": "^1.4.13",
"core-js": "^3.18.3",
"cross-fetch": "^3.1.4",
"electron-progressbar": "^2.0.1",
"file-saver": "^2.0.5",
"install": "^0.13.0",
"liquor-tree": "^0.2.70",
"npm": "^8.5.3",
"npm": "^8.1.1",
"v-tooltip": "2.1.3",
"vue": "^2.6.14",
"vue-class-component": "^7.2.6",
@@ -44,50 +44,49 @@
"vue-property-decorator": "^9.1.2"
},
"devDependencies": {
"@types/ace": "^0.0.48",
"@types/chai": "^4.3.0",
"@types/file-saver": "^2.0.5",
"@types/mocha": "^9.1.0",
"@typescript-eslint/eslint-plugin": "^5.13.0",
"@typescript-eslint/parser": "^5.13.0",
"@vue/cli-plugin-babel": "~5.0.1",
"@vue/cli-plugin-e2e-cypress": "~5.0.1",
"@vue/cli-plugin-eslint": "~5.0.1",
"@vue/cli-plugin-typescript": "~5.0.1",
"@vue/cli-plugin-unit-mocha": "~5.0.1",
"@vue/cli-service": "~5.0.1",
"@types/ace": "0.0.47",
"@types/chai": "^4.2.22",
"@types/file-saver": "^2.0.3",
"@types/mocha": "^9.0.0",
"@typescript-eslint/eslint-plugin": "^5.4.0",
"@typescript-eslint/parser": "^5.4.0",
"@vue/cli-plugin-babel": "~5.0.0-rc.1",
"@vue/cli-plugin-e2e-cypress": "~5.0.0-rc.1",
"@vue/cli-plugin-eslint": "~5.0.0-rc.1",
"@vue/cli-plugin-typescript": "~5.0.0-rc.1",
"@vue/cli-plugin-unit-mocha": "~5.0.0-rc.1",
"@vue/cli-service": "~5.0.0-rc.1",
"@vue/eslint-config-airbnb": "^6.0.0",
"@vue/eslint-config-typescript": "^10.0.0",
"@vue/test-utils": "1.3.0",
"chai": "^4.3.6",
"cypress": "^9.5.1",
"electron": "^17.1.0",
"@vue/eslint-config-typescript": "^9.1.0",
"@vue/test-utils": "1.2.2",
"chai": "^4.3.4",
"cypress": "^8.3.0",
"electron": "^15.3.0",
"electron-builder": "^22.14.13",
"electron-devtools-installer": "^3.2.0",
"electron-log": "^4.4.6",
"electron-updater": "^5.0.0",
"eslint": "7.32.0",
"eslint-plugin-import": "^2.25.4",
"eslint-plugin-vue": "^8.5.0",
"eslint-plugin-vuejs-accessibility": "^1.1.1",
"electron-log": "^4.4.1",
"electron-updater": "^4.3.9",
"eslint": "^7.32.0",
"eslint-plugin-import": "^2.25.3",
"eslint-plugin-vue": "^8.0.3",
"eslint-plugin-vuejs-accessibility": "^1.1.0",
"js-yaml-loader": "^1.2.2",
"markdownlint-cli": "^0.31.1",
"remark-cli": "^10.0.1",
"markdownlint-cli": "^0.29.0",
"remark-cli": "^10.0.0",
"remark-lint-no-dead-urls": "^1.1.0",
"remark-preset-lint-consistent": "^5.1.1",
"remark-validate-links": "^11.0.2",
"sass": "^1.49.9",
"sass-loader": "^12.6.0",
"remark-preset-lint-consistent": "^5.1.0",
"remark-validate-links": "^11.0.1",
"sass": "^1.43.3",
"sass-loader": "10.2.0",
"ts-loader": "9.0.1",
"tslib": "^2.3.1",
"typescript": "^4.6.2",
"typescript": "^4.4.4",
"vue-cli-plugin-electron-builder": "^2.1.1",
"vue-template-compiler": "^2.6.14",
"yaml-lint": "^1.2.4"
},
"//devDependencies": {
"ts-loader": "Here as workaround for vue-cli-plugin-electron-builder using older webpack 4",
"eslint": "Stuck at 7.32.0 because Vue CLI not supporting 8.x.x"
"ts-loader": "Here as workaround for vue-cli-plugin-electron-builder using older webpack 4"
},
"homepage": "https://privacy.sexy",
"repository": {

View File

@@ -509,6 +509,37 @@ actions:
function: PersistUserEnvironmentConfiguration
parameters:
configuration: export POWERSHELL_TELEMETRY_OPTOUT=1
-
category: Configure Parallels
children:
-
name: Turn off ads in Parallels
docs: https://hints.macworld.com/article.php?story=20120724235352514
# Check: defaults read 'com.parallels.Parallels Desktop' 'ProductPromo.ForcePromoOff'
code: defaults write 'com.parallels.Parallels Desktop' 'ProductPromo.ForcePromoOff' -bool yes
# Default: 0 (no)
revertCode: defaults write 'com.parallels.Parallels Desktop' 'ProductPromo.ForcePromoOff' -bool no
# There's more settings but they're off (has value "1" by default):
# WelcomeScreenPromo.PromoOff (default 1)
# NotificationPromo.6635.PromoOff (default 1)
-
category: Disable Parallels auto-updates
children:
-
name: Disable automatically downloading Parallels updates
docs: https://download.parallels.com/desktop/v17/docs/en_US/Parallels-Desktop-Business-Edition-Administrators-Guide/37744.htm
# Check: defaults read 'com.parallels.Parallels Desktop' 'Application preferences.Download updates automatically'
code: defaults write 'com.parallels.Parallels Desktop' 'Application preferences.Download updates automatically' -bool no
# Default: 1 (enabled)
revertCode: defaults write 'com.parallels.Parallels Desktop' 'Application preferences.Download updates automatically' -bool yes
-
name: Disable automatically checking for Parallels updates
docs: https://download.parallels.com/desktop/v17/docs/en_US/Parallels-Desktop-Business-Edition-Administrators-Guide/37744.htm
# Check: defaults read 'com.parallels.Parallels Desktop' 'Application preferences.Check for updates'
# Values: 0 - Never, 1 - Once a day, 2 - Once a week, 3 - Once a month
code: defaults write 'com.parallels.Parallels Desktop' 'Application preferences.Check for updates' -int 0
# Default: 2 (once a week)
revertCode: defaults write 'com.parallels.Parallels Desktop' 'Application preferences.Check for updates' -int 2
-
category: Configure OS
children:
@@ -638,6 +669,52 @@ actions:
name: Disable Spotlight indexing
code: sudo mdutil -i off -d /
revertCode: sudo mdutil -i on /
-
category: Configure crash reporting (quit dialog after an application crash)
# Prompts for sending data to Apple
children:
-
name: Disable Crash reporting
# Quit dialog after an application crash
# "The application <application> has unexpectedly quit" alert
docs:
# Since 10.4 (Basic, Developer, and Server)
- https://web.archive.org/web/20090411195107/http://developer.apple.com/qa/qa2001/qa1288.html
# Before 10.4
# "none" = Don't show any dialog at all (crash reports are still silently written to disk)
# "prompt" = show the unexpectedly quit dialog and prompt to see if the user wants to submit/view the crashreport
# "crashreport" = don't show the unexpectedly quit dialog - instead immediately show the crashreport/submission screen.
- https://web.archive.org/web/20040816171016/http://developer.apple.com/qa/qa2001/qa1288.html
# Description for crashreporter preferences (basic, developer, server), stating basic is the default one
# https://web.archive.org/web/20090228102631/http://developer.apple.com/technotes/tn2004/tn2123.html#SECCRASHREPORTERPREFS
# Check: defaults read 'com.apple.CrashReporter' 'DialogType'
# Values: none|basic (default)|developer|server (before 10.4: crashreport|none)
code: defaults write 'com.apple.CrashReporter' 'DialogType' -string 'none'
revertCode: |- # TODO: Or delete? Since monterey com.apple.CrashReporter is empty
os_major_ver=$(sw_vers -productVersion | awk -F "." '{print $1}')
os_minor_ver=$(sw_vers -productVersion | awk -F "." '{print $2}')
# Older (before 10.4): prompt|crashreport
if [[ $os_major_ver -le 10 \
|| ( $os_major_ver -eq 10 && $os_minor_ver -le 4 ) \
]]; then
defaults write 'com.apple.CrashReporter' 'DialogType' -string 'prompt'
else
# Newer (since 10.4): basic|developer|server
defaults write 'com.apple.CrashReporter' 'DialogType' -string 'basic'
fi
-
name: Use notification instead of report after crash
docs:
# Removing the Crash Reporter may be overkill for some users, so another option is to
# change this to a notification instead.
# The advantage of this is you still get notified if an app has crashed, but you don't
# have to respond in any way (nothing to click on). To undo this change you would use the
# same entry but replace the 1 with a 0.
- https://www.defaults-write.com/os-x-make-crash-reporter-appear-as-a-notification/
- https://osxdaily.com/2015/10/13/set-crash-reporter-as-notification-mac-os-x/
code: defaults write 'com.apple.CrashReporter' 'UseUNC' 1
revertCode: |- # TODO: Or delete? Since monterey com.apple.CrashReporter is empty
defaults write 'com.apple.CrashReporter' 'UseUNC' 1
-
category: Security improvements
children:
@@ -1076,6 +1153,106 @@ actions:
sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate 'CriticalUpdateInstall' -bool true
# Trigger background check with normal scan (critical updates only)
sudo softwareupdate --background-critical
-
category: UI for privacy
children:
-
name: Show hidden files in Finder
recommend: strict # Because NIST recommends it
docs:
# Disables hiding files `.htaccess` in Finder
- https://macos-defaults.com/finder/appleshowallfiles.html
# Securing Apple OSX X 10.10 Systems: NIST Security Configuration Checklist:
# Finder should be configured to not show hidden files and folders; this is already configured by
# default. Finder should also be configured to show file extensions, to show a warning before
# changing a file extension or emptying the trash, and to search this system when performing a
# search. Administrators with intimate knowledge of the OS X system could notice unusual hidden
# files and would benefit from their visibility. Consequently, hidden files should be displayed in an
# SSLF environment. These options can improve defenses against malware. To configure these
# options, go to Finder / Preferences / Advanced; then enable the corresponding options.
- https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-179.pdf
# Check: defaults read 'com.apple.finder' 'AppleShowAllFiles' (expect: 'TRUE', 'FALSE', or key not exists (default in Monterey))
code: |-
killall cfprefsd
defaults write 'com.apple.finder' 'AppleShowAllFiles' -bool true
killall 'Finder'
revertCode: |-
killall cfprefsd
defaults delete 'com.apple.finder' 'AppleShowAllFiles'
killall 'Finder'
-
name: Hide Desktop icons
docs: https://www.defaults-write.com/os-x-how-to-quickly-hide-the-desktop-icons/
# When doing presentations, it can be useful to hide desktop icons
# Check: defaults read 'com.apple.finder' 'CreateDesktop' (expect: 'TRUE', 'FALSE', or key not exists (default in Monterey))
code: |-
killall cfprefsd
defaults write 'com.apple.finder' 'CreateDesktop' -bool false
killall Finder
revertCode: |-
killall cfprefsd
defaults delete 'com.apple.finder' 'CreateDesktop'
killall Finder
# TODO: https://github.com/mathiasbynens/dotfiles/blob/main/.macos
# defaults write com.apple.finder ShowExternalHardDrivesOnDesktop -bool false
# defaults write com.apple.finder ShowHardDrivesOnDesktop -bool false
# defaults write com.apple.finder ShowMountedServersOnDesktop -bool false
# defaults write com.apple.finder ShowRemovableMediaOnDesktop -bool false
-
name: Show all filename extensions # TODO: docs from https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-179.pdf
# Check: defaults read 'NSGlobalDomain' 'AppleShowAllExtensions' (expect: 'TRUE', 'FALSE', or key not exists (default in Monterey))
code: |-
killall cfprefsd
defaults write 'NSGlobalDomain' 'AppleShowAllExtensions' -bool true
killall Finder
revertCode: |-
killall cfprefsd
defaults delete 'NSGlobalDomain' 'AppleShowAllExtensions'
killall Finder
-
name: show path bar
# TODO: defaults write com.apple.finder ShowPathbar -bool true
-
category: Disable creation of metadata files (`.DS_Store`) # TODO: A better category
# macOS creates metadata files as and when files are saved to the hard drive.
# These metadata files can also be viewed further giving malicious actors the extra edge.
# It is recommended that Mac OS X users disable creation of Metadata Files to further boost the
# privacy levels.
children:
-
name: Disable metadata files (`.DS_Store`) on Network Volumes
recommend: strict
docs:
- https://support.apple.com/en-us/HT208209
- https://web.archive.org/web/20190919161732/https://support.apple.com/en-gb/HT1629
# Check: defaults read 'com.apple.desktopservices' 'DSDontWriteNetworkStores' (expect: 'TRUE', 'FALSE', or key not exists (default in Monterey))
code: defaults write 'com.apple.desktopservices' 'DSDontWriteNetworkStores' -bool true
revertCode: defaults delete 'com.apple.desktopservices' 'DSDontWriteNetworkStores'
-
name: Disable metadata files (`.DS_Store`) on USB Volumes
recommend: strict
docs: https://krypted.com/mac-security/disable-dsstore-files-on-usb-drives/
# Check: defaults read 'com.apple.desktopservices' 'DSDontWriteUSBStores' (expect: 'TRUE', 'FALSE', or key not exists (default in Monterey))
code: defaults write 'com.apple.desktopservices' 'DSDontWriteUSBStores' -bool true
revertCode: defaults delete 'com.apple.desktopservices' 'DSDontWriteUSBStores'
-
name: Clear created metadata files # TODO: Not tested
code: |- # "fstype local to search only on the local mounted file system and ignore any other mounted disk under
find ~ \
-type f \
-name .DS_Store \
-fstype local \
-exec \
sh -c \
'
file="{}"
rm -fv "$file"
' \
{} \;
functions:
-
name: PersistUserEnvironmentConfiguration
@@ -1106,3 +1283,9 @@ functions:
echo "[$profile_file] No need for any action, configuration does not exist"
fi
done
# TODO:
# Disable disk image verification (or do enable)
# defaults write com.apple.frameworks.diskimages skip-verify -bool true
# defaults write com.apple.frameworks.diskimages skip-verify-locked -bool true
# defaults write com.apple.frameworks.diskimages skip-verify-remote -bool true

View File

@@ -2,8 +2,8 @@ import { IProjectInformation } from '@/domain/IProjectInformation';
import { ICodeSubstituter } from '@/application/Parser/ScriptingDefinition/ICodeSubstituter';
export class CodeSubstituterStub implements ICodeSubstituter {
private readonly scenarios = new Array<{
code: string, info: IProjectInformation, result: string }>();
private readonly scenarios =
new Array<{ code: string, info: IProjectInformation, result: string }>();
public substitute(code: string, info: IProjectInformation): string {
const scenario = this.scenarios.find((s) => s.code === code && s.info === info);

View File

@@ -1,8 +1,8 @@
import { IEnumParser } from '@/application/Common/Enum';
export class EnumParserStub<T> implements IEnumParser<T> {
private readonly scenarios = new Array<{
inputName: string, inputValue: string, outputValue: T }>();
private readonly scenarios =
new Array<{ inputName: string, inputValue: string, outputValue: T }>();
private defaultValue: T;

View File

@@ -5,8 +5,8 @@ import { ISharedFunction } from '@/application/Parser/Script/Compiler/Function/I
import { FunctionCallArgumentCollectionStub } from '@tests/unit/shared/Stubs/FunctionCallArgumentCollectionStub';
export class ExpressionsCompilerStub implements IExpressionsCompiler {
public readonly callHistory = new Array<{
code: string, parameters: IReadOnlyFunctionCallArgumentCollection }>();
public readonly callHistory =
new Array<{ code: string, parameters: IReadOnlyFunctionCallArgumentCollection }>();
private readonly scenarios = new Array<ITestScenario>();

View File

@@ -5,8 +5,8 @@ import { IEventSource } from '@/infrastructure/Events/IEventSource';
import { EventSource } from '@/infrastructure/Events/EventSource';
export class UserSelectionStub implements IUserSelection {
public readonly changed: IEventSource<readonly SelectedScript[]> = new EventSource<
readonly SelectedScript[]>();
public readonly changed: IEventSource<readonly SelectedScript[]> =
new EventSource<readonly SelectedScript[]>();
public selectedScripts: readonly SelectedScript[] = [];